default firewall zones in gateway profile

- zones are an attrset of name -> [interface-service]

- the firewall will create empty "ifname" sets for each zone name
 in each address family (ip, ip6)

- then watch the interface services, and add the "ifname" outputs
to the corresponding sets when they appear

This commit only adds the empty sets

.gitignore

@@ -6,3 +6,4 @@ result-*
 _build
 *-secrets.nix
 examples/static-leases.nix
+/doc/hardware.rst

NEWS

@@ -0,0 +1,159 @@
+A brief guide to backward-incompatible changes
+that are likely to break configurations or workflows
+
+2023-07-13
+
+* a significant re-arrangement of modules and services, which will
+probably break any configuration written before this time. For a
+detailed explanation, see
+https://www.liminix.org/doc/configuration.html#modules
+
+2023-12-10
+
+* configurations (usually) need no longer import modules from
+modules/outputs because devices are expected to do this instead. This
+change is because the outputs that make sense in any given context are
+usually a property of the device being installed onto.
+
+2023-12-11
+
+* rename outputs.flashimage to outputs.mtdimage (and also diskimage to
+mbrimage). This change is made in the expectation that "fooimage" is
+the name of an outputs that gloms together other filesystem-like
+outputs with some kind of partition table - so we might in future have
+gptimage or lvmimage or ubimage.
+
+2024-01-03
+
+Liminix is now targeted to Nixpkgs 23.11 (not 23.05 as previously).
+Upstream changes that have led to incompatible Liminix changes are:
+
+* newer U-Boot version
+* util-linux can now be built (previously depended on systemd)
+
+2024-01-30
+
+New port! Thanks to Arnout Engelen <arnout@bzzt.net>, Liminix
+now runs on the TP-Link Archer AX23.
+
+2024-02-12
+
+* We now build wifi drivers (mac80211) from the same kernel source as
+the running kernel, instead of using drivers from the linux-backports
+project.  This may be a regression on some devices that depend on
+OpenWrt patches for wireless functionality: if you have a device that
+used to work and now doesn't, refer to OpenWrt
+package/kernel/mac80211/patches/ to see if there's something in there
+that needs to be applied.
+
+* in general, we build kernel modules (e.g. for nftables) at the same
+time as the kernel itself instead of expecting to be able to build
+them afterwards as though they were "out of tree". Refer to commit
+b9c0d93670275e69df24902b05bf4aa4f0fcbe96 for a fuller explanation
+of how this simplifies things.
+
+2024-02-13
+
+So that we can be more consistent about services that would like their
+state to be preserved across boots (assuming a writable filesystem)
+these changes have been made
+
+* /run/service-state has been moved to /run/services/outputs
+ to better reflect what it's used for
+* /run/services/state is either a symlink to /persist/services/state
+ (if there's a writeable fs on /persist) or a directory (if there
+ isn't)
+
+The change will lose your ssh host key(s) unless you copy them from
+the old location to the new one before rebooting into the new system
+
+   mkdir -m 02751 -p /run/services/state/dropbear
+   cp /persist/secrets/dropbear/* /run/services/state/dropbear
+
+The `output`, `mkoutputs` functions defined by ${serviceFns}
+have been updated for the new location.
+
+2024-02-16
+
+New (or at least, previously unreported) port! Liminix now runs on the
+Turris Omnia and has been serving my family's internet needs for most
+of this week.  Thanks to NGI0 Entrust and the NLnet Foundation for
+sponsoring this development (and funding the hardware)
+
+2024-02-21
+
+New port! Thanks to Raito Bezarius, Liminix now runs on the Zyxel NWA50AX,
+an MT7621 (MIPS EL) dual radio WiFi AP.
+
+2024-04-29
+
+The setup for using `levitate` has changed: now it accepts an entire
+config fragment, not just a list of services.  Hopefully this makes it
+a bit more useful :-)
+
+  defaultProfile.packages = with pkgs; [
+    ... 
+    (levitate.override {
+      config  = {
+        services = {
+          inherit (config.services) dhcpc sshd watchdog;
+        };
+        defaultProfile.packages = [ mtdutils ];
+        users.root.openssh.authorizedKeys.keys = secrets.root.keys;
+      };
+    })
+  ];
+
+2024-07-16
+
+* structured parameters are available for the pppoe service
+
+* The "wan" configuration in modules/profiles/gateway.nix has changed:
+instead of passing options that are used to create a pppoe interface,
+callers should create a (pppoe or other) interface and pass that as
+the value of profile.gateway.wan. For the pppoe case this is now only
+very slightly more verbose, and it allows using the gateway profile
+with other kinds of upstream.
+
+2024-8-16
+
+As part of implementing log shipping, the default directory for system
+logs has beenchanged from /run/uncaught-logs to /run/log
+
+2024-10-09
+
+liminix-rebuild is being deprecated. From hereon in, the preferred way
+to do an incremental update on an installed device with a writable
+filesystem is to build the systemConfiguration output
+
+    nix-build  -I liminix-config=hosts/myhost.nix --argstr deviceName turris-omnia -A outputs.systemConfiguration 
+
+and then run the generated `install.sh` script
+
+    result/install.sh root@192.168.8.1
+
+2024-12-16
+
+Config options changed: if you had set config.hardware.dts.includes
+(maybe in an out-of-tree device port) to specify the search paths
+in which dtc finds include files, you will need to change this to 
+hardware.dts.includePaths.
+
+The "new" hardware.dts.includes option is now for dtsi files which
+should be merged into the device tree.
+
+2024-12-19
+
+Incremental updates changed again (but not massively). From hereon in,
+the preferred way to do an incremental update on an installed device
+with a writable filesystem is to build the updater output
+
+    nix-build  -I liminix-config=hosts/myhost.nix --argstr deviceName turris-omnia -A outputs.updater
+
+and then run the generated `update.sh` script. See 
+https://www.liminix.org/doc/admin.html#updating-an-installed-system
+
+2024-12-22
+
+outputs.zimage is now outputs.kernel.zImage. This is unlikely to
+affect many people at all but I mention it anyway.

README.md

@@ -18,22 +18,14 @@ outside word goes across it.
 
 Liminix is pre-1.0. We are still finding new and better ways to do things,
 and there is no attempt to maintain backward compatibility with the old
-ways. This will change when it settles down.
+ways.
 
-_In general:_ development mostly happens on the `main` branch, which is
-therefore not guaranteed to build or to work on every commit. For the
-latest functioning version, see [the CI system](https://build.liminix.org/jobset/liminix/build) and pick a revision with all jobs green.
+The [NEWS](NEWS) file (available wherever you found this README) is
+a high-level overview of breaking changes.
 
-_In particular:_ as of July 2023, a significant re-arrangement of
-modules and services is ongoing:
-
-* if you are using out-of-tree configurations created before commit
-  2e50368, especially if they reference things under pkgs.liminix,
-  they will need updating. Look at changes to examples/rotuer.nix
-  for guidance
-
-* the same is intermittently true for examples/{extensino,arhcive}.nix
-  where I've updated rotuer and not updated them to match.
+Development mostly happens on the `main` branch, which is therefore
+not guaranteed to build or to work on every commit. For the latest
+functioning version, see [the CI system](https://build.liminix.org/jobset/liminix/build) and pick a revision with all jobs green.
 
 
 ## Documentation
@@ -41,7 +33,7 @@ modules and services is ongoing:
 Documentation is in the [doc](doc/) directory. You can build it
 by running
 
-    nix-shell -p sphinx --run "make -C doc html"
+    nix-shell -p sphinx --run "make -C doc hardware.rst html"
 
 Rendered documentation corresponding to the latest commit on `main`
 is published to [https://www.liminix.org/doc/](https://www.liminix.org/doc/)

boot.expect

@@ -0,0 +1,42 @@
+# This is for use with minicom, but needs you to configure it to
+# use expect as its "Script program" instead of runscript.  Try
+# Ctrl+A O -> Filenames and paths -> D
+
+fconfigure stderr -buffering  none
+fconfigure stdout -buffering  none
+
+proc waitprompt { } {
+    expect {
+      "BusyBox" { puts stderr  "DONE\r"; exit 0 }
+      "READY" { puts stderr ";;; READY\r"; }
+      timeout { puts stderr ";;; timed out waiting after $line\r" }
+    }
+}
+
+proc sendline { line } {
+     send "$line; echo \$ready \r"
+     sleep 0.1
+}
+
+log_user 0
+log_file -a -open stderr
+
+set f [open "result/boot.scr"]
+
+send "setenv ready REA\r"
+sleep 0.1
+send "setenv ready \${ready}DY\r"
+sleep 0.1
+
+set timeout 300
+expect_before timeout abort
+while {[gets $f line] >= 0} {
+    puts stderr ";;; next line $line\r"
+    puts stderr ";;; waiting for prompt\r"
+    puts stderr ";;; sending\r"	
+    sendline $line
+    waitprompt
+}
+
+puts stderr "done\r\n"
+close $f

bordervm-configuration.nix

@@ -4,6 +4,10 @@ let
   inherit (lib) mkOption mkEnableOption mdDoc types optional optionals;
 in {
   options.bordervm = {
+    keys = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+    };
     l2tp = {
       host = mkOption {
         description = mdDoc ''
@@ -51,18 +55,17 @@ in {
     <nixpkgs/nixos/modules/virtualisation/qemu-vm.nix>
   ];
   config = {
-    boot.kernelParams = [
-      "loglevel=9"
-    ];
+    boot.kernelParams = [ "loglevel=9" ];
     systemd.services.pppoe =
-      let conf = pkgs.writeText "kpppoed.toml"
-        ''
-      interface_name = "eth1"
-      services = [ "myservice" ]
-      lns_ipaddr = "${cfg.l2tp.host}:${builtins.toString cfg.l2tp.port}"
-      ac_name = "kpppoed-1.0"
-    '';
-      in  {
+      let
+        conf = pkgs.writeText "kpppoed.toml" ''
+          interface_name = "eth1"
+          services = [ "myservice" ]
+          lns_ipaddr = "${cfg.l2tp.host}:${builtins.toString cfg.l2tp.port}"
+          ac_name = "kpppoed-1.0"
+        '';
+      in
+      {
         wantedBy = [ "multi-user.target" ];
         after = [ "network-online.target" ];
         serviceConfig = {
@@ -76,37 +79,81 @@ in {
       };
     };
     services.openssh.enable = true;
+    services.dnsmasq = {
+      enable = true;
+      resolveLocalQueries = false;
+      settings = {
+        # domain-needed = true;
+        dhcp-range = [ "10.0.0.10,10.0.0.240" ];
+        interface = "eth1";
+      };
+    };
+
+    services.nginx = {
+      enable = true;
+      user = "liminix";
+      virtualHosts.${config.networking.hostName} = {
+        root = "/home/liminix";
+        default = true;
+      };
+    };
+    systemd.services.nginx.serviceConfig.ProtectHome = "read-only";
+
     systemd.services.sshd.wantedBy = pkgs.lib.mkForce [ "multi-user.target" ];
 
