uboot: import first variable from auxiliary environment

The U-Boot env file is generated by mkenvimage, which prefixes the variable data with a 4-byte CRC32 by default. ixpreboot.sh previously imported it with `env import -b` as per uboot docs(-b assume binary format (’0’ separated, “00” terminated).), which treats the buffer as raw binary and does not strip the CRC. As a result the first variable's name is parsed a part of CRC. Later variables import correctly because by then the parser is past the CRC. Switching to `env import -c` as per uboot docs (-c assume checksum protected environment format.) makes U-Boot validate and strip the CRC before parsing, so the first variable imports under its real name. Tested on: - QEMU Signed-off-by: Ejub Sabic <ejub1946@outlook.com>
2026-07-22 17:23:00 +02:00 · 2026-06-16 07:29:29 +02:00
449 changed files with 3723 additions and 16517 deletions
@@ -27,17 +27,10 @@ Pull Requests
 Releases
 --------

-Recommended checkpoints, use at your own discretion:
-
 - Make at least one -betaN release to verify the GitHub workflow well in time release day
   - Stuff happens, remember kernelkit/infix#735
 - Make at least one -rcN to flush out any issues in customer repos
   - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
- - Verify release artifacts (checksums, completeness, no corrupted files)
- - Test on actual hardware for at least one architecture
- - Review ChangeLog for completeness
- - Check for release-blocking issues
- - Verify generated GNS3 appliance, no marketplace update on -rc builds
 - Ensure the markdown link for the release diff is updated
 - Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
 - Sync tags for all repo. sync activities
@@ -1,215 +0,0 @@
-name: bitSign Infix Release
-
-on:
-  workflow_dispatch:
-    inputs:
-      release_version:
-        description: 'Release version (e.g., v25.08.0)'
-        required: true
-        type: string
-  push:
-    branches: [ sign-with-bitsign ]
-
-jobs:
-  sign-infix-release:
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-
-    - name: Validate release version format
-      id: validate
-      run: |
-        # Use default version for push events, input version for manual dispatch
-        if [ "${{ github.event_name }}" = "push" ]; then
-          VERSION="v25.08.0"
-          echo "Using default version for push trigger: $VERSION"
-        else
-          VERSION="${{ inputs.release_version }}"
-          echo "Using input version for manual trigger: $VERSION"
-        fi
-
-        # Check if version starts with 'v' and has proper format
-        if ! echo "$VERSION" | grep -qE '^v[0-9]+\.[0-9]+(\.[0-9]+)?(-alpha[0-9]*|-beta[0-9]*|-rc[0-9]*)?$'; then
-          echo "❌ Invalid version format. Expected format: vYY.MM(.PP)(-alphaN|-betaN|-rcN)"
-          echo "Examples: v25.08.0, v25.08.0-alpha1, v25.08.0-rc1"
-          exit 1
-        fi
-
-        # Extract version without 'v' prefix for filename
-        FILE_VERSION="${VERSION#v}"
-        FILENAME="infix-x86_64-${FILE_VERSION}.tar.gz"
-        RELEASE_URL="https://github.com/kernelkit/infix/releases/download/${VERSION}/${FILENAME}"
-
-        echo "✅ Version format valid"
-        echo "file_version=${FILE_VERSION}" >> $GITHUB_OUTPUT
-        echo "filename=${FILENAME}" >> $GITHUB_OUTPUT
-        echo "release_url=${RELEASE_URL}" >> $GITHUB_OUTPUT
-
-    - name: Download Infix release
-      run: |
-        RELEASE_URL="${{ steps.validate.outputs.release_url }}"
-        FILENAME="${{ steps.validate.outputs.filename }}"
-
-        echo "Downloading Infix release: $FILENAME"
-        echo "From: $RELEASE_URL"
-
-        if ! curl -L "$RELEASE_URL" -o "$FILENAME" --fail --show-error --progress-bar; then
-          echo "❌ Failed to download release file from: $RELEASE_URL"
-          echo "Please verify that the release version exists and contains the x86_64 build."
-          echo "You can check available releases at: https://github.com/kernelkit/infix/releases"
-          exit 1
-        fi
-
-        # Verify download
-        if [ -f "$FILENAME" ] && [ -s "$FILENAME" ]; then
-          FILE_SIZE=$(ls -lh "$FILENAME" | awk '{print $5}')
-          echo "✅ Successfully downloaded: $FILENAME ($FILE_SIZE)"
-        else
-          echo "❌ Failed to download release file"
-          exit 1
-        fi
-
-    - name: Create signing request
-      id: create_request
-      run: |
-        FILENAME="${{ steps.validate.outputs.filename }}"
-        FILE_VERSION="${{ steps.validate.outputs.file_version }}"
-        RELEASE="infix-x86_64-${FILE_VERSION}"
-
-        echo "Creating signing request for $FILENAME..."
-        echo "RELEASE parameter: $RELEASE"
-
-        # Create signing request using bitSign API
-        RESPONSE=$(curl -s -X POST "https://portal.bitsign.se/api/v1/requests" \
-          -H "Authorization: Bearer ${{ secrets.BITSIGN_API_KEY }}" \
-          -F "file=@$FILENAME" \
-          -F "key=bit42-Demo1" \
-          -F "job=Infix-x86" \
-          -F "parameters={\"RELEASE\": \"$RELEASE\"}")
-
-        echo "API Response: $RESPONSE"
-
-        # Check if request was successful
-        if echo "$RESPONSE" | jq -e '.success == true' > /dev/null; then
-          REQUEST_ID=$(echo "$RESPONSE" | jq -r '.requestId')
-          echo "✅ Request created successfully with ID: $REQUEST_ID"
-          echo "request_id=$REQUEST_ID" >> $GITHUB_OUTPUT
-        else
-          echo "❌ Failed to create signing request"
-          echo "$RESPONSE" | jq -r '.error // .message // "Unknown error"'
-          exit 1
-        fi
-
-    - name: Wait for signing completion
-      id: wait_completion
-      run: |
-        REQUEST_ID="${{ steps.create_request.outputs.request_id }}"
-        echo "Waiting for signing completion for request: $REQUEST_ID"
-
-        # Poll status for up to 10 minutes (600 seconds) - longer timeout for larger files
-        MAX_WAIT=600
-        WAITED=0
-
-        while [ $WAITED -lt $MAX_WAIT ]; do
-          RESPONSE=$(curl -s -X GET "https://portal.bitsign.se/api/v1/requests/$REQUEST_ID/status" \
-            -H "Authorization: Bearer ${{ secrets.BITSIGN_API_KEY }}")
-
-          STATUS=$(echo "$RESPONSE" | jq -r '.status')
-          echo "Current status: $STATUS (waited ${WAITED}s)"
-
-          if [ "$STATUS" = "completed" ]; then
-            echo "✅ Signing completed successfully!"
-            break
-          elif [ "$STATUS" = "failed" ]; then
-            echo "❌ Signing failed"
-            echo "$RESPONSE" | jq -r '.error // .message // "Unknown error"'
-            exit 1
-          fi
-
-          sleep 10
-          WAITED=$((WAITED + 10))
-        done
-
-        if [ $WAITED -ge $MAX_WAIT ]; then
-          echo "❌ Timeout: Signing did not complete within ${MAX_WAIT} seconds"
-          exit 1
-        fi
-
-    - name: Download signed file
-      id: download_signed
-      run: |
-        REQUEST_ID="${{ steps.create_request.outputs.request_id }}"
-        FILENAME="${{ steps.validate.outputs.filename }}"
-        FILE_VERSION="${{ steps.validate.outputs.file_version }}"
-        SIGNED_FILENAME="infix-x86_64-${FILE_VERSION}-signed.tar.gz"
-
-        echo "Downloading signed file for request: $REQUEST_ID"
-        echo "Expected signed filename: $SIGNED_FILENAME"
-
-        # Download the signed file
-        curl -X GET "https://portal.bitsign.se/api/v1/requests/$REQUEST_ID/download" \
-          -H "Authorization: Bearer ${{ secrets.BITSIGN_API_KEY }}" \
-          -o "$SIGNED_FILENAME" \
-          --fail --show-error
-
-        if [ -f "$SIGNED_FILENAME" ] && [ -s "$SIGNED_FILENAME" ]; then
-          FILE_SIZE=$(ls -lh "$SIGNED_FILENAME" | awk '{print $5}')
-          echo "Successfully downloaded signed file: $SIGNED_FILENAME ($FILE_SIZE)"
-          echo "signed_filename=$SIGNED_FILENAME" >> $GITHUB_OUTPUT
-
-          # Calculate SHA256 checksums for both files
-          ORIGINAL_SHA256=$(sha256sum "$FILENAME" | cut -d' ' -f1)
-          SIGNED_SHA256=$(sha256sum "$SIGNED_FILENAME" | cut -d' ' -f1)
-          echo "original_sha256=$ORIGINAL_SHA256" >> $GITHUB_OUTPUT
-          echo "signed_sha256=$SIGNED_SHA256" >> $GITHUB_OUTPUT
-        else
-          echo "Failed to download signed file"
-          exit 1
-        fi
-
-    - name: Upload signed artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: signed-infix-${{ steps.validate.outputs.file_version }}
-        path: ${{ steps.download_signed.outputs.signed_filename }}
-        retention-days: 90
-
-    - name: Summary
-      run: |
-        # Determine the actual version used (could be from push or input)
-        if [ "${{ github.event_name }}" = "push" ]; then
-          ACTUAL_VERSION="v25.08.0"
-        else
-          ACTUAL_VERSION="${{ inputs.release_version }}"
-        fi
-
-        cat >> $GITHUB_STEP_SUMMARY << EOF
-        # bitSign Infix Release Signing Complete
-
-        The Infix release has been successfully signed using the bitSign API.
-
-        ## Signing Details
-
-        | Property | Value |
-        |----------|-------|
-        | 📦 **Original File** | \`${{ steps.validate.outputs.filename }}\` (\`${{ steps.download_signed.outputs.original_sha256 }}\`) |
-        | ✍️ **Signed File** | \`${{ steps.download_signed.outputs.signed_filename }}\` (\`${{ steps.download_signed.outputs.signed_sha256 }}\`) |
-        | 🔑 **Signing Key** | \`bit42-Demo1\` |
-        | ⚙️ **Job Type** | \`Infix-x86\` |
-        | 🆔 **Request ID** | \`${{ steps.create_request.outputs.request_id }}\` |
-        | 📋 **Release Version** | \`\$ACTUAL_VERSION\` |
-        | 🌐 **API Endpoint** | \`portal.bitsign.se\` |
-
-        ## Download Files
-
-        > **The signed release file is available as a workflow artifact:**
-        > **\`signed-infix-${{ steps.validate.outputs.file_version }}\`**
-        >
-        > The artifact contains the signed file: \`${{ steps.download_signed.outputs.signed_filename }}\`
-
-        ---
-
-        **Next Steps:** The signed release can now be distributed with cryptographic verification of authenticity.
-        EOF
@@ -16,12 +16,11 @@ jobs:
      fail-fast: false
      matrix:
        defconfig:
-          - aarch64_qemu_boot
-          - bpi_r3_boot
-          - cn9130_crb_boot
          - fireant_boot
-          - nanopi_r2s_boot
-          - rpi64_boot
+          - cn9130_crb_boot
+          - aarch64_qemu_boot
+          - rpi4_boot
+          - mt7986_sd_boot
    env:
      MAKEFLAGS: -j5
    steps:
@@ -8,10 +8,9 @@ on:
        type: choice
        required: true
        options:
-          - raspberrypi-rpi64
-          - bananapi-bpi-r3
-          - friendlyarm-nanopi-r2s
-        default: 'raspberrypi-rpi64'
+          - raspberry-pi-4
+          - banana-pi-r3
+        default: 'raspberry-pi-4'
      use_latest_release:
        description: 'Use latest release artifacts instead of workflow artifacts'
        type: boolean
@@ -53,16 +52,12 @@ jobs:
      - name: Set bootloader and target based on board
        run: |
          case "${{ inputs.board }}" in
-            raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
+            raspberry-pi-4)
+              echo "BOOTLOADER=rpi4_boot" >> $GITHUB_ENV
              echo "TARGET=aarch64" >> $GITHUB_ENV
              ;;
-            bananapi-bpi-r3)
-              echo "BOOTLOADER=bpi_r3_boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
-              ;;
-            friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
+            banana-pi-r3)
+              echo "BOOTLOADER=mt7986_sd_boot" >> $GITHUB_ENV
              echo "TARGET=aarch64" >> $GITHUB_ENV
              ;;
            *)
@@ -149,7 +144,19 @@ jobs:
          export BR2_EXTERNAL_INFIX_PATH=$PWD
          export RELEASE=""
          export INFIX_ID="infix"
-          ./utils/mkimage.sh ${{ inputs.board }}
+
+          # Use the standardized mkimage.sh path for the selected board
+          #          BOARD_SCRIPT="src/board/${{ inputs.board }}/mkimage.sh"
+          BOARD_SCRIPT="src/board/${{ inputs.board }}/mkimage.sh"
+
+          if [ -f "$BOARD_SCRIPT" ]; then
+            echo "Using board-specific image creation script: $BOARD_SCRIPT"
+            chmod +x "$BOARD_SCRIPT"
+            "$BOARD_SCRIPT"
+          else
+            echo "Error: Board script $BOARD_SCRIPT not found!"
+            exit 1
+          fi

      - name: Verify created image
        run: |
@@ -176,7 +183,7 @@ jobs:
        with:
          name: sdcard-image-${{ inputs.board }}-${{ env.BOOTLOADER }}
          path: |
-            output/images/*-sdcard.img*
+            output/images/*-sdcard.img
          retention-days: 30

      - name: Create checksums
@@ -211,7 +218,7 @@ jobs:
          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}

          ## Created Images
-          $(find output/images/ -name "*.img*" -o -name "*.qcow2" -o -name "*.raw" | xargs ls -lh 2>/dev/null | sed 's/^/- /' || echo "- No images found")
+          $(find output/images/ -name "*.img" -o -name "*.qcow2" -o -name "*.raw" | xargs ls -lh 2>/dev/null | sed 's/^/- /' || echo "- No images found")

          ## Download
          The SD card image is available as a workflow artifact above.
@@ -1,102 +0,0 @@
-name: Build Release
-
-on:
-  workflow_call:
-    inputs:
-      version:
-        required: true
-        type: string
-      use_cache:
-        required: false
-        type: boolean
-        default: true
-
-jobs:
-  build:
-    name: Build Infix ${{ inputs.version }} [${{ matrix.target }}]
-    runs-on: [self-hosted, release]
-    strategy:
-      matrix:
-        target: [aarch64, x86_64]
-      fail-fast: false
-    steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
-      - uses: actions/checkout@v4
-        with:
-          clean: true
-          submodules: recursive
-
-      - name: Set Release Variables
-        id: vars
-        run: |
-          ver=${{ inputs.version }}
-          echo "ver=${ver}" >> $GITHUB_OUTPUT
-          fver=${ver#v}
-          target=${{ matrix.target }}-${fver}
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-
-      - name: Restore Cache of dl/
-        if: ${{ inputs.use_cache }}
-        uses: actions/cache@v4
-        with:
-          path: dl/
-          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-
-
-      - name: Restore Cache of .ccache/
-        if: ${{ inputs.use_cache }}
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-${{ matrix.target }}-
-            ccache-
-
-      - name: Configure & Build
-        env:
-          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
-        run: |
-          target=${{ matrix.target }}_defconfig
-          echo "Building $target ..."
-          make $target
-          make
-
-      - name: Generate SBOM from Build
-        run: |
-          make legal-info
-
-      - name: Build test specification
-        run: |
-          make test-spec
-
-      - name: Prepare Artifacts
-        run: |
-          cd output/
-          mv images ${{ steps.vars.outputs.dir }}
-          ln -s ${{ steps.vars.outputs.dir }} images
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
-
-          mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: artifact-${{ matrix.target }}
-          path: output/*.tar.gz
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: artifact-disk-image-${{ matrix.target }}
-          path: output/images/*.qcow2
@@ -35,7 +35,7 @@ on:
      parallel:
        required: false
        type: boolean
-        default: true
+        default: false

 env:
  NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
@@ -59,15 +59,6 @@ jobs:
          rm -rf ./* || true
          rm -rf ./.??* || true
          ls -la ./
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true

      - name: Checkout infix repo
        uses: actions/checkout@v4
@@ -119,11 +110,6 @@ jobs:
        run: |
          make ${{ env.TARGET }}_defconfig

