ssmithxandClaude Opus 5.5
d968403d33
Both routers: sshd takes keys only (it is reachable from the open TollGate SSID, and on the Pi from the WAN); shared %router-sysctls in router-base (no ICMP redirects taken, loose rp_filter, kptr_restrict, BPF JIT hardened). MT6000: the lab WAN SSH rule is gone; 99_zz-wired-private (a uci-defaults script, after TollGate's setup) moves lan1-lan5 into TollGate's private network (192.168.2.1), leaves br-lan to the open SSID, rejects SSH/telnet/ LuCI from it, trims nodogsplash's router ports, and turns on the private network's DHCP, which TollGate's setup left disabled (PITFALLS #55). The kernel has CONFIG_NFT_FLOW_OFFLOAD; fw4's offloading was measured and is left off -- no gain at line rate, and it would let flows bypass nodogsplash's session enforcement (PITFALLS #56). Deployed as MT6000 generation 6. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
143 lines
6.3 KiB
Scheme
143 lines
6.3 KiB
Scheme
;;; Nonguix `linux' for the GL.iNet GL-MT6000 (MediaTek MT7986A, Filogic 830).
|
|
;;;
|
|
;;; Mainline drives the SoC (clocks, pinctrl, eMMC, mtk_eth_soc, the MT7531
|
|
;;; switch, mt76 WiFi); the stock arm64 config just leaves ARCH_MEDIATEK off.
|
|
;;; From OpenWrt (target/linux/generic/pending-6.18, at the pinned OpenWrt
|
|
;;; commit): the block-device NVMEM provider (450-457) and "mac-base" cells
|
|
;;; (804, rebased on 6.17), so the board's device tree can read the WiFi
|
|
;;; calibration and MAC addresses from the eMMC `factory' partition; and
|
|
;;; /chosen/bootargs-append (hack-6.18/920) for the kernel command line. The
|
|
;;; board DTS is OpenWrt's (target/linux/mediatek/dts), which builds against
|
|
;;; mainline's mt7986a.dtsi unchanged.
|
|
(define-module (mt6000-linux)
|
|
;; Same cross toolchain as the systems (PITFALLS #35).
|
|
#:use-module (cross-libc-fix)
|
|
#:use-module (gnu packages linux)
|
|
#:use-module (guix gexp)
|
|
#:use-module (guix packages)
|
|
#:use-module (guix utils)
|
|
#:use-module (nongnu packages linux)
|
|
#:export (linux-mt6000))
|
|
|
|
;; Literal file names: local-file resolves them next to this file.
|
|
(define %mt6000-patches
|
|
(list
|
|
(local-file "patches/linux-mt6000/450-block-allow-setting-partition-of_node.patch")
|
|
(local-file "patches/linux-mt6000/451-block-partitions-of-assign-Device-Tree-node-to-parti.patch")
|
|
(local-file "patches/linux-mt6000/452-partitions-efi-apply-Linux-code-style.patch")
|
|
(local-file "patches/linux-mt6000/453-partitions-efi-allow-assigning-partition-Device-Tree.patch")
|
|
(local-file "patches/linux-mt6000/454-block-add-support-for-notifications.patch")
|
|
(local-file "patches/linux-mt6000/455-block-add-new-genhd-flag-GENHD_FL_NVMEM.patch")
|
|
(local-file "patches/linux-mt6000/456-nvmem-implement-block-NVMEM-provider.patch")
|
|
(local-file "patches/linux-mt6000/457-mmc-block-set-GENHD_FL_NVMEM.patch")
|
|
(local-file "patches/linux-mt6000/804-nvmem-core-support-mac-base-fixed-layout-cells.patch")
|
|
;; /chosen/bootargs-append (hack-6.18): GL's U-Boot passes empty
|
|
;; bootargs, so the Guix command line rides in the DTB, as OpenWrt's.
|
|
(local-file "patches/linux-mt6000/920-device_tree_cmdline.patch")))
|
|
|
|
(define %mt6000-kernel-configs
|
|
'(;; The SoC. Built in: everything up to the root file system on eMMC,
|
|
;; and the serial console.
|
|
"CONFIG_ARCH_MEDIATEK=y"
|
|
"CONFIG_COMMON_CLK_MEDIATEK=y"
|
|
"CONFIG_COMMON_CLK_MT7986=y"
|
|
"CONFIG_COMMON_CLK_MT7986_ETHSYS=y"
|
|
"CONFIG_PINCTRL_MT7986=y"
|
|
"CONFIG_MTK_INFRACFG=y"
|
|
"CONFIG_MEDIATEK_WATCHDOG=y"
|
|
"CONFIG_SERIAL_8250=y"
|
|
"CONFIG_SERIAL_8250_CONSOLE=y"
|
|
"CONFIG_SERIAL_8250_MT6577=y"
|
|
"CONFIG_SERIAL_OF_PLATFORM=y"
|
|
"CONFIG_REGULATOR_FIXED_VOLTAGE=y"
|
|
"CONFIG_RPMB=y" ;MMC_BLOCK depends on RPMB || !RPMB
|
|
"CONFIG_MMC=y"
|
|
"CONFIG_MMC_BLOCK=y"
|
|
"CONFIG_MMC_MTK=y"
|
|
"CONFIG_MMC_HSQ=y" ;selected by MMC_MTK
|
|
"CONFIG_EFI_PARTITION=y"
|
|
;; Headless: the kernel log, and any oops or panic, kept across the
|
|
;; (watchdog) reset in the RAM the FIT's DTB reserves -- read it from
|
|
;; /sys/fs/pstore on the next boot. Built in, to catch early deaths.
