##// END OF EJS Templates
Raspi2-3_GenImage
RSS

Cloner depuis https://github.com/drtyhlpr/rpi23-gen-image.git

apparmor
Unknown -
r497:f13e9b47cfc2
parent child
Show More
Show file before | Show file after | Hide comments
@@ -1,530 +1,532
1 1 # rpi23-gen-image
2 2 ## Introduction
3 3 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for all Raspberry Pi computers. The script at this time supports the bootstrapping of the Debian (armhf/armel) releases `stretch` and `buster`. Raspberry Pi 0/1/2/3 images are generated for 32-bit mode only. Raspberry Pi 3 supports 64-bit images that can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.14.y```).
4 4
5 5 ## Build dependencies
6 6 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
7 7
8 8 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
9 9
10 10 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the Raspberry 3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf/armel) cross-compiler toolchain.
11 11
12 12 The script has been tested using the default `crossbuild-essential-armhf` and `crossbuild-essential-armel` toolchain meta packages on Debian Linux `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
13 13
14 14 ## Command-line parameters
15 15 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
16 16
17 17 ##### Command-line examples:
18 18 ```shell
19 19 ENABLE_UBOOT=true ./rpi23-gen-image.sh
20 20 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
21 21 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
22 22 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
23 23 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
24 24 ENABLE_MINBASE=true ./rpi23-gen-image.sh
25 25 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
26 26 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
27 27 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
28 28 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
29 29 RELEASE=stretch BUILD_KERNEL=true ./rpi23-gen-image.sh
30 30 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
31 31 RELEASE=stretch RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
32 32 ```
33 33
34 34 ## Configuration template files
35 35 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
36 36
37 37 ##### Command-line examples:
38 38 ```shell
39 39 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
40 40 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
41 41 ```
42 42
43 43 ## Supported parameters and settings
44 44 #### APT settings:
45 45 ##### `APT_SERVER`="ftp.debian.org/debian"
46 46 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
47 47
48 48 ##### `APT_PROXY`=""
49 49 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once. If `apt-cacher-ng` is running on default `http://127.0.0.1:3142` it is autodetected and you don't need to set this.
50 50
51 51 ##### `APT_INCLUDES`=""
52 52 A comma-separated list of additional packages to be installed by debootstrap during bootstrapping.
53 53
54 54 ##### `APT_INCLUDES_LATE`=""
55 55 A comma-separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.
56 56
57 57 ---
58 58
59 59 #### General system settings:
60 60 ##### `SET_ARCH`=32
61 61 Set Architecture to default 32bit. If you want to compile 64-bit (RPI3 or RPI3+) set it to `64`. This option will set every needed cross-compiler or board specific option for a successful build.
62 62
63 63 ##### `RPI_MODEL`=2
64 64 Specify the target Raspberry Pi hardware model. The script at this time supports the following Raspberry Pi models:
65 65 - `0` = Raspberry Pi 0 and Raspberry Pi 0 W
66 66 - `1` = Raspberry Pi 1 model A and B
67 67 - `1P` = Raspberry Pi 1 model B+ and A+
68 68 - `2` = Raspberry Pi 2 model B
69 69 - `3` = Raspberry Pi 3 model B
70 70 - `3P` = Raspberry Pi 3 model B+
71 71
72 72 ##### `RELEASE`="buster"
73 73 Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases `stretch` and `buster`.
74 74
75 75 ##### `RELEASE_ARCH`="armhf"
76 76 Set the desired Debian release architecture.
77 77
78 78 ##### `HOSTNAME`="rpi$RPI_MODEL-$RELEASE"
79 79 Set system hostname. It's recommended that the hostname is unique in the corresponding subnet.
80 80
81 81 ##### `PASSWORD`="raspberry"
82 82 Set system `root` password. It's **STRONGLY** recommended that you choose a custom password.
83 83
84 84 ##### `USER_PASSWORD`="raspberry"
85 85 Set password for the created non-root user `USER_NAME`=pi. Ignored if `ENABLE_USER`=false. It's **STRONGLY** recommended that you choose a custom password.
86 86
87 87 ##### `DEFLOCAL`="en_US.UTF-8"
88 88 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.
89 89
90 90 ##### `TIMEZONE`="Europe/Berlin"
91 91 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
92 92
93 93 ##### `EXPANDROOT`=true
94 94 Expand the root partition and filesystem automatically on first boot.
95 95
96 96 ##### `ENABLE_QEMU`=false
97 97 Generate kernel (`vexpress_defconfig`), file system image (`qcow2`) and DTB files that can be used for QEMU full system emulation (`vexpress-A15`). The output files are stored in the `$(pwd)/images/qemu` directory. You can find more information about running the generated image in the QEMU section of this readme file.
98 98
99 99 ---
100 100
101 101 #### Keyboard settings:
102 102 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
103 103
104 104 ##### `XKB_MODEL`=""
105 105 Set the name of the model of your keyboard type.
106 106
107 107 ##### `XKB_LAYOUT`=""
108 108 Set the supported keyboard layout(s).
109 109
110 110 ##### `XKB_VARIANT`=""
111 111 Set the supported variant(s) of the keyboard layout(s).
112 112
113 113 ##### `XKB_OPTIONS`=""
114 114 Set extra xkb configuration options.
115 115
116 116 ---
117 117
118 118 #### Networking settings (DHCP):
119 119 This parameter is used to set up networking auto-configuration in `/etc/systemd/network/eth.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
120 120
121 121 ##### `ENABLE_DHCP`=true
122 122 Set the system to use DHCP. This requires an DHCP server.
123 123
124 124 ---
125 125
126 126 #### Networking settings (static):
127 127 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth.network`. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
128 128
129 129 ##### `NET_ADDRESS`=""
130 130 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
131 131
132 132 ##### `NET_GATEWAY`=""
133 133 Set the IP address for the default gateway.
134 134
135 135 ##### `NET_DNS_1`=""
136 136 Set the IP address for the first DNS server.
137 137
138 138 ##### `NET_DNS_2`=""
139 139 Set the IP address for the second DNS server.
140 140
141 141 ##### `NET_DNS_DOMAINS`=""
142 142 Set the default DNS search domains to use for non fully qualified hostnames.
143 143
144 144 ##### `NET_NTP_1`=""
145 145 Set the IP address for the first NTP server.
146 146
147 147 ##### `NET_NTP_2`=""
148 148 Set the IP address for the second NTP server.
149 149
150 150 ---
151 151
152 152 #### Basic system features:
153 153 ##### `ENABLE_CONSOLE`=true
154 154 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system. On RPI `0` `3` `3P` the CPU speed is locked at lowest speed.
155 155
156 156 ##### `ENABLE_PRINTK`=false
157 157 Enables printing kernel messages to konsole. printk is `3 4 1 3` as in raspbian.
158 158
159 159 ##### `ENABLE_BLUETOOTH`=false
160 160 Enable onboard Bluetooth interface on the RPi0/3/3P. See: [Configuring the GPIO serial port on Raspbian jessie and stretch](https://spellfoundry.com/2016/05/29/configuring-gpio-serial-port-raspbian-jessie-including-pi-3/).
161 161
162 162 ##### `ENABLE_MINIUART_OVERLAY`=false
163 163 Enable Bluetooth to use this. Adds overlay to swap UART0 with UART1. Enabling (slower) Bluetooth and full speed serial console. - RPI `0` `3` `3P` have a fast `hardware UART0` (ttyAMA0) and a `mini UART1` (ttyS0)! RPI `1` `1P` `2` only have a `hardware UART0`. `UART0` is considered better, because is faster and more stable than `mini UART1`. By default the Bluetooth modem is mapped to the `hardware UART0` and `mini UART` is used for console. The `mini UART` is a problem for the serial console, because its baudrate depends on the CPU frequency, which is changing on runtime. Resulting in a volatile baudrate and thus in an unusable serial console.
164 164
165 165 ##### `ENABLE_TURBO`=false
166 166 Enable Turbo mode. This setting locks cpu at the highest frequency. As setting ENABLE_CONSOLE=true locks RPI to lowest CPU speed, this is can be used additionally to lock cpu hat max speed. Need a good power supply and probably cooling for the Raspberry PI.
167 167
168 168 ##### `ENABLE_I2C`=false
169 169 Enable I2C interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
170 170
171 171 ##### `ENABLE_SPI`=false
172 172 Enable SPI interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
173 173
174 174 ##### `ENABLE_IPV6`=true
175 175 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
176 176
177 177 ##### `ENABLE_SSHD`=true
178 178 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
179 179
180 180 ##### `ENABLE_NONFREE`=false
181 181 Allow the installation of non-free Debian packages that do not comply with the DFSG. This is required to install closed-source firmware binary blobs.
182 182
183 183 ##### `ENABLE_WIRELESS`=false
184 184 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `3`.
185 185
186 186 ##### `ENABLE_RSYSLOG`=true
187 187 If set to false, disable and uninstall rsyslog (so logs will be available only in journal files)
188 188
189 189 ##### `ENABLE_SOUND`=true
190 190 Enable sound hardware and install Advanced Linux Sound Architecture.
191 191
192 192 ##### `ENABLE_HWRANDOM`=true
193 193 Enable Hardware Random Number Generator. Strong random numbers are important for most network-based communications that use encryption. It's recommended to be enabled.
194 194
195 195 ##### `ENABLE_MINGPU`=false
196 196 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
197 197
198 198 ##### `ENABLE_DBUS`=true
199 199 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
200 200
201 201 ##### `ENABLE_XORG`=false
202 202 Install Xorg open-source X Window System.
203 203
204 204 ##### `ENABLE_WM`=""
205 205 Install a user-defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi23-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
206 206
207 207 ##### `ENABLE_SYSVINIT`=false
208 208 Support for halt,init,poweroff,reboot,runlevel,shutdown,telinit commands
209 209
210 210 ---
211 211
212 212 #### Advanced system features:
213 213 ##### `ENABLE_SYSTEMDSWAP`=false
214 214 Enables [Systemd-swap service](https://github.com/Nefelim4ag/systemd-swap). Usefull if `KERNEL_ZSWAP` is enabled.
215 215
216 216 ##### `ENABLE_MINBASE`=false
217 217 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
218 218
219 219 ##### `ENABLE_REDUCE`=false
220 220 Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
221 221
222 222 ##### `ENABLE_UBOOT`=false
223 223 Replace the default RPi 0/1/2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](https://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol.
224 224
225 225 ##### `UBOOTSRC_DIR`=""
226 226 Path to a directory (`u-boot`) of [U-Boot bootloader sources](https://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot.
227 227
228 228 ##### `ENABLE_FBTURBO`=false
229 229 Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
230 230
231 231 ##### `FBTURBOSRC_DIR`=""
232 232 Path to a directory (`xf86-video-fbturbo`) of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot.
233 233
234 234 ##### `ENABLE_VIDEOCORE`=false
235 235 Install and enable the [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) `vcgencmd`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
236 236
237 237 ##### `VIDEOCORESRC_DIR`=""
238 238 Path to a directory (`userland`) of [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
239 239
240 240 ##### `ENABLE_NEXMON`=false
241 241 Install and enable the [Source code for a C-based firmware patching framework for Broadcom/Cypress WiFi chips that enables you to write your own firmware patches, for example, to enable monitor mode with radiotap headers and frame injection](https://github.com/seemoo-lab/nexmon.git).