     virtualisation = {
+      forwardPorts = [
+        {
+          from = "host";
+          host.port = 7654;
+          #        guest.address = "10.0.2.15";
+          guest.port =7654;
+        }
+        {
+          host.port = 2222;
+          guest.address = "10.0.2.15";
+          guest.port = 22;
+        }];
       qemu = {
-        networkingOptions = [];
-        options = [] ++
-          optional cfg.ethernet.pci.enable
-            "-device vfio-pci,host=${cfg.ethernet.pci.id}" ++
-          optionals cfg.ethernet.usb.enable [
+        networkingOptions = [ ];
+        options =
+          [ ]
+          ++ optional cfg.ethernet.pci.enable "-device vfio-pci,host=${cfg.ethernet.pci.id}"
+          ++ optionals cfg.ethernet.usb.enable [
             "-device usb-ehci,id=ehci"
             "-device usb-host,bus=ehci.0,vendorid=${cfg.ethernet.usb.vendor},productid=${cfg.ethernet.usb.product}"
-          ] ++ [
+          ]
+          ++ [
             "-nographic"
             "-serial mon:stdio"
           ];
       };
       sharedDirectories = {
         liminix = {
+          securityModel = "none";
           source = builtins.toString ./.;
           target = "/home/liminix/liminix";
         };
       };
     };
-    environment.systemPackages = with pkgs; [
-      tcpdump
-      wireshark
-      socat
-      tufted
-      iptables
-      usbutils
-    ];
+
+    services.tang = {
+      enable = true;
+      ipAddressAllow = [ "10.0.0.0/24" "0.0.0.0/0" ];
+    };
+
+    environment.systemPackages =
+      let wireshark-nogui = pkgs.wireshark.override { withQt = false ; };
+          in with pkgs; [
+            tcpdump
+            wireshark-nogui
+            socat
+            tufted
+            iptables
+            usbutils
+            busybox
+            clevis
+          ];
     security.sudo.wheelNeedsPassword = false;
     networking = {
       hostName = "border";
@@ -115,11 +162,17 @@ in {
         useDHCP = false;
         ipv4.addresses = [ { address = "10.0.0.1"; prefixLength = 24;}];
       };
+      nat = {
+        enable = true;
+        internalInterfaces = [ "eth1" ];
+        externalInterface = "eth0";
+      };
     };
     users.users.liminix = {
       isNormalUser = true;
       uid = 1000;
-      extraGroups = [ "wheel"];
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keys = cfg.keys;
     };
     services.getty.autologinUser = "liminix";
   };

bordervm.conf-example.nix

@@ -1,8 +1,12 @@
-{...}:
+{ ... }:
 {
   bordervm = {
     # ethernet.pci = { id = "01:00.0"; enable = true; };
-    ethernet.usb = { vendor = "0x0bda"; product = "0x8153"; enable = true; };
+    ethernet.usb = {
+      vendor = "0x0bda";
+      product = "0x8153";
+      enable = true;
+    };
     l2tp = {
       host = "l2tp.aa.net.uk";
     };

ci.nix

@@ -1,61 +1,82 @@
-{
-  nixpkgs
-, unstable
-, liminix
-, ... }:
 let
-  inherit (builtins) map;
-  pkgs = (import nixpkgs {});
-  borderVmConf =  ./bordervm.conf-example.nix;
+  pkgs = import <nixpkgs> { };
+  liminix = <liminix>;
+  borderVmConf = ./bordervm.conf-example.nix;
   inherit (pkgs.lib.attrsets) genAttrs;
-  devices = {
-    virt = [ "qemu" "qemu-aarch64" ];
-    hw = [ "gl-ar750" "gl-mt300n-v2" "gl-mt300a"  ];
-  };
+  devices = [
+    "gl-ar750"
+    "gl-mt300a"
+    "gl-mt300n-v2"
+    "qemu"
+    "qemu-aarch64"
+    "qemu-armv7l"
+    "tp-archer-ax23"
+    "openwrt-one"
+    "zyxel-nwa50ax"
+    "turris-omnia"
+    "belkin-rt3200"
+  ];
   vanilla = ./vanilla-configuration.nix;
-  for-device = cfg: name:
+  for-device = name:
     (import liminix {
-      inherit nixpkgs borderVmConf;
+      inherit borderVmConf;
       device = import (liminix + "/devices/${name}");
-      liminix-config = cfg;
+      liminix-config = vanilla;
     }).outputs.default;
   tests = import ./tests/ci.nix;
   jobs =
-    (genAttrs devices.hw (name: for-device ./vanilla-configuration-hw.nix name)) //
-    (genAttrs devices.virt (name: for-device vanilla name)) //
-    tests //
-    {
-      buildEnv = (import liminix {
-        inherit nixpkgs  borderVmConf;
-        device = import (liminix + "/devices/qemu");
-        liminix-config = vanilla;
-      }).buildEnv;
-      doc = pkgs.stdenv.mkDerivation {
-        name = "liminix-doc";
-        nativeBuildInputs = with pkgs; [
-          gnumake sphinx
-          fennel luaPackages.lyaml
-        ];
-        src = ./doc;
-        buildPhase = ''
-          cat ${(import ./doc/extract-options.nix).doc} > options.json
-          cat options.json | fennel --correlate parse-options.fnl > modules-generated.rst
-          cp ${(import ./doc/hardware.nix)} hardware.rst
-          make html
-        '';
-        installPhase = ''
-          mkdir -p $out/nix-support $out/share/doc/
-          cp modules.rst options.json $out
-          cp -a _build/html $out/share/doc/liminix
-          echo "file source-dist \"$out/share/doc/liminix\"" \
-              > $out/nix-support/hydra-build-products
-        '';
+    (genAttrs devices for-device)
+    // tests
+    // {
+      buildEnv =
+        (import liminix {
+          inherit borderVmConf;
+          device = import (liminix + "/devices/qemu");
+          liminix-config = vanilla;
+        }).buildEnv;
+      doc =
+        let
+          json =
+            (import liminix {
+              inherit borderVmConf;
+              device = import (liminix + "/devices/qemu");
+              liminix-config =
+                { ... }:
+                {
+                  imports = [ ./modules/all-modules.nix ];
+                };
+            }).outputs.optionsJson;
+        in
+        pkgs.stdenv.mkDerivation {
+          name = "liminix-doc";
+          nativeBuildInputs = with pkgs; [
+            gnumake
+            sphinx
+            fennel
+            luaPackages.lyaml
+          ];
+          src = ./.;
+          buildPhase = ''
+            cat ${json} | fennel --correlate doc/parse-options.fnl > doc/modules-generated.inc.rst
+            cat ${json} | fennel --correlate doc/parse-options-outputs.fnl     > doc/outputs-generated.inc.rst
+            cp ${(import ./doc/hardware.nix)} doc/hardware.rst
+            make -C doc html
+          '';
+          installPhase = ''
+            mkdir -p $out/nix-support $out/share/doc/
+            cd doc
+            cp *-generated.inc.rst hardware.rst $out
+            ln -s ${json} $out/options.json
+            cp -a _build/html $out/share/doc/liminix
+            echo "file source-dist \"$out/share/doc/liminix\"" \
+                > $out/nix-support/hydra-build-products
+          '';
       };
-      with-unstable = (import liminix {
-        nixpkgs = unstable;
-        inherit borderVmConf;
-        device = import (liminix + "/devices/qemu");
-        liminix-config = vanilla;
-      }).outputs.default;
     };
-in jobs
+in jobs //
+   {
+     all = pkgs.mkShell {
+       name = "all tests";
+       contents = pkgs.lib.collect pkgs.lib.isDerivation jobs;
+     };
+   }

default.nix

@@ -1,41 +1,63 @@
 {
-  device
-, liminix-config ? <liminix-config>
-, nixpkgs ? <nixpkgs>
-, borderVmConf ? ./bordervm.conf.nix
+  deviceName ? null,
+  device ? (import ./devices/${deviceName}),
+  liminix-config ? <liminix-config>,
+  borderVmConf ? ./bordervm.conf.nix,
+  imageType ? "primary",
 }:
 
 let
   overlay = import ./overlay.nix;
-  pkgs = import nixpkgs (device.system // {
-    overlays = [overlay];
-    config = {
-      allowUnsupportedSystem = true; # mipsel
-      permittedInsecurePackages = [
-        "python-2.7.18.6"       # kernel backports needs python <3
-      ];
-    };
-  });
+  pkgs = import <nixpkgs> (
+    device.system
+    // {
+      overlays = [ overlay ];
+      config = {
+        allowUnsupportedSystem = true; # mipsel
+        permittedInsecurePackages = [
+          "python-2.7.18.6" # kernel backports needs python <3
+          "python-2.7.18.7"
+        ];
+      };
+    }
+  );
 
-  config = (pkgs.lib.evalModules {
+  eval = pkgs.lib.evalModules {
+    specialArgs = {
+      modulesPath = builtins.toString ./modules;
+    };
     modules = [
-      { _module.args = { inherit pkgs; lib = pkgs.lib; }; }
+      { _module.args = { inherit pkgs; inherit (pkgs) lim; }; }
       ./modules/hardware.nix
       ./modules/base.nix
       ./modules/busybox.nix
       ./modules/hostname.nix
+      ./modules/kernel
+      ./modules/logging.nix
+      ./modules/klogd.nix
       device.module
       liminix-config
       ./modules/s6
       ./modules/users.nix
       ./modules/outputs.nix
+      {
+        boot.imageType = imageType;
+      }
     ];
-  }).config;
+  };
+  config = eval.config;
 
   borderVm = ((import <nixpkgs/nixos/lib/eval-config.nix>) {
     system = builtins.currentSystem;
     modules = [
-      ({  ... } : { nixpkgs.overlays = [ overlay ]; })
+      {
+        nixpkgs.overlays = [
+          (final: prev: {
+            go-l2tp = final.callPackage ./pkgs/go-l2tp {};
+            tufted = final.callPackage ./pkgs/tufted {};
+          })
+        ];
+      }
       (import ./bordervm-configuration.nix)
       borderVmConf
     ];
@@ -43,6 +65,12 @@ let
 in {
   outputs = config.system.outputs // {
     default = config.system.outputs.${config.hardware.defaultOutput};
+    optionsJson =
+      let o = import ./doc/extract-options.nix {
+            inherit pkgs eval;
+            lib = pkgs.lib;
+          };
+      in pkgs.writeText "options.json" (builtins.toJSON o);
   };
 