-      - name: Cleanup stale containers and ports
-        run: |
-          podman rm -af || true
-          pkill -9 -f rootlessport || true
-
      - name: Unit Test ${{ env.TARGET }}
        run: |
          make test-unit
@@ -1,115 +0,0 @@
-name: Check Kernel 6.12 Release
-
-on:
-  workflow_dispatch: # Allow manual triggering
-
-jobs:
-  check-kernel:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out infix repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
-
-      - name: Check out linux repository
-        uses: actions/checkout@v4
-        with:
-          repository: kernelkit/linux
-          path: linux
-          fetch-depth: 0
-          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
-
-      - name: Fetch kernel.org and check for 6.12 release
-        id: check
-        run: |
-          set -e -o pipefail
-          # Fetch the kernel.org frontpage and extract 6.12 version
-          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)
-
-          if [ -z "$CURRENT_VERSION" ]; then
-            echo "Failed to fetch kernel version"
-            exit 1
-          fi
-
-          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          echo "Current 6.12 kernel version: $CURRENT_VERSION"
-
-          # Get the latest tag from our linux tree
-          cd linux
-          git fetch origin
-          LATEST_TAG=$(git tag -l "v6.12.*" | sort -V | tail -n1 | sed 's/^v//')
-          cd ..
-
-          echo "latest_tag=$LATEST_TAG" >> $GITHUB_OUTPUT
-          echo "Latest tag in our tree: $LATEST_TAG"
-
-          if [ "$CURRENT_VERSION" != "$LATEST_TAG" ]; then
-            echo "new_release=true" >> $GITHUB_OUTPUT
-            echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (our version: $LATEST_TAG)"
-          else
-            echo "new_release=false" >> $GITHUB_OUTPUT
-            echo "No change - still at $CURRENT_VERSION"
-          fi
-
-      - name: Set up git credentials
-        if: steps.check.outputs.new_release == 'true'
-        run: |
-          set -e -o pipefail
-          git config --global user.email "ael-bot@users.noreply.github.com"
-          git config --global user.name "ael-bot"
-
-          # Configure git to use the token for HTTPS operations
-          git config --global url."https://ael-bot:${{ secrets.KERNEL_UPDATE_TOKEN }}@github.com/".insteadOf "git@github.com:"
-          git config --global url."https://ael-bot:${{ secrets.KERNEL_UPDATE_TOKEN }}@github.com/".insteadOf "https://github.com/"
-
-      - name: Run kernel upgrade script
-        if: steps.check.outputs.new_release == 'true'
-        env:
-          GIT_TERMINAL_PROMPT: 0
-        run: |
-          set -e -o pipefail
-          ./utils/kernel-upgrade.sh linux
-
-      - name: Create pull request
-        if: steps.check.outputs.new_release == 'true'
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
-          script: |
-            // Check if PR already exists
-            const { data: pulls } = await github.rest.pulls.list({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              head: `${context.repo.owner}:kernel-upgrade`,
-              state: 'open'
-            });
-
-            if (pulls.length === 0) {
-              const { data: pr } = await github.rest.pulls.create({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                title: `Upgrade to kernel ${{ steps.check.outputs.current_version }}`,
-                head: 'kernel-upgrade',
-                base: 'main',
-                body: `Automated kernel upgrade to version ${{ steps.check.outputs.current_version }}.\n\n**Previous version:** ${{ steps.check.outputs.latest_tag }}\n**New version:** ${{ steps.check.outputs.current_version }}\n**Source:** https://www.kernel.org/\n\nThis PR was automatically created by the kernel release monitoring workflow.`
-              });
-
-              // Add label
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pr.number,
-                labels: ['ci:main']
-              });
-
-              // Request reviews
-              await github.rest.pulls.requestReviewers({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                pull_number: pr.number,
-                reviewers: ['troglobit', 'wkz', 'mattiaswal']
-              });
-            }
@@ -41,7 +41,6 @@ jobs:
          pipx inject mkdocs mkdocs-callouts
          pipx inject mkdocs mike
          pipx inject mkdocs mkdocs-to-pdf
-          pipx inject mkdocs mkdocs-glightbox
          # Workaround, if pipx inject fails to install symlink
          ln -s "$(pipx environment -V PIPX_LOCAL_VENVS)/mkdocs/bin/mike" \
                "$(pipx environment -V PIPX_BIN_DIR)/mike" || true
@@ -10,17 +10,6 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - name: Free Disk Space
-        uses: jlumbroso/free-disk-space@main
-        with:
-          tool-cache: true
-          android: true
-          dotnet: true
-          haskell: true
-          large-packages: true
-          docker-images: true
-          swap-storage: false
-
      - name: Install build dependencies
        run: |
          sudo apt-get update
@@ -18,46 +18,96 @@ on:
        type: string

 jobs:
-  set-version:
+  build:
    if: github.repository == 'kernelkit/infix' && startsWith(github.ref, 'refs/tags/')
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.set-ver.outputs.version }}
+    name: Build Infix ${{ github.ref_name }} [${{ matrix.target }}]
+    runs-on: [ self-hosted, release ]
+    strategy:
+      matrix:
+        target: [aarch64, x86_64]
+      fail-fast: false
    steps:
-      - id: set-ver
+      - uses: actions/checkout@v4
+        with:
+          clean: true
+          submodules: recursive
+
+      - name: Set Release Variables
+        id: vars
        run: |
          if [ -n "${{ inputs.version }}" ]; then
              ver=${{ inputs.version }}
          else
              ver=${GITHUB_REF#refs/tags/}
          fi
-          echo "version=${ver}" >> $GITHUB_OUTPUT
+          echo "ver=${ver}" >> $GITHUB_OUTPUT
+          fver=${ver#v}
+          target=${{ matrix.target }}-${fver}
+          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT

-  build:
-    needs: set-version
-    uses: ./.github/workflows/build-release.yml
-    with:
-      version: ${{ needs.set-version.outputs.version }}
-      use_cache: true
+      - name: Restore Cache of dl/
+        uses: actions/cache@v4
+        with:
+          path: dl/
+          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-
+
+      - name: Restore Cache of .ccache/
+        uses: actions/cache@v4
+        with:
+          path: .ccache/
+          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-${{ matrix.target }}-
+            ccache-
+
+      - name: Configure & Build
+        env:
+          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
+        run: |
+          target=${{ matrix.target }}_defconfig
+          echo "Building $target ..."
+          make $target
+          make
+
+      - name: Generate SBOM from Build
+        run: |
+          make legal-info
+
+      - name: Build test specification
+        run: |
+          make test-spec
+
+      - name: Prepare Artifacts
+        run: |
+          cd output/
+          mv images ${{ steps.vars.outputs.dir }}
+          ln -s ${{ steps.vars.outputs.dir }} images
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+
+          mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-${{ matrix.target }}
+          path: output/*.tar.gz
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-disk-image-${{ matrix.target }}
+          path: output/images/*.qcow2

  release:
    name: Release Infix ${{ github.ref_name }}
    needs: build
-    runs-on: [self-hosted, release]
+    runs-on: [ self-hosted, release ]
    permissions:
      contents: write
      discussions: write
    steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
      - uses: actions/checkout@v4
        with:
          submodules: 'true'
@@ -106,9 +156,6 @@ jobs:
        run: |
          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
              |head -n -1 > release.md
-          echo "" >> release.md
-          echo "> [!TIP]" >> release.md
-          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
          cat release.md

      - uses: ncipollo/release-action@v1
@@ -41,16 +41,6 @@ jobs:
    name: Regression Test ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
    runs-on: [self-hosted, regression]
    steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
      - name: Checkout infix repo
        uses: actions/checkout@v4
        with:
@@ -100,8 +90,7 @@ jobs:
      - name: Publish Test Result for ${{ env.TARGET }}
        # Ensure this runs even if Regression Test fails
        if: always()
-        run: |
-          cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY

      - name: Generate Test Report for ${{ env.TARGET }}
        # Ensure this runs even if Regression Test fails
@@ -14,62 +14,29 @@ concurrency:
  cancel-in-progress: true

 jobs:
-  # Gate all builds through this check to prevent wasted runs.  Only run on
-  # 'labeled' events when the label is actually 'ci:main'.  Concurrency control
-  # above handles canceling the 'opened' event when 'labeled' arrives quickly
-  # after (e.g., when creating a PR with ci:main already attached). See #1154.
-  check-trigger:
-    if: |
-      startsWith(github.repository, 'kernelkit/') &&
-      (github.event_name != 'pull_request' ||
-       github.event.action != 'labeled' ||
-       github.event.label.name == 'ci:main')
-    runs-on: ubuntu-latest
-    outputs:
-      x86_64_target: ${{ steps.set-targets.outputs.x86_64_target }}
-      aarch64_target: ${{ steps.set-targets.outputs.aarch64_target }}
-    steps:
-      - run: |
-          echo "Triggering build, logging meta data ..."
-          echo "Event  : ${{ github.event_name }}"
-          echo "Action : ${{ github.event.action }}"
-          echo "Ref    : ${{ github.ref }}"
-          echo "PR     : ${{ github.event.pull_request.number }}"
-          echo "Label  : ${{ github.event.label.name }}"
-      - id: set-targets
-        run: |
-          if [[ "${{ github.event_name }}" == "pull_request" ]] &&           \
-             ! echo '${{ toJSON(github.event.pull_request.labels.*.name) }}' \
-             | grep -q "ci:main"; then
-            echo "x86_64_target=x86_64_minimal" >> $GITHUB_OUTPUT
-            echo "aarch64_target=aarch64_minimal" >> $GITHUB_OUTPUT
-          else
-            echo "x86_64_target=x86_64" >> $GITHUB_OUTPUT
-            echo "aarch64_target=aarch64" >> $GITHUB_OUTPUT
-          fi
-
  build-x86_64:
-    needs: check-trigger
+    if: startsWith(github.repository, 'kernelkit/')
    uses: ./.github/workflows/build.yml
    with:
      name: "infix"
-      target: ${{ needs.check-trigger.outputs.x86_64_target }}
+      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}

  build-aarch64:
-    needs: check-trigger
+    if: startsWith(github.repository, 'kernelkit/')
    uses: ./.github/workflows/build.yml
    with:
      name: "infix"
-      target: ${{ needs.check-trigger.outputs.aarch64_target }}
+      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'aarch64_minimal' || 'aarch64' }}

  test-run-x86_64:
-    needs: [check-trigger, build-x86_64]
+    if: startsWith(github.repository, 'kernelkit/')
+    needs: build-x86_64
    uses: ./.github/workflows/test.yml
    with:
-      target: ${{ needs.check-trigger.outputs.x86_64_target }}
+      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
      name: "infix"

  test-publish-x86_64:
-    if: ${{ github.repository_owner == 'kernelkit' && github.ref_name == 'main' }}
+    if: startsWith(github.repository, 'kernelkit/')
    needs: test-run-x86_64
    uses: ./.github/workflows/publish.yml
@@ -1,68 +0,0 @@
-# Weekly release build to catch flaky tests and verify clean builds.
-# Runs without caches (ccache) to ensure reproducibility. See issue #1003.
-name: Weekly Build
-
-on:
-  schedule:
-    - cron: '5 0 * * 6'  # Saturday at 00:05 UTC, same as Coverity
-  workflow_dispatch:
-
-jobs:
-  build:
-    if: github.repository == 'kernelkit/infix'
-    uses: ./.github/workflows/build-release.yml
-    with:
-      version: "latest"
-      use_cache: false
-
-  publish:
-    name: Publish Weekly Build
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums
-        run: |
-          for file in *.tar.gz; do
-            sha256sum $file > $file.sha256
-          done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi
-
-      - uses: ncipollo/release-action@v1
-        with:
-          tag: latest
-          name: "Latest Weekly Build"
-          prerelease: true
-          makeLatest: false
-          allowUpdates: true
-          removeArtifacts: true
-          body: |
-            Automated weekly build from `${{ github.sha }}`.
-
-            This build runs without caches to catch potential flaky tests and build issues.
-            Not intended for production use - use official releases instead.
-
-            **Commit:** ${{ github.sha }}
-            **Built:** ${{ github.run_id }}
-          artifacts: "*.tar.gz*,*.qcow2*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Weekly Build Published! :package:
-
-          Latest artifacts uploaded to:
-           <https://github.com/kernelkit/infix/releases/tag/latest>
-
-          Built from commit: \`${{ github.sha }}\`
-          EOF
@@ -1,5 +1,3 @@
-source "$BR2_EXTERNAL_INFIX_PATH/board/Config.in"
-
 menu "Branding"

 config INFIX_VENDOR
@@ -1,6 +1,6 @@
-[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
+[![License Badge][]][License] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]

-<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=480 padding=10>
+<img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>

 Turn any ARM or x86 device into a powerful, manageable network appliance
 in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
@@ -129,33 +129,18 @@ deployments.

 ## Technical Details

-<a href="https://bitsign.se">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://bitsign.se/assets/badges/bitsign-badge-dark-mode.png">
-    <source media="(prefers-color-scheme: light)" srcset="https://bitsign.se/assets/badges/bitsign-badge-light-mode.png">
-    <img alt="bitSign - Code Signing" src="https://bitsign.se/assets/badges/bitsign-badge-light-mode.png" align="right" width=150 padding=10>
-  </picture>
-</a>
-
-Built on proven open-source foundations: [Linux][0], [Buildroot][1], and
-[sysrepo][2] — for reliability you can trust:
+Built on proven open-source foundations ([Buildroot][1] + [sysrepo][2])
+for reliability you can trust:

 - **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
 - **YANG Configuration**: Industry-standard models with auto-generated tooling
 - **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
 - **Container Integration**: Docker support with flexible network and hardware access
 - **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
- **Code Signing**: Releases are cryptographically signed for integrity verification

 Perfect for everything from resource-constrained edge devices to
 high-throughput network appliances.

-With the entire system modeled in YANG, scalability is no longer an
-issue, be it in development, testing, or end users deploying and
-monitoring their devices.  All knobs and dials are accessible from the
-CLI (console/SSH), or remotely using the native NETCONF or RESTCONF
-APIs.
-
 > Check the *[Latest Build][]* for bleeding-edge features.

 ---
@@ -167,7 +152,6 @@ APIs.

 ![Alt](https://repobeats.axiom.co/api/embed/5ce7a2a67edc923823afa0f60c327a6e8575b6e9.svg "Repobeats analytics image")

