Merge pull request #1463 from kernelkit/fix-dhcp-client-test

test: dhcp: client_default_gw: Add longer timeout for test
doc: bump release date
2026-07-27 11:13:02 +02:00 · 2026-03-31 15:49:55 +02:00 · 2026-03-31 15:41:08 +02:00 · 2026-03-31 12:26:46 +02:00 · 2026-03-31 11:36:17 +02:00 · 2026-03-31 10:37:26 +02:00
433 changed files with 12625 additions and 9333 deletions
@@ -1,8 +1,10 @@
 Limited free support is only available using the online resources of the
-project on GitHub, and Discord, see <https://github.com/kernelkit>:
+project on GitHub, and Discord, see <https://github.com/kernelkit/infix>:

+&nbsp;&nbsp; :house: <https://www.kernelkit.org> — home page, blog, news, howto's and tutorials  
+&nbsp;&nbsp; :package: <https://github.com/kernelkit/infix/releases/latest> — latest release  
 &nbsp;&nbsp; :speech_balloon: <https://github.com/orgs/kernelkit/discussions>  
-&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>
+&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>  

 Support contracts, development of new features, fast-tracking of reviews
 and contributions, customer branding of Infix, and even customer specific
@@ -1,41 +0,0 @@
-name: 'Restore Build Caches'
-description: 'Restore dl/ and .ccache/ caches for Buildroot builds'
-inputs:
-  target:
-    description: 'Build target for cache key differentiation'
-    required: true
-  dl-prefix:
-    description: 'Prefix for dl/ cache key (e.g., "dl", "dl-boot")'
-    required: false
-    default: 'dl'
-  ccache-prefix:
-    description: 'Prefix for .ccache/ cache key (e.g., "ccache", "ccache-boot")'
-    required: false
-    default: 'ccache'
-  enabled:
-    description: 'Set to false to skip cache restoration'
-    required: false
-    default: 'true'
-runs:
-  using: 'composite'
-  steps:
-    - name: Restore Cache of dl/
-      if: ${{ inputs.enabled == 'true' }}
-      uses: actions/cache@v4
-      with:
-        path: dl/
-        key: ${{ inputs.dl-prefix }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-        restore-keys: |
-          ${{ inputs.dl-prefix }}-
-          dl-
-
-    - name: Restore Cache of .ccache/
-      if: ${{ inputs.enabled == 'true' }}
-      uses: actions/cache@v4
-      with:
-        path: .ccache/
-        key: ${{ inputs.ccache-prefix }}-${{ inputs.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-        restore-keys: |
-          ${{ inputs.ccache-prefix }}-${{ inputs.target }}-
-          ${{ inputs.ccache-prefix }}-
-          ccache-
@@ -1,15 +0,0 @@
-name: 'Podman Cleanup'
-description: 'Clean up stale podman state from previous runs'
-runs:
-  using: 'composite'
-  steps:
-    - name: Cleanup podman state
-      shell: bash
-      run: |
-        set -x
-        podman ps -a              || true
-        podman stop -a            || true
-        podman rm -a -f           || true
-        podman volume prune -f    || true
-        podman system prune -a -f || true
-        podman system migrate     || true
@@ -19,6 +19,8 @@ jobs:
          - aarch64_qemu_boot
          - bpi_r3_sd_boot
          - bpi_r3_emmc_boot
+          - bpi_r64_sd_boot
+          - bpi_r64_emmc_boot
          - cn9130_crb_boot
          - fireant_boot
          - nanopi_r2s_boot
@@ -66,7 +68,7 @@ jobs:

          echo "Building ${defconfig}_defconfig, version ${version}-${rev}, artifact ${archive} ..."

-      - uses: ./.github/actions/cache-restore
+      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: ${{ matrix.defconfig }}
          dl-prefix: dl-boot
@@ -11,6 +11,7 @@ on:
          - raspberrypi-rpi2
          - raspberrypi-rpi64
          - bananapi-bpi-r3
+          - bananapi-bpi-r64
          - friendlyarm-nanopi-r2s
          - microchip-sama7g54-ek
        default: 'raspberrypi-rpi64'
@@ -67,6 +68,12 @@ jobs:
              echo "ARCH=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=true" >> $GITHUB_ENV
              ;;
+            bananapi-bpi-r64)
+              echo "BOOTLOADER_SD=bpi-r64-sd-boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi-r64-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              ;;
            friendlyarm-nanopi-r2s)
              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
              echo "ARCH=aarch64" >> $GITHUB_ENV
@@ -28,7 +28,7 @@ jobs:
          clean: true
          submodules: recursive

-      - uses: ./.github/actions/podman-cleanup
+      - uses: kernelkit/actions/podman-cleanup@v1

      - name: Set Release Variables
        id: vars
@@ -40,7 +40,7 @@ jobs:
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT

-      - uses: ./.github/actions/cache-restore
+      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: ${{ matrix.target }}
          enabled: ${{ inputs.use_cache }}
@@ -89,7 +89,7 @@ jobs:
          submodules: recursive
          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}

-      - uses: ./.github/actions/podman-cleanup
+      - uses: kernelkit/actions/podman-cleanup@v1

      - name: Run pre-build script
        if: ${{ inputs.pre_build_script != '' }}
@@ -120,7 +120,7 @@ jobs:
          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
          echo "Building target ${target}_defconfig"

-      - uses: ./.github/actions/cache-restore
+      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: ${{ env.TARGET }}

@@ -8,6 +8,8 @@ on:
 env:
  PROJECT_NAME: Infix
  CONTACT_EMAIL: troglobit@gmail.com
+  LIBYANG_VERSION: 4.2.2
+  SYSREPO_VERSION: 4.2.10

 jobs:
  coverity:
@@ -55,16 +57,24 @@ jobs:
          sudo apt-get -y update
          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                       libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev
+                       libuev-dev libavahi-client-dev

      - name: Build dependencies
        run: |
-          git clone https://github.com/CESNET/libyang.git
+          git clone -b v${LIBYANG_VERSION} --depth 1 https://github.com/CESNET/libyang.git
+          for p in patches/libyang/${LIBYANG_VERSION}/*.patch; do
+            git -C libyang apply < "$p"
+          done
          mkdir libyang/build
          (cd libyang/build && cmake .. && make all && sudo make install)
-          git clone https://github.com/sysrepo/sysrepo.git
+
+          git clone -b v${SYSREPO_VERSION} --depth 1 https://github.com/sysrepo/sysrepo.git
+          for p in patches/sysrepo/${SYSREPO_VERSION}/*.patch; do
+            git -C sysrepo apply < "$p"
+          done
          mkdir sysrepo/build
          (cd sysrepo/build && cmake .. && make all && sudo make install)
+
          git clone https://github.com/troglobit/libite.git
          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
          make dep
@@ -45,7 +45,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: ./.github/actions/cache-restore
+      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: x86_64
          dl-prefix: dl-netconf
@@ -52,7 +52,7 @@ jobs:
        with:
          submodules: 'true'

-      - uses: ./.github/actions/podman-cleanup
+      - uses: kernelkit/actions/podman-cleanup@v1

      - name: Set Release Variables
        id: rel
@@ -70,7 +70,7 @@ jobs:
          submodules: recursive
          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}

-      - uses: ./.github/actions/podman-cleanup
+      - uses: kernelkit/actions/podman-cleanup@v1

      - name: Run pre-test script
        if: ${{ inputs.pre_test_script != '' }}
@@ -87,7 +87,7 @@ jobs:
          submodules: recursive
          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}

-      - uses: ./.github/actions/podman-cleanup
+      - uses: kernelkit/actions/podman-cleanup@v1

      - name: Run pre-build script
        if: ${{ inputs.pre_build_script != '' }}
@@ -98,7 +98,7 @@ jobs:
          chmod +x ./pre-build.sh
          bash ./pre-build.sh

-      - uses: ./.github/actions/cache-restore
+      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: ${{ env.TARGET }}

@@ -85,12 +85,12 @@ interfaces {
 admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
 admin@infix-12-34-56:/> <b>show interfaces</b>
 <u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
-eth0            ethernet   UP          52:54:00:12:34:56
-                ipv4                   192.168.2.200/24 (static)
-                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                ipv4                   127.0.0.1/8 (static)
                ipv6                   ::1/128 (static)
+eth0            ethernet   UP          52:54:00:12:34:56
+                ipv4                   192.168.2.200/24 (static)
+                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 admin@infix-12-34-56:/> <b>copy running startup</b>
 </code></pre>

@@ -114,6 +114,7 @@ containers for any custom functionality you need.
 - **x86_64** - Run in VMs or on mini PCs for development and testing
 - **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
 - **Microchip SparX-5i** - Enterprise switching capabilities
+- **Microchip SAMA7G54-EK** - ARM Cortex-A7
 - **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
 - **StarFive VisionFive2** - RISC-V architecture support

@@ -167,13 +168,13 @@ APIs.
 [0]: https://www.kernel.org
 [1]: https://buildroot.org/ "Buildroot Homepage"
 [2]: https://www.sysrepo.org/ "Sysrepo Homepage"
-[3]: https://kernelkit.org/infix/latest/cli/introduction/
-[4]: https://kernelkit.org/infix/
-[5]: https://github.com/kernelkit/infix/releases
+[3]: https://www.kernelkit.org/infix/latest/cli/introduction/
+[4]: https://www.kernelkit.org/infix/
+[5]: https://github.com/kernelkit/infix/releases/latest
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
-[Release]:         https://github.com/kernelkit/infix/releases
+[Release]:         https://github.com/kernelkit/infix/releases/latest
 [Release Badge]:   https://img.shields.io/github/v/release/kernelkit/infix 
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/
 [GitHub Status]:   https://github.com/kernelkit/infix/actions/workflows/build.yml/badge.svg
@@ -2,6 +2,7 @@ if BR2_aarch64

 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/freescale-imx8mp-evk/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/friendlyarm-nanopi-r2s/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-cn9130-crb/Config.in"
@@ -4,7 +4,8 @@ aarch64
 Board Specific Documentation
 ----------------------------