   # this is just here as a convenience, so that we can get a
@@ -59,6 +87,8 @@ in {
       go-l2tp
       min-copy-closure
       fennelrepl
+      lzma
+      lua
     ];
   };
 }

devices/belkin-rt3200/default.nix

@@ -0,0 +1,317 @@
+{
+  description = ''
+    Belkin RT-3200 / Linksys E8450
+    ******************************
+
+    This device is based on a 64 bit Mediatek MT7622 ARM platform,
+    and is mostly feature-complete in Liminix but as of Dec 2024
+    has seen very little actual use.
+
+    Hardware summary
+    ================
+
+    - MediaTek MT7622BV (1350MHz)
+    - 128MB NAND flash
+    - 512MB	RAM
+    - b/g/n wireless using MediaTek MT7622BV (MT7615E driver)
+    - a/n/ac/ax wireless using  MediaTek MT7915E
+
+
+    Installation
+    ============
+
+    Liminix on this device uses the UBI volume management system to
+    perform wear leveling on the flash. This is not set up from the
+    factory, so a one-time step is needed to prepare it before Liminix
+    can be installed.
+
+
+    Preparation
+    -----------
+
+    To prepare the device for Liminix you first need to use the
+    `OpenWrt UBI Installer
+    <https://github.com/dangowrt/owrt-ubi-installer>`_ image to
+    rewrite the flash layout. As of Jan 2025 there are two versions
+    of the installer available: the release version 1.0.2 and the
+    pre-release 1.1.3 and for Liminix you nee the pre-relese.
+    The release version of the installer creates UBI volumes
+    according to an older layout that is not compatible with
+    the Linux 6.6.67 kernel used in Liminix.
+
+    You can run the installer in one of two ways:
+    either follow the instructions to do it through the vendor web
+    interface, or you can drop to U-Boot and use TFTP
+
+    .. code-block:: console
+
+        MT7622> setenv ipaddr 10.0.0.6
+        MT7622> setenv serverip 10.0.0.1
+        MT7622> tftpboot 0x42000000  openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb
+        MT7622> bootm 0x42000000
+
+    This will write the new flash layout and then boot into a
+    "recovery" OpenWrt installation.
+
+    Building/installing Liminix
+    ----------------
+
+    The default target for this device is ``outputs.ubimage`` which
+    makes a ubifs image suitable for use with :command:`ubiupdatevol`.
+    To write this to the device we use the OpenWrt recovery system
+    installed in the previous step. In this configuration the
+    device assigns itself the IP address 192.168.1.1/24 on its LAN
+    ports and expects the connected computer to have 192.168.1.254
+
+    .. warning:: The `ubi0_7` device in these instructions is correct
+                 as of Dec 2024 (dangowrt/owrt-ubi-installer commit
+                 d79e7928). If you are installing some time later, it
+                 is important to check the output from
+                 :command:`ubinfo -a` and make sure you are updating
+                 the "liminix" volume and not some other one which had
+                 been introduced since I wrote this.
+
+    .. code-block:: console
+
+        $ nix-build -I liminix-config=./my-configuration.nix  --arg device "import ./devices/belkin-rt3200" -A outputs.default
+        $ cat result/rootfs | ssh root@192.168.1.1 "cat > /tmp/rootfs"
+        $ ssh root@192.168.1.1
+        root@OpenWrt:~# ubimkvol /dev/ubi0 --name=liminix --maxavsize
+        root@OpenWrt:~# ubinfo -a
+        [...]
+        Volume ID:   7 (on ubi0)
+        Type:        dynamic
+        Alignment:   1
+        Size:        851 LEBs (108056576 bytes, 103.0 MiB)
+        State:       OK
+        Name:        liminix
+        Character device major/minor: 250:8
+        root@OpenWrt:~# ubiupdatevol /dev/ubi0_7 /tmp/rootfs
+
+    To make the new system bootable we also need to change some U-Boot variables.
+    ``boot_production`` needs to mount the filesystem and boot the FIT image
+    found there, and :code:`bootcmd` needs to be told _not_ to boot the rescue
+    image if there are records in pstore, because that interferes with
+    ``config.log.persistent``
+
+    .. code-block:: console
+
+        root@OpenWrt:~# fw_setenv orig_boot_production $(fw_printenv -n boot_production)
+        root@OpenWrt:~# fw_setenv orig_bootcmd $(fw_printenv -n bootcmd)
+        root@OpenWrt:~# fw_setenv boot_production 'led $bootled_pwr on ; ubifsmount ubi0:liminix && ubifsload ''${loadaddr} boot/fit && bootm ''${loadaddr}'
+        root@OpenWrt:~# fw_setenv bootcmd 'run boot_ubi'
+
+    For subsequent Liminix reinstalls, just run the
+    :command:`ubiupdatevol` command again. You don't need to repeat
+    the "Preparation" step and in fact should seek to avoid it if
+    possible, as it will reset the erase counters used for write
+    levelling.  Using UBI-aware tools is therefore preferred over any
+    kind of "factory" wipe which will reset them.
+    '';
+
+  system = {
+    crossSystem = {
+      config = "aarch64-unknown-linux-musl";
+    };
+  };
+
+  module = {pkgs, config, lib, lim, ... }:
+    let inherit (lib) mkIf;
+        firmware = pkgs.stdenv.mkDerivation {
+          name = "wlan-firmware";
+          phases = ["installPhase"];
+          installPhase = ''
+            mkdir $out
+            cp ${pkgs.linux-firmware}/lib/firmware/mediatek/{mt7915,mt7615,mt7622}* $out
+          '';
+        };
+        openwrt = pkgs.openwrt_24_10;
+    in {
+      imports = [
+        ../../modules/arch/aarch64.nix
+        ../../modules/outputs/tftpboot.nix
+        ../../modules/outputs/ubifs.nix
+      ];
+      config = {
+    kernel = {
+      extraPatchPhase = ''
+          ${openwrt.applyPatches.mediatek}
+      '';
+      src = openwrt.kernelSrc;
+      version = openwrt.kernelVersion;
+      config = {
+        PCI = "y";
+        ARCH_MEDIATEK = "y";
+        # ARM_MEDIATEK_CPUFREQ = "y";
+
+        # needed for "Cannot find regmap for /infracfg@10000000"
+        MFD_SYSCON = "y";
+        MTK_INFRACFG = "y";
+
+        MTK_PMIC_WRAP = "y";
+        DMADEVICES = "y";
+        MTK_HSDMA="y";
+        MTK_SCPSYS="y";
+        MTK_SCPSYS_PM_DOMAINS="y";
+        # MTK_THERMAL="y";
+        MTK_TIMER="y";
+
+        COMMON_CLK_MT7622 = "y";
+        COMMON_CLK_MT7622_ETHSYS = "y";
+        COMMON_CLK_MT7622_HIFSYS = "y";
+        COMMON_CLK_MT7622_AUDSYS = "y";
+        PM_CLK="y";
+
+        REGMAP_MMIO = "y";
+        CLKSRC_MMIO = "y";
+        REGMAP = "y";
+
+        MEDIATEK_GE_PHY = "y";
+        # MEDIATEK_MT6577_AUXADC = "y";
+        NET_MEDIATEK_SOC = "y";
+        NET_MEDIATEK_SOC_WED = "y";
+        NET_MEDIATEK_STAR_EMAC = "y"; # this enables REGMAP_MMIO
+        NET_VENDOR_MEDIATEK = "y";
+        PCIE_MEDIATEK = "y";
+
+        BLOCK = "y"; # move this to base option
+
+        SPI_MASTER = "y";
+        SPI = "y";
+        SPI_MEM="y";
+        SPI_MTK_NOR="y";
+        SPI_MTK_SNFI = "y";
+
+        MTD = "y";
+        MTD_BLOCK = "y";
+        MTD_RAW_NAND = "y";
+        MTD_NAND_MTK = "y";
+        MTD_NAND_MTK_BMT = "y";      # Bad-block Management Table
+        MTD_NAND_ECC_MEDIATEK= "y";
+        MTD_NAND_ECC_SW_HAMMING= "y";
+        MTD_SPI_NAND= "y";
+        MTD_OF_PARTS = "y";
+        MTD_NAND_CORE= "y";
+        MTD_SPI_NOR= "y";
+        MTD_SPLIT_FIRMWARE= "y";
+        MTD_SPLIT_FIT_FW= "y";
+
+        MTD_UBI_NVMEM = "y";
+        NVMEM_MTK_EFUSE = "y";
+        NVMEM_BLOCK = "y";
+        NVMEM_LAYOUT_ADTRAN = "y";
+
+        MMC = "y";
+        MMC_BLOCK = "y";
+        MMC_CQHCI = "y";
+        MMC_MTK = "y";
+
+        # Distributed Switch Architecture is needed
+        # to make the ethernet ports visible
+        NET_DSA="y";
+        NET_DSA_MT7530="y";
+        NET_DSA_TAG_MTK="y";
+        NET_DSA_MT7530_MDIO="y";
+
+        SERIAL_8250 = "y";
+        SERIAL_8250_CONSOLE = "y";
+        SERIAL_8250_MT6577="y";
+        # SERIAL_8250_NR_UARTS="3";
+        # SERIAL_8250_RUNTIME_UARTS="3";
+        SERIAL_OF_PLATFORM="y";
+
+        # Must enble hardware watchdog drivers. Else the device reboots after several seconds
+        WATCHDOG = "y";
+        MEDIATEK_WATCHDOG = "y";
+      };
+      conditionalConfig = {
+        WLAN= {
+          MT7615E = "m";
+          MT7622_WMAC = "y";
+          MT7915E = "m";
+        };
+      };
+    };
+    boot = {
+      commandLine = [ "console=ttyS0,115200" ];
+      tftp.loadAddress = lim.parseInt "0x48000000";
+      imageFormat = "fit";
+      loader.fit.enable = lib.mkDefault true; # override this if you are building tftpboot
+    };
+    rootfsType = lib.mkDefault "ubifs"; # override this if you are building tftpboot
+    filesystem =
+      let inherit (pkgs.pseudofile) dir symlink;
+           in
+             dir {
+               lib = dir {
+                 firmware = dir {
+                   mediatek = symlink firmware;
+                 };
+               };
+             };
+
+    hardware =
+      let
+        mac80211 =  pkgs.kmodloader.override {
+          targets = ["mt7615e" "mt7915e"];
+          inherit (config.system.outputs) kernel;
+        };
+      in {
+        ubi = {
+          minIOSize = "2048";
+          logicalEraseBlockSize = "126976";
+          physicalEraseBlockSize = "131072";
+          maxLEBcount = "1024"; # guessing
+        };
+
+        defaultOutput = "ubimage";
+        # the kernel expects this to be on a 2MB boundary. U-Boot
+        # (I don't know why) has a default of 0x41080000, which isn't.
+        # We put it at the 32MB mark so that tftpboot can put its rootfs
+        # image and DTB underneath, but maybe this is a terrible waste of
+        # RAM unless the kernel is able to reuse it later. Oh well
+        loadAddress = lim.parseInt "0x42000000";
+        entryPoint = lim.parseInt "0x42000000";
+        rootDevice = "ubi0:liminix";
+        dts = {
+          src = "${openwrt.src}/target/linux/mediatek/dts/mt7622-linksys-e8450-ubi.dts";
+          includePaths =  [
+            "${openwrt.src}/target/linux/mediatek/dts"
+            "${config.system.outputs.kernel.modulesupport}/arch/arm64/boot/dts/mediatek/"
+          ];
+          includes = mkIf config.logging.persistent.enable [
+            ./pstore-pmsg.dtsi
+          ];
+        };
+
+        # - 0x000000000000-0x000008000000 : "spi-nand0"
+        #         - 0x000000000000-0x000000080000 : "bl2"
+        #         - 0x000000080000-0x0000001c0000 : "fip"
+        #         - 0x0000001c0000-0x0000002c0000 : "factory"
+        #         - 0x0000002c0000-0x000000300000 : "reserved"
+        #         - 0x000000300000-0x000008000000 : "ubi"
+
+        networkInterfaces =
+          let
+            inherit (config.system.service.network) link;
+          in rec {
+            wan = link.build { ifname = "wan"; };
+            lan1 = link.build { ifname = "lan1"; };
+            lan2 = link.build { ifname = "lan2"; };
+            lan3 = link.build { ifname = "lan3"; };
+            lan4 = link.build { ifname = "lan4"; };
+            lan = lan3;
+
+            wlan = link.build {
+              ifname = "wlan0";
+              dependencies = [ mac80211 ];
+            };
+            wlan5 = link.build {
+              ifname = "wlan1";
+              dependencies = [ mac80211 ];
+            };
+          };
+      };
+      };
+  };
+}

