image-ddi: Mount persistent storage from internal/rw LVM LV

This opens up for DDI images to ship their own implementation.

.github/actions/cache-restore/action.yml

@@ -0,0 +1,41 @@
+name: 'Restore Build Caches'
+description: 'Restore dl/ and .ccache/ caches for Buildroot builds'
+inputs:
+  target:
+    description: 'Build target for cache key differentiation'
+    required: true
+  dl-prefix:
+    description: 'Prefix for dl/ cache key (e.g., "dl", "dl-boot")'
+    required: false
+    default: 'dl'
+  ccache-prefix:
+    description: 'Prefix for .ccache/ cache key (e.g., "ccache", "ccache-boot")'
+    required: false
+    default: 'ccache'
+  enabled:
+    description: 'Set to false to skip cache restoration'
+    required: false
+    default: 'true'
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore Cache of dl/
+      if: ${{ inputs.enabled == 'true' }}
+      uses: actions/cache@v4
+      with:
+        path: dl/
+        key: ${{ inputs.dl-prefix }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+        restore-keys: |
+          ${{ inputs.dl-prefix }}-
+          dl-
+
+    - name: Restore Cache of .ccache/
+      if: ${{ inputs.enabled == 'true' }}
+      uses: actions/cache@v4
+      with:
+        path: .ccache/
+        key: ${{ inputs.ccache-prefix }}-${{ inputs.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+        restore-keys: |
+          ${{ inputs.ccache-prefix }}-${{ inputs.target }}-
+          ${{ inputs.ccache-prefix }}-
+          ccache-

.github/actions/podman-cleanup/action.yml

@@ -0,0 +1,15 @@
+name: 'Podman Cleanup'
+description: 'Clean up stale podman state from previous runs'
+runs:
+  using: 'composite'
+  steps:
+    - name: Cleanup podman state
+      shell: bash
+      run: |
+        set -x
+        podman ps -a              || true
+        podman stop -a            || true
+        podman rm -a -f           || true
+        podman volume prune -f    || true
+        podman system prune -a -f || true
+        podman system migrate     || true

.github/workflows/build-boot.yml

@@ -22,7 +22,10 @@ jobs:
           - cn9130_crb_boot
           - fireant_boot
           - nanopi_r2s_boot
+          - rpi2_boot
           - rpi64_boot
+          - sama7g54_ek_emmc_boot
+          - sama7g54_ek_sd_boot
     env:
       MAKEFLAGS: -j5
     steps:
@@ -63,24 +66,11 @@ jobs:
 
           echo "Building ${defconfig}_defconfig, version ${version}-${rev}, artifact ${archive} ..."
 
-      - name: Restore Cache of dl/
+      - uses: ./.github/actions/cache-restore
-        uses: actions/cache@v4
         with:
-          path: dl/
+          target: ${{ matrix.defconfig }}
-          key: dl-boot-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          dl-prefix: dl-boot
-          restore-keys: |
+          ccache-prefix: ccache-boot
-            dl-boot-
-            dl-
-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-boot-${{ matrix.defconfig }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-boot-${{ matrix.defconfig }}-
-            ccache-boot-
-            ccache-
 
       - name: Configure ${{ matrix.defconfig }}_defconfig
         run: |

.github/workflows/build-image.yml

@@ -8,14 +8,12 @@ on:
         type: choice
         required: true
         options:
+          - raspberrypi-rpi2
           - raspberrypi-rpi64
           - bananapi-bpi-r3
           - friendlyarm-nanopi-r2s
+          - microchip-sama7g54-ek
         default: 'raspberrypi-rpi64'
-      use_latest_release:
-        description: 'Use latest release artifacts instead of workflow artifacts'
-        type: boolean
-        default: false
 
 jobs:
   create-image:
@@ -53,28 +51,39 @@ jobs:
       - name: Set bootloader and target based on board
         run: |
           case "${{ inputs.board }}" in
+            raspberrypi-rpi2)
+              echo "BOOTLOADER=rpi2-boot" >> $GITHUB_ENV
+              echo "ARCH=arm" >> $GITHUB_ENV
+              echo "BUILD_EMMC=false" >> $GITHUB_ENV
+              ;;
             raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
             bananapi-bpi-r3)
-              echo "BOOTLOADER_SD=bpi_r3_sd_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_SD=bpi-r3-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi_r3_emmc_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi-r3-emmc-boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=true" >> $GITHUB_ENV
               ;;
             friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
+            microchip-sama7g54-ek)
+              echo "BOOTLOADER_SD=sama7g54-ek-sd-boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=sama7g54-ek-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=arm" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              ;;
             *)
               echo "Error: Unknown board ${{ inputs.board }}"
               exit 1
               ;;
           esac
-          echo "Target: $TARGET for board: ${{ inputs.board }}"
+          echo "Arch: $ARCH for board: ${{ inputs.board }}"
           if [ "$BUILD_EMMC" = "true" ]; then
             echo "Building both SD and eMMC images"
             echo "SD Bootloader: $BOOTLOADER_SD"
@@ -85,16 +94,12 @@ jobs:
           fi
 
