Initial commit

config/Config-build.in

@@ -0,0 +1,437 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2006-2013 OpenWrt.org
+# Copyright (C) 2016 LEDE Project
+
+config EXPERIMENTAL
+	bool "Enable experimental features by default"
+	help
+	  Set this option to build with latest bleeding edge features
+	  which may or may not work as expected.
+	  If you would like to help the development of OpenWrt, you are
+	  encouraged to set this option and provide feedback (both
+	  positive and negative). But do so only if you know how to
+	  recover your device in case of flashing potentially non-working
+	  firmware.
+
+	  If you plan to use this build in production, say NO!
+
+menu "Global build settings"
+
+	config JSON_OVERVIEW_IMAGE_INFO
+		bool "Create JSON info file overview per target"
+		default y
+		help
+		  Create a JSON info file called profiles.json in the target
+		  directory containing machine readable list of built profiles
+		  and resulting images.
+
+	config JSON_CYCLONEDX_SBOM
+		bool "Create CycloneDX SBOM JSON"
+		default BUILDBOT
+		help
+		  Create a JSON files *.bom.cdx.json in the build
+		  directory containing Software Bill Of Materials in CycloneDX
+		  format.
+
+	config ALL_NONSHARED
+		bool "Select all target specific packages by default"
+		select ALL_KMODS
+		default BUILDBOT
+
+	config ALL_KMODS
+		bool "Select all kernel module packages by default"
+
+	config ALL
+		bool "Select all userspace packages by default"
+		select ALL_KMODS
+		select ALL_NONSHARED
+
+	config BUILDBOT
+		bool "Set build defaults for automatic builds (e.g. via buildbot)"
+		help
+		  This option changes several defaults to be more suitable for
+		  automatic builds. This includes the following changes:
+		  - Deleting build directories after compiling (to save space)
+		  - Enabling per-device rootfs support
+		  ...
+
+	config SIGNED_PACKAGES
+		bool "Cryptographically signed package lists"
+		default y
+
+	config SIGNATURE_CHECK
+		bool "Enable signature checking in opkg"
+		default SIGNED_PACKAGES
+
+	config DOWNLOAD_CHECK_CERTIFICATE
+		bool "Enable TLS certificate verification during package download"
+		default y
+
+	config USE_APK
+		imply PACKAGE_apk-mbedtls
+		bool "Use APK instead of OPKG to build distribution"
+		default y
+
+	comment "General build options"
+
+	config TESTING_KERNEL
+		bool "Use the testing kernel version"
+		depends on HAS_TESTING_KERNEL
+		default EXPERIMENTAL
+		help
+		  If the target supports a newer kernel version than the default,
+		  you can use this config option to enable it
+
+
+	config DISPLAY_SUPPORT
+		bool "Show packages that require graphics support (local or remote)"
+
+	config BUILD_PATENTED
+		bool "Compile with support for patented functionality"
+		help
+		  When this option is disabled, software which provides patented functionality
+		  will not be built.  In case software provides optional support for patented
+		  functionality, this optional support will get disabled for this package.
+
+	config BUILD_NLS
+		bool "Compile with full language support"
+		help
+		  When this option is enabled, packages are built with the full versions of
+		  iconv and GNU gettext instead of the default OpenWrt stubs. If uClibc is
+		  used, it is also built with locale support.
+
+	config SHADOW_PASSWORDS
+		bool
+		default y
+
+	config CLEAN_IPKG
+		bool
+		prompt "Remove ipkg/opkg status data files in final images"
+		help
+		  This removes all ipkg/opkg status data files from the target directory
+		  before building the root filesystem.
+
+	config IPK_FILES_CHECKSUMS
+		bool
+		prompt "Record files checksums in package metadata"
+		depends on !USE_APK
+		help
+		  This makes file checksums part of package metadata. It increases size
+		  but provides you with pkg_check command to check for flash corruptions.
+
+	config INCLUDE_CONFIG
+		bool "Include build configuration in firmware" if DEVEL
+		help
+		  If enabled, buildinfo files will be stored in /etc/build.* of firmware.
+
+	config REPRODUCIBLE_DEBUG_INFO
+		bool "Make debug information reproducible"
+		default BUILDBOT
+		help
+		  This strips the local build path out of debug information. This has the
+		  advantage of making it reproducible, but the disadvantage of making local
+		  debugging using ./scripts/remote-gdb harder, since the debug data will
+		  no longer point to the full path on the build host.
+
+	config COLLECT_KERNEL_DEBUG
+		bool
+		prompt "Collect kernel debug information"
+		select KERNEL_DEBUG_INFO
+		default BUILDBOT
+		help
+		  This collects debugging symbols from the kernel and all compiled modules.
+		  Useful for release builds, so that kernel issues can be debugged offline
+		  later.
+
+	menu "Kernel build options"
+
+	source "config/Config-kernel.in"
+
+	endmenu
+
+	comment "Package build options"
+
+	config DEBUG
+		bool
+		prompt "Compile packages with debugging info"
+		help
+		  Adds -g3 to the CFLAGS.
+
+	config USE_GC_SECTIONS
+		bool
+		prompt "Dead code and data elimination for all packages (EXPERIMENTAL)"
+		help
+		  Places functions and data items into its own sections to use the linker's
+		  garbage collection capabilites.
+		  Packages can choose to opt-out via setting PKG_BUILD_FLAGS:=no-gc-sections
+
+	config USE_LTO
+		bool
+		prompt "Use the link-time optimizer for all packages (EXPERIMENTAL)"
+		help
+		  Adds LTO flags to the CFLAGS and LDFLAGS.
+		  Packages can choose to opt-out via setting PKG_BUILD_FLAGS:=no-lto
+
+	config MOLD
+		depends on (aarch64 || arm || i386 || i686 || m68k || powerpc || powerpc64 || sh4 || x86_64)
+		depends on !GCC_USE_VERSION_11
+		def_bool $(shell, ./config/check-hostcxx.sh 10 2 12)
+
+	config USE_MOLD
+		bool
+		prompt "Use the mold linker for all packages"
+		depends on MOLD
+		help
+		  Link packages with mold, a modern linker
+		  Packages can opt-out via setting PKG_BUILD_FLAGS:=no-mold
+
+	config IPV6
+		def_bool y
+
+	comment "Stripping options"
+
+	choice
+		prompt "Binary stripping method"
+		default USE_STRIP   if USE_GLIBC
+		default USE_SSTRIP
+		help
+		  Select the binary stripping method you wish to use.
+
+		config NO_STRIP
+			bool "none"
+			help
+			  This will install unstripped binaries (useful for native
+			  compiling/debugging).
+
+		config USE_STRIP
+			bool "strip"
+			help
+			  This will install binaries stripped using strip from binutils.
+
+		config USE_SSTRIP
+			bool "sstrip"
+			depends on !USE_GLIBC
+			help
+			  This will install binaries stripped using sstrip.
+	endchoice
+
+	config STRIP_ARGS
+		string
+		prompt "Strip arguments"
+		depends on USE_STRIP
+		default "--strip-unneeded --remove-section=.comment --remove-section=.note" if DEBUG
+		default "--strip-all"
+		help
+		  Specifies arguments passed to the strip command when stripping binaries.
+
+	config SSTRIP_DISCARD_TRAILING_ZEROES
+		bool "Strip trailing zero bytes"
+		depends on USE_SSTRIP && !USE_MOLD
+		default y
+		help
+		  Use sstrip's -z option to discard trailing zero bytes
+
+	config STRIP_KERNEL_EXPORTS
+		bool "Strip unnecessary exports from the kernel image"
+		depends on BROKEN
+		help
+		  Reduces kernel size by stripping unused kernel exports from the kernel
+		  image.  Note that this might make the kernel incompatible with any kernel
+		  modules that were not selected at the time the kernel image was created.
+
+	config USE_MKLIBS
+		bool "Strip unnecessary functions from libraries"
+		help
+		  Reduces libraries to only those functions that are necessary for using all
+		  selected packages (including those selected as <M>).  Note that this will
+		  make the system libraries incompatible with most of the packages that are
+		  not selected during the build process.
+
+	comment "Hardening build options"
+
+	config PKG_CHECK_FORMAT_SECURITY
+		bool
+		prompt "Enable gcc format-security"
+		default y
+		help
+		  Add -Wformat -Werror=format-security to the CFLAGS.  You can disable
+		  this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
+		  Makefile.
+
+	choice
+		prompt "User space ASLR PIE compilation"
+		default PKG_ASLR_PIE_NONE if ((SMALL_FLASH || LOW_MEMORY_FOOTPRINT) && !SDK)
+		default PKG_ASLR_PIE_REGULAR
+		help
+		  Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.
+		  This enables package build as Position Independent Executables (PIE)
+		  to protect against "return-to-text" attacks. This belongs to the
+		  feature of Address Space Layout Randomisation (ASLR), which is
+		  implemented by the kernel and the ELF loader by randomising the
+		  location of memory allocations. This makes memory addresses harder
+		  to predict when an attacker is attempting a memory-corruption exploit.
+		  You can disable this per package by adding PKG_ASLR_PIE:=0 in the package
+		  Makefile.
+		  Be ware that ASLR increases the binary size.
+		config PKG_ASLR_PIE_NONE
+			bool "None"
+			help
+			  PIE is deactivated for all applications
+		config PKG_ASLR_PIE_REGULAR
+			bool "Regular"
+			help
+			  PIE is activated for some binaries, mostly network exposed applications
+		config PKG_ASLR_PIE_ALL
+			bool "All"
+			select BUSYBOX_DEFAULT_PIE
+			help
+			  PIE is activated for all applications
+	endchoice
+
+	choice
+		prompt "User space Stack-Smashing Protection"
+		default PKG_CC_STACKPROTECTOR_REGULAR
+		help
+		  Enable GCC Stack Smashing Protection (SSP) for userspace applications
+		config PKG_CC_STACKPROTECTOR_NONE
+			bool "None"
+			help
+				No stack smashing protection.
+		config PKG_CC_STACKPROTECTOR_REGULAR
+			bool "Regular"
+			help
+				Protects functions with vulnerable objects.
+				This includes functions with buffers larger than 8 bytes or calls to alloca.
+		config PKG_CC_STACKPROTECTOR_STRONG
+			bool "Strong"
+			help
+				Like Regular, but also protects functions with
+				local arrays or references to local frame addresses.
+		config PKG_CC_STACKPROTECTOR_ALL
+			bool "All"
+			help
+				Protects all functions.
+	endchoice
+
+	choice
+		prompt "Kernel space Stack-Smashing Protection"
+		default KERNEL_CC_STACKPROTECTOR_REGULAR
+		help
+		  Enable GCC Stack-Smashing Protection (SSP) for the kernel
+		config KERNEL_CC_STACKPROTECTOR_NONE
+			bool "None"
+			help
+				No stack smashing protection.
+		config KERNEL_CC_STACKPROTECTOR_REGULAR
+			bool "Regular"
+			help
+				Protects functions with vulnerable objects.
+				This includes functions with buffers larger than 8 bytes or calls to alloca.
+		config KERNEL_CC_STACKPROTECTOR_STRONG
+			bool "Strong"
+			help
+				Like Regular, but also protects functions with
+				local arrays or references to local frame addresses.
+	endchoice
+
+	config KERNEL_STACKPROTECTOR
+		bool
+		default KERNEL_CC_STACKPROTECTOR_REGULAR || KERNEL_CC_STACKPROTECTOR_STRONG
+
+	config KERNEL_STACKPROTECTOR_STRONG
+		bool
+		default KERNEL_CC_STACKPROTECTOR_STRONG
+
+	choice
+		prompt "Enable buffer-overflows detection (FORTIFY_SOURCE)"
+		default PKG_FORTIFY_SOURCE_1
+		help
+		  Enable the _FORTIFY_SOURCE macro which introduces additional
+		  checks to detect buffer-overflows in the following standard library
+		  functions: memcpy, mempcpy, memmove, memset, strcpy, stpcpy,
+		  strncpy, strcat, strncat, sprintf, vsprintf, snprintf, vsnprintf,
+		  gets.  "Conservative" (_FORTIFY_SOURCE set to 1) only introduces
+		  checks that shouldn't change the behavior of conforming programs,
+		  while "aggressive" (_FORTIFY_SOURCES set to 2) some more checking is
+		  added, but some conforming programs might fail.
+		config PKG_FORTIFY_SOURCE_NONE
+			bool "None"
+		config PKG_FORTIFY_SOURCE_1
+			bool "Conservative"
+		config PKG_FORTIFY_SOURCE_2
+			bool "Aggressive"
+	endchoice
+
+	choice
+		prompt "Enable RELRO protection"
+		default PKG_RELRO_FULL
+		help
+		  Enable a link-time protection known as RELRO (Relocation Read Only)
+		  which helps to protect from certain type of exploitation techniques
+		  altering the content of some ELF sections. "Partial" RELRO makes the
+		  .dynamic section not writeable after initialization, introducing
+		  almost no performance penalty, while "full" RELRO also marks the GOT
+		  as read-only at the cost of initializing all of it at startup.
+		config PKG_RELRO_NONE
+			bool "None"
+		config PKG_RELRO_PARTIAL
+			bool "Partial"
+		config PKG_RELRO_FULL
+			bool "Full"
+	endchoice
+
+	config TARGET_ROOTFS_SECURITY_LABELS
+		bool
+		select KERNEL_SQUASHFS_XATTR
+		select KERNEL_EXT4_FS_SECURITY
+		select KERNEL_F2FS_FS_SECURITY
+		select KERNEL_UBIFS_FS_SECURITY
+		select KERNEL_JFFS2_FS_SECURITY
+
+	config SELINUX
+		bool "Enable SELinux"
+		select KERNEL_SECURITY_SELINUX
+		select TARGET_ROOTFS_SECURITY_LABELS
+		select PACKAGE_procd-selinux
+		select PACKAGE_busybox-selinux
+		help
+		  This option enables SELinux kernel features, applies security labels
+		  in squashfs rootfs and selects the selinux-variants of busybox and procd.
+
+		  Selecting this option results in about 0.5MiB of additional flash space
+		  usage accounting for increased kernel and rootfs size.
+
+	choice
+		prompt "default SELinux type"
+		depends on TARGET_ROOTFS_SECURITY_LABELS
+		default SELINUXTYPE_dssp
+		help
+		  Select SELinux policy to be installed and used for applying rootfs labels.
+
+		config SELINUXTYPE_targeted
+			bool "targeted"
+			select PACKAGE_refpolicy
+			help
+			  SELinux Reference Policy (refpolicy)
+
+		config SELINUXTYPE_dssp
+			bool "dssp"
+			select PACKAGE_selinux-policy
+			help
+			  Defensec SELinux Security Policy -- OpenWrt edition
+
+	endchoice
+
+	config USE_SECCOMP
+		bool "Enable SECCOMP"
+		select KERNEL_SECCOMP
+		depends on (aarch64 || arm || armeb || mips || mipsel || mips64 || mips64el || i386 || powerpc || x86_64)
+		depends on !TARGET_uml
+		default y
+		help
+		  This option enables seccomp kernel features to safely
+		  execute untrusted bytecode and selects the seccomp-variants
+		  of procd
+
+endmenu

config/Config-devel.in

@@ -0,0 +1,159 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2006-2013 OpenWrt.org
+
+menuconfig DEVEL
+	bool "Advanced configuration options (for developers)"
+
+	config BROKEN
+		bool "Show broken platforms / packages / devices" if DEVEL
+
+	config BINARY_FOLDER
+		string "Binary folder" if DEVEL
+		default ""
+		help
+		  Store built firmware images and filesystem images in this directory.
+		  If not set, uses './bin/$(BOARD)'
+
+	config DOWNLOAD_TOOL_CUSTOM
+		string "Use custom download tool" if DEVEL
+		default ""
+		help
+		  Use and force custom download tool instead of relying on autoselection
+		  between curl if available and wget as a fallback.
+
+		  download.pl supports 3 tools officially aria2c, curl and wget.
+		  If one of the tool is used in this config, download.pl will use the
+		  default args to make use of them.
+
+		  If the provided string is different than aria2c, curl or wget, the command
+		  is used as is and the download url will be appended at the end of such command.
+
+	config DOWNLOAD_FOLDER
+		string "Download folder" if DEVEL
+		default ""
+		help
+		  Store downloaded source bundles in this directory.
+		  If not set then defaults to './dl', which is removed by operations such as
+		  'git clean -xdf' or 'make distclean'.
+		  This option is useful if you have a low bandwidth Internet connection, and by
+		  setting a path outside the OpenWrt tree downloads will be saved.
+
+	config LOCALMIRROR
+		string "Local mirror for source packages" if DEVEL
+		default ""
+
+	config AUTOREBUILD
+		bool "Automatic rebuild of packages" if DEVEL
+		default y
+		help
+		  Automatically rebuild packages when their files change.
+
+	config AUTOREMOVE
+		bool "Automatic removal of build directories" if DEVEL
+		help
+		  Automatically delete build directories after make target completed.
+		  This allows you to symlink build_dir into a scratch location, e.g. a ramdisk,
+		  which does not have enough space to keep a complete build_dir.
+
+	config BUILD_ALL_HOST_TOOLS
+		bool "Compile all host tools" if DEVEL
+		help
+		  Compile all host host tools even if not needed. This is needed to prepare a
+		  universal precompiled host tools archive to use in another buildroot.
+
+	config BUILD_SUFFIX
+		string "Build suffix to append to the target BUILD_DIR variable" if DEVEL
+		default ""
+		help
+		  Build suffix to append to the BUILD_DIR variable, i.e: './build_dir/{target-build-dir}_$(BUILD_SUFFIX)'.
+		  This allows you to switch to a different .config whilst retaining all the build
+		  objects generated by the first .config
+
+	config TARGET_ROOTFS_DIR
+		string "Override the default TARGET_ROOTFS_DIR variable" if DEVEL
+		default ""
+		help
+		  Override the default TARGET_ROOTFS_DIR variable content $(BUILD_DIR) with
+		  custom path.  Use this option to re-define the location of the target
+		  root filesystem directory.
+
+	config CCACHE
+		bool "Use ccache" if DEVEL
+		help
+		  Compiler cache; see https://ccache.samba.org/
+
+	config CCACHE_DIR
+		string "Set ccache directory" if CCACHE
+		default ""
+		help
+		  Store ccache in this directory.
+		  If not set, uses './.ccache'
+
+	config KERNEL_CFLAGS
+		string "Kernel extra CFLAGS" if DEVEL
+		default "-falign-functions=32" if TARGET_bcm53xx
+		default ""
+
+	config EXTERNAL_KERNEL_TREE
+		string "Use external kernel tree" if DEVEL
+		default ""
+
+	config KERNEL_GIT_CLONE_URI
+		string "Enter git repository to clone" if DEVEL
+		default ""
+		help
+		  Enter the full git repository path i.e.:
+		  git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git
+		  This will create a git clone of the kernel in your build directory.
+
+	config KERNEL_GIT_LOCAL_REPOSITORY
+		string "Enter path to local reference repository" if DEVEL
+		depends on (KERNEL_GIT_CLONE_URI != "")
+		default ""
+		help
+		  Enter a full pathname to a local reference git repository.
+		  In this instance, the --reference option of git clone will
+		  be used thus creating a quick local clone of your repo.
+
+	config KERNEL_GIT_REF
+		string "Enter git ref at which to checkout" if DEVEL
+		depends on (KERNEL_GIT_CLONE_URI != "")
+		default ""
+		help
+		  Enter the git ref at which to checkout the git repository
+		  after it is cloned, and before making it a tar-ball.
+		  It can be a git hash or a branch name.
+		  If unused, the clone's repository HEAD will be checked-out.
+
+	config KERNEL_GIT_MIRROR_HASH
+		string "Enter hash of Git kernel tree source checkout tarball" if DEVEL
+		depends on (KERNEL_GIT_CLONE_URI != "")
+		default ""
+
+	config BUILD_LOG
+		bool "Enable log files during build process" if DEVEL
+		help
+		  If enabled, log files will be written to the ./log directory.
+
+	config BUILD_LOG_DIR
+		string "Log folder" if DEVEL
+		default ""
+		help
+		  Store build logs in this directory.
+		  If not set, uses './logs'
+
+	config SRC_TREE_OVERRIDE
+		bool "Enable package source tree override" if DEVEL
+		help
+		  If enabled, you can force a package to use a git tree as source
+		  code instead of the normal tarball. Create a symlink 'git-src'
+		  in the package directory, pointing to the .git tree that you want
+		  to pull the source code from.
+
+	config EXTRA_OPTIMIZATION
+		string "Additional compiler options" if DEVEL
+		default "-fno-caller-saves -fno-plt" if !CONFIG_EXTERNAL_TOOLCHAIN && !arc
+		default "-fno-caller-saves"
+		help
+		  Extra target-independent optimizations to use when building for the target.

config/Config-images.in

@@ -0,0 +1,325 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2006-2013 OpenWrt.org
+
+menu "Target Images"
+
+	menuconfig TARGET_ROOTFS_INITRAMFS
+		bool "ramdisk"
+		default y if USES_INITRAMFS
+		help
+		  Embed the root filesystem into the kernel (initramfs).
+
+		choice
+			prompt "Compression"
+			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_apm821xx
+			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_ath79_mikrotik
+			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_lantiq
+			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_mpc85xx
+			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_ramips
+			default TARGET_INITRAMFS_COMPRESSION_ZSTD if TARGET_qualcommax
+			default TARGET_INITRAMFS_COMPRESSION_XZ if USES_SEPARATE_INITRAMFS
+			default TARGET_INITRAMFS_COMPRESSION_NONE
+			depends on TARGET_ROOTFS_INITRAMFS
+			help
+			  Select ramdisk compression.
+
+			config TARGET_INITRAMFS_COMPRESSION_NONE
+				bool "none"
+
+			config TARGET_INITRAMFS_COMPRESSION_GZIP
+				bool "gzip"
+
+			config TARGET_INITRAMFS_COMPRESSION_BZIP2
+				bool "bzip2"
+
+			config TARGET_INITRAMFS_COMPRESSION_LZMA
+				bool "lzma"
+
+			config TARGET_INITRAMFS_COMPRESSION_LZO
+				bool "lzo"
+
+			config TARGET_INITRAMFS_COMPRESSION_LZ4
+				bool "lz4"
+
+			config TARGET_INITRAMFS_COMPRESSION_XZ
+				bool "xz"
+
+			config TARGET_INITRAMFS_COMPRESSION_ZSTD
+				bool "zstd"
+		endchoice
+
+		config EXTERNAL_CPIO
+			string
+			prompt "Use external cpio" if TARGET_ROOTFS_INITRAMFS
+			default ""
+			help
+			  Kernel uses specified external cpio as INITRAMFS_SOURCE.
+
+		config TARGET_INITRAMFS_FORCE
+			bool "Force"
+			depends on TARGET_ROOTFS_INITRAMFS
+			help
+			  Ignore the initramfs passed by the bootloader.
+
+		config TARGET_ROOTFS_INITRAMFS_SEPARATE
+			bool "separate ramdisk"
+			depends on USES_SEPARATE_INITRAMFS && TARGET_ROOTFS_INITRAMFS && !TARGET_INITRAMFS_FORCE
+			default y if USES_SEPARATE_INITRAMFS
+			help
+			  Generate separate initrd.cpio instead of embedding it.
+			  This is useful for generating images with a dedicated
+			  ramdisk e.g. in U-Boot's uImage and uImage.FIT formats.
+
+	comment "Root filesystem archives"
+
+	config TARGET_ROOTFS_CPIOGZ
+		bool "cpio.gz"
+		default y if USES_CPIOGZ
+		help
+		  Build a compressed cpio archive of the root filesystem.
+
+	config TARGET_ROOTFS_TARGZ
+		bool "tar.gz"
+		default y if USES_TARGZ
+		help
+		  Build a compressed tar archive of the root filesystem.
+
+	comment "Root filesystem images"
+
+	menuconfig TARGET_ROOTFS_EXT4FS
+		bool "ext4"
+		default y if USES_EXT4
+		help
+		  Build an ext4 root filesystem.
+
+		config TARGET_EXT4_RESERVED_PCT
+			int "Percentage of reserved blocks in root filesystem"
+			depends on TARGET_ROOTFS_EXT4FS
+			default 0
+			help
+			  Select the percentage of reserved blocks in the root filesystem.
+
+		choice
+			prompt "Root filesystem block size"
+			default TARGET_EXT4_BLOCKSIZE_4K
+			depends on TARGET_ROOTFS_EXT4FS
+			help
+			  Select the block size of the root filesystem.
+
+			config TARGET_EXT4_BLOCKSIZE_4K
+				bool "4k"
+
+			config TARGET_EXT4_BLOCKSIZE_2K
+				bool "2k"
+
+			config TARGET_EXT4_BLOCKSIZE_1K
+				bool "1k"
+		endchoice
+
+		config TARGET_EXT4_BLOCKSIZE
+			int
+			default 4096 if TARGET_EXT4_BLOCKSIZE_4K
+			default 2048 if TARGET_EXT4_BLOCKSIZE_2K
+			default 1024 if TARGET_EXT4_BLOCKSIZE_1K
+			depends on TARGET_ROOTFS_EXT4FS
+
+		config TARGET_EXT4_JOURNAL
+			bool "Create a journaling filesystem"
+			depends on TARGET_ROOTFS_EXT4FS
+			default y
+			help
+			  Create an ext4 filesystem with a journal.
+
+	config TARGET_ROOTFS_JFFS2
+		bool "jffs2"
+		depends on USES_JFFS2
+		help
+		  Build a JFFS2 root filesystem.
+
+	config TARGET_ROOTFS_JFFS2_NAND
+		bool "jffs2 for NAND"
+		default y if USES_JFFS2_NAND
+		depends on USES_JFFS2_NAND
+		help
+		  Build a JFFS2 root filesystem for NAND flash.
+
+	menuconfig TARGET_ROOTFS_SQUASHFS
+		bool "squashfs"
+		default y if USES_SQUASHFS
+		help
+		  Build a squashfs root filesystem.
+
+		config TARGET_SQUASHFS_BLOCK_SIZE
+			int "Block size (in KiB)"
+			depends on TARGET_ROOTFS_SQUASHFS
+			default 64 if LOW_MEMORY_FOOTPRINT
+			default 1024 if (SMALL_FLASH && !LOW_MEMORY_FOOTPRINT)
+			default 256
+			help
+			  Select squashfs block size, must be one of:
+			    4, 8, 16, 32, 64, 128, 256, 512, 1024
+
+	menuconfig TARGET_ROOTFS_UBIFS
+		bool "ubifs"
+		default y if USES_UBIFS
+		depends on USES_UBIFS
+		help
+		  Build a UBIFS root filesystem.
+
+		choice
+			prompt "compression"
+			default TARGET_UBIFS_COMPRESSION_ZLIB
+			depends on TARGET_ROOTFS_UBIFS
+			help
+			  Select compression type
+
+			config TARGET_UBIFS_COMPRESSION_NONE
+				bool "none"
+
+			config TARGET_UBIFS_COMPRESSION_LZO
+				bool "lzo"
+
+			config TARGET_UBIFS_COMPRESSION_ZLIB
+				bool "zlib"
+		endchoice
+
+		config TARGET_UBIFS_FREE_SPACE_FIXUP
+			bool "free space fixup" if TARGET_ROOTFS_UBIFS
+			default y
+			help
+			  The filesystem free space has to be fixed up on first mount.
+
+		config TARGET_UBIFS_JOURNAL_SIZE
+			string
+			prompt "journal size" if TARGET_ROOTFS_UBIFS
+			default ""
+
+	config GRUB_IMAGES
+		bool "Build GRUB images (Linux x86 or x86_64 host only)"
+		depends on TARGET_x86
+		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS
+		select PACKAGE_grub2
+		select PACKAGE_grub2-bios-setup
+		default y
+
+	config GRUB_EFI_IMAGES
+		bool "Build GRUB EFI images"
+		depends on TARGET_x86 || TARGET_armsr || TARGET_loongarch64
+		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS
+		select PACKAGE_grub2 if TARGET_x86
+		select PACKAGE_grub2-efi if TARGET_x86
+		select PACKAGE_grub2-bios-setup if TARGET_x86
+		select PACKAGE_grub2-efi-arm if TARGET_armsr
+		select PACKAGE_grub2-efi-loongarch64 if TARGET_loongarch64
+		select PACKAGE_kmod-fs-vfat
+		default y
+
+	config GRUB_CONSOLE
+		bool "Use Console Terminal (in addition to Serial)"
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		default y
+
+	config GRUB_BAUDRATE
+		int "Serial port baud rate"
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		default 38400 if TARGET_x86_generic
+		default 115200
+
+	config GRUB_FLOWCONTROL
+		bool "Use RTE/CTS on serial console"
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		depends on TARGET_SERIAL != ""
+
+	config GRUB_BOOTOPTS
+		string "Extra kernel boot options"
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		help
+		  If you don't know, just leave it blank.
+
+	config GRUB_TIMEOUT
+		string "Seconds to wait before booting the default entry"
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		default "5"
+		help
+		  If you don't know, 5 seconds is a reasonable default.
+
+	config GRUB_TITLE
+		string "Title for the menu entry in GRUB"
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		default "OpenWrt"
+		help
+		  This is the title of the GRUB menu entry.
+		  If unspecified, it defaults to OpenWrt.
+
+	config ISO_IMAGES
+		bool "Build LiveCD image (ISO)"
+		depends on TARGET_x86
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+
+	config VDI_IMAGES
+		bool "Build VirtualBox image files (VDI)"
+		depends on TARGET_x86
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		select PACKAGE_kmod-e1000
+
+	config VMDK_IMAGES
+		bool "Build VMware image files (VMDK)"
+		depends on TARGET_x86 || TARGET_armsr
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		select PACKAGE_kmod-e1000
+
+	config VHDX_IMAGES
+		bool "Build Hyper-V image files (VHDX)"
+		depends on TARGET_x86
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		select PACKAGE_kmod-e1000
+
+	config TARGET_SERIAL
+		string "Serial port device"
+		depends on TARGET_x86 || TARGET_armsr || TARGET_loongarch64
+		default "ttyS0"
+
+	config TARGET_IMAGES_GZIP
+		bool "GZip images"
+		depends on TARGET_ROOTFS_EXT4FS || TARGET_x86 || TARGET_armsr || TARGET_malta || TARGET_loongarch64
+		default y
+
+	comment "Image Options"
+
+	source "target/linux/*/image/Config.in"
+	source "target/linux/*/*/image/Config.in"
+
+	config TARGET_KERNEL_PARTSIZE
+		int "Kernel partition size (in MiB)"
+		depends on USES_BOOT_PART
+		default 8 if TARGET_apm821xx_sata
+		default 64 if TARGET_bcm27xx
+		default 128 if TARGET_armsr
+		default 16
+
+	config TARGET_ROOTFS_PARTSIZE
+		int "Root filesystem partition size (in MiB)"
+		depends on USES_ROOTFS_PART || TARGET_ROOTFS_EXT4FS
+		default 232 if TARGET_loongarch64
+		default 448 if TARGET_mediatek
+		default 104
+		help
+		  Select the root filesystem partition size.
+
+	config TARGET_ROOTFS_PARTNAME
+		string "Root partition on target device"
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		help
+		  Override the root partition on the final device. If left empty,
+		  it will be mounted by PARTUUID which makes the kernel find the
+		  appropriate disk automatically.
+
+	config TARGET_ROOTFS_PERSIST_VAR
+		bool "Make /var persistent"
+		help
+		  Do not symlink /var to /tmp, so that its content will persist
+		  across reboots. When enabled, /var/run will still be linked
+		  to /tmp/run.
+
+endmenu

config/check-hostcxx.sh

@@ -0,0 +1,12 @@
+cat << EOF | "$STAGING_DIR_HOST/bin/g++" -c -x c++ -o /dev/null - >/dev/null 2>&1
+#if __clang__
+  #if __clang_major__ < $3
+    #error "clang too old"
+  #endif
+#else
+  #if __GNUC__ < $1 || (__GNUC__ == $1 && (__GNUC_MINOR__ < $2))
+    #error "gcc too old"
+  #endif
+#endif
+EOF
+[ $? -eq 0 ] && echo y || echo n

config/check-uname.sh

@@ -0,0 +1 @@
+[ "$(uname)" = "$1" ] && echo y || echo n