devices/belkin-rt3200/pstore-pmsg.dtsi

@@ -0,0 +1,8 @@
+/ {
+	reserved-memory {
+		/* make sure address matches upstream  */
+		ramoops@42ff0000 {
+			pmsg-size = <0x10000>;
+		};
+	};
+};

devices/families/qemu.nix

@@ -0,0 +1,57 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    ../../modules/outputs/jffs2.nix
+  ];
+  config = {
+    kernel = {
+      config = {
+        MTD = "y";
+        MTD_BLOCK = "y";
+        MTD_CMDLINE_PARTS = "y";
+        MTD_PHRAM = "y";
+
+        VIRTIO_MENU = "y";
+        PCI = "y";
+        VIRTIO_PCI = "y";
+        BLOCK = "y";
+        VIRTIO_BLK = "y";
+        VIRTIO_NET = "y";
+      };
+      conditionalConfig = {
+        WLAN= {
+          MAC80211_HWSIM = "m";
+        };
+      };
+    };
+    hardware =
+      let
+        mac80211 =  pkgs.kmodloader.override {
+          inherit (config.system.outputs) kernel;
+          targets = ["mac80211_hwsim"];
+        };
+      in {
+        defaultOutput = "vmroot";
+        rootDevice = "/dev/mtdblock0";
+        dts.src = pkgs.lib.mkDefault null;
+        flash.eraseBlockSize = 65536;
+        networkInterfaces =
+          let inherit (config.system.service.network) link;
+          in {
+            wan = link.build {
+              devpath = "/devices/pci0000:00/0000:00:13.0/virtio0";
+              ifname = "wan";
+            };
+            lan = link.build {
+              devpath = "/devices/pci0000:00/0000:00:14.0/virtio1";
+              ifname = "lan";
+            };
+
+            wlan_24 = link.build {
+              ifname = "wlan0";
+              dependencies = [ mac80211 ];
+            };
+          };
+      };
+  };
+}

devices/gl-ar750/default.nix

@@ -1,11 +1,3 @@
-
-# I like GL.iNet devices because they're relatively accessible to
-# DIY users: the serial port connections have headers preinstalled
-# and don't need soldering
-
-# Mainline linux 5.19 doesn't have device-tree support for this device
-# or even for the SoC, so we use the extensive OpenWrt kernel patches
-
 {
   system = {
     crossSystem = {
@@ -21,6 +13,9 @@
     GL.iNet GL-AR750
     ****************
 
+    Hardware summary
+    ================
+
     The GL-AR750 "Creta" travel router features:
 
      - QCA9531 @650Mhz SoC
@@ -30,30 +25,37 @@
      - 16MB NOR Flash
      - supported in OpenWrt by the "ath79" SoC family
 
-    As with many GL.iNet devices, the stock vendor firmware
-    is a fork of OpenWrt, meaning that the plain binary
-    ``firmware.bin`` that Liminix builds can be flashed using the
-    vendor web UI and the U-Boot emergency "unbrick" routine
-
     The GL-AR750 has two distinct sets of wifi hardware. The 2.4GHz
     radio is part of the QCA9531 SoC, i.e. it's on the same silicon as
     the CPU, the Ethernet, the USB etc. The device is connected to the
-    host via AHB, the "Advanced High-Performance Bus" and it is
-    supported in Linux using the ath9k driver. The 5GHz support, on the
-    other hand, is provided by a QCA9887 PCIe (PCI embedded) WLAN chip:
-    I haven't looked closely at the router innards to see if this is
-    actually physically a separate board that could be unplugged, but
-    as far as Linux is concerned it behaves as one. This is
+    host via `AHB <https://en.wikipedia.org/wiki/Advanced_Microcontroller_Bus_Architecture>`_ and it is
+    supported in Linux using the ath9k driver. 5GHz wifi
+    is provided by a QCA9887 PCIe (PCI embedded) WLAN chip,
     supported by the ath10k driver.
 
+    Installation
+    ============
+
+    As with many GL.iNet devices, the stock vendor firmware
+    is a fork of OpenWrt, meaning that the binary created by
+    :ref:`system-outputs-mtdimage` can be flashed using the
+    vendor web UI or the U-Boot emergency "unbrick" routine.
+
+    Flashing over an existing Liminix system is not possible while
+    that system is running, otherwise you'll be overwriting flash
+    partitions while they're in use - and that might not end well.
+    Configure the system with :ref:`levitate` if you need to
+    make it upgradable.
+
     Vendor web page: https://www.gl-inet.com/products/gl-ar750/
 
     OpenWrt web page: https://openwrt.org/toh/gl.inet/gl-ar750
 
   '';
 
-  module = {pkgs, config, ... }:
+  module = {pkgs, config, lim, lib, ... }:
     let
+      inherit (lib) mkIf;
       openwrt = pkgs.openwrt;
       firmwareBlobs = pkgs.pkgsBuildBuild.fetchFromGitHub {
         owner = "kvalo";
@@ -71,14 +73,15 @@
           cp $blobdir/board.bin  $out/ath10k/QCA9887/hw1.0/
         '';
       };
-      mac80211 = pkgs.mac80211.override {
-        drivers = ["ath9k" "ath10k_pci"];
-        klibBuild = config.system.outputs.kernel.modulesupport;
+      mac80211 = pkgs.kmodloader.override {
+        targets = ["ath9k" "ath10k_pci"];
+        inherit (config.system.outputs) kernel;
+        dependencies = [ ath10k_cal_data ];
       };
       ath10k_cal_data =
         let
-          offset = 1024 * 20; # 0x5000
-          size = 2048 + 68; # 0x844
+          offset = lim.parseInt "0x5000";
+          size = lim.parseInt "0x844";
         in pkgs.liminix.services.oneshot rec  {
           name = "ath10k_cal_data";
           up = ''
@@ -91,45 +94,56 @@
         '';
       };
       inherit (pkgs.pseudofile) dir symlink;
-      inherit (pkgs.liminix.networking) interface;
     in {
       imports = [
         ../../modules/network
         ../../modules/arch/mipseb.nix
+        ../../modules/outputs/tftpboot.nix
+        ../../modules/outputs/mtdimage.nix
+        ../../modules/outputs/jffs2.nix
       ];
 
       programs.busybox.options = {
         FEATURE_DD_IBS_OBS = "y"; # ath10k_cal_data needs skip_bytes,fullblock
       };
       hardware = {
-        defaultOutput = "flashimage";
-        loadAddress = "0x80060000";
-        entryPoint  = "0x80060000";
+        defaultOutput = "mtdimage";
+        loadAddress = lim.parseInt "0x80060000";
+        entryPoint = lim.parseInt "0x80060000";
         flash = {
-          address = "0x9F060000";
-          size ="0xfa0000";
-          eraseBlockSize = "65536";
+          address = lim.parseInt "0x9F060000";
+          size = lim.parseInt "0xfa0000";
+          eraseBlockSize = 65536;
         };
         rootDevice = "/dev/mtdblock5";
         dts = {
           src = "${openwrt.src}/target/linux/ath79/dts/qca9531_glinet_gl-ar750.dts";
-          includes =  [
+          includePaths =  [
             "${openwrt.src}/target/linux/ath79/dts"
           ];
+          includes = mkIf config.logging.persistent.enable [
+            ./pstore-ramoops.dtsi
+          ];
         };
 