|
|
"CONFIG_PSTORE_RAM=y"
|
|
"CONFIG_PSTORE_CONSOLE=y"
|
|
;; WiFi calibration and MACs from the eMMC `factory' partition
|
|
;; (OpenWrt's block NVMEM patches), efuses for thermal calibration.
|
|
"CONFIG_NVMEM=y"
|
|
"CONFIG_NVMEM_BLOCK=y"
|
|
"CONFIG_NVMEM_LAYOUTS=y"
|
|
"CONFIG_NVMEM_LAYOUT_U_BOOT_ENV=y"
|
|
"CONFIG_NVMEM_MTK_EFUSE=y"
|
|
"CONFIG_MTK_THERMAL=y"
|
|
"CONFIG_MTK_SOC_THERMAL=y"
|
|
"CONFIG_MTK_LVTS_THERMAL=y"
|
|
;; Ethernet: two GMACs, the MT7531 switch (lan1-5), 2.5G PHYs.
|
|
"CONFIG_NET_MEDIATEK_SOC=m"
|
|
"CONFIG_NET_MEDIATEK_SOC_WED=y"
|
|
"CONFIG_NET_DSA=m"
|
|
"CONFIG_NET_DSA_MT7530=m"
|
|
"CONFIG_NET_DSA_MT7530_MDIO=m"
|
|
"CONFIG_NET_DSA_TAG_MTK=m"
|
|
"CONFIG_PCS_MTK_LYNXI=m"
|
|
;; fw4's flow offloading (software flowtables; the PPE in hardware).
|
|
;; Available but left off: PITFALLS #56.
|
|
"CONFIG_NFT_FLOW_OFFLOAD=m"
|
|
"CONFIG_MEDIATEK_GE_PHY=m"
|
|
"CONFIG_REALTEK_PHY=m"
|
|
;; WiFi: MT7986 WMAC (mt7915e driver).
|
|
"CONFIG_MT7915E=m"
|
|
"CONFIG_MT798X_WMAC=y"
|
|
;; USB 3.
|
|
"CONFIG_PHY_MTK_TPHY=y"
|
|
"CONFIG_USB_XHCI_MTK=m"
|
|
;; Buttons, LEDs, crypto engine.
|
|
"CONFIG_KEYBOARD_GPIO=m"
|
|
"CONFIG_LEDS_GPIO=m"
|
|
"CONFIG_CRYPTO_DEV_SAFEXCEL=m"))
|
|
|
|
(define linux-mt6000-source
|
|
(origin
|
|
(inherit (package-source linux))
|
|
(patches (append (origin-patches (package-source linux))
|
|
%mt6000-patches))))
|
|
|
|
(define linux-mt6000/no-dts
|
|
(customize-linux #:name "linux-mt6000"
|
|
#:linux linux
|
|
#:source linux-mt6000-source
|
|
#:configs %mt6000-kernel-configs))
|
|
|
|
(define-public linux-mt6000
|
|
(package
|
|
(inherit linux-mt6000/no-dts)
|
|
(arguments
|
|
(substitute-keyword-arguments (package-arguments linux-mt6000/no-dts)
|
|
((#:phases phases)
|
|
#~(modify-phases #$phases
|
|
(add-after 'unpack 'add-gl-mt6000-dts
|
|
;; Built and installed with the other MediaTek DTBs
|
|
;; (lib/dtbs/mediatek/mt7986a-glinet-gl-mt6000.dtb), plus
|
|
;; our fixes for GL's firmware and this kernel (-guix.dtsi).
|
|
(lambda _
|
|
(let ((dir "arch/arm64/boot/dts/mediatek"))
|
|
(copy-file
|
|
#$(local-file
|
|
"patches/linux-mt6000/mt7986a-glinet-gl-mt6000.dts")
|
|
(string-append dir "/mt7986a-glinet-gl-mt6000.dts"))
|
|
(copy-file
|
|
#$(local-file
|
|
"patches/linux-mt6000/mt7986a-glinet-gl-mt6000-guix.dtsi")
|
|
(string-append dir "/mt7986a-glinet-gl-mt6000-guix.dtsi"))
|
|
(make-file-writable
|
|
(string-append dir "/mt7986a-glinet-gl-mt6000.dts"))
|
|
(let ((port (open-file
|
|
(string-append dir "/mt7986a-glinet-gl-mt6000.dts")
|
|
"a")))
|
|
(display "\n#include \"mt7986a-glinet-gl-mt6000-guix.dtsi\"\n"
|
|
port)
|
|
(close-port port))
|
|
(let ((port (open-file (string-append dir "/Makefile") "a")))
|
|
(display "dtb-$(CONFIG_ARCH_MEDIATEK) += \
|
|
mt7986a-glinet-gl-mt6000.dtb\n" port)
|
|
(close-port port)))))))))))
|