The image labelled eth0 (SFP+) as the only WAN; the single copper RJ45
(eth2/mvpp2-2) was trapped in br-lan, so an operator/uplink arriving on
copper got no lease. Make both eth0 (SFP+) and eth2 (copper) DHCP WAN
candidates (whichever is cabled gets the lease); br-lan keeps the switch
LAN ports. Verified live on the c3box reference install.
CONFIG_CFG80211_REQUIRE_SIGNED_REGDB=y + CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS=y
pull libssl-dev:arm64 as build-dep at dpkg-checkbuilddeps time. The CI
runner only has libssl-dev (amd64), so cross-arm64 kernel .deb build
fails.
FR regulatory lock is already enforced at userspace by secubox-mesh
postinst (`iw reg set FR`) per CM-MESH-MPCIE-2026-06 §6 — kernel-side
signed regdb is redundant for the initial mesh integration. Revisit
later with proper multi-arch libssl-dev install in build-kernel.yml
if signed regdb becomes a CSPN requirement.
Unblocks kernel build run 26815902206 (failed on libssl-dev:arm64).
Append WIRELESS/WIFI block to OpenWrt-merged kernel fragment so the next
build-kernel.yml run ships:
- mac80211 + 802.11s mesh + HWMP (=m)
- ath10k_pci for QCA9880 / WLE900VX backhaul mesh
- mt76x2u for MT7632U USB access client
- ath9k_htc for AR9271 firmware-free audit dongle
- signed regulatory DB (FR domain lock via secubox-mesh postinst)
Add four sanity-check greps in build-kernel.yml so a future fragment
regression fails the CI before producing a kernel .deb without WiFi.
Manual workflow_dispatch of build-kernel.yml required to materialise
the new linux-image-*.deb (artifact path not yet wired into
build-image.yml — see tracking issue).
After the 2026-05-23 reboot the board sat at the extlinux prompt
waiting for an operator key press on the serial console and only came
back online once someone reached the headless unit physically. Two
issues with the template:
1. DEFAULT pointed at `secubox-led`, a stale label the live config no
longer carries (board has been renamed to `nftables` / `mpcie-fix`
entries since the kernel rebuild). When extlinux can't find the
named DEFAULT it falls back to interactive selection — which is
indistinguishable on the serial console from a "wait forever" hang.
2. TIMEOUT 50 (5 s) was reasonable but still felt long; dropping to
30 (3 s) makes reboots one-shot from a service-restart standpoint
while still giving an operator at the console a window to pick the
legacy kernel if needed.
Aligns the template with the live config (labels nftables + mpcie-fix)
so a board reinstall reproduces the working menu. DEFAULT is mpcie-fix
because that's the only kernel that supports EP06 mPCIe USB PHY +
RTL-SDR (Sentinelle GSM v0.4.0 needs both); the legacy nftables kernel
remains available as a manual fallback in the menu.
Both x64 profiles were DHCP-only; on a network without DHCP the appliance
had no IP at all and was unreachable.
Both interfaces now declare DHCP4 + static 192.168.1.55/24 +
gw 192.168.1.254 + DNS 1.1.1.1, 8.8.8.8. systemd-networkd accepts both:
DHCP routes get the configured low metric (100/200), the static fallback
gets metric 1000, so DHCP wins when available and the static keeps the
appliance reachable on 192.168.1.55 when DHCP times out.
Applied to all WAN candidate interfaces:
x64-vm: enp0s3 (VBox NAT), enp1s0 (KVM), ens192 (VMware)
x64-live: "en*" match, "eth*" match
LAN-side interfaces (enp0s8 host-only, enp2s0, ens224, br-lan) unchanged.
Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
merge_config.sh greps every line for kconfig-shaped patterns including
the negative form `# CONFIG_X is not set`. The fragment's prose
comment quoted that literal string, which the merger mistook for a
directive and concatenated with the next real directive, producing
a poisoned merge that left CONFIG_ZRAM_DEF_COMP_ZSTD unset.
Rewording the prose so 'is not set' never appears in a comment line
unblocks the cross-arm64 kernel build.
Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
CI run 26222437600 failed at the sanity-check: kconfig didn't emit
CONFIG_ZRAM_DEF_COMP="zstd" verbatim because that symbol is the
auto-derived output of the CONFIG_ZRAM_DEF_COMP_<X> choice family,
not a settable variable. Check the choice itself instead.
Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
gk2 board runs 15+ LXCs on 8 GiB without swap; the stock kernel ships
`# CONFIG_ZRAM is not set` so zram-tools can't activate. Adding zram
as a module with zstd as the default compressor lets userspace create
/dev/zram0, mkswap, and swapon at ~25% of RAM for safe compressed
RAM-backed swap (no plaintext on disk — CSPN-friendly).