-[0]: https://www.kernel.org
 [1]: https://buildroot.org/ "Buildroot Homepage"
 [2]: https://www.sysrepo.org/ "Sysrepo Homepage"
 [3]: https://kernelkit.org/infix/latest/cli/introduction/
@@ -176,8 +160,6 @@ APIs.
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
-[Release]:         https://github.com/kernelkit/infix/releases
-[Release Badge]:   https://img.shields.io/github/v/release/kernelkit/infix 
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/
 [GitHub Status]:   https://github.com/kernelkit/infix/actions/workflows/build.yml/badge.svg
 [Coverity Scan]:   https://scan.coverity.com/projects/29393
@@ -1,7 +0,0 @@
-menu "Board Support"
-
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"
-
-endmenu
@@ -1,13 +0,0 @@
-if BR2_aarch64
-
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/freescale-imx8mp-evk/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/friendlyarm-nanopi-r2s/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-cn9130-crb/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-espressobin/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/microchip-sparx5-pcb135/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/raspberrypi-rpi64/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/styx-dcp-sc-28p/Config.in"
-
-endif
@@ -8,4 +8,4 @@ Board Specific Documentation
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
 - [NanoPi R2S](r2s/)
- [Raspberry Pi 64-bit](raspberry-pi64/)
+- [Raspberry Pi 4 b](raspberry-pi-4/)
@@ -1,333 +0,0 @@
-{
-  "ieee802-dot1ab-lldp:lldp": {
-    "infix-lldp:enabled": true
-  },
-  "ietf-hardware:hardware": {
-    "component": [
-      {
-        "name": "USB",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "class": "infix-hardware:usb",
-        "name": "USB2",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      }
-    ]
-  },
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "br0",
-        "type": "infix-if-type:bridge",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "192.168.0.1",
-              "prefix-length": 24
-            }
-          ]
-        }
-      },
-      {
-        "name": "lan1",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lan2",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lan3",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lan4",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lo",
-        "type": "infix-if-type:loopback",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "127.0.0.1",
-              "prefix-length": 8
-            }
-          ]
-        },
-        "ietf-ip:ipv6": {
-          "address": [
-            {
-              "ip": "::1",
-              "prefix-length": 128
-            }
-          ]
-        }
-      },
-      {
-        "name": "sfp1",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "sfp2",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "wan",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "ietf-ip:ipv4": {
-          "infix-dhcp-client:dhcp": {
-            "option": [
-              {"id": "ntp-server"},
-              {"id": "broadcast"},
-              {"id": "domain"},
-              {"id": "hostname"},
-              {"id": "dns-server"},
-              {"id": "router"},
-              {"id": "netmask"}
-            ]
-          }
-        }
-      },
-      {
-        "name": "wifi0",
-        "type": "infix-if-type:wifi"
-      },
-      {
-        "name": "wifi1",
-        "type": "infix-if-type:wifi"
-      }
-    ]
-  },
-  "ietf-keystore:keystore": {
-        "asymmetric-keys": {
-            "asymmetric-key": [
-                {
-                    "name": "genkey",
-                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
-                    "public-key": "",
-                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
-                    "cleartext-private-key": "",
-                    "certificates": {}
-                }
-            ]
-        }
-  },
-  "ietf-netconf-acm:nacm": {
-    "enable-nacm": true,
-    "groups": {
-      "group": [
-        {
-          "name": "admin",
-          "user-name": [
-            "admin"
-          ]
-        }
-      ]
-    },
-    "rule-list": [
-      {
-        "name": "admin-acl",
-        "group": [
-          "admin"
-        ],
-        "rule": [
-          {
-            "name": "permit-all",
-            "module-name": "*",
-            "access-operations": "*",
-            "action": "permit",
-            "comment": "Allow 'admin' group complete access to all operations and data."
-          }
-        ]
-      },
-      {
-        "name": "default-deny-all",
-        "group": [
-          "*"
-        ],
-        "rule": [
-          {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
-            "path": "/ietf-system:system/authentication/user/password",
-            "access-operations": "*",
-            "action": "deny"
-          }
-        ]
-      }
-    ]
-  },
-  "ietf-netconf-server:netconf-server": {
-    "listen": {
-      "endpoints": {
-        "endpoint": [
-          {
-            "name": "default-ssh",
-            "ssh": {
-              "tcp-server-parameters": {
-                "local-address": "::"
-              },
-              "ssh-server-parameters": {
-                "server-identity": {
-                  "host-key": [
-                    {
-                      "name": "default-key",
-                      "public-key": {
-                        "central-keystore-reference": "genkey"
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        ]
-      }
-    }
-  },
-  "ietf-system:system": {
-    "hostname": "bpi-%m",
-    "ntp": {
-      "server": [
-        {
-          "name": "default",
-          "udp": {
-            "address": "pool.ntp.org"
-          }
-        }
-      ]
-    },
-    "authentication": {
-      "user": [
-        {
-          "name": "admin",
-          "password": "$factory$",
-          "infix-system:shell": "bash"
-        }
-      ]
-    },
-    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
-  },
-  "infix-dhcp-server:dhcp-server": {
-    "option": [
-      {
-        "id": "ntp-server",
-        "address": "auto"
-      },
-      {
-        "id": "dns-server",
-        "address": "auto"
-      },
-      {
-        "id": "router",
-        "address": "auto"
-      }
-    ],
-    "subnet": [
-      {
-        "subnet": "192.168.0.0/24",
-        "pool": {
-          "start-address": "192.168.0.100",
-          "end-address": "192.168.0.250"
-        }
-      }
-    ]
-  },
-  "infix-firewall:firewall": {
-    "default": "wan",
-    "zone": [
-      {
-        "name": "lan",
-        "action": "accept",
-        "interface": [
-          "br0"
-        ]
-      },
-      {
-        "name": "wan",
-        "action": "drop",
-        "interface": [
-          "wan"
-        ],
-        "service": [
-          "dhcpv6-client"
-        ]
-      }
-    ],
-    "policy": [
-      {
-        "name": "lan-to-wan",
-        "ingress": [
-          "lan"
-        ],
-        "egress": [
-          "wan"
-        ],
-        "masquerade": true
-      }
-    ]
-  },
-  "infix-meta:meta": {
-    "version": "1.6"
-  },
-  "infix-services:mdns": {
-    "enabled": true
-  },
-  "infix-services:ssh": {
-    "enabled": true,
-    "hostkey": [
-      "genkey"
-    ],
-    "listen": [
-      {
-        "name": "ipv4",
-        "address": "0.0.0.0",
-        "port": 22
-      },
-      {
-        "name": "ipv6",
-        "address": "::",
-        "port": 22
-      }
-    ]
-  },
-  "infix-services:web": {
-    "enabled": true,
-    "console": {
-      "enabled": true
-    },
-    "netbrowse": {
-      "enabled": true
-    },
-    "restconf": {
-      "enabled": true
-    }
-  }
-}
-
@@ -1,9 +0,0 @@
-config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
-	bool "FriendlyElec NanoPi R2S"
-	depends on BR2_aarch64
-	select SDCARD_AUX
-	select BR2_PACKAGE_INPUT_EVENT_DAEMON
-	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
-	help
-	  FriendlyElec NanoPi R2S is a compact router board based on
-	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.
@@ -1 +0,0 @@
-dtb-y += rockchip/rk3328-nanopi-r2s.dtb
@@ -1,13 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * Common Infix OS defaults
- */
-
-/ {
-	chosen {
-		infix {
-			/* Default admin user password: 'admin' */
-			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
-		};
-	};
-};
@@ -1,23 +0,0 @@
-#include <arm64/rockchip/rk3328-nanopi-r2s.dts>
-#include "infix.dtsi"
-
-&rtl8153 {
-	/*
-	 * Fix port number: device is on port 1, not port 2
-	 *
-	 * The kernel's usb_of_get_connect_type() function checks for child
-	 * nodes with a 'reg' property matching the physical port number to
-	 * determine if a USB port is "hard-wired" (internal) vs external.
-	 * With authorized_default=2, only hard-wired ports are automatically
-	 * authorized. The RTL8153 shows up as device 3-1 (hub 3, port 1), so
-	 * reg must be <1> for the kernel to mark it as USB_PORT_CONNECT_TYPE_HARD_WIRED
-	 * and authorize it automatically at boot.
-	 */
-	reg = <1>;
-};
-
-&{/chosen/infix} {
-	/* Expose only the external USB 2.0 port for user management */
-	usb-ports = <&usb_host0_ehci>;
-	usb-port-names = "USB";
-};
@@ -1,78 +0,0 @@
-define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
-	# Rockchip RK3328 SoC
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_ROCKCHIP)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
-
-	# PHY drivers
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_INNO_USB2)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_TYPEC)
-	$(call KCONFIG_SET_OPT,CONFIG_PHY_ROCKCHIP_USB,m)
-	$(call KCONFIG_SET_OPT,CONFIG_PHY_ROCKCHIP_PCIE,m)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PHY)
-
-	# Clocks and Power Management
-	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_ROCKCHIP)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RK3328)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_PWM)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PWM_ROCKCHIP)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR_GPIO)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR_RK808)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_CHARGER_RK817)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_RK805)
-
-	# I2C Controller
-	$(call KCONFIG_ENABLE_OPT,CONFIG_I2C_RK3X)
-
-	# I2C/SPI/MFD
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MFD_RK8XX_I2C)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MFD_RK8XX_SPI)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_SPI_ROCKCHIP)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_DRV_RK808)
-
-	# MMC/Storage
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_DW_ROCKCHIP)
-
-	# PCIe
-	$(call KCONFIG_SET_OPT,CONFIG_PCIE_ROCKCHIP_HOST,m)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PCIE_ROCKCHIP_DW_HOST)
-
-	# Thermal and ADC
-	$(call KCONFIG_SET_OPT,CONFIG_ROCKCHIP_THERMAL,m)
-	$(call KCONFIG_SET_OPT,CONFIG_ROCKCHIP_SARADC,m)
-
-	# Crypto
-	$(call KCONFIG_ENABLE_OPT,CONFIG_CRYPTO_DEV_ROCKCHIP)
-
-	# NVMEM
-	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
-	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)
-
-	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_PLATFORM)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_DWMAC_ROCKCHIP)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
-
-	# Network: USB Ethernet (LAN port - RTL8153 via USB 3.0)
-	$(call KCONFIG_SET_OPT,CONFIG_USB_NET_DRIVERS,m)
-	$(call KCONFIG_SET_OPT,CONFIG_USB_RTL8152,m)
-
-	# USB 3.0 xHCI Controller (required for RTL8153 LAN port)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_XHCI_HCD)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_XHCI_PLATFORM)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3_HOST)
-
-	# USB 2.0 Host
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_HCD)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_HCD_PLATFORM)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_ROOT_HUB_TT)
-endef
-
-$(eval $(ix-board))
-$(eval $(generic-package))
@@ -1,3 +0,0 @@
-#!/bin/sh
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add
@@ -56,7 +56,6 @@ CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
-CONFIG_PARTITION_ADVANCED=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_KSM=y
@@ -244,6 +243,9 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
+CONFIG_NET_TEAM=m
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
+CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -332,20 +334,12 @@ CONFIG_MDIO_BITBANG=y
 CONFIG_MDIO_MVUSB=m
 CONFIG_MDIO_MSCC_MIIM=y
 CONFIG_MDIO_BUS_MUX_MMIOREG=y
-CONFIG_USB_RTL8150=m
 CONFIG_USB_RTL8152=m
-CONFIG_USB_LAN78XX=m
 CONFIG_USB_USBNET=m
 CONFIG_USB_NET_CDC_EEM=m
 # CONFIG_USB_NET_CDC_NCM is not set
-CONFIG_USB_NET_DM9601=m
-CONFIG_USB_NET_SMSC75XX=m
-CONFIG_USB_NET_SMSC95XX=m
 # CONFIG_USB_NET_NET1080 is not set
-CONFIG_USB_ALI_M5632=y
-CONFIG_USB_AN2720=y
-CONFIG_USB_EPSON2888=y
-CONFIG_USB_KC2190=y
+# CONFIG_USB_NET_CDC_SUBSET is not set
 # CONFIG_USB_NET_ZAURUS is not set
 # CONFIG_WLAN is not set
 CONFIG_INPUT_EVDEV=y
@@ -433,7 +427,7 @@ CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
 CONFIG_USB_ULPI_BUS=y
-CONFIG_USB=y
+CONFIG_USB=m
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
@@ -444,8 +438,6 @@ CONFIG_USB_OHCI_HCD_PLATFORM=m
 CONFIG_USB_STORAGE=m
 CONFIG_USB_DWC3=y
 CONFIG_USB_DWC2=y
-CONFIG_USB_DWC2_HOST=y
-CONFIG_USB_DWC2_PCI=y
 CONFIG_USB_CHIPIDEA=m
 CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
@@ -5,28 +5,21 @@ image cfg.ext4 {

 	ext4 {
 		label = "cfg"
-                use-mke2fs = true
-                features = "uninit_bg"
-                extraargs = "-m 0 -i 4096"
 	}
 }

-# The /var partition will be expanded automatically at first boot
-# to use the full size of the SD-card or eMMC media.
 image var.ext4 {
 	empty = true
 	temporary = true
-	size = 128M
+	size = 512M

 	ext4 {
 		label = "var"
-                use-mke2fs = true
-                features = "uninit_bg"
-                extraargs = "-m 0 -i 4096"
+		use-mke2fs = true
 	}
 }