242 242
243 243 ##### `NEXMONSRC_DIR`=""
244 244 Path to a directory (`nexmon`) of [Source code for ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
245 245
246 246 ##### `ENABLE_IPTABLES`=false
247 247 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
248 248
249 249 ##### `ENABLE_USER`=true
250 250 Create non-root user with password `USER_PASSWORD`=raspberry. Unless overridden with `USER_NAME`=user, the username will be `pi`.
251 251
252 252 ##### `USER_NAME`=pi
253 253 Non-root user to create. Ignored if `ENABLE_USER`=false
254 254
255 255 ##### `ENABLE_ROOT`=false
256 256 Set root user password so root login will be enabled
257 257
258 258 ##### `ENABLE_HARDNET`=false
259 259 Enable IPv4/IPv6 network stack hardening settings.
260 260
261 261 ##### `ENABLE_SPLITFS`=false
262 262 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
263 263
264 264 ##### `CHROOT_SCRIPTS`=""
265 265 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
266 266
267 267 ##### `ENABLE_INITRAMFS`=false
268 268 Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
269 269
270 270 ##### `ENABLE_IFNAMES`=true
271 271 Enable automatic assignment of predictable, stable network interface names for all local Ethernet, WLAN interfaces. This might create complex and long interface names.
272 272
273 273 ##### `DISABLE_UNDERVOLT_WARNINGS`=
274 274 Disable RPi2/3 under-voltage warnings and overlays. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present.
275 275
276 276 ---
277 277
278 278 #### SSH settings:
279 279 ##### `SSH_ENABLE_ROOT`=false
280 280 Enable password-based root login via SSH. This may be a security risk with the default password set, use only in trusted environments. `ENABLE_ROOT` must be set to `true`.
281 281
282 282 ##### `SSH_DISABLE_PASSWORD_AUTH`=false
283 283 Disable password-based SSH authentication. Only public key based SSH (v2) authentication will be supported.
284 284
285 285 ##### `SSH_LIMIT_USERS`=false
286 286 Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true).
287 287
288 288 ##### `SSH_ROOT_PUB_KEY`=""
289 289 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
290 290
291 291 ##### `SSH_USER_PUB_KEY`=""
292 292 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
293 293
294 294 ---
295 295
296 296 #### Kernel compilation:
297 297 ##### `BUILD_KERNEL`=true
298 298 Build and install the latest RPi 0/1/2/3 Linux kernel. Currently only the default RPi 0/1/2/3 kernel configuration is used.
299 299
300 300 ##### `CROSS_COMPILE`="arm-linux-gnueabihf-"
301 301 This sets the cross-compile environment for the compiler.
302 302
303 303 ##### `KERNEL_ARCH`="arm"
304 304 This sets the kernel architecture for the compiler.
305 305
306 306 ##### `KERNEL_IMAGE`="kernel7.img"
307 307 Name of the image file in the boot partition. If not set, `KERNEL_IMAGE` will be set to "kernel8.img" automatically if building for arm64.
308 308
309 309 ##### `KERNEL_BRANCH`=""
310 310 Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site.
311 311
312 312 ##### `QEMU_BINARY`="/usr/bin/qemu-arm-static"
313 313 Sets the QEMU enviornment for the Debian archive. If not set, `QEMU_BINARY` will be set to "/usr/bin/qemu-aarch64-static" automatically if building for arm64.
314 314
315 315 ##### `KERNEL_DEFCONFIG`="bcm2709_defconfig"
316 316 Sets the default config for kernel compiling. If not set, `KERNEL_DEFCONFIG` will be set to "bcmrpi3\_defconfig" automatically if building for arm64.
317 317
318 318 ##### `KERNEL_REDUCE`=false
319 319 Reduce the size of the generated kernel by removing unwanted devices, network and filesystem drivers (experimental).
320 320
321 321 ##### `KERNEL_THREADS`=1
322 322 Number of parallel kernel building threads. If the parameter is left untouched the script will automatically determine the number of CPU cores to set the number of parallel threads to speed the kernel compilation.
323 323
324 324 ##### `KERNEL_HEADERS`=true
325 325 Install kernel headers with the built kernel.
326 326
327 327 ##### `KERNEL_MENUCONFIG`=false
328 328 Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated.
329 329
330 330 ##### `KERNEL_OLDDEFCONFIG`=false
331 331 Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values.
332 332
333 333 ##### `KERNEL_CCACHE`=false
334 334 Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again.
335 335
336 336 ##### `KERNEL_REMOVESRC`=true
337 337 Remove all kernel sources from the generated OS image after it was built and installed.
338 338
339 339 ##### `KERNELSRC_DIR`=""
340 340 Path to a directory (`linux`) of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
341 341
342 342 ##### `KERNELSRC_CLEAN`=false
343 343 Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
344 344
345 345 ##### `KERNELSRC_CONFIG`=true
346 346 Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
347 347
348 348 ##### `KERNELSRC_USRCONFIG`=""
349 349 Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy.
350 350
351 351 ##### `KERNELSRC_PREBUILT`=false
352 352 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
353 353
354 354 ##### `RPI_FIRMWARE_DIR`=""
355 355 The directory (`firmware`) containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project.
356 356
357 357 ##### `KERNEL_DEFAULT_GOV`="ONDEMAND"
358 358 Set the default cpu governor at kernel compilation. Supported values are: PERFORMANCE POWERSAVE USERSPACE ONDEMAND CONSERVATIVE SCHEDUTIL
359 359
360 360 ##### `KERNEL_NF`=false
361 361 Enable Netfilter modules as kernel modules
362 362
363 363 ##### `KERNEL_VIRT`=false
364 364 Enable Kernel KVM support (/dev/kvm)
365 365
366 366 ##### `KERNEL_ZSWAP`=false
367 367 Enable Kernel Zswap support. Best use on high RAM load and mediocre CPU load usecases
368 368
369 369 ##### `KERNEL_BPF`=true
370 370 Allow attaching eBPF programs to a cgroup using the bpf syscall (CONFIG_BPF_SYSCALL CONFIG_CGROUP_BPF) [systemd compilations about it - File /lib/systemd/system/systemd-journald.server:36 configures an IP firewall (IPAddressDeny=all), but the local system does not support BPF/cgroup based firewalls]
371 371
372 ##### `KERNEL_SECURITY`=false
373 Enables Apparmor, integrity subsystem, auditing
372 374 ---
373 375
374 376 #### Reduce disk usage:
375 377 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
376 378
377 379 ##### `REDUCE_APT`=true
378 380 Configure APT to use compressed package repository lists and no package caching files.
379 381
380 382 ##### `REDUCE_DOC`=true
381 383 Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations.
382 384
383 385 ##### `REDUCE_MAN`=true
384 386 Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations.
385 387
386 388 ##### `REDUCE_VIM`=false
387 389 Replace `vim-tiny` package by `levee` a tiny vim clone.
388 390
389 391 ##### `REDUCE_BASH`=false
390 392 Remove `bash` package and switch to `dash` shell (experimental).
391 393
392 394 ##### `REDUCE_HWDB`=true
393 395 Remove PCI related hwdb files (experimental).
394 396
395 397 ##### `REDUCE_SSHD`=true
396 398 Replace `openssh-server` with `dropbear`.
397 399
398 400 ##### `REDUCE_LOCALE`=true
399 401 Remove all `locale` translation files.
400 402
401 403 ---
402 404
403 405 #### Encrypted root partition:
404 406 ##### `ENABLE_CRYPTFS`=false
405 407 Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
406 408
407 409 ##### `CRYPTFS_PASSWORD`=""
408 410 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
409 411
410 412 ##### `CRYPTFS_MAPPING`="secure"
411 413 Set name of dm-crypt managed device-mapper mapping.
412 414
413 415 ##### `CRYPTFS_CIPHER`="aes-xts-plain64:sha512"
414 416 Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
415 417
416 418 ##### `CRYPTFS_XTSKEYSIZE`=512
417 419 Sets key size in bits. The argument has to be a multiple of 8.
418 420
419 421 ##### `CRYPTFS_DROPBEAR`=false
420 422 Enable Dropbear Initramfs support
421 423
422 424 ##### `CRYPTFS_DROPBEAR_PUBKEY`=""
423 425 Provide path to dropbear Public RSA-OpenSSH Key
424 426
425 427 ---
426 428
427 429 #### Build settings:
428 430 ##### `BASEDIR`=$(pwd)/images/${RELEASE}
429 431 Set a path to a working directory used by the script to generate an image.
430 432
431 433 ##### `IMAGE_NAME`=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}
432 434 Set a filename for the output file(s). Note: the script will create $IMAGE_NAME.img if `ENABLE_SPLITFS`=false or $IMAGE_NAME-frmw.img and $IMAGE_NAME-root.img if `ENABLE_SPLITFS`=true. Note 2: If the KERNEL_BRANCH is not set, the word "CURRENT" is used.
