upd and patches

assets/var/gnu/linux/kernel/firmware.md

@@ -0,0 +1,16 @@
+linux/kernel/firmware
+=
+https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
+
+``` env *** env ***
+disable=true
+```
+
+``` sh *** build ***
+make DESTDIR=/pkg/gnu/linux/kernel/firmware install
+```
+
+``` sh *** config ***
+mv lib/firmware/* lib
+rm -r lib/firmware
+```

assets/var/gnu/linux/kernel/modules.md

@@ -0,0 +1,93 @@
+linux/kernel/modules 7.1.4
+=
+https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.4.tar.xz
+
+``` env *** env ***
+disable=true
+```
+
+``` sh *** patch ***
+mkdir -p certs
+cp /pkg/gnu/linux/kernel/var/certs/* certs || true
+sed -i '/^static const char \* const fw_path\[\] = {$/,/^};$/ s|"/lib/firmware|"/pkg/gnu/linux/kernel/firmware/lib|g' drivers/base/firmware_loader/main.c
+```
+
+``` sh *** build ***
+#
+# Configuration
+#
+cat > .config.base <<ENDCONFIG
+# Kernel settings
+CONFIG_KERNEL_LZ4=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_PREEMPT=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
+
+# Video
+CONFIG_FB=y
+CONFIG_FB_EFI=y
+CONFIG_FB_SIMPLE=y
+CONFIG_DRM_SIMPLEDRM=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+CONFIG_DRM_FBDEV_EMULATION=y
+
+# Security 
+CONFIG_INTEGRITY=n
+CONFIG_SECURITY_SELINUX=n
+CONFIG_KEY_DH_OPERATIONS=y
+CONFIG_TCG_TPM=y
+CONFIG_TRUSTED_KEYS_TPM=y
+CONFIG_SECURITYFS=y
+CONFIG_HARDENED_USERCOPY=y
+CONFIG_FORTIFY_SOURCE=y
+CONFIG_SECURITY_DMESG_RESTRICT=y
+CONFIG_SECURITY_LANDLOCK=y
+CONFIG_SECURITY_YAMA=y
+CONFIG_SECURITY_LOADPIN=y
+CONFIG_SECURITY_SAFESETID=y
+CONFIG_LSM="landlock,yama,loadpin,safesetid"
+
+# Block devices
+CONFIG_BLK_DEV_NVME=y
+CONFIG_BLK_WBT=y
+CONFIG_NVME_CORE=y
+CONFIG_NVME_HWMON=y
+CONFIG_F2FS_FS=y
+
+# AeroLinux conf
+CONFIG_CMDLINE_BOOL=y
+CONFIG_CMDLINE="root=PARTLABEL=aerolinux init=/pkg/gnu/s6/bin/s6-init rootwait rw console=tty0 earlycon=efifb loglevel=8 debug"
+CONFIG_MODPROBE_PATH="/pkg/gnu/bin/modprobe"
+ENDCONFIG
+
+make defconfig
+./scripts/kconfig/merge_config.sh -m .config .config.base
+find . -name Kconfig -exec awk '
+    /^(config|menuconfig) [A-Za-z0-9_]+$/ {
+        config_name = $2
+        getline next_line
+        if (next_line ~ /^[[:space:]]*tristate([[:space:]]|$)/) {
+            print "CONFIG_" config_name "=m"
+        }
+    }
+' {} + > .config.modules
+./scripts/kconfig/merge_config.sh .config .config.modules
+sed -E '/.*DEBUG.*/ s/=(y|m)/=n/' -i .config
+make olddefconfig
+./scripts/kconfig/merge_config.sh -m .config .config.base
+make olddefconfig
+make -j$(nproc) vmlinux modules
+make INSTALL_MOD_PATH=/pkg/gnu/linux/kernel/modules modules_install
+mkdir -p /pkg/gnu/linux/kernel/var/certs
+cp System.map /pkg/gnu/linux/kernel/var/System.map
+cp .config /pkg/gnu/linux/kernel/var/config
+cp {certs/signing_key.pem,certs/signing_key.x509} /pkg/gnu/linux/kernel/var/certs || true
+```
+
+``` sh *** config ***
+mv lib/modules/* lib
+rm -r lib/modules
+```