-image #INFIX_ID##VERSION#-nanopi-r2s-sdcard.img {
+image sdcard.img {
 	hdimage {
 		partition-table-type = "gpt"
 	}
@@ -0,0 +1,743 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_PSI=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EXPERT=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_KEXEC_FILE=y
+CONFIG_ARCH_ROCKCHIP=y
+CONFIG_ARM64_VA_BITS_48=y
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_SMT=y
+CONFIG_NR_CPUS=8
+CONFIG_COMPAT=y
+CONFIG_RANDOMIZE_BASE=y
+# CONFIG_SUSPEND is not set
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+CONFIG_CPUFREQ_DT=y
+CONFIG_ARM_SCMI_CPUFREQ=y
+CONFIG_ACPI_CPPC_CPUFREQ=m
+CONFIG_ACPI=y
+CONFIG_ACPI_APEI=y
+CONFIG_ACPI_APEI_GHES=y
+CONFIG_ACPI_APEI_MEMORY_FAILURE=y
+CONFIG_ACPI_APEI_EINJ=y
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=y
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+# CONFIG_GCC_PLUGINS is not set
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_KSM=y
+CONFIG_MEMORY_FAILURE=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CMA=y
+CONFIG_CMA_AREAS=20
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_IPV6_SIT=m
+CONFIG_IPV6_GRE=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETWORK_PHY_TIMESTAMPING=y
+CONFIG_NETFILTER=y
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_CT=m
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CGROUP=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
+CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
+CONFIG_NF_CONNTRACK_BRIDGE=y
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BRIDGE=y
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_BRIDGE_MRP=y
+CONFIG_BRIDGE_CFM=y
+CONFIG_VLAN_8021Q=y
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBS=m
+CONFIG_NET_SCH_ETF=m
+CONFIG_NET_SCH_TAPRIO=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_BPF=m
+CONFIG_NET_CLS_FLOWER=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_GACT=y
+CONFIG_NET_ACT_MIRRED=y
+CONFIG_NET_ACT_NAT=y
+CONFIG_NET_ACT_SKBEDIT=y
+CONFIG_NET_ACT_VLAN=y
+CONFIG_NET_ACT_BPF=y
+CONFIG_DCB=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_MPLS=y
+CONFIG_NET_MPLS_GSO=y
+CONFIG_MPLS_ROUTING=m
+CONFIG_NET_PKTGEN=y
+CONFIG_BT=m
+# CONFIG_BT_LE is not set
+CONFIG_BT_LEDS=y
+# CONFIG_BT_DEBUGFS is not set
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_LL=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIUART_QCA=y
+CONFIG_CFG80211=y
+CONFIG_MAC80211=y
+CONFIG_MAC80211_LEDS=y
+CONFIG_RFKILL=y
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_PASID=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_ACPI=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_ROCKCHIP_HOST=m
+CONFIG_PCIE_ROCKCHIP_DW_HOST=y
+CONFIG_PCI_ENDPOINT=y
+CONFIG_PCI_ENDPOINT_CONFIGFS=y
+CONFIG_PCI_EPF_TEST=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_VEXPRESS_CONFIG=y
+CONFIG_ARM_SCMI_PROTOCOL=y
+CONFIG_ARM_SCPI_PROTOCOL=y
+CONFIG_EFI_CAPSULE_LOADER=y
+CONFIG_MTD=y
+CONFIG_MTD_BLOCK=y
+CONFIG_MTD_CFI=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_INTELEXT=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_PHYSMAP_OF=y
+CONFIG_MTD_DATAFLASH=y
+CONFIG_MTD_SST25L=y
+CONFIG_MTD_BLOCK2MTD=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_NAND_DENALI_DT=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_OF_OVERLAY=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=m
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_NVME=m
+CONFIG_SRAM=y
+CONFIG_PCI_ENDPOINT_TEST=m
+CONFIG_EEPROM_AT24=m
+CONFIG_EEPROM_AT25=m
+CONFIG_UACCE=m
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_HISI_SAS=y
+CONFIG_SCSI_HISI_SAS_PCI=y
+CONFIG_MEGARAID_SAS=y
+CONFIG_SCSI_MPT3SAS=m
+CONFIG_SCSI_VIRTIO=y
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_CEVA=y
+CONFIG_SATA_SIL24=y
+CONFIG_PATA_OF_PLATFORM=y
+CONFIG_MD=y
+# CONFIG_MD_BITMAP_FILE is not set
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_INIT=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_WIREGUARD=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
+CONFIG_VXLAN=m
+CONFIG_GENEVE=m
+CONFIG_BAREUDP=m
+CONFIG_MACSEC=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_VIRTIO_NET=y
+CONFIG_NLMON=y
+CONFIG_NET_VRF=y
+# CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_NET_VENDOR_ADAPTEC is not set
+# CONFIG_NET_VENDOR_AGERE is not set
+# CONFIG_NET_VENDOR_ALACRITECH is not set
+# CONFIG_NET_VENDOR_ALTEON is not set
+# CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AMD is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
+# CONFIG_NET_VENDOR_ARC is not set
+# CONFIG_NET_VENDOR_ASIX is not set
+CONFIG_ATL2=m
+CONFIG_ALX=m
+# CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_VENDOR_CADENCE is not set
+# CONFIG_NET_VENDOR_CAVIUM is not set
+# CONFIG_NET_VENDOR_CHELSIO is not set
+# CONFIG_NET_VENDOR_CISCO is not set
+# CONFIG_NET_VENDOR_CORTINA is not set
+# CONFIG_NET_VENDOR_DEC is not set
+# CONFIG_NET_VENDOR_DLINK is not set
+# CONFIG_NET_VENDOR_EMULEX is not set
+# CONFIG_NET_VENDOR_EZCHIP is not set
+# CONFIG_NET_VENDOR_GOOGLE is not set
+# CONFIG_NET_VENDOR_HISILICON is not set
+# CONFIG_NET_VENDOR_HUAWEI is not set
+# CONFIG_NET_VENDOR_INTEL is not set
+# CONFIG_NET_VENDOR_LITEX is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+# CONFIG_NET_VENDOR_MELLANOX is not set
+# CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROCHIP is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
+# CONFIG_NET_VENDOR_MICROSOFT is not set
+# CONFIG_NET_VENDOR_MYRI is not set
+# CONFIG_NET_VENDOR_NI is not set
+# CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETERION is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
+# CONFIG_NET_VENDOR_NVIDIA is not set
+# CONFIG_NET_VENDOR_OKI is not set
+# CONFIG_NET_VENDOR_PACKET_ENGINES is not set
+# CONFIG_NET_VENDOR_PENSANDO is not set
+# CONFIG_NET_VENDOR_QLOGIC is not set
+# CONFIG_NET_VENDOR_BROCADE is not set
+# CONFIG_NET_VENDOR_QUALCOMM is not set
+# CONFIG_NET_VENDOR_RDC is not set
+CONFIG_8139CP=m
+CONFIG_8139TOO=m
+# CONFIG_8139TOO_PIO is not set
+CONFIG_R8169=m
+# CONFIG_NET_VENDOR_RENESAS is not set
+# CONFIG_NET_VENDOR_ROCKER is not set
+# CONFIG_NET_VENDOR_SAMSUNG is not set
+# CONFIG_NET_VENDOR_SEEQ is not set
+# CONFIG_NET_VENDOR_SILAN is not set
+# CONFIG_NET_VENDOR_SIS is not set
+# CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_SOCIONEXT is not set
+CONFIG_STMMAC_ETH=y
+# CONFIG_DWMAC_GENERIC is not set
+# CONFIG_NET_VENDOR_SUN is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
+# CONFIG_NET_VENDOR_TEHUTI is not set
+# CONFIG_NET_VENDOR_TI is not set
+# CONFIG_NET_VENDOR_VIA is not set
+# CONFIG_NET_VENDOR_WIZNET is not set
+# CONFIG_NET_VENDOR_XILINX is not set
+CONFIG_LED_TRIGGER_PHY=y
+CONFIG_AX88796B_PHY=y
+CONFIG_DAVICOM_PHY=m
+CONFIG_REALTEK_PHY=y
+CONFIG_ROCKCHIP_PHY=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BUS_MUX_MULTIPLEXER=y
+CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=m
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_CDC_NCM=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+# CONFIG_USB_NET_ZAURUS is not set
+CONFIG_ATH10K=m
+CONFIG_ATH10K_PCI=m
+CONFIG_WCN36XX=m
+# CONFIG_WLAN_VENDOR_ATMEL is not set
+# CONFIG_WLAN_VENDOR_BROADCOM is not set
+# CONFIG_WLAN_VENDOR_INTEL is not set
+# CONFIG_WLAN_VENDOR_INTERSIL is not set
+# CONFIG_WLAN_VENDOR_MARVELL is not set
+# CONFIG_WLAN_VENDOR_MEDIATEK is not set
+CONFIG_RTL8180=m
+CONFIG_RTL8187=m
+CONFIG_RTL_CARDS=m
+CONFIG_RTL8192CE=m
+CONFIG_RTL8192SE=m
+CONFIG_RTL8192DE=m
+CONFIG_RTL8723AE=m
+CONFIG_RTL8723BE=m
+CONFIG_RTL8188EE=m
+CONFIG_RTL8192EE=m
+CONFIG_RTL8821AE=m
+CONFIG_RTL8192CU=m
+CONFIG_RTL8XXXU=m
+CONFIG_RTL8XXXU_UNTESTED=y
+CONFIG_RTW88=m
+CONFIG_RTW88_8822BE=m
+CONFIG_RTW88_8822BS=m
+CONFIG_RTW88_8822BU=m
+CONFIG_RTW88_8822CE=m
+CONFIG_RTW88_8822CS=m
+CONFIG_RTW88_8822CU=m
+CONFIG_RTW88_8723DE=m
+CONFIG_RTW88_8723DS=m
+CONFIG_RTW88_8723DU=m
+CONFIG_RTW88_8821CE=m
+CONFIG_RTW88_8821CS=m
+CONFIG_RTW88_8821CU=m
+CONFIG_RTW88_DEBUG=y
+CONFIG_RTW89=m
+CONFIG_RTW89_8851BE=m
+CONFIG_RTW89_8852AE=m
+CONFIG_RTW89_8852BE=m
+CONFIG_RTW89_8852CE=m
+CONFIG_RTW89_DEBUGMSG=y
+# CONFIG_WLAN_VENDOR_RSI is not set
+# CONFIG_WLAN_VENDOR_TI is not set
+# CONFIG_WLAN_VENDOR_ZYDAS is not set
+# CONFIG_WLAN_VENDOR_QUANTENNA is not set
+CONFIG_INPUT_FF_MEMLESS=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_EVBUG=y
+CONFIG_KEYBOARD_GPIO=y
+CONFIG_KEYBOARD_GPIO_POLLED=y
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_RK805_PWRKEY=y
+# CONFIG_SERIO_SERPORT is not set
+CONFIG_SERIO_AMBAKMI=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_LEGACY_PTY_COUNT=16
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_RT288X=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL010=y
+CONFIG_SERIAL_AMBA_PL010_CONSOLE=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_HW_RANDOM_VIRTIO=m
+CONFIG_TCG_TPM=y
+CONFIG_TCG_TIS_I2C_INFINEON=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_RK3X=y
+CONFIG_I2C_SLAVE=y
+CONFIG_SPI=y
+CONFIG_SPI_BITBANG=m
+CONFIG_SPI_CADENCE_QUADSPI=y
+CONFIG_SPI_DESIGNWARE=m
+CONFIG_SPI_DW_DMA=y
+CONFIG_SPI_DW_MMIO=m
+CONFIG_SPI_PL022=y
+CONFIG_SPI_ROCKCHIP=y
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPMI=y
+CONFIG_PPS=y
+# CONFIG_PTP_1588_CLOCK is not set
+CONFIG_DEBUG_PINCTRL=y
+CONFIG_PINCTRL_RK805=y
+CONFIG_PINCTRL_SINGLE=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_MAX732X=y
+CONFIG_GPIO_PCA953X=y
+CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_SYSCON_REBOOT_MODE=y
+CONFIG_CHARGER_RK817=y
+CONFIG_SENSORS_ARM_SCMI=y
+CONFIG_SENSORS_ARM_SCPI=y
+CONFIG_SENSORS_PWM_FAN=m
+CONFIG_CPU_THERMAL=y
+CONFIG_THERMAL_EMULATION=y
+CONFIG_ROCKCHIP_THERMAL=m
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_SYSFS=y
+CONFIG_SOFT_WATCHDOG=y
+CONFIG_MFD_RK8XX_I2C=y
+CONFIG_MFD_RK8XX_SPI=y
+# CONFIG_MFD_VEXPRESS_SYSREG is not set
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_DEBUG=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_USERSPACE_CONSUMER=y
+CONFIG_REGULATOR_NETLINK_EVENTS=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_REGULATOR_PWM=y
+CONFIG_REGULATOR_RK808=y
+CONFIG_REGULATOR_VCTRL=y
+# CONFIG_HID_SUPPORT is not set
+CONFIG_USB_ULPI_BUS=y
+CONFIG_USB_CONN_GPIO=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_DYNAMIC_MINORS=y
+CONFIG_USB_OTG=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_ACM=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_MUSB_HDRC=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC2=y
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_SIMPLE=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_USB_ULPI=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_SNP_UDC_PLAT=y
+CONFIG_USB_BDC_UDC=y
+CONFIG_USB_CONFIGFS=m
+CONFIG_USB_CONFIGFS_SERIAL=y
+CONFIG_USB_CONFIGFS_ACM=y
+CONFIG_USB_CONFIGFS_OBEX=y
+CONFIG_USB_CONFIGFS_NCM=y
+CONFIG_USB_CONFIGFS_ECM=y
+CONFIG_USB_CONFIGFS_ECM_SUBSET=y
+CONFIG_USB_CONFIGFS_RNDIS=y
+CONFIG_USB_CONFIGFS_EEM=y
+CONFIG_USB_CONFIGFS_MASS_STORAGE=y
+CONFIG_USB_CONFIGFS_F_FS=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_ACPI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_OF_ARASAN=y
+CONFIG_MMC_SDHCI_CADENCE=y
+CONFIG_MMC_SDHCI_F_SDH30=y
+CONFIG_MMC_SPI=y
+CONFIG_MMC_DW=y
+CONFIG_MMC_DW_HI3798CV200=y
+CONFIG_MMC_DW_K3=y
+CONFIG_MMC_DW_ROCKCHIP=y
+CONFIG_SCSI_UFSHCD=y
+CONFIG_SCSI_UFSHCD_PLATFORM=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_CLASS_FLASH=y
+CONFIG_LEDS_CLASS_MULTICOLOR=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_SYSCON=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_DISK=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_LEDS_TRIGGER_NETDEV=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_RK808=y
+CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_PL030=y
+CONFIG_RTC_DRV_PL031=y
+CONFIG_DMADEVICES=y
+CONFIG_PL330_DMA=y
+CONFIG_SYNC_FILE=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_INPUT=y
+CONFIG_VIRTIO_MMIO=y
+# CONFIG_VHOST_MENU is not set
+CONFIG_STAGING=y
+CONFIG_RTLLIB=m
+CONFIG_RTL8192E=m
+CONFIG_RTL8723BS=m
+CONFIG_R8712U=m
+CONFIG_RTS5208=m
+# CONFIG_SURFACE_PLATFORMS is not set
+CONFIG_COMMON_CLK_SCMI=y
+CONFIG_COMMON_CLK_SCPI=y
+CONFIG_COMMON_CLK_PWM=y
+CONFIG_HWSPINLOCK=y
+# CONFIG_FSL_ERRATUM_A008585 is not set
+# CONFIG_HISILICON_ERRATUM_161010101 is not set
+# CONFIG_ARM64_ERRATUM_858921 is not set
+CONFIG_ARM_MHU=y
+CONFIG_PLATFORM_MHU=y
+CONFIG_IOMMU_IO_PGTABLE_ARMV7S=y
+CONFIG_ROCKCHIP_IOMMU=y
+CONFIG_ARM_SMMU=y
+CONFIG_ARM_SMMU_V3=y
+CONFIG_ROCKCHIP_IODOMAIN=y
+CONFIG_ROCKCHIP_DTPM=m
+CONFIG_ROCKCHIP_PM_DOMAINS=y
+CONFIG_DEVFREQ_GOV_USERSPACE=m
+CONFIG_EXTCON_USB_GPIO=y
+CONFIG_MEMORY=y
+CONFIG_IIO=y
+CONFIG_MAX9611=m
+CONFIG_ROCKCHIP_SARADC=m
+CONFIG_IIO_ST_LSM6DSX=m
+CONFIG_SENSORS_ISL29018=m
+CONFIG_VCNL4000=m
+CONFIG_IIO_ST_MAGN_3AXIS=m
+CONFIG_MPL3115=m
+CONFIG_PWM=y
+CONFIG_PWM_ROCKCHIP=y
+CONFIG_RESET_GPIO=y
+CONFIG_PHY_ROCKCHIP_DPHY_RX0=m
+CONFIG_PHY_ROCKCHIP_EMMC=y
+CONFIG_PHY_ROCKCHIP_INNO_HDMI=m
+CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_PHY_ROCKCHIP_INNO_CSIDPHY=m
+CONFIG_PHY_ROCKCHIP_INNO_DSIDPHY=m
+CONFIG_PHY_ROCKCHIP_PCIE=m
+CONFIG_PHY_ROCKCHIP_TYPEC=y
+CONFIG_PHY_ROCKCHIP_USB=m
+CONFIG_POWERCAP=y
+CONFIG_ARM_SCMI_POWERCAP=y
+CONFIG_DTPM=y
+CONFIG_ARM_SMMU_V3_PMU=m
+CONFIG_NVMEM_RMEM=m
+CONFIG_NVMEM_ROCKCHIP_EFUSE=m
+CONFIG_NVMEM_ROCKCHIP_OTP=m
+CONFIG_TEE=y
+CONFIG_OPTEE=y
+CONFIG_MUX_MMIO=y
+CONFIG_INTERCONNECT=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_BTRFS_FS=y
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_AUTOFS_FS=y
+CONFIG_FUSE_FS=y
+CONFIG_VIRTIO_FS=y
+CONFIG_OVERLAY_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_UTF8=y
+CONFIG_EXFAT_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_PROC_CHILDREN=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_HUGETLBFS=y
+CONFIG_EFIVAR_FS=y
+CONFIG_JFFS2_FS=y
+CONFIG_JFFS2_FS_XATTR=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_SQUASHFS_ZSTD=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_V4_1=y
+CONFIG_NFS_V4_2=y
+CONFIG_ROOT_NFS=y
+CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
+CONFIG_SECURITY=y
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_CURVE25519=m
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_USER_API_RNG=m
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA512_ARM64_CE=m
+CONFIG_CRYPTO_SHA3_ARM64=m
+CONFIG_CRYPTO_SM3_ARM64_CE=m
+CONFIG_CRYPTO_AES_ARM64_BS=m
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=m
+CONFIG_CRYPTO_DEV_ROCKCHIP=y
+CONFIG_CRYPTO_DEV_CCREE=m
+CONFIG_PACKING=y
+CONFIG_INDIRECT_PIO=y
+CONFIG_CRC_CCITT=m
+CONFIG_CRC8=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=32
+CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_FS=y
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_SCHED_DEBUG is not set
+CONFIG_FUNCTION_TRACER=y
+CONFIG_MEMTEST=y
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+BOARD_DIR="$(dirname $0)"
+
+install -m 0644 -D $BOARD_DIR/extlinux.conf $TARGET_DIR/boot/extlinux/extlinux.conf
@@ -0,0 +1,206 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.2.1",
+              "prefix-length": 24
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {}
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet"
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name":  "deny-password-read",
+            "module-name": "ietf-system",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny"
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-address": "::"
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "r2s",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          },
+	  "iburst": true
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-client:dhcp-client": {
+    "client-if": [
+      {
+        "if-name": "wan",
+        "option": [
+          {
+            "name": "broadcast"
+          },
+          {
+            "name": "dns"
+          },
+          {
+            "name": "domain"
+          },
+          {
+            "name": "hostname"
+          },
+          {
+            "name": "ntpsrv"
+          },
+          {
+            "name": "router"
+          },
+          {
+            "name": "subnet"
+          }
+        ]
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "infix-meta:version": "1.2"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -1,2 +1,2 @@
 ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/ff540000.ethernet/net/eth0", NAME="wan"
-ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/ff600000.usb/xhci-hcd.0.auto/usb5/5-1/5-1:1.0/net/*", NAME="lan"
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/ff600000.usb/xhci-hcd.0.auto/usb3/3-1/3-1:1.0/net/*", NAME="lan"
@@ -0,0 +1,46 @@
+# Raspberry Pi 4 b
+
+## Support level
+Full support for base board but not any extension board on the
+GPIOs.
+
+### Touch screen
+The [Raspberry Pi touch display v1][RPI-TOUCH] is supported, including
+touch functionality. There are multiple touchscreens on the market for
+Raspberry Pi, but only the official (first version with 800x480
+resolution) is currently supported. Infix supplies all drivers
+required to utilize the hardware, but you need to add the actual
+graphical application in a container.
+
+There are some important considerations you need to know about when
+using Infix for graphical applications. The container needs access to
+/dev/dri/ to be able to access the graphics card, and it also needs
+access to /run/udev to be able to find the input devices.
+
+Example of running Doom in Infix:
+
+```cli
+	admin@example:/> configure
+	admin@example:/config/> edit container doom
+	admin@example:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
+	admin@example:/config/container/doom/> set privileged
+	admin@example:/config/container/doom/> edit mount udev
+	admin@example:/config/container/doom/mount/udev/> set type bind
+	admin@example:/config/container/doom/mount/udev/> set target /run/udev/
+	admin@example:/config/container/doom/mount/udev/> set source /run/udev/
+	admin@example:/config/container/doom/mount/udev/> end
+	admin@example:/config/container/doom/mount/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
+	admin@example:/config/container/doom/mount/xorg.conf/> set target /etc/X11/xorg.conf
+	admin@example:/config/container/doom/mount/xorg.conf/> end
+	admin@example:/config/container/doom/> edit volume var
+	admin@example:/config/container/doom/volume/var/> set target /var
+	admin@example:/config/container/doom/volume/var/> leave
+	admin@example:/>
+
+```
+
+### Pre-built images
+SD card image: [infix-rpi4-sdcard.img](https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi4-sdcard.img)
+
+
+[RPI-TOUCH]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
@@ -1,12 +0,0 @@
-config BR2_PACKAGE_RASPBERRYPI_RPI64
-	bool "Raspberry Pi 64-bit (RPi3 and later)"
-	depends on BR2_aarch64
-	select SDCARD_AUX
-	select BR2_PACKAGE_FEATURE_WIFI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
-
-	help
-	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
-	  of single-board computers (SBC), RPi 3B and later, including the
-	  Raspberry Pi 2W, which shares the same CPU core as RPi 3B.
@@ -1,13 +0,0 @@
-Copyright (c) 2025 The KernelKit Authors
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -1,59 +0,0 @@
-# Raspberry Pi 3B/4B
-
-## Support level
-
-Full support for base board but not any extension board on the GPIOs.
-Other RPi boards of the same generation may work as well, but may need
-some additional testing/work.  A few CM4 variants have been tested and
-seem to work as expected, but YMMV as always.
-
-### Touch screen
-
-The [Raspberry Pi touch display v1][0] is supported on the 4B, including
-touch functionality.  There are multiple touchscreens on the market for
-Raspberry Pi, but currently only the official first version with 800x480
-resolution is supported.  Infix supplies all drivers required to utilize
-the hardware, but you need to add the actual graphical application in a
-container.
-
-There are some important considerations you need to know about when
-using Infix for graphical applications.  The container needs access to
-`/dev/dri/` to be able to access the graphics card, it also need access
-to `/run/udev` to be able to find the input devices.
-
-Example of running Doom in Infix:
-
-```
-admin@example:/> configure
-admin@example:/config/> edit container doom
-admin@example:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
-admin@example:/config/container/doom/> set privileged
-admin@example:/config/container/doom/> edit mount udev
-admin@example:/config/container/doom/mount/udev/> set type bind
-admin@example:/config/container/doom/mount/udev/> set target /run/udev/
-admin@example:/config/container/doom/mount/udev/> set source /run/udev/
-admin@example:/config/container/doom/mount/udev/> end
-admin@example:/config/container/doom/mount/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
-admin@example:/config/container/doom/mount/xorg.conf/> set target /etc/X11/xorg.conf
-admin@example:/config/container/doom/mount/xorg.conf/> end
-admin@example:/config/container/doom/> edit volume var
-admin@example:/config/container/doom/volume/var/> set target /var
-admin@example:/config/container/doom/volume/var/> leave
-admin@example:/>
-```
-
-> [!NOTE]
-> The `xorg.conf` [content mount][2] is a nifty detail of Infix that
-> allows you to keep all the relevant configuration in a single file.
-> The deta is "simply" `base64` encoded, so you do not really need the
-> features of the Infix CLI, everything can be set up remotely [using
-> `curl`][3] if you like.
-
-### Pre-built images
-
-Pre-built SD card images are available here: [infix-rpi64-sdcard.img][sdcard]
-
-[0]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
-[1]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
-[2]: https://kernelkit.org/infix/latest/container/#content-mounts
-[3]: https://kernelkit.org/infix/latest/scripting-restconf/
@@ -1,35 +0,0 @@
-[all]
-arm_64bit=1
-
-arm_boost=1
-force_turbo=1
-
-kernel=u-boot.bin
-
-dtoverlay=rpi-env
-dtoverlay=infix-key
-
-disable_overscan=1
-
-enable_uart=1
-uart_2ndstage=1
-
-[pi3]
-start_file=start.elf
-fixup_file=fixup.dat
-
-dtoverlay=miniuart-bt
-
-gpu_mem=100
-
-[pi4]
-start_file=start4.elf
-fixup_file=fixup4.dat
-
-dtoverlay=vc4-kms-v3d-pi4
-lcd_rotate=2
-
-# Prevent console on DSI
-console=map:0
-
-gpu_mem=256
@@ -1,4 +0,0 @@
-dtb-y += broadcom/bcm2837-rpi-3-b.dtb broadcom/bcm2837-rpi-zero-2-w.dtb \
-	 broadcom/bcm2711-rpi-4-b.dtb broadcom/bcm2711-rpi-4-b-dsi.dtb  \
-	 broadcom/bcm2711-rpi-400.dtb broadcom/bcm2711-rpi-cm4-io.dtb   \
-	 broadcom/bcm2711-rpi-cm4.dtb
@@ -1,9 +0,0 @@
-#include <arm64/broadcom/bcm2711-rpi-400.dts>
-#include "infix.dtsi"
-
-/ {
-	chosen {
-		/* 8250 auxiliary UART instead of pl011 */
-		stdout-path = "serial1:115200n8";
-	};
-};
@@ -1,9 +0,0 @@
-#include <arm64/broadcom/bcm2711-rpi-cm4-io.dts>
-#include "infix.dtsi"
-
-/ {
-	chosen {
-		/* 8250 auxiliary UART instead of pl011 */
-		stdout-path = "serial1:115200n8";
-	};
-};
@@ -1,9 +0,0 @@
-#include <arm/broadcom/bcm2711-rpi-cm4.dtsi>
-#include "infix.dtsi"
-
-/ {
-	chosen {
-		/* 8250 auxiliary UART instead of pl011 */
-		stdout-path = "serial1:115200n8";
-	};
-};
@@ -1,9 +0,0 @@
-#include <arm64/broadcom/bcm2837-rpi-3-b.dts>
-#include "infix.dtsi"
-
-/ {
-	chosen {
-		/* 8250 auxiliary UART instead of pl011 */
-		stdout-path = "serial1:115200n8";
-	};
-};
@@ -1,9 +0,0 @@
-#include <arm64/broadcom/bcm2837-rpi-zero-2-w.dts>
-#include "infix.dtsi"
-
-/ {
-	chosen {
-		/* 8250 auxiliary UART instead of pl011 */
-		stdout-path = "serial1:115200n8";
-	};
-};
@@ -1,13 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * Common Infix OS defaults
- */
-
-/ {
-	chosen {
-		infix {
-			/* Default admin user password: 'admin' */
-			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
-		};
-	};
-};
@@ -1,78 +0,0 @@
-image boot.vfat {
-	vfat {
-		files = {
-#BOOT_FILES#
-		}
-	}
-
-	size = 32M
-}
-
-image cfg.ext4 {
-	empty = true
-	temporary = true
-	size = 16M
-
-	ext4 {
-		label = "cfg"
-                use-mke2fs = true
-                features = "uninit_bg"
-                extraargs = "-m 0 -i 4096"
-	}
-}
-
-# The /var partition will be expanded automatically at first boot
-# to use the full size of the SD-card or eMMC media.
-image var.ext4 {
-	empty = true
-	temporary = true
-	size = 128M
-
-	ext4 {
-		label = "var"
-                use-mke2fs = true
-                features = "uninit_bg"
-                extraargs = "-m 0 -i 4096"
-	}
-}
-
-image #INFIX_ID##VERSION#-rpi64-sdcard.img {
-	hdimage {
-		partition-table-type = "hybrid"
-	}
-
-	partition boot {
-		partition-type = 0xc
-		bootable = "true"
-		image = "boot.vfat"
-	}
-
-	partition aux {
-		partition-type-uuid = srv
-		image = "aux.ext4"
-	}
-
-	partition primary {
-		partition-type-uuid = linux
-		bootable = "true"
-		size = 250M
-		image = "rootfs.squashfs"
-	}
-
-	partition secondary {
-		partition-type-uuid = linux
-		bootable = "true"
-		size = 250M
-		image = "rootfs.squashfs"
-	}
-
-	partition cfg {
-		partition-type-uuid = srv
-		image = "cfg.ext4"
-	}
-
-	partition var {
-		partition-type-uuid = var
-		image = "var.ext4"
-	}
-}
@@ -1 +0,0 @@
-raspberrypi,4-model-b
@@ -1,10 +0,0 @@
-{
-    "eth0": {
-	"comment": "Primary Ethernet controller, native BCM2711",
-	"phy-detached-when-down": true
-    },
-    "eth1": {
-	"comment": "Second Ethernet controller on CM4 boards, attached over PCIe",
-	"phy-detached-when-down": true
-    }
-}
@@ -1,10 +0,0 @@
-{
-    "eth0": {
-	"comment": "Primary Ethernet controller, native on BCM2711, and smsc95xx on BCM2837",
-	"phy-detached-when-down": true
-    },
-    "@ethtool:driver=smsc95xx": {
-	"comment": "BCM2837 smsc95xx driver does not support disabling flow control",
-        "broken-flow-control": true
-    }
-}
@@ -1,4 +1,4 @@
 label Infix (aarch64)
 	kernel /boot/Image
 	fdtdir /boot
-	append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}
+	append ${bootargs_root} ${bootargs_log} -- ${bootargs_user}
@@ -1,2 +0,0 @@
-include $(BR2_EXTERNAL_INFIX_PATH)/board/ix-board.mk
-include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/*/*/*.mk))
@@ -94,9 +94,10 @@ If you see the following line printed one or more times, don't panic.