433 435
434 436 ## Understanding the script
435 437 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
436 438
437 439 | Script | Description |
438 440 | --- | --- |
439 441 | `10-bootstrap.sh` | Debootstrap basic system |
440 442 | `11-apt.sh` | Setup APT repositories |
441 443 | `12-locale.sh` | Setup Locales and keyboard settings |
442 444 | `13-kernel.sh` | Build and install RPi 0/1/2/3 Kernel |
443 445 | `14-fstab.sh` | Setup fstab and initramfs |
444 446 | `15-rpi-config.sh` | Setup RPi 0/1/2/3 config and cmdline |
445 447 | `20-networking.sh` | Setup Networking |
446 448 | `21-firewall.sh` | Setup Firewall |
447 449 | `30-security.sh` | Setup Users and Security settings |
448 450 | `31-logging.sh` | Setup Logging |
449 451 | `32-sshd.sh` | Setup SSH and public keys |
450 452 | `41-uboot.sh` | Build and Setup U-Boot |
451 453 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
452 454 | `43-videocore.sh` | Build and Setup videocore libraries |
453 455 | `50-firstboot.sh` | First boot actions |
454 456 | `99-reduce.sh` | Reduce the disk space usage |
455 457
456 458 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
457 459
458 460 | Directory | Description |
459 461 | --- | --- |
460 462 | `apt` | APT management configuration files |
461 463 | `boot` | Boot and RPi 0/1/2/3 configuration files |
462 464 | `dpkg` | Package Manager configuration |
463 465 | `etc` | Configuration files and rc scripts |
464 466 | `firstboot` | Scripts that get executed on first boot |
465 467 | `initramfs` | Initramfs scripts |
466 468 | `iptables` | Firewall configuration files |
467 469 | `locales` | Locales configuration |
468 470 | `modules` | Kernel Modules configuration |
469 471 | `mount` | Fstab configuration |
470 472 | `network` | Networking configuration files |
471 473 | `sysctl.d` | Swapping and Network Hardening configuration |
472 474 | `xorg` | fbturbo Xorg driver configuration |
473 475
474 476 ## Custom packages and scripts
475 477 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
476 478
477 479 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
478 480
479 481 ## Logging of the bootstrapping process
480 482 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
481 483
482 484 ```shell
483 485 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
484 486 ```
485 487
486 488 ## Flashing the image file
487 489 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi 0/1/2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
488 490
489 491 ##### Flashing examples:
490 492 ```shell
491 493 bmaptool copy ./images/buster/2017-01-23-rpi3-buster.img /dev/mmcblk0
492 494 dd bs=4M if=./images/buster/2017-01-23-rpi3-buster.img of=/dev/mmcblk0
493 495 ```
494 496 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
495 497 ```shell
496 498 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-frmw.img /dev/mmcblk0
497 499 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-root.img /dev/sdc
498 500 ```
499 501
500 502 ## QEMU emulation
501 503 Start QEMU full system emulation:
502 504 ```shell
503 505 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=tty1"
504 506 ```
505 507
506 508 Start QEMU full system emulation and output to console:
507 509 ```shell
508 510 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
509 511 ```
510 512
511 513 Start QEMU full system emulation with SMP and output to console:
512 514 ```shell
513 515 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -smp cpus=2,maxcpus=2 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
514 516 ```
515 517
516 518 Start QEMU full system emulation with cryptfs, initramfs and output to console:
517 519 ```shell
518 520 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -initrd "initramfs-${KERNEL_VERSION}" -append "root=/dev/mapper/secure cryptdevice=/dev/mmcblk0p2:secure rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
519 521 ```
520 522
521 523 ## External links and references
522 524 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
523 525 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
524 526 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
525 527 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
526 528 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
527 529 * [U-BOOT git repository](https://git.denx.de/?p=u-boot.git;a=summary)
528 530 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
529 531 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm80211/brcm)
530 532 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
Show file before | Show file after | Hide comments
@@ -1,501 +1,543
1 1 #
2 2 # Build and Setup RPi2/3 Kernel
3 3 #
4 4
5 5 # Load utility functions
6 6 . ./functions.sh
7 7
8 8 # Need to use kali kernel src if nexmon is enabled
9 9 if [ "$ENABLE_NEXMON" = true ] ; then
10 10 echo "WARNING: if ENABLE_NEXMON is used remember to put the CORRECT KERNELSRC IN KERNELSRC_DIR!!!!!1!"
11 11 KERNEL_URL="${KALI_KERNEL_URL}"
12 12 KERNEL_BRANCH=""
13 13 fi
14 14
15 15 # Fetch and build latest raspberry kernel
16 16 if [ "$BUILD_KERNEL" = true ] ; then
17 17 # Setup source directory
18 18 mkdir -p "${KERNEL_DIR}"
19 19
20 20 # Copy existing kernel sources into chroot directory
21 21 if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then
22 22 # Copy kernel sources and include hidden files
23 23 cp -r "${KERNELSRC_DIR}/". "${KERNEL_DIR}"
24 24
25 25 # Clean the kernel sources
26 26 if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then
27 27 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper
28 28 fi
29 29 else # KERNELSRC_DIR=""
30 30 # Create temporary directory for kernel sources
31 31 temp_dir=$(as_nobody mktemp -d)
32 32
33 33 # Fetch current RPi2/3 kernel sources
34 34 if [ -z "${KERNEL_BRANCH}" ] ; then
35 35 as_nobody -H git -C "${temp_dir}" clone --depth=1 "${KERNEL_URL}" linux
36 36 else
37 37 as_nobody -H git -C "${temp_dir}" clone --depth=1 --branch "${KERNEL_BRANCH}" "${KERNEL_URL}" linux
38 38 fi
39 39
40 40 # Copy downloaded kernel sources
41 41 cp -r "${temp_dir}/linux/"* "${KERNEL_DIR}"
42 42
43 43 # Remove temporary directory for kernel sources
44 44 rm -fr "${temp_dir}"
45 45
46 46 # Set permissions of the kernel sources
47 47 chown -R root:root "${R}/usr/src"
48 48 fi
49 49
50 50 # Calculate optimal number of kernel building threads
51 51 if [ "$KERNEL_THREADS" = "1" ] && [ -r /proc/cpuinfo ] ; then
52 52 KERNEL_THREADS=$(grep -c processor /proc/cpuinfo)
53 53 fi
54 54
55 55 # Configure and build kernel
56 56 if [ "$KERNELSRC_PREBUILT" = false ] ; then
57 57 # Remove device, network and filesystem drivers from kernel configuration
58 58 if [ "$KERNEL_REDUCE" = true ] ; then
59 59 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
60 60 sed -i\
61 61 -e "s/\(^CONFIG_SND.*\=\).*/\1n/"\
62 62 -e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\
63 63 -e "s/\(^CONFIG_AC97.*\=\).*/\1n/"\
64 64 -e "s/\(^CONFIG_VIDEO_.*\=\).*/\1n/"\
65 65 -e "s/\(^CONFIG_MEDIA_TUNER.*\=\).*/\1n/"\
66 66 -e "s/\(^CONFIG_DVB.*\=\)[ym]/\1n/"\
67 67 -e "s/\(^CONFIG_REISERFS.*\=\).*/\1n/"\
68 68 -e "s/\(^CONFIG_JFS.*\=\).*/\1n/"\
69 69 -e "s/\(^CONFIG_XFS.*\=\).*/\1n/"\
70 70 -e "s/\(^CONFIG_GFS2.*\=\).*/\1n/"\
71 71 -e "s/\(^CONFIG_OCFS2.*\=\).*/\1n/"\
72 72 -e "s/\(^CONFIG_BTRFS.*\=\).*/\1n/"\
73 73 -e "s/\(^CONFIG_HFS.*\=\).*/\1n/"\
74 74 -e "s/\(^CONFIG_JFFS2.*\=\)[ym]/\1n/"\
75 75 -e "s/\(^CONFIG_UBIFS.*\=\).*/\1n/"\
76 76 -e "s/\(^CONFIG_SQUASHFS.*\=\)[ym]/\1n/"\
77 77 -e "s/\(^CONFIG_W1.*\=\)[ym]/\1n/"\
78 78 -e "s/\(^CONFIG_HAMRADIO.*\=\).*/\1n/"\
79 79 -e "s/\(^CONFIG_CAN.*\=\).*/\1n/"\
80 80 -e "s/\(^CONFIG_IRDA.*\=\).*/\1n/"\
81 81 -e "s/\(^CONFIG_BT_.*\=\).*/\1n/"\
82 82 -e "s/\(^CONFIG_WIMAX.*\=\)[ym]/\1n/"\
83 83 -e "s/\(^CONFIG_6LOWPAN.*\=\).*/\1n/"\
84 84 -e "s/\(^CONFIG_IEEE802154.*\=\).*/\1n/"\
85 85 -e "s/\(^CONFIG_NFC.*\=\).*/\1n/"\
86 86 -e "s/\(^CONFIG_FB_TFT=.*\=\).*/\1n/"\
87 87 -e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\
88 88 -e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\
89 89 -e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\
90 90 "${KERNEL_DIR}/.config"
91 91 fi
92 92
93 93 if [ "$KERNELSRC_CONFIG" = true ] ; then
94 94 # Load default raspberry kernel configuration
95 95 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
96 96
97 97 #Switch to KERNELSRC_DIR so we can use set_kernel_config
98 98 cd "${KERNEL_DIR}" || exit
99 99
100 100 # enable ZSWAP see https://askubuntu.com/a/472227 or https://wiki.archlinux.org/index.php/zswap
101 101 if [ "$KERNEL_ZSWAP" = true ] ; then
102 102 set_kernel_config CONFIG_ZPOOL y
103 103 set_kernel_config CONFIG_ZSWAP y
104 104 set_kernel_config CONFIG_ZBUD y
105 105 set_kernel_config CONFIG_Z3FOLD y
106 106 set_kernel_config CONFIG_ZSMALLOC y
107 107 set_kernel_config CONFIG_PGTABLE_MAPPING y
108 108 fi
109 109
110 110 # enable basic KVM support; see https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=210546&start=25#p1300453
111 111 if [ "$KERNEL_VIRT" = true ] && { [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; } ; then
112 112 set_kernel_config CONFIG_VIRTUALIZATION y
113 113 set_kernel_config CONFIG_KVM y
114 114 set_kernel_config CONFIG_VHOST_NET m
115 115 set_kernel_config CONFIG_VHOST_CROSS_ENDIAN_LEGACY y
116 116 fi
117 117
118 # enable apparmor,integrity audit,
119 if [ "$KERNEL_SECURITY" = true ] ; then
120
121 # security filesystem, security models and audit
122 set_kernel_config CONFIG_SECURITYFS y
123 set_kernel_config CONFIG_SECURITY y
124 set_kernel_config CONFIG_AUDIT y
125
126 # harden strcpy and memcpy
127 set_kernel_config CONFIG_HARDENED_USERCOPY=y
128 set_kernel_config CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y
129 set_kernel_config CONFIG_FORTIFY_SOURCE=y
130
131 # integrity sub-system
132 set_kernel_config CONFIG_INTEGRITY=y
133 set_kernel_config CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
134 set_kernel_config CONFIG_INTEGRITY_AUDIT=y
135 set_kernel_config CONFIG_INTEGRITY_SIGNATURE=y
136 set_kernel_config CONFIG_INTEGRITY_TRUSTED_KEYRING=y
137
138 # This option provides support for retaining authentication tokens and access keys in the kernel.