         networkInterfaces =
           let inherit (config.system.service.network) link;
           in {
-            lan = link.build { ifname = "eth0"; };
-            wan = link.build { ifname = "eth1"; };
+            lan = link.build {
+              ifname = "lan";
+              devpath = "/devices/platform/ahb/1a000000.eth";
+            };
+            wan = link.build {
+              ifname = "wan";
+              devpath = "/devices/platform/ahb/19000000.eth";
+            };
             wlan = link.build {
               ifname = "wlan0";
               dependencies = [ mac80211 ];
             };
             wlan5 = link.build {
               ifname = "wlan1";
-              dependencies = [ mac80211 ath10k_cal_data ];
+              dependencies = [ ath10k_cal_data mac80211  ];
             };
           };
       };
@@ -144,17 +158,19 @@
         };
       };
       boot.tftp = {
-        loadAddress = "0x00A00000";
+        loadAddress = lim.parseInt "0x00A00000";
+        appendDTB = true;
       };
       kernel = {
-        src = pkgs.pkgsBuildBuild.fetchurl {
-          name = "linux.tar.gz";
-          url = "https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.71.tar.gz";
-          hash = "sha256-yhO2cXIeIgUxkSZf/4aAsF11uxyh+UUZu6D1h92vCD8=";
-        };
+        # Mainline linux 5.19 doesn't have device-tree support for
+        # this device or even for the SoC, so we use the extensive
+        # OpenWrt kernel patches
         extraPatchPhase = ''
           ${openwrt.applyPatches.ath79}
+          sed -i.bak -e '\,include <linux/hw_random.h>,a #include <linux/gpio/driver.h>'  drivers/net/wireless/ath/ath9k/ath9k.h # context reqd for next patch
+          patch -p1 <  ${openwrt.src}/package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
         '';
+
         config = {
           ATH79 = "y";
           PCI = "y";
@@ -175,7 +191,6 @@
           CONSOLE_LOGLEVEL_QUIET = "4";
 
           NET = "y";
-          NETDEVICES = "y";
           ETHERNET = "y";
           NET_VENDOR_ATHEROS = "y";
           AG71XX = "y";             # ethernet (qca,qca9530-eth)
@@ -204,14 +219,21 @@
           WATCHDOG = "y";
           ATH79_WDT = "y";  # watchdog timer
 
-          # this is all copied from nixwrt ath79 config. Clearly not all
-          # of it is device config, some of it is wifi config or
-          # installation method config or ...
-
           EARLY_PRINTK = "y";
 
           PRINTK_TIME = "y";
         };
+        conditionalConfig = {
+          WLAN = {
+            WLAN_VENDOR_ATH = "y";
+            ATH_COMMON = "m";
+            ATH9K = "m";
+            ATH9K_AHB = "y";
+            ATH10K = "m";
+            ATH10K_PCI = "m";
+            ATH10K_DEBUG = "y";
+          };
+        };
       };
     };
 }

devices/gl-ar750/pstore-ramoops.dtsi

@@ -0,0 +1,9 @@
+/ {
+reserved-memory {
+		ramoops@03f00000 {
+			compatible = "ramoops";
+			reg = <0x03f00000 0x10000>;
+			pmsg-size = <0x10000>;
+		};
+	};
+};

devices/gl-mt300a/default.nix

@@ -13,34 +13,11 @@
 
   description = ''
     GL.iNet GL-MT300A
-    ********************
+    *****************
 
     The GL-MT300A is based on a MT7620 chipset.
 
-    The GL.iNet pocket router range makes nice cheap hardware for
-    playing with Liminix or similar projects. The manufacturers seem
-    open to the DIY market, and the devices have a reasonable amount
-    of RAM and are much easier to get serial connections than many
-    COTS routers.
-
-    Wire up the serial connection: this probably involves opening
-    the box, locating the serial header pins (TX, RX and GND) and
-    connecting a USB TTL converter - e.g. a PL2303 based device - to
-    it. The defunct OpenWRT wiki has a guide with some pictures. (If
-    you don't have a USB TTL converter to hand, other options are
-    available. For example, use the GPIO pins on a Raspberry Pi.)
-
-    Run a terminal emulator such as Minicom on whatever is on the
-    other end of the link. I use 115200 8N1 and find it also helps
-    to set "Line tx delay" to 1ms, "backspace sends DEL" and
-    "lineWrap on".
-
-    When you turn the router on you should be greeted with some
-    messages from U-Boot and a little bit of ASCII art, followed by
-    the instruction to hit SPACE to stop autoboot. Do this and you
-    will get a gl-mt300a> prompt.
-
-    For flashing from uboot, the firmware partition is from
+    For flashing from U-Boot, the firmware partition is from
     0xbc050000 to 0xbcfd0000.
 
     WiFi on this device is provided by the rt2800soc module. It
@@ -48,6 +25,18 @@
     - assuming we want to use the wireless - we need to build MTD
     support into the kernel even if we're using TFTP root.
 
+    Installation
+    ============
+
+    The stock vendor firmware is a fork of OpenWrt, meaning that the
+    binary created by :ref:`system-outputs-mtdimage` can be flashed
+    using the vendor web UI or the U-Boot emergency "unbrick" routine.
+
+    Flashing over an existing Liminix system is not possible while
+    that system is running, otherwise you'll be overwriting flash
+    partitions while they're in use - and that might not end well.
+    Configure the system with :ref:`levitate` if you need to
+    make it upgradable.
 
     Vendor web page: https://www.gl-inet.com/products/gl-mt300a/
 
@@ -55,20 +44,24 @@
 
   '';
 
-  module = { pkgs, config, lib, ...}:
+  module = { pkgs, config, lib, lim, ...}:
     let
-      inherit (pkgs.liminix.networking) interface;
       inherit (pkgs) openwrt;
-      mac80211 = pkgs.mac80211.override {
-        drivers = ["rt2800soc"];
-        klibBuild = config.system.outputs.kernel.modulesupport;
+      mac80211 = pkgs.kmodloader.override {
+        targets = ["rt2800soc"];
+        inherit (config.system.outputs) kernel;
       };
     in {
-      imports = [ ../../modules/arch/mipsel.nix ];
+      imports = [
+        ../../modules/arch/mipsel.nix
+        ../../modules/outputs/tftpboot.nix
+        ../../modules/outputs/mtdimage.nix
+        ../../modules/outputs/jffs2.nix
+      ];
       hardware = {
-        defaultOutput = "flashimage";
-        loadAddress = "0x80000000";
-        entryPoint  = "0x80000000";
+        defaultOutput = "mtdimage";
+        loadAddress = lim.parseInt "0x80000000";
+        entryPoint = lim.parseInt "0x80000000";
 
         # Creating 5 MTD partitions on "spi0.0":
         # 0x000000000000-0x000000030000 : "u-boot"
@@ -81,15 +74,15 @@
         # 0x000000260000-0x000000f80000 : "rootfs"
 
         flash = {
-          address = "0xbc050000";
-          size ="0xf80000";
-          eraseBlockSize = "65536";
+          address = lim.parseInt "0xbc050000";
+          size = lim.parseInt "0xf80000";
+          eraseBlockSize = 65536;
         };
         rootDevice = "/dev/mtdblock5";
 
         dts = {
           src = "${openwrt.src}/target/linux/ramips/dts/mt7620a_glinet_gl-mt300a.dts";
-          includes = [
+          includePaths = [
             "${openwrt.src}/target/linux/ramips/dts"
           ];
         };
@@ -97,19 +90,6 @@
           let
             inherit (config.system.service.network) link;
             inherit (config.system.service) vlan;
-            inherit (pkgs.liminix.services) oneshot;
-            swconfig = oneshot {
-              name = "swconfig";
-              up = ''
-                PATH=${pkgs.swconfig}/bin:$PATH
-                swconfig dev switch0 set reset
-                swconfig dev switch0 set enable_vlan 1
-                swconfig dev switch0 vlan 1 set ports '1 2 3 4 6t'
-                swconfig dev switch0 vlan 2 set ports '0 6t'
-                swconfig dev switch0 set apply
-              '';
-              down = "${pkgs.swconfig}/bin/swconfig dev switch0 set reset";
-            };
           in rec {
             eth = link.build { ifname = "eth0"; };
             # lan and wan ports are both behind a switch on eth0
@@ -117,13 +97,11 @@
               ifname = "eth0.1";
               primary = eth;
               vid = "1";
-              dependencies =  [swconfig eth];
             };
             wan = vlan.build {
               ifname = "eth0.2";
               primary = eth;
               vid = "2";
-              dependencies =  [swconfig eth];
             };
             wlan = link.build {
               ifname = "wlan0";
@@ -132,17 +110,14 @@
           };
       };
       boot.tftp = {
-        loadAddress = "0x00A00000";
-      };
+        loadAddress = lim.parseInt "0x00A00000";
+        appendDTB = true;
+     };
 
       kernel = {
-        src = pkgs.fetchurl {
-          name = "linux.tar.gz";
-          url = "https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.71.tar.gz";
-          hash = "sha256-yhO2cXIeIgUxkSZf/4aAsF11uxyh+UUZu6D1h92vCD8=";
-        };
         extraPatchPhase = ''
           ${openwrt.applyPatches.ramips}
+          ${openwrt.applyPatches.rt2x00}
         '';
         config = {
 
@@ -159,7 +134,6 @@
           CONSOLE_LOGLEVEL_QUIET = "4";
 
           NET = "y";
-          NETDEVICES = "y";
           ETHERNET = "y";
           NET_VENDOR_RALINK = "y";
           NET_RALINK_MDIO = "y";
@@ -186,6 +160,14 @@
         } // lib.optionalAttrs (config.system.service ? vlan) {
           SWCONFIG = "y";
         };
+        conditionalConfig = {
+          WLAN = {
+            WLAN_VENDOR_RALINK = "y";
+            RT2800SOC = "m";
+            RT2X00 = "m";
+          };
+        };
+
       };
     };
 }

devices/gl-mt300n-v2/default.nix

@@ -13,10 +13,23 @@
     GL.iNet GL-MT300N-v2
     ********************
 
-    The GL-MT300N-v2 "Mango" is is very similar to the MT300A, but is
-    based on MT7628 instead of MT7620.  It's also marginally cheaper
-    and comes in a yellow case not a blue one.  It's different again
-    to the v1, which has only half the RAM.
+    The GL-MT300N-v2 "Mango" is is very similar to the :ref:`gl-mt300a`, but is
+    based on the MT7628 chipset instead of MT7620.  It's also marginally cheaper
+    and comes in a yellow case not a blue one.  Be sure your device is
+    v2 not v1, which is a different animal and has only half as much RAM.
+
+    Installation
+    ============
+
+    The stock vendor firmware is a fork of OpenWrt, meaning that the
+    binary created by :ref:`system-outputs-mtdimage` can be flashed
+    using the vendor web UI or the U-Boot emergency "unbrick" routine.
+
+    Flashing over an existing Liminix system is not possible while
+    that system is running, otherwise you'll be overwriting flash
+    partitions while they're in use - and that might not end well.
+    Configure the system with :ref:`levitate` if you need to
+    make it upgradable.
 
