# Maintainer: David P. # Contributor: André Silva # Contributor: Márcio Silva # Contributor: fauno # Contributor: Sorin-Mihai Vârgolici # Contributor: Michał Masłowski # Contributor: Luke Shumaker # Contributor: Luke R. # Based on linux package pkgbase=linux-libre-xtreme _pkgbasever=4.14-gnu _pkgver=4.14.15-gnu _hardenedver=a _replacesarchkernel=('linux%') # '%' gets replaced with _kernelname _replacesoldkernels=() # '%' gets replaced with _kernelname _replacesoldmodules=() # '%' gets replaced with _kernelname _srcname=linux-${_pkgbasever%-*} _archpkgver=${_pkgver%-*} pkgver=${_pkgver//-/_} pkgrel=1 rcnrel=armv7-x4 arch=('i686' 'x86_64' 'armv7h') url="https://wiki.parabola.nu/Xtreme" license=('GPL2') makedepends=('kmod' 'inetutils' 'bc' 'libelf') makedepends_armv7h=('git') options=('!strip') source=( "https://linux-libre.fsfla.org/pub/linux-libre/releases/${_pkgbasever}/linux-libre-${_pkgbasever}.tar.xz"{,.sign} "https://linux-libre.fsfla.org/pub/linux-libre/releases/${_pkgver}/patch-${_pkgbasever}-${_pkgver}.xz"{,.sign} "https://github.com/copperhead/linux-hardened/releases/download/${_pkgver%-*}.${_hardenedver}/linux-hardened-${_pkgver%-*}.${_hardenedver}.patch"{,.sig} "https://repo.parabola.nu/other/linux-libre/logos/logo_linux_clut224.ppm"{,.sig} "https://repo.parabola.nu/other/linux-libre/logos/logo_linux_mono.pbm"{,.sig} "https://repo.parabola.nu/other/linux-libre/logos/logo_linux_vga16.ppm"{,.sig} # the main kernel config files 'config.i686' 'config.x86_64' 'config.armv7h' # pacman hooks for depmod and initramfs regeneration '60-linux.hook' '90-linux.hook' # standard config files for mkinitcpio ramdisk 'linux.preset' # armv7h patches "https://repo.parabola.nu/other/rcn-libre/patches/${_pkgver%-*}/rcn-libre-${_pkgver%-*}-${rcnrel}.patch"{,.sig} '0001-ARM-atags-add-support-for-Marvell-s-u-boot.patch' '0002-ARM-atags-fdt-retrieve-MAC-addresses-from-Marvell-bo.patch' '0003-SMILE-Plug-device-tree-file.patch' '0004-fix-mvsdio-eMMC-timing.patch' '0005-net-smsc95xx-Allow-mac-address-to-be-set-as-a-parame.patch' '0006-set-default-cubietruck-led-triggers.patch' '0007-exynos4412-odroid-set-higher-minimum-buck2-regulator.patch' '0008-disable-USB3-port-on-ODROID-XU.patch' '0009-ARM-dove-enable-ethernet-on-D3Plug.patch' # other patches '0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch' '0002-fix-Atmel-maXTouch-touchscreen-support.patch' '0001-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch' '0002-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch' '0003-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch' ) sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e684147ebed91d1528d2685423dd784c5fca0f3650f874f2b93cfc6b7689b9a87f' 'SKIP' '1d60b4b6abb48c757c772b5c6bbefc32d525757b3841bafc277f57d7814a54468e67d7a3932fd520b89b25cfb95e76a644eab38093f151b962132d2a2194b816' 'SKIP' '3db85f6cb13acfdc86940552ae945dda17c2cb6936059515bd1fb2d980aa972904e5aac56bf5ef933dad0087a7d0090437d5a11a658cae3cfd6148a21acb19de' 'SKIP' '13cb5bc42542e7b8bb104d5f68253f6609e463b6799800418af33eb0272cc269aaa36163c3e6f0aacbdaaa1d05e2827a4a7c4a08a029238439ed08b89c564bb3' 'SKIP' '267295aa0cea65684968420c68b32f1a66a22d018b9d2b2c1ef14267bcf4cb68aaf7099d073cbfefe6c25c8608bdcbbd45f7ac8893fdcecbf1e621abdfe9ecc1' 'SKIP' '7a3716bfe3b9f546da309c7492f3e08f8f506813afeb1c737a474c83313d5c313cf4582b65215c2cfce3b74d9d1021c96e8badafe8f6e5b01fe28d2b5c61ae78' 