- [Banana Pi R3](banana-pi-r3/)
+- [Banana Pi BPi-R3](banana-pi-r3/)
+- [Banana Pi BPi-R64](banana-pi-r64/)
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
 - [NanoPi R2S](r2s/)
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_ALDER_ALDER
 	bool "Alder"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Alder
@@ -262,8 +262,8 @@ make aarch64
 ./utils/mkimage.sh -odt emmc bananapi-bpi-r3
 ```

-[0]: https://kernelkit.org/posts/flashing-sdcard/
-[1]: https://kernelkit.org/infix/latest/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.kernelkit.org/infix/latest/
 [2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img
 [3]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-emmc.img
 [4]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r3-emmc-boot-2025.01-latest.tar.gz
@@ -8,7 +8,22 @@
 		};
 	};
 };
+/*
+From 236317dd4e55512933dcdaec3d0b4a0824f5e5bd Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 10 Aug 2025 18:11:01 +0800
+Subject: [PATCH] arm64: dts: mediatek: mt7986: increase ATF reserved memory to
+ 256 kiB

+The latest Mediatek open-source Trusted Firmware-A project has
+reserved 256 KiB for BL2 and BL31. It is better to increase the
+reserved memory region in the Linux kernel to protect the data.
+
+https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/patches-6.12/199-arm64-dts-mediatek-mt7986-increase-ATF-reserved-memo.patch
+*/
+&secmon_reserved {
+	reg = <0 0x43000000 0 0x40000>;
+};
 &cpu_thermal {
 	/delete-node/ trips;
 	/delete-node/ cooling-maps;
@@ -21,21 +21,21 @@
      {
        "name": "radio0",
        "class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-	  "band": "2.4GHz",
-	  "channel": "auto"
-	 }
-     },
-     {
-	"name": "radio1",
-	"class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      },
+      {
+        "name": "radio1",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
          "band": "5GHz",
          "channel": "auto"
+        }
      }
-    }
    ]
  },
  "ietf-interfaces:interfaces": {
@@ -130,7 +130,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -179,7 +180,7 @@
            }
          }
        },
-	"infix-interfaces:bridge-port": {
+        "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      },
@@ -195,7 +196,7 @@
            }
          }
        },
-       "infix-interfaces:bridge-port": {
+        "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      }
@@ -21,21 +21,21 @@
      {
        "name": "radio0",
        "class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-	  "band": "2.4GHz",
-	  "channel": "auto"
-	 }
-     },
-     {
-	"name": "radio1",
-	"class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      },
+      {
+        "name": "radio1",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
          "band": "5GHz",
          "channel": "auto"
+        }
      }
-    }
    ]
  },
  "ietf-interfaces:interfaces": {
@@ -96,7 +96,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -145,7 +146,7 @@
            }
          }
        },
-	"infix-interfaces:bridge-port": {
+        "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      },
@@ -161,7 +162,7 @@
            }
          }
        },
-       "infix-interfaces:bridge-port": {
+        "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      }
@@ -0,0 +1,7 @@
+config BR2_PACKAGE_BANANAPI_BPI_R64
+	bool "Banana Pi R64"
+	depends on BR2_aarch64
+	select BR2_PACKAGE_FEATURE_WIFI
+	select SDCARD_AUX
+	help
+	  Build Banana PI R64 support
@@ -0,0 +1,13 @@
+Copyright (c) 2026 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -0,0 +1,143 @@
+# Banana Pi BPI-R64
+
+## Overview
+
+<img align="right" src="banana_pi_bpi-r64_interface.jpg" alt="Board Overview" width=400 padding=10>
+
+The Banana Pi BPI-R64 is a networking board based on the MediaTek MT7622
+(dual Cortex-A53, AArch64) SoC.
+
+### Hardware Features
+
+- MediaTek MT7622 ARM Cortex-A53 dual-core processor @ 1.35 GHz
+- 1 GB DDR3L RAM
+- 8 GB eMMC storage
+- microSD card slot
+- MT7531 Gigabit Ethernet switch (4x LAN + 1x WAN)
+- MT7603E built-in 2.4 GHz WiFi
+- USB 3.0 port
+- 2x Mini PCIe slots
+
+### Default Network Configuration
+
+Infix comes preconfigured with:
+
+- **LAN ports** (lan0-lan3): Bridged for internal networking
+- **WAN port**: DHCP client enabled for internet connectivity
+- **WiFi** (wifi0-ap): Bridged to LAN (MT7615 PCIe card if fitted, otherwise MT7603E)
+
+## Boot Switch Reference
+
+<img align="right" src="bpi-r64-sw1.png" alt="SW1 Boot Switch" width=90 padding=10>
+
+The BPI-R64 uses a 2-position DIP switch (SW1) to select the boot device
+order.  The MT7622 Boot ROM tries devices in the order listed and falls
+back to the next if no valid BL2 is found at the expected location.
+
+| SW1 | Boot device | Use case                   |
+|-----|-------------|----------------------------|
+| OFF | eMMC        | Production eMMC boot       |
+| ON  | SD card     | SD card boot / development |
+
+> [!NOTE]
+> SinoVoip has exposed only one bit of the MT7622's two-bit `BOOT_SEL[1:0]`
+> strapping field via SW1, with `BOOT_SEL[1]` hardwired high.  This limits the
+> board to eMMC (`10b`) and SD (`11b`) boot; the SPI-NOR and SPI-NAND modes
+> available on the MT7622 reference board (`00b`, `01b`) are not selectable.
+
+## Getting Started
+
+### Quick Start with SD Card
+
+1. **Flash the image to an SD card** (the filename includes the version, e.g.
+   `infix-25.01-bpi-r64-sdcard.img`):
+
+<img align="right" src="debug-uart.png" alt="Debug UART" width=100 padding=10>
+
+   ```sh
+   dd if=infix-*-bpi-r64-sdcard.img of=/dev/sdX bs=4M status=progress
+   ```
+
+2. **Set boot switch:** SW1 ON (SD card boot)
+3. **Insert SD card and power on**
+4. **Connect console:** 115200 8N1 — use the dedicated Debug UART header
+   just below the 40-pin GPIO header; pins are labeled GND, RX, TX on the board
+5. **Default login:** `admin` / `admin`
+
+## Installing to eMMC
+
+Unlike the BPI-R3 (where SD and eMMC share a bus, requiring a NAND intermediate
+step), the BPI-R64 has separate controllers for SD (mmc1/MSDC1) and eMMC
+(mmc0/MSDC0).  You can write directly to eMMC while booted from SD.
+
+### eMMC Boot ROM Behaviour
+
+> [!IMPORTANT]
+> The MT7622 Boot ROM reads BL2 from the eMMC BOOT0 hardware partition (offset
+> 0), not from the User Data Area where the main disk image lives.  The
+> installation procedure below writes BL2 to BOOT0 separately to handle this.
+
+### Procedure
+
+Boot from SD and write the eMMC image from U-Boot using a FAT32-formatted USB
+drive.
+
+#### Step 1: Boot from SD card
+
+1. Set SW1 to ON (SD boot)
+2. Insert SD card with Infix
+3. Power on and break into U-Boot (press Ctrl-C during boot)
+
+#### Step 2: Write the eMMC image from U-Boot
+
+Place `infix-bpi-r64-emmc.img` and `bl2.img` on a FAT32-formatted USB drive,
+then from the U-Boot prompt:
+
+```
+usb start
+fatload usb 0:1 0x44000000 infix-bpi-r64-emmc.img
+setexpr blocks ${filesize} / 0x200
+mmc dev 0
+mmc write 0x44000000 0x0 ${blocks}
+```
+
+#### Step 3: Write BL2 to eMMC BOOT0
+
+```
+fatload usb 0:1 0x44000000 bl2.img
+mmc partconf 0 1 1 1
+setexpr blkcnt ${filesize} + 0x1ff
+setexpr blkcnt ${blkcnt} / 0x200
+mmc write 0x44000000 0x0 ${blkcnt}
+mmc partconf 0 1 1 0
+```
+
+#### Step 4: Boot from eMMC
+
+1. Power off the board
+2. Set SW1 to OFF (eMMC boot)
+3. Remove SD card and USB drive
+4. Power on
+
+## Platform Notes
+
+### mmc0 = eMMC, mmc1 = SD
+
+On MT7622, MSDC0 (mmc0) is the 8-bit eMMC controller and MSDC1 (mmc1) is the
+4-bit SD card controller — the reverse of many other platforms.
+
+## Building
+
+```sh
+# Bootloader only (SD)
+make O=x-boot-bpir64-sd bpi_r64_sd_boot_defconfig && make O=x-boot-bpir64-sd
+
+# Bootloader only (eMMC)
+make O=x-boot-bpir64-emmc bpi_r64_emmc_boot_defconfig && make O=x-boot-bpir64-emmc
+
+# Compose SD image (pass the Infix rootfs output directory)
+utils/mkimage.sh -b x-boot-bpir64-sd -r x-aarch64/images bananapi-bpi-r64
+
+# Compose eMMC image
+utils/mkimage.sh -b x-boot-bpir64-emmc -r x-aarch64/images -t emmc bananapi-bpi-r64
+```
@@ -0,0 +1,35 @@
+define BANANAPI_BPI_R64_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MEDIATEK)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MACH_MT7622)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_MT7622)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_MT6577)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
+	# Ethernet subsystem clock controller — required for the eth MAC,
+	# MT7531 DSA switch, and HSDMA to get their clocks from &ethsys.
+	# Without this, eth probe fails and the switch is never detected.
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_MT7622_ETHSYS)
+	# HIF subsystem clock controller — required for PCIe and USB.
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_MT7622_HIFSYS)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
+	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MT7603E,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PCIE_MEDIATEK,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_MTK)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_XHCI_MTK,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_TPHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MTK_SOC_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_I2C_MT65XX,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PWM_MEDIATEK,m)
+	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_MT6380,m)
+	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_MTK_EFUSE,m)
+	$(call KCONFIG_SET_OPT,CONFIG_CRYPTO_DEV_SAFEXCEL,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_DRV_MT7622)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))
@@ -0,0 +1 @@
+dtb-y += mediatek/mt7622-bananapi-bpi-r64.dtb
@@ -0,0 +1,3 @@
+#include <arm64/mediatek/mt7622-bananapi-bpi-r64.dts>
+
+#include "mt7622-bananapi-bpi-r64.dtsi"
@@ -0,0 +1,10 @@
+/ {
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+			usb-ports = <&ssusb>;
+			usb-port-names = "USB";
+		};
+	};
+};
@@ -0,0 +1,89 @@
+image cfg.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
+image var.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image #INFIX_ID##VERSION#-bpi-r64-#TARGET#.img {
+        hdimage {
+                partition-table-type = "hybrid"
+                # MT7622 TF-A partition driver detects GPT by checking MBR[0]
+                # for the 0xEE protective entry.  Place it first so that BL2
+                # (with partition-type = 0x83) lands at MBR slot 1.
+                gpt-protective-first = true
+        }
+
+        # BL2 bootloader at sector 1024 (0x80000). The MT7622 Boot ROM scans
+        # the hybrid MBR for a bootable entry and loads BL2 from its offset.
+        # partition-type makes it visible in the MBR at slot 1 (slot 0 holds
+        # the 0xEE protective entry required by the TF-A partition driver).
+        partition bl2 {
+                partition-type = 0x83
+                image = "bl2.img"
+                offset = 1024s
+                size = 1024s
+                bootable = true
+        }
+
+        # Factory/calibration data at fixed offset
+        partition factory {
+                offset = 4608K
+                size = 2M
+        }
+
+        # FIP partition - BL31 + U-Boot
+        partition fip {
+                image = "fip.bin"
+                offset = 13312s
+                size = 4096s
+        }
+
+        partition aux {
+                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+                image = "aux.ext4"
+        }
+
+        partition primary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition secondary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition cfg {
+                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+                image = "cfg.ext4"
+        }
+
+        partition var {
+                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+                image = "var.ext4"
+        }
+}
@@ -0,0 +1,438 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan0",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R64"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1,14 @@
+# Rename MT7531 external switch ports by DT node path.
+
+# The DTS already contains this but it has been observed in the wild
+# that we may end up with names like lan118 rather than by DTS label,
+# so this set of rules, that run after most other rules, match on the
+# OF_FULLNAME which is a stable reference.
+#
+# MT7622 / BPI-R64 switch topology (switch@1f, ports):
+#   port@0 = wan, port@1..4 = lan0..lan3, port@5,6 = cpu
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@0", NAME="wan"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@1", NAME="lan0"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@2", NAME="lan1"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@3", NAME="lan2"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@4", NAME="lan3"
@@ -0,0 +1,2 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-emmc-env.dtsi"
+CONFIG_SUPPORT_EMMC_BOOT=y
@@ -0,0 +1,19 @@
+CONFIG_AUTOBOOT=y
+CONFIG_BOOTDELAY=2
+# CONFIG_MMC_PCI is not set
+CONFIG_ENV_IS_NOWHERE=y
+# CONFIG_ENV_IS_IN_MMC is not set
+
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_MTK=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+
+CONFIG_DM_MDIO=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_PHY_ETHERNET_ID=y
+
+CONFIG_CMD_MDIO=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_DM=y
@@ -0,0 +1,5 @@
+#include <mt7622-env.dtsi>
+
+&env {
+	fdtfile = "mediatek/mt7622-bananapi-bpi-r64.dtb";
+};
@@ -0,0 +1,18 @@
+/ {
+	config {
+		env: environment {
+			bootcmd = "run ixboot";
+			boot_targets = "mmc0";
+			ethprime = "eth0";
+			fdt_addr_r = "0x43f00000";
+			kernel_addr_r = "0x44000000";
+			scriptaddr = "0x48000000";
+			ramdisk_addr_r = "0x4A000000";
+
+			/* This is a development platform, keep
+			 * developer mode statically enabled.
+			 */
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+		};
+	};
+};
@@ -0,0 +1,6 @@
+#include <mt7622-env.dtsi>
+
+&env {
+	boot_targets = "mmc1";   /* SD = mmc1 on MT7622 */
+	fdtfile = "mediatek/mt7622-bananapi-bpi-r64.dtb";
+};
@@ -0,0 +1 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-sd-env.dtsi"
@@ -71,7 +71,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -502,6 +502,7 @@ CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
 CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_HCD_PLATFORM=m
 CONFIG_USB_OHCI_HCD=m
 CONFIG_USB_OHCI_HCD_PLATFORM=m
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MARVELL_CN9130_CRB
 	bool "Marvell CN9130-CRB"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Customer Reference Board for CN9130
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MARVELL_ESPRESSOBIN
 	bool "Marvell ESPRESSObin"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Marvell ESPRESSObin
@@ -2,9 +2,6 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	bool "Raspberry Pi 64-bit (RPi3 and later)"
 	depends on BR2_aarch64
 	select SDCARD_AUX
-	select BR2_PACKAGE_FEATURE_WIFI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
@@ -312,13 +312,13 @@ While capable of basic routing tasks, be aware of limitations:
 For applications requiring multiple ports or high performance, consider
 dedicated networking hardware like the [Banana Pi R3][12].

-[0]: https://kernelkit.org/posts/flashing-sdcard/
-[1]: https://kernelkit.org/infix/latest/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.kernelkit.org/infix/latest/
 [2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
-[3]: https://kernelkit.org/infix/latest/container/#content-mounts
-[4]: https://kernelkit.org/infix/latest/scripting-restconf/
+[3]: https://www.kernelkit.org/infix/latest/container/#content-mounts
+[4]: https://www.kernelkit.org/infix/latest/scripting-restconf/
 [8]: https://github.com/kernelkit/infix/releases/tag/latest-boot
-[9]: https://kernelkit.org/infix/latest/networking/#wifi
+[9]: https://www.kernelkit.org/infix/latest/networking/#wifi
 [10]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
 [11]: https://www.raspberrypi.com/documentation/
-[12]: https://kernelkit.org/infix/latest/hardware/#banana-pi-bpi-r3
+[12]: https://www.kernelkit.org/infix/latest/hardware/#banana-pi-bpi-r3
@@ -35,7 +35,4 @@ fixup_file=fixup4.dat
 dtoverlay=vc4-kms-v3d-pi4
 lcd_rotate=2

-# Prevent console on DSI
-console=map:0
-
 gpu_mem=256
@@ -43,8 +43,8 @@ image #INFIX_ID##VERSION#-rpi64-sdcard.img {

 	partition boot {
 		partition-type = 0xc
-		bootable = "true"
 		image = "boot.vfat"
+		bootable = "true"
 	}

 	partition aux {
@@ -54,16 +54,14 @@ image #INFIX_ID##VERSION#-rpi64-sdcard.img {

 	partition primary {
 		partition-type-uuid = linux
-		bootable = "true"
-		size = 250M
 		image = "rootfs.squashfs"
+		size = 250M
 	}

 	partition secondary {
 		partition-type-uuid = linux
-		bootable = "true"
-		size = 250M
 		image = "rootfs.squashfs"
+		size = 250M
 	}

 	partition cfg {
@@ -62,7 +62,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -0,0 +1,313 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB1",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "USB2",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "USB3",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "00"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "eth0",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Raspberry Pi 400"
+              }
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0"
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "rpi-%m",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          },
+          "iburst": true
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  }
+}
@@ -0,0 +1,10 @@
+{
+    "eth0": {
+	"comment": "Primary Ethernet controller, native on BCM2711, and smsc95xx on BCM2837",
+	"phy-detached-when-down": true
+    },
+    "@ethtool:driver=smsc95xx": {
+	"comment": "BCM2837 smsc95xx driver does not support disabling flow control",
+        "broken-flow-control": true
+    }
+}
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_STYX_DCP_SC_28P
 	bool "Styx DCP-SC-28P"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Styx DCP-SC-28P
@@ -4,4 +4,5 @@ Arm 32-bit
 Board Specific Documentation
 ----------------------------

+- [Microchip SAMA7G54-EK (32-bit)](microchip-sama7g54-ek/)
 - [Raspberry Pi 2 Model B (32-bit)](raspberrypi-rpi2/)
@@ -1,20 +1,19 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
-CONFIG_AUDIT=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_BPF_JIT=y
-CONFIG_PREEMPT=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
 CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
+# CONFIG_CPU_ISOLATION is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=18
+CONFIG_LOG_BUF_SHIFT=16
 CONFIG_MEMCG=y
 CONFIG_BLK_CGROUP=y
 CONFIG_CFS_BANDWIDTH=y
@@ -31,19 +30,15 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
-CONFIG_ARCH_MULTI_V6=y
-CONFIG_ARCH_VIRT=y
-CONFIG_ARCH_BCM=y
-CONFIG_ARCH_BCM2835=y
+# CONFIG_ARM_ERRATA_643719 is not set
 CONFIG_SMP=y
 CONFIG_CPU_FREQ=y
-CONFIG_CPU_FREQ_STAT=y
-CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
 CONFIG_CPUFREQ_DT=y
-CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -55,7 +50,11 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_PARTITION_ADVANCED=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_ZSWAP=y
+CONFIG_ZSWAP_DEFAULT_ON=y
+CONFIG_ZSWAP_SHRINKER_DEFAULT_ON=y
 # CONFIG_COMPAT_BRK is not set
+# CONFIG_BALLOON_COMPACTION is not set
 CONFIG_KSM=y
 CONFIG_CMA=y
 CONFIG_NET=y
@@ -259,7 +258,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
-CONFIG_RASPBERRYPI_FIRMWARE=y
 CONFIG_FW_CFG_SYSFS=y
 CONFIG_FW_CFG_SYSFS_CMDLINE=y
 CONFIG_OF_OVERLAY=y
@@ -301,63 +299,29 @@ CONFIG_VETH=m
 CONFIG_VIRTIO_NET=y
 CONFIG_NLMON=y
 CONFIG_NET_VRF=y
-CONFIG_BCMGENET=y
-CONFIG_SMSC911X=y
-CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
-CONFIG_USB_NET_SMSC95XX=y
-CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
-CONFIG_INPUT_TOUCHSCREEN=y
-CONFIG_TOUCHSCREEN_EDT_FT5X06=m
 # CONFIG_LEGACY_PTYS is not set
-CONFIG_SERIAL_8250=y
-CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_EXTENDED=y
-CONFIG_SERIAL_8250_SHARE_IRQ=y
-CONFIG_SERIAL_8250_BCM2835AUX=y
-CONFIG_SERIAL_AMBA_PL011=y
-CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
-CONFIG_SPI_BCM2835=y
-CONFIG_SPI_BCM2835AUX=y
-CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
-CONFIG_BCM2711_THERMAL=y
-CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
-CONFIG_BCM2835_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
-CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
-CONFIG_DRM=y
-CONFIG_DRM_LOAD_EDID_FIRMWARE=y
-CONFIG_DRM_SIMPLEDRM=y
-CONFIG_DRM_PANEL_SIMPLE=m
-CONFIG_DRM_TOSHIBA_TC358762=m
-CONFIG_DRM_V3D=m
-CONFIG_DRM_VC4=m
-CONFIG_DRM_VC4_HDMI_CEC=y
-CONFIG_FB=y
-CONFIG_BACKLIGHT_CLASS_DEVICE=y
-CONFIG_SOUND=y
-CONFIG_SND=y
-CONFIG_SND_SOC=y
-CONFIG_SND_BCM2835_SOC_I2S=y
-CONFIG_HID_GENERIC=m
 CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
+CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
+CONFIG_USB_EHCI_HCD_PLATFORM=m
+CONFIG_USB_OHCI_HCD=m
+CONFIG_USB_OHCI_HCD_PLATFORM=m
 CONFIG_USB_STORAGE=y
-CONFIG_USB_DWC2=y
-CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_ETH=m
 CONFIG_USB_ETH_EEM=y
@@ -365,8 +329,6 @@ CONFIG_USB_G_SERIAL=m
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
-CONFIG_MMC_SDHCI_IPROC=y
-CONFIG_MMC_BCM2835=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
@@ -380,20 +342,13 @@ CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_LEDS_TRIGGER_TRANSIENT=y
 CONFIG_LEDS_TRIGGER_CAMERA=y
 CONFIG_DMADEVICES=y
-CONFIG_DMA_BCM2835=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
-CONFIG_STAGING=y
-CONFIG_SND_BCM2835=m
-CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
-CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
-CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT4_FS=y
@@ -426,18 +381,13 @@ CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_HARDLOCKUP_DETECTOR=y
 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
 CONFIG_TEST_LOCKUP=m
-# CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
-CONFIG_MEMTEST=y
+# CONFIG_RUNTIME_TESTING_MENU is not set
@@ -112,5 +112,5 @@ Connect a USB-to-serial adapter to the board's debug UART header.
 > [!WARNING]
 > Use only 3.3V serial adapters.

-[0]: https://kernelkit.org/posts/flashing-sdcard/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
 [1]: https://www.microchip.com/en-us/development-tool/EV21H18A
@@ -16,3 +16,28 @@
 &thermal_sensor {
 	status = "disabled";
 };
+
+/*
+ * Enable SDMMC high speed mode, please note that neither 'mmc-ddr-1_8v'
+ * or 'mmc-hs200-1_8v' work, even though [1] states they are supported,
+ * the errata [2] tells a different story: "Using mode SDR104, HS200 or
+ * HS400 may lead to tuning issues, data read errors or clock switching
+ * failures." — empirical testing has proved this on a rev 5 board.
+ *
+ * [1]: https://github.com/linux4sam/linux-at91/commit/5b35500
+ * [2]: https://ww1.microchip.com/downloads/en/DeviceDoc/SAMA7G5-Series-Silicon-Errata-and-Data-Sheet-Clarification-DS80001016A.pdf
+ */
+&sdmmc0 {
+	/delete-property/ sdhci-caps-mask;
+	cap-mmc-highspeed;
+	cap-mmc-hw-reset;
+};
+
+&sdmmc1 {
+	/delete-property/ no-1-8-v;
+	/delete-property/ sdhci-caps-mask;
+};
+
+&sdmmc2 {
+	/delete-property/ sdhci-caps-mask;
+};
@@ -1,12 +0,0 @@
-[system]
-compatible=infix-sama7g54-ek
-bootloader=uboot
-statusfile=/mnt/aux/rauc.status
-
-[slot.rootfs.0]
-device=/dev/disk/by-partlabel/primary
-bootname=primary
-
-[slot.rootfs.1]
-device=/dev/disk/by-partlabel/secondary
-bootname=secondary
@@ -1,6 +1,8 @@
 # Common U-Boot extras for SAMA7G54-EK
 CONFIG_EFI_PARTITION=y
 CONFIG_ENV_IMPORT_FDT=y
+# CONFIG_ENV_IS_IN_FAT is not set
+CONFIG_ENV_IS_NOWHERE=y
 CONFIG_FIT=y
 CONFIG_FIT_SIGNATURE=y
 CONFIG_RSA=y
@@ -2,9 +2,6 @@ config BR2_PACKAGE_RASPBERRYPI_RPI2
 	bool "Raspberry Pi 2 Model B (32-bit ARMv7)"
 	depends on BR2_arm
 	select SDCARD_AUX
-	select BR2_PACKAGE_FEATURE_WIFI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
 	help
 	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
 	  (SBC) with BCM2836 quad-core Cortex-A7 processor.
@@ -91,5 +91,5 @@ Serial settings: 115200 8N1
 > [!WARNING]
 > Use only 3.3V serial adapters. 5V adapters will damage your Raspberry Pi!

-[0]: https://kernelkit.org/posts/flashing-sdcard/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
 [1]: https://www.raspberrypi.com/products/raspberry-pi-2-model-b/
@@ -1,13 +1,19 @@
 # Raspberry Pi 2 Model B specific kernel configuration
 define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
+
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SOUND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835_SOC_I2S,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_KEYBOARD)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_TOUCHSCREEN)
 	$(call KCONFIG_SET_OPT,CONFIG_INPUT_MOUSEDEV,m)
 	$(call KCONFIG_SET_OPT,CONFIG_HID_GENERIC,m)
+	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)

 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
@@ -15,46 +21,58 @@ define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DMA_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARM_RASPBERRYPI_CPUFREQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PWM_BCM2835)
 	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_BCM2835,m)
+	$(call KCONFIG_SET_OPT,CONFIG_SPI_BCM2835,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SPI_BCM2835AUX,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SENSORS_RASPBERRYPI_HWMON,m)
+	$(call KCONFIG_SET_OPT,CONFIG_BCM2711_THERMAL,y)
 	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_SET_OPT,CONFIG_MMC_SDHCI_IPROC,y)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_BCM2835AUX)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_AMBA_PL011)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_AMBA_PL011_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
+	$(call KCONFIG_SET_OPT,CONFIG_BCMGENET,y)
 	$(call KCONFIG_SET_OPT,CONFIG_SMSC911X,y)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_USBNET)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_LAN78XX,y)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_NET_SMSC95XX,y)
 	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,y)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_KMS_HELPER)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_SIMPLEDRM,y)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_V3D,m)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_VC4,m)
-	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)
-	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
-
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_VC4_HDMI_CEC)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_LOAD_EDID_FIRMWARE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_PANEL_BRIDGE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_BRIDGE)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_TOSHIBA_TC358762,m)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_PANEL_SIMPLE,m)
+	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)

 	$(call KCONFIG_ENABLE_OPT,CONFIG_FB)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_FBDEV_EMULATION)
-
-	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
-
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC2)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NOP_USB_XCEIV)
 endef

 $(eval $(ix-board))
@@ -54,7 +54,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -0,0 +1,28 @@
+[system]
+compatible=infix-arm
+bootloader=uboot
+statusfile=/mnt/aux/rauc.status
+mountprefix=/var/lib/rauc/mnt
+bundle-formats=-plain
+max-bundle-download-size=1073741824
+
+[log.event-log]
+filename=/var/log/upgrade-json.log
+format=json-pretty
+max-size=1M
+max-files=5
+
+[keyring]
+directory=/etc/rauc/keys
+
+[slot.rootfs.0]
+device=/dev/disk/by-partlabel/primary
+bootname=primary
+
+[slot.rootfs.1]
+device=/dev/disk/by-partlabel/secondary
+bootname=secondary
+
+[slot.net.0]
+device=/dev/ram0
+bootname=net
@@ -1,21 +1,11 @@
-
 menu "Images"

-comment "DDI Based"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ddi/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ddi-disk/Config.in"
-
-comment "ITB Based"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rootfs/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-qcow/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
-
-comment "General"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-barebox-esp/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-lvm-stub/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"

 endmenu
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.36.1
-# Sun Feb  9 12:25:37 2025
+# Busybox version: 1.37.0
+# Mon Feb  9 07:51:08 2026
 #
 CONFIG_HAVE_DOT_CONFIG=y

@@ -17,6 +17,7 @@ CONFIG_SHOW_USAGE=y
 CONFIG_FEATURE_VERBOSE_USAGE=y
 # CONFIG_FEATURE_COMPRESS_USAGE is not set
 CONFIG_LFS=y
+CONFIG_TIME64=y
 CONFIG_PAM=y
 CONFIG_FEATURE_DEVPTS=y
 CONFIG_FEATURE_UTMP=y
@@ -469,6 +470,7 @@ CONFIG_FEATURE_FIND_NEWER=y
 CONFIG_FEATURE_FIND_SAMEFILE=y
 CONFIG_FEATURE_FIND_EXEC=y
 CONFIG_FEATURE_FIND_EXEC_PLUS=y
+CONFIG_FEATURE_FIND_EXEC_OK=y
 CONFIG_FEATURE_FIND_USER=y
 CONFIG_FEATURE_FIND_GROUP=y
 CONFIG_FEATURE_FIND_NOT=y
@@ -795,6 +797,7 @@ CONFIG_FLASH_ERASEALL=y
 CONFIG_FLASH_LOCK=y
 CONFIG_FLASH_UNLOCK=y
 CONFIG_FLASHCP=y
+CONFIG_GETFATTR=y
 CONFIG_HDPARM=y
 CONFIG_FEATURE_HDPARM_GET_IDENTITY=y
 # CONFIG_FEATURE_HDPARM_HDIO_SCAN_HWIF is not set
@@ -933,6 +936,7 @@ CONFIG_IPRULE=y
 CONFIG_IPNEIGH=y
 CONFIG_FEATURE_IP_ADDRESS=y
 CONFIG_FEATURE_IP_LINK=y
+CONFIG_FEATURE_IP_LINK_CAN=y
 CONFIG_FEATURE_IP_ROUTE=y
 CONFIG_FEATURE_IP_ROUTE_DIR="/etc/iproute2"
 CONFIG_FEATURE_IP_TUNNEL=y
@@ -1007,6 +1011,7 @@ CONFIG_FEATURE_WGET_HTTPS=y
 CONFIG_WHOIS=y
 CONFIG_ZCIP=y
 CONFIG_UDHCPD=y
+CONFIG_FEATURE_UDHCPD_BOOTP=y
 CONFIG_FEATURE_UDHCPD_BASE_IP_ON_MAC=y
 CONFIG_FEATURE_UDHCPD_WRITE_LEASES_EARLY=y
 CONFIG_DHCPD_LEASES_FILE="/var/lib/misc/udhcpd.leases"
@@ -1016,7 +1021,12 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
+CONFIG_UDHCPC6_DEFAULT_SCRIPT=""
 # CONFIG_UDHCPC6 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC3646 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC4704 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC4833 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC5970 is not set

 #
 # Common options for DHCP applets
@@ -1027,7 +1037,7 @@ CONFIG_UDHCP_DEBUG=0
 CONFIG_UDHCPC_SLACK_FOR_BUGGY_SERVERS=80
 CONFIG_FEATURE_UDHCP_RFC3397=y
 CONFIG_FEATURE_UDHCP_8021Q=y
-CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS="-b -R -n -O search"
+CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS=""

 #
 # Print Utilities
@@ -1132,7 +1142,7 @@ CONFIG_SH_IS_ASH=y
 CONFIG_BASH_IS_NONE=y
 CONFIG_SHELL_ASH=y
 CONFIG_ASH=y
-CONFIG_ASH_OPTIMIZE_FOR_SIZE=y
+# CONFIG_ASH_OPTIMIZE_FOR_SIZE is not set
 CONFIG_ASH_INTERNAL_GLOB=y
 CONFIG_ASH_BASH_COMPAT=y
 # CONFIG_ASH_BASH_SOURCE_CURDIR is not set
@@ -1146,7 +1156,6 @@ CONFIG_ASH_IDLE_TIMEOUT=y
 CONFIG_ASH_ECHO=y
 CONFIG_ASH_PRINTF=y
 CONFIG_ASH_TEST=y
-CONFIG_ASH_SLEEP=y
 CONFIG_ASH_HELP=y
 CONFIG_ASH_GETOPTS=y
 CONFIG_ASH_CMDCMD=y
@@ -1197,7 +1206,7 @@ CONFIG_FEATURE_SH_MATH_64=y
 CONFIG_FEATURE_SH_MATH_BASE=y
 CONFIG_FEATURE_SH_EXTRA_QUIET=y
 # CONFIG_FEATURE_SH_STANDALONE is not set
-# CONFIG_FEATURE_SH_NOFORK is not set
+CONFIG_FEATURE_SH_NOFORK=y
 CONFIG_FEATURE_SH_READ_FRAC=y
 # CONFIG_FEATURE_SH_HISTFILESIZE is not set
 CONFIG_FEATURE_SH_EMBEDDED_SCRIPTS=y
@@ -1,102 +0,0 @@
-#Simple dracut config for a system without systemd
-
-#Dracut configuration
-
-show_modules=yes
-i18n_install_all=no
-lvmconf=no
-mdadmconf=no
-early_microcode=no
-hostonly=no
-hostonly_cmdline=no
-use_fstab=no
-kernel_cmdline="rd.break=initqueue"
-do_strip=no
-
-# Dracut modules needed
-add_dracutmodules+=" \
-busybox \
-"
-
-# Modules to ignore
-omit_dracutmodules+=" \
-base \
-bash \
-biosdevname \
-btrfs \
-bluetooth \
-caps \
-cifs \
-connman \
-crypt \
-crypt-gpg \
-dash \
-dbus-broker \
-dbus-daemon \
-dm \
-dmraid \
-dmsquash-live-ntfs \
-dracut-systemd \
-fcoe \
-fcoe-uefi \
-fs-lib \
-iscsi \
-i18n \
-kernel-modules \
-kernel-modules-extra \
-lvmmerge \
-lvm \
-lunmask \
-mdraid \
-memstrack \
-mksh \
-modsign \
-mount-root \
-multipath \
-nbd \
-network-legacy \
-network-wicked \
-nfs \
-nvdimm \
-nvmf \
-parse-lunmask \
-pcsc \
-qemu \
-qemu-net \
-resume \
-rootfs-block \
-rngd \
-shutdown \
-systemd \
-systemd-udevd \
-systemd-coredump \
-systemd-ask-password \
-systemd-timedated \
-systemd-rfkill \
-systemd-resolved \
-systemd-hostnamed \
-systemd-initrd \
-systemd-integritysetup \
-systemd-journald \
-systemd-ldconfig \
-systemd-networkd \
-systemd-timesyncd \
-systemd-veritysetup \
-systemd-modules-load \
-systemd-pcrphase \
-systemd-portabled \
-systemd-pstore \
-systemd-sysctl \
-systemd-repart \
-systemd-sysext \
-systemd-sysusers \
-systemd-tmpfiles \
-squash \
-ssh-client \
-stratis \
-tpm2-tss \
-udev-rules \
-url-lib \
-usrmount \
-virtiofs \
-"
@@ -1,6 +0,0 @@
-config IMAGE_BAREBOX_ESP
-	bool "Barebox EFI System Partition"
-	depends on BR2_TARGET_BAREBOX
-	default y if IMAGE_DDI
-	help
-	  An EFI System Partition (ESP) with Barebox installed.
@@ -1,38 +0,0 @@
-#!/bin/sh
-
-set -e
-
-case "$BR2_ARCH" in
-    x86_64)
-	BOOT_EFI=BOOTX64.EFI
-	;;
-    *)
-	echo "Unknown EFI boot path for $BR2_ARCH" >&2
-	exit 1
-	;;
-esac
-
-mkdir -p "${WORKDIR}"/root
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp
-
-cat <<EOF >"${WORKDIR}"/genimage.cfg
-image barebox-esp.vfat {
-	size = "16M"
-	vfat {
-		file EFI/BOOT/$BOOT_EFI {
-			image = $BINARIES_DIR/barebox.efi
-		}
-	}
-}
-
-# Silence genimage warnings
-config {}
-EOF
-
-genimage \
-    --tmppath    "${WORKDIR}"/tmp  \
-    --rootpath   "${WORKDIR}"/root \
-    --inputpath  "${WORKDIR}"      \
-    --outputpath "${BINARIES_DIR}" \
-    --config "${WORKDIR}"/genimage.cfg
@@ -1,7 +0,0 @@
-################################################################################
-#
-# image-barebox-esp
-#
-################################################################################
-
-$(eval $(ix-image))
@@ -1,8 +0,0 @@
-menuconfig IMAGE_DDI_DISK
-	bool "LVM2 based provisioning disk (DDI)"
-	depends on IMAGE_BAREBOX_ESP
-	depends on IMAGE_DDI
-	help
-	  Compose a full disk image consisting of an EFI System
-	  Partition (ESP) containing Barebox, and an LVM PV in which
-	  Infix is installed as an LV.
@@ -1,46 +0,0 @@
-#!/bin/sh
-
-set -e
-
-
-mkdir -p "${WORKDIR}"/root
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp
-
-"${BR2_EXTERNAL_INFIX_PATH}"/utils/lvm-mkinternal \
-	"${BINARIES_DIR}"/"${ARTIFACT}".raw >"${WORKDIR}"/internal.lvm
-
-cat <<EOF >"${WORKDIR}"/genimage.cfg
-
-image ${ARTIFACT}.disk {
-	hdimage {
-		partition-table-type = "gpt"
-	}
-
-	partition esp {
-		partition-type-uuid = "esp"
-		image = "$BINARIES_DIR/barebox-esp.vfat"
-	}
-
-	partition esp-backup {
-		partition-type-uuid = "esp"
-		image = "$BINARIES_DIR/barebox-esp.vfat"
-	}
-
-	partition internal {
-		growfs = "true"
-		partition-type-uuid = "lvm"
-		image = "internal.lvm"
-	}
-}
-
-# Silence genimage warnings
-config {}
-EOF
-
-genimage \
-    --tmppath    "${WORKDIR}"/tmp  \
-    --rootpath   "${WORKDIR}"/root \
-    --inputpath  "${WORKDIR}"      \
-    --outputpath "${BINARIES_DIR}" \
-    --config "${WORKDIR}"/genimage.cfg
@@ -1,9 +0,0 @@
-################################################################################
-#
-# image-ddi-disk
-#
-################################################################################
-
-IMAGE_DDI_DISK_DEPENDENCIES := image-barebox-esp image-ddi
-
-$(eval $(ix-image))
@@ -1,33 +0,0 @@
-menuconfig IMAGE_DDI
-	bool "Discoverable Disk Image (DDI)"
-	select BR2_TARGET_ROOTFS_SQUASHFS
-	select BR2_PACKAGE_HOST_GENIMAGE
-	help
-	  Create a Discoverable Disk Image containing:
-	  - SquashFS of the root filesystem
-	  - dm-verity hash tree of the root filesystem
-	  - DDI compliant JSON signature object of the hash tree
-
-	  https://uapi-group.org/specifications/specs/discoverable_disk_image/
-
-config IMAGE_DDI_KEY
-	string "signing key"
-	depends on IMAGE_DDI
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
-	help
-	  Path to the private RSA key, in PKCS#8 format, used to sign
-	  the dm-verity hash tree.
-
-config IMAGE_DDI_CERT
-	string "signing cert"
-	depends on IMAGE_DDI
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
-	help
-	  Path to the X509 certificate whose associated public key can
-	  validate the authenticity of the generated signature.
-
-	  The SHA256 fingerprint of this certificate is recorded
-	  alongside the standard PKCS#7 signature in the JSON object,
-	  which can be useful to locate corresponding key on systems
-	  that lack full X509 parsing capabilities.
-
@@ -1,81 +0,0 @@
-#!/bin/sh
-
-# Generate the DDI in two phases. First we create the verity hash tree
-# and signature, then we collect them together with the rootfs in the
-# ddi. The reason for this is that genimage (at least up to v19) can
-# not infer the size of a partition if the image to be placed in it is
-# created by the same genimage instance. With the two-phase approach,
-# we work around that problem and can create a DDI without any wasted
-# space.
-
-set -e
-
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp "${WORKDIR}"/verity
-
-cat <<EOF >"${WORKDIR}"/genimage-verity.cfg
-image rootfs.verity {
-	verity {
-        	image = "rootfs.squashfs"
-	}
-}
-
-image rootfs.verity-sig {
-	verity-sig {
-        	image = "rootfs.verity"
-		cert = "${CERT}"
-		key = "${KEY}"
-	}
-}
-
-config {}
-EOF
-
-genimage \
-    --loglevel 1 \
-    --tmppath    "${WORKDIR}"/tmp \
-    --rootpath   "${WORKDIR}" \
-    --inputpath  "${BINARIES_DIR}" \
-    --outputpath "${WORKDIR}"/verity \
-    --config     "${WORKDIR}"/genimage-verity.cfg
-
-case "${BR2_ARCH}" in
-    "x86_64")
-	arch=x86-64
-	;;
-    *)
-	echo "ERROR: missing mapping from ${BR2_ARCH} to genimage arch" >&2
-	exit 1
-	;;
-esac
-
-cat <<EOF >"${WORKDIR}"/genimage-ddi.cfg
-image ${ARTIFACT}.raw {
-	hdimage {
-		partition-table-type = "gpt"
-	}
-
-	partition root {
-		partition-type-uuid = "root-${arch}"
-		image = "rootfs.squashfs"
-	}
-	partition root-verity {
-		partition-type-uuid = "root-${arch}-verity"
-		image = "${WORKDIR}/verity/rootfs.verity"
-	}
-	partition root-verity-sig {
-		partition-type-uuid = "root-${arch}-verity-sig"
-		image = "${WORKDIR}/verity/rootfs.verity-sig"
-	}
-}
-
-config {}
-EOF
-
-genimage \
-    --loglevel 1 \
-    --tmppath    "${WORKDIR}"/tmp \
-    --rootpath   "${WORKDIR}" \
-    --inputpath  "${BINARIES_DIR}" \
-    --outputpath "${BINARIES_DIR}" \
-    --config     "${WORKDIR}"/genimage-ddi.cfg
@@ -1,32 +0,0 @@
-image rootfs.verity {
-	verity {
-        	image = "rootfs.squashfs"
-	}
-}
-
-image rootfs.verity-sig {
-	verity-sig {
-        	image = "rootfs.verity"
-		cert = "@CERT@"
-		key = "@KEY@"
-	}
-}
-
-image @ARTIFACT@.raw {
-	hdimage {
-		partition-table-type = "gpt"
-	}
-
-	partition root {
-		partition-type-uuid = "root-@ARCH@"
-		image = "rootfs.squashfs"
-	}
-	partition root-verity {
-		partition-type-uuid = "root-@ARCH@-verity"
-		image = "rootfs.verity"
-	}
-	partition root-verity-sig {
-		partition-type-uuid = "root-@ARCH@-verity-sig"
-		image = "rootfs.verity-sig"
-	}
-}
@@ -1,10 +0,0 @@
-################################################################################
-#
-# image-ddi
-#
-################################################################################
-
-IMAGE_DDI_DEPENDENCIES := host-genimage rootfs-squashfs
-IMAGE_DDI_CONFIG_VARS := KEY CERT
-
-$(eval $(ix-image))
@@ -1,15 +0,0 @@
-tmpfs		/tmp		tmpfs	mode=0755,nosuid,nodev	0	0
-tmpfs		/run		tmpfs	mode=0755,nosuid,nodev	0	0
-tmpfs		/media		tmpfs	mode=1755,nosuid,nodev	0	0
-tmpfs		/mnt/tmp	tmpfs	defaults		0	0
-
-# Locate and mount /cfg, /home, /root and /var from the internal
-# volume, wherever that is located - or, as a last resort, setup tmpfs
-# mounts at these points. Setup an ephemeral writable overlay on /etc.
-/usr/libexec/infix/mnt#	/mnt/rw	  helper	none			0	0
-
-# Optional, nice-to-have mounts
-debugfs		/sys/kernel/debug   debugfs	nofail			0	0
-tracefs		/sys/kernel/tracing tracefs	nofail			0	0
-cfgfs		/config		    configfs	nofail,noauto		0	0
-host		/mnt/host	    9p		nofail,noauto,cache=none,msize=16384	0	0
@@ -1,211 +0,0 @@
-#!/bin/sh
-# Called from /etc/fstab to ensure we have something writable mounted
-# at /cfg, /home, /root, and /var.
-#
-# In the normal case, the "rw" LV from the "internal" LVM VG is used
-# to back all persistant storage. In the event that "internal" is
-# present, but the "rw" LV is missing, one will be provisioned, along
-# with the required BTRFS subvolumes.
-#
-# In all other scenarios where the subvolumes are not available, the
-# system will fall back to temporary storage for all mount points.
-#
-# For /etc, a writable, tmpfs backed, layer is always overlayed on top
-# of the read-only contents from the OS image.
-
-set -e
-
-nm=$(basename "$0")
-need_restore=
-code=0
-
-logmsg()
-{
-    logger -k -t "$nm" -p user.crit "$@"
-}
-
-status()
-{
-    GREEN="$(printf '\033[1;32m')"
-    RED="$(printf '\033[1;31m')"
-    YELLOW="$(printf '\033[1;33m')"
-    BOLD="$(printf '\033[1m')"
-    RESET="$(printf '\033[0m')"
-
-    case $1 in
-        0) color=$GREEN; text=' OK ' ;;
-        1) color=$RED;   text='FAIL' ;;
-        2) color=$YELLOW;text='WARN' ;;
-        *) color=$YELLOW;text=' ⋯  ' ;;
-    esac
-
-    printf '%s[%s%s%s%s]%s ' "$BOLD" "$color" "$text" "$RESET" "$BOLD" "$RESET"
-}
-
-print_start()
-{
-    printf '\r\033[K%s%s' "$(status 3)" "$*" > /dev/console
-    need_restore=YES
-}
-
-print_end()
-{
-    rc=$1; shift
-    if [ $# -gt 0 ]; then
-        printf '\r\033[K%s%s\n' "$(status "$rc")" "$*" > /dev/console
-    else
-        printf '\r%s\n' "$(status "$rc")" > /dev/console
-    fi
-}
-
-# Restore Finit's original progress message so its [ OK ] appears correctly
-print_restore()
-{
-    [ "$need_restore" ] || return 0
-    print_start "Mounting filesystems from /etc/fstab"
-}
-
-# # External button or bootloader changed kernel command line
-# check_factory()
-# {
-#     if [ -f /mnt/cfg/infix/.reset ]; then
-# 	return 0;
-#     fi
-
-#     if grep -q 'finit.cond=factory-reset' /proc/cmdline; then
-# 	return 0;
-#     fi
-
-#     # Add to your br2-external to extend factory-reset check
-#     if [ ! -x /usr/libexec/infix/check-factory ]; then
-# 	return 1;
-#     fi
-
-#     /usr/libexec/infix/check-factory
-# }
-
-# factory_reset()
-# {
-#     find /sys/class/leds/ -type l -exec sh -c 'echo 100 > $0/brightness' {} \;
-#     print_start "Resetting to factory defaults."
-#     logger $opt -p user.notice -t "$nm" "Resetting to factory defaults."
-
-#     rm -rf /mnt/cfg/* /mnt/var/*
-#     sync
-
-#     logger $opt -p user.notice -t "$nm" "Factory reset complete."
-#     print_end 0 "Factory reset complete."
-#     print_restore
-# }
-
-subvols="cfg var root home"
-
-internal_rw_provision()
-{
-    print_start "Provisioning persistent storage on internal volume"
-
-    lvm lvcreate --name rw --extents 50%FREE internal || {
-	logmsg "No rw LV available, nor could it be created"
-	print_end 1
-	return 1
-    }
-
-    mkfs.btrfs -L rw /dev/internal/rw || {
-	logmsg "Could not create BTRFS on rw LV"
-	print_end 1
-	return 1
-    }
-
-    mount -t btrfs /dev/internal/rw /mnt/rw || {
-	logmsg "Failed to mount rw"
-	print_end 1
-	return 1
-    }
-
-    for subvol in $subvols; do
-	btrfs subvolume create /mnt/rw/@"$subvol" || {
-	    logmsg "Failed to create @$subvol on rw"
-	    print_end 1
-	    return 1
-	}
-    done
-
-    umount /mnt/rw || {
-	logmsg "Failed to unmount rw"
-	print_end 1
-	return 1
-    }
-
-    print_end 0
-}
-
-internal_rw_activate()
-{
-    lvm vgs internal || {
-	logmsg "No internal volume available"
-	return 1
-    }
-
-    lvm vgchange -ay internal || {
-	logmsg "Unable to bring internal volume online"
-	return 1
-    }
-
-    # The only condition under which we do BTRFS provisioning is when
-    # the LV is absent. In all other failure scenarios: fall back to
-    # tmpfs and let the user sort it out. This way we do not risk any
-    # loss of data.
-    [ -b /dev/internal/rw ] && return 0
-
-    internal_rw_provision
-}
-
-internal_rw_mount()
-{
-    internal_rw_activate || return 1
-
-    for subvol in $subvols; do
-	mount -t btrfs /dev/internal/rw /"$subvol" -o subvol=@"$subvol" || {
-	    logmsg "Failed to mount /$subvol"
-	    return 1
-	}
-    done
-}
-
-tmpfs_rw_mount()
-{
-    for subvol in $subvols; do
-	mkdir -p -m 0755 /mnt/tmp/"$subvol"
-	mount /mnt/tmp/"$subvol" /"$subvol" -o bind || {
-	    logmsg "Failed to mount temporary /$subvol"
-	    return 1
-	}
-    done
-}
-
-tmpfs_etc_mount()
-{
-    mkdir -p -m 0755 /mnt/tmp/etc/
-    tar c -C /etc . | tar x -C /mnt/tmp/etc
-    mount /mnt/tmp/etc /etc -o bind
-}
-
-exec >/mnt/tmp/mnt.log 2>&1
-
-tmpfs_etc_mount || {
-    code=1
-    logmsg "Failed to make /etc writable"
-}
-
-if ! internal_rw_mount; then
-    code=1
-    print_end 1 "Mounting persistent storage from internal volume"
-    logmsg "Internal volume not found, falling back to tmpfs"
-
-    print_start "Falling back to ephemeral tmpfs storage!"
-    tmpfs_rw_mount
-    print_end $?
-fi
-
-print_restore
-exit $code
@@ -12,7 +12,7 @@ cat <<EOF >"${gns3a}"
    "category": "router",
    "description": "${ARTIFACT} development appliance",
    "vendor_name": "Kernelkit",
-    "vendor_url": "https://kernelkit.org",
+    "vendor_url": "https://www.kernelkit.org",
    "product_name": "${ARTIFACT} devel",
    "registry_version": 6,
    "status": "experimental",
@@ -1,8 +0,0 @@
-config IMAGE_LVM_STUB
-	bool "LVM2 stub image"
-	default y if IMAGE_DDI
-	help
-	  An empty LVM2 physical volume attached to the internal
-	  volume group. This is useful as a base image for persistent
-	  storage in QEMU emulation scenarios where the OS is supplied
-	  in a separate image.
@@ -1,34 +0,0 @@
-#!/bin/sh
-
-set -e
-
-
-mkdir -p "${WORKDIR}"/root
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp
-
-"${BR2_EXTERNAL_INFIX_PATH}"/utils/lvm-mkinternal >"${WORKDIR}"/stub.lvm
-
-cat <<EOF >"${WORKDIR}"/genimage.cfg
-image lvm-stub.disk {
-	hdimage {
-		partition-table-type = "gpt"
-	}
-
-	partition internal {
-		growfs = "true"
-		image = "stub.lvm"
-		partition-type-uuid = "lvm"
-	}
-}
-
-# Silence genimage warnings
-config {}
-EOF
-
-genimage \
-    --tmppath    "${WORKDIR}"/tmp  \
-    --rootpath   "${WORKDIR}"/root \
-    --inputpath  "${WORKDIR}"      \
-    --outputpath "${BINARIES_DIR}" \
-    --config "${WORKDIR}"/genimage.cfg
@@ -1,7 +0,0 @@
-################################################################################
-#
-# image-lvm-stub
-#
-################################################################################
-
-$(eval $(ix-image))
@@ -50,7 +50,7 @@ The default credentials for the demo builds is
    Password: 
    .-------.
    |  . .  | Infix OS — Immutable.Friendly.Secure
-    |-. v .-| https://kernelkit.org
+    |-. v .-| https://www.kernelkit.org
    '-'---'-'

    Run the command 'cli' for interactive OAM
@@ -10,7 +10,6 @@ $(1): $$($(2)_DEPENDENCIES)
 	PKGDIR=$$($(2)_DIR) \
 	WORKDIR=$$(BUILD_DIR)/$(1) \
 	BINARIES_DIR=$$(BINARIES_DIR) \
-	BR2_ARCH=$$(BR2_ARCH) \
 	BR2_EXTERNAL_INFIX_PATH=$$(BR2_EXTERNAL_INFIX_PATH) \
 	ARTIFACT=$$(INFIX_ARTIFACT) \
 	COMPATIBLE=$$(INFIX_COMPATIBLE) \
@@ -20,7 +19,6 @@ $(1): $$($(2)_DEPENDENCIES)

 ifeq ($$($(2)),y)
 TARGETS_ROOTFS += $(1)
-BR2_ROOTFS_OVERLAY := "$$(realpath $$(pkgdir)/rootfs) $$(call qstrip,$$(BR2_ROOTFS_OVERLAY))"
 endif

 endef
@@ -1,15 +0,0 @@
-#!/bin/bash
-
-check() {
-    return 0
-}
-
-depends() {
-    return 0
-}
-
-install() {
-    # Not sure if this should be handled by buildroot's merged-usr
-    # module. Fix it here for now.
-    ln -s "lib" "${initdir?}/lib64"
-}
@@ -1,279 +0,0 @@
-#!/bin/sh
-
-echo -ne "\e[31m●\e[0m \e[33m●\e[0m \e[32m●\e[0m  Infix Initramfs — " >/dev/console
-source /etc/os-release >/dev/console
-echo "$VERSION"
-
-set -e
-
-getkopt()
-{
-    grep -q -E "(^| )$1( |$)" /proc/cmdline
-}
-
-getkparam()
-{
-    sed -n "s/.*\<$1=\([^ ]*\).*/\1/p" /proc/cmdline
-}
-
-debug_shell()
-{
-    [ "$(getkparam rd.shell)" = "$1" ] || return 0
-
-    exec </dev/console &>/dev/console
-    echo "Starting debug shell at $1"
-    exec sh -i
-}
-
-die()
-{
-    step="${*:-$step}"
-
-    echo -e "\r\e[0K[\e[31mFAIL\e[0m] $step" >/dev/console
-    echo "<0>ix-initramfs: ERROR: $step" >/dev/kmsg
-    debug_shell error
-    exit 1
-}
-
-warn()
-{
-    step="${*:-$step}"
-
-    echo -e "\r\e[0K[\e[33mWARN\e[0m] $step" >/dev/console
-    echo "<5>ix-initramfs: WARNING: $step" >/dev/kmsg
-    debug_shell warning
-}
-
-ok()
-{
-    step="${*:-$step}"
-
-    echo -e "\r\e[0K[\e[32m OK \e[0m] $step" >/dev/console
-    echo "<5>ix-initramfs: $step" >/dev/kmsg
-}
-
-begin()
-{
-    step="$*"
-    echo -ne "[\e[33m ⋯  \e[0m] $step" >/dev/console
-}
-
-debug()
-{
-    echo "<7>ix-initramfs: $*" >/dev/kmsg
-}
-
-mountcore()
-{
-    mount -t proc     proc /proc
-    mount -t sysfs    sys  /sys
-    mount -t devtmpfs dev  /dev
-}
-
-mountroot()
-{
-    mkdir /newroot
-    mount "$1" /newroot || \
-	die "Unable to mount rootfs on $1"
-
-    ok "Mounting root filesystem on $(basename $1)"
-}
-
-switchroot()
-{
-    local innerinit=$(getkparam init)
-
-    ok "Switching to root filesystem"
-    exec switch_root /newroot ${innerinit:-/sbin/init}
-}
-
-internal_get_part()
-{
-    local _i _pv
-
-    for _i in $(seq 50); do
-	_pv=$(lvm pvs --reportformat json \
-		  | jq -r '.report[].pv[] | select(.vg_name == "internal") | .pv_name')
-	if [ "$_pv" ]; then
-	    [ $_i -gt 5 ] && ok
-	    echo "$_pv"
-	    return 0
-	fi
-
-	[ $_i -eq 5 ] && begin "Waiting for the internal volume to come online"
-	sleep .2
-    done
-
-    warn "Proceeding without the internal volume"
-    return 0
-}
-
-internal_inflate()
-{
-    local _dev _growfs _index _part
-
-    getkopt rd.nointernal && return 0
-
-    GPT_PART_GROWFS_BIT=59
-
-    _part=$(internal_get_part)
-    [ "$_part" ] || return 0
-
-    _index=$(cat /sys/class/block/$(basename "$_part")/partition)
-    [ "$_index" ] || return 1
-
-    _dev=/dev/$(basename $(realpath /sys/class/block/$(basename "$_part")/../))
-    [ -b "$_dev" ] || return 1
-
-    sgdisk "$_dev" -A "$_index":get:$GPT_PART_GROWFS_BIT \
-	| grep -q "$_index:$GPT_PART_GROWFS_BIT:1" \
-	|| return 0
-
-    begin "Inflating internal VG in $_part"
-
-    # First, expand the GPT to cover the entire disk and expand the
-    # LVM partition as much as possible.
-    if ! sgdisk "$_dev" \
-	      --disk-guid=random \
-	      --set-alignment=1 \
-	      --move-second-header \
-	      --delete="$_index" \
-	      --largest-new="$_index" --typecode="$_index":8e00 \
-	      >/tmp/internal-inflate.log 2>&1; then
-	warn "Failed to inflate GPT on $_dev"
-	return 0
-    fi
-
-    if ! lvm pvresize "$_part" >>/tmp/internal-inflate.log 2>&1; then
-	warn "Failed to resize PV $_part"
-	return 0
-    fi
-
-    ok "Inflated internal VG in $_part"
-}
-
-addparts()
-{
-    local _disk="$1"
-    local _partscan="/sys/class/block/"$(basename "$_disk")/partscan
-
-    [ -f "$_partscan" ] && [ $(cat "$_partscan") -eq 1 ] && return
-
-    kpartx -a "$_disk" 2>/dev/null || die "addparts: Unable to add partitions from $_disk"
-}
-
-gptuuid_probe()
-{
-    local _uuid=$(echo "$1" | sed -e 's/^GPTUUID=//' | tr ABCDEF abcdef)
-    local _cand _disk _initrd
-
-    [ -f /initrd.image ] && _initrd=/initrd.image
-
-    for _disk in $_initrd $(find /dev/ -type b); do
-	_cand=$(ddi "$_disk" inspect uuid | tr ABCDEF abcdef)
-	[ $? -eq 0 ] || continue
-
-	if [ "$_cand" = "$_uuid" ]; then
-	    ok "Located $_uuid in $_disk"
-	    echo "$_disk"
-	    return
-	fi
-    done
-
-    die "gptuuid_probe: Unable to find disk $_uuid"
-}
-
-ddi_probe()
-{
-    local _disk="$1"
-    local _dm="$(basename $_disk).root"
-    local _hash=$(getkparam rd.ddi.roothash)
-    local _v _trust
-
-    if [ -n "$_hash" ]; then
-	ok "Trusting pre-authenticated root hash"
-	_v="-V $_hash"
-    else
-	_v="-v"
-    fi
-
-    _trust=$(ddi "$_disk" part root open $_v "$_dm" 2>&1 \
-		 || die "ddi_probe: veritysetup of $_disk failed")
-
-    ok "$_trust"
-    ok "Opened verity protected root from $(basename $_disk)"
-    echo /dev/mapper/"$_dm"
-}
-
-lvm_probe()
-{
-    local _vg=$(dirname "$1") _lv=$(basename "$1")
-
-    lvm vgchange -ay "$_vg" &>/dev/null || \
-	die "lvm_probe: Failed to activate the $_vg VG"
-
-    [ -b /dev/"$1" ] || die "lvm_probe: Unable to locate the $_lv LV in $_vg"
-
-    echo /dev/"$1"
-}
-
-lo_probe()
-{
-    local _lo=$(losetup -f || die "probe_lo: found no free loop device for $1")
-    losetup -P "$_lo" "$1" || die "probe_lo: losetup of $1 to $_lo failed"
-
-    debug "lo_probe: setup $_lo backed by $1"
-    echo "$_lo"
-}
-
-probe()
-{
-    local _real _kind
-
-    case "$1" in
-	/*)
-	    _real=$(realpath "$1")
-	    _kind=$(stat -c %F "$_real" 2>/dev/null || true)
-	    case "$_kind" in
-		"block special file")
-		    addparts "$_real"
-		    echo "$_real"
-		    ;;
-		"regular file")
-		    lo_probe "$_real"
-		    ;;
-		"")
-		    die "Unknown root \"$1\""
-		    ;;
-		*)
-		    die "Unsupported root \"$1\": $_kind"
-		    ;;
-	    esac
-	    ;;
-	lvm)
-	    shift
-	    probe $(lvm_probe "$@")
-	    ;;
-	ddi)
-	    shift
-	    ddi_probe $(probe "$@")
-	    ;;
-	GPTUUID=*)
-	    gptuuid_probe "$@"
-	    ;;
-    esac
-}
-
-mountcore
-
-debug_shell internal
-internal_inflate
-
-debug_shell probe
-rootdev=$(probe $(getkparam root | sed -e 's/:/ /g'))
-
-debug_shell mount
-mountroot "$rootdev"
-
-debug_shell switchroot
-switchroot
@@ -1,21 +0,0 @@
-#!/bin/bash
-
-progs="blkid ddi dmsetup kpartx jq lvm openssl sgdisk veritysetup"
-
-check() {
-    require_binaries $progs || return 1
-
-    return 0
-}
-
-depends() {
-    return 0
-}
-
-install() {
-    inst_multiple $progs
-    inst '/etc/os-release'
-    inst '/etc/rauc/keys/*'
-
-    cp "$moddir/init" "${initdir?}/init"
-}
@@ -44,6 +44,10 @@ if [ -n "${ID_LIKE}" ]; then
    ID="${ID} ${ID_LIKE}"
 fi

+# Initialize default hostname for hostname.d pattern
+mkdir -p "$TARGET_DIR/etc/hostname.d"
+cp "$TARGET_DIR/etc/hostname" "$TARGET_DIR/etc/hostname.d/10-default"
+
 # This is a symlink to /usr/lib/os-release, so we remove this to keep
 # original Buildroot information.
 ixmsg "Creating /etc/os-release"
@@ -149,7 +149,7 @@ config QEMU_HOST

 config QEMU_APPEND
 	string "Extra kernel options"
-	depends on QEMU_LOADER_KERNEL
+	depends on !QEMU_ROOTFS_MMC

 config QEMU_EXTRA
 	string "Extra QEMU options"
@@ -1,279 +0,0 @@
-mainmenu "QEMU @ARCH@ Virtualization"
-
-config QEMU_@ARCH@
-	bool
-	default y
-
-config QEMU_ARCH
-	string
-	default "@ARCH@"
-
-config QEMU_VIRTIO_BUS
-	string
-	default "device"  if QEMU_arm
-	default "pci"
-
-config QEMU_BIN_DDI
-	string
-	default "@IMAGE@"
-
-config QEMU_BIN_DISK
-	string
-	default "@DISK@"
-
-config QEMU_BIN_ESP
-	string
-	default "@ESP@"
-
-config QEMU_BIN_KERNEL
-	string
-	depends on QEMU_LOADER_QEMU
-	default "../zImage"  if QEMU_arm
-	default "../Image"   if QEMU_aarch64
-	default "../bzImage" if QEMU_x86_64
-
-config QEMU_BIN_LVM_STUB
-	string
-	default "../lvm-stub.disk"
-
-
-choice
-	prompt "Loader"
-	default QEMU_LOADER_QEMU
-
-config QEMU_LOADER_QEMU
-	bool "QEMU"
-
-config QEMU_LOADER_OVMF
-	bool "OVMF (UEFI)"
-
-endchoice
-
-config QEMU_BIN_BIOS
-	string
-	depends on !QEMU_LOADER_KERNEL
-	default "OVMF.fd" if QEMU_LOADER_OVMF
-
-menu "Machine"
-
-config QEMU_MACHINE
-	string "Machine"
-	default "pc" if QEMU_x86_64
-	default "virt"
-
-config QEMU_CPU
-	string "CPU"
-	default "host" if QEMU_x86_64
-	default "cortex-a53" if QEMU_aarch64
-	default "max"
-
-config QEMU_RAM
-	string "RAM size (k/M/G)"
-	default "384M"
-
-choice
-     prompt "Console"
-     default QEMU_CONSOLE_VIRTIO
-
-config QEMU_CONSOLE_VIRTIO
-     bool "Virtio (hvc0)"
-
-config QEMU_CONSOLE_SERIAL
-     bool "Serial (ttyS0/ttyAMA0)"
-
-endchoice
-
-config QEMU_CONSOLE
-     string
-     default "hvc0" if QEMU_CONSOLE_VIRTIO
-     default "ttyAMA0" if QEMU_arm
-     default "ttyAMA0" if QEMU_aarch64
-     default "ttyS0"
-
-endmenu
-
-menu "Disks & Filesystems"
-
-config QEMU_DISK_INITRD
-     bool "Use the DDI as initrd"
-     depends on QEMU_LOADER_QEMU
-     help
-       Pass, and boot from, the DDI as the initial RAM disk.
-
-       This is useful to test netbooting scenarios, e.g., in
-       combination with an empty system disk to simulate an initial
-       deployment.
-
-comment "System disk"
-
-choice
-     prompt "Interface"
-     default QEMU_DISK_SYS_IF_VIRTIO
-
-config QEMU_DISK_SYS_IF_VIRTIO
-     bool "virtio"
-     help
-       Attach system disks using virtio block devices.
-
-endchoice
-
-choice
-     prompt "Contents"
-     default QEMU_DISK_SYS_SPLIT
-
-config QEMU_DISK_SYS_EMPTY
-     bool "Empty disk"
-     help
-       Attach an empty disk.
-
-       This is useful for testing things like installing Infix from a
-       USB mass storage device (see "USB Mass Storage" below).
-
-config QEMU_DISK_SYS_FULL
-     bool "Full system disk"
-     help
-       Use the full system disk containing:
-       - EFI partition (and backup) with Barebox
-       - LVM PV with Infix installed
-
-       This is useful when testing system upgrades, fallback
-       mechanisms related to corrupt disks etc.
-
-       WARNING: Usage of this option is fraught with peril as
-       incremental builds of Infix are likely to cause corruption in
-       the QCoW2 layer. If you do not understand the meaning of this
-       you most likely to NOT want to make use of this feature.
-
-config QEMU_DISK_SYS_NONE
-     bool "None"
-     help
-       Do not attach any system disk.
-
-       This is useful for testing how Infix behaves when no persistent
-       storage is available - a common scenario during bringup of a
-       new board.
-
-config QEMU_DISK_SYS_SPLIT
-     bool "Split ESP/DDI/LVM"
-     help
-       Attach the EFI System partition, containing Barebox; the raw
-       DDI image; and an (initially empty) LVM stub for persistent
-       storage - each as a separate disk.
-
-       This is the simplest way of testing out incremental builds of
-       Infix. Since the DDI is attached as a raw read-only disk, there
-       is no risk of CoW corruption like with a full system disk.
-
-       NOTE: In this setup, the size below refers to the size of the
-       LVM stub.
-
-endchoice
-
-config QEMU_DISK_SYS_SIZE
-	string "Size (k/M/G)"
-	default "8G"
-
-comment "USB mass storage"
-
-choice
-     prompt "Contents"
-     default QEMU_DISK_USB_NONE
-
-config QEMU_DISK_USB_DISK
-     bool "Full system disk"
-     help
-       Attach the full system disk containing:
-       - EFI partition (and backup) with Barebox
-       - LVM PV with Infix installed
-
-config QEMU_DISK_USB_NONE
-     bool "None"
-     help
-       Do not attach any disk over USB.
-
-endchoice
-
-config QEMU_DISK_USB_SIZE
-	string "Size (k/M/G)"
-	depends on !QEMU_DISK_USB_NONE
-	default "4G"
-
-comment "Host filesystem passthrough (9P)"
-
-config QEMU_DISK_HOST
-	string "Path"
-	default "/tmp"
-
-endmenu
-
-menu "Networking"
-
-choice
-     prompt "Mode"
-     default QEMU_NET_USER
-
-config QEMU_NET_BRIDGE
-     bool "Bridged"
-
-config QEMU_NET_NONE
-     bool "None"
-
-config QEMU_NET_ROCKER
-     bool "Rocker"
-
-config QEMU_NET_TAP
-     bool "TAP"
-
-config QEMU_NET_USER
-     bool "User"
-
-endchoice
-
-config QEMU_NET_MODE
-	string
-	default "bridge" if QEMU_NET_BRIDGE
-	default "none"   if QEMU_NET_NONE
-	default "rocker" if QEMU_NET_ROCKER
-	default "tap"    if QEMU_NET_TAP
-	default "user"   if QEMU_NET_USER
-
-config QEMU_NET_MODEL
-	string "Interface model"
-	default "virtio-net-device" if QEMU_arm
-	default "virtio-net-pci"
-	help
-	  The default virtio NIC works for most use-cases, but if you
-	  want to play with low-level stuff like ethtool, you might
-	  want to test the Intel 82545EM driver, e1000.
-
-	  Note: ARM 32-bit uses virtio-net-device (MMIO) by default.
-
-config QEMU_NET_BRIDGE_DEV
-	string "Bridge device"
-	depends on QEMU_NET_BRIDGE
-	default "virbr0"
-
-config QEMU_NET_USER_OPTS
-	string "User mode options"
-	depends on QEMU_NET_USER
-	help
-	  Extra -nic user,<OPTIONS>
-
-config QEMU_NET_TAP_N
-	int "Number of TAPs"
-	depends on QEMU_NET_TAP
-	default 1
-
-config QEMU_NET_PORTS
-	int "Number of Rocker switch ports"
-	depends on QEMU_NET_ROCKER
-	default 10
-
-endmenu
-
-config QEMU_EXTRA
-	string "Extra QEMU options"
-
-config QEMU_APPEND
-	string "Extra kernel options"
-	depends on QEMU_LOADER_QEMU
@@ -1,480 +0,0 @@
-#!/bin/sh
-# This script can be used to start an Infix OS image in Qemu.  It reads
-# either a .config, generated from Config.in, or qemu.cfg from a release
-# tarball, for the required configuration data.
-#
-# Debian/Ubuntu users can change the configuration post-release, install
-# the kconfig-frontends package:
-#
-#    sudo apt install kconfig-frontends
-#
-# and then call this script with:
-#
-#    ./run.sh -c
-#
-# To bring up a menuconfig dialog.  Select `Exit` and save the changes.
-# For more help, see:_
-#
-#    ./run.sh -h
-#
-# shellcheck disable=SC3037
-
-# Add /sbin to PATH for mkfs.ext4 and such (not default in debian)
-export PATH="/sbin:/usr/sbin:$PATH"
-
-qdir=$(dirname "$(readlink -f "$0")")
-imgdir=$(readlink -f "${qdir}/..")
-prognm=$(basename "$0")
-
-usage()
-{
-    cat <<EOF
-usage: $prognm [OPTIONS] [-- KERNEL-ARGS]
-
-Start Infix in a VM.
-
-Any arguments after -- are passed to the kernel, provided that QEMU's
-native loader is being used (i.e., not UEFI, for example).  This
-includes a second --, which the kernel uses to delimit between kernel
-arguments and those passed to the init process.
-
-Options:
-  -0
-    Clear any copy-on-write layers, resetting all disks to their
-    initial states, and exit.
-
-  -c
-    Run menuconfig to change Qemu settings.  This requires the
-    'kconfig-frontends' package (Debian/Ubuntu).
-
-  -G
-    Skip config generation. This is useful if you are testing out new
-    QEMU features by manually modifying qemu.cfg.
-
-  -h
-    Show this help message
-
-Example:
-
-  $prognm -- loglevel=4 -- finit.debug
-
-  Will set the kernel's loglevel to 4, and pass finit.debug as an
-  argument to PID 1.
-
-EOF
-}
-
-die()
-{
-    echo "$prognm: $*" >&2
-    exit 1
-}
-
-binpath()
-{
-    case "$1" in
-	./*|../*)
-	    # Relative paths are relative to the location of .config
-	    printf "$qdir/$1"
-	    ;;
-	*)
-	    printf "$1"
-	    ;;
-    esac
-}
-
-q()
-{
-    local _cmd="$1"
-    shift
-
-    case "$_cmd" in
-	sect)
-	    printf ' \\\n\t' >>"$qdir"/qemu.sh
-
-	    case $# in
-		1)
-		    printf -- "-$1" >>"$qdir"/qemu.sh
-		    _delim=" "
-		    ;;
-		2)
-		    printf -- "-$1 $2" >>"$qdir"/qemu.sh
-		    _delim=","
-		    ;;
-		*)
-		    die "q sect: Invalid arguments"
-		    ;;
-	    esac
-	    ;;
-	param)
-	    [ $# -eq 2 ] || die "q param: Takes exactly two arguments"
-	    printf -- "$_delim$1=$2" >>"$qdir"/qemu.sh
-	    _delim=","
-	    ;;
-	option)
-	    [ $# -eq 1 ] || die "q option: Takes exactly one argument"
-	    printf -- "$_delim$1" >>"$qdir"/qemu.sh
-	    _delim=","
-	    ;;
-	*)
-	    die "q: Unknown command: $_cmd"
-	    ;;
-    esac
-}
-
-q_sect_device_virtio()
-{
-    q sect device virtio-$1-$QEMU_VIRTIO_BUS
-}
-
-q_add_disk()
-{
-    if [ "$QEMU_DISK_SYS_IF_VIRTIO" ]; then
-    	q_sect_device_virtio blk
-	q param drive "$1"
-    else
-	die "Unknown system disk interface"
-    fi
-}
-
-q_sect_device_usb()
-{
-    if [ -z "$usb_bus_added" ]; then
-	q sect usb
-	q sect device usb-ehci
-	q param id ehci
-	usb_bus_added=YES
-    fi
-
-    q sect device "$1"
-    q param bus ehci.0
-}
-
-qcowed()
-{
-    local _qcow="$qdir"/"$1".qcow2
-    local _base _size
-
-    if [ -f "$_qcow" ] && qemu-img check -q "$_qcow"; then
-	echo "$_qcow"
-	return
-    fi
-
-    rm -f "$_qcow"
-
-    case $# in
-	2)
-	    _size="$2"
-
-	    qemu-img create -q -f qcow2 "$_qcow" "$_size" \
-		|| die "Unable to create $1"
-	    ;;
-	3)
-
-	    _base="$2"
-	    _size="$3"
-
-	    [ "$_size" = "auto" ] && _size=
-
-	    qemu-img create -q -f qcow2 -F raw \
-		     -o backing_file="$_base" "$_qcow" $_size \
-		|| die "Unable to create CoW layer for $_base"
-	    ;;
-	*)
-	    die "qcowed: usage: qcowed <name> [<backing-file>] <size>"
-	    ;;
-    esac
-
-    echo "$_qcow"
-}
-
-append()
-{
-    echo -n " $*" >>"$qdir"/append
-}
-
-gen_machine()
-{
-    q sect machine
-    q param type  "$QEMU_MACHINE"
-    q param accel kvm:tcg
-
-    q sect cpu "$QEMU_CPU"
-
-    q sect m
-    q param size "$QEMU_RAM"
-}
-
-gen_loader()
-{
-    if [ "$QEMU_LOADER_QEMU" ]; then
-	q sect kernel $(binpath "$QEMU_BIN_KERNEL")
-    elif [ "$QEMU_LOADER_OVMF" ]; then
-	q sect bios $(binpath "$QEMU_BIN_BIOS")
-    fi
-}
-
-gen_serial()
-{
-    q sect display none
-
-    q_sect_device_virtio serial
-
-    q sect chardev stdio
-    q param id  console0
-    q param mux on
-
-    q sect mon
-    q param chardev console0
-
-    case "$QEMU_CONSOLE" in
-	hvc0)
-	    q sect device virtconsole
-	    q param nr      0
-	    q param name    console
-	    q param chardev console0
-	    ;;
-	ttyS0|ttyAMA0)
-	    q sect serial chardev:console0
-	    ;;
-	*)
-	    die "Unsupported console: $QEMU_CONSOLE"
-	    ;;
-    esac
-
-    append console="$QEMU_CONSOLE"
-
-    [ "$V" ] && append debug || append loglevel=4
-}
-
-gpt_uuid()
-{
-    sgdisk "$1" -p | awk '
-    	BEGIN { err = 1; } END { exit(err); }
-	/^Creating new GPT/ { exit; }
-
-	/^Disk identifier \(GUID\): / {
-	    print($4); err = 0; exit;
-	}' || die "Unable to determine GPT UUID of $1"
-}
-
-gen_disk_sys_empty()
-{
-    q sect drive
-    q param id        disk-sys
-    q param format    qcow2
-    q param if        none
-    q param file      $(qcowed disk-sys "$QEMU_DISK_SYS_SIZE")
-
-    q_add_disk disk-sys
-}
-
-gen_disk_sys_full()
-{
-    q sect drive
-    q param id        disk-sys
-    q param format    qcow2
-    q param if        none
-    q param file      $(qcowed disk-sys $(binpath "$QEMU_BIN_DISK") \
-			       "$QEMU_DISK_SYS_SIZE")
-
-    q_add_disk disk-sys
-
-    append root=ddi:lvm:internal/$(basename "$QEMU_BIN_DDI")
-}
-
-gen_disk_sys_split()
-{
-    # EFI System Partition
-    q sect drive
-    q param id        disk-esp
-    q param format    qcow2
-    q param if        none
-    q param file      $(qcowed disk-esp $(binpath "$QEMU_BIN_ESP") auto)
-
-    q_add_disk disk-esp
-
-    # LVM stub
-    q sect drive
-    q param id        disk-sys
-    q param format    qcow2
-    q param if        none
-    q param file      $(qcowed disk-sys $(binpath "$QEMU_BIN_LVM_STUB") \
-			       "$QEMU_DISK_SYS_SIZE")
-
-    q_add_disk disk-sys
-
-    # DDI (ro)
-    q sect drive
-    q param id        disk-ddi
-    q param format    raw
-    q param file      $(binpath "$QEMU_BIN_DDI")
-    q param if        none
-    q param read-only on
-
-    q_add_disk disk-ddi
-
-    append root=ddi:GPTUUID=$(gpt_uuid $(binpath "$QEMU_BIN_DDI"))
-}
-
-gen_disk_sys()
-{
-    [ "$QEMU_DISK_SYS_NONE" ] && return
-
-    if [ "$QEMU_DISK_SYS_EMPTY" ]; then
-	gen_disk_sys_empty
-    elif [ "$QEMU_DISK_SYS_FULL" ]; then
-	gen_disk_sys_full
-    elif [ "$QEMU_DISK_SYS_SPLIT" ]; then
-	gen_disk_sys_split
-    else
-	die "Unknown system disk mode"
-    fi
-}
-
-gen_disk_usb()
-{
-    [ "$QEMU_DISK_USB_NONE" ] && return
-
-    if [ "$QEMU_DISK_USB_DISK" ]; then
-	q sect drive
-	q param id        disk-usb
-	q param format    qcow2
-	q param file      $(qcowed disk-usb \
-				$(binpath "$QEMU_BIN_DISK") \
-				"$QEMU_DISK_USB_SIZE")
-	q param if        none
-
-	q_sect_device_usb usb-storage
-	q param drive disk-usb
-    else
-	die "Unknown USB attachment"
-    fi
-}
-
-gen_disk_initrd()
-{
-    [ "$QEMU_DISK_INITRD" ] || return
-
-    q sect initrd $(binpath "$QEMU_BIN_DDI")
-    append root=ddi:/initrd.image
-}
-
-internal_is_available()
-{
-    [ "$QEMU_DISK_SYS_FULL" ] || [ "$QEMU_DISK_SYS_SPLIT" ] \
-	|| [ "$QEMU_DISK_USB_DISK" ]
-}
-
-gen_disks()
-{
-    gen_disk_sys
-    gen_disk_usb
-
-    gen_disk_initrd
-
-    internal_is_available || append rd.nointernal
-}
-
-gen_gdb()
-{
-    # Create a UNIX socket on the host that is connected to a virtio
-    # console in the guest, which gdbserver can attach to for
-    # userspace debugging.
-    q sect chardev socket
-    q param id     gdbserver
-    q param path   "$qdir"/gdbserver.sock
-    q param server on
-    q param wait   off
-
-    q sect device virtconsole
-    q param nr      1
-    q param name    gdbserver
-    q param chardev gdbserver
-
-    # Create a UNIX socket on the host that is connected to QEMU's GDB
-    # stub, for bootloader/kernel debugging.
-    q sect chardev socket
-    q param id gdbqemu
-    q param path   "$qdir"/gdbqemu.sock
-    q param server on
-    q param wait   off
-
-    q sect gdb chardev:gdbqemu
-}
-
-gen_all()
-{
-    local _append
-
-    : >"$qdir"/append
-    cat <<EOF >"$qdir"/qemu.sh
-#!/bin/sh
-
-echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
-
-line=\$(stty -g)
-stty raw
-trap 'stty "\$line"' EXIT INT TERM
-
-qemu-system-$QEMU_ARCH -nodefaults \\
-EOF
-    chmod +x "$qdir"/qemu.sh
-
-    gen_machine
-    gen_loader
-    gen_serial
-    gen_disks
-    gen_gdb
-
-    if [ "$QEMU_LOADER_QEMU" ]; then
-	_append=$(cat "$qdir"/append)
-	q sect append "\"$_append $QEMU_APPEND $*\""
-    fi
-
-    echo >>"$qdir"/qemu.sh
-}
-
-menuconfig()
-{
-    command -v kconfig-mconf >/dev/null \
-	|| die "cannot find kconfig-mconf for menuconfig"
-
-    CONFIG_= KCONFIG_CONFIG="$qdir"/.config \
-	   kconfig-mconf "$qdir"/Config.in
-}
-
-_generate=YES
-
-while getopts "0cGh-" opt; do
-    case ${opt} in
-	0)
-	    echo "Clearing all copy-on-write layers" >&2
-	    rm -f "$qdir"/*.qcow2
-	    exit 0
-	    ;;
-	c)
-	    menuconfig
-	    ;;
-	G)
-	    _generate=
-	    ;;
-	h)
-	    usage && exit 0
-	    ;;
-	-)
-	    break
-	    ;;
-	*)
-	    usage && exit 1
-	    ;;
-    esac
-done
-shift $((OPTIND - 1))
-
-# shellcheck disable=SC1090
-. "$qdir"/.config
-
-[ "$_generate" ] && gen_all "$*"
-
-exec "$qdir"/qemu.sh
@@ -4,15 +4,9 @@
 #
 ################################################################################

-qemu-scripts-dir := $(pkgdir)/$(if $(IMAGE_DDI),ddi,itb)
-qemu-image := ../$(INFIX_ARTIFACT).$(if $(IMAGE_DDI),raw,qcow2)
-qemu-disk := $(if $(IMAGE_DDI_DISK),../$(INFIX_ARTIFACT).disk)
-qemu-esp := $(if $(IMAGE_BAREBOX_ESP),../barebox-esp.vfat)
-
-qemu-kconfig-prefix := $(if $(IMAGE_DDI),,CONFIG_)
-
+QEMU_SCRIPTS_DIR := $(pkgdir)
 qemu-kconfig = \
-	CONFIG_="$(qemu-kconfig-prefix)" \
+	CONFIG_="CONFIG_" \
 	BR2_CONFIG="$(BINARIES_DIR)/qemu/.config" \
 	$(BUILD_DIR)/buildroot-config/$(1) $(2) "$(BINARIES_DIR)/qemu/Config.in"

@@ -31,19 +25,17 @@ qemu-scripts: \
 		$(BINARIES_DIR)/qemu/Config.in \
 		$(BINARIES_DIR)/qemu/.config

-$(BINARIES_DIR)/qemu/run.sh: $(qemu-scripts-dir)/run.sh
+$(BINARIES_DIR)/qemu/run.sh: $(QEMU_SCRIPTS_DIR)/run.sh
 	@$(call IXMSG,"Installing QEMU scripts")
 	@mkdir -p $(dir $@)
 	@cp $< $@

-$(BINARIES_DIR)/qemu/Config.in: $(qemu-scripts-dir)/Config.in.in
+$(BINARIES_DIR)/qemu/Config.in: $(QEMU_SCRIPTS_DIR)/Config.in.in
 	@mkdir -p $(dir $@)
 	@sed \
-		-e "s:@ARCH@:$(BR2_ARCH):g" \
-		-e "s:@IMAGE@:$(qemu-image):g" \
-		-e "s:@DISK@:$(qemu-disk):g" \
-		-e "s:@ESP@:$(qemu-esp):g" \
-	<$< >$@
+		-e "s:@ARCH@:QEMU_$(BR2_ARCH):" \
+		-e "s:@DISK_IMG@:../$(INFIX_ARTIFACT).qcow2:" \
+	< $< >$@

 $(BINARIES_DIR)/qemu/.config: $(BINARIES_DIR)/qemu/Config.in
 	@$(call qemu-kconfig,conf,--olddefconfig)
@@ -2,6 +2,7 @@
 # managed by openresolv.  DHCP lease, VPN tunnel establishment,
 # and similar events feed servers and configuration to dnsmasq.
 domain-needed
+dhcp-authoritative

 # Allow configuration and cache clear over D-Bus
 enable-dbus
@@ -10,8 +11,6 @@ enable-dbus
 #dhcp-option=option:netmask
 #dhcp-option=28			# option:broadcast
 #dhcp-option=option:domain-name
-dhcp-option=option:router
-dhcp-option=option:dns-server
 dhcp-option=12			# option:hostname

 # Generated by openresolv
@@ -1,3 +1,3 @@
-task name:ixinit log:tag:ixinit [S] <pid/syslogd> \
+task name:ixinit [S] <pid/syslogd> \
 	/usr/libexec/finit/runparts -bp /usr/libexec/infix/init.d \
 	-- Probing system
@@ -1 +0,0 @@
-task [S] <service/confd/ready> /usr/libexec/infix/mkcert -- Verifying self-signed https certificate
@@ -1,3 +1,3 @@
-service name:netopeer notify:none log env:/etc/default/confd \
-	[12345] <pid/confd> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
+service name:netopeer notify:none log:null env:/etc/default/confd      \
+	[12345] <pid/confd,usr/bootstrap> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
 	-- NETCONF server
@@ -1,3 +1,3 @@
-service name:rousette notify:none log:null <pid/confd> env:/etc/default/confd \
-	[12345] rousette --syslog -t $CONFD_TIMEOUT \
+service <!pid/confd,usr/bootstrap> notify:none log:null env:/etc/default/confd \
+	[12345] rousette --syslog --log-level info -t $CONFD_TIMEOUT           \
 	-- RESTCONF server
@@ -1,5 +1,5 @@
 # Override Finit plugin
 service cgroup.system name:dbus notify:none pid:!/run/messagebus.pid \
-	[S123456789] <pid/syslogd> /usr/bin/dbus-daemon --nofork --system --syslog-only \
+	[S123456789] <usr/bootstrap> /usr/bin/dbus-daemon --nofork --system --syslog-only \
 	-- D-Bus message bus daemon

@@ -1 +0,0 @@
-../available/mkcert.conf
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`dtb-y += mediatek/mt7622-bananapi-bpi-r64.dtb`
				`@@ -0,0 +1 @@`
				`CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-sd-env.dtsi"`
				`@@ -1 +0,0 @@`
				`task [S] <service/confd/ready> /usr/libexec/infix/mkcert -- Verifying self-signed https certificate`