     Vendor web page: https://www.gl-inet.com/products/gl-mt300n-v2/
 
@@ -24,23 +37,27 @@
 
   '';
 
-  module = { pkgs, config, lib, ...}:
+  module = { pkgs, config, lib, lim, ...}:
     let
-      inherit (pkgs.liminix.networking) interface;
       inherit (pkgs.liminix.services) oneshot;
       inherit (pkgs.pseudofile) dir symlink;
       inherit (pkgs) openwrt;
 
-      mac80211 = pkgs.mac80211.override {
-        drivers = ["mt7603e"];
-        klibBuild = config.system.outputs.kernel.modulesupport;
+      mac80211 = pkgs.kmodloader.override {
+        targets = ["mt7603e"];
+        inherit (config.system.outputs) kernel;
       };
       wlan_firmware = pkgs.fetchurl {
         url = "https://github.com/openwrt/mt76/raw/f24b56f935392ca1d35fae5fd6e56ef9deda4aad/firmware/mt7628_e2.bin";
         hash = "sha256:1dkhfznmdz6s50kwc841x3wj0h6zg6icg5g2bim9pvg66as2vmh9";
       };
     in {
-      imports = [ ../../modules/arch/mipsel.nix ];
+      imports = [
+        ../../modules/arch/mipsel.nix
+        ../../modules/outputs/tftpboot.nix
+        ../../modules/outputs/mtdimage.nix
+        ../../modules/outputs/jffs2.nix
+      ];
       filesystem = dir {
         lib = dir {
           firmware = dir {
@@ -49,20 +66,20 @@
         };
       };
       hardware = {
-        defaultOutput = "flashimage";
-        loadAddress = "0x80000000";
-        entryPoint  = "0x80000000";
+        defaultOutput = "mtdimage";
+        loadAddress = lim.parseInt "0x80000000";
+        entryPoint = lim.parseInt "0x80000000";
 
         flash = {
-          address = "0xbc050000";
-          size = "0xfb0000";
-          eraseBlockSize = "65536";
+          address = lim.parseInt "0xbc050000";
+          size = lim.parseInt "0xfb0000";
+          eraseBlockSize = 65536;
         };
         rootDevice = "/dev/mtdblock5";
 
         dts = {
           src = "${openwrt.src}/target/linux/ramips/dts/mt7628an_glinet_gl-mt300n-v2.dts";
-          includes = [
+          includePaths = [
             "${openwrt.src}/target/linux/ramips/dts"
           ];
         };
@@ -80,7 +97,7 @@
                 swconfig dev switch0 vlan 2 set ports '0 6t'
                 swconfig dev switch0 set apply
               '';
-              down = "swconfig dev switch0 set reset";
+              down = "${pkgs.swconfig}/bin/swconfig dev switch0 set reset";
             };
           in rec {
             eth = link.build { ifname = "eth0"; dependencies =  [swconfig]; };
@@ -104,15 +121,11 @@
       boot.tftp = {
         # 20MB seems to give enough room to uncompress the kernel
         # without anything getting trodden on. 10MB was too small
-        loadAddress = "0x1400000";
+        loadAddress = lim.parseInt "0x1400000";
+        appendDTB = true;
       };
 
       kernel = {
-        src = pkgs.fetchurl {
-          name = "linux.tar.gz";
-          url = "https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.71.tar.gz";
-          hash = "sha256-yhO2cXIeIgUxkSZf/4aAsF11uxyh+UUZu6D1h92vCD8=";
-        };
         extraPatchPhase = ''
           ${openwrt.applyPatches.ramips}
         '';
@@ -143,7 +156,6 @@
           REGULATOR_FIXED_VOLTAGE = "y";
 
           NET = "y";
-          NETDEVICES = "y";
           ETHERNET = "y";
 
           PHYLIB = "y";
@@ -169,6 +181,15 @@
           RALINK_WDT = "y";  # watchdog
           MT7621_WDT = "y";  # or it might be this one
         };
+        conditionalConfig = {
+          WLAN = {
+            WLAN_VENDOR_RALINK = "y";
+            WLAN_VENDOR_MEDIATEK = "y";
+            MT7603E = "m";
+          };
+        };
+
       };
+
     };
 }

devices/openwrt-one/default.nix

@@ -0,0 +1,739 @@
+{
+  description = ''
+    OpenWrt One
+    ***********
+
+    Hardware summary
+    ================
+
+    - MediaTek MT7981B (1300MHz)
+    - 256MB NAND Flash
+    - 1024MB RAM
+    - WLan hardware: Mediatek MT7976C
+
+    Status
+    ======
+
+    - Only tested over TFTP so far.
+    - WiFi (2.4G and 5G) works.
+    - 2.5G ethernet port works.
+
+    Limitations
+    ===========
+
+    - adding `he_bss_color="128"` causes `Invalid argument` for hostap
+    - nvme support untested
+    - I don't think the front LEDs work yet
+
+    Installation
+    ============
+
+      TODO: add instructions on how to boot directly from TFTP to memory
+      and how to install from TFTP to flash without going through OpenWrt.
+
+      The instructions below assume you can boot and SSH into OpenWrt:
+
+      Boot into OpenWrt and create a 'liminix' UBI partition:
+
+        root@OpenWrt:~# ubimkvol /dev/ubi0 --name=liminix --maxavsize
+
+    Remember the 'Volume ID' that was created for this new partition
+
+    Build the UBI image and write it to this new partition:
+
+        $ nix-build -I liminix-config=./my-configuration.nix  --arg device "import ./devices/openwrt-one" -A outputs.default
+        $ cat result/rootfs | ssh root@192.168.1.1 "cat > /tmp/rootfs"
+        $ ssh root@192.168.1.1
+        root@OpenWrt:~# ubiupdatevol /dev/ubi0_X /tmp/rootfs # replace X with the volume id, if needed check with `ubinfo`
+
+    Reboot into the U-Boot prompt and boot with:
+
+        OpenWrt One> ubifsmount ubi0:liminix && ubifsload ''${loadaddr} boot/fit && bootm ''${loadaddr}'
+
+    If this works, reboot into OpenWrt and configure U-Boot to boot ubifs by default:
+
+        root@OpenWrt:~# fw_setenv orig_boot_production $(fw_printenv -n boot_production)
+        root@OpenWrt:~# fw_setenv boot_production 'led white on ; ubifsmount ubi0:liminix && ubifsload ''${loadaddr} boot/fit && bootm ''${loadaddr}'
+
+    Troubleshooting
+    ===============
+
+      The instructions above assume you can boot and SSH into the (recovery)
+      OpenWrt installation. If you have broken your device to the point where that
+      is no longer possible, you could re-install OpenWrt, but probably you could
+      also install directly from U-Boot:
+
+        https://github.com/u-boot/u-boot/blob/master/doc/README.ubi
+  '';
+
+  system = {
+    crossSystem = {
+      config = "aarch64-unknown-linux-musl";
+      gcc = {
+        # https://openwrt.org/docs/techref/instructionset/aarch64_cortex-a53
+        # openwrt ./target/linux/mediatek/filogic/target.mk
+        # https://gcc.gnu.org/onlinedocs/gcc/AArch64-Options.html
+        # https://en.wikipedia.org/wiki/Comparison_of_ARM_processors
+        arch = "armv8-a";
+      };
+    };
+  };
+
+  module = {pkgs, config, lib, lim, ... }:
+  let 
+    openwrt = pkgs.openwrt_24_10;
+    mediatek-firmware = pkgs.stdenv.mkDerivation {
+          name = "wlan-firmware";
+          phases = ["installPhase"];
+          installPhase = ''
+            mkdir $out
+
+            cp ${pkgs.linux-firmware}/lib/firmware/mediatek/{mt7915,mt7615,mt7986_eeprom_mt7976,mt7981}* $out
+          '';
+        };
+    airoha-firmware = pkgs.stdenv.mkDerivation {
+          name = "airoha-firmware";
+          phases = ["installPhase"];
+          installPhase = ''
+            mkdir $out
+
+            cp ${pkgs.linux-firmware}/lib/firmware/airoha/* $out
+          '';
+        };
+    in {
+      imports = [
+        ../../modules/arch/aarch64.nix
+        ../../modules/outputs/tftpboot.nix
+        ../../modules/outputs/ubifs.nix
+      ];
+      config = {
+        kernel = {
+          src = openwrt.kernelSrc;
+          version = openwrt.kernelVersion;
+          extraPatchPhase = ''
+            ${openwrt.applyPatches.mediatek}
+          '';
+          config = {
+            NET="y"; # unlock NET_XGRESS
+            SERIAL_8250="y"; # unlock SERIAL_8250_FSL
+            SERIAL_8250_CONSOLE="y"; # to get the serial console
+            WATCHDOG="y"; # unlock WATCHDOG_CORE
+            NEW_LEDS="y"; # unlock LEDS_PWM
+            LEDS_CLASS="y"; # unlock LEDS_PWM
+            LEDS_TRIGGERS="y"; # unlock LEDS_TRIGGER_PATTERN
+            DEFERRED_STRUCT_PAGE_INIT="y"; # trigger PADATA
+            # Taken from openwrt's ./target/linux/mediatek/filogic/config-6.6
+            "64BIT"="y";
+            AIROHA_EN8801SC_PHY="y";
+            ARCH_BINFMT_ELF_EXTRA_PHDRS="y";
+            ARCH_CORRECT_STACKTRACE_ON_KRETPROBE="y";
+            ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG="y";
+            ARCH_DMA_ADDR_T_64BIT="y";
+            ARCH_FORCE_MAX_ORDER="10";
+            ARCH_KEEP_MEMBLOCK="y";
+            ARCH_MEDIATEK="y";
+            ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE="y";
+            ARCH_MMAP_RND_BITS="18";
+            ARCH_MMAP_RND_BITS_MAX="24";
+            ARCH_MMAP_RND_BITS_MIN="18";
+            ARCH_MMAP_RND_COMPAT_BITS_MIN="11";
+            ARCH_PROC_KCORE_TEXT="y";
+            ARCH_SPARSEMEM_ENABLE="y";
+            ARCH_STACKWALK="y";
+            ARCH_SUSPEND_POSSIBLE="y";
+            ARCH_WANTS_NO_INSTR="y";
+            ARCH_WANTS_THP_SWAP="y";
+            ARM64="y";
+            ARM64_4K_PAGES="y";
+            ARM64_ERRATUM_843419="y";
+            ARM64_LD_HAS_FIX_ERRATUM_843419="y";
+            ARM64_PAGE_SHIFT="12";
+            ARM64_PA_BITS="48";
+            ARM64_PA_BITS_48="y";
+            ARM64_TAGGED_ADDR_ABI="y";
+            ARM64_VA_BITS="39";
+            ARM64_VA_BITS_39="y";
+            ARM_AMBA="y";
+            ARM_ARCH_TIMER="y";
+            ARM_ARCH_TIMER_EVTSTREAM="y";
+            ARM_GIC="y";
+            ARM_GIC_V2M="y";
+            ARM_GIC_V3="y";
+            ARM_GIC_V3_ITS="y";
+            ARM_GIC_V3_ITS_PCI="y";
+            ARM_MEDIATEK_CPUFREQ="y";
+            ARM_PMU="y";
+            ARM_PMUV3="y";
+            ARM_PSCI_FW="y";
+            ATA="y";
+            AUDIT_ARCH_COMPAT_GENERIC="y";
+            BLK_DEV_LOOP="y";
+            BLK_DEV_SD="y";
+            BLK_MQ_PCI="y";
+            BLK_PM="y";
+            BLOCK_NOTIFIERS="y";
+            BSD_PROCESS_ACCT="y";
+            BSD_PROCESS_ACCT_V3="y";
+            BUFFER_HEAD="y";
+            BUILTIN_RETURN_ADDRESS_STRIPS_PAC="y";
+            CC_HAVE_SHADOW_CALL_STACK="y";
+            CC_HAVE_STACKPROTECTOR_SYSREG="y";
+            #CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5";
+            CC_NO_ARRAY_BOUNDS="y";
+            CLKSRC_MMIO="y";
+            CLONE_BACKWARDS="y";
+            CMDLINE_OVERRIDE="y";
+            COMMON_CLK="y";
+            COMMON_CLK_MEDIATEK="y";
+            COMMON_CLK_MT7981="y";
+            COMMON_CLK_MT7981_ETHSYS="y";
+            COMMON_CLK_MT7986="y";
+            COMMON_CLK_MT7986_ETHSYS="y";
+            COMMON_CLK_MT7988="y";
+            COMPACT_UNEVICTABLE_DEFAULT="1";
+            CONFIGFS_FS="y";
+            CONSOLE_LOGLEVEL_DEFAULT="15";
+            CONTEXT_TRACKING="y";
+            CONTEXT_TRACKING_IDLE="y";
+            CPU_FREQ="y";
+            CPU_FREQ_DEFAULT_GOV_USERSPACE="y";
+            CPU_FREQ_GOV_ATTR_SET="y";
+            CPU_FREQ_GOV_COMMON="y";
+            CPU_FREQ_GOV_CONSERVATIVE="y";
+            CPU_FREQ_GOV_ONDEMAND="y";
+            CPU_FREQ_GOV_PERFORMANCE="y";
+            CPU_FREQ_GOV_POWERSAVE="y";
+            CPU_FREQ_GOV_SCHEDUTIL="y";
+            CPU_FREQ_GOV_USERSPACE="y";
+            CPU_FREQ_STAT="y";
+            CPU_LITTLE_ENDIAN="y";
+            CPU_RMAP="y";
+            CPU_THERMAL="y";
+            CRC16="y";
+            CRC_CCITT="y";
+            CRYPTO_AES_ARM64="y";
+            CRYPTO_AES_ARM64_CE="y";
+            CRYPTO_AES_ARM64_CE_BLK="y";
+            CRYPTO_AES_ARM64_CE_CCM="y";
+            CRYPTO_CMAC="y";
+            CRYPTO_CRC32="y";
+            CRYPTO_CRC32C="y";
+            CRYPTO_CRYPTD="y";
+            CRYPTO_DEFLATE="y";
+            CRYPTO_DRBG="y";
+            CRYPTO_DRBG_HMAC="y";
+            CRYPTO_DRBG_MENU="y";
+            CRYPTO_ECB="y";
+            CRYPTO_ECC="y";
+            CRYPTO_ECDH="y";
+            CRYPTO_GHASH_ARM64_CE="y";
+            CRYPTO_HASH_INFO="y";
+            CRYPTO_HMAC="y";
+            CRYPTO_JITTERENTROPY="y";
+            CRYPTO_LIB_BLAKE2S_GENERIC="y";
+            CRYPTO_LIB_GF128MUL="y";
+            CRYPTO_LIB_SHA1="y";
+            CRYPTO_LIB_SHA256="y";
+            CRYPTO_LIB_UTILS="y";
+            CRYPTO_LZO="y";
+            CRYPTO_RNG="y";
+            CRYPTO_RNG2="y";
+            CRYPTO_RNG_DEFAULT="y";
+            CRYPTO_SHA256="y";
+            CRYPTO_SHA256_ARM64="y";
+            CRYPTO_SHA2_ARM64_CE="y";
+            CRYPTO_SHA3="y";
+            CRYPTO_SHA512="y";
+            CRYPTO_SM4="y";
+            CRYPTO_SM4_ARM64_CE_BLK="y";
+            CRYPTO_SM4_ARM64_CE_CCM="y";
+            CRYPTO_SM4_ARM64_CE_GCM="y";
+            CRYPTO_ZSTD="y";
+            DCACHE_WORD_ACCESS="y";
+            #DEBUG_INFO="y";
+            DEBUG_MISC="y";
+            DIMLIB="y";
+            DMADEVICES="y";
+            DMATEST="y";
+            DMA_BOUNCE_UNALIGNED_KMALLOC="y";
+            DMA_DIRECT_REMAP="y";
+            DMA_ENGINE="y";
+            DMA_ENGINE_RAID="y";
+            DMA_OF="y";
+            DMA_VIRTUAL_CHANNELS="y";
+            DTC="y";
+            EDAC_SUPPORT="y";
+            EINT_MTK="y";
+            EXCLUSIVE_SYSTEM_RAM="y";
+            EXT4_FS="y";
+            F2FS_FS="y";
+            FIXED_PHY="y";
+            FIX_EARLYCON_MEM="y";
+            FRAME_POINTER="y";
+            FS_IOMAP="y";
+            FS_MBCACHE="y";
+            FUNCTION_ALIGNMENT="4";