'SKIP' '5cb9e980110917da96f11fbc81688eb3b960a4543ffb1f4fae62eb0ccc79124cd2143e2d736febc52dc8db2856fa9e536713712a49fa3da263448465c5cecc20' '309300f5e74525dceec0e837a61071cfda761323a775cbf4350e0ed197ba5cf3763499f899919ebf6927f4e63ff804ac316ce4fe6af90aa76eae026db6adff55' '8e129802b8bd49a0529a29a7fcb6da59e071b7dc58e34cf9fcbbf10f95f65472ccccdd1ff0aabd01b14053c82d4ce4b02cec96542488da9b09d75f2ef16cea2d' '7ad5be75ee422dda3b80edd2eb614d8a9181e2c8228cd68b3881e2fb95953bf2dea6cbe7900ce1013c9de89b2802574b7b24869fc5d7a95d3cc3112c4d27063a' '4a8b324aee4cccf3a512ad04ce1a272d14e5b05c8de90feb82075f55ea3845948d817e1b0c6f298f5816834ddd3e5ce0a0e2619866289f3c1ab8fd2f35f04f44' '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf' '02ca6d0bb935ae6f9049ba363f5f0157b4dfd0e4181c65bedb7c0009a0accb6e8d4bb663cb61dd8b095cdd6684e5cbad5966ee6bffd65f0c3d4524b3faee225e' 'SKIP' '29c709ee6892a668c77945142ed9749cb8a3135575a4316f4a3cc85fbda41c09fdd65e32507b654c96aa438bd2aed08c09919bb162daee969643aafd053321c4' '5b35ef2c675aed00ddf82b8a96a486230fad78f05b5a69c95a57632d6c7f428f026439f3ced72cf54156ffd4fd563e68d4285ba6f42428c00b966257951039c3' 'e9544aa1f86328299e97e7ace9ef7997fc3e7ebc8ce906e5f87feee4cd716d75e46656c949dd103512fb13be2948db010c5aab233f2a8fc9cf49b2ae8d98a2fb' '757f75a0a1b14b43bc9150718748952b6e11252611aadf32490dbb35864e78075b31aa9f19bb3d22c442451125852389b13920b29e58449ee82bff92c7854a21' 'e882019d93cc95a379e9c46c1f72fc4df54507efa5fed498399424c0f0cc908d60ea94f422e1aefcfb2c4b6cfaa1c4d3de63b2cab09196c5147a36a07ab5ece8' '23f21fb05188479fb2238229a88d1d45f30052e3d7dcbbf99c5b9a763493eac122795431cf6932e85bd6e091380179b62e986782fafe7e8c2bd53940199b925e' '45a21f9dfec613c8f4dba284aaf80e307612440893536295a32ec805e11439272a0949921a22f12f67600df8415870aa27101b7e3d3869aea88ad3e1cb614086' '6c93bc1e8d580af288921e10c456bdbda1dcb6d6f08c111cddaf9a32b43c2df41b50136bc09aaac1da9c3cae667bba6e075d590dcc465107ae6e2c3dcf7da657' 'f813d51834cedc23fabbb6060709a24f29969fea5aeb963fdeddb79723014ffc0c6d34be45eea8419d5087a5a9c561a42a113d667f03625283f2f2fc68196545' '02af4dd2a007e41db0c63822c8ab3b80b5d25646af1906dc85d0ad9bb8bbf5236f8e381d7f91cf99ed4b0978c50aee37cb9567cdeef65b7ec3d91b882852b1af' 'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168' 'feba817e3e1595d8069ecc71cc3f3c358d1c65fd284ac4338e4d510c2322bb1c50d802fd1f48f9347323cebf469287bc24695f53b680eb1531c011f4b8452a18' 'edd7060b42a7bc77d720cefa65ce0fbb78e321e00c67d122ebf1efdbdba4181ef4ccb0e76ddcb4365c85db6dee21b18f26d66aad606d6c50cb68abd716cb9e69' 'e8229b8979ab287d9ad2cac137f2ba349bd43fd0fc09ad19239ea8e3d0d9571977a8296d3814887d7c15f61431f91194851b4a1af5c61ed416faec8283ce3206') validpgpkeys=( '474402C8C582DAFBE389C427BCB7CF877E7D47A7' # Alexandre Oliva '65EEFE022108E2B708CBFCF7F9E712E59AF5F22A' # Daniel Micay '6DB9C4B4F0D8C0DC432CF6E4227CA7C556B2BA78' # David P. ) _kernelname=${pkgbase#linux-libre} _replacesarchkernel=("${_replacesarchkernel[@]/\%/${_kernelname}}") _replacesoldkernels=("${_replacesoldkernels[@]/\%/${_kernelname}}") _replacesoldmodules=("${_replacesoldmodules[@]/\%/${_kernelname}}") case "${CARCH}" in i686|x86_64) KARCH=x86;; armv7h) KARCH=arm;; esac prepare() { cd ${_srcname} # add upstream patch if [ "${_pkgbasever}" != "${_pkgver}" ]; then patch -p1 -i ../patch-${_pkgbasever}-${_pkgver} fi chmod +x tools/objtool/sync-check.sh # GNU patch doesn't support git-style file mode if [ "${CARCH}" = "armv7h" ]; then # RCN patch (CM3 firmware deblobbed and AUFS