VyOS image build scripts (mirror of https://github.com/vyos/vyos-build.git) https://git.amelek.net/vyos/vyos-build.git/atom?h=sever-sever-patch-1 2024-10-02T08:02:51+00:00 2024-10-02T08:02:51+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2024-10-02T08:02:51+00:00 urn:sha1:2fed892f2746561207aa21a2660f4d8f3f79d24e 2024-09-25T18:24:21+00:00 Christian Breunig christian@breunig.cc 2024-09-25T18:24:21+00:00 urn:sha1:d235b31a095f9b8fdb2d5c231935c8b4b4c3da6c The shim review board (which is the secure boot base loader) recommends using ephemeral keys when signing the Linux Kernel. This commit enables the Kernel build system to generate a one-time ephemeral key that is used to: * sign all build-in Kernel modules * sign all other out-of-tree Kernel modules The key lives in /tmp and is destroyed after the build container exits and is named: "VyOS build time autogenerated kernel key". In addition the Kernel now uses CONFIG_MODULE_SIG_FORCE. This now makes it unable to load any Kernel Module to the image that is NOT signed by the ephemeral key. 2024-09-14T18:58:44+00:00 Christian Breunig christian@breunig.cc 2024-09-14T18:58:27+00:00 urn:sha1:beb3df0733d8cf682291e19b0df0871da20ab5d4 2024-04-29T19:22:34+00:00 Christian Breunig christian@breunig.cc 2024-04-29T19:22:09+00:00 urn:sha1:fbe43ddcc2ee4a132a135bca688c533a4e9fab15 2024-03-23T12:30:35+00:00 Ernesto Castellotti ernesto@castellotti.net 2024-03-23T12:30:35+00:00 urn:sha1:a44647f0982f2a6b7a78af80f82e1c650ab0b11e The ixgbe driver did not support the 1000BASE-BX standard so for example FS.com SFP-GE-BX 1310/1490nm 10km transceiver received an unsupported module error even with allow_unsupported_sfp enabled. To solve this problem I created a patch that was accepted by Linux upstream (https://github.com/torvalds/linux/commit/1b43e0d20f2d007ec4c124b0deaa848ff8d61f4a) so starting from kernel 6.9 the ixgbe driver will have 1000BASE-BX support, however VyOS uses the out of tree driver so it is necessary to backport the patch. 2024-03-22T07:54:25+00:00 Christian Breunig christian@breunig.cc 2024-03-22T07:50:58+00:00 urn:sha1:ea7d59a4bf64a854be04ccf7566e1cf95d4e09a8 In-tree vs. Out-Of-Tree drivers differ in the way how unsupported transceivers are defined (uint vs array of int) for the Kernel module parameters. This results in: kernel: ixgbe 0000:5e:00.0: failed to initialize because an unsupported SFP+ module type was detected. kernel: ixgbe 0000:5e:00.0: Reload the driver after installing a supported module. kernel: ixgbe 0000:5e:00.0: removed PHC on eth6 This patch always enables unsupported SFP+ modules as wo do anyway from the userspace but only for the first port. 2024-02-01T09:03:38+00:00 Christian Breunig christian@breunig.cc 2024-02-01T08:42:25+00:00 urn:sha1:36065ae874e170f3f60829b0b5348119b7e15e9a This fixes commit 0f80a22b5 ("T5619: Add out-of-tree Intel ixgbe driver") to work with the latest 6.6 code base. For more information see https://lore.kernel.org/lkml/f90837d0-810e-5772-7841-28d47c44d260@intel.com 2024-02-01T09:03:38+00:00 Skyler Mäntysaari samip5@users.noreply.github.com 2023-10-18T19:33:35+00:00 urn:sha1:738ce141fb1c5cf77832bb93e21029b882910921