+            FUNCTION_ALIGNMENT_4B="y";
+            FWNODE_MDIO="y";
+            FW_LOADER_PAGED_BUF="y";
+            #FW_LOADER_SYSFS="y";
+            #GCC11_NO_ARRAY_BOUNDS="y";
+            #GCC_ASM_GOTO_OUTPUT_WORKAROUND="y";
+            GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS="y";
+            GENERIC_ALLOCATOR="y";
+            GENERIC_ARCH_TOPOLOGY="y";
+            GENERIC_BUG="y";
+            GENERIC_BUG_RELATIVE_POINTERS="y";
+            GENERIC_CLOCKEVENTS="y";
+            GENERIC_CLOCKEVENTS_BROADCAST="y";
+            GENERIC_CPU_AUTOPROBE="y";
+            GENERIC_CPU_VULNERABILITIES="y";
+            GENERIC_CSUM="y";
+            GENERIC_EARLY_IOREMAP="y";
+            GENERIC_GETTIMEOFDAY="y";
+            GENERIC_IDLE_POLL_SETUP="y";
+            GENERIC_IOREMAP="y";
+            GENERIC_IRQ_EFFECTIVE_AFF_MASK="y";
+            GENERIC_IRQ_SHOW="y";
+            GENERIC_IRQ_SHOW_LEVEL="y";
+            GENERIC_LIB_DEVMEM_IS_ALLOWED="y";
+            GENERIC_MSI_IRQ="y";
+            GENERIC_PCI_IOMAP="y";
+            GENERIC_PHY="y";
+            GENERIC_PINCONF="y";
+            GENERIC_PINCTRL_GROUPS="y";
+            GENERIC_PINMUX_FUNCTIONS="y";
+            GENERIC_SCHED_CLOCK="y";
+            GENERIC_SMP_IDLE_THREAD="y";
+            GENERIC_STRNCPY_FROM_USER="y";
+            GENERIC_STRNLEN_USER="y";
+            GENERIC_TIME_VSYSCALL="y";
+            GLOB="y";
+            GPIO_CDEV="y";
+            GPIO_WATCHDOG="y";
+            GPIO_WATCHDOG_ARCH_INITCALL="y";
+            GRO_CELLS="y";
+            HARDIRQS_SW_RESEND="y";
+            HAS_DMA="y";
+            HAS_IOMEM="y";
+            HAS_IOPORT="y";
+            HAS_IOPORT_MAP="y";
+            HWMON="y";
+            HW_RANDOM="y";
+            HW_RANDOM_MTK="y";
+            I2C="y";
+            I2C_BOARDINFO="y";
+            I2C_CHARDEV="y";
+            I2C_MT65XX="y";
+            ICPLUS_PHY="y";
+            ILLEGAL_POINTER_VALUE="0xdead000000000000";
+            #INITRAMFS_SOURCE="""";
+            IRQCHIP="y";
+            IRQ_DOMAIN="y";
+            IRQ_DOMAIN_HIERARCHY="y";
+            IRQ_FORCED_THREADING="y";
+            IRQ_TIME_ACCOUNTING="y";
+            IRQ_WORK="y";
+            JBD2="y";
+            JUMP_LABEL="y";
+            LEDS_PWM="y";
+            LEDS_SMARTRG_LED="y";
+            LIBFDT="y";
+            LOCK_DEBUGGING_SUPPORT="y";
+            LOCK_SPIN_ON_OWNER="y";
+            LZO_COMPRESS="y";
+            LZO_DECOMPRESS="y";
+            MAGIC_SYSRQ="y";
+            MAXLINEAR_GPHY="y";
+            MDIO_BUS="y";
+            MDIO_DEVICE="y";
+            MDIO_DEVRES="y";
+            MEDIATEK_2P5GE_PHY="y";
+            MEDIATEK_GE_PHY="y";
+            MEDIATEK_GE_SOC_PHY="y";
+            MEDIATEK_WATCHDOG="y";
+            MESSAGE_LOGLEVEL_DEFAULT="7";
+            MFD_SYSCON="y";
+            MIGRATION="y";
+            MMC="y";
+            MMC_BLOCK="y";
+            MMC_CQHCI="y";
+            MMC_MTK="y";
+            MMU_LAZY_TLB_REFCOUNT="y";
+            MODULES_TREE_LOOKUP="y";
+            MODULES_USE_ELF_RELA="y";
+            MTD_NAND_CORE="y";
+            MTD_NAND_ECC="y";
+            MTD_NAND_ECC_MEDIATEK="y";
+            MTD_NAND_ECC_SW_HAMMING="y";
+            MTD_NAND_MTK="y";
+            MTD_NAND_MTK_BMT="y";
+            MTD_PARSER_TRX="y";
+            MTD_RAW_NAND="y";
+            MTD_SPI_NAND="y";
+            MTD_SPI_NOR="y";
+            MTD_SPLIT_FIRMWARE="y";
+            MTD_SPLIT_FIT_FW="y";
+            MTD_UBI="y";
+            MTD_UBI_BEB_LIMIT="20";
+            MTD_UBI_BLOCK="y";
+            MTD_UBI_FASTMAP="y";
+            MTD_UBI_NVMEM="y";
+            MTD_UBI_WL_THRESHOLD="4096";
+            MTK_CPUX_TIMER="y";
+            MTK_HSDMA="y";
+            MTK_INFRACFG="y";
+            MTK_LVTS_THERMAL="y";
+            MTK_LVTS_THERMAL_DEBUGFS="y";
+            MTK_PMIC_WRAP="y";
+            MTK_REGULATOR_COUPLER="y";
+            MTK_SCPSYS="y";
+            MTK_SCPSYS_PM_DOMAINS="y";
+            MTK_SOC_THERMAL="y";
+            MTK_THERMAL="y";
+            MTK_TIMER="y";
+            MUTEX_SPIN_ON_OWNER="y";
+            NEED_DMA_MAP_STATE="y";
+            NEED_SG_DMA_LENGTH="y";
+            NET_DEVLINK="y";
+            NET_DSA="y";
+            NET_DSA_MT7530="y";
+            NET_DSA_MT7530_MDIO="y";
+            NET_DSA_MT7530_MMIO="y";
+            NET_DSA_TAG_MTK="y";
+            #NET_EGRESS="y";
+            NET_FLOW_LIMIT="y";
+            #NET_INGRESS="y";
+            NET_MEDIATEK_SOC="y";
+            NET_MEDIATEK_SOC_WED="y";
+            NET_SELFTESTS="y";
+            NET_SWITCHDEV="y";
+            NET_VENDOR_MEDIATEK="y";
+            #NET_XGRESS="y";
+            NLS="y";
+            NO_HZ_COMMON="y";
+            NO_HZ_IDLE="y";
+            NR_CPUS="4";
+            NVMEM="y";
+            NVMEM_BLOCK="y";
+            NVMEM_LAYOUTS="y";
+            NVMEM_LAYOUT_ADTRAN="y";
+            NVMEM_MTK_EFUSE="y";
+            NVMEM_SYSFS="y";
+            OF="y";
+            OF_ADDRESS="y";
+            OF_DYNAMIC="y";
+            OF_EARLY_FLATTREE="y";
+            OF_FLATTREE="y";
+            OF_GPIO="y";
+            OF_IRQ="y";
+            OF_KOBJ="y";
+            OF_MDIO="y";
+            OF_OVERLAY="y";
+            OF_RESOLVE="y";
+            PADATA="y";
+            PAGE_POOL="y";
+            PAGE_POOL_STATS="y";
+            PAGE_SIZE_LESS_THAN_256KB="y";
+            PAGE_SIZE_LESS_THAN_64KB="y";
+            #PAHOLE_HAS_LANG_EXCLUDE="y";
+            PARTITION_PERCPU="y";
+            PCI="y";
+            PCIEAER="y";
+            PCIEASPM="y";
+            PCIEASPM_PERFORMANCE="y";
+            PCIEPORTBUS="y";
+            PCIE_MEDIATEK_GEN3="y";
+            PCIE_PME="y";
+            PCI_DEBUG="y";
+            PCI_DOMAINS="y";
+            PCI_DOMAINS_GENERIC="y";
+            PCI_MSI="y";
+            PCS_MTK_LYNXI="y";
+            PCS_MTK_USXGMII="y";
+            PERF_EVENTS="y";
+            PER_VMA_LOCK="y";
+            PGTABLE_LEVELS="3";
+            PHYLIB="y";
+            PHYLIB_LEDS="y";
+            PHYLINK="y";
+            PHYS_ADDR_T_64BIT="y";
+            PHY_MTK_TPHY="y";
+            PHY_MTK_XFI_TPHY="y";
+            PHY_MTK_XSPHY="y";
+            PINCTRL="y";
+            PINCTRL_MT7981="y";
+            PINCTRL_MT7986="y";
+            PINCTRL_MT7988="y";
+            PINCTRL_MTK_MOORE="y";
+            PINCTRL_MTK_V2="y";
+            PM="y";
+            PM_CLK="y";
+            PM_GENERIC_DOMAINS="y";
+            PM_GENERIC_DOMAINS_OF="y";
+            PM_OPP="y";
+            POLYNOMIAL="y";
+            POSIX_CPU_TIMERS_TASK_WORK="y";
+            POWER_RESET="y";
+            POWER_RESET_SYSCON="y";
+            POWER_SUPPLY="y";
+            PREEMPT_NONE_BUILD="y";
+            PRINTK_TIME="y";
+            PSTORE="y";
+            PSTORE_COMPRESS="y";
+            PSTORE_CONSOLE="y";
+            PSTORE_PMSG="y";
+            PSTORE_RAM="y";
+            PTP_1588_CLOCK_OPTIONAL="y";
+            PWM="y";
+            PWM_MEDIATEK="y";
+            PWM_SYSFS="y";
+            QUEUED_RWLOCKS="y";
+            QUEUED_SPINLOCKS="y";
+            RANDSTRUCT_NONE="y";
+            RAS="y";
+            RATIONAL="y";
+            REALTEK_PHY="y";
+            REED_SOLOMON="y";
+            REED_SOLOMON_DEC8="y";
+            REED_SOLOMON_ENC8="y";
+            REGMAP="y";
+            REGMAP_I2C="y";
+            REGMAP_MMIO="y";
+            REGULATOR="y";
+            REGULATOR_FIXED_VOLTAGE="y";
+            REGULATOR_MT6380="y";
+            REGULATOR_RT5190A="y";
+            RESET_CONTROLLER="y";
+            RESET_TI_SYSCON="y";
+            RFS_ACCEL="y";
+            RODATA_FULL_DEFAULT_ENABLED="y";
+            RPS="y";
+            RTC_CLASS="y";
+            RTC_DRV_MT7622="y";
+            RTC_I2C_AND_SPI="y";
+            RWSEM_SPIN_ON_OWNER="y";
+            SCHED_MC="y";
+            SCSI="y";
+            SCSI_COMMON="y";
+            SERIAL_8250_FSL="y";
+            SERIAL_8250_MT6577="y";
+            SERIAL_8250_NR_UARTS="3";
+            SERIAL_8250_RUNTIME_UARTS="3";
+            SERIAL_DEV_BUS="y";
+            SERIAL_DEV_CTRL_TTYPORT="y";
+            SERIAL_MCTRL_GPIO="y";
+            SERIAL_OF_PLATFORM="y";
+            SGL_ALLOC="y";
+            SG_POOL="y";
+            SMP="y";
+            SOCK_RX_QUEUE_MAPPING="y";
+            SOFTIRQ_ON_OWN_STACK="y";
+            SPARSEMEM="y";
+            SPARSEMEM_EXTREME="y";
+            SPARSEMEM_VMEMMAP="y";
+            SPARSEMEM_VMEMMAP_ENABLE="y";
+            SPARSE_IRQ="y";
+            SPI="y";
+            SPI_DYNAMIC="y";
+            SPI_MASTER="y";
+            SPI_MEM="y";
+            SPI_MT65XX="y";
+            SPI_MTK_SNFI="y";
+            #SQUASHFS_DECOMP_MULTI_PERCPU="y";
+            SWIOTLB="y";
+            SWPHY="y";
+            SYSCTL_EXCEPTION_TRACE="y";
+            THERMAL="y";
+            THERMAL_DEFAULT_GOV_STEP_WISE="y";
+            THERMAL_EMERGENCY_POWEROFF_DELAY_MS="0";
+            THERMAL_GOV_BANG_BANG="y";
+            THERMAL_GOV_FAIR_SHARE="y";
+            THERMAL_GOV_STEP_WISE="y";
+            THERMAL_GOV_USER_SPACE="y";
+            THERMAL_HWMON="y";
+            THERMAL_OF="y";
+            THERMAL_WRITABLE_TRIPS="y";
+            THREAD_INFO_IN_TASK="y";
+            TICK_CPU_ACCOUNTING="y";
+            TIMER_OF="y";
+            TIMER_PROBE="y";
+            TRACE_IRQFLAGS_NMI_SUPPORT="y";
+            TREE_RCU="y";
+            TREE_SRCU="y";
+            UBIFS_FS="y";
+            UIMAGE_FIT_BLK="y";
+            USB_SUPPORT="y";
+            VMAP_STACK="y";
+            WATCHDOG_CORE="y";