139 set_kernel_config CONFIG_KEYS=y
140 set_kernel_config CONFIG_KEYS_COMPAT=y
141
142 # Apparmor
143 set_kernel_config CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE 1
144 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH_DEFAULT y
145 set_kernel_config CONFIG_DEFAULT_SECURITY_APPARMOR y
146 set_kernel_config CONFIG_SECURITY_APPARMOR y
147 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH y
148 set_kernel_config CONFIG_DEFAULT_SECURITY "apparmor"
149
150 # restrictions on unprivileged users reading the kernel
151 set_kernel_config CONFIG_SECURITY_DMESG_RESTRICT=y
152
153 # network security hooks
154 set_kernel_config CONFIG_SECURITY_NETWORK y
155 set_kernel_config CONFIG_SECURITY_NETWORK_XFRM=y
156 set_kernel_config CONFIG_SECURITY_PATH=y
157 set_kernel_config CONFIG_SECURITY_YAMA=y
158 fi
159
118 160 # Netfilter kernel support See https://github.com/raspberrypi/linux/issues/2177#issuecomment-354647406
119 161 if [ "$KERNEL_NF" = true ] ; then
120 162 set_kernel_config CONFIG_IP_NF_TARGET_SYNPROXY m
121 163 set_kernel_config CONFIG_NETFILTER_XT_MATCH_CGROUP m
122 164 set_kernel_config CONFIG_NETFILTER_XT_MATCH_IPCOMP m
123 165 set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
124 166 set_kernel_config CONFIG_NFT_FIB_INET m
125 167 set_kernel_config CONFIG_NFT_FIB_IPV4 m
126 168 set_kernel_config CONFIG_NFT_FIB_IPV6 m
127 169 set_kernel_config CONFIG_NFT_FIB_NETDEV m
128 170 set_kernel_config CONFIG_NFT_OBJREF m
129 171 set_kernel_config CONFIG_NFT_RT m
130 172 set_kernel_config CONFIG_NFT_SET_BITMAP m
131 173 set_kernel_config CONFIG_NF_CONNTRACK_TIMEOUT y
132 174 set_kernel_config CONFIG_NF_LOG_ARP m
133 175 set_kernel_config CONFIG_NF_SOCKET_IPV4 m
134 176 set_kernel_config CONFIG_NF_SOCKET_IPV6 m
135 177 set_kernel_config CONFIG_BRIDGE_EBT_BROUTE m
136 178 set_kernel_config CONFIG_BRIDGE_EBT_T_FILTER m
137 179 set_kernel_config CONFIG_BRIDGE_NF_EBTABLES m
138 180 set_kernel_config CONFIG_IP6_NF_IPTABLES m
139 181 set_kernel_config CONFIG_IP6_NF_MATCH_AH m
140 182 set_kernel_config CONFIG_IP6_NF_MATCH_EUI64 m
141 183 set_kernel_config CONFIG_IP6_NF_NAT m
142 184 set_kernel_config CONFIG_IP6_NF_TARGET_MASQUERADE m
143 185 set_kernel_config CONFIG_IP6_NF_TARGET_NPT m
144 186 set_kernel_config CONFIG_IP_SET_BITMAP_IPMAC m
145 187 set_kernel_config CONFIG_IP_SET_BITMAP_PORT m
146 188 set_kernel_config CONFIG_IP_SET_HASH_IP m
147 189 set_kernel_config CONFIG_IP_SET_HASH_IPMARK m
148 190 set_kernel_config CONFIG_IP_SET_HASH_IPPORT m
149 191 set_kernel_config CONFIG_IP_SET_HASH_IPPORTIP m
150 192 set_kernel_config CONFIG_IP_SET_HASH_IPPORTNET m
151 193 set_kernel_config CONFIG_IP_SET_HASH_MAC m
152 194 set_kernel_config CONFIG_IP_SET_HASH_NET m
153 195 set_kernel_config CONFIG_IP_SET_HASH_NETIFACE m
154 196 set_kernel_config CONFIG_IP_SET_HASH_NETNET m
155 197 set_kernel_config CONFIG_IP_SET_HASH_NETPORT m
156 198 set_kernel_config CONFIG_IP_SET_HASH_NETPORTNET m
157 199 set_kernel_config CONFIG_IP_SET_LIST_SET m
158 200 set_kernel_config CONFIG_NETFILTER_XTABLES m
159 201 set_kernel_config CONFIG_NETFILTER_XTABLES m
160 202 set_kernel_config CONFIG_NFT_BRIDGE_META m
161 203 set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
162 204 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV4 m
163 205 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
164 206 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV4 m
165 207 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
166 208 set_kernel_config CONFIG_NFT_COMPAT m
167 209 set_kernel_config CONFIG_NFT_COUNTER m
168 210 set_kernel_config CONFIG_NFT_CT m
169 211 set_kernel_config CONFIG_NFT_DUP_IPV4 m
170 212 set_kernel_config CONFIG_NFT_DUP_IPV6 m
171 213 set_kernel_config CONFIG_NFT_DUP_NETDEV m
172 214 set_kernel_config CONFIG_NFT_EXTHDR m
173 215 set_kernel_config CONFIG_NFT_FWD_NETDEV m
174 216 set_kernel_config CONFIG_NFT_HASH m
175 217 set_kernel_config CONFIG_NFT_LIMIT m
176 218 set_kernel_config CONFIG_NFT_LOG m
177 219 set_kernel_config CONFIG_NFT_MASQ m
178 220 set_kernel_config CONFIG_NFT_MASQ_IPV4 m
179 221 set_kernel_config CONFIG_NFT_MASQ_IPV6 m
180 222 set_kernel_config CONFIG_NFT_META m
181 223 set_kernel_config CONFIG_NFT_NAT m
182 224 set_kernel_config CONFIG_NFT_NUMGEN m
183 225 set_kernel_config CONFIG_NFT_QUEUE m
184 226 set_kernel_config CONFIG_NFT_QUOTA m
185 227 set_kernel_config CONFIG_NFT_REDIR m
186 228 set_kernel_config CONFIG_NFT_REDIR_IPV4 m
187 229 set_kernel_config CONFIG_NFT_REDIR_IPV6 m
188 230 set_kernel_config CONFIG_NFT_REJECT m
189 231 set_kernel_config CONFIG_NFT_REJECT_INET m
190 232 set_kernel_config CONFIG_NFT_REJECT_IPV4 m
191 233 set_kernel_config CONFIG_NFT_REJECT_IPV6 m
192 234 set_kernel_config CONFIG_NFT_SET_HASH m
193 235 set_kernel_config CONFIG_NFT_SET_RBTREE m
194 236 set_kernel_config CONFIG_NF_CONNTRACK_IPV4 m
195 237 set_kernel_config CONFIG_NF_CONNTRACK_IPV6 m
196 238 set_kernel_config CONFIG_NF_DEFRAG_IPV4 m
197 239 set_kernel_config CONFIG_NF_DEFRAG_IPV6 m
198 240 set_kernel_config CONFIG_NF_DUP_IPV4 m
199 241 set_kernel_config CONFIG_NF_DUP_IPV6 m
200 242 set_kernel_config CONFIG_NF_DUP_NETDEV m
201 243 set_kernel_config CONFIG_NF_LOG_BRIDGE m
202 244 set_kernel_config CONFIG_NF_LOG_IPV4 m
203 245 set_kernel_config CONFIG_NF_LOG_IPV6 m
204 246 set_kernel_config CONFIG_NF_NAT_IPV4 m
205 247 set_kernel_config CONFIG_NF_NAT_IPV6 m
206 248 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV4 m
207 249 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV6 m
208 250 set_kernel_config CONFIG_NF_NAT_PPTP m
209 251 set_kernel_config CONFIG_NF_NAT_PROTO_GRE m
210 252 set_kernel_config CONFIG_NF_NAT_REDIRECT m
211 253 set_kernel_config CONFIG_NF_NAT_SIP m
212 254 set_kernel_config CONFIG_NF_NAT_SNMP_BASIC m
213 255 set_kernel_config CONFIG_NF_NAT_TFTP m
214 256 set_kernel_config CONFIG_NF_REJECT_IPV4 m
215 257 set_kernel_config CONFIG_NF_REJECT_IPV6 m
216 258 set_kernel_config CONFIG_NF_TABLES m
217 259 set_kernel_config CONFIG_NF_TABLES_ARP m
218 260 set_kernel_config CONFIG_NF_TABLES_BRIDGE m
219 261 set_kernel_config CONFIG_NF_TABLES_INET m
220 262 set_kernel_config CONFIG_NF_TABLES_IPV4 m
221 263 set_kernel_config CONFIG_NF_TABLES_IPV6 m
222 264 set_kernel_config CONFIG_NF_TABLES_NETDEV m
223 265 fi
224 266
225 267 # Enables BPF syscall for systemd-journald see https://github.com/torvalds/linux/blob/master/init/Kconfig#L848 or https://groups.google.com/forum/#!topic/linux.gentoo.user/_2aSc_ztGpA
226 268 if [ "$KERNEL_BPF" = true ] ; then
227 269 set_kernel_config CONFIG_BPF_SYSCALL y
228 270 set_kernel_config CONFIG_BPF_EVENTS y
229 271 set_kernel_config CONFIG_BPF_STREAM_PARSER y
230 272 set_kernel_config CONFIG_CGROUP_BPF y
231 273 fi
232 274
233 275 # KERNEL_DEFAULT_GOV was set by user
234 276 if [ "$KERNEL_DEFAULT_GOV" != powersave ] && [ -n "$KERNEL_DEFAULT_GOV" ]; then
235 277
236 278 case "$KERNEL_DEFAULT_GOV" in
237 279 performance)
238 280 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
239 281 ;;
240 282 userspace)
241 283 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE y
242 284 ;;
243 285 ondemand)
244 286 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND y
245 287 ;;
246 288 conservative)
247 289 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE y
248 290 ;;
249 291 shedutil)
250 292 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL y
251 293 ;;
252 294 *)
253 295 echo "error: unsupported default cpu governor"
254 296 exit 1
255 297 ;;
256 298 esac
257 299
258 300 # unset previous default governor
259 301 unset_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE
260 302 fi
261 303
262 304
263 305
264 306 #Revert to previous directory
265 307 cd "${WORKDIR}" || exit
266 308
267 309 # Set kernel configuration parameters to enable qemu emulation
268 310 if [ "$ENABLE_QEMU" = true ] ; then
269 311 echo "CONFIG_FHANDLE=y" >> "${KERNEL_DIR}"/.config
270 312 echo "CONFIG_LBDAF=y" >> "${KERNEL_DIR}"/.config
271 313
272 314 if [ "$ENABLE_CRYPTFS" = true ] ; then
273 315 {
274 316 echo "CONFIG_EMBEDDED=y"
275 317 echo "CONFIG_EXPERT=y"
276 318 echo "CONFIG_DAX=y"
277 319 echo "CONFIG_MD=y"
278 320 echo "CONFIG_BLK_DEV_MD=y"
279 321 echo "CONFIG_MD_AUTODETECT=y"
280 322 echo "CONFIG_BLK_DEV_DM=y"
281 323 echo "CONFIG_BLK_DEV_DM_BUILTIN=y"
282 324 echo "CONFIG_DM_CRYPT=y"
283 325 echo "CONFIG_CRYPTO_BLKCIPHER=y"
284 326 echo "CONFIG_CRYPTO_CBC=y"
285 327 echo "CONFIG_CRYPTO_XTS=y"
286 328 echo "CONFIG_CRYPTO_SHA512=y"
287 329 echo "CONFIG_CRYPTO_MANAGER=y"
288 330 } >> "${KERNEL_DIR}"/.config
289 331 fi
290 332 fi
291 333
292 334 # Copy custom kernel configuration file
293 335 if [ -n "$KERNELSRC_USRCONFIG" ] ; then
294 336 cp "$KERNELSRC_USRCONFIG" "${KERNEL_DIR}"/.config
295 337 fi
296 338
297 339 # Set kernel configuration parameters to their default values
298 340 if [ "$KERNEL_OLDDEFCONFIG" = true ] ; then
299 341 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig
300 342 fi
301 343
302 344 # Start menu-driven kernel configuration (interactive)
303 345 if [ "$KERNEL_MENUCONFIG" = true ] ; then
304 346 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig
305 347 fi
306 348 # end if "$KERNELSRC_CONFIG" = true
307 349 fi
308 350
309 351 # Use ccache to cross compile the kernel
310 352 if [ "$KERNEL_CCACHE" = true ] ; then
311 353 cc="ccache ${CROSS_COMPILE}gcc"
312 354 else
313 355 cc="${CROSS_COMPILE}gcc"
314 356 fi
315 357
316 358 # Cross compile kernel and dtbs
317 359 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" "${KERNEL_BIN_IMAGE}" dtbs
318 360
319 361 # Cross compile kernel modules
320 362 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
321 363 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" modules
322 364 fi
323 365 # end if "$KERNELSRC_PREBUILT" = false
324 366 fi
325 367
326 368 # Check if kernel compilation was successful
327 369 if [ ! -r "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" ] ; then
328 370 echo "error: kernel compilation failed! (kernel image not found)"
329 371 cleanup
330 372 exit 1
331 373 fi
332 374
333 375 # Install kernel modules
334 376 if [ "$ENABLE_REDUCE" = true ] ; then
335 377 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
336 378 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install
337 379 fi
338 380 else
339 381 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
340 382 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install
341 383 fi
342 384
343 385 # Install kernel firmware
344 386 if grep -q "^firmware_install:" "${KERNEL_DIR}/Makefile" ; then
345 387 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install
346 388 fi
347 389 fi
348 390
349 391 # Install kernel headers
350 392 if [ "$KERNEL_HEADERS" = true ] && [ "$KERNEL_REDUCE" = false ] ; then
351 393 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install
352 394 fi
353 395 # make tar.gz kernel package - missing os bzw. modules
354 396 #** ** ** WARNING ** ** **
355 397 #Your architecture did not define any architecture-dependent files
356 398 #to be placed into the tarball. Please add those to ./scripts/package/buildtar .
357 399 # make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" targz-pkg
358 400
359 401 # Prepare boot (firmware) directory
360 402 mkdir "${BOOT_DIR}"
361 403
362 404 # Get kernel release version
363 405 KERNEL_VERSION=$(cat "${KERNEL_DIR}/include/config/kernel.release")
364 406
365 407 # Copy kernel configuration file to the boot directory
366 408 install_readonly "${KERNEL_DIR}/.config" "${R}/boot/config-${KERNEL_VERSION}"
367 409
368 410 # Prepare device tree directory
369 411 mkdir "${BOOT_DIR}/overlays"
370 412
371 413 # Ensure the proper .dtb is located
372 414 if [ "$KERNEL_ARCH" = "arm" ] ; then
373 415 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb ; do
374 416 if [ -f "${dtb}" ] ; then
375 417 install_readonly "${dtb}" "${BOOT_DIR}/"
376 418 fi
377 419 done
378 420 else
379 421 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/broadcom/"*.dtb ; do
380 422 if [ -f "${dtb}" ] ; then
381 423 install_readonly "${dtb}" "${BOOT_DIR}/"
382 424 fi
383 425 done
384 426 fi
385 427
386 428 # Copy compiled dtb device tree files
387 429 if [ -d "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays" ] ; then
388 430 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtb ; do
389 431 if [ -f "${dtb}" ] ; then
390 432 install_readonly "${dtb}" "${BOOT_DIR}/overlays/"
391 433 fi
392 434 done
393 435
394 436 if [ -f "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" ] ; then
395 437 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOT_DIR}/overlays/README"
396 438 fi
397 439 fi
398 440
399 441 if [ "$ENABLE_UBOOT" = false ] ; then
400 442 # Convert and copy kernel image to the boot directory
401 443 "${KERNEL_DIR}/scripts/mkknlimg" "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
402 444 else
403 445 # Copy kernel image to the boot directory
404 446 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
405 447 fi
406 448
407 449 # Remove kernel sources
408 450 if [ "$KERNEL_REMOVESRC" = true ] ; then
409 451 rm -fr "${KERNEL_DIR}"
410 452 else
411 453 # Prepare compiled kernel modules
412 454 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
413 455 if grep -q "^modules_prepare:" "${KERNEL_DIR}/Makefile" ; then
414 456 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" modules_prepare
415 457 fi
416 458
417 459 # Create symlinks for kernel modules
418 460 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/build"
419 461 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/source"
420 462 fi
421 463 fi
422 464
423 465 else # BUILD_KERNEL=false
424 466 # echo Install precompiled kernel...
425 467 # echo error: not implemented
426 468 if [ "$SET_ARCH" = 64 ] && { [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; } ; then
427 469
428 470 # Use Sakakis modified kernel if ZSWAP is active
429 471 if [ "$KERNEL_ZSWAP" = true ] || [ "$KERNEL_VIRT" = true ] || [ "$KERNEL_NF" = true ] || [ "$KERNEL_BPF" = true ] ; then
430 472 RPI3_64_KERNEL_URL="${RPI3_64_BIS_KERNEL_URL}"
431 473 fi
432 474
433 475 # Create temporary directory for dl
434 476 temp_dir=$(as_nobody mktemp -d)
435 477
436 478 # Fetch kernel dl
437 479 as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI3_64_KERNEL_URL"
438 480
439 481 #extract download
440 482 tar -xJf "${temp_dir}"/kernel.tar.xz -C "${temp_dir}"
441 483
442 484 #move extracted kernel to /boot/firmware
443 485 mkdir "${R}/boot/firmware"
444 486 cp "${temp_dir}"/boot/* "${R}"/boot/firmware/
445 487 cp -r "${temp_dir}"/lib/* "${R}"/lib/
446 488
447 489 # Remove temporary directory for kernel sources
448 490 rm -fr "${temp_dir}"
449 491
450 492 # Set permissions of the kernel sources
451 493 chown -R root:root "${R}/boot/firmware"
452 494 chown -R root:root "${R}/lib/modules"
453 495 fi
454 496
455 497 # Install Kernel from hypriot comptabile with all Raspberry PI
456 498 if [ "$SET_ARCH" = 32 ] ; then
457 499 # Create temporary directory for dl
458 500 temp_dir=$(as_nobody mktemp -d)
459 501
460 502 # Fetch kernel
461 503 as_nobody wget -O "${temp_dir}"/kernel.deb -c "$RPI_32_KERNEL_URL"
462 504
463 505 # Copy downloaded U-Boot sources
464 506 mv "${temp_dir}"/kernel.deb "${R}"/tmp/kernel.deb
465 507
466 508 # Set permissions
467 509 chown -R root:root "${R}"/tmp/kernel.deb
468 510
469 511 # Install kernel
470 512 chroot_exec dpkg -i /tmp/kernel.deb
471 513
472 514 # move /boot to /boot/firmware to fit script env.
473 515 #mkdir "${BOOT_DIR}"
474 516 mkdir "${temp_dir}"/firmware
475 517 mv "${R}"/boot/* "${temp_dir}"/firmware/
476 518 mv "${temp_dir}"/firmware "${R}"/boot/
477 519
478 520 #same for kernel headers
479 521 if [ "$KERNEL_HEADERS" = true ] ; then
480 522 # Fetch kernel header
481 523 as_nobody wget -O "${temp_dir}"/kernel-header.deb -c "$RPI_32_KERNELHEADER_URL"
482 524 mv "${temp_dir}"/kernel-header.deb "${R}"/tmp/kernel-header.deb
483 525 chown -R root:root "${R}"/tmp/kernel-header.deb
484 526 # Install kernel header
485 527 chroot_exec dpkg -i /tmp/kernel-header.deb
486 528 rm -f "${R}"/tmp/kernel-header.deb
487 529 fi
488 530
489 531 # Remove temporary directory and files
490 532 rm -fr "${temp_dir}"
491 533 rm -f "${R}"/tmp/kernel.deb
492 534 fi
493 535
494 536 # Check if kernel installation was successful
495 537 KERNEL="$(ls -1 "${R}"/boot/firmware/kernel* | sort | tail -n 1)"
496 538 if [ -z "$KERNEL" ] ; then
497 539 echo "error: kernel installation failed! (/boot/kernel* not found)"
498 540 cleanup
499 541 exit 1
500 542 fi
501 543 fi
Show file before | Show file after | Hide comments
@@ -1,869 +1,870
1 1 #!/bin/sh
2 2 ########################################################################
3 3 # rpi23-gen-image.sh 2015-2017
4 4 #
5 5 # Advanced Debian "stretch" and "buster" bootstrap script for Raspberry Pi
6 6 #
7 7 # This program is free software; you can redistribute it and/or
8 8 # modify it under the terms of the GNU General Public License
9 9 # as published by the Free Software Foundation; either version 2
10 10 # of the License, or (at your option) any later version.
11 11 #
12 12 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
13 13 #
14 14 # Big thanks for patches and enhancements by 20+ github contributors!
15 15 ########################################################################
16 16
17 17 # Are we running as root?
18 18 if [ "$(id -u)" -ne "0" ] ; then
19 19 echo "error: this script must be executed with root privileges!"
20 20 exit 1
21 21 fi
22 22
23 23 # Check if ./functions.sh script exists
24 24 if [ ! -r "./functions.sh" ] ; then
25 25 echo "error: './functions.sh' required script not found!"
26 26 exit 1
27 27 fi
28 28
29 29 # Load utility functions
30 30 . ./functions.sh
31 31
32 32 # Load parameters from configuration template file
33 33 if [ -n "$CONFIG_TEMPLATE" ] ; then
34 34 use_template
35 35 fi
36 36
37 37 # Introduce settings
38 38 set -e
39 39 echo -n -e "\n#\n# RPi 0/1/2/3 Bootstrap Settings\n#\n"
40 40 set -x
41 41
42 42 # Raspberry Pi model configuration
43 43 RPI_MODEL=${RPI_MODEL:=2}
44 44
45 45 # Debian release
46 46 RELEASE=${RELEASE:=buster}
47 47
48 48 # Kernel Branch
49 49 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
50 50
51 51 # URLs
52 52 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
53 53 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
54 54 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
55 55 COLLABORA_URL=${COLLABORA_URL:=https://repositories.collabora.co.uk/debian}
56 56 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
57 57 UBOOT_URL=${UBOOT_URL:=https://git.denx.de/u-boot.git}
58 58 VIDEOCORE_URL=${VIDEOCORE_URL:=https://github.com/raspberrypi/userland}
59 59 BLUETOOTH_URL=${BLUETOOTH_URL:=https://github.com/RPi-Distro/pi-bluetooth.git}
60 60 NEXMON_URL=${NEXMON_URL:=https://github.com/seemoo-lab/nexmon.git}
61 61 SYSTEMDSWAP_URL=${SYSTEMDSWAP_URL:=https://github.com/Nefelim4ag/systemd-swap.git}
62 62
63 63 # Kernel deb packages for 32bit kernel
64 64 RPI_32_KERNEL_URL=${RPI_32_KERNEL_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel_20180422-141901_armhf.deb}
65 65 RPI_32_KERNELHEADER_URL=${RPI_32_KERNELHEADER_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel-headers_20180422-141901_armhf.deb}
66 66 # Kernel has KVM and zswap enabled - use if KERNEL_* parameters and precompiled kernel are used
67 67 RPI3_64_BIS_KERNEL_URL=${RPI3_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel-bis/releases/download/4.14.80.20181113/bcmrpi3-kernel-bis-4.14.80.20181113.tar.xz}
68 68 # Default precompiled 64bit kernel
69 69 RPI3_64_DEF_KERNEL_URL=${RPI3_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel/releases/download/4.14.80.20181113/bcmrpi3-kernel-4.14.80.20181113.tar.xz}
70 70 # Generic
71 71 RPI3_64_KERNEL_URL=${RPI3_64_KERNEL_URL:=$RPI3_64_DEF_KERNEL_URL}
72 72 # Kali kernel src - used if ENABLE_NEXMON=true (they patch the wlan kernel modul)
73 73 KALI_KERNEL_URL=${KALI_KERNEL_URL:=https://github.com/Re4son/re4son-raspberrypi-linux.git}
74 74
75 75 # Build directories
76 76 WORKDIR=$(pwd)
77 77 BASEDIR=${BASEDIR:=${WORKDIR}/images/${RELEASE}}
78 78 BUILDDIR="${BASEDIR}/build"
79 79
80 80 # Chroot directories
81 81 R="${BUILDDIR}/chroot"
82 82 ETC_DIR="${R}/etc"
83 83 LIB_DIR="${R}/lib"
84 84 BOOT_DIR="${R}/boot/firmware"
85 85 KERNEL_DIR="${R}/usr/src/linux"
86 86 WLAN_FIRMWARE_DIR="${LIB_DIR}/firmware/brcm"
87 87 BLUETOOTH_FIRMWARE_DIR="${ETC_DIR}/firmware/bt"
88 88
89 89 # Firmware directory: Blank if download from github
90 90 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
91 91
92 92 # General settings
93 93 SET_ARCH=${SET_ARCH:=32}
94 94 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
95 95 PASSWORD=${PASSWORD:=raspberry}
96 96 USER_PASSWORD=${USER_PASSWORD:=raspberry}
97 97 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
98 98 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
99 99 EXPANDROOT=${EXPANDROOT:=true}
100 100
101 101 # Keyboard settings
102 102 XKB_MODEL=${XKB_MODEL:=""}
103 103 XKB_LAYOUT=${XKB_LAYOUT:=""}
104 104 XKB_VARIANT=${XKB_VARIANT:=""}
105 105 XKB_OPTIONS=${XKB_OPTIONS:=""}
106 106
107 107 # Network settings (DHCP)
108 108 ENABLE_DHCP=${ENABLE_DHCP:=true}
109 109
110 110 # Network settings (static)
111 111 NET_ADDRESS=${NET_ADDRESS:=""}
112 112 NET_GATEWAY=${NET_GATEWAY:=""}
113 113 NET_DNS_1=${NET_DNS_1:=""}
114 114 NET_DNS_2=${NET_DNS_2:=""}
115 115 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
116 116 NET_NTP_1=${NET_NTP_1:=""}
117 117 NET_NTP_2=${NET_NTP_2:=""}
118 118
119 119 # APT settings
120 120 APT_PROXY=${APT_PROXY:=""}
121 121 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
122 122
123 123 # Feature settings
124 124 ENABLE_PRINTK=${ENABLE_PRINTK:=false}
125 125 ENABLE_BLUETOOTH=${ENABLE_BLUETOOTH:=false}
126 126 ENABLE_MINIUART_OVERLAY=${ENABLE_MINIUART_OVERLAY:=false}
127 127 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
128 128 ENABLE_I2C=${ENABLE_I2C:=false}
129 129 ENABLE_SPI=${ENABLE_SPI:=false}
130 130 ENABLE_IPV6=${ENABLE_IPV6:=true}
131 131 ENABLE_SSHD=${ENABLE_SSHD:=true}
132 132 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
133 133 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
134 134 ENABLE_SOUND=${ENABLE_SOUND:=true}
135 135 ENABLE_DBUS=${ENABLE_DBUS:=true}
136 136 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
137 137 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
138 138 ENABLE_XORG=${ENABLE_XORG:=false}
139 139 ENABLE_WM=${ENABLE_WM:=""}
140 140 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
141 141 ENABLE_USER=${ENABLE_USER:=true}
142 142 USER_NAME=${USER_NAME:="pi"}
143 143 ENABLE_ROOT=${ENABLE_ROOT:=false}
144 144 ENABLE_QEMU=${ENABLE_QEMU:=false}
145 145 ENABLE_SYSVINIT=${ENABLE_SYSVINIT:=false}
146 146
147 147 # SSH settings
148 148 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
149 149 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
150 150 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
151 151 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
152 152 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
153 153
154 154 # Advanced settings
155 155 ENABLE_SYSTEMDSWAP=${ENABLE_SYSTEMDSWAP:=false}
156 156 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
157 157 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
158 158 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
159 159 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
160 160 ENABLE_UBOOTUSB=${ENABLE_UBOOTUSB=false}
161 161 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
162 162 ENABLE_VIDEOCORE=${ENABLE_VIDEOCORE:=false}
163 163 ENABLE_NEXMON=${ENABLE_NEXMON:=false}
164 164 VIDEOCORESRC_DIR=${VIDEOCORESRC_DIR:=""}
165 165 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
166 166 NEXMONSRC_DIR=${NEXMONSRC_DIR:=""}
167 167 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
168 168 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
169 169 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
170 170 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
171 171 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
172 172 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
173 173
174 174 # Kernel compilation settings
175 175 BUILD_KERNEL=${BUILD_KERNEL:=true}
176 176 KERNEL_REDUCE=${KERNEL_REDUCE:=false}
177 177 KERNEL_THREADS=${KERNEL_THREADS:=1}
178 178 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
179 179 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
180 180 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
181 181 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
182 182 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
183 183 KERNEL_ZSWAP=${KERNEL_ZSWAP:=false}
184 184 KERNEL_VIRT=${KERNEL_VIRT:=false}
185 185 KERNEL_BPF=${KERNEL_BPF:=false}
186 186 KERNEL_DEFAULT_GOV=${KERNEL_DEFAULT_GOV:=powersave}
187 KERNEL_SECURITY=${KERNEL_SECURITY:=false}
187 188
188 189 # Kernel compilation from source directory settings
189 190 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
190 191 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
191 192 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
192 193 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
193 194
194 195 # Reduce disk usage settings
195 196 REDUCE_APT=${REDUCE_APT:=true}
196 197 REDUCE_DOC=${REDUCE_DOC:=true}
197 198 REDUCE_MAN=${REDUCE_MAN:=true}
198 199 REDUCE_VIM=${REDUCE_VIM:=false}
199 200 REDUCE_BASH=${REDUCE_BASH:=false}
200 201 REDUCE_HWDB=${REDUCE_HWDB:=true}
201 202 REDUCE_SSHD=${REDUCE_SSHD:=true}
202 203 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
203 204
204 205 # Encrypted filesystem settings
205 206 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
206 207 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
207 208 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
208 209 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
209 210 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
210 211 #Dropbear-initramfs supports unlocking encrypted filesystem via SSH on bootup
211 212 CRYPTFS_DROPBEAR=${CRYPTFS_DROPBEAR:=false}
212 213 #Provide your own Dropbear Public RSA-OpenSSH Key otherwise it will be generated
213 214 CRYPTFS_DROPBEAR_PUBKEY=${CRYPTFS_DROPBEAR_PUBKEY:=""}
214 215
215 216 # Chroot scripts directory
216 217 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
217 218
218 219 # Packages required in the chroot build environment
219 220 APT_INCLUDES=${APT_INCLUDES:=""}
220 221 APT_INCLUDES="${APT_INCLUDES},apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils,locales,keyboard-configuration,console-setup,libnss-systemd"
221 222
222 223 #Packages to exclude from chroot build environment
223 224 APT_EXCLUDES=${APT_EXCLUDES:=""}
224 225
225 226 # Packages required for bootstrapping
226 227 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo netselect-apt"
227 228 MISSING_PACKAGES=""
228 229
229 230 # Packages installed for c/c++ build environment in chroot (keep empty)
230 231 COMPILER_PACKAGES=""
231 232
232 233 # Check if apt-cacher-ng has port 3142 open and set APT_PROXY
233 234 APT_CACHER_RUNNING=$(lsof -i :3142 | cut -d ' ' -f3 | uniq | sed '/^\s*$/d')
234 235 if [ "${APT_CACHER_RUNNING}" = "apt-cacher-ng" ] ; then
235 236 APT_PROXY=http://127.0.0.1:3142/
236 237 fi
237 238
238 239 # netselect-apt does not know buster yet
239 240 if [ "$RELEASE" = "buster" ] ; then
240 241 RLS=testing
241 242 else
242 243 RLS="$RELEASE"
243 244 fi
244 245
245 246 if [ -f "$(pwd)/files/apt/sources.list" ] ; then
246 247 rm "$(pwd)/files/apt/sources.list"
247 248 fi
248 249
249 250 if [ "$ENABLE_NONFREE" = true ] ; then
250 251 netselect-apt --arch "$RELEASE_ARCH" -t 3 --sources --nonfree --outfile "$(pwd)/files/apt/sources.list" -d "$RLS"
251 252 else
252 253 netselect-apt --arch "$RELEASE_ARCH" -t 3 --sources --outfile "$(pwd)/files/apt/sources.list" -d "$RLS"
253 254 fi
254 255
255 256 # sed and cut the result string so we can use it as APT_SERVER
256 257 APT_SERVER=$(grep -m 1 http files/apt/sources.list | sed "s|http://| |g" | cut -d ' ' -f 3 | sed 's|/$|''|')
257 258
258 259 # make script easier and more stable to use with convenient setup switch. Just setup SET_ARCH and RPI_MODEL and your good to go!
259 260 if [ -n "$SET_ARCH" ] ; then
260 261 # 64-bit configuration
261 262 if [ "$SET_ARCH" = 64 ] ; then
262 263 # General 64-bit depended settings
263 264 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
264 265 KERNEL_ARCH=${KERNEL_ARCH:=arm64}
265 266 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
266 267
267 268 # Raspberry Pi model specific settings
268 269 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
269 270 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
270 271 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
271 272 RELEASE_ARCH=${RELEASE_ARCH:=arm64}
272 273 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
273 274 CROSS_COMPILE=${CROSS_COMPILE:=aarch64-linux-gnu-}
274 275 else
275 276 echo "error: Only Raspberry PI 3 and 3B+ support 64-bit"
276 277 exit 1
277 278 fi
278 279 fi
279 280
280 281 # 32-bit configuration
281 282 if [ "$SET_ARCH" = 32 ] ; then
282 283 # General 32-bit dependend settings
283 284 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
284 285 KERNEL_ARCH=${KERNEL_ARCH:=arm}
285 286 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
286 287
287 288 # Raspberry Pi model specific settings
288 289 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 1P ] ; then
289 290 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armel"
290 291 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi_defconfig}
291 292 RELEASE_ARCH=${RELEASE_ARCH:=armel}
292 293 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel.img}
293 294 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabi-}
294 295 fi
295 296
296 297 # Raspberry Pi model specific settings
297 298 if [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
298 299 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
299 300 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
300 301 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
301 302 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
302 303 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
303 304 fi
304 305 fi
305 306 # SET_ARCH not set
306 307 else
307 308 echo "error: Please set '32' or '64' as value for SET_ARCH"
308 309 exit 1
309 310 fi
310 311 # Device specific configuration and U-Boot configuration
311 312 case "$RPI_MODEL" in
312 313 0)
313 314 DTB_FILE=${DTB_FILE:=bcm2708-rpi-0-w.dtb}
314 315 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
315 316 ;;
316 317 1)
317 318 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b.dtb}
318 319 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
319 320 ;;
320 321 1P)
321 322 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b-plus.dtb}
322 323 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
323 324 ;;
324 325 2)
325 326 DTB_FILE=${DTB_FILE:=bcm2709-rpi-2-b.dtb}
326 327 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_2_defconfig}
327 328 ;;
328 329 3)
329 330 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
330 331 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
331 332 ;;
332 333 3P)
333 334 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
334 335 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
335 336 ;;
336 337 *)
337 338 echo "error: Raspberry Pi model $RPI_MODEL is not supported!"
338 339 exit 1
339 340 ;;
340 341 esac
341 342
342 343 # Raspberry PI 0,3,3P with Bluetooth and Wifi onboard
343 344 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
344 345 # Include bluetooth packages on supported boards
345 346 if [ "$ENABLE_BLUETOOTH" = true ] ; then
346 347 APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
347 348 fi
348 349 if [ "$ENABLE_WIRELESS" = true ] ; then
349 350 APT_INCLUDES="${APT_INCLUDES},wireless-tools,crda,wireless-regdb"
350 351 fi
351 352 else # Raspberry PI 1,1P,2 without Wifi and bluetooth onboard
352 353 # Check if the internal wireless interface is not supported by the RPi model
353 354 if [ "$ENABLE_WIRELESS" = true ] || [ "$ENABLE_BLUETOOTH" = true ]; then
354 355 echo "error: The selected Raspberry Pi model has no integrated interface for wireless or bluetooth"
355 356 exit 1
356 357 fi
357 358 fi
358 359
359 360 if [ "$BUILD_KERNEL" = false ] && [ "$ENABLE_NEXMON" = true ]; then
360 361 echo "error: You have to compile kernel sources, if you want to enable nexmon"
361 362 exit 1
362 363 fi
363 364
364 365 # Prepare date string for default image file name
365 366 DATE="$(date +%Y-%m-%d)"
366 367 if [ -z "$KERNEL_BRANCH" ] ; then
367 368 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
368 369 else
369 370 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
370 371 fi
371 372
372 373 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
373 374 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
374 375 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
375 376 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
376 377 exit 1
377 378 fi
378 379 fi
379 380
380 381 set +x
381 382
382 383 # Add cmake to compile videocore sources
383 384 if [ "$ENABLE_VIDEOCORE" = true ] ; then
384 385 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cmake"
385 386 fi
386 387
387 388 # Add deps for nexmon
388 389 if [ "$ENABLE_NEXMON" = true ] ; then
389 390 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libgmp3-dev gawk qpdf bison flex make autoconf automake build-essential libtool"
390 391 fi
391 392
392 393 # Add libncurses5 to enable kernel menuconfig
393 394 if [ "$KERNEL_MENUCONFIG" = true ] ; then
394 395 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses-dev"
395 396 fi
396 397
397 398 # Add ccache compiler cache for (faster) kernel cross (re)compilation
398 399 if [ "$KERNEL_CCACHE" = true ] ; then
399 400 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
400 401 fi
401 402
402 403 # Add cryptsetup package to enable filesystem encryption
403 404 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
404 405 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
405 406 APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup"
406 407
407 408 # If cryptfs,dropbear and initramfs are enabled include dropbear-initramfs package
408 409 if [ "$CRYPTFS_DROPBEAR" = true ] && [ "$ENABLE_INITRAMFS" = true ]; then
409 410 APT_INCLUDES="${APT_INCLUDES},dropbear-initramfs"
410 411 fi
411 412
412 413 if [ -z "$CRYPTFS_PASSWORD" ] ; then
413 414 echo "error: no password defined (CRYPTFS_PASSWORD)!"
414 415 exit 1
415 416 fi
416 417 ENABLE_INITRAMFS=true
417 418 fi
418 419
419 420 # Add initramfs generation tools
420 421 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
421 422 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
422 423 fi
423 424
424 425 # Add device-tree-compiler required for building the U-Boot bootloader
425 426 if [ "$ENABLE_UBOOT" = true ] ; then
426 427 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler,bison,flex,bc"
427 428 else
428 429 if [ "$ENABLE_UBOOTUSB" = true ] ; then
429 430 echo "error: Enabling UBOOTUSB requires u-boot to be enabled"
430 431 exit 1
431 432 fi
432 433 fi
433 434
434 435 # Check if root SSH (v2) public key file exists
435 436 if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
436 437 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
437 438 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
438 439 exit 1
439 440 fi
440 441 fi
441 442
442 443 # Check if $USER_NAME SSH (v2) public key file exists
443 444 if [ -n "$SSH_USER_PUB_KEY" ] ; then
444 445 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
445 446 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
446 447 exit 1
447 448 fi
448 449 fi
449 450
450 451 if [ "$ENABLE_NEXMON" = true ] && [ -n "$KERNEL_BRANCH" ] ; then
451 452 echo "error: Please unset KERNEL_BRANCH if using ENABLE_NEXMON"
452 453 exit 1
453 454 fi
454 455
455 456 # Check if all required packages are installed on the build system
456 457 for package in $REQUIRED_PACKAGES ; do
457 458 if [ "$(dpkg-query -W -f='${Status}' "$package")" != "install ok installed" ] ; then
458 459 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
459 460 fi
460 461 done
461 462
462 463 # If there are missing packages ask confirmation for install, or exit
463 464 if [ -n "$MISSING_PACKAGES" ] ; then
464 465 echo "the following packages needed by this script are not installed:"
465 466 echo "$MISSING_PACKAGES"
466 467
467 468 printf "\ndo you want to install the missing packages right now? [y/n] "
468 469 read -r confirm
469 470 [ "$confirm" != "y" ] && exit 1
470 471
471 472 # Make sure all missing required packages are installed
472 473 apt-get -qq -y install `echo "${MISSING_PACKAGES}" | sed "s/ //"`
473 474 fi
474 475
475 476 # Check if ./bootstrap.d directory exists
476 477 if [ ! -d "./bootstrap.d/" ] ; then
477 478 echo "error: './bootstrap.d' required directory not found!"
478 479 exit 1
479 480 fi
480 481
481 482 # Check if ./files directory exists
482 483 if [ ! -d "./files/" ] ; then
483 484 echo "error: './files' required directory not found!"
484 485 exit 1
485 486 fi
486 487
487 488 # Check if specified KERNELSRC_DIR directory exists
488 489 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
489 490 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
490 491 exit 1
491 492 fi
492 493
493 494 # Check if specified UBOOTSRC_DIR directory exists
494 495 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
495 496 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
496 497 exit 1
497 498 fi
498 499
499 500 # Check if specified VIDEOCORESRC_DIR directory exists
500 501 if [ -n "$VIDEOCORESRC_DIR" ] && [ ! -d "$VIDEOCORESRC_DIR" ] ; then
501 502 echo "error: '${VIDEOCORESRC_DIR}' specified directory not found (VIDEOCORESRC_DIR)!"
502 503 exit 1
503 504 fi
504 505
505 506 # Check if specified FBTURBOSRC_DIR directory exists
506 507 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
507 508 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
508 509 exit 1
509 510 fi
510 511
511 512 # Check if specified NEXMONSRC_DIR directory exists
512 513 if [ -n "$NEXMONSRC_DIR" ] && [ ! -d "$NEXMONSRC_DIR" ] ; then
513 514 echo "error: '${NEXMONSRC_DIR}' specified directory not found (NEXMONSRC_DIR)!"
514 515 exit 1
515 516 fi
516 517
517 518 # Check if specified CHROOT_SCRIPTS directory exists
518 519 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
519 520 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
520 521 exit 1
521 522 fi
522 523
523 524 # Check if specified device mapping already exists (will be used by cryptsetup)
524 525 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
525 526 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
526 527 exit 1
527 528 fi
528 529
529 530 # Don't clobber an old build
530 531 if [ -e "$BUILDDIR" ] ; then
531 532 echo "error: directory ${BUILDDIR} already exists, not proceeding"
532 533 exit 1
533 534 fi
534 535
535 536 # Setup chroot directory
536 537 mkdir -p "${R}"
537 538
538 539 # Check if build directory has enough of free disk space >512MB
539 540 if [ "$(df --output=avail "${BUILDDIR}" | sed "1d")" -le "524288" ] ; then
540 541 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
541 542 exit 1
542 543 fi
543 544
544 545 set -x
545 546
546 547 # Call "cleanup" function on various signals and errors
547 548 trap cleanup 0 1 2 3 6
548 549
549 550 # Add required packages for the minbase installation
550 551 if [ "$ENABLE_MINBASE" = true ] ; then
551 552 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
552 553 fi
553 554
554 555 # Add parted package, required to get partprobe utility
555 556 if [ "$EXPANDROOT" = true ] ; then
556 557 APT_INCLUDES="${APT_INCLUDES},parted"
557 558 fi
558 559
559 560 # Add dbus package, recommended if using systemd
560 561 if [ "$ENABLE_DBUS" = true ] ; then
561 562 APT_INCLUDES="${APT_INCLUDES},dbus"
562 563 fi
563 564
564 565 # Add iptables IPv4/IPv6 package
565 566 if [ "$ENABLE_IPTABLES" = true ] ; then
566 567 APT_INCLUDES="${APT_INCLUDES},iptables,iptables-persistent"
567 568 fi
568 569
569 570 # Add openssh server package
570 571 if [ "$ENABLE_SSHD" = true ] ; then
571 572 APT_INCLUDES="${APT_INCLUDES},openssh-server"
572 573 fi
573 574
574 575 # Add alsa-utils package
575 576 if [ "$ENABLE_SOUND" = true ] ; then
576 577 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
577 578 fi
578 579
579 580 # Add rng-tools package
580 581 if [ "$ENABLE_HWRANDOM" = true ] ; then
581 582 APT_INCLUDES="${APT_INCLUDES},rng-tools"
582 583 fi
583 584
584 585 # Add fbturbo video driver
585 586 if [ "$ENABLE_FBTURBO" = true ] ; then
586 587 # Enable xorg package dependencies
587 588 ENABLE_XORG=true
588 589 fi
589 590
590 591 # Add user defined window manager package
591 592 if [ -n "$ENABLE_WM" ] ; then
592 593 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
593 594
594 595 # Enable xorg package dependencies
595 596 ENABLE_XORG=true
596 597 fi
597 598
598 599 # Add xorg package
599 600 if [ "$ENABLE_XORG" = true ] ; then
600 601 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
601 602 fi
602 603
603 604 # Replace selected packages with smaller clones
604 605 if [ "$ENABLE_REDUCE" = true ] ; then
605 606 # Add levee package instead of vim-tiny
606 607 if [ "$REDUCE_VIM" = true ] ; then
607 608 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
608 609 fi
609 610