    LABEL=var: Can't lookup blockdev

-See the Customizing section above.  Silence the error by selecting one
-more writable partition (/var) in menuconfig for log files, container
-images, etc.  The size can also be adjusted there.
+See the Customizing section above.  To silence the error you need to
+create another writable partition for Infix to store logs, container
+images, etc.  Look for the 'var' keyword, you can adjust the size of
+the partition.


 Graphical Network Simulator 3 (GNS3)
@@ -104,11 +105,12 @@ Graphical Network Simulator 3 (GNS3)

 GNS3 is a very powerful front-end to Qemu which takes care of creating
 virtual links between network devices running in Qemu.  This README is
-all you need to get going, alongisde it is the appliance file (.gns3a)
-that reference image files in this directory needed to load into GNS3.
+only link to the material you need.  This directory holds the appliance
+file, .gns3a, that references image files also in this directory, that
+you need to load into GNS3.

-Necessary Ubuntu packages are available through the offical GNS3 PPA.
-If you don't know what a PPA is, read up on that first:
+The necessary extra packages are available through the offical PPA.  If
+you don't know what a PPA is, read up on that first:

 - https://launchpad.net/~gns3/+archive/ubuntu/ppa

@@ -120,8 +122,9 @@ There's a lot of tutorials and guides online, start here:
 About
 -----

-Infix is a free, Linux-based, immutable operating system, built around
+Infix is a free, Linux-based, immutable operating system built around
 Buildroot, and sysrepo.  A powerful mix that ease porting to different
 platforms, simplify long-term maintenance, and provide easy management
-using NETCONF, RESTCONF, or the built-in, command line interface (CLI)
+using NETCONF, RESTCONF, or the built-in command line interface (CLI)
 from a console or SSH login.
+
@@ -11,8 +11,7 @@ image aux.ext4 {
 	ext4 {
 		label = "aux"
 		use-mke2fs = true
-		features = "^metadata_csum,^metadata_csum_seed,uninit_bg"
-                extraargs = "-m 0 -i 4096"
+		features = "^metadata_csum,^metadata_csum_seed"
 	}
 }

@@ -1,8 +1,6 @@
-#!/usr/bin/env bash
-# shellcheck disable=SC1090,SC1091,SC3053
-
+#!/bin/sh
+# shellcheck disable=SC1090,SC1091
 common=$(dirname "$(readlink -f "$0")")
-. "$common/lib.sh"
 . "$BR2_CONFIG" 2>/dev/null
 . "$TARGET_DIR/usr/lib/os-release"

@@ -32,21 +30,27 @@ EOF
    # Ignore a few top-level oddballs not used by core Infix
    cmd="$cmd -x supported-algorithms"

-    ixmsg "Calling $cmd"
+    # Execute the command
+    echo "Calling: $cmd"
    $cmd
 }

-if [ -f "$TARGET_DIR/etc/rauc/system.conf" ]; then
-    sed -i "s/compatible=.*/compatible=$INFIX_COMPATIBLE/" "$TARGET_DIR/etc/rauc/system.conf"
-fi
-
 if [ -n "${ID_LIKE}" ]; then
    ID="${ID} ${ID_LIKE}"
 fi

+if [ -n "$INFIX_IMAGE_ID" ]; then
+    NAME="$INFIX_IMAGE_ID"
+else
+    NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
+fi
+
+if [ -f "$TARGET_DIR/etc/rauc/system.conf" ]; then
+    sed -i "s/compatible=.*/compatible=$INFIX_COMPATIBLE/" "$TARGET_DIR/etc/rauc/system.conf"
+fi
+
 # This is a symlink to /usr/lib/os-release, so we remove this to keep
 # original Buildroot information.
-ixmsg "Creating /etc/os-release"
 rm -f "$TARGET_DIR/etc/os-release"
 {
    echo "NAME=\"$INFIX_NAME\""
@@ -83,7 +87,6 @@ rm -f "$TARGET_DIR/etc/os-release"
 } > "$TARGET_DIR/etc/os-release"

 echo "$INFIX_TAGLINE $INFIX_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
-ixmsg "Creating /etc/version: $(cat "$TARGET_DIR/etc/version")"

 # In case of ambguities, this is what the image was built from
 cp "$BR2_CONFIG" "$TARGET_DIR/usr/share/infix/config"
@@ -98,9 +101,12 @@ fi
 # Drop Buildroot default pam_lastlog.so from login chain
 sed -i '/^[^#]*pam_lastlog.so/s/^/# /' "$TARGET_DIR/etc/pam.d/login"

-# Allow bash to be login shells, it is added automatically when selected
-# in menuyconfig, but not when BusyBox provides a symlink (for ash).
-# The /bin/{true,false} are old UNIX beart means of disabling a user.
+# Allow pdmenu (setup) and bash to be login shells, bash is added
+# automatically when selected in menuyconfig, but not when BusyBox
+# provides a symlink (for ash).  The /bin/{true,false} are old UNIX
+# beart means of disabling a user.
+grep -qsE '^/usr/bin/pdmenu$$' "$TARGET_DIR/etc/shells" \
+        || echo "/usr/bin/pdmenu" >> "$TARGET_DIR/etc/shells"
 grep -qsE '^/bin/bash$$' "$TARGET_DIR/etc/shells" \
        || echo "/bin/bash" >> "$TARGET_DIR/etc/shells"
 grep -qsE '^/bin/true$$' "$TARGET_DIR/etc/shells" \
@@ -108,6 +114,12 @@ grep -qsE '^/bin/true$$' "$TARGET_DIR/etc/shells" \
 grep -qsE '^/bin/false$$' "$TARGET_DIR/etc/shells" \
        || echo "/bin/false" >> "$TARGET_DIR/etc/shells"

+boards=$(${BR2_EXTERNAL_INFIX_PATH}/board/common/selected-boards.sh ${BR2_EXTERNAL_INFIX_PATH} ${O})
+
+for board in $boards; do
+	[ ! -f "${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh" ] && continue
+	${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh
+done
 # Allow clish (symlink to /usr/bin/klish) to be a login shell
 grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
        || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"
@@ -1,8 +1,7 @@
 # Start a container instance (%i) and redirect logs to /log/container
-# Give podman enough time to properly shut down the container, kill:30,
-# which is also matched in the container script (podman default is 10!)
-# The pre:script, responsibe for fetching a remote image and calling on
-# 'podman load', must not have a timeout.
+# Give podman enough time to properly shut down the container, kill:30
+# The pre:script, which is responsibe for fetching a remote image, must
+# not have a timeout.  The cleanup should take no longer than a minute.
 sysv    log:prio:local1,tag:%i kill:30 pid:!/run/container:%i.pid \
-	pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container   \
+	pre:0,/usr/sbin/container cleanup:60,/usr/sbin/container   \
 	[2345] <!> :%i container -n %i -- container %i
@@ -1,3 +0,0 @@
-service [2345] <!pid/syslogd> reload:'firewall-cmd -q --reload' \
-	firewalld --nofork --log-target syslog                  \
-	-- Firewall daemon
@@ -15,9 +15,9 @@ cfgfs		/config		configfs	nofail,noauto		0	0
 # The chosen backing storage for the overlays placed on /cfg, /etc,
 # /home, /root, and /var, are determined dynamically by /usr/libexec/infix/mnt
 # depending on the available devices.
-mnttmp		/mnt/tmp	tmpfs	defaults					0	0
-LABEL=aux	/mnt/aux	ext2	noatime,nodiratime,noauto,errors=remount-ro	0	0
-LABEL=var	/mnt/var	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
-LABEL=cfg	/mnt/cfg	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
-hostfs		/mnt/host	9p	cache=none,msize=16384,noauto			0	0
-/usr/libexec/infix/mnt#	/cfg	helper	none						0	0
+mnttmp		/mnt/tmp	tmpfs		defaults			0	0
+LABEL=aux	/mnt/aux	auto		noatime,nodiratime,noauto	0	0
+LABEL=var	/mnt/var	auto		noatime,nodiratime,noauto	0	0
+LABEL=cfg	/mnt/cfg	auto		noatime,nodiratime,noauto	0	0
+hostfs		/mnt/host	9p		cache=none,msize=16384,noauto	0	0
+/usr/libexec/infix/mnt#	/cfg	helper		none				0	0
@@ -0,0 +1,3 @@
+# Do not authorize usb ports before they have been checked in in the device-tree
+options usbcore authorized_default=0
+ 
@@ -1,6 +0,0 @@
-# Log firewall denied/rejected packet logs to dedicated file
-# https://www.cyberciti.biz/faq/enable-firewalld-logging-for-denied-packets-on-linux/
-:msg, contains, "_DROP"
-kern.*                  -/var/log/firewall.log
-:msg, contains, "_REJECT"
-kern.*                  -/var/log/firewall.log
@@ -1,18 +1,11 @@
 #!/bin/sh
-opts="-n1"
-
-if [ "$1" = "-q" ]; then
-    opts="$opts -s"
-    shift
-fi
-
 Q=$@

 /bin/echo -n "$Q, are you sure (y/N)? "
-read $opts yorn
+read -n1 yorn
 echo

-if [ "x$yorn" != "xy" ] && [ "x$yorn" != "xY" ]; then
+if [ x$yorn != "xy" ] && [ x$yorn != "xY" ]; then
   echo "OK, aborting."
   exit 1
 fi
@@ -98,45 +98,13 @@ class DTSystem:
        data = dict(zip(names, phs))
        if data != {}:
            out["usb-ports"] = []
-
-        name_counts = {}  # Track how many times each name has been used
-
        for name, ph in data.items():
-            for dev in self.devices_from_ph(ph):
-                # Filter to only USB bus devices (usbN) that have authorized_default
-                # This avoids duplicate entries for platform devices and hub interfaces
-                if not dev.hasattr("authorized_default"):
-                    continue
-
-                # Convert platform path to /sys/bus/usb/devices/usbN path
-                # by finding the matching symlink in /sys/bus/usb/devices/
-                usb_path = dev.syspath
-                try:
-                    real_device = os.path.realpath(dev.syspath)
-                    usb_bus_dir = "/sys/bus/usb/devices"
-                    if os.path.exists(usb_bus_dir):
-                        for entry in os.listdir(usb_bus_dir):
-                            if not entry.startswith("usb"):
-                                continue
-                            candidate = os.path.join(usb_bus_dir, entry)
-                            if os.path.realpath(candidate) == real_device:
-                                usb_path = candidate
-                                break
-                except:
-                    pass  # Fall back to original path if resolution fails
-
-                # Handle name deduplication: first use gets bare name, subsequent get numbers
-                if name not in name_counts:
-                    name_counts[name] = 1
-                    final_name = name
-                else:
-                    name_counts[name] += 1
-                    final_name = f"{name}{name_counts[name]}"
-
-                out["usb-ports"].append({
-                    "name": final_name,
-                    "path": usb_path
-                })
+            [out["usb-ports"].extend([{
+                "name": name,
+                "path": dev.attrpath("authorized")}, {
+                    "name": name,
+                    "path": dev.attrpath("authorized_default")
+                }]) for dev in self.devices_from_ph(ph)]

    def infix_devices(self, kind):
        phs = self.__get_phandle_array(kind)
@@ -172,13 +140,20 @@ class QEMUSystem:
        return [self.product_vpd()]

    def usb_ports(self):
-        ports = [{
-            "name": "USB1",
-            "path": "/sys/bus/usb/devices/usb1"
-        }, {
-            "name": "USB2",
-            "path": "/sys/bus/usb/devices/usb2"
-        }]
+        ports = [
+            {
+                "name": "USB",
+                "path": "/sys/bus/usb/devices/usb1/authorized"
+            }, {
+                "name": "USB",
+                "path": "/sys/bus/usb/devices/usb1/authorized_default"
+            }, {
+                "name": "USB2",
+                "path": "/sys/bus/usb/devices/usb2/authorized"
+            }, {
+                "name": "USB2",
+                "path": "/sys/bus/usb/devices/usb2/authorized_default"
+            }]
        return ports


@@ -277,12 +252,8 @@ def vpd_inject(out, vpds):
            break


-def fallback_base_mac():
-    """Find MAC address of first suitable non-loopback interface.
-
-    Prefers real (globally unique) MACs over locally administered ones.
-    Prioritizes interface types: eth* > wan > wifi* > others.
-    """
+def qemu_base_mac():
+    """Find MAC address of first non-loopback interface, subtract with 1"""
    base_path = '/sys/class/net'
    interfaces = []

@@ -294,41 +265,13 @@ def fallback_base_mac():
            fn = os.path.join(base_path, iface, 'address')
            with open(fn, 'r', encoding='ascii') as f:
                mac = f.read().strip()
-
-            # Check if locally administered (bit 1 of first octet is set)
-            first_byte = int(mac.split(':')[0], 16)
-            is_local = bool(first_byte & 0x02)
-
-            # Prefer: eth* > wan > wifi* > others, then real MACs > local MACs
-            priority = 0
-            if iface.startswith('eth'):
-                priority = 400
-            elif iface == 'wan':
-                priority = 300
-            elif iface.startswith('wifi'):
-                priority = 200
-            else:
-                priority = 100
-
-            # Real MACs get +100 bonus
-            if not is_local:
-                priority += 100
-
-            interfaces.append((priority, iface, mac))
+            interfaces.append((mac, iface))
        except FileNotFoundError:
            continue

    if interfaces:
-        interfaces.sort(reverse=True)  # Highest priority first
-        return interfaces[0][2]  # Return MAC
-
-    return None
-
-
-def qemu_base_mac():
-    """Find MAC address of first non-loopback interface, subtract with 1"""
-    mac = fallback_base_mac()
-    if mac:
+        interfaces.sort()
+        mac  = interfaces[0][0]
        mac  = int(mac.replace(':', ''), 16)
        mac -= 1
        mac %= 1 << 48
@@ -365,37 +308,37 @@ def probe_qemusystem(out):
    subprocess.run("initctl -nbq cond set qemu".split(), check=False)
    return 0

-
-def generic_usb_ports(out):
-    """Generic USB port discovery - works for all systems"""
-    ports = []
-    usb_base = "/sys/bus/usb/devices"
-
-    if not os.path.exists(usb_base):
-        return
-
-    for entry in sorted(os.listdir(usb_base)):
-        # Only look at root hubs (usbN)
-        if not entry.startswith("usb"):
-            continue
-
-        device_path = os.path.join(usb_base, entry)
-        # Check if this is a root hub (has authorized files)
-        if os.path.exists(os.path.join(device_path, "authorized")):
-            # Extract number from usbN
-            num = entry.replace("usb", "")
-            ports.append({
-                "num": num,
-                "path": device_path
-            })
-
-    # Name ports: "USB" for single port, "USB1", "USB2", etc. for multiple
-    if ports:
-        if len(ports) == 1:
-            out["usb-ports"] = [{"name": "USB", "path": ports[0]["path"]}]
-        else:
-            out["usb-ports"] = [{"name": f"USB{p['num']}", "path": p["path"]} for p in ports]
-
+def rasberry_pi_4_usb_ports(out):
+    out["usb-ports"] = [
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized_default"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-1/authorized",
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-0:1.0/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized_default"
+        },
+        {
+            "name": "USB3",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/2-0:1.0/authorized"
+        }
+    ]

 def probe_dtsystem(out):
    """Probe DTS based system, expects a VPD in ONIE PROM format."""
@@ -406,11 +349,11 @@ def probe_dtsystem(out):
    if model:
        out["product-name"] = model

-    # Try devicetree-based USB discovery first, fallback to generic
-    dtsys.infix_usb_devices(out)
-    if "usb-ports" not in out or not out["usb-ports"]:
-        generic_usb_ports(out)
-
+    # Since rpi4 has USB on PCIe, there is no phandle reference
+    if model and model.startswith("Raspberry Pi 4"):
+        rasberry_pi_4_usb_ports(out)
+    else:
+        dtsys.infix_usb_devices(out)
    out["compatible"] = dtsys.base.str_array("compatible")

    staticpw = dtsys.infix.str("factory-password-hash")
@@ -418,11 +361,6 @@ def probe_dtsystem(out):
        out["factory-password-hash"] = staticpw

    vpd_inject(out, vpds)
-
-    # Fallback to interface MAC if VPD doesn't provide one (e.g., SBCs)
-    if not out["mac-address"]:
-        out["mac-address"] = fallback_base_mac()
-
    return 0


@@ -19,7 +19,6 @@ set -e

 nm=$(basename "$0")
 err=0
-mmc=""
 opt="-k"

 # External button or bootloader changed kernel command line
@@ -44,257 +43,12 @@ check_factory()
 factory_reset()
 {
    find /sys/class/leds/ -type l -exec sh -c 'echo 100 > $0/brightness' {} \;
-    print_start "Resetting to factory defaults."
-    logger $opt -p user.notice -t "$nm" "Resetting to factory defaults."
+    logger $opt -p user.crit -t "$nm" "Resetting to factory defaults."

    rm -rf /mnt/cfg/* /mnt/var/*
+
+    logger $opt -p user.crit -t "$nm" "Factory reset complete."
    sync
-
-    logger $opt -p user.notice -t "$nm" "Factory reset complete."
-    print_end 0 "Factory reset complete."
-    print_restore
-}
-
-is_mmc()
-{
-    [ -n "$mmc" ] && return $mmc
-
-    # Check if primary or secondary partition (our rootfs) is on MMC
-    for label in primary secondary; do
-        devname=$(find_partition_by_label "$label" 2>/dev/null)
-        if [ -n "$devname" ]; then
-            case "$devname" in
-                mmcblk*)
-		    mmc=0
-                    return 0
-                    ;;
-            esac
-        fi
-    done
-
-    mmc=1
-    return 1
-}
-
-wait_mmc()
-{
-    # Try up to 50 times with 0.2s sleep = 10 second timeout
-    for _ in $(seq 50); do
-        if ls /dev/mmcblk* >/dev/null 2>&1; then
-            logger $opt -p user.notice -t "$nm" "MMC device available after delay"
-            return 0
-        fi
-        sleep .2
-    done
-
-    logger $opt -p user.warn -t "$nm" "Timeout waiting for MMC device"
-    return 1
-}
-
-# This early on we don't have the luxury of /dev/disk/by-label/$1
-find_partition_by_label()
-{
-    label="$1"
-
-    for diskpath in /sys/class/block/*; do
-	devname=$(basename "$diskpath")
-
-	# Skip partitions, only check whole disks
-	[ -f "$diskpath/partition" ] && continue
-
-	# Skip ram, loop, and other virtual devices
-	case "$devname" in
-	    ram*|loop*|nullb*|dm-*) continue ;;
-	esac
-
-	disk="/dev/$devname"
-
-	#
-	# 1. Try GPT/MBR partition label using sgdisk
-	#
-	result=$(sgdisk -p "$disk" 2>/dev/null | awk -v label="$label" -v devname="$devname" '
-	    /^ *[0-9]/ {
-		if ($7 == label) {
-		    if (devname ~ /^(mmcblk|nvme|loop)/)
-			print devname "p" $1;
-		    else
-			print devname $1;
-		    exit 0;
-		}
-	    }
-	')
-
-	if [ -n "$result" ]; then
-	    echo "$result"
-	    return 0
-	fi
-
-	#
-	# 2. Fallback: Check if the whole disk is an ext4/ext2/ext3 filesystem
-	#
-
-	# Check for ext4/ext2/ext3 magic number (0xEF53) at offset 1080 (1024+56).
-	magic_number=$(dd if="$disk" bs=1 skip=1080 count=2 2>/dev/null | od -t x2 -A n | tr -d ' \n')
-
-	# Check for both Little-Endian ('53ef') and Big-Endian ('ef53') interpretations of 0xEF53.
-	# This supports bi-endian architectures like MIPS that may run in BE mode,
-	# as well as the LE mode which is standard for RISC-V and ext filesystems.
-	if [ "$magic_number" = "ef53" ] || [ "$magic_number" = "53ef" ]; then
-
-	    # Read the volume label from offset 1144 (1024+120)
-	    fslabel=$(dd if="$disk" bs=1 skip=1144 count=16 2>/dev/null | tr -d '\000')
-	    logger $opt -p user.notice -t "$nm" "Found label $fslabel on disk $disk ..."
-
-	    if [ "$fslabel" = "$label" ]; then
-		echo "$devname"
-		return 0
-	    fi
-	fi
-    done
-
-    return 1
-}
-
-status()
-{
-    GREEN="$(printf '\033[1;32m')"
-    RED="$(printf '\033[1;31m')"
-    YELLOW="$(printf '\033[1;33m')"
-    BOLD="$(printf '\033[1m')"
-    RESET="$(printf '\033[0m')"
-
-    case $1 in
-        0) color=$GREEN; text=' OK ' ;;
-        1) color=$RED;   text='FAIL' ;;
-        2) color=$YELLOW;text='WARN' ;;
-        *) color=$YELLOW;text=' ⋯  ' ;;
-    esac
-
-    printf '%s[%s%s%s%s]%s ' "$BOLD" "$color" "$text" "$RESET" "$BOLD" "$RESET"
-}
-
-print_start()
-{
-    printf '\r\033[K%s%s' "$(status 3)" "$*" > /dev/console
-}
-
-print_end()
-{
-    rc=$1; shift
-    if [ $# -gt 0 ]; then
-        printf '\r\033[K%s%s\n' "$(status "$rc")" "$*" > /dev/console
-    else
-        printf '\r%s\n' "$(status "$rc")" > /dev/console
-    fi
-}
-
-# Restore Finit's original progress message so its [ OK ] appears correctly
-print_restore()
-{
-    print_start "Mounting filesystems from /etc/fstab"
-}
-
-# Helper to log resize error and create failure marker (stage 1)
-resize_err()
-{
-    print_end 1
-    logger $opt -p user.err -t "$nm" "$1"
-    echo "1" > /mnt/aux/resized.failed
-
-    return 1
-}
-
-# Helper to log filesystem resize error and rename pending marker (stage 2)
-resize_fs_err()
-{
-    print_end 1
-    logger $opt -p user.err -t "$nm" "$1"
-    rm -f /mnt/aux/resized.pending
-    echo "1" > /mnt/aux/resized.failed
-
-    return 1
-}
-
-# Stage 1: Expand the given partition to fill up the rest of storage
-# On success, creates "resized.pending" marker and reboots.
-# On failure, creates "resized.failed" marker and returns 1.
-resize_partition()
-{
-    label="$1"
-
-    print_start "Resizing /var partition on sdcard, please wait ..."
-
-    devname=$(find_partition_by_label "$label")
-    [ -z "$devname" ] && resize_err "Label \"$label\" not found"
-
-    part="/dev/$devname"
-    diskname=$(basename "$(readlink -f "/sys/class/block/$devname/..")")
-    disk="/dev/$diskname"
-    partnum="${devname##*[^0-9]}"
-
-    logger $opt -p user.notice -t "$nm" "Found partition $part (partition $partnum on $disk)"
-
-    start=$(sgdisk -i "$partnum" "$disk" 2>/dev/null | grep "First sector:" | awk '{print $3}')
-    [ -z "$start" ] && resize_err "Could not determine start sector for partition $partnum"
-
-    logger $opt -p user.notice -t "$nm" "Expanding partition $partnum from sector $start to end of disk"
-
-    sgdisk -e "$disk" 2>&1 | logger $opt -p user.notice -t "$nm" || \
-	resize_err "Failed expanding GPT on $disk"
-
-    sgdisk -d "$partnum" "$disk" >/dev/null 2>&1 || \
-	resize_err "Failed deleting partition $partnum on $disk"
-
-    sgdisk -n "$partnum:$start:0" "$disk" >/dev/null 2>&1 || \
-	resize_err "Failed recreating partition $partnum on $disk"
-
-    sgdisk -t "$partnum:8300" "$disk" >/dev/null 2>&1 || \
-	resize_err "Failed setting partition type on $disk"
-
-    sgdisk -c "$partnum:$label" "$disk" >/dev/null 2>&1 || \
-	resize_err "Failed setting partition label on $disk"
-
-    logger $opt -p user.notice -t "$nm" "Partition table updated on $disk"
-    partprobe "$disk" 2>/dev/null
-
-    # Mark stage 1 complete, stage 2 will happen after reboot
-    echo "1" > /mnt/aux/resized.pending
-    sync
-
-    print_end 0 "Resizing /var partition on sdcard, done. Rebooting ..."
-    logger $opt -p user.notice -t "$nm" "Partition expanded, rebooting to resize filesystem"
-
-    reboot -f
-}
-
-# Stage 2: Complete filesystem resize after partition table has been expanded
-# On success, renames "resized.pending" to "resized".
-# On failure, renames "resized.pending" to "resized.failed" and returns 1.
-resize_filesystem()
-{
-    label="$1"
-
-    print_start "Expanding /var filesystem, please wait ..."
-
-    devname=$(find_partition_by_label "$label")
-    [ -z "$devname" ] && resize_fs_err "Label \"$label\" not found for filesystem resize"
-
-    part="/dev/$devname"
-
-    logger $opt -p user.notice -t "$nm" "Resizing filesystem on $part"
-    resize2fs "$part" 2>&1 | logger $opt -p user.notice -t "$nm" || \
-	resize_fs_err "Failed resizing filesystem on $part"
-
-    tune2fs -O resize_inode "$part" 2>/dev/null
-    print_end 0 "Expanding /var filesystem, done."
-    logger $opt -p user.notice -t "$nm" "Filesystem resize complete"
-
-    # Mark resize complete successfully
-    mv /mnt/aux/resized.pending /mnt/aux/resized
-    sync
-
-    print_restore
-    return 0
 }

 mount_rw()
@@ -302,29 +56,7 @@ mount_rw()
    # If something is already setup, leave it be.
    mountpoint -q "/$1" && return 0

-    # If partition doesn't exist (var is optional), signal caller.
-    find_partition_by_label "$1" >/dev/null || return 1
-
-    # Check if /var has been resized to fill the sdcard/eMMC
-    if [ "$1" = "var" ] && is_mmc; then
-	if [ -f /mnt/aux/resized ] || [ -f /mnt/aux/resized.failed ]; then
-	    # 3. Already done
-	    :
-	elif [ -f /mnt/aux/resized.pending ]; then
-	    # 2. After reboot we can resize ext4
-	    resize_filesystem "$1"
-	else
-	    # 1. Start with resizing the var partition to the end of the media
-	    resize_partition "$1"
-	fi
-    fi
-
    # TODO: Also look for UBI partitions
-
-    # Disable periodic fsck, yet keeping safety checks on ext4
-    if grep "LABEL=$label" /etc/fstab |grep -q ext4; then
-	tune2fs -c 0 -i 0 LABEL="$1" 2>/dev/null
-    fi
    mount LABEL="$1" 2>/dev/null && return 0

    return 1
@@ -371,14 +103,6 @@ if ! logger -? |grep -q "Log to kernel"; then
    opt="-c"
 fi

-# On boards with MMC/SD cards, the controller may probe slowly, in particular
-# if we netboot (ram load) the device - wait for it if not already available
-if is_mmc && ! ls /dev/mmcblk* >/dev/null 2>&1; then
-    wait_mmc
-fi
-
-# The aux partition must be mounted before everything else since it's used
-# for internal bookkeeping.
 if ! mount_rw aux >/dev/null 2>&1; then
    logger $opt -p user.warn -t "$nm" \
 	   "No auxiliary partition found, software updates not supported."
@@ -6,33 +6,19 @@
 # NOTE: when creating/deleting containers, remember 'initctl reload' to
 #       activate the changes!  In confd this is already handled.
 #
-# TODO: this script should be refactored to take a .cfg file instead for
-#       each container.  For details, see this pull request discussion:
-#       https://github.com/kernelkit/infix/pull/1151#discussion_r2444851292
-#
-# shellcheck disable=SC1001
-CLEANUP=/var/lib/containers/cleanup
 DOWNLOADS=/var/lib/containers/oci
 BUILTIN=/lib/oci
 BASEDIR=/var/tmp
 container=$0
 checksum=""
 extracted=
-timeout=30		    # NOTE: matched with container@.conf
+timeout=30
 dir=""
 all=""
 env=""
 port=""
 force=

-# Variable shared across subshells
-export meta_sha=""
-
-dbg()
-{
-    logger -I $PPID -t container -p local1.debug -- "$*"
-}
-
 log()
 {
    logger -I $PPID -t container -p local1.notice -- "$*"
@@ -58,104 +44,6 @@ pidfn()
    echo "/run/containers/${1}.pid"
 }

-calc_sha()
-{
-    sha256sum "$1" 2>/dev/null | awk '{print $1}'
-}
-
-# Check image transport, return 0 if remote, 1 if local
-is_remote()
-{
-    image=$(awk '/^# meta-image:/ {print $3}' "$1" 2>/dev/null || echo "")
-    echo "$image"
-
-    case "$image" in
-	oci\:* | oci-archive\:* | docker-archive\:* | docker-daemon\:* | \
-	    dir\:* | containers-storage\:* | ostree\:* | sif\:* | /*)
-	    return 1
-	    ;;
-	*)
-	    return 0
-	    ;;
-    esac
-}
-
-# Check loaded image in container store vs archive, as well as verifying
-# the container instance vs. the configuration.
-#
-# This is an optimization to cut down startup times.
-is_uptodate()
-{
-    img_sha=$(awk '/^# meta-image-sha256:/ {print $3}' "$script" 2>/dev/null)
-    if [ -n "$img_sha" ]; then
-	# Local image optimization: check if archive SHA matches stored sidecar file
-	img=$(awk '/^# meta-image:/ {print $3}' "$script" 2>/dev/null)
-	if [ -n "$img" ]; then
-	    case "$img" in
-		docker-archive\:*)
-		    archive_path="${img#docker-archive:}"
-		    ;;
-		oci-archive\:*)
-		    archive_path="${img#oci-archive:}"
-		    ;;
-		*)
-		    archive_path="$img"
-		    ;;
-	    esac
-
- 	    # Handle relative paths - check BUILTIN and DOWNLOADS
-	    if [ ! -f "$archive_path" ]; then
-		if [ -f "$DOWNLOADS/$(basename "$archive_path")" ]; then
-		    archive_path="$DOWNLOADS/$(basename "$archive_path")"
-		elif [ -f "$BUILTIN/$(basename "$archive_path")" ]; then
-		    archive_path="$BUILTIN/$(basename "$archive_path")"
-		fi
-	    fi
-
-	    # Check if the archive exists and compare SHA with sidecar file
-	    if [ -f "$archive_path" ]; then
-		archive_basename=$(basename "$archive_path")
-		sha_file="$DOWNLOADS/${archive_basename}.sha256"
-
-		if [ -f "$sha_file" ]; then
-		    stored_sha=$(cat "$sha_file" 2>/dev/null)
-		    current_sha=$(calc_sha "$archive_path")
-
-		    # If SHA matches, check container instance
-		    if [ "$stored_sha" = "$current_sha" ]; then
-			if podman container exists "$name"; then
-			    config_sha=$(calc_sha "$script")
-			    container_sha=$(podman inspect "$name" --format '{{index .Config.Labels "config-sha256"}}' 2>/dev/null)
-			    container_img_sha=$(podman inspect "$name" --format '{{index .Config.Labels "meta-image-sha256"}}' 2>/dev/null)
-
-			    if [ "$container_img_sha" = "$img_sha" ] && [ "$container_sha" = "$config_sha" ]; then
-				# Unmodified local image and configuration
-				return 0
-			    fi
-			fi
-		    else
-			# Archive changed (e.g., rootfs upgrade) - need to reload
-			dbg "Archive SHA changed, will reload image and recreate container"
-		    fi
-		fi
-	    fi
-	fi
-    else
-	# Remote image optimization: check config-sha256 only
-	if podman container exists "$name"; then
-	    config_sha=$(calc_sha "$script")
-	    container_sha=$(podman inspect "$name" --format '{{index .Config.Labels "config-sha256"}}' 2>/dev/null)
-
-	    if [ "$container_sha" = "$config_sha" ]; then
-		# Unmodified local image and configuration
-		return 0
-	    fi
-	fi
-    fi
-
-    return 1
-}
-
 check()
 {
    file=$1
@@ -186,16 +74,11 @@ fetch()
    dst="$DOWNLOADS/$file"

    cd "$DOWNLOADS" || return
-    if [ -f "$file" ]; then
-	if [ -n "$force" ]; then
-	    log "Force flag set, removing cached $file and re-downloading."
-	    rm -f "$file"
-	else
-	    log "$file already available."
-	    if check "$file"; then
-		echo "$dst"
-		return 0
-	    fi
+    if [ -e "$file" ]; then
+	log "$file already available."
+	if check "$file"; then
+	    echo "$dst"
+	    return 0
 	fi
    fi

@@ -235,7 +118,6 @@ load_archive()
 {
    uri=$1
    tag=$2
-    tmp=$3
    img=$(basename "$uri")

    # Supported transports for load and create
@@ -252,8 +134,7 @@ load_archive()
 	    fi
            ;;
 	*)			# docker://*, docker-archive:*, or URL
-	    # Skip existence check if force flag is set (e.g., for upgrade command)
-	    if [ -z "$force" ] && podman image exists "$img"; then
+	    if podman image exists "$img"; then
 		echo "$img"
 		return 0
 	    fi
@@ -268,10 +149,10 @@ load_archive()
 	    ;;
    esac

-    if [ ! -f "$file" ]; then
-	if [ -f "$DOWNLOADS/$file" ]; then
+    if [ ! -e "$file" ]; then
+	if [ -e "$DOWNLOADS/$file" ]; then
 	    file="$DOWNLOADS/$file"
-	elif [ -f "$BUILTIN/$file" ]; then
+	elif [ -e "$BUILTIN/$file" ]; then
 	    file="$BUILTIN/$file"
 	else
 	    err 1 "cannot find OCI archive $file in URI $uri"
@@ -324,7 +205,7 @@ load_archive()
    fi

    [ -n "$quiet" ] || log "Loading OCI image $dir ..."
-    output=$(nice podman load -qi "$dir")
+    output=$(podman load -qi "$dir")

    # Extract image ID from podman load output:
    # "Loaded image: sha256:cd9d0aaf81be..."
@@ -349,23 +230,6 @@ load_archive()
 	err 1 "failed tagging image as $tag"
    fi

-    # Save archive SHA256 to sidecar file to enable optimization
-    # This applies to both local archives and downloaded remote archives
-    if [ -f "$file" ]; then
-	img_sha256=$(calc_sha "$file")
-	archive_basename=$(basename "$file")
-	sha_file="$DOWNLOADS/${archive_basename}.sha256"
-
-	mkdir -p "$DOWNLOADS"
-
-	echo "$img_sha256" > "$sha_file"
-	if [ -n "$tmp" ]; then
-	    echo "$img_sha256" > "$tmp"
-	fi
-
-	log "Saved archive checksum to $sha_file"
-    fi
-
    # Clean up after ourselves
    if [ -n "$extracted" ]; then
 	log "Cleaning up extracted $dir"
@@ -397,16 +261,10 @@ create()

    # Unpack and load docker-archive/oci/oci-archive, returning image
    # name, or return docker:// URL for download.
-    sha_file=$(mktemp)
-    if ! image=$(load_archive "$image" "" "$sha_file"); then
+    if ! image=$(load_archive "$image"); then
 	exit 1
    fi

-    if [ -s "$sha_file" ]; then
-	img_sha=$(cat "$sha_file" 2>/dev/null || echo "")
-	rm "$sha_file"
-    fi
-
    if [ -z "$logging" ]; then
 	logging="--log-driver syslog"
    fi
@@ -437,24 +295,9 @@ create()
 	args="$args --network=none"
    fi

-    # Add optimization labels for meta-image-sha256 and config checksum
-    script="/run/containers/${name}.sh"
-    if [ -f "$script" ]; then
- 	if [ -z "$img_sha" ]; then
-	    # Extract meta-image-sha256 from script if present
-	    img_sha=$(awk '/^# meta-image-sha256:/ {print $3}' "$script" 2>/dev/null)
-	fi
-	if [ -n "$img_sha" ]; then
-	    args="$args --label meta-image-sha256=$img_sha"
-	fi
-
-	# Add config checksum label
-	args="$args --label config-sha256=$(calc_sha "$script")"
-    fi
-
    # shellcheck disable=SC2048
    log "podman create --name $name --conmon-pidfile=$pidfile $args $image $*"
-    if nice podman create --name "$name" --conmon-pidfile="$pidfile" $args "$image" $*; then
+    if podman create --name "$name" --conmon-pidfile="$pidfile" $args "$image" $*; then
 	[ -n "$quiet"  ] || log "Successfully created container $name from $image"
 	[ -n "$manual" ] || start "$name"

@@ -488,90 +331,11 @@ delete()
 	sleep 1
    done

-    # NOTE: -v does not remove *named volumes*
    podman rm -vif "$name" >/dev/null 2>&1
    [ -n "$quiet" ] || log "Container $name has been removed."
-}

-# Called by Finit cleanup:script when a container service is removed.
-# Processes all container instance IDs found in $CLEANUP/<name>/ directory
-# and removes them. This handles the case where a container with the same
-# name but different configuration replaces an old one.
-#
-# Note: Volumes are NOT automatically removed to prevent accidental data loss.
-#       Use 'admin-exec container prune' to clean up unused volumes manually.
-cleanup()
-{
-    if [ -z "$name" ]; then
-	log "cleanup: missing container name"
-	return 1
-    fi
-
-    cleanup_dir="$CLEANUP/$name"
-    if [ ! -d "$cleanup_dir" ]; then
-	log "cleanup: no cleanup directory for $name, nothing to do"
-	return 0
-    fi
-
-    log "Cleaning up container instances for: $name"
-
-    # Remove all container instances by ID from the cleanup directory
-    for id_file in "$cleanup_dir"/*; do
-	[ -f "$id_file" ] || continue
-	cid=$(basename "$id_file")
-
-	# Extract image name and meta-image-sha256 from the container instance labels
-	# These are the image in container store and the trace to an oci-archive.tar.gz
-	img=$(podman inspect "$cid" 2>/dev/null | jq -r '.[].ImageName' 2>/dev/null || echo "")
-	sha=$(podman inspect "$cid" --format '{{index .Config.Labels "meta-image-sha256"}}' 2>/dev/null || echo "")
-
-	log "Removing container instance with ID: ${cid:0:12}..."
-	podman rm -vif "$cid" >/dev/null 2>&1
-	rm -f "$id_file"
-
-	# Clean up the image if it exists and is not used by other containers
-	if [ -n "$img" ] && [ "$img" != "null" ]; then
-	    if ! podman ps -a --format "{{.Image}}" | grep -q "^${img}$"; then
-		log "Removing unused image: $img"
-		podman rmi "$img" 2>/dev/null || true
-
-		# Also remove archive and sidecar checksum file from $DOWNLOADS for remote images
-		# I.e., $DOWNLOADS/oci-archive.tar.gz and $DOWNLOADS/oci-archive.tar.gz.sha256
-		if [ -n "$sha" ] && [ -d "$DOWNLOADS" ]; then
-		    # Search for matching sidecar file containing this SHA
-		    for sha_file in "$DOWNLOADS"/*.sha256; do
-			[ -f "$sha_file" ] || continue
-			stored_sha=$(cat "$sha_file" 2>/dev/null || echo "")
-			if [ "$stored_sha" = "$sha" ]; then
-			    # Found matching sidecar - derive archive filename by stripping .sha256
-			    archive="${sha_file%.sha256}"
-			    if [ -f "$archive" ]; then
-				# Safety check: verify archive SHA matches before removing
-				if [ "$(calc_sha "$archive")" = "$sha" ]; then
-				    log "Removing archive: $archive"
-				    rm -f "$archive"
-				else
-				    log "Warning: archive SHA mismatch for $archive, not removing"
-				fi
-			    fi
-
-			    log "Removing sidecar file: $sha_file"
-			    rm -f "$sha_file"
-			    break
-			fi
-		    done
-		fi
-	    else
-		log "Image $img still in use by other containers, not removing"
-	    fi
-	fi
-    done
-
-    # Remove the cleanup directory for this container, and parent if empty
-    rmdir "$cleanup_dir" 2>/dev/null
-    rmdir "$CLEANUP" 2>/dev/null
-
-    exit 0
+    cnt=$(podman image prune -af | wc -l)
+    log "Pruned $cnt image(s)"
 }

 waitfor()
@@ -611,42 +375,31 @@ stop()
    # Real work is done by wrap() courtesy of finit sysv emulation
 }

-# When called by Finit: `initctl stop foo`, the container script
-# is called as `container -n $foo stop`.  For the stop command
-# we want to bypass the default 10 second timeout.
-#
-# NOTE: containers have three phases: setup, running, and teardown.
-#       the setup phase is this script trying to fetch the image.
 wrap()
 {
    name=$1
    cmd=$2
-    args=
    pidfile=$(pidfn "$name")

-    if [ "$cmd" = "stop" ]; then
-	# The setup phase may run forever in the background trying to fetch
-	# the image.  It saves its PID in /run/containers/${name}.pid
-	if [ -f "$pidfile" ]; then
-            pid=$(cat "$pidfile")
+    # Containers have three phases: setup, running, and teardown.

-	    # Check if setup is still running ...
-	    if kill -0 "$pid" 2>/dev/null; then
-		kill "$pid"
-		wait "$pid" 2>/dev/null
-            fi
+    # The setup phase may run forever in the background trying to fetch
+    # the image.  It saves its PID in /run/containers/${name}.pid
+    if [ "$cmd" = "stop" ] && [ -f "$pidfile" ]; then
+        pid=$(cat "$pidfile")

-            rm -f "$pidfile"
-            return 0
-	fi
+	# Check if setup is still running ...
+	if kill -0 "$pid" 2>/dev/null; then
+            kill "$pid"
+            wait "$pid" 2>/dev/null
+        fi

-	# Only the 'podman stop' command takes -i and --timeout
-	args="-i --timeout $timeout"
+        rm -f "$pidfile"
+        return 0
    fi

    # Skip "echo $name" from podman start in log
-    # shellcheck disable=SC2086
-    podman "$cmd" $args "$name" >/dev/null
+    podman "$cmd" "$name" >/dev/null
 }

 # Removes network $1 from all containers
@@ -677,7 +430,7 @@ netrestart()
    done
 }

-atexit()
+cleanup()
 {
    pidfile=$(pidfn "$name")

@@ -697,7 +450,7 @@ usage:
  container [opt] cmd [arg]

 options:
-  -a, --all                Show all, do all, remove all, of something
+  -a, --all                Show all, of something
      --dns NAMESERVER     Set nameserver(s) when creating a container
      --dns-search LIST    Set host lookup search list when creating container
      --cap-add CAP        Add capability to unprivileged container
@@ -707,7 +460,7 @@ options:
  -d, --detach             Detach a container started with 'run IMG [CMD]'
  -e, --env FILE           Environment variables when creating container
      --entrypoint         Disable container image's ENTRYPOINT, run cmd + arg
-  -f, --force              Force operation, e.g. remove, or force image re-fetch
+  -f, --force              Force operation, e.g. remove
  -h, --help               Show this help text
      --hostname NAME      Set hostname when creating container
      --net NETWORK        Network interface(s) when creating or finding container
@@ -737,7 +490,7 @@ commands:
  list    [image | oci]    List names (only) of containers, images, or OCI archives
  load    [NAME | URL] NM  Load OCI tarball fileNAME or URL to image NM
  locate                   Find container that currently owns '--net IFNAME'
-  remove  [IMAGE]          Remove an image, or prune unused images including OCI archives
+  remove   IMAGE           Remove an (unused) container image
  restart [network] NAME   Restart a (crashed) container or container(s) using network
  run      NAME [CMD]      Run a container interactively, with an optional command
  save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
@@ -885,7 +638,7 @@ if [ -n "$cmd" ]; then
    shift
 fi

-trap atexit INT HUP TERM
+trap cleanup INT HUP TERM

 case $cmd in
    # Does not work atm., cannot attach to TTY because
@@ -893,9 +646,6 @@ case $cmd in
    # attach)
    # 	podman attach "$1"
    # 	;;
-    cleanup) # Hidden from public view, use remove or flush commands instead
-	cleanup "$@"
-	;;
    create)
 	[ -n "$quiet" ] || log "Got create args: $*"
 	create "$@"
@@ -989,14 +739,7 @@ case $cmd in
 	podman pull "$@"
 	;;
    remove)
-	if [ -n "$all" ]; then
-	    log "Removing all OCI archives from $DOWNLOADS directory ..."
-	    find "${DOWNLOADS:?}" -mindepth 1 -exec rm -rf {} +
-	    log "Removing all unused container images ..."
-	    podman image prune $all $force
-	else
-	    podman rmi $force -i "$1"
-	fi
+	podman rmi $all $force -i "$1"
 	;;
    run)
 	img=$1
@@ -1032,54 +775,28 @@ case $cmd in
 	script=/run/containers/${name}.sh
 	[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."

-	if is_uptodate "$script"; then
-	    log "Container $name config unchanged, skipping setup"
-	    exit 0
-	fi
-
-	# Capture old image ID before recreation (for surgical cleanup after)
-	old_image_id=""
-	if podman container exists "$name"; then
-	    old_image_id=$(podman inspect "$name" --format '{{.ImageID}}' 2>/dev/null)
-	fi
-
 	# Save our PID in case we get stuck here and someone wants to
 	# stop us, e.g., due to reconfiguration or reboot.
 	pidfile=$(pidfn "${name}")
 	echo $$ > "$pidfile"

-	if image=$(is_remote "$script"); then
-	    while ! "$script"; do
-		log "${name}: setup failed, waiting for network changes ..."
+	while ! "$script"; do
+            log "${name}: setup failed, waiting for network changes ..."

-		# Timeout and retry after 60 seconds, on SIGTERM, or when
-		# any network event is caught.
-		timeout -s TERM -k 1 60 sh -c \
-			'ip monitor address route 2>/dev/null | head -n1 >/dev/null' || true
+	    # Timeout and retry after 60 seconds, on SIGTERM, or when
+	    # any network event is caught.
+	    timeout -s TERM -k 1 60 sh -c \
+		    'ip monitor address route 2>/dev/null | head -n1 >/dev/null' || true

-		# On IP address/route changes, wait a few seconds more to ensure
-		# the system has ample time to react and set things up for us.
-		log "${name}: retrying ..."
-		sleep 2
-	    done
-	elif ! "$script"; then
-	    log "${name}: setup failed for local image $image"
-	    rm -f "$pidfile"
-	    exit 1
-	fi
+	    # On IP address/route changes, wait a few seconds more to ensure
+	    # the system has ample time to react and set things up for us.
+	    log "${name}: retrying ..."
+	    sleep 2
+	done

 	rm -f "$pidfile"
-
-	# Remove the old image if it's not used by any other containers
-	if [ -n "$old_image_id" ]; then
-	    # Check if the old image is still in use by any containers
-	    if ! podman ps -a --format '{{.ImageID}}' | grep -q "^${old_image_id}$"; then
-		log "Removing old image $old_image_id"
-		podman rmi "$old_image_id" 2>/dev/null || true
-	    else
-		log "Old image $old_image_id still in use by other containers, keeping it"
-	    fi
-	fi
+	cnt=$(podman image prune -f | wc -l)
+	log "setup: pruned $cnt image(s)"
 	;;
    shell)
 	if [ -z "$name" ]; then
@@ -1171,89 +888,32 @@ case $cmd in
 	podman stats -i 2
 	;;
    upgrade)
-	if [ -z "$name" ]; then
-	    name="$1"
-	fi
-	script=/run/containers/${name}.sh
+	# Start script used to initially create container
+	script=/run/containers/${1}.sh

-	# Verify container exists
-	if ! podman container exists "$name"; then
-	    echo "No such container: $name"
-	    exit 1
-	fi
-
-	# Check if container uses a mutable tag (e.g., :latest)
-	# Get the actual image name from the running container
-	image_name=$(podman inspect "$name" | jq -r '.[].ImageName')
-	if [ -z "$image_name" ]; then
-	    echo "Cannot determine ImageName for container $name"
-	    exit 1
-	fi
-
-	# Check if image uses :latest or other mutable tag
-	# Images with immutable digests (@sha256:...) don't benefit from upgrade
-	if echo "$image_name" | grep -qE '@sha256:'; then
-	    echo "Container $name uses an immutable image digest ($image_name)"
-	    echo "Upgrade will have no effect. Update the configuration to use a mutable tag."
-	    exit 1
-	fi
-
-	# Get image URI from the container script
-	img=$(awk '/^# meta-image:/ {print $3}' "$script")
+	# Find container image
+	img=$(podman inspect "$1" | jq -r .[].ImageName)
 	if [ -z "$img" ]; then
-	    echo "Cannot determine image for container $name"
-	    exit 1
+	    echo "No such container ($1), or invalid ImageName.  Cannot upgrade."
+	    exit 1;
 	fi

-	echo ">> Upgrading container $name from image $img ..."
-
-	# Capture the current image ID before upgrade so we can remove it after
-	old_image_id=$(podman inspect "$name" --format '{{.ImageID}}' 2>/dev/null)
-
-	# Stop container using proper command (goes through Finit)
-	printf ">> Stopping container ... "
-	container stop "$name"
-	echo "done"
-
-	# Set force flag to ensure fresh pull/fetch of image
-	force="-f"
-
-	# For remote images, force re-pull
-	case "$img" in
-	    docker://* | ftp://* | http://* | https://*)
-		printf ">> Pulling latest image ... "
-		if ! load_archive "$img" >/dev/null 2>&1; then
-		    echo "failed"
-		    echo "Failed fetching $img, check your network settings."
-		    exit 1
-		fi
-		echo "done"
-		;;
-	    *)
-		# Local archives - user must update the file manually
-		echo ">> Using local image $img (ensure file is updated) ..."
-		;;
-	esac
-
-	# Recreate container by running the script
-	echo ">> Recreating container ..."
+	# Likely an OCI archive, or local directory, assume user has updated image.
+	if echo "$img" | grep -Eq '^localhost/'; then
+	    file=$(awk '/^# meta-image:/ {print $3}' "$script")
+	    echo ">> Upgrading container $1 using $file ..."
+	else
+	    printf ">> Stopping ... "
+	    podman stop "$1"
+	    printf ">> "
+	    podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
+	    echo ">> Starting $1 ..."
+	fi
 	if ! "$script"; then
-	    echo ">> Failed recreating container $name"
+	    echo ">> Failed recreating container $1"
 	    exit 1
 	fi
-
-	# Remove the old image if it's not used by any other containers
-	if [ -n "$old_image_id" ]; then
-	    # Check if the old image is still in use by any containers
-	    if ! podman ps -a --format '{{.ImageID}}' | grep -q "^${old_image_id}$"; then
-		log "Removing old image $old_image_id"
-		podman rmi "$old_image_id" 2>/dev/null || true
-	    else
-		log "Old image $old_image_id still in use by other containers, keeping it"
-	    fi
-	fi
-
-	echo ">> Container $name upgraded successfully."
+	echo ">> Done."
 	;;
    volume)
 	cmd=$1
@@ -1276,8 +936,8 @@ case $cmd in
 		    ;;
 		cleanup)
 		    # Called as cleanup-script from Finit service
-		    log "Calling $container -n $SERVICE_ID cleanup"
-		    exec $container -q -n "$SERVICE_ID" cleanup
+		    log "Calling $container -n $SERVICE_ID delete"
+		    exec $container -q -n "$SERVICE_ID" delete
 		    ;;
 		*)
 		    false
@@ -33,7 +33,7 @@ for tgt in "${boot_targets}"; do
 	setexpr ixmenu_n ${ixmenu_n} + 1

 	if load ${devtype} ${devnum}:${auxpart} ${loadaddr} /uboot.env; then
-	    env import -b ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact
+	    env import -c ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact
 	fi

 	if test -n "${DEBUG}"; then
@@ -1,5 +0,0 @@
-if BR2_riscv
-
-# No boards yet in tree, visionfive2 is not integrated
-
-endif
@@ -258,6 +258,9 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
+CONFIG_NET_TEAM=m
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
+CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -278,22 +281,8 @@ CONFIG_DWMAC_DWC_QOS_ETH=y
 CONFIG_DWMAC_STARFIVE=y
 CONFIG_MICROCHIP_PHY=y
 CONFIG_MOTORCOMM_PHY=y
-CONFIG_USB_RTL8150=m
 CONFIG_USB_RTL8152=m
-CONFIG_USB_LAN78XX=m
 CONFIG_USB_USBNET=m
-CONFIG_USB_NET_CDC_EEM=m
-# CONFIG_USB_NET_CDC_NCM is not set
-CONFIG_USB_NET_DM9601=m
-CONFIG_USB_NET_SMSC75XX=m
-CONFIG_USB_NET_SMSC95XX=m
-# CONFIG_USB_NET_NET1080 is not set
-# CONFIG_USB_NET_CDC_SUBSET is not set
-CONFIG_USB_ALI_M5632=y
-CONFIG_USB_AN2720=y
-CONFIG_USB_EPSON2888=y
-CONFIG_USB_KC2190=y
-# CONFIG_USB_NET_ZAURUS is not set
 # CONFIG_WLAN is not set
 CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_GPIO=y
@@ -1,4 +1,4 @@
 label Infix (riscv64)
  kernel /boot/Image
  fdtdir /boot
-  append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}
+  append ${bootargs_root} ${bootargs_log} -- ${bootargs_user}
@@ -1,5 +0,0 @@
-if BR2_x86_64
-
-# No boards yet in tree
-
-endif
@@ -42,14 +42,14 @@ export secondary

 submenu "primary" "$log" {
    set slot="$1"
-    set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
+    set append="console=ttyS0 console=hvc0 root=PARTLABEL=$slot $2"
    set root="($primary)"
    source /boot/grub/grub.cfg
 }

 submenu "secondary" "$log"  {
    set slot="$1"
-    set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
+    set append="console=ttyS0 console=hvc0 root=PARTLABEL=$slot $2"
    set root="($secondary)"
    source /boot/grub/grub.cfg
 }
@@ -63,7 +63,7 @@ submenu "net" "$log"  {
 	set root=(initrd)

 	set slot="$1"
-	set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 qroot=/dev/ram0 ramdisk_size=65536 $2"
+	set append="console=ttyS0 console=hvc0 qroot=/dev/ram0 ramdisk_size=65536 $2"
 	source /boot/grub/grub.cfg
    else
 	if [ -z "$net_efinet0_dhcp_next_server" ]; then
@@ -191,6 +191,9 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
+CONFIG_NET_TEAM=m
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
+CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -219,7 +222,7 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
-CONFIG_USB=y
+CONFIG_USB=m
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_EHCI_HCD=m
 CONFIG_USB_UHCI_HCD=m
@@ -28,7 +28,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.56"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.49"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -38,7 +38,6 @@ BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -74,7 +73,6 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPERF3=y
@@ -124,7 +122,6 @@ BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
 BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
-BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
@@ -140,12 +137,11 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_ALDER_ALDER=y
-BR2_PACKAGE_BANANAPI_BPI_R3=y
-BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
-BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
+BR2_PACKAGE_RASPBERRY_PI_4=y
+BR2_PACKAGE_BANANA_PI_R3=y
 BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.56"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.49"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -67,7 +67,6 @@ BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
@@ -100,7 +99,6 @@ BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
 BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
-BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
@@ -115,11 +113,8 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_ALDER_ALDER=y
-BR2_PACKAGE_BANANAPI_BPI_R3=y
-BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
-BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
@@ -20,7 +20,7 @@ BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2023.07.02"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="qemu_arm64"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/qemu-uboot/extras.config"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/qemu/uboot/extras.config"
 BR2_TARGET_UBOOT_FORMAT_DTB=y
 BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_RAUC=y
@@ -30,9 +30,9 @@ BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2023.07.02"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mvebu_crb_cn9130"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/marvell-cn9130-crb/uboot/extras.config"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/cn9130-crb/uboot/extras.config"
 BR2_TARGET_UBOOT_FORMAT_DTB=y
-BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/marvell-cn9130-crb/uboot/cn9130-crb-env.dtsi"
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/cn9130-crb/uboot/cn9130-crb-env.dtsi"
 BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
@@ -27,11 +27,10 @@ BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mt7986a_bpir3_sd"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r3/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r3/uboot/sd-extras.config"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/src/board/banana-pi-r3/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/src/board/banana-pi-r3/uboot/sd-extras.config"
 BR2_TARGET_UBOOT_NEEDS_DTC=y
 BR2_TARGET_UBOOT_FORMAT_DTB=y
-BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r3/uboot/*.dtsi"
-BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/src/board/banana-pi-r3/uboot/*.dtsi"
 BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
@@ -1,48 +0,0 @@
-BR2_aarch64=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
-BR2_ENABLE_DEBUG=y
-BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
-BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
-BR2_SSP_NONE=y
-BR2_INIT_NONE=y
-BR2_SYSTEM_BIN_SH_NONE=y
-# BR2_PACKAGE_BUSYBOX is not set
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="v2.12"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="rk3328"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES=""
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_NEEDS_ARM32_TOOLCHAIN=y
-BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
-BR2_TARGET_UBOOT_BOARD_DEFCONFIG="nanopi-r2s-rk3328"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/friendlyarm-nanopi-r2s/uboot/extras.config"
-BR2_TARGET_UBOOT_NEEDS_DTC=y
-BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
-BR2_TARGET_UBOOT_NEEDS_PYELFTOOLS=y
-BR2_TARGET_UBOOT_NEEDS_OPENSSL=y
-BR2_TARGET_UBOOT_NEEDS_ATF_BL31=y
-BR2_TARGET_UBOOT_NEEDS_ATF_BL31_ELF=y
-BR2_TARGET_UBOOT_FORMAT_DTB=y
-BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
-BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
-BR2_TARGET_UBOOT_SPL=y
-BR2_TARGET_UBOOT_SPL_NAME="idbloader.img"
-BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/friendlyarm-nanopi-r2s/uboot/r2s-env.dtsi"
-BR2_PACKAGE_HOST_BMAP_TOOLS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_BOOTLOADER_SPLASHSCREEN=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
@@ -0,0 +1,216 @@
+BR2_aarch64=y
+BR2_ARM_FPU_VFPV4=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_TARGET_GENERIC_HOSTNAME="infix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
+BR2_TARGET_GENERIC_GETTY_TERM="xterm"
+BR2_SYSTEM_DHCP="eth0"
+BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
+BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs  ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh support/scripts/genimage.sh"
+BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.49"
+BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="rockchip/rk3328-nanopi-r2s"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
+BR2_PACKAGE_STRACE=y
+BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_LINUX_FIRMWARE=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT61=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT73=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT2XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_81XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X=y
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_EVEMU=y
+BR2_PACKAGE_EVTEST=y
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_INPUT_EVENT_DAEMON=y
+BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_LINUX_PAM=y
+BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_CONNTRACK_TOOLS=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FRR=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPERF3=y
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPTABLES_NFTABLES=y
+BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_MTR=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NETCAT_OPENBSD=y
+BR2_PACKAGE_NETSNMP=y
+BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_NMAP=y
+BR2_PACKAGE_NMAP_NCAT=y
+BR2_PACKAGE_NMAP_NMAP=y
+BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_TRACEROUTE=y
+BR2_PACKAGE_ULOGD=y
+BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIRELESS_REGDB=y
+BR2_PACKAGE_WIRELESS_TOOLS=y
+BR2_PACKAGE_WPA_SUPPLICANT=y
+BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_NEOFETCH=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
+BR2_PACKAGE_HTOP=y
+BR2_PACKAGE_IRQBALANCE=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_DBUS=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_RAUC_JSON=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_LESS=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="v2.9"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="rk3328"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES=""
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_NEEDS_ARM32_TOOLCHAIN=y
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2024.07"
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="nanopi-r2s-rk3328"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/uboot/extras.config"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
+BR2_TARGET_UBOOT_NEEDS_PYELFTOOLS=y
+BR2_TARGET_UBOOT_NEEDS_OPENSSL=y
+BR2_TARGET_UBOOT_NEEDS_ATF_BL31=y
+BR2_TARGET_UBOOT_NEEDS_ATF_BL31_ELF=y
+BR2_TARGET_UBOOT_FORMAT_DTB=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
+BR2_TARGET_UBOOT_SPL=y
+BR2_TARGET_UBOOT_SPL_NAME="idbloader.img"
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/uboot/r2s-env.dtsi"
+BR2_PACKAGE_HOST_E2FSPROGS=y
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_IMAGE_ID="${INFIX_ID}-r2s"
+INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_GENCERT=y
+BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_KEYACK=y
+BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
+BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
+BR2_PACKAGE_PODMAN=y
+BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
+BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
+BR2_PACKAGE_PODMAN_DRIVER_VFS=y
+BR2_PACKAGE_TETRIS=y
+BR2_PACKAGE_ROUSETTE=y
+BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+# GNS3_APPLIANCE is not set
+SDCARD_AUX=y
@@ -86,7 +86,6 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPERF3=y
@@ -164,7 +163,6 @@ BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
 BR2_TARGET_UBOOT_SPL=y
 BR2_TARGET_UBOOT_SPL_NAME="spl/u-boot-spl.bin.normal.out"
 BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/uboot/visionfive2-env.dtsi"
-BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
@@ -1,4 +1,5 @@
 BR2_aarch64=y
+BR2_cortex_a72=y
 BR2_TOOLCHAIN_EXTERNAL=y
 BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
 BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
@@ -13,13 +14,10 @@ BR2_SYSTEM_BIN_SH_NONE=y
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 # BR2_PACKAGE_BUSYBOX is not set
 BR2_PACKAGE_RPI_FIRMWARE=y
-BR2_PACKAGE_RPI_FIRMWARE_BOOTCODE_BIN=y
-BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI=y
-BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI_X=y
 BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4=y
 BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4_X=y
-BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/raspberrypi-rpi64/config.txt"
-BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/raspberrypi-rpi64/cmdline.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/config.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/cmdline.txt"
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_UBOOT=y
@@ -27,13 +25,12 @@ BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_arm64"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/raspberrypi-rpi64/uboot/extras.config"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/uboot/extras.config"
 BR2_TARGET_UBOOT_NEEDS_DTC=y
 BR2_TARGET_UBOOT_FORMAT_DTB=y
 BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
 BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
-BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/raspberrypi-rpi64/uboot/rpi-env.dtso"
-BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/uboot/rpi-env.dtso"
 BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
--- a/Show More
+++ b/Show More