removed) # Note: For stability reasons, AUFS has been removed in the RCN patch. # We are supporting AUFS in linux-libre-pck through PCK patch. # See https://wiki.parabola.nu/PCK for further details. git apply -v "${srcdir}/rcn-libre-${_pkgver%-*}-${rcnrel}.patch" # ALARM patches patch -p1 -i "${srcdir}/0001-ARM-atags-add-support-for-Marvell-s-u-boot.patch" patch -p1 -i "${srcdir}/0002-ARM-atags-fdt-retrieve-MAC-addresses-from-Marvell-bo.patch" patch -p1 -i "${srcdir}/0003-SMILE-Plug-device-tree-file.patch" patch -p1 -i "${srcdir}/0004-fix-mvsdio-eMMC-timing.patch" patch -p1 -i "${srcdir}/0005-net-smsc95xx-Allow-mac-address-to-be-set-as-a-parame.patch" patch -p1 -i "${srcdir}/0006-set-default-cubietruck-led-triggers.patch" patch -p1 -i "${srcdir}/0007-exynos4412-odroid-set-higher-minimum-buck2-regulator.patch" patch -p1 -i "${srcdir}/0008-disable-USB3-port-on-ODROID-XU.patch" patch -p1 -i "${srcdir}/0009-ARM-dove-enable-ethernet-on-D3Plug.patch" fi # add hardened patches patch -Np1 -i "${srcdir}/linux-hardened-${_pkgver%-*}.${_hardenedver}.patch" # add freedo as boot logo install -m644 -t drivers/video/logo \ "${srcdir}/logo_linux_"{clut224.ppm,vga16.ppm,mono.pbm} # security patches # add latest fixes from stable queue, if needed # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git # https://nvd.nist.gov/vuln/detail/CVE-2017-8824 patch -Np1 -i ../0001-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch # https://bugs.archlinux.org/task/56605 patch -Np1 -i ../0002-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch # https://bugs.archlinux.org/task/56711 patch -Np1 -i ../0003-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch # maintain the TTY over USB disconnects # http://www.coreboot.org/EHCI_Gadget_Debug patch -p1 -i "${srcdir}/0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch" # fix Atmel maXTouch touchscreen support # https://labs.parabola.nu/issues/877 # http://www.fsfla.org/pipermail/linux-libre/2015-November/003202.html patch -p1 -i "${srcdir}/0002-fix-Atmel-maXTouch-touchscreen-support.patch" cp -Tf ../config.${CARCH} .config if [ "${_kernelname}" != "" ]; then sed -i "s|CONFIG_LOCALVERSION=.*|CONFIG_LOCALVERSION=\"${_kernelname}\"|g" ./.config sed -i "s|CONFIG_LOCALVERSION_AUTO=.*|CONFIG_LOCALVERSION_AUTO=n|" ./.config fi # append pkgrel to extraversion sed -ri "s|^(EXTRAVERSION =.*\S).*|\1-${pkgrel}|" Makefile # don't run depmod on 'make install'. We'll do this ourselves in packaging sed -i '2iexit 0' scripts/depmod.sh # get kernel version make prepare # load configuration # Configure the kernel. Replace the line below with one of your choice. #make menuconfig # CLI menu for configuration #make nconfig # new CLI menu for configuration #make xconfig # X-based configuration #make oldconfig # using old config from previous kernel version # ... or manually edit .config # rewrite configuration yes "" | make config >/dev/null } build() { cd ${_srcname} if [ "${CARCH}" = "armv7h" ]; then make ${MAKEFLAGS} LOCALVERSION= zImage modules dtbs elif [ "${CARCH}" = "x86_64" ] || [ "${CARCH}" = "i686" ]; then make ${MAKEFLAGS} LOCALVERSION= bzImage modules fi } _package() { pkgdesc="The ${pkgbase^} kernel and modules with a handful of awesome security features [AppArmor, SMACK, TOMOYO, SELinux, YAMA, Linux-hardened]" [ "${pkgbase}" = "linux-libre" ] && groups=('base' 'base-openrc') depends=('coreutils' 'linux-libre-firmware' 'kmod' 