* board/mochabin/kernel/config-6.12.85-secubox-zram.fragment (new):
CONFIG_ZRAM=m, CONFIG_ZRAM_DEF_COMP_ZSTD=y, CONFIG_ZSMALLOC=y +
zstd/lz4/lzo crypto for runtime swap of compressor.
* kernel-build/build-kernel.sh: merge the zram fragment into the
kernel config alongside the OpenWrt-merged base.
Follow-up (separate issue): ship a minimal /usr/lib/systemd/system/
zramswap.service that does `modprobe zram; mkswap /dev/zram0;
swapon -p 100 /dev/zram0` so we don't need apt outbound for
zram-tools.
Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
- Define Board struct with hardware, boot, interfaces
- Define Tweaks struct for board-specific overrides
- Add LoadBoard and LoadTweaks functions
- Add MOCHAbin board.yaml and tweaks.yaml
- Support missing tweaks.yaml (optional)
- Add tests for TestLoadBoard and TestLoadTweaks
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Session 120 findings:
- Rapid I2C writes can hang the mv64xxx controller on both 6.6.x and 6.12.x
- Kernel 6.12.x is worse (fails even with delays)
- Kernel 6.6.x works with proper delays (30-50ms between writes)
Changed CONFIG_LEDS_IS31FL319X from =y (built-in) to =m (module):
- Allows I2C bus recovery without reboot: rmmod/modprobe
- Matches Debian kernel defaults
- Module can be loaded by systemd after boot
Also added Session 120 documentation with:
- Root cause analysis using systematic debugging
- Kernel comparison (6.6.x vs 6.12.x)
- initcall_blacklist=leds_pca955x_init (OpenWrt workaround)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Kernel 6.12.85-openwrt-led deployed with IS31FL319X driver
- 9 LEDs working: blue/green/red × led1/led2/led3
- Heartbeat trigger active on green:led1
- USB network drivers added for Eye Remote (cdc_ether, usbnet)
- Config fragment updated with LED and USB options
- GitHub issues #60, #45, #39 updated
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add missing built-in dependencies for boot-critical subsystems:
- MMC: Full chain (MMC, MMC_BLOCK, SDHCI, SDHCI_PLTFM, XENON)
- Filesystems: EXT4, VFAT, OverlayFS (required for boot)
- DSA Switch: Bridge deps (LLC, STP, BRIDGE), MV88E6XXX
- USB: XHCI, USB_STORAGE for USB boot/devices
- SATA: AHCI for SSD support
- PCIe: PCIE_ARMADA_8K
LED IS31FL319X driver tested working on MOCHAbin with kernel 6.12.85.
I2C errors occur but LED commands still function.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- config-6.12.85-debian-base: Full Debian arm64 kernel config (13K options)
extracted from working MOCHAbin system with MVPP2 network driver
- config-6.12.85-secubox-led-v2.fragment: Kconfig fragment enabling:
- IS31FL319X/IS31FL32XX LED drivers (built-in)
- MVPP2/MVNETA network drivers (built-in)
- I2C MV64XXX for LED controller
- GPIO/pinctrl for LED shutdown pin
- /proc/config.gz for debugging
Build strategy: merge fragment on top of Debian base using
scripts/kconfig/merge_config.sh to preserve all working drivers
while adding LED support.
Fixes kernel panic from missing MVPP2 in previous custom builds.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Change USB modules from =m to =y for live USB support:
- CONFIG_USB_XHCI_HCD=y (USB 3.0)
- CONFIG_USB_XHCI_PCI=y
- CONFIG_USB_XHCI_PLATFORM=y
- CONFIG_USB_EHCI_HCD=y (USB 2.0)
- CONFIG_USB_EHCI_PCI=y
- CONFIG_USB_OHCI_HCD=y (USB 1.1)
- CONFIG_USB_OHCI_HCD_PCI=y
- CONFIG_USB_STORAGE=y
Required for bootable USB without module dependencies.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Change critical network modules from =m to =y to avoid module mismatch:
- CONFIG_MDIO=y (core MDIO bus)
- CONFIG_SFP=y (SFP+ support)
- CONFIG_MARVELL_PHY=y (Marvell PHY driver)
- CONFIG_MARVELL_10G_PHY=y (10G PHY)
- CONFIG_MDIO_I2C=y (MDIO over I2C)
These are required for MVPP2 network to work without loading modules
from a different kernel version.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add GeoMap tab with country attack distribution
- Display country flags emoji in alerts list
- Show attack percentage by country
- Fix WAF addon to use X-Forwarded-For for real attacker IP
- Enable FAT/VFAT built-in and MVPP2 in LED kernel config
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add kernel config for 6.12.85 with:
- CONFIG_ARCH_MVEBU=y (required for Marvell Armada)
- CONFIG_I2C_MV64XXX=y (I2C controller for IS31FL3199)
- CONFIG_LEDS_IS31FL319X=y (LED driver)
This fixes the "Driver 'mv64xxx_i2c' is already registered" conflict
by building the I2C driver into the kernel instead of as a module.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- extlinux.conf: secubox-led entry now uses initrd.img-6.12.85
(matches kernel 6.12.85, not the +deb12-arm64 variant)
- This fixes "Driver 'mv64xxx_i2c' is already registered" error
caused by kernel/initrd module mismatch
- Add secubox-led-k2000 script for rainbow LED effect
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The shutdown-gpios property was incorrectly set to GPIO_ACTIVE_LOW,
causing the LED controller to stay in shutdown mode.
Changed to GPIO_ACTIVE_HIGH to match OpenWrt's working configuration.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Pi Zero composite gadget creates both RNDIS (usb0) and CDC-ECM (usb1)
interfaces with same MAC prefix. This caused duplicate routes for
10.55.0.0/24 network, breaking connectivity to Eye Remote.
Fix:
- RNDIS (usb0): Configure with IP 10.55.0.1/24, bring up
- CDC-ECM (usb1): Disable (ip link down) to prevent route conflict
- Add serial console symlink /dev/eye-remote-console
Ref #52
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The 4G image size was insufficient for the full SecuBox install with
slipstream packages (~5.5GB rootfs needed). Updated to 8G which fits
on SATA or larger SD cards.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Problem: IP assignment failures on bare metal AMD64 due to broken
netplan wildcard syntax - using wan0: with match: name: "e*" but
no set-name: directive caused conflicts on multi-interface systems.
Solution:
- Split single e* pattern into separate en* and eth* matches
- Different route metrics (100/200) for deterministic routing
- Added br-lan bridge pre-definition for router mode
- Enhanced secubox-net-detect with better logging and patterns
- New secubox-net-reset utility for forcing re-detection
Changes:
- board/x64-live/netplan/00-secubox.yaml: Fixed bootstrap config
- image/build-live-usb.sh: Updated embedded netplan with same fix
- image/sbin/secubox-net-detect: Enhanced interface detection
- image/sbin/secubox-net-reset: New utility script
- CLAUDE.md: Added Debian shell scripting guidelines
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Display system for Pi Zero Eye Remote (HyperPixel 2.1 Round 480x480):
Splash Screen (splash.py):
- Animated phoenix logo for boot/halt/start/reboot states
- Pulsing glow effects with fire colors
- Progress indicator ring with rotating dots
- Fallback phoenix symbol if logo image missing
Fallback Display Manager (fallback_manager.py):
- Connection state detection (OTG 10.55.0.1, WiFi secubox.local)
- Four modes: OFFLINE, CONNECTING, ONLINE, COMMUNICATING
- Local metrics radar with 6 concentric rings
- 3D rotating cube with module icons when connected
- Rainbow sweep line animation
Touch Analysis Tools:
- touch_analyzer.py: Noise pattern analysis (Y-axis oscillation at stable X)
- touch_calibrate.py: Corner target display for manual calibration
- touch_filter.py: X-stable noise filtering
Radar Variants:
- radar_flashy.py: Vibrant colors with 3D cube
- radar_concentric.py: Balanced metric arcs centered at 12 o'clock
- radar_rainbow.py: Rainbow colorization with sweep
- radar_full.py: Complete feature set
Also includes:
- Hardware Smart-Strip module specs (SBX-STR-01)
- Host configuration for USB OTG network
- Systemd service for USB auto-mode
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Extended mv88e6xxx blacklist to include mv88e6085 subdriver and added
initcall_blacklist for built-in driver scenarios. Fixes detection loop
on ESPRESSObin v7 during USB boot via Eye Remote.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add ARP-based IP collision detection for multi-device environments
- MAC-based pseudo-random IP offset to spread devices across range
- Gratuitous ARP announcement to prevent IP conflicts
- Fix EspressoBin DSA network: target wan interface, not eth0 CPU port
- Static IP fallback 192.168.255.250 when DHCP unavailable
- Sync all build scripts to version 1.7.0
- Add screenshot script with 90+ module URLs
- Add mock HTML screenshots for documentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
secubox-flash-disk:
- Add efibootmgr verification after GRUB EFI install
- Show manual fix instructions if EFI entry not created
- Mount /dev/pts for chroot compatibility
- Pass target device to grub-install
- Better error handling and summary
netplan (x64-live):
- Remove invalid routes (via: 0.0.0.0)
- Add dhcp4-overrides for proper DNS/routes
- Rename wan to wan0 to avoid conflicts
Fixes Error 1962 on Lenovo ThinkCentre M710q
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Plymouth: Integrate secubox-cube theme with 3D rotating module icons
- Auth: Create users.json for portal login (admin/secubox)
- flash-disk: Fix 'local' outside function error on line 236
- netplan: Add br-lan/wan structure for x64-live mode
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add fonts-terminus and kbd packages for UTF-8 box-drawing chars
- Configure console-setup with Terminus font (FONTFACE/FONTSIZE)
- Add vconsole.conf with ter-v16n font for systemd
- Include flash-emmc.scr on boot partition for U-Boot flashing
- Copy embedded eMMC image to boot partition for U-Boot access
- Update README with Live USB Quick Flash instructions
- Bump version to 1.6.1
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add build-all-live-usb.yml with matrix for x64, EspressoBin V7, and RPi 400
- Update release.yml to include live USB builds in release pipeline
- Add RPi 400 netplan configuration for Ethernet and WiFi
- Deprecate build-live-usb.yml (now wrapper to unified workflow)
Platforms supported:
- x64 (amd64) - GRUB UEFI/BIOS boot
- EspressoBin V7 (arm64) - U-Boot distroboot with embedded eMMC image
- Raspberry Pi 400 (arm64) - Native Pi firmware boot
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New components for bootable live USB with eMMC flashing capability:
- image/build-ebin-live-usb.sh: Build script for ARM64 live USB
- SquashFS-based live filesystem
- Cross-compilation support via QEMU
- Optional embedded eMMC image for flashing
- Distroboot configuration for U-Boot
- image/sbin/secubox-flash-emmc: Interactive eMMC flasher
- Safety checks (won't flash if running from eMMC)
- Progress display and checksum verification
- Auto mode for unattended installation
- Dry-run option for testing
- board/espressobin-v7/boot-live-usb.cmd: U-Boot boot script
- USB boot priority configuration
- Live-boot kernel parameters
- board/espressobin-v7/extlinux/extlinux.conf: Distroboot menu
- Live, To-RAM, Flash, and Rescue boot options
- Updated secubox-console-tui with "Flash to eMMC" menu option
Usage:
# Build eMMC image first
sudo bash image/build-image.sh --board espressobin-v7
# Build live USB with embedded image
sudo bash image/build-ebin-live-usb.sh \
--embed-image output/secubox-espressobin-v7-bookworm.img.gz
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New scripts for USB boot workflow:
- boot-usb.cmd/scr: Boot live system from USB
- flash-emmc.cmd/scr: Flash compressed image to eMMC
Usage:
1. Copy image.gz + boot.scr to FAT32 USB
2. On U-Boot: usb start && load usb 0:1 $loadaddr boot.scr && source $loadaddr
3. For eMMC flash: load usb 0:1 $loadaddr flash-emmc.scr && source $loadaddr
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add rpi400 to default CI builds in build-image.yml
- Create board/rpi400/config.mk with Pi 400 settings
- Add build-image.sh redirect to build-rpi-usb.sh for RPi boards
- Add boot menu system to build-rpi-usb.sh:
- Normal, Kiosk, Console, Bridge, Minimal modes
- VT100/DEC PDP-style menu interface
- Persistent mode selection across reboots
- systemd integration for early boot
- Fix slipstream in build-rpi-usb.sh:
- Use dpkg --force-depends (pip provides Python deps)
- Skip failing apt-get -f install
- Add more Python dependencies to pip install
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use armada-3720-espressobin-v7-emmc.dtb to enable both SDHCI controllers
- Fix root device: /dev/mmcblk1p2 (eMMC is mmc1 with dual controller DTB)
- Add modprobe.blacklist=mv88e6xxx,dsa_core to prevent DSA probe loop
- Add sdhci.debug_quirks2=0x40 to fix xenon-sdhci DDR timing issues
- Add initramfs hooks for sdhci-xenon and mv88e6xxx blacklist
- Add systemd service to load mv88e6xxx after rootfs mount
- Fix fstab tmpfs mount (remove non-existent user reference)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Document storage constraints for ARM boards:
- ESPRESSObin 4GB eMMC: max 3.5GB image
- ESPRESSObin 8GB/MOCHAbin: 4GB default, 6GB max
- MOCHAbin SATA/NVMe alternative for larger installs
- Added MOCHAbin README.md with U-Boot flash guide
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Document U-Boot flash procedure for installing SecuBox to eMMC
from USB drive. Includes:
- USB to eMMC flash via gzwrite
- SD card alternative method
- Network interface mapping
- Troubleshooting tips
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