       - name: Download bootloader artifacts
-        if: ${{ !inputs.use_latest_release }}
         run: |
-          # Download from latest bootloader build workflow on main branch
+          # Download bootloader from latest-boot release tag
-          gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
-          BOOT_RUN_ID=$(cat latest_boot_run_id)
-
           if [ "$BUILD_EMMC" = "true" ]; then
             # Download both SD and eMMC bootloaders for boards that support both
             echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
-            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_SD} --dir temp_bootloader_sd/
+            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
             mkdir -p output_sd/images
             cd temp_bootloader_sd/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -102,7 +107,7 @@ jobs:
             rm -rf temp_bootloader_sd/
 
             echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
-            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_EMMC} --dir temp_bootloader_emmc/
+            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
             mkdir -p output_emmc/images
             cd temp_bootloader_emmc/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
@@ -115,7 +120,7 @@ jobs:
             ls -la output_emmc/images/
           else
             # Single bootloader for boards that only support SD
-            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
+            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
 
             # Extract bootloader directly to output/images
             cd temp_bootloader/
@@ -130,7 +135,6 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download Infix artifacts
-        if: ${{ !inputs.use_latest_release }}
         run: |
           # Download from latest Kernelkit Trigger workflow for main branch
           gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
@@ -138,7 +142,7 @@ jobs:
 
           if [ "$BUILD_EMMC" = "true" ]; then
             # Copy Infix artifacts to both SD and eMMC output directories
-            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
 
             cd temp_infix/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -152,7 +156,7 @@ jobs:
             ls -la output_emmc/images/
           else
             # Single output directory for SD-only boards
-            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
 
             # Extract Infix directly to output/images
             cd temp_infix/
@@ -166,58 +170,6 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Download from latest releases
-        if: ${{ inputs.use_latest_release }}
-        run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            # Download both SD and eMMC bootloaders
-            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
-            mkdir -p output_sd/images
-            cd temp_bootloader_sd/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-            cd ../
-            rm -rf temp_bootloader_sd/
-
-            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
-            mkdir -p output_emmc/images
-            cd temp_bootloader_emmc/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-            cd ../
-            rm -rf temp_bootloader_emmc/
-
-            # Download Infix once and extract to both directories
-            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
-            cd temp_infix/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-            cd ../
-            rm -rf temp_infix/
-
-            echo "SD files extracted to output_sd/images:"
-            ls -la output_sd/images/
-            echo "eMMC files extracted to output_emmc/images:"
-            ls -la output_emmc/images/
-          else
-            # Download latest bootloader release
-            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
-            cd temp_bootloader/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-            cd ../
-            rm -rf temp_bootloader/
-
-            # Download latest Infix release
-            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
-            cd temp_infix/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-            cd ../
-            rm -rf temp_infix/
-
-            echo "All files extracted to output/images:"
-            ls -la output/images/
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Verify extracted files
         run: |
           if [ "$BUILD_EMMC" = "true" ]; then
@@ -249,7 +201,7 @@ jobs:
             export BR2_EXTERNAL_INFIX_PATH=$PWD
             export RELEASE=""
             export INFIX_ID="infix"
-            ./utils/mkimage.sh ${{ inputs.board }}
+            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
           fi
 
       - name: Create eMMC image
@@ -347,10 +299,11 @@ jobs:
           # SD Card & eMMC Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
-          **Target:** ${{ env.TARGET }}
+          **Arch:** ${{ env.ARCH }}
           **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
           **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
-          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
+          **Bootloader Source:** latest-boot release
+          **Infix Source:** Latest workflow run on main
 
           ## Created Images
           $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
@@ -363,9 +316,10 @@ jobs:
           # SD Card Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
-          **Target:** ${{ env.TARGET }}
+          **Arch:** ${{ env.ARCH }}
           **Bootloader:** ${{ env.BOOTLOADER }}
-          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
+          **Bootloader Source:** latest-boot release
+          **Infix Source:** Latest workflow run on main
 
           ## Created Images
           $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")

.github/workflows/build-release.yml

@@ -20,24 +20,16 @@ jobs:
     runs-on: [self-hosted, release]
     strategy:
       matrix:
-        target: [aarch64, x86_64]
+        target: [aarch64, arm, x86_64]
       fail-fast: false
     steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
       - uses: actions/checkout@v4
         with:
           clean: true
           submodules: recursive
 
+      - uses: ./.github/actions/podman-cleanup
+
       - name: Set Release Variables
         id: vars
         run: |
@@ -48,24 +40,10 @@ jobs:
           echo "dir=infix-$target"        >> $GITHUB_OUTPUT
           echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
 
-      - name: Restore Cache of dl/
+      - uses: ./.github/actions/cache-restore
-        if: ${{ inputs.use_cache }}
-        uses: actions/cache@v4
         with:
-          path: dl/
+          target: ${{ matrix.target }}
-          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          enabled: ${{ inputs.use_cache }}
-          restore-keys: |
-            dl-
-
-      - name: Restore Cache of .ccache/
-        if: ${{ inputs.use_cache }}
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-${{ matrix.target }}-
-            ccache-
 