610 611 # Add dropbear package instead of openssh-server
611 612 if [ "$REDUCE_SSHD" = true ] ; then
612 613 APT_INCLUDES="$(echo "${APT_INCLUDES}" | sed "s/openssh-server/dropbear/")"
613 614 fi
614 615 fi
615 616
616 617 # Configure systemd-sysv exclude to make halt/reboot/shutdown scripts available
617 618 if [ "$ENABLE_SYSVINIT" = false ] ; then
618 619 APT_EXCLUDES="--exclude=${APT_EXCLUDES},init,systemd-sysv"
619 620 fi
620 621
621 622 # Configure kernel sources if no KERNELSRC_DIR
622 623 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
623 624 KERNELSRC_CONFIG=true
624 625 fi
625 626
626 627 # Configure reduced kernel
627 628 if [ "$KERNEL_REDUCE" = true ] ; then
628 629 KERNELSRC_CONFIG=false
629 630 fi
630 631
631 632 # Configure qemu compatible kernel
632 633 if [ "$ENABLE_QEMU" = true ] ; then
633 634 DTB_FILE=vexpress-v2p-ca15_a7.dtb
634 635 UBOOT_CONFIG=vexpress_ca15_tc2_defconfig
635 636 KERNEL_DEFCONFIG="vexpress_defconfig"
636 637 if [ "$KERNEL_MENUCONFIG" = false ] ; then
637 638 KERNEL_OLDDEFCONFIG=true
638 639 fi
639 640 fi
640 641
641 642 # Execute bootstrap scripts
642 643 for SCRIPT in bootstrap.d/*.sh; do
643 644 head -n 3 "$SCRIPT"
644 645 . "$SCRIPT"
645 646 done
646 647
647 648 ## Execute custom bootstrap scripts
648 649 if [ -d "custom.d" ] ; then
649 650 for SCRIPT in custom.d/*.sh; do
650 651 . "$SCRIPT"
651 652 done
652 653 fi
653 654
654 655 # Execute custom scripts inside the chroot
655 656 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
656 657 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
657 658 chroot_exec /bin/bash -x <<'EOF'
658 659 for SCRIPT in /chroot_scripts/* ; do
659 660 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
660 661 $SCRIPT
661 662 fi
662 663 done
663 664 EOF
664 665 rm -rf "${R}/chroot_scripts"
665 666 fi
666 667
667 668 # Remove c/c++ build environment from the chroot
668 669 chroot_remove_cc
669 670
670 671 # Generate required machine-id
671 672 MACHINE_ID=$(dbus-uuidgen)
672 673 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
673 674 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
674 675
675 676 # APT Cleanup
676 677 chroot_exec apt-get -y clean
677 678 chroot_exec apt-get -y autoclean
678 679 chroot_exec apt-get -y autoremove
679 680
680 681 # Unmount mounted filesystems
681 682 umount -l "${R}/proc"
682 683 umount -l "${R}/sys"
683 684
684 685 # Clean up directories
685 686 rm -rf "${R}/run/*"
686 687 rm -rf "${R}/tmp/*"
687 688
688 689 # Clean up files
689 690 rm -f "${ETC_DIR}/ssh/ssh_host_*"
690 691 rm -f "${ETC_DIR}/dropbear/dropbear_*"
691 692 rm -f "${ETC_DIR}/apt/sources.list.save"
692 693 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
693 694 rm -f "${ETC_DIR}/*-"
694 695 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
695 696 rm -f "${ETC_DIR}/resolv.conf"
696 697 rm -f "${R}/root/.bash_history"
697 698 rm -f "${R}/var/lib/urandom/random-seed"
698 699 rm -f "${R}/initrd.img"
699 700 rm -f "${R}/vmlinuz"
700 701 rm -f "${R}${QEMU_BINARY}"
701 702
702 703 if [ "$ENABLE_QEMU" = true ] ; then
703 704 # Setup QEMU directory
704 705 mkdir "${BASEDIR}/qemu"
705 706
706 707 # Copy kernel image to QEMU directory
707 708 install_readonly "${BOOT_DIR}/${KERNEL_IMAGE}" "${BASEDIR}/qemu/${KERNEL_IMAGE}"
708 709
709 710 # Copy kernel config to QEMU directory
710 711 install_readonly "${R}/boot/config-${KERNEL_VERSION}" "${BASEDIR}/qemu/config-${KERNEL_VERSION}"
711 712
712 713 # Copy kernel dtbs to QEMU directory
713 714 for dtb in "${BOOT_DIR}/"*.dtb ; do
714 715 if [ -f "${dtb}" ] ; then
715 716 install_readonly "${dtb}" "${BASEDIR}/qemu/"
716 717 fi
717 718 done
718 719
719 720 # Copy kernel overlays to QEMU directory
720 721 if [ -d "${BOOT_DIR}/overlays" ] ; then
721 722 # Setup overlays dtbs directory
722 723 mkdir "${BASEDIR}/qemu/overlays"
723 724
724 725 for dtb in "${BOOT_DIR}/overlays/"*.dtb ; do
725 726 if [ -f "${dtb}" ] ; then
726 727 install_readonly "${dtb}" "${BASEDIR}/qemu/overlays/"
727 728 fi
728 729 done
729 730 fi
730 731
731 732 # Copy u-boot files to QEMU directory
732 733 if [ "$ENABLE_UBOOT" = true ] ; then
733 734 if [ -f "${BOOT_DIR}/u-boot.bin" ] ; then
734 735 install_readonly "${BOOT_DIR}/u-boot.bin" "${BASEDIR}/qemu/u-boot.bin"
735 736 fi
736 737 if [ -f "${BOOT_DIR}/uboot.mkimage" ] ; then
737 738 install_readonly "${BOOT_DIR}/uboot.mkimage" "${BASEDIR}/qemu/uboot.mkimage"
738 739 fi
739 740 if [ -f "${BOOT_DIR}/boot.scr" ] ; then
740 741 install_readonly "${BOOT_DIR}/boot.scr" "${BASEDIR}/qemu/boot.scr"
741 742 fi
742 743 fi
743 744
744 745 # Copy initramfs to QEMU directory
745 746 if [ -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" ] ; then
746 747 install_readonly "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" "${BASEDIR}/qemu/initramfs-${KERNEL_VERSION}"
747 748 fi
748 749 fi
749 750
750 751 # Calculate size of the chroot directory in KB
751 752 CHROOT_SIZE=$(expr "$(du -s "${R}" | awk '{ print $1 }')")
752 753
753 754 # Calculate the amount of needed 512 Byte sectors
754 755 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
755 756 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
756 757 ROOT_OFFSET=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}")
757 758
758 759 # The root partition is EXT4
759 760 # This means more space than the actual used space of the chroot is used.
760 761 # As overhead for journaling and reserved blocks 35% are added.
761 762 ROOT_SECTORS=$(expr "$(expr "${CHROOT_SIZE}" + "${CHROOT_SIZE}" \/ 100 \* 35)" \* 1024 \/ 512)
762 763
763 764 # Calculate required image size in 512 Byte sectors
764 765 IMAGE_SECTORS=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}")
765 766
766 767 # Prepare image file
767 768 if [ "$ENABLE_SPLITFS" = true ] ; then
768 769 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count="${TABLE_SECTORS}"
769 770 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek="${FRMW_SECTORS}"
770 771 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count="${TABLE_SECTORS}"
771 772 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek="${ROOT_SECTORS}"
772 773
773 774 # Write firmware/boot partition tables
774 775 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
775 776 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
776 777 EOM
777 778
778 779 # Write root partition table
779 780 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
780 781 ${TABLE_SECTORS},${ROOT_SECTORS},83
781 782 EOM
782 783
783 784 # Setup temporary loop devices
784 785 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME"-frmw.img)"
785 786 ROOT_LOOP="$(losetup -o 1M -f --show "$IMAGE_NAME"-root.img)"
786 787 else # ENABLE_SPLITFS=false
787 788 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count="${TABLE_SECTORS}"
788 789 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek="${IMAGE_SECTORS}"
789 790
790 791 # Write partition table
791 792 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
792 793 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
793 794 ${ROOT_OFFSET},${ROOT_SECTORS},83
794 795 EOM
795 796
796 797 # Setup temporary loop devices
797 798 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME".img)"
798 799 ROOT_LOOP="$(losetup -o 65M -f --show "$IMAGE_NAME".img)"
799 800 fi
800 801
801 802 if [ "$ENABLE_CRYPTFS" = true ] ; then
802 803 # Create dummy ext4 fs
803 804 mkfs.ext4 "$ROOT_LOOP"
804 805
805 806 # Setup password keyfile
806 807 touch .password
807 808 chmod 600 .password
808 809 echo -n ${CRYPTFS_PASSWORD} > .password
809 810
810 811 # Initialize encrypted partition
811 812 echo "YES" | cryptsetup luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -s "${CRYPTFS_XTSKEYSIZE}" .password
812 813
813 814 # Open encrypted partition and setup mapping
814 815 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
815 816
816 817 # Secure delete password keyfile
817 818 shred -zu .password
818 819
819 820 # Update temporary loop device
820 821 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
821 822
822 823 # Wipe encrypted partition (encryption cipher is used for randomness)
823 824 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count="$(blockdev --getsz "${ROOT_LOOP}")"
824 825 fi
825 826
826 827 # Build filesystems
827 828 mkfs.vfat "$FRMW_LOOP"
828 829 mkfs.ext4 "$ROOT_LOOP"
829 830
830 831 # Mount the temporary loop devices
831 832 mkdir -p "$BUILDDIR/mount"
832 833 mount "$ROOT_LOOP" "$BUILDDIR/mount"
833 834
834 835 mkdir -p "$BUILDDIR/mount/boot/firmware"
835 836 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
836 837
837 838 # Copy all files from the chroot to the loop device mount point directory
838 839 rsync -a "${R}/" "$BUILDDIR/mount/"
839 840
840 841 # Unmount all temporary loop devices and mount points
841 842 cleanup
842 843
843 844 # Create block map file(s) of image(s)
844 845 if [ "$ENABLE_SPLITFS" = true ] ; then
845 846 # Create block map files for "bmaptool"
846 847 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
847 848 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
848 849
849 850 # Image was successfully created
850 851 echo "$IMAGE_NAME-frmw.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
851 852 echo "$IMAGE_NAME-root.img ($(expr \( "${TABLE_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
852 853 else
853 854 # Create block map file for "bmaptool"
854 855 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
855 856
856 857 # Image was successfully created
857 858 echo "$IMAGE_NAME.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
858 859
859 860 # Create qemu qcow2 image
860 861 if [ "$ENABLE_QEMU" = true ] ; then
861 862 QEMU_IMAGE=${QEMU_IMAGE:=${BASEDIR}/qemu/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
862 863 QEMU_SIZE=16G
863 864
864 865 qemu-img convert -f raw -O qcow2 "$IMAGE_NAME".img "$QEMU_IMAGE".qcow2
865 866 qemu-img resize "$QEMU_IMAGE".qcow2 $QEMU_SIZE
866 867
867 868 echo "$QEMU_IMAGE.qcow2 ($QEMU_SIZE)" ": successfully created"
868 869 fi
869 870 fi
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant