mirror of
https://github.com/ps5-linux/ps5-linux-image.git
synced 2026-07-16 01:50:40 +00:00
389 lines
13 KiB
YAML
389 lines
13 KiB
YAML
image:
|
|
name: ps5-kali
|
|
distribution: debian
|
|
# Release images use Kali's last snapshot for stable, repeatable builds.
|
|
release: kali-last-snapshot
|
|
description: Kali Linux XFCE desktop
|
|
architecture: x86_64
|
|
|
|
source:
|
|
downloader: debootstrap
|
|
url: https://kali.download/kali
|
|
variant: minbase
|
|
keyserver: keyserver.ubuntu.com
|
|
keys:
|
|
- 0x827C8569F2518CC677FECA1AED65462EC8D5E4C5
|
|
|
|
packages:
|
|
manager: apt
|
|
update: true
|
|
cleanup: true
|
|
|
|
repositories:
|
|
- name: sources.list
|
|
url: |-
|
|
deb https://kali.download/kali kali-last-snapshot main contrib non-free non-free-firmware
|
|
architectures:
|
|
- amd64
|
|
|
|
sets:
|
|
- packages:
|
|
# Full Kali desktop and toolset
|
|
- kali-desktop-xfce
|
|
- kali-linux-everything
|
|
- kali-defaults
|
|
- kali-defaults-desktop
|
|
- kali-themes
|
|
- kali-wallpapers-2026
|
|
- kali-wallpapers-all
|
|
- kali-menu
|
|
- kali-tweaks
|
|
- kali-undercover
|
|
|
|
# Display / GPU / audio
|
|
- lightdm
|
|
- lightdm-gtk-greeter
|
|
- xserver-xorg
|
|
- xserver-xorg-video-amdgpu
|
|
- dbus-x11
|
|
- x11-xserver-utils
|
|
- mesa-vulkan-drivers
|
|
- pipewire
|
|
- pipewire-pulse
|
|
- wireplumber
|
|
- pavucontrol
|
|
|
|
# Networking and remote access
|
|
- network-manager
|
|
- network-manager-gnome
|
|
- openssh-server
|
|
- iputils-ping
|
|
- ntpsec
|
|
- iw
|
|
- wpasupplicant
|
|
- wireless-regdb
|
|
|
|
# Firmware and PS5 boot support
|
|
- firmware-linux
|
|
- firmware-linux-nonfree
|
|
- firmware-amd-graphics
|
|
- firmware-realtek
|
|
- firmware-atheros
|
|
- firmware-mediatek
|
|
- firmware-misc-nonfree
|
|
- initramfs-tools
|
|
- kexec-tools
|
|
- kmod
|
|
- busybox
|
|
- zstd
|
|
- systemd-zram-generator
|
|
|
|
# Base system utilities
|
|
- sudo
|
|
- cloud-guest-utils
|
|
- parted
|
|
- e2fsprogs
|
|
- usbutils
|
|
- pciutils
|
|
- rfkill
|
|
- util-linux
|
|
- curl
|
|
- wget
|
|
- git
|
|
- ca-certificates
|
|
- build-essential
|
|
- bc
|
|
- bison
|
|
- flex
|
|
- libssl-dev
|
|
- libelf-dev
|
|
- vim
|
|
- nano
|
|
- tmux
|
|
- firefox-esr
|
|
# Ghidra 12.1 requires JDK 21. The full Kali set also installs newer JDKs.
|
|
- openjdk-21-jdk
|
|
action: install
|
|
|
|
files:
|
|
- path: /etc/hostname
|
|
generator: hostname
|
|
|
|
- path: /etc/hosts
|
|
generator: hosts
|
|
|
|
- path: /etc/machine-id
|
|
generator: dump
|
|
|
|
- path: /etc/kernel/postinst.d/zz-update-boot
|
|
generator: copy
|
|
source: /tmp/build-staging/zz-update-boot
|
|
mode: "0755"
|
|
|
|
- path: /etc/fstab
|
|
generator: copy
|
|
source: /tmp/build-staging/fstab
|
|
|
|
- path: /etc/apt/trusted.gpg.d/kali-archive-keyring.asc
|
|
generator: copy
|
|
source: /tmp/build-staging/kali-archive-keyring.asc
|
|
|
|
- path: /usr/local/sbin/grow-rootfs
|
|
generator: copy
|
|
source: /tmp/build-staging/grow-rootfs
|
|
mode: "0755"
|
|
|
|
- path: /etc/systemd/system/grow-rootfs.service
|
|
generator: copy
|
|
source: /tmp/build-staging/grow-rootfs.service
|
|
|
|
- path: /opt/debs/
|
|
generator: copy
|
|
source: /tmp/build-staging/debs
|
|
|
|
actions:
|
|
- trigger: post-unpack
|
|
action: |-
|
|
#!/bin/bash
|
|
set -eux
|
|
rm -f /var/lib/apt/lists/*InRelease /var/lib/apt/lists/*Release /var/lib/apt/lists/*Packages* || true
|
|
echo 'Acquire::Retries "10";' > /etc/apt/apt.conf.d/80retry
|
|
cat > /etc/apt/trusted.gpg.d/kali-archive-keyring.asc <<'EOF'
|
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
|
|
|
mQINBGgBJJUBEADlMTZVDCjrSXIAuYfL3VZt8OoplUdw3mSPlhIjZQmIo2sdzvAF
|
|
EMSCQ+vWeD4VqV9tBtiVx6j8VSfyW18YHHAkvajWDRg5hPLf80wGxrtXYu+vj3Ri
|
|
5dOMhrl9fHKIifPOoV3pFTtOk0dB9lkcmtNzjWgwOJduLbjjraE1BBKqc0uaXDCa
|
|
RJnPYkQuJQcZxmZVFAo9NP7KSAL1zMvutAd0R3WeMaWpT22nGa3rJj4kj25zV6Kn
|
|
qGnv5kQaY2cTlQHnp6EbiLe5sCE7zIOp5CjwIJhyCyn4zT8KqGB8Sw8PEi9mYlSY
|
|
wbGzzfAAbBk7Y8xbmvRrkrHzU74jH0iMK566QVu2yl3Dz0hrlliV6vGn2ZWu7qmh
|
|
lwXSb+q4u46tDbFjdUjYJG2upx5vOm5SewD9snLB4YN2e2qDeQgY16AfpkJa51+u
|
|
PwTeDCbfuQu3irLWcGRZgpOBgsxqCtpZBmF6ED7L8tntoyjZ9WeB8FnTcv7hx5J1
|
|
IPCO4K5TvW0SX6ZKp1Jusbkn5hrrFTjOJHhIDVdioM/wYDKkqJ9e25oGAqPkJYRY
|
|
euonU1teK+EOLM7ZIbalhukrw0bgYl9UJRxQMLEhZzoiiCLLiv3oWHAQGFclP+1E
|
|
zXgbLBviFAU4+DMXfhA6vy8BmS9oTpleS1p3/EOwf2rX/yt4qF7IW9ZXuQARAQAB
|
|
tEBLYWxpIExpbnV4IEFyY2hpdmUgQXV0b21hdGljIFNpZ25pbmcgS2V5ICgyMDI1
|
|
KSA8ZGV2ZWxAa2FsaS5vcmc+iQJUBBMBCgA+FiEEgnyFafJRjMZ3/soa7WVGLsjV
|
|
5MUFAmgF7tkCGwMFCQWkfeUFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ7WVG
|
|
LsjV5MXcjw//XeI6OXY7VcH+hXRcT7W49AwqRfmSaSEWs474G2DQR9UppzvkFCab
|
|
uiWl5jrlkeGbVFsiBruJfIlCdYMMnPk8gEm/SEhVRqcZVOjYCWcMlSVB6oU+6tgW
|
|
jKPPRDELiq7mTl8S4sEdvUxpsWoMqEQZ1+CsJsw+p+TARGNIrUUdL9hTOoOUpvue
|
|
nKNEEfzbKvLk2gj2tKOgr1HcDmVbbmRsL87+UYq1JvA0OzJ0KrhBdTZHJWchAJwa
|
|
p+UUog2XrzvXYXWBPfQLsNVkFirmVd1B5vonj3OeNlVU51YriRQ4P4onLrwlfha8
|
|
vUGeNJw/ihXTQFpvmF7fFSRa7Pr5YfWkDZ4BGuEB+kSycu2PMWCXXHdY++cMIlRf
|
|
uUg/wvzcwAkS99DJ0EAiOun0oypE5+r5HwfaI9IrJlgZMPlFctyBIGVg2DFZCdLH
|
|
VHG1Voq/CU2tgWvWyuHXHVlUiZiWJoj7BbVa88Gj+VyvB/md1xBh0ScmfH4uGgnX
|
|
hpLFPIVuR1SJYarovVmtFhAjbqbrAA4Q9utpOeOOVDMD5tuq856/lLh+SWPkRsUy
|
|
ZJTwz1Nh0rJ/UJOMSo4ljkkr53iR/IM4woAAaP+0hkZoIDSbVVW5Im1Yj461exl4
|
|
0ltMBMym2KZk/IFOTloSfW7hMmGlqaLfQEH1ryHefIIpkgKJa6WgVxA=
|
|
=f+tz
|
|
-----END PGP PUBLIC KEY BLOCK-----
|
|
EOF
|
|
apt-get update
|
|
|
|
- trigger: post-update
|
|
action: |-
|
|
#!/bin/bash
|
|
set -eux
|
|
passwd -l root
|
|
|
|
- trigger: post-packages
|
|
action: |-
|
|
#!/bin/bash
|
|
set -eux
|
|
|
|
# Default user (kali/kali)
|
|
useradd -m -G sudo -s /bin/bash kali
|
|
echo "kali:kali" | chpasswd
|
|
|
|
# The image is assembled inside Docker, where the generated hostname is
|
|
# otherwise the temporary container ID. Use a stable PS5 hostname.
|
|
printf 'ps5\n' > /etc/hostname
|
|
if grep -q '^127\.0\.1\.1' /etc/hosts; then
|
|
sed -i 's/^127\.0\.1\.1.*/127.0.1.1 ps5/' /etc/hosts
|
|
else
|
|
printf '127.0.1.1 ps5\n' >> /etc/hosts
|
|
fi
|
|
|
|
# Ghidra 12.1 requires JDK 21, while Kali Rolling may select a newer Java
|
|
# as the system default. Keep its desktop launcher on the supported JDK.
|
|
test -x /usr/lib/jvm/java-21-openjdk-amd64/bin/java
|
|
sed -i 's|^JAVA_HOME_OVERRIDE=.*|JAVA_HOME_OVERRIDE=/usr/lib/jvm/java-21-openjdk-amd64|' /usr/share/ghidra/support/launch.properties
|
|
|
|
# LightDM autologin into XFCE
|
|
mkdir -p /etc/lightdm/lightdm.conf.d
|
|
cat > /etc/lightdm/lightdm.conf.d/50-ps5-autologin.conf <<'EOF'
|
|
[Seat:*]
|
|
autologin-user=kali
|
|
autologin-user-timeout=0
|
|
user-session=xfce
|
|
EOF
|
|
|
|
# SSH is installed for opt-in remote access. Keep it disabled while the
|
|
# distributed image still has public default local credentials.
|
|
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
|
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
|
|
|
|
systemctl set-default graphical.target
|
|
systemctl disable ssh.service || true
|
|
systemctl disable ssh.socket || true
|
|
systemctl enable NetworkManager
|
|
systemctl enable lightdm
|
|
|
|
# PS5 systems may boot without a useful hardware clock. Keep the shared
|
|
# image timezone-neutral and synchronize after a network connection exists.
|
|
ln -sf /usr/share/zoneinfo/Etc/UTC /etc/localtime
|
|
printf 'Etc/UTC\n' > /etc/timezone
|
|
# Android USB tethering may provide IPv4 only. The default pool returned
|
|
# one unreachable IPv4 peer in PS5 testing; these independent IPv4 peers
|
|
# responded and preserve multi-source time validation.
|
|
sed -i '/^pool [0-3]\.debian\.pool\.ntp\.org /s/^/# PS5 replaced: /' /etc/ntpsec/ntp.conf
|
|
cat >> /etc/ntpsec/ntp.conf <<'EOF'
|
|
|
|
# PS5 USB-tether-friendly IPv4 time sources
|
|
server -4 time.cloudflare.com iburst
|
|
server -4 time.google.com iburst
|
|
server -4 time.apple.com iburst
|
|
server -4 time.windows.com iburst
|
|
EOF
|
|
systemctl enable ntpsec.service
|
|
|
|
# zram swap: half of RAM, zstd compressed
|
|
printf '[zram0]\nzram-size = ram / 2\ncompression-algorithm = zstd\n' > /etc/systemd/zram-generator.conf
|
|
|
|
# Avoid PS5 display sleep/blanking during first boot demos.
|
|
install -d -m 0755 /home/kali/.config/autostart
|
|
cat > /home/kali/.config/autostart/ps5-display.desktop <<'EOF'
|
|
[Desktop Entry]
|
|
Type=Application
|
|
Name=PS5 Display Defaults
|
|
Exec=sh -c 'xset s off -dpms; xset s noblank'
|
|
X-GNOME-Autostart-enabled=true
|
|
EOF
|
|
chown -R kali:kali /home/kali
|
|
|
|
- trigger: post-files
|
|
action: |-
|
|
#!/bin/bash
|
|
set -eux
|
|
systemctl enable grow-rootfs.service
|
|
mkdir -p /boot/efi
|
|
|
|
# This USB image uses zram, not a disk-backed hibernation device. Avoid
|
|
# embedding a temporary build-container device as a resume target.
|
|
mkdir -p /etc/initramfs-tools/conf.d
|
|
printf 'RESUME=none\n' > /etc/initramfs-tools/conf.d/resume
|
|
|
|
dpkg -i /opt/debs/*.deb
|
|
rm -rf /opt/debs
|
|
# kali-linux-everything installs a generic Kali kernel. Keep updates from
|
|
# replacing the PS5-patched kernel used by the loader.
|
|
dpkg-query -W -f='${binary:Package} ${db:Status-Status}\n' 'linux-image-*' 2>/dev/null \
|
|
| awk '$2 == "installed" { print $1 }' \
|
|
| xargs -r apt-mark hold
|
|
apt-mark hold linux-ps5 || true
|
|
|
|
KVER=$(ls -1t /lib/modules | head -1)
|
|
depmod -a "$KVER"
|
|
|
|
# PS5 internal WiFi uses the Marvell/NXP IW620 at PCI ID 1b4b:2b56. Build
|
|
# the PS5-patched NXP mwifiex module for the installed PS5 kernel. Firmware
|
|
# is console-provided by ps5-linux-loader on the boot partition, so a boot
|
|
# service copies it into /lib/firmware before loading the module.
|
|
IW620_SRC=/tmp/ps5-iw620-mwifiex
|
|
IW620_PATCHES=/tmp/ps5-linux-mwifiex
|
|
IW620_NXP_REF=a5fe4e194bf99315e349d81d77d6dfacec70757a
|
|
IW620_PATCH_REF=5cfd063449f27e2f8a7d17c814a3bb21c27aa903
|
|
rm -rf "$IW620_SRC" "$IW620_PATCHES"
|
|
git clone https://github.com/nxp-imx/mwifiex.git "$IW620_SRC"
|
|
git -C "$IW620_SRC" checkout "$IW620_NXP_REF"
|
|
git clone https://github.com/ps5-linux/ps5-linux-mwifiex.git "$IW620_PATCHES"
|
|
git -C "$IW620_PATCHES" checkout "$IW620_PATCH_REF"
|
|
git -C "$IW620_SRC" apply "$IW620_PATCHES/ps5-iw620.patch"
|
|
make -C "$IW620_SRC" CONFIG_OBJTOOL= KERNELDIR="/lib/modules/$KVER/build" ARCH=x86 -j"$(nproc)"
|
|
test -f "$IW620_SRC/mlan.ko"
|
|
test -f "$IW620_SRC/moal.ko"
|
|
install -d "/lib/modules/$KVER/extra/ps5-iw620"
|
|
install -m 0644 "$IW620_SRC/mlan.ko" "/lib/modules/$KVER/extra/ps5-iw620/mlan.ko"
|
|
install -m 0644 "$IW620_SRC/moal.ko" "/lib/modules/$KVER/extra/ps5-iw620/moal.ko"
|
|
install -d /etc/modprobe.d /usr/local/sbin /etc/systemd/system /usr/share/doc/ps5-iw620
|
|
cat > /etc/modprobe.d/ps5-iw620.conf <<'EOF'
|
|
# PS5 IW620 mwifiex
|
|
# Prevent udev from auto-loading moal before the loader-provided firmware is
|
|
# copied from the boot partition. ps5-iw620.service loads it explicitly.
|
|
blacklist moal
|
|
blacklist mlan
|
|
softdep moal pre: cfg80211 mlan
|
|
options moal fw_name=nxp/pcieuartiw620_combo_v1.bin pcie_int_mode=1 drv_mode=1 cfg80211_wext=4 sta_name=mlan ext_scan=0 auto_fw_reload=0 wifi_reset_config=0 sched_scan=0 ps_mode=2 auto_ds=2 amsdu_disable=1
|
|
EOF
|
|
cat > /usr/local/sbin/ps5-iw620-load <<'EOF'
|
|
#!/bin/sh
|
|
set -eu
|
|
|
|
FW_NAME=nxp/pcieuartiw620_combo_v1.bin
|
|
FW_DST=/lib/firmware/$FW_NAME
|
|
FW_SRC=
|
|
|
|
for candidate in "/boot/efi/lib/$FW_NAME" "/boot/lib/$FW_NAME" "$FW_DST"; do
|
|
if [ -f "$candidate" ]; then
|
|
FW_SRC="$candidate"
|
|
break
|
|
fi
|
|
done
|
|
|
|
if [ -z "$FW_SRC" ]; then
|
|
FW_SRC="$(find /boot /boot/efi -path "*/$FW_NAME" -type f 2>/dev/null | head -n 1)"
|
|
fi
|
|
|
|
if [ -n "$FW_SRC" ] && [ -f "$FW_SRC" ]; then
|
|
install -D -m 0644 "$FW_SRC" "$FW_DST"
|
|
fi
|
|
|
|
if [ ! -f "$FW_DST" ]; then
|
|
echo "PS5 IW620 firmware not found on the boot partition; skipping WiFi load"
|
|
exit 0
|
|
fi
|
|
|
|
# If udev raced us and loaded the module before firmware was copied, reload
|
|
# it so firmware init can succeed.
|
|
modprobe -r moal mlan 2>/dev/null || true
|
|
modprobe cfg80211 || true
|
|
modprobe moal
|
|
rfkill unblock all 2>/dev/null || true
|
|
nmcli radio wifi on 2>/dev/null || true
|
|
EOF
|
|
chmod 0755 /usr/local/sbin/ps5-iw620-load
|
|
cat > /etc/systemd/system/ps5-iw620.service <<'EOF'
|
|
[Unit]
|
|
Description=Load PS5 IW620 internal WiFi
|
|
RequiresMountsFor=/boot/efi
|
|
Wants=systemd-udev-settle.service
|
|
After=local-fs.target boot-efi.mount systemd-udev-settle.service
|
|
Before=NetworkManager.service network-pre.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/ps5-iw620-load
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
cat > /usr/share/doc/ps5-iw620/BUILDINFO <<EOF
|
|
NXP mwifiex ref: $IW620_NXP_REF
|
|
ps5-linux-mwifiex ref: $IW620_PATCH_REF
|
|
Kernel: $KVER
|
|
Module options: fw_name=nxp/pcieuartiw620_combo_v1.bin pcie_int_mode=1 drv_mode=1 cfg80211_wext=4 sta_name=mlan ext_scan=0 auto_fw_reload=0 wifi_reset_config=0 sched_scan=0 ps_mode=2 auto_ds=2 amsdu_disable=1
|
|
EOF
|
|
depmod -a "$KVER"
|
|
systemctl enable ps5-iw620.service
|
|
rm -rf "$IW620_SRC" "$IW620_PATCHES"
|
|
|
|
grep -qxF amdgpu /etc/initramfs-tools/modules || printf '\namdgpu\n' >> /etc/initramfs-tools/modules
|
|
printf 'MODULES=most\nBUSYBOX=y\n' > /etc/initramfs-tools/conf.d/ps5-amdgpu
|
|
update-initramfs -c -k "$KVER"
|
|
/etc/kernel/postinst.d/zz-update-boot "$KVER"
|
|
|
|
mappings:
|
|
architecture_map: debian
|