       - name: Configure & Build
         env:

.github/workflows/build.yml

@@ -78,15 +78,6 @@ jobs:
           rm -rf ./* || true
           rm -rf ./.??* || true
           ls -la ./
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
 
       - name: Checkout infix repo
         uses: actions/checkout@v4
@@ -98,6 +89,8 @@ jobs:
           submodules: recursive
           token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
 
+      - uses: ./.github/actions/podman-cleanup
+
       - name: Run pre-build script
         if: ${{ inputs.pre_build_script != '' }}
         run: |
@@ -127,22 +120,9 @@ jobs:
           echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
           echo "Building target ${target}_defconfig"
 
-      - name: Restore Cache of dl/
+      - uses: ./.github/actions/cache-restore
-        uses: actions/cache@v4
         with:
-          path: dl/
+          target: ${{ env.TARGET }}
-          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-
-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-${{ env.TARGET }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-${{ env.TARGET }}-
-            ccache-
 
       - name: Configure ${{ env.TARGET }}
         run: |
@@ -153,10 +133,6 @@ jobs:
           podman rm -af || true
           pkill -9 -f rootlessport || true
 
-      - name: Unit Test ${{ env.TARGET }}
-        run: |
-          make test-unit
-
       - name: Prepare parallel build
         id: parallel
         run: |

.github/workflows/check-kernel-release.yml

@@ -1,4 +1,4 @@
-name: Check Kernel 6.12 Release
+name: Check Kernel 6.18 Release
 
 on:
   schedule:
@@ -17,12 +17,12 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
 
-      - name: Fetch kernel.org and check for 6.12 release
+      - name: Fetch kernel.org and check for 6.18 release
         id: check
         run: |
           set -e -o pipefail
-          # Fetch the kernel.org frontpage and extract 6.12 version
+          # Fetch the kernel.org frontpage and extract 6.18 version
-          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)
+          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.18\.\d+' | head -n1)
 
           if [ -z "$CURRENT_VERSION" ]; then
             echo "Failed to fetch kernel version"
@@ -30,7 +30,7 @@ jobs:
           fi
 
           echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          echo "Current 6.12 kernel version: $CURRENT_VERSION"
+          echo "Current 6.18 kernel version: $CURRENT_VERSION"
 
           # Get the version from infix defconfig
           INFIX_VERSION=$(grep 'BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=' configs/aarch64_defconfig | cut -d'"' -f2)
@@ -47,7 +47,7 @@ jobs:
               echo "PR already exists for kernel $CURRENT_VERSION, skipping"
             else
               echo "new_release=true" >> $GITHUB_OUTPUT
-              echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
+              echo "🎉 New 6.18 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
             fi
           else
             echo "new_release=false" >> $GITHUB_OUTPUT
@@ -99,7 +99,7 @@ jobs:
           BRANCH_NAME: ${{ steps.branch.outputs.name }}
         run: |
           set -e -o pipefail
-          ./utils/kernel-upgrade.sh linux "$BRANCH_NAME"
+          ./utils/kernel-upgrade.sh linux 6.18 "$BRANCH_NAME"
 
       - name: Create pull request
         if: steps.check.outputs.new_release == 'true'

.github/workflows/inventory.yml

@@ -45,22 +45,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Restore Cache of dl/
+      - uses: ./.github/actions/cache-restore
-        uses: actions/cache@v4
         with:
-          path: dl/
+          target: x86_64
-          key: dl-netconf-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          dl-prefix: dl-netconf
-          restore-keys: |
-            dl-netconf-
-            dl-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-x86_64-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-x86_64-
-            ccache-
       - name: Disk inventory (2/2) ...
         run: |
           echo "df -h ========================================================================="

.github/workflows/release.yml

@@ -48,20 +48,12 @@ jobs:
       contents: write
       discussions: write
     steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
       - uses: actions/checkout@v4
         with:
           submodules: 'true'
 
+      - uses: ./.github/actions/podman-cleanup
+
       - name: Set Release Variables
         id: rel
         run: |
@@ -104,11 +96,7 @@ jobs:
 
       - name: Extract ChangeLog entry ...
         run: |
-          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
+          cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
-              |head -n -1 > release.md
-          echo "" >> release.md
-          echo "> [!TIP]" >> release.md
-          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
           cat release.md
 
       - uses: ncipollo/release-action@v1

.github/workflows/test.yml

@@ -60,16 +60,6 @@ jobs:
     name: Regression Test ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
     runs-on: [self-hosted, regression]
     steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
       - name: Checkout infix repo
         uses: actions/checkout@v4
         with:
@@ -80,6 +70,8 @@ jobs:
           submodules: recursive
           token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
 
+      - uses: ./.github/actions/podman-cleanup
+
       - name: Run pre-test script
         if: ${{ inputs.pre_test_script != '' }}
         run: |