'mkinitcpio>=0.7') optdepends=('crda: to set the correct wireless channels of your country' 'apparmor: to configure and enable mandatory access control for programs') provides=("${_replacesarchkernel[@]/%/=${_archpkgver}}" "LINUX-ABI_VERSION=${_archpkgver}") conflicts=("${_replacesarchkernel[@]}" "${_replacesoldkernels[@]}" "${_replacesoldmodules[@]}") replaces=("${_replacesarchkernel[@]}" "${_replacesoldkernels[@]}" "${_replacesoldmodules[@]}") backup=("etc/mkinitcpio.d/${pkgbase}.preset") install=linux.install cd ${_srcname} # get kernel version _kernver="$(make LOCALVERSION= kernelrelease)" _basekernel=${_kernver%%-*} _basekernel=${_basekernel%.*} mkdir -p "${pkgdir}"/{boot,usr/lib/modules} make LOCALVERSION= INSTALL_MOD_PATH="${pkgdir}/usr" modules_install if [ "${CARCH}" = "armv7h" ]; then make LOCALVERSION= INSTALL_DTBS_PATH="${pkgdir}/boot/dtbs/${pkgbase}" dtbs_install cp arch/$KARCH/boot/zImage "${pkgdir}/boot/vmlinuz-${pkgbase}" elif [ "${CARCH}" = "x86_64" ] || [ "${CARCH}" = "i686" ]; then cp arch/$KARCH/boot/bzImage "${pkgdir}/boot/vmlinuz-${pkgbase}" fi # make room for external modules local _extramodules="extramodules-${_basekernel}${_kernelname}" ln -s "../${_extramodules}" "${pkgdir}/usr/lib/modules/${_kernver}/extramodules" # add real version for building modules and running depmod from hook echo "${_kernver}" | install -Dm644 /dev/stdin "${pkgdir}/usr/lib/modules/${_extramodules}/version" # remove build and source links rm "${pkgdir}"/usr/lib/modules/${_kernver}/{source,build} # now we call depmod... depmod -b "${pkgdir}/usr" -F System.map "${_kernver}" if [ "${CARCH}" = "x86_64" ] || [ "${CARCH}" = "i686" ]; then # add vmlinux install -Dt "${pkgdir}/usr/lib/modules/${_kernver}/build" -m644 vmlinux fi # sed expression for following substitutions if [ "${CARCH}" = "armv7h" ]; then local _subst=" s|/boot/vmlinuz-%PKGBASE%|${_kernver}|g s|%PKGBASE%|${pkgbase}|g s|%KERNVER%|${_kernver}|g s|%EXTRAMODULES%|${_extramodules}|g " elif [ "${CARCH}" = "x86_64" ] || [ "${CARCH}" = "i686" ]; then local _subst=" s|%PKGBASE%|${pkgbase}|g s|%KERNVER%|${_kernver}|g s|%EXTRAMODULES%|${_extramodules}|g " fi # hack to allow specifying an initially nonexisting install file sed "${_subst}" "${startdir}/${install}" > "${startdir}/${install}.pkg" true && install=${install}.pkg # install mkinitcpio preset file sed "${_subst}" ../linux.preset | install -Dm644 /dev/stdin "${pkgdir}/etc/mkinitcpio.d/${pkgbase}.preset" # install pacman hooks sed "${_subst}" ../60-linux.hook | install -Dm644 /dev/stdin "${pkgdir}/usr/share/libalpm/hooks/60-${pkgbase}.hook" sed "${_subst}" ../90-linux.hook | install -Dm644 /dev/stdin "${pkgdir}/usr/share/libalpm/hooks/90-${pkgbase}.hook" } _package-headers() { pkgdesc="Header files and scripts for building modules for ${pkgbase^} kernel" provides=("${_replacesarchkernel[@]/%/-headers=${_archpkgver}}") conflicts=("${_replacesarchkernel[@]/%/-headers}" "${_replacesoldkernels[@]/%/-headers}") replaces=("${_replacesarchkernel[@]/%/-headers}" "${_replacesoldkernels[@]/%/-headers}") cd ${_srcname} local _builddir="${pkgdir}/usr/lib/modules/${_kernver}/build" install -Dt "${_builddir}" -m644 Makefile .config Module.symvers install -Dt "${_builddir}/kernel" -m644 kernel/Makefile mkdir "${_builddir}/.tmp_versions" cp -t "${_builddir}" -a include scripts install -Dt "${_builddir}/arch/${KARCH}" -m644 arch/${KARCH}/Makefile install -Dt "${_builddir}/arch/${KARCH}/kernel" -m644 arch/${KARCH}/kernel/asm-offsets.s if [[ ${CARCH} = i686 ]]; then install -t "${_builddir}/arch/${KARCH}" -m644 arch/${KARCH}/Makefile_32.cpu fi cp -t "${_builddir}/arch/${KARCH}" -a arch/${KARCH}/include install -Dt "${_builddir}/drivers/md" -m644 drivers/md/*.h install -Dt "${_builddir}/net/mac80211" -m644 net/mac80211/*.h # http://bugs.archlinux.org/task/9912 install -Dt "${_builddir}/drivers/media/dvb-core" -m644 drivers/media/dvb-core/*.h # http://bugs.archlinux.org/task/13146 install -Dt "${_builddir}/drivers/media/i2c" -m644 drivers/media/i2c/msp3400-driver.h # http://bugs.archlinux.org/task/20402 install -Dt "${_builddir}/drivers/media/usb/dvb-usb" -m644 drivers/media/usb/dvb-usb/*.h install -Dt "${_builddir}/drivers/media/dvb-frontends" -m644 drivers/media/dvb-frontends/*.h install -Dt "${_builddir}/drivers/media/tuners" -m644 drivers/media/tuners/*.h # add xfs and shmem for aufs building mkdir -p "${_builddir}"/{fs/xfs,mm} # copy in Kconfig files find . -name Kconfig\* -exec install -Dm644 {} "${_builddir}/{}" \; # add objtool for external module building and enabled VALIDATION_STACK option if [[ -e tools/objtool/objtool ]]; then install -Dt "${_builddir}/tools/objtool" tools/objtool/objtool fi # remove unneeded architectures local _arch for _arch in "${_builddir}"/arch/*/; do if [[ ${_arch} != */${KARCH}/ ]]; then rm -r "${_arch}" fi done # remove files already in linux-docs package rm -r "${_builddir}/Documentation" # parabola changes # # since we don't want to diverge too much from arch's pkgbuild, we'll # start marking our changes as such if [ "${CARCH}" = "armv7h" ]; then for i in dove exynos omap2; do mkdir -p "${pkgdir}/usr/lib/modules/${_kernver}/build/arch/${KARCH}/mach-${i}" cp -a arch/${KARCH}/mach-${i}/include "${pkgdir}/usr/lib/modules/${_kernver}/build/arch/${KARCH}/mach-${i}/" done for i in omap orion samsung versatile; do mkdir -p "${pkgdir}/usr/lib/modules/${_kernver}/build/arch/${KARCH}/plat-${i}" cp -a arch/${KARCH}/plat-${i}/include "${pkgdir}/usr/lib/modules/${_kernver}/build/arch/${KARCH}/plat-${i}/" done fi # end of parabola changes # Fix permissions chmod -R u=rwX,go=rX "${_builddir}" # strip scripts directory local _binary _strip while read -rd '' _binary; do case "$(file -bi "${_binary}")" in *application/x-sharedlib*) _strip="${STRIP_SHARED}" ;; # Libraries (.so) *application/x-archive*) _strip="${STRIP_STATIC}" ;; # Libraries (.a) *application/x-executable*) _strip="${STRIP_BINARIES}" ;; # Binaries *) continue ;; esac /usr/bin/strip ${_strip} "${_binary}" done < <(find "${_builddir}/scripts" -type f -perm -u+w -print0 2>/dev/null) } _package-docs() { pkgdesc="Kernel hackers manual - HTML documentation that comes with the ${pkgbase^} kernel" provides=("${_replacesarchkernel[@]/%/-docs=${_archpkgver}}") conflicts=("${_replacesarchkernel[@]/%/-docs}" "${_replacesoldkernels[@]/%/-docs}") replaces=("${_replacesarchkernel[@]/%/-docs}" "${_replacesoldkernels[@]/%/-docs}") cd ${_srcname} local _builddir="${pkgdir}/usr/lib/modules/${_kernver}/build" mkdir -p "${_builddir}" cp -t "${_builddir}" -a Documentation # Fix permissions chmod -R u=rwX,go=rX "${_builddir}" } pkgname=("${pkgbase}" "${pkgbase}-headers" "${pkgbase}-docs") for _p in ${pkgname[@]}; do eval "package_${_p}() { $(declare -f "_package${_p#${pkgbase}}") _package${_p#${pkgbase}} }" done # vim:set ts=8 sts=2 sw=2 et: