docs: release 0.2.0-beta.17

CHANGELOG.md

@@ -6,15 +6,15 @@ pre-releases for test devices only.
 
 ## 0.2.0-beta.17
 
+- **SMB 3 with signing about three times as fast: the crypto engine computes the signatures** ([#94](https://github.com/UniqueDroid/ShareOS/issues/94)). Windows 11 signs every SMB connection, and on the 800 MHz Kirkwood the signature limited writing: measured on a DNS-320L, about 35 MB/s without signing (the disks), only 4–10 MB/s with SMB 3.1.1 – ksmbd computes AES-CMAC on the CPU, where AES manages about 12 MB/s. The Kirkwood has a crypto engine (Marvell CESA) that does AES-CBC at about 38 MB/s with DMA, but ksmbd could not use it. A kernel patch (`0001-ksmbd-cmac-via-cbc`) computes the AES-CMAC of messages from 8 KiB through `cbc(aes)` – the engine – (CMAC is a CBC-MAC; the last block and the subkeys on the CPU), checks the first result against the old way and falls back to it on any error. Measured: **19–23 MB/s** signed, the CPU load of ksmbd went from about 64 % to under 10 %. `shareos-shares` loads `marvell-cesa` before ksmbd; module parameter `ksmbd.cbc_cmac=0` switches it off. Tested before on a UML kernel with Samba's smbclient (signing required, checksums equal). Tried as well and dropped: AES-GMAC signing (GHASH in C on ARMv5 is not faster, 3–8 MB/s).
+- **SMB compatibility mode** (Freigaben → Dienste → SMB → *Kompatibilitätsmodus (höchstens SMB 2.1)*, off by default) for devices that have trouble with SMB 3: limits ksmbd to SMB 2.1 (HMAC-SHA256 signature on the CPU, 9–14 MB/s signed; no encryption, no multichannel). Changing it restarts ksmbd (the protocol range is only read at start); a `ksmbd.mountd` left over without the kernel module is restarted instead of being taken for a running SMB server. The kernel also has AES in ARM assembly now (`CONFIG_CRYPTO_AES_ARM`). `tests/test-users.sh` checks the setting.
+- **Take over disks with data instead of erasing them.** Speicher → Laufwerke shows **„<partition> übernehmen“** at every partition (or RAID array) with a file system ShareOS does not know yet – the data disks of Alt-F or the D-Link firmware. It becomes a volume as it is: nothing is erased, ext4 gets the quick check and the quota feature as every volume, the first Linux volume becomes the apps area, RAID 1/0/linear arrays get their layout and go into `mdadm.conf`. Before, only the setup wizard was offered, which erases the disks (asked by a tester right after switching from Alt-F). `shareos-storage adopt <name> <partition>`, rpcd `shareos.storage adopt`; `tests/test-storage.sh` (+4 checks). SWITCHING/UMSTIEG explain it, with the SSH commands for older versions.
+- **DNS-320 rev A: no more reboot loop after flashing** ([#96](https://github.com/UniqueDroid/ShareOS/issues/96)). The stock U-Boot copies the initramfs to its load address before the kernel starts; on the DNS-325 0x800000 lies in memory the kernel uses, so the kernel dropped the initramfs, found no `/init` and restarted every minute (fixed for the DNS-325 in 0.2.0-beta.9). The DNS-320 rev A – the same SoC (88F6281) and U-Boot family – showed the same kind of loop (LEDs on, restart about every minute, no network), so its initramfs is now loaded at 0x1000000 as on the DNS-325. A box already in the loop needs a serial console once to start the new image from RAM (see the issue). `tests/check-initrd-address.sh` checks the new address.
+- **Scheduled jobs did not run at all** ([#82](https://github.com/UniqueDroid/ShareOS/issues/82)). BusyBox `crond` reads `<dir>/crontabs`, and buildroot's busybox config sets the dir to `/etc/cron` – while `shareos-cron` writes root's crontab to `/etc/crontabs/root`. So `crond` saw an empty `/etc/cron/crontabs`, and none of the ShareOS jobs ran: the scheduled switch-off (reported: the box switched on by schedule but not off), the hourly wake-up alarm, the message checks every 10 minutes, automatic updates, scheduled SMART tests, cloud jobs, Paperless inboxes, app tasks, the Zabbix collector. Running a job by hand always worked, which hid it. `CONFIG_FEATURE_CROND_DIR="/etc"` now, and `post-build.sh` stops the build if crond would read another directory. On a box before beta.17: `rm -rf /etc/cron/crontabs; ln -s /etc/crontabs /etc/cron/crontabs; /etc/init.d/S50crond restart`.
 - **Power schedule: you see when the box comes on again.** The schedule is a short overview first (the days with their times, next switch-on/-off, *aktiv*/*aus*) with *Einrichten*/*Bearbeiten*; the table only opens on that button. The page shows the next switch-on and switch-off with the full date; saving says "the box switches on on Sat., 07.11.2026, 10:15" (or that none is planned); the power-off dialog says when the schedule switches it on again. Times entered while the switch *Zeitplan einschalten* is off get a clear warning (easy to miss before). The switch-on must now be only **one minute** ahead (was three) when you save or switch off – the alarm counts whole minutes and the MCU cuts the power 3 s after the shutdown; before, a test like "on at 10:15, switch off at 10:13" silently set the alarm for the next week. `tests/test-power.sh` updated.
-- **Header stays on one line.** The status chips (messages, update, VPN, apps …) use the free room left of *ONLINE*; the ones that do not fit go behind a small **+N** button (amber when a warning is among them), which opens them as a list under the row – the header keeps its height and the clock stays on the right. The *MELDUNG* chip no longer counts the “update available” message while the *UPDATE* chip is shown (it counted the same thing twice; the message stays under System → Meldungen and still goes out by mail/push).
 - **Interface:** *Mein ShareOS* has its own tab **APPS** with all apps of the user (star = favourite); the start page keeps only the favourites at the top (*FAV APPS*). System → Allgemein: device name and access (root password) moved down, between *App & Widgets* and *Über* (section *GERÄT & ZUGANG*).
-- **Scheduled jobs did not run at all** ([#82](https://github.com/UniqueDroid/ShareOS/issues/82)). BusyBox `crond` reads `<dir>/crontabs`, and buildroot's busybox config sets the dir to `/etc/cron` – while `shareos-cron` writes root's crontab to `/etc/crontabs/root`. So `crond` saw an empty `/etc/cron/crontabs`, and none of the ShareOS jobs ran: the scheduled switch-off (reported: the box switched on by schedule but not off), the hourly wake-up alarm, the message checks every 10 minutes, automatic updates, scheduled SMART tests, cloud jobs, Paperless inboxes, app tasks, the Zabbix collector. Running a job by hand always worked, which hid it. `CONFIG_FEATURE_CROND_DIR="/etc"` now, and `post-build.sh` stops the build if crond would read another directory. On a box before beta.17: `rm -rf /etc/cron/crontabs; ln -s /etc/crontabs /etc/cron/crontabs; /etc/init.d/S50crond restart`.
-- **Take over disks with data instead of erasing them.** Speicher → Laufwerke shows **„<partition> übernehmen“** at every partition (or RAID array) with a file system ShareOS does not know yet – the data disks of Alt-F or the D-Link firmware. It becomes a volume as it is: nothing is erased, ext4 gets the quick check and the quota feature as every volume, the first Linux volume becomes the apps area, RAID 1/0/linear arrays get their layout and go into `mdadm.conf`. Before, only the setup wizard was offered, which erases the disks (asked by a tester right after switching from Alt-F). `shareos-storage adopt <name> <partition>`, rpcd `shareos.storage adopt`; `tests/test-storage.sh` (+4 checks). SWITCHING/UMSTIEG explain it, with the SSH commands for older versions.
+- **Header stays on one line.** The status chips (messages, update, VPN, apps …) use the free room left of *ONLINE*; the ones that do not fit go behind a small **+N** button (amber when a warning is among them), which opens them as a list under the row – the header keeps its height and the clock stays on the right. The *MELDUNG* chip no longer counts the “update available” message while the *UPDATE* chip is shown (it counted the same thing twice; the message stays under System → Meldungen and still goes out by mail/push).
 - **Hardening after an external code review** (static analysis by another AI, checked against the code; the suggested patch was not taken over as it was, because it only moved one overflow into the next buffer). `dns320l-daemon`: the arguments of a `-x` command were assembled into 64 bytes with `sprintf` and copied into 512-byte messages with `strcpy` – now at most 256 bytes, `snprintf`, refused when too long (a heap overflow before, shown with AddressSanitizer); the command name is checked against its 64 bytes; the answer of the daemon is read with room for the terminating zero (one byte past the buffer before); `write_str_to_file` writes the string as it is instead of through a 64-byte copy, and completely. `dns323-fw`: complete writes (`write_all`), the disabled size check is documented (damaged files fail the checksums). `shareos-flash-bin`: one firmware write at a time (lock with the pid; a stale one is taken over). All of this was only reachable locally as root (the daemon listens on a root-only Unix socket) – nothing changes in how fan, LEDs and MCU are driven. `tests/test-flash-bin.sh` +2 checks.
-- **DNS-320 rev A: no more reboot loop after flashing** ([#96](https://github.com/UniqueDroid/ShareOS/issues/96)). The stock U-Boot copies the initramfs to its load address before the kernel starts; on the DNS-325 0x800000 lies in memory the kernel uses, so the kernel dropped the initramfs, found no `/init` and restarted every minute (fixed for the DNS-325 in 0.2.0-beta.9). The DNS-320 rev A – the same SoC (88F6281) and U-Boot family – showed the same kind of loop (LEDs on, restart about every minute, no network), so its initramfs is now loaded at 0x1000000 as on the DNS-325. A box already in the loop needs a serial console once to start the new image from RAM (see the issue). `tests/check-initrd-address.sh` checks the new address.
-- **SMB 3 with signing about three times as fast: the crypto engine computes the signatures** ([#94](https://github.com/UniqueDroid/ShareOS/issues/94)). Windows 11 signs every SMB connection, and on the 800 MHz Kirkwood the signature limited writing: measured on a DNS-320L, about 35 MB/s without signing (the disks), only 4–10 MB/s with SMB 3.1.1 – ksmbd computes AES-CMAC on the CPU, where AES manages about 12 MB/s. The Kirkwood has a crypto engine (Marvell CESA) that does AES-CBC at about 38 MB/s with DMA, but ksmbd could not use it. A kernel patch (`0001-ksmbd-cmac-via-cbc`) computes the AES-CMAC of messages from 8 KiB through `cbc(aes)` – the engine – (CMAC is a CBC-MAC; the last block and the subkeys on the CPU), checks the first result against the old way and falls back to it on any error. Measured: **19–23 MB/s** signed, the CPU load of ksmbd went from about 64 % to under 10 %. `shareos-shares` loads `marvell-cesa` before ksmbd; module parameter `ksmbd.cbc_cmac=0` switches it off. Tested before on a UML kernel with Samba's smbclient (signing required, checksums equal). Tried as well and dropped: AES-GMAC signing (GHASH in C on ARMv5 is not faster, 3–8 MB/s).
-- **SMB compatibility mode** (Freigaben → Dienste → SMB → *Kompatibilitätsmodus (höchstens SMB 2.1)*, off by default) for devices that have trouble with SMB 3: limits ksmbd to SMB 2.1 (HMAC-SHA256 signature on the CPU, 9–14 MB/s signed; no encryption, no multichannel). Changing it restarts ksmbd (the protocol range is only read at start); a `ksmbd.mountd` left over without the kernel module is restarted instead of being taken for a running SMB server. The kernel also has AES in ARM assembly now (`CONFIG_CRYPTO_AES_ARM`). `tests/test-users.sh` checks the setting.
 
 ## 0.2.0-beta.16
 

README.md

@@ -67,6 +67,7 @@ Version in brackets = first release with the feature.
 
 **Storage**
 - Setup wizard: one disk, two separate disks, a mirror (RAID 1), RAID 0 or JBOD (mdadm; RAID 0/JBOD from beta.9), optional swap partition per disk
+- Take over disks with data from Alt-F or the D-Link firmware as they are, nothing erased (Speicher → Laufwerke → *übernehmen*, 0.2.0-beta.17)
 - File system per volume: **ext4** (recommended: owners, storage limit per user, personal folders, apps), **Btrfs**, **exFAT**, **NTFS** (beta.7), **ext3**, **ext2**, **FAT32** (beta.9)
 - Share rights are also set as POSIX ACLs on the share folders (ext4, Btrfs), so every program of a user is held to them, not only SMB (0.2.0-beta.6)
 - **Snapshots:** dated states of shares, personal folders or whole drives on another drive (hourly to weekly, hard links like rsnapshot, keep the last N plus days/weeks/months), restore with the file browser (0.2.0-beta.6)
@@ -75,7 +76,7 @@ Version in brackets = first release with the feature.
 - **USB sticks and disks:** mounted at `/mnt/usb-<name>` when plugged in (FAT32, exFAT, NTFS, ext4, Btrfs), **Safely remove**, **Format** with exFAT, FAT32, NTFS or ext4 (beta.7)
 
 **Shares, users, files**
-- SMB 2/3 (ksmbd) and NFS v4 shares with read/write permissions per user and group, guest access optional
+- SMB 2/3 (ksmbd) and NFS v4 shares with read/write permissions per user and group, guest access optional; the crypto engine of the SoC computes the SMB 3 signatures (about three times as fast, 0.2.0-beta.17); compatibility mode up to SMB 2.1 for difficult clients (0.2.0-beta.17)
 - Users and groups; one account for shares, web interface and apps; storage limit per user (ext4); import of Alt-F users with their passwords
 - "My ShareOS": users with web access manage their own password, look, shares, storage, cloud and Paperless
 - File browser in the web interface: admins for all drives and USB drives, users for their personal folder and the shares they have rights to (enabled per user; read-only shares stay read-only, also for apps); upload/download with progress, drag and drop, large files; trash per folder with restore and automatic emptying (0.2.0-beta.12)
@@ -113,7 +114,7 @@ Version in brackets = first release with the feature.
 - Back to Alt-F (or any D-Link `.bin`) from the firmware page, checked and read back (beta.7)
 - First-run assistant, network settings with automatic rollback, name via mDNS (`<name>.local`), fallback address `192.168.0.32` without DHCP
 - HTTPS with a self-signed certificate that follows name and IP, own certificate possible
-- Power schedule: switch off and on per weekday (switching on through the wake-up alarm of the DNS-320L/320 rev B/327L; 0.2.0-beta.15)
+- Power schedule: switch off and on per weekday (switching on through the wake-up alarm of the DNS-320L/320 rev B/327L; 0.2.0-beta.15; switching off works from 0.2.0-beta.17, the overview shows the date of the next switch-on)
 - Start log: the logs of the last 3 starts are kept on the flash (System → Protokolle → *Start-Protokoll*), so a box that was unreachable after a start can be looked into afterwards (0.2.0-beta.15)
 - Reset button: access reset (5–10 s: network, root password, certificate) or factory reset (≥ 15 s), USB button removes USB drives (beta.9) or copies them into a dated folder (0.2.0-beta.12); the buttons work again on the DNS-320L and DNS-325 (0.2.0-beta.10)
 - Messages: RAID, volumes, temperature, SMART, updates, failed cloud jobs and app tasks – in the interface, by e-mail (SMTP) and push (ntfy, Gotify, webhook) (beta.9), Telegram bot (beta.12)

docs/DEVELOPMENT.md

@@ -211,6 +211,28 @@ the box for why the web server was not running.
 | 18:25 | Two reports about OneDrive (#91, #92): after signing in, `rclone.conf` lacked `drive_id` and `drive_type` – rclone asks for the drive only in its interactive setup. Now ShareOS looks it up at Microsoft Graph. A failed "Add" also used up the sign-in. |
 | 20:38 | The reporter's output showed why users could not open the downloads: his shares point into the personal folders, which get no share rights – the admin job's files belonged to root. They now belong to the user of the folder (#93) – `v0.2.0-beta.16`. |
 
+### Wednesday, 28.10.2026
+
+| Time | What happened |
+|---|---|
+| 09:10 | Jan publishes `v0.2.0-beta.16`. |
+
+### Friday, 30.10.2026
+
+| Time | What happened |
+|---|---|
+| 20:53 | A DNS-320 rev A restarted in a loop after flashing (#96): its U-Boot copies the initramfs to an address the kernel then overwrote. The image now loads it at 0x01000000 (#98). |
+| 22:02 | SMB was slow (#94): signed SMB 3 at 4–10 MB/s, the CPU busy with AES-CMAC. Jan's measurements on the box: unsigned 32–40 MB/s. First step: a compatibility mode up to SMB 2.1 (#99). |
+
+### Saturday, 31.10.2026
+
+| Time | What happened |
+|---|---|
+| 00:08 | A tester switching from Alt-F asked how to keep the data on his disks – the setup wizard erases them. Now *übernehmen* takes a disk with data as it is (#100). He followed the SSH steps and both disks run on ShareOS. |
+| 08:39 | ksmbd computes the SMB 3 signatures (AES-CMAC) through `cbc(aes)` of the Marvell crypto engine: Jan measured 18–22 MB/s instead of 6–11 (#101). The same morning: hardening after an external code review (#102). |
+| 12:34 | Switching off by schedule never happened (#82): BusyBox `crond` read the empty `/etc/cron/crontabs`, so no ShareOS cron job had ever run (#104). |
+| 15:14 | The schedule is a short overview with the date of the next switch-on (#105); *Mein ShareOS* gets its own APPS tab and the header stays on one line, the rest behind **+N** (#106). Everything goes into `v0.2.0-beta.17`. |
+
 ## Notable problems solved
 
 - **The bootloader's 3 MB limit:** the kernel shrank from 4.2 to 2.4 MB, with drivers moved to modules. The initramfs is only 0.9 MB.

docs/ENTWICKLUNG.md

@@ -212,6 +212,28 @@ direkt auf der Box nachgesehen, warum der Webserver nicht lief.
 | 18:25 | Zwei Meldungen zu OneDrive (#91, #92): Nach der Anmeldung fehlten in der `rclone.conf` `drive_id` und `drive_type` – rclone fragt das Laufwerk nur bei der interaktiven Einrichtung ab. Jetzt liest ShareOS es bei Microsoft Graph nach. Ein fehlgeschlagenes „Hinzufügen“ verbrauchte außerdem die Anmeldung. |
 | 20:38 | Die Ausgaben des Melders zeigten, warum Benutzer die Downloads nicht öffnen konnten: Seine Freigaben zeigen in die persönlichen Ordner, und die bekommen keine Freigabe-Rechte – die Dateien des Admin-Auftrags gehörten root. Sie gehören jetzt dem Benutzer des Ordners (#93) – `v0.2.0-beta.16`. |
 
+### Mittwoch, 28.10.2026
+
+| Zeit | Was passiert ist |
+|---|---|
+| 09:10 | Jan veröffentlicht `v0.2.0-beta.16`. |
+
+### Freitag, 30.10.2026
+
+| Zeit | Was passiert ist |
+|---|---|
+| 20:53 | Eine DNS-320 rev A startete nach dem Flashen immer wieder neu (#96): Ihr U-Boot kopiert das Initramfs an eine Adresse, die der Kernel danach überschrieb. Das Image lädt es jetzt nach 0x01000000 (#98). |
+| 22:02 | SMB war langsam (#94): signiertes SMB 3 mit 4–10 MB/s, die CPU mit AES-CMAC beschäftigt. Jans Messungen auf der Box: ohne Signatur 32–40 MB/s. Erster Schritt: ein Kompatibilitätsmodus bis SMB 2.1 (#99). |
+
+### Samstag, 31.10.2026
+
+| Zeit | Was passiert ist |
+|---|---|
+| 00:08 | Ein Tester beim Umstieg von Alt-F fragte, wie die Daten auf seinen Platten bleiben – der Einrichtungsassistent löscht sie. Jetzt übernimmt *übernehmen* eine Platte mit Daten, wie sie ist (#100). Er hat die SSH-Schritte befolgt, beide Platten laufen unter ShareOS. |
+| 08:39 | ksmbd berechnet die SMB-3-Signaturen (AES-CMAC) über `cbc(aes)` der Marvell-Krypto-Einheit: Jan hat 18–22 MB/s statt 6–11 gemessen (#101). Am selben Morgen: Härtung nach einer externen Code-Prüfung (#102). |
+| 12:34 | Das Ausschalten nach Zeitplan passierte nie (#82): BusyBox-`crond` las das leere `/etc/cron/crontabs`, kein Cron-Auftrag von ShareOS war je gelaufen (#104). |
+| 15:14 | Der Zeitplan ist eine kurze Übersicht mit dem Datum des nächsten Einschaltens (#105); *Mein ShareOS* bekommt einen eigenen Reiter APPS, und der Kopf bleibt einzeilig, der Rest hinter **+N** (#106). Alles kommt in `v0.2.0-beta.17`. |
+
 ## Bemerkenswerte Problemlösungen
 
 - **3-MB-Grenze des Bootloaders:** Der Kernel ist von 4,2 auf 2,4 MB geschrumpft, Treiber wurden in Module ausgelagert. Das Start-System umfasst nur 0,9 MB.