.github/workflows/trigger.yml

@@ -1,4 +1,4 @@
-name: Kernelkit Trigger
+name: CI
 
 on:
   pull_request:
@@ -28,6 +28,7 @@ jobs:
     outputs:
       x86_64_target: ${{ steps.set-targets.outputs.x86_64_target }}
       aarch64_target: ${{ steps.set-targets.outputs.aarch64_target }}
+      arm_target: ${{ steps.set-targets.outputs.arm_target }}
     steps:
       - run: |
           echo "Triggering build, logging meta data ..."
@@ -43,25 +44,40 @@ jobs:
              | grep -q "ci:main"; then
             echo "x86_64_target=x86_64_minimal" >> $GITHUB_OUTPUT
             echo "aarch64_target=aarch64_minimal" >> $GITHUB_OUTPUT
+            echo "arm_target=arm_minimal" >> $GITHUB_OUTPUT
           else
             echo "x86_64_target=x86_64" >> $GITHUB_OUTPUT
             echo "aarch64_target=aarch64" >> $GITHUB_OUTPUT
+            echo "arm_target=arm" >> $GITHUB_OUTPUT
           fi
+  unit-test:
+    needs: check-trigger
+    uses: ./.github/workflows/unit-test.yml
+    with:
+      name: "infix"
+      target: ${{ needs.check-trigger.outputs.x86_64_target }}
 
   build-x86_64:
-    needs: check-trigger
+    needs: [check-trigger, unit-test]
     uses: ./.github/workflows/build.yml
     with:
       name: "infix"
       target: ${{ needs.check-trigger.outputs.x86_64_target }}
 
   build-aarch64:
-    needs: check-trigger
+    needs: [check-trigger, unit-test]
     uses: ./.github/workflows/build.yml
     with:
       name: "infix"
       target: ${{ needs.check-trigger.outputs.aarch64_target }}
 
+  build-arm:
+    needs: [check-trigger, unit-test]
+    uses: ./.github/workflows/build.yml
+    with:
+      name: "infix"
+      target: ${{ needs.check-trigger.outputs.arm_target }}
+
   test-run-x86_64:
     needs: [check-trigger, build-x86_64]
     uses: ./.github/workflows/test.yml

.github/workflows/unit-test.yml

@@ -0,0 +1,116 @@
+name: unit-test
+
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: "Build target (e.g. aarch64 or aarch64_minimal)"
+        default: "x86_64"
+        type: string
+      parallel:
+        description: 'Massive parallel build of each image'
+        default: true
+        type: boolean
+      name:
+        description: "Name (for spin overrides)"
+        default: "infix"
+        type: string
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        default: kernelkit/infix
+        type: string
+      infix_branch:
+        description: 'Branch/tag/commit to checkout (for spin overrides)'
+        default: ''
+        type: string
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+      infix_branch:
+        required: false
+        type: string
+        default: ''
+        description: 'Branch/tag/commit to checkout (for spin overrides). Defaults to github.ref if not specified'
+      parallel:
+        required: false
+        type: boolean
+        default: true
+      pre_build_script:
+        required: false
+        type: string
+        default: ''
+        description: 'Optional script to run after checkout (for spin customization)'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'
+
+env:
+  NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
+  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  INFIX_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_branch || inputs.infix_branch }}
+
+jobs:
+  unit-tests:
+    name: Build ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+    runs-on: [ self-hosted, latest ]
+    env:
+      PARALLEL: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.parallel == 'true' || github.event_name != 'workflow_dispatch' && inputs.parallel == true }}
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Cleanup Build Folder
+        run: |
+          ls -la ./
+          rm -rf ./* || true
+          rm -rf ./.??* || true
+          ls -la ./
+
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
+          clean: true
+          fetch-depth: 0
+          submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
+
+      - uses: ./.github/actions/podman-cleanup
+
+      - name: Run pre-build script
+        if: ${{ inputs.pre_build_script != '' }}
+        run: |
+          cat > ./pre-build.sh << 'EOF'
+          ${{ inputs.pre_build_script }}
+          EOF
+          chmod +x ./pre-build.sh
+          bash ./pre-build.sh
+
+      - uses: ./.github/actions/cache-restore
+        with:
+          target: ${{ env.TARGET }}
+
+      - name: Configure ${{ env.TARGET }}
+        run: |
+          make ${{ env.TARGET }}_defconfig
+
+      - name: Cleanup stale containers and ports
+        run: |
+          podman rm -af || true
+          pkill -9 -f rootlessport || true
+
+      - name: Unit Test ${{ env.TARGET }}
+        run: |
+          make test-unit

.gitignore

@@ -1,6 +1,8 @@
 *~
 .claude
 .gdb_history
+.claude
+AGENTS.md
 /.backup
 /.ccache
 /dl

README.md

@@ -16,10 +16,12 @@ if something goes wrong.  Deploy once, trust forever.
 
 **🤝 Friendly**  
 Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit `?` or TAB for
+with built-in help for every command — just hit <kbd>?</kbd> or
-context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
+<kbd>TAB</kbd> for context-aware assistance.
-[comprehensive documentation][4] mean you're never stuck.  Whether
+
-you're learning networking or managing enterprise infrastructure.
+Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
+mean you're never stuck.  Whether you're learning networking or managing
+enterprise infrastructure.
 
 **🛡️ Secure**  
 Built with security as a foundation, not an afterthought.  Minimal
@@ -53,27 +55,24 @@ your device, your rules.
    Consistent tooling from development to production deployment.  
    How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
 
-## See It In Action
+## Quick Example
 
 Configure an interface in seconds - the CLI guides you with built-in help:
 
-<details><summary><b>Click Here for an example CLI Session</b></summary>
+<pre><code>admin@infix-12-34-56:/> <b>configure</b>
-
+admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
-```bash
+admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4</b> <kbd>TAB</kbd>
-admin@infix-12-34-56:/> configure
+      address     autoconf      bind-ni-name     dhcp 
-admin@infix-12-34-56:/config/> edit interface eth0
+      enabled     forwarding    mtu              neighbor
-admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
+admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4 address 192.168.2.200 prefix-length 24</b>
-      address     autoconf bind-ni-name      enabled
+admin@infix-12-34-56:/config/interface/eth0/> <b>show</b>
-      forwarding  mtu      neighbor
-admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
-admin@infix-12-34-56:/config/interface/eth0/> show
 type ethernet;
 ipv4 {
   address 192.168.2.200 {
     prefix-length 24;
   }
 }
-admin@infix-12-34-56:/config/interface/eth0/> diff
+admin@infix-12-34-56:/config/interface/eth0/> <b>diff</b>
 interfaces {
   interface eth0 {
 +    ipv4 {
@@ -83,25 +82,23 @@ interfaces {
 +    }
   }
 }
-admin@infix-12-34-56:/config/interface/eth0/> leave
+admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
-admin@infix-12-34-56:/> show interfaces
+admin@infix-12-34-56:/> <b>show interfaces</b>
-INTERFACE       PROTOCOL   STATE       DATA
+<u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
 eth0            ethernet   UP          52:54:00:12:34:56
                 ipv4                   192.168.2.200/24 (static)
                 ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                 ipv4                   127.0.0.1/8 (static)
                 ipv6                   ::1/128 (static)
-admin@infix-12-34-56:/> copy running-config startup-config
+admin@infix-12-34-56:/> <b>copy running startup</b>
-```
+</code></pre>
 
-Notice how TAB completion shows available options, `show` displays
+Notice how <kbd>TAB</kbd> completion shows available options, `show`
-current config, and `diff` shows exactly what changed before you
+displays current config, and `diff` shows exactly what changed before
-commit your changes with the `leave` command.
+you commit your changes with the `leave` command.
 
-</details>
+For more information, see [CLI documentation][3].
-
-> [Full CLI documentation →][3]
 
 ## Get Started
 
@@ -111,7 +108,7 @@ containers for any custom functionality you need.
 
 ### Supported Platforms
 
-- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
+- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
 - **Banana Pi-R3** - Your next home router and gateway
 - **NanoPi R2S** - Compact dual-port router in a tiny package
 - **x86_64** - Run in VMs or on mini PCs for development and testing

board/Config.in

@@ -1,6 +1,6 @@
 menu "Board Support"
 
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/arm/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"

board/README.md

@@ -0,0 +1,18 @@
+Board Support
+=============
+
+The board support for an architecture always starts with Qemu support,
+this is what each `linux_defconfig` at the very least sets up.  Then
+each `$BR2_ARCH` has additional BSPs, e.g., Banana Pi BPI-R3.
+
+The `board/` directory is matched with the `configs/*_defconfigs` and
+the only execption is `board/common/`, which holds all shared files for
+Infix builds.
+
+Each `board/$BR2_ARCH/` can then have vendor/product sub-directories
+for the BSPs which may contain "fixups" to the base kernel config and
+any additional device tree files that should be included as well.
+
+To rebuild a board-specific package, e.g. NanoPi R2S:
+
+    make friendlyarm-nanopi-r2s-rebuild all

board/aarch32/Config.in

@@ -1,5 +0,0 @@
-if BR2_arm
-
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/raspberrypi-rpi2/Config.in"
-
-endif

board/aarch32/board.mk

@@ -1 +0,0 @@
-

board/aarch64/bananapi-bpi-r3/Config.in

@@ -5,6 +5,7 @@ config BR2_PACKAGE_BANANAPI_BPI_R3
 	select BR2_PACKAGE_LINUX_FIRMWARE
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7986
+	select BR2_PACKAGE_LINUX_FIRMWARE_AIROHA_EN8811H
 	select SDCARD_AUX
 	help
 	  Build Banana PI R3 support

board/aarch64/bananapi-bpi-r3/README.md

@@ -1,20 +1,29 @@
-# Banana Pi BPI-R3
+# Banana Pi BPI-R3 / BPI-R3 Mini
 
 <img src="bananapi-bpi-r3.webp" alt="The board" width=800 padding=10>
 
 ## Overview
 
-The Banana Pi R3 is a high-performance networking board with full Infix
+The Banana Pi BPI-R3 and BPI-R3 Mini are high-performance networking
-support for all enabled features including switched Ethernet ports, WiFi,
+boards with full Infix support for all enabled features including
-and SFP interfaces.
+Ethernet, WiFi, and SFP interfaces.
+
+Both boards share the same SoC and most peripherals.  The key
+differences are:
+
+| Feature         | BPI-R3             | BPI-R3 Mini             |
+|-----------------|--------------------|-------------------------|
+| Ethernet switch | Yes (4x LAN + WAN) | No (WAN/LAN ports only) |
+| SD card slot    | Yes                | No                      |
 
 ### Hardware Features
 
 - MediaTek MT7986 ARM Cortex-A53 quad-core processor @ 2.0 GHz
 - 2 GB DDR4 RAM
-- 8 GB eMMC storage + microSD card slot
+- 8 GB eMMC storage
-- 5x Gigabit Ethernet ports (4x LAN, 1x WAN)
+- microSD card slot (BPI-R3 only)
-- 2x SFP cages for fiber connectivity (1G/2.5G)
+- 5x Gigabit Ethernet ports with switch core (BPI-R3 only)
+- 2x SFP cages for fiber connectivity (1G/2.5G) (BPI-R3 only)
 - Dual-band WiFi (2.4 GHz + 5 GHz)
 - USB 3.0 port
 - Mini PCIe slot
@@ -23,16 +32,20 @@ and SFP interfaces.
 
 Infix comes preconfigured with:
 
-- **LAN ports** (lan1-lan4): Bridged for internal networking
+- **LAN ports** (lan1-lan4): Bridged for internal networking (BPI-R3 only)
 - **WAN port**: DHCP client enabled for internet connectivity
-- **SFP ports** (sfp1, sfp2): Available for configuration
+- **SFP ports** (sfp1, sfp2): Available for configuration (BPI-R3 only)
 - **WiFi interfaces** (wifi0, wifi1): Available for configuration
 
 ## Getting Started
 
-### Quick Start with SD Card
+### BPI-R3: Quick Start with SD Card
 
-The easiest way to get started is using an SD card:
+The easiest way to get started with the BPI-R3 is using an SD card:
+
+> [!NOTE]
+> SD card boot works but we have observed stability issues. For production
+> use or long-term reliability, we recommend installing to eMMC (see below).
 
 1. **Download the SD card image:** [infix-bpi-r3-sdcard.img][2]
 2. **Flash the image to an SD card:** see [this guide][0]
@@ -45,6 +58,12 @@ The easiest way to get started is using an SD card:
    - Connect to LAN port or console (115200 8N1)
    - Default login: `admin` / `admin`
 
+### BPI-R3 Mini: Getting Started
+
+The BPI-R3 Mini does not have an SD card slot, so you must install
+directly to eMMC.  See [Installing to eMMC — BPI-R3
+Mini](#bpi-r3-mini) below.
+
 ### Boot Switch Reference
 
 The BPI-R3 has a 4-position DIP switch that controls boot media:
@@ -53,59 +72,49 @@ The BPI-R3 has a 4-position DIP switch that controls boot media:
 
 | Position | Mode        | Description                           |
 |----------|-------------|---------------------------------------|
-| 0000     | SD card     | Boot from microSD card (recommended)  |
+| 0000     | SD card     | Boot from microSD card                |
-| 0110     | eMMC        | Boot from internal eMMC storage       |
+| 0110     | eMMC        | Boot from internal eMMC (recommended) |
 | 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |
 
 > [!NOTE]
-> Switch position is read from left to right: "0" = OFF, "1" = ON.  
+> Switch position is read from left to right: "0" = OFF, "1" = ON.
 > When the DIP switch is in the "UP" position it is OFF(0).
 
-## Advanced: Installing to eMMC
+## Installing to eMMC
 
 For production deployments or better performance, you can install Infix
-to the internal eMMC storage. This is more complex but provides faster
+to the internal eMMC storage.
-boot times and eliminates the external SD card.
 
-### Why Use eMMC?
+> [!IMPORTANT]
-
+> While Infix boots on both SD card and eMMC on the BPI-R3, we have
-**Advantages:**
+> observed stability issues with SD cards on this platform. **eMMC is
-
+> recommended** for reliable operation.
-- Faster boot and better performance
-- No external SD card to manage
-- More robust for industrial/embedded deployments
-
-**Disadvantages:**
-
-- More complex installation process
-- Requires intermediate NAND boot step
-- Harder to recover from errors
 
 ### Prerequisites
 
 - FTDI USB-to-serial cable (3.3V) for console access
-- microSD card with Infix (for initial boot)
 - USB flash drive (FAT32 formatted)
+- microSD card with Infix, for initial boot (BPI-R3 only)
 - Downloaded files (see below)
 
 ### Required Files
 
 Download and place these files on a FAT32-formatted USB drive:
 
-1. **Intermediate NAND bootloader** (from Frank-W's U-Boot):
+1. **Infix eMMC image:**
-   - [bpi-r3_spim-nand_bl2.img][5] (BL2 loader)
-   - [bpi-r3_spim-nand_fip.bin][6] (FIP image)
-2. **Infix eMMC image:**
    - [infix-bpi-r3-emmc.img][3] (Complete system image)
-3. **eMMC bootloader** (extracted from):
+2. **eMMC bootloader** (extracted from):
    - [bpi-r3-emmc-boot-2025.01-latest.tar.gz][4]
    - Extract `bl2.img` from the tarball to your USB drive
+3. **Intermediate NAND bootloader** (BPI-R3 only, from Frank-W's U-Boot):
+   - [bpi-r3_spim-nand_bl2.img][5] (BL2 loader)
+   - [bpi-r3_spim-nand_fip.bin][6] (FIP image)
 
 > [!WARNING]
 > The following process involves multiple boot mode changes.  Take your
-> time verify each step carefully.
+> time and verify each step carefully.
 
-### Installation Steps
+### BPI-R3
 
 #### Step 1: Boot from SD card
 
@@ -167,13 +176,48 @@ mmc partconf 0 1 1 0
 
 Your BPI-R3 should now boot Infix from internal eMMC storage!
 
+### BPI-R3 Mini
+
+The BPI-R3 Mini does not have an SD card slot, so you have to go
+through the factory-installed Linux (OpenWRT) to flash the Infix
+bootloader and OS to eMMC.
+
+#### Step 1: Boot from NAND (factory default)
+
+<img src="r3mini_nandboot2.png" alt="BPI-R3 Mini NAND boot switch position" width=400>
+
+1. Ensure boot switches are set to NAND mode (factory default)
+2. Place `infix-bpi-r3-emmc.img` and `bl2.img` on a USB drive
+3. Power on and boot into Linux
+4. Mount the USB drive to `/mnt`
+
+#### Step 2: Flash Infix to eMMC
+
+From the Linux shell:
+
+```
+echo 0 > /proc/sys/kernel/printk
+dd if=/mnt/infix-bpi-r3-emmc.img of=/dev/mmcblk0
+echo 0 > /sys/block/mmcblk0boot0/force_ro
+dd if=/mnt/bl2.img of=/dev/mmcblk0boot0
+sync
+```
+
+#### Step 3: Boot from eMMC
+
+<img src="r3mini_emmcboot.png" alt="BPI-R3 Mini eMMC boot switch position" width=400>
+
+1. Power off the board
+2. Set boot switches to eMMC mode (see image above)
+3. Power on
+
 ## Troubleshooting
 
 ### Board won't boot
 
 - Verify boot switch positions (check twice!)
 - Ensure power supply provides adequate current (12V/2A recommended)
-- Try booting from SD card with switches at **0000**
+- Try booting from SD card with switches at **0000** (BPI-R3 only)
 
 ### Can't break into U-Boot
 
@@ -185,9 +229,9 @@ Your BPI-R3 should now boot Infix from internal eMMC storage!
 
 - Boot from NAND (**1010**) and verify eMMC image was written
 - Check USB drive contents - ensure all files are present
-- Re-run Step 5 (eMMC boot configuration)
+- Re-run the eMMC boot configuration step
 
-### Reverting to SD card
+### Reverting to SD card (BPI-R3 only)
 
 Simply set boot switches back to **0000** and boot from SD card. The
 eMMC installation does not affect SD card functionality.

board/aarch64/bananapi-bpi-r3/bananapi-bpi-r3.mk

@@ -6,9 +6,10 @@ define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_GPIO,y)
 	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+	$(call KCONFIG_SET_OPT,CONFIG_AIR_EN8811H_PHY,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
 	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)

board/aarch64/bananapi-bpi-r3/dts/Makefile

@@ -1 +1 @@
-dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb
+dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb mediatek/mt7986a-bananapi-bpi-r3-mini.dtb

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-emmc.dts

@@ -1,2 +1,4 @@
+#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
+
 #include "mt7986a-bananapi-bpi-r3.dtsi"
 #include "mt7986a-bananapi-bpi-r3-emmc.dtsi"

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-mini.dts

@@ -0,0 +1,12 @@
+#include <arm64/mediatek/mt7986a-bananapi-bpi-r3-mini.dts>
+
+#include "mt7986a-bananapi-bpi-r3.dtsi"
+#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"
+
+&phy0 {
+	compatible = "ethernet-phy-id03a2.a411";
+};
+&phy1 {
+	compatible = "ethernet-phy-id03a2.a411";
+};
+

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-mini.dtsi

@@ -0,0 +1,2 @@
+#include "mt7986a-bananapi-bpi-r3.dtsi"
+#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-sd.dts

@@ -1,2 +1,4 @@
+#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
+
 #include "mt7986a-bananapi-bpi-r3.dtsi"
 #include "mt7986a-bananapi-bpi-r3-sd.dtsi"

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3.dtsi

@@ -1,5 +1,3 @@
-#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
-
 / {
 	chosen {
 		infix {

board/aarch64/bananapi-bpi-r3/genimage.cfg.in

@@ -51,6 +51,11 @@ image #INFIX_ID##VERSION#-bpi-r3-#TARGET#.img {
                 size = 4096s
         }
 
+	partition en8811h_fw {
+		size = 10M
+		image = "en8811h-fw.bin"
+	}
+
         partition aux {
                 partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
                 image = "aux.ext4"

