image-ddi: Mount persistent storage from internal/rw LVM LV

This opens up for DDI images to ship their own implementation.

.github/CHECKLIST.md

@@ -3,41 +3,39 @@ Checklists for Pull Requests and Releases
 
 Maintainer checklists for reviewing pull requests and doing releases.
 
-
 Pull Requests
 -------------
 
- - If applicable, is there a readable ChangeLog entry?
+- If applicable, is there a readable ChangeLog entry?
- - If any LICENSE file has been updated, has the `.hash` file been updated?
+- If any LICENSE file has been updated, has the `.hash` file been updated?
- - If any change to a Finit `.svc` file, does any run/task linger?  
+- If any change to a Finit `.svc` file, does any run/task linger?  
-   I.e., is there a runlevel and/or condition defined to prevent them
+  I.e., is there a runlevel and/or condition defined to prevent them
-   from running outside of their intended runlevel?
+  from running outside of their intended runlevel?
- - If any change to grub or qemu/qeneth setup, has it been tested in GNS3?
+- If any change to grub or qemu/qeneth setup, has it been tested in GNS3?
-   - If any change to u-boot/buildroot, has it been tested with `<booloader>_defconfig`
+  - If any change to u-boot/buildroot, has it been tested with `<booloader>_defconfig`
- - If any change to logging, have the resulting logs been audited?
+- If any change to logging, have the resulting logs been audited?
-   - Check for duplicate entries, misspellings
+  - Check for duplicate entries, misspellings
-   - Check for sneaky severity changes, e.g., error vs note, error vs warning
+  - Check for sneaky severity changes, e.g., error vs note, error vs warning
- - If new subsystem, or major changes to a subsystem, have the docs been updated?
+- If new subsystem, or major changes to a subsystem, have the docs been updated?
- - If change to mDNS, has it been tested with netbrowse?
+- If change to mDNS, has it been tested with netbrowse?
- - If change to `_defconfig`, verify `local.mk` and sync with other archs
+- If change to `_defconfig`, verify `local.mk` and sync with other archs
-   - Test manually as well, e.g., CLI changes do not have ha regression tests
+  - Test manually as well, e.g., CLI changes do not have ha regression tests
-   - Build from distclean, or use artifacts built by build servers, for manual tests
+  - Build from distclean, or use artifacts built by build servers, for manual tests
-
 
 Releases
 --------
 
 Recommended checkpoints, use at your own discretion:
 
- - Make at least one -betaN release to verify the GitHub workflow well in time release day
+- Make at least one -betaN release to verify the GitHub workflow well in time release day
-   - Stuff happens, remember kernelkit/infix#735
+  - Stuff happens, remember kernelkit/infix#735
- - Make at least one -rcN to flush out any issues in customer repos
+- Make at least one -rcN to flush out any issues in customer repos
-   - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
+  - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
- - Verify release artifacts (checksums, completeness, no corrupted files)
+- Verify release artifacts (checksums, completeness, no corrupted files)
- - Test on actual hardware for at least one architecture
+- Test on actual hardware for at least one architecture
- - Review ChangeLog for completeness
+- Review ChangeLog for completeness
- - Check for release-blocking issues
+- Check for release-blocking issues
- - Verify generated GNS3 appliance, no marketplace update on -rc builds
+- Verify generated GNS3 appliance, no marketplace update on -rc builds
- - Ensure the markdown link for the release diff is updated
+- Ensure the markdown link for the release diff is updated
- - Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
+- Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
- - Sync tags for all repo. sync activities
+- Sync tags for all repo. sync activities

.github/CONTRIBUTING.md

@@ -9,15 +9,15 @@ forms of collaboration as well.  [Let's talk!][support] :handshake:
 
 If you are unsure how to start implementing an idea or fix:
 
- - :bug: open an issue, there are human friendly templates for _bugs_
+- :bug: open an issue, there are human friendly templates for _bugs_
-   and _feature requests_ at <https://github.com/kernelkit/infix/issues>
+  and _feature requests_ at <https://github.com/kernelkit/infix/issues>
- - :speech_balloon: use the [Q&A Forum][discuss]
+- :speech_balloon: use the [Q&A Forum][discuss]
- - :technologist: The [Developer's Guide][devguide] is also a useful start
+- :technologist: The [Developer's Guide][devguide] is also a useful start
 
-> _Talking about code and problems first is often the best way to get
+> [!IMPORTANT]
+> Talking about code and problems first is often the best way to get
 > started before submitting a pull request.  We have found it always
-> saves time, yours and ours._
+> saves time, yours and ours.
-
 
 :sparkles: General Guidelines
 -----------------------------
@@ -27,21 +27,20 @@ version the change is made against, what it does, and, more importantly
 *why* -- from your perspective, why is it a bug, why does the code need
 changing in this way.  Start with why.
 
- - :bug: Bug reports need metadata like Infix version or commit hash
+- :bug: Bug reports need metadata like Infix version or commit hash
- - :adhesive_bandage: Bug fixes also need version, and (preferably) a
+- :adhesive_bandage: Bug fixes also need version, and (preferably) a
-   corresponding issue number for the ChangeLog
+  corresponding issue number for the ChangeLog
- - :new: New features, you need to get approval of the YANG model first!  
+- :new: New features, you need to get approval of the YANG model first!  
-   :speech_balloon: Please use the [Forum][discuss], e.g., category:
+  :speech_balloon: Please use the [Forum][discuss], e.g., category:
-   *Ideas*, or open a :pray: feature request issue
+  *Ideas*, or open a :pray: feature request issue
- - :white_check_mark: New features also need new regression tests, this
+- :white_check_mark: New features also need new regression tests, this
-   can be basic tests or more complex use-case tests comprising multiple
+  can be basic tests or more complex use-case tests comprising multiple
-   subsystems, see [Testing Changes](#test_tube-testing-changes), below
+  subsystems, see [Testing Changes](#test_tube-testing-changes), below
 
 Please take care to ensure you follow the project coding style and the
 commit message format.  If you follow these recommendations you help
 the maintainers and make it easier for them to include your code.
 
-
 :woman_technologist: Coding Style
 ---------------------------------
 
@@ -51,39 +50,40 @@ and it is expected that you provide a human-readable summary for the
 release notes (ChangeLog) and at least a configuration example in the
 manual for new features.
 
-> **Tip:** consider ["Readme driven development"][RDD] for new features.
+> [!TIP]
-> It is amazing how many flaws in your own bright ideas come to bare
+> Consider ["Readme driven development"][RDD] for new features.  It is
-> when you suddenly have to explain them to someone else!
+> amazing how many flaws in your own bright ideas come to bare when you
+> suddenly have to explain them to someone else!
 
 We expect code contributions for:
 
- - C code in [Linux Coding Style][Linux]
+- C code in [Linux Coding Style][Linux]
- - Python code should follow [PEP-8][]
+- Python code should follow [PEP-8][]
 
+> [!IMPORTANT]
 > **However,** always submit code that follows the style of surrounding
 > code!  Legacy takes precedence, and remember, we read code a lot more
 > than write it, so legibility is important.
 
 The ChangeLog deserves a separate mention:
 
- - Releases are listed in reverse chronological order order, so the
+- Releases are listed in reverse chronological order order, so the
-   latest/next release is at the beginning of the file
+  latest/next release is at the beginning of the file
- - Only *user-facing bugs and features* are detailed, so code refactor,
+- Only *user-facing bugs and features* are detailed, so code refactor,
-   new tests, etc. are not listed.
+  new tests, etc. are not listed.
- - Add your changes/features to the Changes section
+- Add your changes/features to the Changes section
- - Add your Fix line in the Fixes section, in numeric order 
+- Add your Fix line in the Fixes section, in numeric order
- - Changes and fixes without an issue number are listed after all
+- Changes and fixes without an issue number are listed after all
-   numbered ones
+  numbered ones
- - YANG model changes are documented in their respective model, for
+- YANG model changes are documented in their respective model, for
-   standard models, e.g., for `ietf-interfaces.yang`, the corresponding
+  standard models, e.g., for `ietf-interfaces.yang`, the corresponding
-   `infix-interfaces.yang` detail augments/deviations as revisions.
+  `infix-interfaces.yang` detail augments/deviations as revisions.
 
 A final note, lines of code are allowed to be longer than 72 characters
 these days, unless you live by PEP-8 (see above).  There is no enforced
 maximum, but the team usually keep it around 100 characters for both C
 and Python.
 
-
 :test_tube: Testing Changes
 ---------------------------
 
@@ -97,9 +97,8 @@ the same pull request.
 
 For help getting started with testing, see the following resources:
 
- - [Developer's Guide][devguide]
+- [Developer's Guide][devguide]
- - [Regression Testing][testing]
+- [Regression Testing][testing]
-
 
 :memo: Commit Messages
 ----------------------
@@ -110,45 +109,135 @@ proud of your work and set up a proper GIT identity for your commits:
 
 <img src="../doc/jack.png" width=70 align="right">
 
-    $ git config --global user.name "Jacky Linker"
+```bash
-    $ git config --global user.email jacky.linker@example.com
+$ git config --global user.name "Jacky Linker"
+$ git config --global user.email jacky.linker@example.com
+```
 
 Example commit message from one of many [online guides][cbeams].  Use
 `git commit -s` to automatically add a `Signed-off-by` for proof of
 origin, see [DCO][] for more info.
 
-    subsystem: brief, but clear and concise summary of changes
+```text
-    
+subsystem: brief, but clear and concise summary of changes
-    More detailed explanatory text, if necessary.  Wrap it to about 72
-    characters or so.  In some contexts, the first line is treated as
-    the subject of an email and the rest of the text as the body.  The
-    empty line separating summary from body is critical.  Tools like
-    rebase can get confused if the empty line is missing.
-    
-    Further paragraphs should be separated with empty lines.
-    
-     - Bullet points are okay, too
-    
-     - Typically a hyphen or asterisk is used for the bullet, preceded
-       by a single space, with blank lines in between, but conventions
-       vary here
 
-	If you use an issue tracker, put references to them at the bottom,
+More detailed explanatory text, if necessary.  Wrap it to about 72
-	like this:
+characters or so.  In some contexts, the first line is treated as
+the subject of an email and the rest of the text as the body.  The
+empty line separating summary from body is critical.  Tools like
+rebase can get confused if the empty line is missing.
 
-	Resolves: #123
+Further paragraphs should be separated with empty lines.
-	See also: #456, #789
 
-    Signed-off-by: Jacky Linker <jacky.linker@example.com>
+ - Bullet points are okay, too
+
+ - Typically a hyphen or asterisk is used for the bullet, preceded
+   by a single space, with blank lines in between, but conventions
+   vary here
+
+If you use an issue tracker, put references to them at the bottom,
+like this:
+
+Resolves: #123
+See also: #456, #789
+
+Signed-off-by: Jacky Linker <jacky.linker@example.com>
+```
 
 This is an example of how to [automatically close][closing] an issue
 when the commit is merged to mainline.  Several keywords are available.
 
+:lock_with_ink_pen: Signing Commits with GPG
+---------------------------------------------
+
+To ensure the authenticity and integrity of your contributions, we
+**require** all commits to be signed with GPG.  This cryptographically
+verifies that commits come from a trusted source.
+
+### Generating a GPG Key
+
+If you don't already have a GPG key, generate one:
+
+```bash
+$ gpg --full-generate-key
+```
+
+When prompted, choose:
+- Key type: `RSA and RSA` (default)
+- Key size: `4096` bits (recommended for security)
+- Expiration: `0` (key does not expire)
+- Real name and email: Use the same email as your Git configuration
+
+> [!NOTE]
+> We recommend keys that do not expire for signing commits.  Expiration
+> creates a "usability time bomb" without providing meaningful security
+> benefits for code signing.  See [this article][pgpfan] for details.
+
+### Configuring Git to Sign Commits
+
+First, find your GPG key ID:
+
+```bash
+$ gpg --list-secret-keys --keyid-format=long
+```
+
+Look for the line starting with `sec`, the key ID is the part after the `/`.
+For example, in `sec   rsa4096/ABCD1234EFGH5678`, the key ID is `ABCD1234EFGH5678`.
+
+Configure Git to use your GPG key:
+
+```bash
+$ git config --global user.signingkey ABCD1234EFGH5678
+$ git config --global commit.gpgsign true
+```
+
+The second command enables automatic signing for all commits.  Alternatively,
+you can sign individual commits with `git commit -S`.
+
+### Publishing Your Public Key
+
+To allow others to verify your signatures, publish your public key to a
+keyserver:
+
+```bash
+$ gpg --keyserver hkps://keys.openpgp.org --send-keys ABCD1234EFGH5678
+```
+
+> [!IMPORTANT]
+> The keyserver will send a verification email to the address associated
+> with your key.  You **must** click the link in that email to confirm
+> ownership before your key becomes searchable by email address.
+
+Alternative keyservers you can use:
+- `hkps://keyserver.ubuntu.com`
+- `hkps://pgp.mit.edu`
+
+### Adding Your GPG Key to GitHub
+
+For GitHub to show your commits as "Verified", you need to add your public
+key to your account:
+
+1. Export your public key:
+   ```bash
+   $ gpg --armor --export ABCD1234EFGH5678
+   ```
+
+2. Copy the entire output, including the `-----BEGIN PGP PUBLIC KEY BLOCK-----`
+   and `-----END PGP PUBLIC KEY BLOCK-----` lines.
+
+3. Go to [GitHub Settings → SSH and GPG keys](https://github.com/settings/keys)
+
+4. Click **New GPG key** and paste your public key.
+
+Now your signed commits will display a "Verified" badge on GitHub! :white_check_mark:
+
+For more details, see GitHub's [official documentation on commit signature verification][gpg-verify].
 
 :twisted_rightwards_arrows: Pull Requests
 -----------------------------------------
 
-> _The git repository is the canonical location for information._
+> [!NOTE]
+> _The git repository is the canonical location for all information._
 
 A pull request should preferably address a single issue or change.  This
 may of course include multiple related changes, but what is important to
@@ -167,7 +256,6 @@ Buildroot, consider the pull request message body similar to the cover
 letter for a series of patches -- it's a summary of changes, and it is
 lost when the changes are merged to the mainline branch.
 
-
 :balance_scale: Code of Conduct
 -------------------------------
 
@@ -184,6 +272,8 @@ other contributions that are not aligned to this Code of Conduct."*
 [PEP-8]:    https://peps.python.org/pep-0008/
 [RDD]:      https://tom.preston-werner.com/2010/08/23/readme-driven-development
 [cbeams]:   https://cbea.ms/git-commit/#seven-rules
-[conduct]:  CODE-OF-CONDUCT.md
+[conduct]:    CODE-OF-CONDUCT.md
-[DCO]:      https://developercertificate.org/
+[DCO]:        https://developercertificate.org/
-[closing]:  https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
+[closing]:    https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
+[gpg-verify]: https://docs.github.com/en/authentication/managing-commit-signature-verification
+[pgpfan]:     https://articles.59.ca/doku.php?id=pgpfan:expire

.github/actions/cache-restore/action.yml

@@ -0,0 +1,41 @@
+name: 'Restore Build Caches'
+description: 'Restore dl/ and .ccache/ caches for Buildroot builds'
+inputs:
+  target:
+    description: 'Build target for cache key differentiation'
+    required: true
+  dl-prefix:
+    description: 'Prefix for dl/ cache key (e.g., "dl", "dl-boot")'
+    required: false
+    default: 'dl'
+  ccache-prefix:
+    description: 'Prefix for .ccache/ cache key (e.g., "ccache", "ccache-boot")'
+    required: false
+    default: 'ccache'
+  enabled:
+    description: 'Set to false to skip cache restoration'
+    required: false
+    default: 'true'
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore Cache of dl/
+      if: ${{ inputs.enabled == 'true' }}
+      uses: actions/cache@v4
+      with:
+        path: dl/
+        key: ${{ inputs.dl-prefix }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+        restore-keys: |
+          ${{ inputs.dl-prefix }}-
+          dl-
+
+    - name: Restore Cache of .ccache/
+      if: ${{ inputs.enabled == 'true' }}
+      uses: actions/cache@v4
+      with:
+        path: .ccache/
+        key: ${{ inputs.ccache-prefix }}-${{ inputs.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+        restore-keys: |
+          ${{ inputs.ccache-prefix }}-${{ inputs.target }}-
+          ${{ inputs.ccache-prefix }}-
+          ccache-

.github/actions/podman-cleanup/action.yml

@@ -0,0 +1,15 @@
+name: 'Podman Cleanup'
+description: 'Clean up stale podman state from previous runs'
+runs:
+  using: 'composite'
+  steps:
+    - name: Cleanup podman state
+      shell: bash
+      run: |
+        set -x
+        podman ps -a              || true
+        podman stop -a            || true
+        podman rm -a -f           || true
+        podman volume prune -f    || true
+        podman system prune -a -f || true
+        podman system migrate     || true

.github/workflows/build-boot.yml

@@ -17,11 +17,15 @@ jobs:
       matrix:
         defconfig:
           - aarch64_qemu_boot
-          - bpi_r3_boot
+          - bpi_r3_sd_boot
+          - bpi_r3_emmc_boot
           - cn9130_crb_boot
           - fireant_boot
           - nanopi_r2s_boot
+          - rpi2_boot
           - rpi64_boot
+          - sama7g54_ek_emmc_boot
+          - sama7g54_ek_sd_boot
     env:
       MAKEFLAGS: -j5
     steps:
@@ -62,24 +66,11 @@ jobs:
 
           echo "Building ${defconfig}_defconfig, version ${version}-${rev}, artifact ${archive} ..."
 
-      - name: Restore Cache of dl/
+      - uses: ./.github/actions/cache-restore
-        uses: actions/cache@v4
         with:
-          path: dl/
+          target: ${{ matrix.defconfig }}
-          key: dl-boot-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          dl-prefix: dl-boot
-          restore-keys: |
+          ccache-prefix: ccache-boot
-            dl-boot-
-            dl-
-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-boot-${{ matrix.defconfig }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-boot-${{ matrix.defconfig }}-
-            ccache-boot-
-            ccache-
 
       - name: Configure ${{ matrix.defconfig }}_defconfig
         run: |

.github/workflows/build-image.yml

@@ -1,4 +1,4 @@
-name: Create SD Card Images
+name: Create SD Card & eMMC Images
 
 on:
   workflow_dispatch:
@@ -8,14 +8,12 @@ on:
         type: choice
         required: true
         options:
+          - raspberrypi-rpi2
           - raspberrypi-rpi64
           - bananapi-bpi-r3
           - friendlyarm-nanopi-r2s
+          - microchip-sama7g54-ek
         default: 'raspberrypi-rpi64'
-      use_latest_release:
-        description: 'Use latest release artifacts instead of workflow artifacts'
-        type: boolean
-        default: false
 
 jobs:
   create-image:
@@ -53,136 +51,230 @@ jobs:
       - name: Set bootloader and target based on board
         run: |
           case "${{ inputs.board }}" in
+            raspberrypi-rpi2)
+              echo "BOOTLOADER=rpi2-boot" >> $GITHUB_ENV
+              echo "ARCH=arm" >> $GITHUB_ENV
+              echo "BUILD_EMMC=false" >> $GITHUB_ENV
+              ;;
             raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
             bananapi-bpi-r3)
-              echo "BOOTLOADER=bpi_r3_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_SD=bpi-r3-sd-boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi-r3-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
               ;;
             friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=false" >> $GITHUB_ENV
+              ;;
+            microchip-sama7g54-ek)
+              echo "BOOTLOADER_SD=sama7g54-ek-sd-boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=sama7g54-ek-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=arm" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
               ;;
             *)
               echo "Error: Unknown board ${{ inputs.board }}"
               exit 1
               ;;
           esac
-          echo "Using bootloader: $BOOTLOADER and target: $TARGET for board: ${{ inputs.board }}"
+          echo "Arch: $ARCH for board: ${{ inputs.board }}"
+          if [ "$BUILD_EMMC" = "true" ]; then
+            echo "Building both SD and eMMC images"
+            echo "SD Bootloader: $BOOTLOADER_SD"
+            echo "eMMC Bootloader: $BOOTLOADER_EMMC"
+          else
+            echo "Building SD image only"
+            echo "Bootloader: $BOOTLOADER"
+          fi
 
       - name: Download bootloader artifacts
-        if: ${{ !inputs.use_latest_release }}
         run: |
-          # Download from latest bootloader build workflow on main branch
+          # Download bootloader from latest-boot release tag
-          gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
+          if [ "$BUILD_EMMC" = "true" ]; then
-          BOOT_RUN_ID=$(cat latest_boot_run_id)
+            # Download both SD and eMMC bootloaders for boards that support both
+            echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
+            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            mkdir -p output_sd/images
+            cd temp_bootloader_sd/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            cd ../
+            rm -rf temp_bootloader_sd/
 
-          gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
+            echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
+            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            mkdir -p output_emmc/images
+            cd temp_bootloader_emmc/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_bootloader_emmc/
 
-          # Extract bootloader directly to output/images
+            echo "SD bootloader files:"
-          cd temp_bootloader/
+            ls -la output_sd/images/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            echo "eMMC bootloader files:"
-          cd ../
+            ls -la output_emmc/images/
-          rm -rf temp_bootloader/
+          else
+            # Single bootloader for boards that only support SD
+            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
 
-          echo "Bootloader files extracted to output/images:"
+            # Extract bootloader directly to output/images
-          ls -la output/images/
+            cd temp_bootloader/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_bootloader/
+
+            echo "Bootloader files extracted to output/images:"
+            ls -la output/images/
+          fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download Infix artifacts
-        if: ${{ !inputs.use_latest_release }}
         run: |
           # Download from latest Kernelkit Trigger workflow for main branch
           gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
           INFIX_RUN_ID=$(cat latest_infix_run_id)
 
-          gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Copy Infix artifacts to both SD and eMMC output directories
+            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
 
-          # Extract Infix directly to output/images
+            cd temp_infix/
-          cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-          cd ../
+            cd ../
-          rm -rf temp_infix/
+            rm -rf temp_infix/
 
-          echo "Infix files extracted to output/images:"
+            echo "Infix files extracted to output_sd/images:"
-          ls -la output/images/
+            ls -la output_sd/images/
-        env:
+            echo "Infix files extracted to output_emmc/images:"
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+            ls -la output_emmc/images/
+          else
+            # Single output directory for SD-only boards
+            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
 
-      - name: Download from latest releases
+            # Extract Infix directly to output/images
-        if: ${{ inputs.use_latest_release }}
+            cd temp_infix/
-        run: |
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          # Download latest bootloader release
+            cd ../
-          gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            rm -rf temp_infix/
-          cd temp_bootloader/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_bootloader/
 
-          # Download latest Infix release
+            echo "Infix files extracted to output/images:"
-          gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            ls -la output/images/
-          cd temp_infix/
+          fi
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_infix/
-
-          echo "All files extracted to output/images:"
-          ls -la output/images/
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Verify extracted files
         run: |
-          echo "Files available for mkimage.sh:"
+          if [ "$BUILD_EMMC" = "true" ]; then
-          ls -la output/images/
+            echo "Files available for SD image:"
-          echo ""
+            ls -la output_sd/images/
-          echo "File types:"
+            echo ""
-          file output/images/* || true
+            echo "Files available for eMMC image:"
+            ls -la output_emmc/images/
+          else
+            echo "Files available for mkimage.sh:"
+            ls -la output/images/
+            echo ""
+            echo "File types:"
+            file output/images/* || true
+          fi
 
       - name: Create SD card image
         run: |
-          export BINARIES_DIR=$PWD/output/images
+          if [ "$BUILD_EMMC" = "true" ]; then
+            export BINARIES_DIR=$PWD/output_sd/images
+            export BUILD_DIR=$PWD/build
+            export BR2_EXTERNAL_INFIX_PATH=$PWD
+            export RELEASE=""
+            export INFIX_ID="infix"
+            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
+          else
+            export BINARIES_DIR=$PWD/output/images
+            export BUILD_DIR=$PWD/build
+            export BR2_EXTERNAL_INFIX_PATH=$PWD
+            export RELEASE=""
+            export INFIX_ID="infix"
+            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
+          fi
+
+      - name: Create eMMC image
+        if: ${{ env.BUILD_EMMC == 'true' }}
+        run: |
+          export BINARIES_DIR=$PWD/output_emmc/images
           export BUILD_DIR=$PWD/build
           export BR2_EXTERNAL_INFIX_PATH=$PWD
           export RELEASE=""
           export INFIX_ID="infix"
-          ./utils/mkimage.sh ${{ inputs.board }}
+          ./utils/mkimage.sh -t emmc ${{ inputs.board }}
 
-      - name: Verify created image
+      - name: Verify created images
         run: |
-          echo "Contents of output/images after mkimage.sh:"
+          if [ "$BUILD_EMMC" = "true" ]; then
-          ls -lh output/images/
+            echo "SD card image:"
+            ls -lh output_sd/images/*-sdcard.img* 2>/dev/null || true
+            if ls output_sd/images/*-sdcard.img 1> /dev/null 2>&1; then
+              for img in output_sd/images/*-sdcard.img; do
+                echo "- $(basename $img)"
+                file "$img"
+                fdisk -l "$img" 2>/dev/null | head -20
+              done
+            fi
 
-          # Look for SD card image with pattern: *-sdcard.img
+            echo ""
-          if ls output/images/*-sdcard.img 1> /dev/null 2>&1; then
+            echo "eMMC image:"
-            echo "Found SD card image(s):"
+            ls -lh output_emmc/images/*-emmc.img* 2>/dev/null || true
-            for img in output/images/*-sdcard.img; do
+            if ls output_emmc/images/*-emmc.img 1> /dev/null 2>&1; then
-              echo "- $(basename $img)"
+              for img in output_emmc/images/*-emmc.img; do
-              file "$img"
+                echo "- $(basename $img)"
-              fdisk -l "$img" 2>/dev/null || true
+                file "$img"
-            done
+                fdisk -l "$img" 2>/dev/null | head -20
+              done
+            fi
+
+            # Copy both images to output/images for artifact upload
+            mkdir -p output/images
+            cp output_sd/images/*-sdcard.img* output/images/ 2>/dev/null || true
+            cp output_emmc/images/*-emmc.img* output/images/ 2>/dev/null || true
           else
-            echo "No SD card image found matching pattern: *-sdcard.img"
+            echo "Contents of output/images after mkimage.sh:"
-            echo "Available files:"
+            ls -lh output/images/
-            ls -la output/images/
+
-            exit 1
+            # Look for SD card image with pattern: *-sdcard.img
+            if ls output/images/*-sdcard.img 1> /dev/null 2>&1; then
+              echo "Found SD card image(s):"
+              for img in output/images/*-sdcard.img; do
+                echo "- $(basename $img)"
+                file "$img"
+                fdisk -l "$img" 2>/dev/null || true
+              done
+            else
+              echo "No SD card image found matching pattern: *-sdcard.img"
+              echo "Available files:"
+              ls -la output/images/
+              exit 1
+            fi
           fi
 
-      - name: Upload SD card image
+      - name: Upload images as artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: sdcard-image-${{ inputs.board }}-${{ env.BOOTLOADER }}
+          name: images-${{ inputs.board }}
           path: |
             output/images/*-sdcard.img*
+            output/images/*-emmc.img*
           retention-days: 30
 
       - name: Create checksums
         run: |
           cd output/images/
-          for file in *-sdcard.img; do
+          for file in *-sdcard.img *-emmc.img; do
             if [ -f "$file" ]; then
               sha256sum "$file" > "$file.sha256"
             fi
@@ -198,21 +290,41 @@ jobs:
           prerelease: true
           tag: "latest-boot"
           token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "output/images/*-sdcard.img*"
+          artifacts: "output/images/*-sdcard.img*,output/images/*-emmc.img*"
 
       - name: Generate summary
         run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          if [ "$BUILD_EMMC" = "true" ]; then
+            cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # SD Card & eMMC Image Build Complete! 🚀
+
+          **Board:** ${{ inputs.board }}
+          **Arch:** ${{ env.ARCH }}
+          **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
+          **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
+          **Bootloader Source:** latest-boot release
+          **Infix Source:** Latest workflow run on main
+
+          ## Created Images
+          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
+
+          ## Download
+          Both SD card and eMMC images are available as workflow artifacts above and in the latest-boot release.
+          EOF
+          else
+            cat <<EOF >> $GITHUB_STEP_SUMMARY
           # SD Card Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
-          **Target:** ${{ env.TARGET }}
+          **Arch:** ${{ env.ARCH }}
           **Bootloader:** ${{ env.BOOTLOADER }}
-          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
+          **Bootloader Source:** latest-boot release
+          **Infix Source:** Latest workflow run on main
 
           ## Created Images
-          $(find output/images/ -name "*.img*" -o -name "*.qcow2" -o -name "*.raw" | xargs ls -lh 2>/dev/null | sed 's/^/- /' || echo "- No images found")
+          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
 
           ## Download
           The SD card image is available as a workflow artifact above.
           EOF
+          fi

.github/workflows/build-release.yml

@@ -1,3 +1,6 @@
+# Needed for make pkg-stats
+# sudo apt install python3-aiohttp
+---
 name: Build Release
 
 on:
@@ -17,24 +20,16 @@ jobs:
     runs-on: [self-hosted, release]
     strategy:
       matrix:
-        target: [aarch64, x86_64]
+        target: [aarch64, arm, x86_64]
       fail-fast: false
     steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
       - uses: actions/checkout@v4
         with:
           clean: true
           submodules: recursive
 
+      - uses: ./.github/actions/podman-cleanup
+
       - name: Set Release Variables
         id: vars
         run: |
@@ -45,24 +40,10 @@ jobs:
           echo "dir=infix-$target"        >> $GITHUB_OUTPUT
           echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
 
-      - name: Restore Cache of dl/
+      - uses: ./.github/actions/cache-restore
-        if: ${{ inputs.use_cache }}
-        uses: actions/cache@v4
         with:
-          path: dl/
+          target: ${{ matrix.target }}
-          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          enabled: ${{ inputs.use_cache }}
-          restore-keys: |
-            dl-
-
-      - name: Restore Cache of .ccache/
-        if: ${{ inputs.use_cache }}
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-${{ matrix.target }}-
-            ccache-
 
       - name: Configure & Build
         env:
@@ -75,7 +56,12 @@ jobs:
 
       - name: Generate SBOM from Build
         run: |
+          # Generate manifest files in CSV format for CycloneDX
           make legal-info
+          # Generate cpe.json for CycloneDX
+          make -s show-info > output/cpe.json
+          # Generate pkg-stats.{json,html} for humans
+          make pkg-stats
 
       - name: Build test specification
         run: |
@@ -84,13 +70,22 @@ jobs:
       - name: Prepare Artifacts
         run: |
           cd output/
+
+          # Collect relevant files for SBOM and CPE info. for more info, see:
+          # https://github.com/CycloneDX/cyclonedx-buildroot
+          mkdir               images/sbom
+          mv pkg-stats.*      images/sbom/
+          mv cpe.json         images/sbom/
+          mv legal-info/*.csv images/sbom/
+
+          # Remove rootfs.squashfs from release (can be extracted from rootfs.itb)
+          # Saves ~131MB per architecture. See issue #858
+          rm -f images/rootfs.squashfs
+
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
           tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
-          mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-
       - uses: actions/upload-artifact@v4
         with:
           name: artifact-${{ matrix.target }}

.github/workflows/build.yml

@@ -19,6 +19,10 @@ on:
         description: 'Repo to checkout (for spin overrides)'
         default: kernelkit/infix
         type: string
+      infix_branch:
+        description: 'Branch/tag/commit to checkout (for spin overrides)'
+        default: ''
+        type: string
 
   workflow_call:
     inputs:
@@ -32,15 +36,30 @@ on:
         required: false
         type: string
         default: kernelkit/infix
+      infix_branch:
+        required: false
+        type: string
+        default: ''
+        description: 'Branch/tag/commit to checkout (for spin overrides). Defaults to github.ref if not specified'
       parallel:
         required: false
         type: boolean
         default: true
+      pre_build_script:
+        required: false
+        type: string
+        default: ''
+        description: 'Optional script to run after checkout (for spin customization)'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'
 
 env:
   NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
   TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
   INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  INFIX_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_branch || inputs.infix_branch }}
 
 jobs:
   build:
@@ -59,24 +78,27 @@ jobs:
           rm -rf ./* || true
           rm -rf ./.??* || true
           ls -la ./
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
 
       - name: Checkout infix repo
         uses: actions/checkout@v4
         with:
           repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
+          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
           clean: true
           fetch-depth: 0
           submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
+
+      - uses: ./.github/actions/podman-cleanup
+
+      - name: Run pre-build script
+        if: ${{ inputs.pre_build_script != '' }}
+        run: |
+          cat > ./pre-build.sh << 'EOF'
+          ${{ inputs.pre_build_script }}
+          EOF
+          chmod +x ./pre-build.sh
+          bash ./pre-build.sh
 
       - name: Set Build Variables
         id: vars
@@ -98,22 +120,9 @@ jobs:
           echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
           echo "Building target ${target}_defconfig"
 
-      - name: Restore Cache of dl/
+      - uses: ./.github/actions/cache-restore
-        uses: actions/cache@v4
         with:
-          path: dl/
+          target: ${{ env.TARGET }}
-          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-
-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-${{ env.TARGET }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-${{ env.TARGET }}-
-            ccache-
 
       - name: Configure ${{ env.TARGET }}
         run: |
@@ -124,10 +133,6 @@ jobs:
           podman rm -af || true
           pkill -9 -f rootlessport || true
 
-      - name: Unit Test ${{ env.TARGET }}
-        run: |
-          make test-unit
-
       - name: Prepare parallel build
         id: parallel
         run: |

.github/workflows/check-kernel-release.yml

@@ -1,10 +1,13 @@
-name: Check Kernel 6.12 Release
+name: Check Kernel 6.18 Release
 
 on:
-  workflow_dispatch: # Allow manual triggering
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
 
 jobs:
   check-kernel:
+    if: github.repository == 'kernelkit/infix'
     runs-on: ubuntu-latest
 
     steps:
@@ -14,20 +17,12 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
 
-      - name: Check out linux repository
+      - name: Fetch kernel.org and check for 6.18 release
-        uses: actions/checkout@v4
-        with:
-          repository: kernelkit/linux
-          path: linux
-          fetch-depth: 0
-          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
-
-      - name: Fetch kernel.org and check for 6.12 release
         id: check
         run: |
           set -e -o pipefail
-          # Fetch the kernel.org frontpage and extract 6.12 version
+          # Fetch the kernel.org frontpage and extract 6.18 version
-          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)
+          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.18\.\d+' | head -n1)
 
           if [ -z "$CURRENT_VERSION" ]; then
             echo "Failed to fetch kernel version"
@@ -35,24 +30,54 @@ jobs:
           fi
 
           echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          echo "Current 6.12 kernel version: $CURRENT_VERSION"
+          echo "Current 6.18 kernel version: $CURRENT_VERSION"
 
-          # Get the latest tag from our linux tree
+          # Get the version from infix defconfig
-          cd linux
+          INFIX_VERSION=$(grep 'BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=' configs/aarch64_defconfig | cut -d'"' -f2)
-          git fetch origin
-          LATEST_TAG=$(git tag -l "v6.12.*" | sort -V | tail -n1 | sed 's/^v//')
-          cd ..
 
-          echo "latest_tag=$LATEST_TAG" >> $GITHUB_OUTPUT
+          echo "infix_version=$INFIX_VERSION" >> $GITHUB_OUTPUT
-          echo "Latest tag in our tree: $LATEST_TAG"
+          echo "Infix kernel version: $INFIX_VERSION"
 
-          if [ "$CURRENT_VERSION" != "$LATEST_TAG" ]; then
+          if [ "$CURRENT_VERSION" != "$INFIX_VERSION" ]; then
-            echo "new_release=true" >> $GITHUB_OUTPUT
+            # Check if there's already an open PR for this version
-            echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (our version: $LATEST_TAG)"
+            PR_EXISTS=$(gh pr list --state open --search "Upgrade to kernel $CURRENT_VERSION in:title" --json number --jq 'length')
+
+            if [ "$PR_EXISTS" -gt 0 ]; then
+              echo "new_release=false" >> $GITHUB_OUTPUT
+              echo "PR already exists for kernel $CURRENT_VERSION, skipping"
+            else
+              echo "new_release=true" >> $GITHUB_OUTPUT
+              echo "🎉 New 6.18 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
+            fi
           else
             echo "new_release=false" >> $GITHUB_OUTPUT
             echo "No change - still at $CURRENT_VERSION"
           fi
+        env:
+          GH_TOKEN: ${{ secrets.KERNEL_UPDATE_TOKEN }}
+
+      - name: Generate branch name
+        if: steps.check.outputs.new_release == 'true'
+        id: branch
+        run: |
+          BRANCH_NAME="kernel-upgrade-$(uuidgen | tr '[:upper:]' '[:lower:]')"
+          echo "name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+          echo "Branch name: $BRANCH_NAME"
+
+      - name: Import GPG key
+        if: steps.check.outputs.new_release == 'true'
+        run: |
+          # Import the GPG key
+          echo "${{ secrets.AEL_BOT_GPG_PRIVATE_KEY }}" | gpg --batch --import
+
+          # Get the key ID
+          GPG_KEY_ID=$(gpg --list-secret-keys --keyid-format=long | grep '^sec' | head -1 | awk '{print $2}' | cut -d'/' -f2)
+          echo "GPG_KEY_ID=$GPG_KEY_ID" >> $GITHUB_ENV
+
+          # Configure GPG agent for non-interactive use
+          echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
+          echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf
+          gpg-connect-agent reloadagent /bye || true
 
       - name: Set up git credentials
         if: steps.check.outputs.new_release == 'true'
@@ -60,6 +85,8 @@ jobs:
           set -e -o pipefail
           git config --global user.email "ael-bot@users.noreply.github.com"
           git config --global user.name "ael-bot"
+          git config --global commit.gpgsign true
+          git config --global user.signingkey ${{ env.GPG_KEY_ID }}
 
           # Configure git to use the token for HTTPS operations
           git config --global url."https://ael-bot:${{ secrets.KERNEL_UPDATE_TOKEN }}@github.com/".insteadOf "git@github.com:"
@@ -69,9 +96,10 @@ jobs:
         if: steps.check.outputs.new_release == 'true'
         env:
           GIT_TERMINAL_PROMPT: 0
+          BRANCH_NAME: ${{ steps.branch.outputs.name }}
         run: |
           set -e -o pipefail
-          ./utils/kernel-upgrade.sh linux
+          ./utils/kernel-upgrade.sh linux 6.18 "$BRANCH_NAME"
 
       - name: Create pull request
         if: steps.check.outputs.new_release == 'true'
@@ -79,7 +107,6 @@ jobs:
         with:
           github-token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
           script: |
-            // Check if PR already exists
             const { data: pulls } = await github.rest.pulls.list({
               owner: context.repo.owner,
               repo: context.repo.repo,
@@ -92,12 +119,11 @@ jobs:
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 title: `Upgrade to kernel ${{ steps.check.outputs.current_version }}`,
-                head: 'kernel-upgrade',
+                head: '${{ steps.branch.outputs.name }}',
                 base: 'main',
-                body: `Automated kernel upgrade to version ${{ steps.check.outputs.current_version }}.\n\n**Previous version:** ${{ steps.check.outputs.latest_tag }}\n**New version:** ${{ steps.check.outputs.current_version }}\n**Source:** https://www.kernel.org/\n\nThis PR was automatically created by the kernel release monitoring workflow.`
+                body: `Automated kernel upgrade to version ${{ steps.check.outputs.current_version }}.\n\n**Previous version:** ${{ steps.check.outputs.infix_version }}\n**New version:** ${{ steps.check.outputs.current_version }}\n**Source:** https://www.kernel.org/\n\nThis PR was automatically created by the kernel release monitoring workflow.`
               });
 
-              // Add label
               await github.rest.issues.addLabels({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
@@ -105,7 +131,6 @@ jobs:
                 labels: ['ci:main']
               });
 
-              // Request reviews
               await github.rest.pulls.requestReviewers({
                 owner: context.repo.owner,
                 repo: context.repo.repo,

.github/workflows/coverity.yml

@@ -69,10 +69,10 @@ jobs:
           (cd libite && ./autogen.sh && ./configure && make && sudo make install)
           make dep
 
-      - name: Check applications
+      - name: Build applications for Coverity
         run: |
           export PATH=`pwd`/coverity/bin:$PATH
-          cov-build --dir cov-int make check
+          cov-build --dir cov-int make coverity
 
       - name: Submit results to Coverity Scan
         env:

.github/workflows/inventory.yml

@@ -45,22 +45,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Restore Cache of dl/
+      - uses: ./.github/actions/cache-restore
-        uses: actions/cache@v4
         with:
-          path: dl/
+          target: x86_64
-          key: dl-netconf-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          dl-prefix: dl-netconf
-          restore-keys: |
-            dl-netconf-
-            dl-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-x86_64-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-x86_64-
-            ccache-
       - name: Disk inventory (2/2) ...
         run: |
           echo "df -h ========================================================================="

.github/workflows/release.yml

@@ -48,20 +48,12 @@ jobs:
       contents: write
       discussions: write
     steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
       - uses: actions/checkout@v4
         with:
           submodules: 'true'
 
+      - uses: ./.github/actions/podman-cleanup
+
       - name: Set Release Variables
         id: rel
         run: |
@@ -75,7 +67,7 @@ jobs:
           if echo $ver | grep -qE 'v[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
             echo "pre=true"     >> $GITHUB_OUTPUT
             echo "latest=false" >> $GITHUB_OUTPUT
-          elif echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
+          elif echo $ver | grep -qE '^v[0-9]+\.[0-9]+(\.0)?$'; then
             echo "pre=false"    >> $GITHUB_OUTPUT
             echo "latest=true"  >> $GITHUB_OUTPUT
             echo "cat=Releases" >> $GITHUB_OUTPUT
@@ -104,11 +96,7 @@ jobs:
 
       - name: Extract ChangeLog entry ...
         run: |
-          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
+          cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
-              |head -n -1 > release.md
-          echo "" >> release.md
-          echo "> [!TIP]" >> release.md
-          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
           cat release.md
 
       - uses: ncipollo/release-action@v1
@@ -117,7 +105,7 @@ jobs:
           prerelease: ${{ steps.rel.outputs.pre }}
           makeLatest: ${{ steps.rel.outputs.latest }}
           discussionCategory: ${{ steps.rel.outputs.cat }}
-          bodyFile:  release.md
+          bodyFile: release.md
           artifacts: "*.tar.gz*,*.qcow2*"
 
       - name: Summary

.github/workflows/test.yml

@@ -8,6 +8,10 @@ on:
         required: false
         default: kernelkit/infix
         type: string
+      infix_branch:
+        description: 'Branch/tag/commit to checkout (for spin overrides)'
+        default: ''
+        type: string
 
   workflow_call:
     inputs:
@@ -21,6 +25,11 @@ on:
         required: false
         type: string
         default: kernelkit/infix
+      infix_branch:
+        required: false
+        type: string
+        default: ''
+        description: 'Branch/tag/commit to checkout (for spin overrides). Defaults to github.ref if not specified'
       ninepm-conf:
         required: false
         type: string
@@ -29,10 +38,20 @@ on:
         required: false
         type: string
         default: 'test'
+      pre_test_script:
+        required: false
+        type: string
+        default: ''
+        description: 'Optional script to run after checkout (for spin customization)'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'
 
 env:
   TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
   INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  INFIX_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_branch || inputs.infix_branch }}
   NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
   TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}
 
@@ -41,24 +60,26 @@ jobs:
     name: Regression Test ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
     runs-on: [self-hosted, regression]
     steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
       - name: Checkout infix repo
         uses: actions/checkout@v4
         with:
           repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
+          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
           clean: true
           fetch-depth: 0
           submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
+
+      - uses: ./.github/actions/podman-cleanup
+
+      - name: Run pre-test script
+        if: ${{ inputs.pre_test_script != '' }}
+        run: |
+          cat > ./pre-test.sh << 'EOF'
+          ${{ inputs.pre_test_script }}
+          EOF
+          chmod +x ./pre-test.sh
+          bash ./pre-test.sh
 
       - name: Set Build Variables
         id: vars

.github/workflows/trigger.yml

@@ -1,4 +1,4 @@
-name: Kernelkit Trigger
+name: CI
 
 on:
   pull_request:
@@ -28,6 +28,7 @@ jobs:
     outputs:
       x86_64_target: ${{ steps.set-targets.outputs.x86_64_target }}
       aarch64_target: ${{ steps.set-targets.outputs.aarch64_target }}
+      arm_target: ${{ steps.set-targets.outputs.arm_target }}
     steps:
       - run: |
           echo "Triggering build, logging meta data ..."
@@ -43,25 +44,40 @@ jobs:
              | grep -q "ci:main"; then
             echo "x86_64_target=x86_64_minimal" >> $GITHUB_OUTPUT
             echo "aarch64_target=aarch64_minimal" >> $GITHUB_OUTPUT
+            echo "arm_target=arm_minimal" >> $GITHUB_OUTPUT
           else
             echo "x86_64_target=x86_64" >> $GITHUB_OUTPUT
             echo "aarch64_target=aarch64" >> $GITHUB_OUTPUT
+            echo "arm_target=arm" >> $GITHUB_OUTPUT
           fi
+  unit-test:
+    needs: check-trigger
+    uses: ./.github/workflows/unit-test.yml
+    with:
+      name: "infix"
+      target: ${{ needs.check-trigger.outputs.x86_64_target }}
 
   build-x86_64:
-    needs: check-trigger
+    needs: [check-trigger, unit-test]
     uses: ./.github/workflows/build.yml
     with:
       name: "infix"
       target: ${{ needs.check-trigger.outputs.x86_64_target }}
 
   build-aarch64:
-    needs: check-trigger
+    needs: [check-trigger, unit-test]
     uses: ./.github/workflows/build.yml
     with:
       name: "infix"
       target: ${{ needs.check-trigger.outputs.aarch64_target }}
 
+  build-arm:
+    needs: [check-trigger, unit-test]
+    uses: ./.github/workflows/build.yml
+    with:
+      name: "infix"
+      target: ${{ needs.check-trigger.outputs.arm_target }}
+
   test-run-x86_64:
     needs: [check-trigger, build-x86_64]
     uses: ./.github/workflows/test.yml

.github/workflows/unit-test.yml

@@ -0,0 +1,116 @@
+name: unit-test
+
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: "Build target (e.g. aarch64 or aarch64_minimal)"
+        default: "x86_64"
+        type: string
+      parallel:
+        description: 'Massive parallel build of each image'
+        default: true
+        type: boolean
+      name:
+        description: "Name (for spin overrides)"
+        default: "infix"
+        type: string
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        default: kernelkit/infix
+        type: string
+      infix_branch:
+        description: 'Branch/tag/commit to checkout (for spin overrides)'
+        default: ''
+        type: string
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+      infix_branch:
+        required: false
+        type: string
+        default: ''
+        description: 'Branch/tag/commit to checkout (for spin overrides). Defaults to github.ref if not specified'
+      parallel:
+        required: false
+        type: boolean
+        default: true
+      pre_build_script:
+        required: false
+        type: string
+        default: ''
+        description: 'Optional script to run after checkout (for spin customization)'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'
+
+env:
+  NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
+  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  INFIX_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_branch || inputs.infix_branch }}
+
+jobs:
+  unit-tests:
+    name: Build ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+    runs-on: [ self-hosted, latest ]
+    env:
+      PARALLEL: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.parallel == 'true' || github.event_name != 'workflow_dispatch' && inputs.parallel == true }}
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Cleanup Build Folder
+        run: |
+          ls -la ./
+          rm -rf ./* || true
+          rm -rf ./.??* || true
+          ls -la ./
+
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
+          clean: true
+          fetch-depth: 0
+          submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
+
+      - uses: ./.github/actions/podman-cleanup
+
+      - name: Run pre-build script
+        if: ${{ inputs.pre_build_script != '' }}
+        run: |
+          cat > ./pre-build.sh << 'EOF'
+          ${{ inputs.pre_build_script }}
+          EOF
+          chmod +x ./pre-build.sh
+          bash ./pre-build.sh
+
+      - uses: ./.github/actions/cache-restore
+        with:
+          target: ${{ env.TARGET }}
+
+      - name: Configure ${{ env.TARGET }}
+        run: |
+          make ${{ env.TARGET }}_defconfig
+
+      - name: Cleanup stale containers and ports
+        run: |
+          podman rm -af || true
+          pkill -9 -f rootlessport || true
+
+      - name: Unit Test ${{ env.TARGET }}
+        run: |
+          make test-unit

.gitignore

@@ -1,5 +1,8 @@
 *~
+.claude
 .gdb_history
+.claude
+AGENTS.md
 /.backup
 /.ccache
 /dl

Makefile

@@ -16,8 +16,7 @@ bmake   = $(MAKE) -C buildroot O=$(O) $1
 all: $(config) buildroot/Makefile
 	@+$(call bmake,$@)
 
-check dep:
+check dep coverity:
-	@echo "Starting local check, stage $@ ..."
 	@make -C src $@
 
 $(config):
@@ -33,6 +32,11 @@ $(config):
 legal-info: | buildroot/Makefile
 	$(call bmake,legal-info LINUX_LICENSE_FILES=COPYING)
 
+cyclonedx: | buildroot/Makefile
+	@echo "Generating package information..."
+	@$(MAKE) --no-print-directory -C buildroot O=$(O) show-info | ./buildroot/utils/generate-cyclonedx > $(O)/cyclonedx-sbom.json
+	@echo "CycloneDX SBOM generated: $(O)/cyclonedx-sbom.json"
+
 # Workaround, see board/x86_64/board.mk
 test:
 	@+$(call bmake,$@)
@@ -40,4 +44,4 @@ test:
 buildroot/Makefile:
 	@git submodule update --init
 
-.PHONY: all check test
+.PHONY: all check coverity dep test cyclonedx

README.md

@@ -16,10 +16,12 @@ if something goes wrong.  Deploy once, trust forever.
 
 **🤝 Friendly**  
 Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit `?` or TAB for
+with built-in help for every command — just hit <kbd>?</kbd> or
-context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
+<kbd>TAB</kbd> for context-aware assistance.
-[comprehensive documentation][4] mean you're never stuck.  Whether
+
-you're learning networking or managing enterprise infrastructure.
+Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
+mean you're never stuck.  Whether you're learning networking or managing
+enterprise infrastructure.
 
 **🛡️ Secure**  
 Built with security as a foundation, not an afterthought.  Minimal
@@ -53,27 +55,24 @@ your device, your rules.
    Consistent tooling from development to production deployment.  
    How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
 
-## See It In Action
+## Quick Example
 
 Configure an interface in seconds - the CLI guides you with built-in help:
 
-<details><summary><b>Click Here for an example CLI Session</b></summary>
+<pre><code>admin@infix-12-34-56:/> <b>configure</b>
-
+admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
-```bash
+admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4</b> <kbd>TAB</kbd>
-admin@infix-12-34-56:/> configure
+      address     autoconf      bind-ni-name     dhcp 
-admin@infix-12-34-56:/config/> edit interface eth0
+      enabled     forwarding    mtu              neighbor
-admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
+admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4 address 192.168.2.200 prefix-length 24</b>
-      address     autoconf bind-ni-name      enabled
+admin@infix-12-34-56:/config/interface/eth0/> <b>show</b>
-      forwarding  mtu      neighbor
-admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
-admin@infix-12-34-56:/config/interface/eth0/> show
 type ethernet;
 ipv4 {
   address 192.168.2.200 {
     prefix-length 24;
   }
 }
-admin@infix-12-34-56:/config/interface/eth0/> diff
+admin@infix-12-34-56:/config/interface/eth0/> <b>diff</b>
 interfaces {
   interface eth0 {
 +    ipv4 {
@@ -83,25 +82,23 @@ interfaces {
 +    }
   }
 }
-admin@infix-12-34-56:/config/interface/eth0/> leave
+admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
-admin@infix-12-34-56:/> show interfaces
+admin@infix-12-34-56:/> <b>show interfaces</b>
-INTERFACE       PROTOCOL   STATE       DATA
+<u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
 eth0            ethernet   UP          52:54:00:12:34:56
                 ipv4                   192.168.2.200/24 (static)
                 ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                 ipv4                   127.0.0.1/8 (static)
                 ipv6                   ::1/128 (static)
-admin@infix-12-34-56:/> copy running-config startup-config
+admin@infix-12-34-56:/> <b>copy running startup</b>
-```
+</code></pre>
 
-Notice how TAB completion shows available options, `show` displays
+Notice how <kbd>TAB</kbd> completion shows available options, `show`
-current config, and `diff` shows exactly what changed before you
+displays current config, and `diff` shows exactly what changed before
-commit your changes with the `leave` command.
+you commit your changes with the `leave` command.
 
-</details>
+For more information, see [CLI documentation][3].
-
-> [Full CLI documentation →][3]
 
 ## Get Started
 
@@ -111,7 +108,7 @@ containers for any custom functionality you need.
 
 ### Supported Platforms
 
-- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
+- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
 - **Banana Pi-R3** - Your next home router and gateway
 - **NanoPi R2S** - Compact dual-port router in a tiny package
 - **x86_64** - Run in VMs or on mini PCs for development and testing

board/Config.in

@@ -1,5 +1,6 @@
 menu "Board Support"
 
+source "$BR2_EXTERNAL_INFIX_PATH/board/arm/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"

board/README.md

@@ -0,0 +1,18 @@
+Board Support
+=============
+
+The board support for an architecture always starts with Qemu support,
+this is what each `linux_defconfig` at the very least sets up.  Then
+each `$BR2_ARCH` has additional BSPs, e.g., Banana Pi BPI-R3.
+
+The `board/` directory is matched with the `configs/*_defconfigs` and
+the only execption is `board/common/`, which holds all shared files for
+Infix builds.
+
+Each `board/$BR2_ARCH/` can then have vendor/product sub-directories
+for the BSPs which may contain "fixups" to the base kernel config and
+any additional device tree files that should be included as well.
+
+To rebuild a board-specific package, e.g. NanoPi R2S:
+
+    make friendlyarm-nanopi-r2s-rebuild all

board/aarch64/bananapi-bpi-r3/Config.in

@@ -5,6 +5,7 @@ config BR2_PACKAGE_BANANAPI_BPI_R3
 	select BR2_PACKAGE_LINUX_FIRMWARE
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7986
+	select BR2_PACKAGE_LINUX_FIRMWARE_AIROHA_EN8811H
 	select SDCARD_AUX
 	help
 	  Build Banana PI R3 support

board/aarch64/bananapi-bpi-r3/README.md

@@ -1,27 +1,273 @@
-# Banana Pi R3
+# Banana Pi BPI-R3 / BPI-R3 Mini
 
-## Support level
+<img src="bananapi-bpi-r3.webp" alt="The board" width=800 padding=10>
-Full support for all Infix enabled features including switched ethernet ports, WiFi,
-and SFP interfaces. The board includes comprehensive hardware support for
-MediaTek MT7986 SoC features.
 
-### Hardware features
+## Overview
-The Banana Pi R3 is a high-performance networking board featuring:
-- MediaTek MT7986 ARM Cortex-A53 quad-core processor
-- 4x Gigabit LAN ports (lan1-lan4)
-- 1x Gigabit WAN port
-- 2x SFP ports (sfp1, sfp2) for fiber connectivity
-- Dual WiFi interfaces (wifi0 for 2.4GHz, wifi1 for 5GHz)
-- USB support
-- SD card boot support
 
-### Network configuration
+The Banana Pi BPI-R3 and BPI-R3 Mini are high-performance networking
-The board comes preconfigured with:
+boards with full Infix support for all enabled features including
-- 4 switched LAN ports for internal networking
+Ethernet, WiFi, and SFP interfaces.
-- Dedicated WAN port with DHCP client enabled
-- SFP ports for high-speed fiber connections
-- Dual WiFi interfaces for wireless connectivity
 
-### Pre-built images
+Both boards share the same SoC and most peripherals.  The key
-SD card image: [infix-bpi-r3-sdcard.img](https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img)
+differences are:
 
+| Feature         | BPI-R3             | BPI-R3 Mini             |
+|-----------------|--------------------|-------------------------|
+| Ethernet switch | Yes (4x LAN + WAN) | No (WAN/LAN ports only) |
+| SD card slot    | Yes                | No                      |
+
+### Hardware Features
+
+- MediaTek MT7986 ARM Cortex-A53 quad-core processor @ 2.0 GHz
+- 2 GB DDR4 RAM
+- 8 GB eMMC storage
+- microSD card slot (BPI-R3 only)
+- 5x Gigabit Ethernet ports with switch core (BPI-R3 only)
+- 2x SFP cages for fiber connectivity (1G/2.5G) (BPI-R3 only)
+- Dual-band WiFi (2.4 GHz + 5 GHz)
+- USB 3.0 port
+- Mini PCIe slot
+
+### Default Network Configuration
+
+Infix comes preconfigured with:
+
+- **LAN ports** (lan1-lan4): Bridged for internal networking (BPI-R3 only)
+- **WAN port**: DHCP client enabled for internet connectivity
+- **SFP ports** (sfp1, sfp2): Available for configuration (BPI-R3 only)
+- **WiFi interfaces** (wifi0, wifi1): Available for configuration
+
+## Getting Started
+
+### BPI-R3: Quick Start with SD Card
+
+The easiest way to get started with the BPI-R3 is using an SD card:
+
+> [!NOTE]
+> SD card boot works but we have observed stability issues. For production
+> use or long-term reliability, we recommend installing to eMMC (see below).
+
+1. **Download the SD card image:** [infix-bpi-r3-sdcard.img][2]
+2. **Flash the image to an SD card:** see [this guide][0]
+3. **Set boot switches:**
+   - Set DIP switches to **0000** (SD card boot mode)
+   - Switch positions are on the underside of the board near the SD slot
+4. **Boot the board:**
+   - Insert the SD card
+   - Connect power
+   - Connect to LAN port or console (115200 8N1)
+   - Default login: `admin` / `admin`
+
+### BPI-R3 Mini: Getting Started
+
+The BPI-R3 Mini does not have an SD card slot, so you must install
+directly to eMMC.  See [Installing to eMMC — BPI-R3
+Mini](#bpi-r3-mini) below.
+
+### Boot Switch Reference
+
+The BPI-R3 has a 4-position DIP switch that controls boot media:
+
+<img align="right" src="bootstrap-switch.webp" alt="DIP switches" width=200 padding=10>
+
+| Position | Mode        | Description                           |
+|----------|-------------|---------------------------------------|
+| 0000     | SD card     | Boot from microSD card                |
+| 0110     | eMMC        | Boot from internal eMMC (recommended) |
+| 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |
+
+> [!NOTE]
+> Switch position is read from left to right: "0" = OFF, "1" = ON.
+> When the DIP switch is in the "UP" position it is OFF(0).
+
+## Installing to eMMC
+
+For production deployments or better performance, you can install Infix
+to the internal eMMC storage.
+
+> [!IMPORTANT]
+> While Infix boots on both SD card and eMMC on the BPI-R3, we have
+> observed stability issues with SD cards on this platform. **eMMC is
+> recommended** for reliable operation.
+
+### Prerequisites
+
+- FTDI USB-to-serial cable (3.3V) for console access
+- USB flash drive (FAT32 formatted)
+- microSD card with Infix, for initial boot (BPI-R3 only)
+- Downloaded files (see below)
+
+### Required Files
+
+Download and place these files on a FAT32-formatted USB drive:
+
+1. **Infix eMMC image:**
+   - [infix-bpi-r3-emmc.img][3] (Complete system image)
+2. **eMMC bootloader** (extracted from):
+   - [bpi-r3-emmc-boot-2025.01-latest.tar.gz][4]
+   - Extract `bl2.img` from the tarball to your USB drive
+3. **Intermediate NAND bootloader** (BPI-R3 only, from Frank-W's U-Boot):
+   - [bpi-r3_spim-nand_bl2.img][5] (BL2 loader)
+   - [bpi-r3_spim-nand_fip.bin][6] (FIP image)
+
+> [!WARNING]
+> The following process involves multiple boot mode changes.  Take your
+> time and verify each step carefully.
+
+### BPI-R3
+
+#### Step 1: Boot from SD card
+
+1. Set boot switches to **0000** (SD card mode)
+2. Insert SD card with Infix
+3. Power on and break into U-Boot (press Ctrl-C during boot)
+
+#### Step 2: Flash intermediate NAND bootloader
+
+This step installs a temporary bootloader to NAND that will help us
+flash the eMMC. From the U-Boot prompt:
+
+```
+usb start
+mtd erase spi-nand0
+fatload usb 0:1 0x50000000 bpi-r3_spim-nand_bl2.img
+mtd write spi-nand0 0x50000000 0x0 0x100000
+fatload usb 0:1 0x50000000 bpi-r3_spim-nand_fip.bin
+mtd write spi-nand0 0x50000000 0x380000 0x200000
+```
+
+#### Step 3: Boot from NAND
+
+1. Power off the board
+2. Set boot switches to **1010** (NAND mode)
+3. Power on - you should boot into U-Boot again
+
+#### Step 4: Write Infix image to eMMC
+
+From the U-Boot prompt:
+
+```
+usb start
+fatload usb 0:1 0x50000000 infix-bpi-r3-emmc.img
+setexpr blocks ${filesize} / 0x200
+mmc write 0x50000000 0x0 ${blocks}
+```
+
+This writes the complete Infix system (partitions, rootfs, etc.) to eMMC.
+
+#### Step 5: Configure eMMC boot
+
+Now configure the eMMC boot partition and write the bootloader:
+
+```
+mmc partconf 0 1 1 1
+mmc erase 0x0 0x400
+fatload usb 0:1 0x50000000 bl2.img
+mmc write 0x50000000 0x0 0x400
+mmc partconf 0 1 1 0
+```
+
+#### Step 6: Boot from eMMC
+
+1. Power off the board
+2. Set boot switches to **0110** (eMMC mode)
+3. Remove SD card (optional, but recommended to verify eMMC boot)
+4. Power on
+
+Your BPI-R3 should now boot Infix from internal eMMC storage!
+
+### BPI-R3 Mini
+
+The BPI-R3 Mini does not have an SD card slot, so you have to go
+through the factory-installed Linux (OpenWRT) to flash the Infix
+bootloader and OS to eMMC.
+
+#### Step 1: Boot from NAND (factory default)
+
+<img src="r3mini_nandboot2.png" alt="BPI-R3 Mini NAND boot switch position" width=400>
+
+1. Ensure boot switches are set to NAND mode (factory default)
+2. Place `infix-bpi-r3-emmc.img` and `bl2.img` on a USB drive
+3. Power on and boot into Linux
+4. Mount the USB drive to `/mnt`
+
+#### Step 2: Flash Infix to eMMC
+
+From the Linux shell:
+
+```
+echo 0 > /proc/sys/kernel/printk
+dd if=/mnt/infix-bpi-r3-emmc.img of=/dev/mmcblk0
+echo 0 > /sys/block/mmcblk0boot0/force_ro
+dd if=/mnt/bl2.img of=/dev/mmcblk0boot0
+sync
+```
+
+#### Step 3: Boot from eMMC
+
+<img src="r3mini_emmcboot.png" alt="BPI-R3 Mini eMMC boot switch position" width=400>
+
+1. Power off the board
+2. Set boot switches to eMMC mode (see image above)
+3. Power on
+
+## Troubleshooting
+
+### Board won't boot
+
+- Verify boot switch positions (check twice!)
+- Ensure power supply provides adequate current (12V/2A recommended)
+- Try booting from SD card with switches at **0000** (BPI-R3 only)
+
+### Can't break into U-Boot
+
+- Ensure serial console is connected properly (115200 8N1, 3.3V)
+- Press Ctrl-C immediately when you see boot messages
+- Try power cycling and pressing Ctrl-C repeatedly
+
+### eMMC boot fails after installation
+
+- Boot from NAND (**1010**) and verify eMMC image was written
+- Check USB drive contents - ensure all files are present
+- Re-run the eMMC boot configuration step
+
+### Reverting to SD card (BPI-R3 only)
+
+Simply set boot switches back to **0000** and boot from SD card. The
+eMMC installation does not affect SD card functionality.
+
+## Additional Resources
+
+- [Infix Documentation][1]
+- [Official BPI-R3 Wiki][7]
+- [Release Downloads][8]
+
+## Building Custom Images
+
+See the main Infix documentation for building from source. To build both
+SD card and eMMC images locally:
+
+```bash
+# Build bootloaders for both SD and eMMC
+make x-bpi-r3-sd-boot
+make x-bpi-r3-emmc-boot
+
+# Build main system
+make aarch64
+
+# Create SD card image
+./utils/mkimage.sh -od bananapi-bpi-r3
+
+# Create eMMC image
+./utils/mkimage.sh -odt emmc bananapi-bpi-r3
+```
+
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://kernelkit.org/infix/latest/
+[2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img
+[3]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-emmc.img
+[4]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r3-emmc-boot-2025.01-latest.tar.gz
+[5]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2025-10-bpi-2025.10-2025-10-13_1032/bpi-r3_spim-nand_bl2.img
+[6]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2025-10-bpi-2025.10-2025-10-13_1032/bpi-r3_spim-nand_fip.bin
+[7]: https://wiki.banana-pi.org/Banana_Pi_BPI-R3
+[8]: https://github.com/kernelkit/infix/releases/tag/latest-boot

board/aarch64/bananapi-bpi-r3/bananapi-bpi-r3.mk

@@ -6,9 +6,10 @@ define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_GPIO,y)
 	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+	$(call KCONFIG_SET_OPT,CONFIG_AIR_EN8811H_PHY,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
 	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)

board/aarch64/bananapi-bpi-r3/dts/Makefile

@@ -1 +1 @@
-dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb
+dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb mediatek/mt7986a-bananapi-bpi-r3-mini.dtb

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-emmc.dts

@@ -0,0 +1,4 @@
+#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
+
+#include "mt7986a-bananapi-bpi-r3.dtsi"
+#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-emmc.dtsi

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/*
+This is copied from linux where it is an overlay, unfortunatly it is not
+possible to use dtbo in sysboot unless present in syslinux.conf
+*/
+&{/soc/mmc@11230000} {
+        bus-width = <8>;
+        max-frequency = <200000000>;
+        cap-mmc-highspeed;
+        mmc-hs200-1_8v;
+        mmc-hs400-1_8v;
+        hs400-ds-delay = <0x14014>;
+        non-removable;
+        no-sd;
+        no-sdio;
+        status = "okay";
+};

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-mini.dts

@@ -0,0 +1,12 @@
+#include <arm64/mediatek/mt7986a-bananapi-bpi-r3-mini.dts>
+
+#include "mt7986a-bananapi-bpi-r3.dtsi"
+#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"
+
+&phy0 {
+	compatible = "ethernet-phy-id03a2.a411";
+};
+&phy1 {
+	compatible = "ethernet-phy-id03a2.a411";
+};
+

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-mini.dtsi

@@ -0,0 +1,2 @@
+#include "mt7986a-bananapi-bpi-r3.dtsi"
+#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-sd.dts

@@ -1,2 +1,4 @@
+#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
+
 #include "mt7986a-bananapi-bpi-r3.dtsi"
 #include "mt7986a-bananapi-bpi-r3-sd.dtsi"

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3.dtsi

@@ -1,5 +1,3 @@
-#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
-
 / {
 	chosen {
 		infix {

board/aarch64/bananapi-bpi-r3/genimage.cfg.in

@@ -24,7 +24,7 @@ image var.ext4 {
         }
 }
 
-image #INFIX_ID##VERSION#-bpi-r3-sdcard.img {
+image #INFIX_ID##VERSION#-bpi-r3-#TARGET#.img {
         hdimage {
                 partition-table-type = "gpt"
 
@@ -51,6 +51,11 @@ image #INFIX_ID##VERSION#-bpi-r3-sdcard.img {
                 size = 4096s
         }
 
+	partition en8811h_fw {
+		size = 10M
+		image = "en8811h-fw.bin"
+	}
+
         partition aux {
                 partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
                 image = "aux.ext4"

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg

@@ -17,7 +17,25 @@
         "state": {
           "admin-state": "unlocked"
         }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+	  "band": "2.4GHz",
+	  "channel": "auto"
+	 }
+     },
+     {
+	"name": "radio1",
+	"class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+          "band": "5GHz",
+          "channel": "auto"
       }
+    }
     ]
   },
   "ietf-interfaces:interfaces": {
@@ -99,34 +117,118 @@
       {
         "name": "wan",
         "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R3"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
       },
       {
-        "name": "wifi0",
+        "name": "wifi0-ap",
-        "type": "infix-if-type:wifi"
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+	"infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
       },
       {
-        "name": "wifi1",
+        "name": "wifi1-ap",
-        "type": "infix-if-type:wifi"
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio1",
+          "access-point": {
+            "ssid": "Infix5Ghz",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+       "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
       }
     ]
   },
   "ietf-keystore:keystore": {
-        "asymmetric-keys": {
+    "asymmetric-keys": {
-            "asymmetric-key": [
+      "asymmetric-key": [
-                {
+        {
-                    "name": "genkey",
+          "name": "genkey",
-                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-                    "public-key": "",
+          "public-key": "",
-                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-                    "cleartext-private-key": "",
+          "cleartext-private-key": "",
-                    "certificates": {}
+          "certificates": {}
-                }
-            ]
         }
+      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
+    }
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -134,6 +236,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -153,6 +263,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -160,11 +301,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
+            "name": "deny-password-access",
-            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }
@@ -178,7 +333,11 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -221,36 +380,6 @@
     },
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
-      {
-        "if-name": "wan",
-        "option": [
-          {
-            "id": "ntp-server"
-          },
-          {
-            "id": "broadcast"
-          },
-          {
-            "id": "domain"
-          },
-          {
-            "id": "hostname"
-          },
-          {
-            "id": "dns-server"
-          },
-          {
-            "id": "router"
-          },
-          {
-            "id": "netmask"
-          }
-        ]
-      }
-    ]
-  },
   "infix-dhcp-server:dhcp-server": {
     "option": [
       {
@@ -300,6 +429,7 @@
     "policy": [
       {
         "name": "lan-to-wan",
+        "action": "accept",
         "ingress": [
           "lan"
         ],
@@ -311,7 +441,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.5"
+    "version": "1.7"
   },
   "infix-services:mdns": {
     "enabled": true
@@ -347,4 +477,3 @@
     }
   }
 }
-

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/product/init.d/S01-trigger-udev.sh

@@ -1,3 +0,0 @@
-#!/bin/sh
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/product/interface-quirks.json

@@ -0,0 +1,11 @@
+{
+    "sfp1": {
+	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
+	"broken-autoneg": true
+    },
+    "sfp2": {
+	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
+	"broken-autoneg": true
+    }
+
+}

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3mini/etc/factory-config.cfg

@@ -0,0 +1,445 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "class": "infix-hardware:usb",
+        "name": "USB2",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+	  "band": "2.4GHz",
+	  "channel": "auto"
+	 }
+     },
+     {
+	"name": "radio1",
+	"class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+          "band": "5GHz",
+          "channel": "auto"
+      }
+    }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R3"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+	"infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "wifi1-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio1",
+          "access-point": {
+            "ssid": "Infix5Ghz",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+       "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3mini/etc/udev/rules.d/90-bpi-r3-mini-rename-ethernet.rules

@@ -0,0 +1,2 @@
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth0", NAME="lan"
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth1", NAME="wan"

board/aarch64/bananapi-bpi-r3/uboot/emmc-extras.config

@@ -0,0 +1,3 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7986-emmc-env.dtsi"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES="BOOT_DEVICE=emmc DRAM_USE_DDR4=1 USE_MKIMAGE=1  MKIMAGE=$(HOST_DIR)/bin/mkimage"
+CONFIG_SUPPORT_EMMC_BOOT=y

board/aarch64/bananapi-bpi-r3/uboot/extras.config

@@ -3,10 +3,43 @@ CONFIG_BOOTDELAY=2
 # CONFIG_MMC_PCI is not set
 CONFIG_ENV_IS_NOWHERE=y
 # CONFIG_ENV_IS_IN_MMC is not set
+CONFIG_MULTI_DTB_FIT=y
+CONFIG_OF_LIST="mt7986a-bpi-r3-sd mt7986a-bpi-r3-emmc mt7986a-bpi-r3-mini"
+
 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_MTK=y
 CONFIG_USB_MTU3=y
-CONFIG_CMD_USB=y
 CONFIG_PHY=y
 CONFIG_PHY_MTK_TPHY=y
+
+CONFIG_MTK_SPIM=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_SPI_FLASH=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH_MTD=y
+CONFIG_SPI_FLASH_MACRONIX=y
+CONFIG_SPI_FLASH_WINBOND=y
+CONFIG_SPI_FLASH_GIGADEVICE=y
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTK_SPIM=y
+CONFIG_MTK_SNOR=y
+
+CONFIG_DM_MDIO=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_PHY_ETHERNET_ID=y
+
+CONFIG_PHY_AIROHA=y
+CONFIG_PHY_AIROHA_EN8811H=y
+CONFIG_PHY_AIROHA_FW_IN_MMC=y
+
+CONFIG_CMD_SF=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_MDIO=y
+CONFIG_CMD_MTDPARTS=y
+CONFIG_CMD_DM=y

board/aarch64/bananapi-bpi-r3/uboot/mt7986-emmc-env.dtsi

@@ -0,0 +1,5 @@
+#include <mt7986-env.dtsi>
+
+&env {
+      fdtfile = "mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb";
+};

board/aarch64/bananapi-bpi-r3/uboot/mt7986-env.dtsi

@@ -15,6 +15,10 @@
                        scriptaddr = "0x48000000";
                        ramdisk_addr_r = "0x4A000000";
 
+		en8811h_fw_part = "0#en8811h_fw";
+		en8811h_fw_dm_dir = "EthMD32.dm.bin";
+		en8811h_fw_dsp_dir = "EthMD32.DSP.bin";
+
                        /* This is a development platform, keep
                         * developer mode statically enabled.
                         */

board/aarch64/board.mk

@@ -1,3 +1,4 @@
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/*/*.mk))
 
 .PHONY: board-enable-qemu-uboot
 board-enable-qemu-uboot:
@@ -19,13 +20,6 @@ board-enable-qemu-uboot:
 			'$$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config' \
 		--enable TARGET_UBOOT_FORMAT_DTB
 
-.PHONY: board-enable-sparx-fit
-board-enable-sparx-fit:
-	@$(call IXMSG,"Enabling SparX-5i compatible FIT options")
-	@BR2_PREFIX= ./utils/config --file $(BR2_CONFIG) \
-	 	--enable FIT_IMAGE \
-	 	--set-str FIT_KERNEL_LOAD_ADDR "0x7 0x00000000"
-
 .PHONY: board-sparx-flash-uboot
 board-sparx-flash-uboot: $(BINARIES_DIR)/u-boot.bin
 	@grep -q 'BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mscc_fireant_pcb135_emmc"' $(BR2_CONFIG) || \

board/aarch64/friendlyarm-nanopi-r2s/Config.in

@@ -4,6 +4,7 @@ config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
 	select SDCARD_AUX
 	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
+	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	help
 	  FriendlyElec NanoPi R2S is a compact router board based on
 	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.

board/aarch64/friendlyarm-nanopi-r2s/friendlyarm-nanopi-r2s.mk

@@ -4,6 +4,9 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
+	# TODO: for some reason this just locks up the device
+	#       so we'll have to rely on the softdog :-(
+	# $(call KCONFIG_ENABLE_OPT,CONFIG_DW_WATCHDOG)
 
 	# PHY drivers
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
@@ -51,6 +54,10 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)
 
+	# Input layer
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MISC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
+
 	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg

@@ -58,26 +58,77 @@
       {
         "name": "wan",
         "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "NanoPi R2S"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
       }
     ]
   },
   "ietf-keystore:keystore": {
-        "asymmetric-keys": {
+    "asymmetric-keys": {
-            "asymmetric-key": [
+      "asymmetric-key": [
-                {
+        {
-                    "name": "genkey",
+          "name": "genkey",
-                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-                    "public-key": "",
+          "public-key": "",
-                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-                    "cleartext-private-key": "",
+          "cleartext-private-key": "",
-                    "certificates": {}
+          "certificates": {}
-                }
-            ]
         }
+      ]
+    }
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -85,6 +136,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -104,6 +163,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -111,11 +201,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
+            "name": "deny-password-access",
-            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }
@@ -129,7 +233,11 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -172,36 +280,6 @@
     },
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
-      {
-        "if-name": "wan",
-        "option": [
-          {
-            "id": "ntp-server"
-          },
-          {
-            "id": "broadcast"
-          },
-          {
-            "id": "domain"
-          },
-          {
-            "id": "hostname"
-          },
-          {
-            "id": "dns-server"
-          },
-          {
-            "id": "router"
-          },
-          {
-            "id": "netmask"
-          }
-        ]
-      }
-    ]
-  },
   "infix-dhcp-server:dhcp-server": {
     "option": [
       {
@@ -251,6 +329,7 @@
     "policy": [
       {
         "name": "lan-to-wan",
+        "action": "accept",
         "ingress": [
           "lan"
         ],
@@ -262,7 +341,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.5"
+    "version": "1.7"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/product/init.d/S01-trigger-udev.sh

@@ -1,3 +0,0 @@
-#!/bin/sh
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add

board/aarch64/linux_defconfig

@@ -39,7 +39,6 @@ CONFIG_ARM64_ERRATUM_1286807=y
 CONFIG_ARM64_ERRATUM_1542419=y
 CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
-CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
 CONFIG_COMPAT=y
 # CONFIG_SUSPEND is not set
@@ -52,7 +51,6 @@ CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_ARMADA_8K_CPUFREQ=y
 CONFIG_ACPI=y
 CONFIG_KPROBES=y
-CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -79,7 +77,6 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -95,12 +92,31 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -109,15 +125,23 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
+CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -134,29 +158,69 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_IPMAC=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -244,6 +308,7 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
+CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -407,10 +472,10 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_GPIO_WATCHDOG=y
+CONFIG_ARM_SBSA_WATCHDOG=y
 CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_MAX77620=y
-CONFIG_MFD_SEC_CORE=y
 CONFIG_MFD_ROHM_BD718XX=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -419,7 +484,6 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_MAX77620=y
 CONFIG_REGULATOR_PCA9450=y
 CONFIG_REGULATOR_QCOM_SPMI=y
-CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_A4TECH is not set
 # CONFIG_HID_APPLE is not set
@@ -429,11 +493,11 @@ CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_CYPRESS is not set
 # CONFIG_HID_EZKEY is not set
 # CONFIG_HID_KENSINGTON is not set
-# CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
 CONFIG_USB_ULPI_BUS=y
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
@@ -451,7 +515,6 @@ CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
 CONFIG_USB_HSIC_USB3503=m
-CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_SNP_UDC_PLAT=y
@@ -485,7 +548,6 @@ CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
 CONFIG_RTC_DRV_PCF8523=y
-CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
 CONFIG_RTC_DRV_PL031=y
@@ -500,7 +562,6 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 # CONFIG_SURFACE_PLATFORMS is not set
 CONFIG_COMMON_CLK_CS2000_CP=y
-CONFIG_COMMON_CLK_S2MPS11=y
 CONFIG_COMMON_CLK_XGENE=y
 CONFIG_COMMON_CLK_BD718XX=y
 CONFIG_MAILBOX=y
@@ -517,7 +578,8 @@ CONFIG_PHY_SAMSUNG_USB2=y
 CONFIG_NVMEM_LAYOUT_ONIE_TLV=y
 CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -536,16 +598,17 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
-CONFIG_CRYPTO_SHA1_ARM64_CE=y
-CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
@@ -557,8 +620,13 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_DETECT_HUNG_TASK=y
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-# CONFIG_SCHED_DEBUG is not set
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_WQ_WATCHDOG=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
+CONFIG_TEST_LOCKUP=m
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
 # CONFIG_STRICT_DEVMEM is not set

board/aarch64/raspberrypi-rpi64/Config.in

@@ -5,7 +5,7 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
-
+	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
 	  of single-board computers (SBC), RPi 3B and later, including the

board/aarch64/raspberrypi-rpi64/README.md

@@ -1,59 +1,324 @@
-# Raspberry Pi 3B/4B
+# Raspberry Pi 3B/4B/CM4
 
-## Support level
+## Overview
 
-Full support for base board but not any extension board on the GPIOs.
+The Raspberry Pi is one of the most popular single-board computers with full
-Other RPi boards of the same generation may work as well, but may need
+Infix support for networking features, making it an excellent platform for
-some additional testing/work.  A few CM4 variants have been tested and
+learning, prototyping, and lightweight network applications.
-seem to work as expected, but YMMV as always.
 
-### Touch screen
+### Hardware Features
 
-The [Raspberry Pi touch display v1][0] is supported on the 4B, including
+**Raspberry Pi 3B:**
-touch functionality.  There are multiple touchscreens on the market for
-Raspberry Pi, but currently only the official first version with 800x480
-resolution is supported.  Infix supplies all drivers required to utilize
-the hardware, but you need to add the actual graphical application in a
-container.
 
-There are some important considerations you need to know about when
+- Broadcom BCM2837B0 ARM Cortex-A53 quad-core processor @ 1.4 GHz
-using Infix for graphical applications.  The container needs access to
+- 1 GB LPDDR2 RAM
-`/dev/dri/` to be able to access the graphics card, it also need access
+- microSD card slot for storage
-to `/run/udev` to be able to find the input devices.
+- 4x USB 2.0 ports
+- Fast Ethernet (100 Mbps)
+- Dual-band WiFi (2.4 GHz + 5 GHz) and Bluetooth 4.2
+- HDMI port
+- GPIO header (40-pin)
 
-Example of running Doom in Infix:
+**Raspberry Pi 4B:**
+
+- Broadcom BCM2711 ARM Cortex-A72 quad-core processor @ 1.5 GHz
+- 1 GB, 2 GB, 4 GB, or 8 GB LPDDR4 RAM (depending on model)
+- microSD card slot for storage
+- 2x USB 3.0 + 2x USB 2.0 ports
+- Gigabit Ethernet
+- Dual-band WiFi (2.4 GHz + 5 GHz) and Bluetooth 5.0
+- 2x micro-HDMI ports (up to 4K output)
+- GPIO header (40-pin)
+- PoE support (with add-on HAT)
+
+**Compute Module 4 (CM4):**
+
+- Same processor as Pi 4B
+- Compact form factor for embedded applications
+- Optional eMMC storage (0 GB, 8 GB, 16 GB, or 32 GB)
+- Requires carrier board for I/O connectivity
+- Various configurations tested and working
+
+### Default Network Configuration
+
+Infix comes preconfigured with:
+
+- **Ethernet port**: DHCP client enabled for internet connectivity
+- **WiFi interfaces** (wlan0, wlan1): Available for configuration as AP or client
+- **GPIO**: Available but extension boards not currently supported
+
+### Support Level
+
+Full support for base board networking and core functionality. GPIO extension
+boards (HATs) are not currently supported. Other Raspberry Pi boards of the
+same generation may work but may require additional testing.
+
+## Getting Started
+
+### Quick Start with SD Card
+
+The easiest way to get started is using a microSD card:
+
+1. **Download the SD card image:** [infix-rpi64-sdcard.img][2]
+2. **Flash the image to a microSD card:** see [this guide][0]
+3. **Boot the board:**
+   - Insert the microSD card into your Raspberry Pi
+   - Connect an Ethernet cable to your network
+   - Connect power (see [Power Supply Requirements](#power-supply-requirements))
+   - The board will boot automatically
+4. **Connect and login:**
+   - SSH to the DHCP-assigned IP address
+   - Default login: `admin` / `admin`
+
+> [!NOTE]
+> Raspberry Pi 3B and 4B boot with a factory configuration (`factory-config.cfg`)
+> that enables DHCP client on the Ethernet port. This means you can access
+> the device over the network without needing a serial console. Simply find
+> the assigned IP address and SSH in!
+>
+> **Compute Module 4 (CM4)** and some other variants do not have this factory
+> configuration, so you'll need to use a serial console for initial setup or
+> configure the carrier board accordingly.
+
+### First Boot Notes
+
+On first boot, Infix will:
+
+- Obtain an IP address via DHCP on the Ethernet port
+- Generate unique SSH host keys
+- Initialize the configuration system
+
+You can find the assigned IP address by:
+
+- Checking your DHCP server/router's client list
+- Using network scanning tools like `nmap` or `arp-scan`
+- Connecting via serial console and running `ip addr` (if needed)
+
+## Hardware-Specific Features
+
+### WiFi Configuration
+
+Both Pi 3B and Pi 4B include dual-band WiFi that can be configured as a
+client (station mode). See the [Infix WiFi documentation][9] for detailed
+configuration examples.
+
+To configure WiFi as a client, first store your WiFi password in the keystore:
 
 ```
-admin@example:/> configure
+admin@infix:/> configure
-admin@example:/config/> edit container doom
+admin@infix:/config/> edit keystore symmetric-key mywifi
-admin@example:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
+admin@infix:/config/keystore/…/mywifi/> set key-format passphrase-key-format
-admin@example:/config/container/doom/> set privileged
+admin@infix:/config/keystore/…/mywifi/> change cleartext-symmetric-key
-admin@example:/config/container/doom/> edit mount udev
+Passphrase: ************
-admin@example:/config/container/doom/mount/udev/> set type bind
+Retype passphrase: ************
-admin@example:/config/container/doom/mount/udev/> set target /run/udev/
+admin@infix:/config/keystore/…/mywifi/> leave
-admin@example:/config/container/doom/mount/udev/> set source /run/udev/
+```
-admin@example:/config/container/doom/mount/udev/> end
+
-admin@example:/config/container/doom/mount/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
+Then configure the WiFi interface using the keystore reference:
-admin@example:/config/container/doom/mount/xorg.conf/> set target /etc/X11/xorg.conf
+
-admin@example:/config/container/doom/mount/xorg.conf/> end
+```
-admin@example:/config/container/doom/> edit volume var
+admin@infix:/> configure
-admin@example:/config/container/doom/volume/var/> set target /var
+admin@infix:/config/> edit interface wifi0
-admin@example:/config/container/doom/volume/var/> leave
+admin@infix:/config/interface/wifi0/> set ipv4 dhcp-client
-admin@example:/>
+admin@infix:/config/interface/wifi0/> set wifi ssid YourNetworkName
+admin@infix:/config/interface/wifi0/> set wifi secret mywifi
+admin@infix:/config/interface/wifi0/> set wifi country-code US
+admin@infix:/config/interface/wifi0/> leave
 ```
 
 > [!NOTE]
-> The `xorg.conf` [content mount][2] is a nifty detail of Infix that
+> The WiFi password (8-63 characters) is stored securely in the keystore as
-> allows you to keep all the relevant configuration in a single file.
+> `mywifi` (or any name you choose), which is then referenced in the WiFi
-> The deta is "simply" `base64` encoded, so you do not really need the
+> configuration. The country-code must match your location for regulatory
-> features of the Infix CLI, everything can be set up remotely [using
+> compliance (e.g., US, SE, DE, JP).
-> `curl`][3] if you like.
 
-### Pre-built images
+### Touch Screen Support
 
-Pre-built SD card images are available here: [infix-rpi64-sdcard.img][sdcard]
+The [Raspberry Pi Touch Display v1][10] (800x480 resolution) is supported on
+the Pi 4B, including touch functionality. To use graphical applications with
+the touch screen, you need to run them in a container with proper device
+access.
 
-[0]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
+#### Requirements for Graphical Applications
-[1]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
+
-[2]: https://kernelkit.org/infix/latest/container/#content-mounts
+Containers need:
-[3]: https://kernelkit.org/infix/latest/scripting-restconf/
+- Access to `/dev/dri/` for graphics card access
+- Access to `/run/udev` for input device detection
+- Privileged mode or specific capabilities
+
+#### Example: Running Doom with Touch Screen
+
+```
+admin@infix:/> configure
+admin@infix:/config/> edit container doom
+admin@infix:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
+admin@infix:/config/container/doom/> set privileged
+admin@infix:/config/container/doom/> edit mount udev
+admin@infix:/config/container/…/udev/> set type bind
+admin@infix:/config/container/…/udev/> set target /run/udev/
+admin@infix:/config/container/…/udev/> set source /run/udev/
+admin@infix:/config/container/…/udev/> end
+admin@infix:/config/container/doom/> edit mount xorg.conf
+admin@infix:/config/container/…/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
+admin@infix:/config/container/…/xorg.conf/> set target /etc/X11/xorg.conf
+admin@infix:/config/container/…/xorg.conf/> end
+admin@infix:/config/container/doom/> edit volume var
+admin@infix:/config/container/…/var/> set target /var
+admin@infix:/config/container/…/var/> leave
+```
+
+> [!NOTE]
+> The `xorg.conf` [content mount][3] is a useful Infix feature that allows you
+> to keep all configuration in a single file. The data is base64 encoded, and
+> everything can be set up remotely [using `curl`][4] if preferred.
+
+### Power Supply Requirements
+
+Proper power supply is critical for stable operation:
+
+- **Raspberry Pi 4B:** 5V/3A USB-C power supply (official recommended)
+- **Raspberry Pi 3B:** 5V/2.5A micro-USB power supply
+- **Compute Module 4:** Power requirements depend on carrier board
+
+Inadequate power can cause:
+- Random reboots or crashes
+- USB device failures
+- Network disconnections
+- Corrupted storage
+
+<img align="right" src="gpio-pinout.png" alt="GPIO Pinout" width=300 padding=10>
+
+### Serial Console Access (Optional)
+
+A serial console is useful for debugging but not required for Pi 3B/4B, since
+the factory configuration enables network access via DHCP. For CM4 and other
+variants without factory configuration, serial console access is required for
+initial setup.
+
+To connect via serial:
+
+1. Connect a USB-to-TTL serial adapter (3.3V) to GPIO pins:
+   - GND (black wire) → Pin 6 (Ground)
+   - TX → Pin 8 (GPIO 14, RXD)
+   - RX → Pin 10 (GPIO 15, TXD)
+   - **VCC (red wire) → Leave disconnected** (Pi has its own power supply)
+2. Use 115200 baud, 8 data bits, no parity, 1 stop bit (115200 8N1)
+3. Connect using `screen`, `minicom`, or similar terminal emulator
+
+The image shows the standard 40-pin GPIO header pinout. For serial console:
+- **Pin 6** (black) = Ground
+- **Pin 8** (orange) = TxD (UART) - connect to RX on your adapter
+- **Pin 10** (orange) = RxD (UART) - connect to TX on your adapter
+
+> [!WARNING]
+> Use only 3.3V serial adapters. 5V adapters will damage your Raspberry Pi!
+
+## Troubleshooting
+
+### Board won't boot
+
+- Verify the power supply meets requirements (see [Power Supply Requirements](#power-supply-requirements))
+- Check that the SD card is properly seated
+- Try re-flashing the SD card image
+- Look for the green LED activity indicator (should flash during boot)
+- Connect via serial console to see boot messages if needed
+
+### Can't find IP address
+
+- Ensure Ethernet cable is properly connected (look for link LED activity)
+- Verify your DHCP server is running and has available addresses
+- Check your router/DHCP server's client list for new devices
+- Use `nmap` or `arp-scan` to scan your network
+- Connect via serial console and run `ip addr` to see the assigned address
+
+### WiFi not working
+
+- Verify WiFi regulatory domain is set correctly
+- Check that SSID and password are correct
+- Ensure WiFi channel is supported in your region
+- Try connecting to a 2.4 GHz network first (better compatibility)
+
+### SD card corruption
+
+If the system becomes unresponsive or won't boot:
+
+- Always use proper shutdown procedures (don't just pull power)
+- Use a quality SD card (Class 10, A1, or better recommended)
+- Consider using a UPS or battery backup for critical deployments
+- Verify power supply meets requirements (see [Power Supply Requirements](#power-supply-requirements))
+
+### Container/Docker issues
+
+- Verify adequate RAM is available (check with `free -h`)
+- Ensure sufficient SD card space (check with `df -h`)
+- For Pi 3B, consider using lighter containers due to limited RAM
+
+## Additional Resources
+
+- [Infix Documentation][1]
+- [Flashing SD Card Guide][0]
+- [Infix Container Documentation][3]
+- [Scripting with RESTCONF][4]
+- [Release Downloads][8]
+- [Official Raspberry Pi Documentation][11]
+
+## Building Custom Images
+
+See the main Infix documentation for building from source. To build a custom
+Raspberry Pi image:
+
+```bash
+# Build the bootloader (only needed once or when bootloader changes)
+make O=x-boot rpi64_boot_defconfig
+make O=x-boot
+
+# Build main system
+make aarch64_defconfig
+make
+
+# Create SD card image
+./utils/mkimage.sh -od raspberrypi-rpi64
+```
+
+The resulting image will be in `output/images/infix-rpi64-sdcard.img`.
+
+### Customizing the Build
+
+You can customize the build by:
+- Modifying `board/aarch64/raspberrypi-rpi64/config.txt` for boot configuration
+- Adding packages to the Buildroot configuration
+- Customizing the device tree in `board/aarch64/raspberrypi-rpi64/dts/`
+
+## Performance Notes
+
+### Raspberry Pi 4B vs 3B
+
+The Pi 4B offers significant improvements over the 3B:
+- 3x faster processor
+- Up to 8x more RAM
+- Gigabit Ethernet (vs 100 Mbps)
+- USB 3.0 for faster storage and peripherals
+- Better thermal performance
+
+For network-intensive applications, the Pi 4B is strongly recommended.
+
+### Raspberry Pi as a Router
+
+While capable of basic routing tasks, be aware of limitations:
+- Single Ethernet port (consider USB Ethernet adapters for multi-port setups)
+- CPU-based packet processing (no hardware offload)
+- Best suited for home/lab use rather than high-throughput production
+
+For applications requiring multiple ports or high performance, consider
+dedicated networking hardware like the [Banana Pi R3][12].
+
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://kernelkit.org/infix/latest/
+[2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
+[3]: https://kernelkit.org/infix/latest/container/#content-mounts
+[4]: https://kernelkit.org/infix/latest/scripting-restconf/
+[8]: https://github.com/kernelkit/infix/releases/tag/latest-boot
+[9]: https://kernelkit.org/infix/latest/networking/#wifi
+[10]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
+[11]: https://www.raspberrypi.com/documentation/
+[12]: https://kernelkit.org/infix/latest/hardware/#banana-pi-bpi-r3

board/aarch64/raspberrypi-rpi64/config.txt

@@ -1,3 +1,9 @@
+# Raspberry Pi bootloader (start.elf) configuration
+#
+# uart_2ndstage=1 - Enable early boot debug output from the bootloader
+#                   Useful for debugging boot failures before U-Boot starts
+#                   Comment out for production to reduce boot noise
+
 [all]
 arm_64bit=1
 
@@ -12,7 +18,7 @@ dtoverlay=infix-key
 disable_overscan=1
 
 enable_uart=1
-uart_2ndstage=1
+#uart_2ndstage=1
 
 [pi3]
 start_file=start.elf

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg

@@ -10,6 +10,13 @@
         "state": {
           "admin-state": "unlocked"
         }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "00"
+        }
       }
     ]
   },
@@ -37,11 +44,46 @@
       },
       {
         "name": "eth0",
-        "type": "infix-if-type:ethernet"
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Raspberry Pi 4 Model B"
+              }
+            ]
+          }
+        }
       },
       {
         "name": "wifi0",
-        "type": "infix-if-type:wifi"
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0"
+        }
       }
     ]
   },
@@ -61,6 +103,9 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -68,6 +113,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -87,6 +140,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -94,11 +178,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
+            "name": "deny-password-access",
-            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }
@@ -112,7 +210,11 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -157,38 +259,8 @@
     },
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
-      {
-        "if-name": "eth0",
-        "option": [
-          {
-            "id": "netmask"
-          },
-          {
-            "id": "broadcast"
-          },
-          {
-            "id": "router"
-          },
-          {
-            "id": "domain"
-          },
-          {
-            "id": "hostname"
-          },
-          {
-            "id": "dns-server"
-          },
-          {
-            "id": "ntp-server"
-          }
-        ]
-      }
-    ]
-  },
   "infix-meta:meta": {
-    "version": "1.5"
+    "version": "1.7"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/usr/libexec/confd/product/gen-interfaces

@@ -1,6 +0,0 @@
-cat <<EOF
-   {
-        "name": "wifi0",
-        "type": "infix-if-type:wifi",
-   }
-EOF

board/aarch64/raspberrypi-rpi64/uboot/rpi-env.dtso

@@ -12,6 +12,15 @@
 			boot_targets = "mmc0";
 			ethprime = "eth0";
 
+			/* Memory layout for kernel boot:
+			 *   0x00200000: Kernel relocation address
+			 *   0x04000000: FDT (64MB, gives enough space for kernels up to ~60MB)
+			 *   0x10000000: Ramdisk (Memsize - 256MB)
+			 */
+			kernel_addr_r = "0x00200000";
+			fdt_addr_r = "0x04000000";
+			ramdisk_addr_r = "0x10000000";
+
 			stdout = "serial";
 			stderr = "serial";
 			stdin = "serial";

board/aarch64/rootfs/usr/sbin/wan-monitor.sh

@@ -20,6 +20,7 @@ cleanup()
 {
     rm -f "$LED_FILE"
     rm -f "$PID_FILE"
+    kill %% 2>/dev/null
     exit 0
 }
 
@@ -31,11 +32,13 @@ remaining_time=$((1800 - $(awk '{print int($1)}' /proc/uptime)))
 
 while [ "$remaining_time" -gt 0 ]; do
     check_wan
-    sleep 1
+    sleep 1 &
+    wait $!
     remaining_time=$((remaining_time - 1))
 done
 
 while :; do
     check_wan
-    sleep 5
+    sleep 5 &
+    wait $!
 done

board/aarch64/rootfs/usr/share/product/marvell,armada-ap807/etc/support.d/50-marvell-cn913x.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -e
+
+ecc_stat()
+{
+    local chan=
+    local base=
+
+    for chan in 0 1; do
+        base=$((0xf0020360 + 0x200 * chan))
+
+        echo "DRAM Channel $chan ECC Status"
+        echo -n "  Log config: "; devmem $((base + 0x0)) 32
+        echo -n "  1b errors:  "; devmem $((base + 0x4)) 32
+        echo -n "  Info 0:     "; devmem $((base + 0x8)) 32
+        echo -n "  Info 1:     "; devmem $((base + 0xc)) 32
+        echo
+    done
+}
+
+[ -n "$1" ] || { echo "usage: $0 OUT-DIR"; exit 1; }
+work="$1"/marvell-cn913x
+mkdir -p "${work}"
+
+ecc_stat >"${work}"/ecc-stat

board/aarch64/styx-dcp-sc-28p/dts/styx/dcp-sc-28p-a.dts

@@ -59,3 +59,9 @@
 		XSWP(a, "e13", 13, &sfp0);
 	};
 };
+
+&cp0_spi1 {
+	spi-flash@0 {
+		broken-flash-reset;
+	};
+};

board/arm/Config.in

@@ -0,0 +1,6 @@
+if BR2_arm
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/arm/microchip-sama7g54-ek/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/arm/raspberrypi-rpi2/Config.in"
+
+endif

board/arm/README.md

@@ -0,0 +1,7 @@
+Arm 32-bit
+==========
+
+Board Specific Documentation
+----------------------------
+
+- [Raspberry Pi 2 Model B (32-bit)](raspberrypi-rpi2/)

board/arm/board.mk

@@ -0,0 +1 @@
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/arm/*/*.mk))

board/arm/boot.script

@@ -0,0 +1,7 @@
+blkmap get boot dev devnum
+load blkmap ${devnum} ${kernel_addr_r} /boot/zImage
+#TODO: LOAD FDT
+
+setenv bootargs "${bootargs_root} ${bootargs_rauc} ${bootargs_log}"
+
+bootz ${kernel_addr_r} ${ramdisk} ${fdt_addr}

board/arm/linux_defconfig

@@ -0,0 +1,443 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_ARCH_MULTI_V6=y
+CONFIG_ARCH_VIRT=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_SMP=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_VFP=y
+CONFIG_NEON=y
+CONFIG_KERNEL_MODE_NEON=y
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_JUMP_LABEL=y
+# CONFIG_GCC_PLUGINS is not set
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_KSM=y
+CONFIG_CMA=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_NET_IPVTI=m
+CONFIG_NET_FOU_IP_TUNNELS=y
+CONFIG_IPV6_SIT=m
+CONFIG_IPV6_GRE=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETWORK_PHY_TIMESTAMPING=y
+CONFIG_NETFILTER=y
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_PROCFS=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
+CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=y
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=y
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=y
+CONFIG_NFT_XFRM=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=y
+CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CGROUP=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_IPMAC=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
+CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
+CONFIG_NF_CONNTRACK_BRIDGE=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BRIDGE=y
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_BRIDGE_MRP=y
+CONFIG_BRIDGE_CFM=y
+CONFIG_NET_DSA=y
+CONFIG_VLAN_8021Q=y
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_MQPRIO=y
+CONFIG_NET_CLS_BASIC=y
+CONFIG_NET_CLS_BPF=y
+CONFIG_NET_CLS_FLOWER=y
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_GACT=y
+CONFIG_NET_ACT_MIRRED=y
+CONFIG_NET_ACT_SKBEDIT=y
+CONFIG_DCB=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_MPLS=y
+CONFIG_NET_MPLS_GSO=y
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
+CONFIG_NET_PKTGEN=y
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_RFKILL=y
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_LWTUNNEL=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_UEVENT_HELPER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+# CONFIG_STANDALONE is not set
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_FW_CFG_SYSFS=y
+CONFIG_FW_CFG_SYSFS_CMDLINE=y
+CONFIG_OF_OVERLAY=y
+CONFIG_BLK_DEV_NULL_BLK=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_NVME=y
+CONFIG_SRAM=y
+CONFIG_EEPROM_AT24=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_SCSI_SAS_LIBSAS=y
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_VIRTIO=y
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_MOBILE_LPM_POLICY=0
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_PATA_OF_PLATFORM=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_INIT=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
+CONFIG_VXLAN=m
+CONFIG_GENEVE=m
+CONFIG_BAREUDP=m
+CONFIG_MACSEC=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_VIRTIO_NET=y
+CONFIG_NLMON=y
+CONFIG_NET_VRF=y
+CONFIG_BCMGENET=y
+CONFIG_SMSC911X=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_INPUT_MOUSEDEV=m
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_BCM2835=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=y
+CONFIG_SPI_BCM2835AUX=y
+CONFIG_SENSORS_RASPBERRYPI_HWMON=m
+CONFIG_THERMAL=y
+CONFIG_BCM2711_THERMAL=y
+CONFIG_BCM2835_THERMAL=m
+CONFIG_WATCHDOG=y
+CONFIG_I6300ESB_WDT=y
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_SYSCON=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_DRM=y
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_SIMPLEDRM=y
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_TOSHIBA_TC358762=m
+CONFIG_DRM_V3D=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_VC4_HDMI_CEC=y
+CONFIG_FB=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_SOC=y
+CONFIG_SND_BCM2835_SOC_I2S=y
+CONFIG_HID_GENERIC=m
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_OTG=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_DWC2=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_ETH=m
+CONFIG_USB_ETH_EEM=y
+CONFIG_USB_G_SERIAL=m
+CONFIG_MMC=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_IPROC=y
+CONFIG_MMC_BCM2835=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=y
+CONFIG_LEDS_TRIGGER_CAMERA=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_INPUT=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_STAGING=y
+CONFIG_SND_BCM2835=m
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_BTRFS_FS=y
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_FUSE_FS=y
+CONFIG_VIRTIO_FS=y
+CONFIG_OVERLAY_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_EXFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_SQUASHFS_ZSTD=y
+CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
+CONFIG_CRYPTO_CCM=y
+CONFIG_CRYPTO_GCM=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=32
+CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_FS=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_TIMEOUT=20
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_WQ_WATCHDOG=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
+CONFIG_TEST_LOCKUP=m
+# CONFIG_RCU_TRACE is not set
+CONFIG_FUNCTION_TRACER=y
+CONFIG_MEMTEST=y

board/arm/microchip-sama7g54-ek/Config.in

@@ -0,0 +1,7 @@
+config BR2_PACKAGE_MICROCHIP_SAMA7G54_EK
+	bool "Microchip SAMA7G54-EK Evaluation Kit"
+	depends on BR2_arm
+	select SDCARD_AUX
+	help
+	  Support for the Microchip SAMA7G54 Evaluation Kit featuring
+	  a Cortex-A7 processor with MACB Gigabit Ethernet and MMC storage.

board/arm/microchip-sama7g54-ek/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2026 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

board/arm/microchip-sama7g54-ek/README.md

@@ -0,0 +1,116 @@
+Microchip SAMA7G54-EK
+=====================
+
+The [SAMA7G54-EK][1] is an evaluation kit for the Microchip SAMA7G5 series,
+featuring an ARM Cortex-A7 processor @ 800 MHz with 512 MB DDR3L RAM.
+
+The board features:
+
+- 2x MACB Gigabit Ethernet ports
+- 8 GB eMMC (SDMMC0) + microSD card slot (SDMMC1)
+- QSPI NOR flash
+- USB 2.0 host ports
+- CAN bus interfaces
+- Flexcom serial ports (UART, SPI, I2C)
+
+How to Build
+------------
+
+Since there are no pre-built images for ARM 32-bit, you need to build
+both Infix and the bootloader from source.
+
+### SD Card
+
+1. Build the bootloader
+
+        make O=x-boot-sama7g54 sama7g54_ek_sd_boot_defconfig
+        make O=x-boot-sama7g54
+
+2. Build Infix
+
+        make O=x-arm arm_defconfig
+        make O=x-arm
+
+3. Create the SD card image
+
+        ./utils/mkimage.sh -b x-boot-sama7g54 -r x-arm microchip-sama7g54-ek
+
+### eMMC
+
+1. Build the bootloader
+
+        make O=x-boot-sama7g54-emmc sama7g54_ek_emmc_boot_defconfig
+        make O=x-boot-sama7g54-emmc
+
+2. Build Infix (same as above, skip if already built)
+
+        make O=x-arm arm_defconfig
+        make O=x-arm
+
+3. Create the eMMC image
+
+        ./utils/mkimage.sh -b x-boot-sama7g54-emmc -r x-arm -t emmc microchip-sama7g54-ek
+
+Flashing to SD Card
+-------------------
+
+[Flash the image][0] to a microSD card (at least 2 GB):
+
+```bash
+sudo dd if=x-boot-sama7g54/images/infix-arm-sdcard.img of=/dev/sdX \
+        bs=1M status=progress oflag=direct
+```
+
+You can also use `bmaptool` for faster writes:
+
+```bash
+sudo bmaptool copy x-boot-sama7g54/images/infix-arm-sdcard.img /dev/sdX
+```
+
+> [!WARNING]
+> Ensure `/dev/sdX` is the correct device for your SD card and not used
+> by the host system!  Use `lsblk` to verify.
+
+Flashing to eMMC
+-----------------
+
+The SAMA7G5EK has an on-board 8 GB eMMC (SDMMC0/mmc0).  Jumper J22
+controls if booting from onboard storage is allowed or not; open means
+allowed.  When open, the SW4 button can also prevent booting from eMMC
+if held at power on.
+
+The easiest method is to flash from a running SD card system:
+
+1. Boot the board from SD card
+2. Transfer the eMMC image to the board (USB drive, network, etc.)
+3. Flash the eMMC:
+
+        sudo bmaptool copy emmc.img /dev/mmcblk0
+
+4. Power off, remove SD card, and boot from eMMC
+
+Booting the Board
+-----------------
+
+1. Insert the flashed SD card (or ensure eMMC is flashed)
+2. Connect an Ethernet cable
+3. Power up the board
+4. Find the assigned IP and SSH in, default login: `admin` / `admin`
+
+Console Port
+------------
+
+The debug console is on Flexcom3 (active by default):
+
+- Baud rate: 115200
+- Data bits: 8
+- Parity: None
+- Stop bits: 1
+
+Connect a USB-to-serial adapter to the board's debug UART header.
+
+> [!WARNING]
+> Use only 3.3V serial adapters.
+
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.microchip.com/en-us/development-tool/EV21H18A

board/arm/microchip-sama7g54-ek/dts/Makefile

@@ -0,0 +1 @@
+dtb-y += microchip/at91-sama7g5ek.dtb

board/arm/microchip-sama7g54-ek/dts/microchip/at91-sama7g5ek.dts

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Infix OS device tree for Microchip SAMA7G5 Evaluation Kit
+ */
+
+#include <arm/microchip/at91-sama7g5ek.dts>
+#include "infix.dtsi"
+
+/ {
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+};
+
+/* Thermal sensor disabled until OTP is calibrated */
+&thermal_sensor {
+	status = "disabled";
+};

board/arm/microchip-sama7g54-ek/dts/microchip/infix.dtsi

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Common Infix OS defaults
+ */
+
+/ {
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+	};
+};

board/arm/microchip-sama7g54-ek/genimage.cfg.in

@@ -0,0 +1,85 @@
+# Disk image for Microchip SAMA7G5EK (sama7g5 evaluation kit)
+
+image boot.vfat {
+	vfat {
+		files = {
+			"boot.bin",
+			"u-boot.bin"
+		}
+	}
+
+	size = 16M
+}
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
+	ext4 {
+		label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
+image var.ext4 {
+	empty = true
+	temporary = true
+	size = 128M
+
+	ext4 {
+		label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+image #INFIX_ID##VERSION#-sama7g54-ek-#TARGET#.img {
+	hdimage {
+		partition-table-type = "hybrid"
+	}
+
+	partition boot {
+		partition-type = 0xC
+		bootable = "true"
+		image = "boot.vfat"
+		offset = 1M
+	}
+
+	partition aux {
+		partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 250M
+		image = "rootfs.squashfs"
+	}
+
+	partition secondary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 250M
+		image = "rootfs.squashfs"
+	}
+
+	partition cfg {
+		partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+		image = "var.ext4"
+	}
+}
+
+# Silence genimage warnings
+config {}

board/arm/microchip-sama7g54-ek/microchip-sama7g54-ek.mk

@@ -0,0 +1,69 @@
+# Microchip SAMA7G54-EK kernel configuration fixups
+define MICROCHIP_SAMA7G54_EK_LINUX_CONFIG_FIXUPS
+	# AT91/Microchip SoC
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_AT91)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SOC_SAMA7G5)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ATMEL_CLOCKSOURCE_TCB)
+
+	# Serial console (FLEXCOM)
+	# Use ttyAT naming to avoid major/minor conflict with the
+	# 8250 driver (needed by Raspberry Pi 2 in the shared ARM config)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_ATMEL)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_ATMEL_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_ATMEL_TTYAT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MFD_ATMEL_FLEXCOM)
+
+	# Network: MACB Ethernet
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MICROCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MACB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MICREL_PHY)
+
+	# MMC/SD
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_PLTFM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_OF_AT91)
+
+	# Pin control and GPIO
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_AT91)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_AT91PIO4)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_SYSFS)
+
+	# I2C and SPI
+	$(call KCONFIG_ENABLE_OPT,CONFIG_I2C_AT91)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SPI_ATMEL)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SPI_ATMEL_QUADSPI)
+
+	# Power management and reset
+	$(call KCONFIG_ENABLE_OPT,CONFIG_POWER_RESET)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_POWER_RESET_AT91_RESET)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_POWER_RESET_AT91_SAMA5D2_SHDWC)
+
+	# Watchdog
+	$(call KCONFIG_ENABLE_OPT,CONFIG_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SAMA5D4_WATCHDOG)
+
+	# DMA and RTC
+	$(call KCONFIG_ENABLE_OPT,CONFIG_AT_XDMAC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_CLASS)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_DRV_AT91SAM9)
+
+	# Crypto hardware acceleration
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CRYPTO_DEV_ATMEL_AES)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CRYPTO_DEV_ATMEL_TDES)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CRYPTO_DEV_ATMEL_SHA)
+
+	# USB Host
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_HCD)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_OHCI_HCD)
+
+	# Regulators
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR_FIXED_VOLTAGE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR_MCP16502)
+
+	# NVMEM for OTP
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NVMEM_MICROCHIP_OTPC)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))

board/arm/microchip-sama7g54-ek/rootfs/etc/rauc/system.conf

@@ -0,0 +1,12 @@
+[system]
+compatible=infix-sama7g54-ek
+bootloader=uboot
+statusfile=/mnt/aux/rauc.status
+
+[slot.rootfs.0]
+device=/dev/disk/by-partlabel/primary
+bootname=primary
+
+[slot.rootfs.1]
+device=/dev/disk/by-partlabel/secondary
+bootname=secondary

board/arm/microchip-sama7g54-ek/rootfs/usr/share/product/microchip,sama7g5ek/etc/product/interface-quirks.json

@@ -0,0 +1,5 @@
+{
+    "@ethtool:driver=macb": {
+        "broken-flow-control": true
+    }
+}

board/arm/microchip-sama7g54-ek/uboot/emmc-extras.config

@@ -0,0 +1 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi sama7g54-ek-env-emmc.dtsi"

board/arm/microchip-sama7g54-ek/uboot/extras.config

@@ -0,0 +1,13 @@
+# Common U-Boot extras for SAMA7G54-EK
+CONFIG_EFI_PARTITION=y
+CONFIG_ENV_IMPORT_FDT=y
+CONFIG_FIT=y
+CONFIG_FIT_SIGNATURE=y
+CONFIG_RSA=y
+CONFIG_RSA_VERIFY=y
+CONFIG_BLKMAP=y
+CONFIG_LZ4=y
+CONFIG_LZMA=y
+CONFIG_CMD_UNLZ4=y
+CONFIG_CMD_UNZIP=y
+CONFIG_CMD_IMI=y

board/arm/microchip-sama7g54-ek/uboot/sama7g54-ek-env-emmc.dtsi

@@ -0,0 +1,19 @@
+/ {
+	config {
+		environment {
+			vendor = "Microchip";
+			bootcmd = "run ixboot";
+			boot_targets = "mmc0";
+			fdtfile = "microchip/at91-sama7g5ek.dtb";
+			fdt_addr_r = "0x62000000";
+			kernel_addr_r = "0x63000000";
+			scriptaddr = "0x68000000";
+			ramdisk_addr_r = "0x69000000";
+			ixbootdelay = "0.5";
+			bootdelay = "-2";
+			bootmenu_delay = "10";
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+			ixbtn-factory = "echo \"No button, use bootmenu\"";
+		};
+	};
+};

board/arm/microchip-sama7g54-ek/uboot/sama7g54-ek-env-sd.dtsi

@@ -0,0 +1,19 @@
+/ {
+	config {
+		environment {
+			vendor = "Microchip";
+			bootcmd = "run ixboot";
+			boot_targets = "mmc1";
+			fdtfile = "microchip/at91-sama7g5ek.dtb";
+			fdt_addr_r = "0x62000000";
+			kernel_addr_r = "0x63000000";
+			scriptaddr = "0x68000000";
+			ramdisk_addr_r = "0x69000000";
+			ixbootdelay = "0.5";
+			bootdelay = "-2";
+			bootmenu_delay = "10";
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+			ixbtn-factory = "echo \"No button, use bootmenu\"";
+		};
+	};
+};

board/arm/microchip-sama7g54-ek/uboot/sd-extras.config

@@ -0,0 +1 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi sama7g54-ek-env-sd.dtsi"

board/arm/raspberrypi-rpi2/Config.in

@@ -0,0 +1,14 @@
+config BR2_PACKAGE_RASPBERRYPI_RPI2
+	bool "Raspberry Pi 2 Model B (32-bit ARMv7)"
+	depends on BR2_arm
+	select SDCARD_AUX
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+	help
+	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
+	  (SBC) with BCM2836 quad-core Cortex-A7 processor.
+
+	  This was the only Raspberry Pi model with the BCM2836 and the rare
+	  RPi 2B board revision v1.2 actually got an underclocked BCM2837,
+	  which is the saem Cortex-A53 as the RPi3, but w/o wifi.

board/arm/raspberrypi-rpi2/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2025 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

board/arm/raspberrypi-rpi2/README.md

@@ -0,0 +1,95 @@
+Raspberry Pi 2 Model B
+======================
+
+The [Raspberry Pi 2 Model B][1] is a 32-bit ARM single-board computer,
+powered by the Broadcom BCM2836 quad-core Cortex-A7 processor @ 900 MHz
+with 1 GB RAM.
+
+The board features:
+
+- 4x USB 2.0 ports
+- Fast Ethernet (100 Mbps)
+- microSD card slot for storage
+- HDMI port
+- GPIO header (40-pin)
+
+> [!NOTE]
+> Revision 1.2 of the Pi 2B actually uses a BCM2837 (Cortex-A53) underclocked
+> and without WiFi, making it very similar to the Pi 3B hardware-wise but
+> running in 32-bit mode.  This revision is not supported.
+
+How to Build
+------------
+
+Since there are no pre-built images for ARM 32-bit, you need to build both
+Infix and the bootloader from source.
+
+1. Clone the repository
+
+        git clone https://github.com/kernelkit/infix.git
+        cd infix
+
+2. Build the bootloader (in separate tree)
+
+        make O=x-boot rpi2_boot_defconfig
+        make O=x-boot
+
+3. Build Infix (in another tree)
+
+        make O=x-arm arm_defconfig
+        make O=x-arm
+
+4. Create the SD card image
+
+        ./utils/mkimage.sh -b x-boot -r x-arm raspberrypi-rpi2
+
+The resulting image can be found in `x-boot/images/infix-arm-sdcard.img`
+
+Flashing to SD Card
+-------------------
+
+[Flash the image][0] to a microSD card (at least 4 GB):
+
+```bash
+sudo dd if=x-boot/images/infix-arm-sdcard.img of=/dev/mmcblk0 \
+        bs=1M status=progress oflag=direct
+```
+
+You can also use `bmaptool`:
+
+```bash
+sudo bmaptool copy x-boot/images/infix-rpi2-sdcard.img /dev/mmcblk0
+```
+
+> [!WARNING]
+> Ensure `/dev/mmcblk0` is the correct device for your SD card and not used by
+> the host system! Use `lsblk` to verify.
+
+Booting the Board
+-----------------
+
+1. Insert the flashed SD card into the Raspberry Pi
+2. Connect an Ethernet cable (DHCP will be used to get an IP address)
+3. Power up the board using a 5V/2.5A micro-USB power supply
+
+The board will boot and obtain an IP address via DHCP on the Ethernet port.
+Find the assigned IP and SSH in with the default login credentials, user/pass:
+`admin` / `admin`.
+
+Console Port (Optional)
+-----------------------
+
+A serial console can be useful for debugging. Connect a USB-to-TTL
+serial adapter (3.3V) to GPIO pins:
+
+- GND → Pin 6, ground
+- TxD → Pin 8, GPIO 14
+- RxD → Pin 10, GPIO 15
+
+Serial settings: 115200 8N1
+
+> [!WARNING]
+> Use only 3.3V serial adapters. 5V adapters will damage your Raspberry Pi!
+
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.raspberrypi.com/products/raspberry-pi-2-model-b/

board/arm/raspberrypi-rpi2/barebox/env/boot/mmc

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+mkdir /mnt/primary
+mount /dev/disk0.primary /mnt/primary
+
+global.bootm.image="/mnt/primary/boot/zImage"
+global.bootm.oftree="/mnt/primary/boot/broadcom/bcm2836-rpi-2-b.dtb"
+global.linux.bootargs.base="quiet console=ttyAMA0,115200 console=tty1 rauc.slot=primary"
+global.linux.bootargs.dyn.root="root=PARTLABEL=primary rootwait ro"
+
+bootm

board/arm/raspberrypi-rpi2/barebox/env/config

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# Barebox configuration for Raspberry Pi 2
+
+# Boot timeout (seconds)
+global autoboot_timeout=3
+
+# Default boot order
+global boot.default="mmc net"
+
+# Enable colored output if supported
+global allow_color=true

board/arm/raspberrypi-rpi2/barebox/env/init/automount

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# Automount MMC partitions
+mkdir -p /mnt/mmc
+automount /mnt/mmc 'mci0.probe=1 && mount /dev/disk0.0 /mnt/mmc'

board/arm/raspberrypi-rpi2/barebox/env/init/bootorder

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+# Set boot order: try mmc first, then network
+global.boot.default="mmc net"

board/arm/raspberrypi-rpi2/barebox/extras.config

@@ -0,0 +1,17 @@
+# Minimal Barebox configuration for Raspberry Pi 2
+# Basic boot only - A/B partitioning and secure boot to be added later
+
+# Enable custom embedded environment
+CONFIG_DEFAULT_ENVIRONMENT=y
+CONFIG_DEFAULT_ENVIRONMENT_GENERIC_NEW=y
+
+# Enable GPT partition table support for hybrid partition tables
+CONFIG_PARTITION_DISK_EFI=y
+
+# Enable SquashFS support for reading rootfs
+CONFIG_FS_SQUASHFS=y
+CONFIG_FS_SQUASHFS_LZ4=y
+CONFIG_FS_SQUASHFS_LZO=y
+CONFIG_FS_SQUASHFS_XZ=y
+CONFIG_FS_SQUASHFS_ZLIB=y
+CONFIG_FS_SQUASHFS_ZSTD=y

board/arm/raspberrypi-rpi2/cmdline.txt

@@ -0,0 +1 @@
+root=/dev/mmcblk0p2 rootwait console=tty1 console=ttyAMA0,115200

board/arm/raspberrypi-rpi2/config.txt

@@ -0,0 +1,19 @@
+# Raspberry Pi bootloader (start.elf) configuration
+#
+# uart_2ndstage=1 - Enable early boot debug output from the bootloader
+#                   Useful for debugging boot failures before Barebox starts
+#                   Comment out for production to reduce boot noise
+
+[all]
+kernel=barebox-raspberry-pi-2.img
+
+disable_overscan=1
+
+enable_uart=1
+#uart_2ndstage=1
+
+[pi2]
+start_file=start.elf
+fixup_file=fixup.dat
+
+gpu_mem=100

board/arm/raspberrypi-rpi2/dts/Makefile

@@ -0,0 +1 @@
+dtb-y += broadcom/bcm2836-rpi-2-b.dtb

board/arm/raspberrypi-rpi2/dts/broadcom/Makefile

@@ -0,0 +1 @@
+# Placeholder - dtb-y is defined in parent Makefile

board/arm/raspberrypi-rpi2/dts/broadcom/bcm2836-rpi-2-b.dts

@@ -0,0 +1,19 @@
+#include <arm/broadcom/bcm2836-rpi-2-b.dts>
+#include "infix.dtsi"
+
+/ {
+	/* CMA pool for GPU and video */
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		cma-reserved {
+			compatible = "shared-dma-pool";
+			size = <0x4000000>; /* 64MB */
+			alignment = <0x1000000>; /* 16MB aligned */
+			linux,cma-default;
+			reusable;
+		};
+	};
+};

board/arm/raspberrypi-rpi2/dts/broadcom/infix.dtsi

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Common Infix OS defaults
+ */
+
+/ {
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+	};
+};

board/arm/raspberrypi-rpi2/genimage.cfg.in

@@ -0,0 +1,78 @@
+image boot.vfat {
+	vfat {
+		files = {
+#BOOT_FILES#
+		}
+	}
+
+	size = 32M
+}
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
+	ext4 {
+		label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
+image var.ext4 {
+	empty = true
+	temporary = true
+	size = 128M
+
+	ext4 {
+		label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+image #INFIX_ID##VERSION#-rpi2-sdcard.img {
+	hdimage {
+		partition-table-type = "hybrid"
+	}
+
+	partition boot {
+		partition-type = 0xc
+		bootable = "true"
+		image = "boot.vfat"
+	}
+
+	partition aux {
+		partition-type-uuid = srv
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		partition-type-uuid = linux
+		bootable = "true"
+		size = 250M
+		image = "rootfs.squashfs"
+	}
+
+	partition secondary {
+		partition-type-uuid = linux
+		bootable = "true"
+		size = 250M
+		image = "rootfs.squashfs"
+	}
+
+	partition cfg {
+		partition-type-uuid = srv
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		partition-type-uuid = var
+		image = "var.ext4"
+	}
+}

board/arm/raspberrypi-rpi2/raspberrypi-rpi2.mk

@@ -0,0 +1,61 @@
+# Raspberry Pi 2 Model B specific kernel configuration
+define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SOUND)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_KEYBOARD)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_TOUCHSCREEN)
+	$(call KCONFIG_SET_OPT,CONFIG_INPUT_MOUSEDEV,m)
+	$(call KCONFIG_SET_OPT,CONFIG_HID_GENERIC,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
+	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_MBOX,y)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DMA_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_BCM2835)
+	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
+	$(call KCONFIG_SET_OPT,CONFIG_I2C_BCM2835,m)
+	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_THERMAL,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_BCM2835AUX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
+	$(call KCONFIG_SET_OPT,CONFIG_SMSC911X,y)
+	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,y)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_KMS_HELPER)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_V3D,m)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_VC4,m)
+	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_VC4_HDMI_CEC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_LOAD_EDID_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_PANEL_BRIDGE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_BRIDGE)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_TOSHIBA_TC358762,m)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_PANEL_SIMPLE,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_FBDEV_EMULATION)
+
+	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))

board/arm/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg

@@ -0,0 +1,283 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "eth0",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Raspberry Pi 2 Model B"
+              }
+            ]
+          }
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "rpi-%m",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          },
+          "iburst": true
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  }
+}

board/arm/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/product/interface-quirks.json

@@ -0,0 +1,8 @@
+{
+    "eth0": {
+	"phy-detached-when-down": true
+    },
+    "@ethtool:driver=smsc95xx": {
+        "broken-flow-control": true
+    }
+}

board/arm/raspberrypi-rpi2/uboot/extras.config

@@ -0,0 +1,13 @@
+# CONFIG_MMC_PCI is not set
+CONFIG_OF_OVERLAY_LIST="rpi-env infix-key"
+# CONFIG_ENV_IS_IN_FAT is not set
+
+# Increase early malloc heap to handle DTB with embedded scripts
+CONFIG_SYS_MALLOC_F_LEN=0x2000
+
+# Compression support needed for SquashFS
+CONFIG_LZ4=y
+CONFIG_LZMA=y
+CONFIG_CMD_LZMADEC=y
+CONFIG_CMD_UNLZ4=y
+CONFIG_CMD_UNZIP=y