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg

@@ -17,7 +17,25 @@
         "state": {
           "admin-state": "unlocked"
         }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+	  "band": "2.4GHz",
+	  "channel": "auto"
+	 }
+     },
+     {
+	"name": "radio1",
+	"class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+          "band": "5GHz",
+          "channel": "auto"
       }
+    }
     ]
   },
   "ietf-interfaces:interfaces": {
@@ -102,54 +120,115 @@
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {"id": "ntp-server"},
+              {
-              {"id": "broadcast"},
+                "id": "ntp-server"
-              {"id": "domain"},
+              },
-              {"id": "hostname"},
+              {
-              {"id": "dns-server"},
+                "id": "broadcast"
-              {"id": "router"},
+              },
-              {"id": "netmask"},
+              {
-              {"id": "vendor-class", "value": "Banana Pi BPI-R3"}
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R3"
+              }
             ]
           }
         },
         "ietf-ip:ipv6": {
           "infix-dhcpv6-client:dhcp": {
             "option": [
-              {"id": "ntp-server"},
+              {
-              {"id": "client-fqdn"},
+                "id": "ntp-server"
-              {"id": "domain-search"},
+              },
-              {"id": "dns-server"}
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
             ]
           }
         }
       },
       {
-        "name": "wifi0",
+        "name": "wifi0-ap",
-        "type": "infix-if-type:wifi"
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+	"infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
       },
       {
-        "name": "wifi1",
+        "name": "wifi1-ap",
-        "type": "infix-if-type:wifi"
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio1",
+          "access-point": {
+            "ssid": "Infix5Ghz",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+       "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
       }
     ]
   },
   "ietf-keystore:keystore": {
-        "asymmetric-keys": {
+    "asymmetric-keys": {
-            "asymmetric-key": [
+      "asymmetric-key": [
-                {
+        {
-                    "name": "genkey",
+          "name": "genkey",
-                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-                    "public-key": "",
+          "public-key": "",
-                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-                    "cleartext-private-key": "",
+          "cleartext-private-key": "",
-                    "certificates": {}
+          "certificates": {}
-                }
-            ]
         }
+      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
+    }
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -157,6 +236,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -176,6 +263,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -183,11 +301,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
+            "name": "deny-password-access",
-            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }
@@ -201,7 +333,11 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -293,7 +429,7 @@
     "policy": [
       {
         "name": "lan-to-wan",
-	"action": "accept",
+        "action": "accept",
         "ingress": [
           "lan"
         ],
@@ -305,7 +441,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.6"
+    "version": "1.7"
   },
   "infix-services:mdns": {
     "enabled": true
@@ -341,4 +477,3 @@
     }
   }
 }
-

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/product/init.d/S01-trigger-udev.sh

@@ -1,3 +0,0 @@
-#!/bin/sh
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/product/interface-quirks.json

@@ -0,0 +1,11 @@
+{
+    "sfp1": {
+	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
+	"broken-autoneg": true
+    },
+    "sfp2": {
+	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
+	"broken-autoneg": true
+    }
+
+}

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3mini/etc/factory-config.cfg

@@ -0,0 +1,445 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "class": "infix-hardware:usb",
+        "name": "USB2",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+	  "band": "2.4GHz",
+	  "channel": "auto"
+	 }
+     },
+     {
+	"name": "radio1",
+	"class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+          "band": "5GHz",
+          "channel": "auto"
+      }
+    }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R3"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+	"infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "wifi1-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio1",
+          "access-point": {
+            "ssid": "Infix5Ghz",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+       "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3mini/etc/udev/rules.d/90-bpi-r3-mini-rename-ethernet.rules

@@ -0,0 +1,2 @@
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth0", NAME="lan"
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth1", NAME="wan"

board/aarch64/bananapi-bpi-r3/uboot/extras.config

@@ -3,6 +3,9 @@ CONFIG_BOOTDELAY=2
 # CONFIG_MMC_PCI is not set
 CONFIG_ENV_IS_NOWHERE=y
 # CONFIG_ENV_IS_IN_MMC is not set
+CONFIG_MULTI_DTB_FIT=y
+CONFIG_OF_LIST="mt7986a-bpi-r3-sd mt7986a-bpi-r3-emmc mt7986a-bpi-r3-mini"
+
 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_MTK=y
@@ -26,8 +29,17 @@ CONFIG_MTD_SPI_NAND=y
 CONFIG_MTK_SPIM=y
 CONFIG_MTK_SNOR=y
 
+CONFIG_DM_MDIO=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_PHY_ETHERNET_ID=y
+
+CONFIG_PHY_AIROHA=y
+CONFIG_PHY_AIROHA_EN8811H=y
+CONFIG_PHY_AIROHA_FW_IN_MMC=y
+
 CONFIG_CMD_SF=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_MTD=y
+CONFIG_CMD_MDIO=y
 CONFIG_CMD_MTDPARTS=y
 CONFIG_CMD_DM=y

board/aarch64/bananapi-bpi-r3/uboot/mt7986-env.dtsi

@@ -15,6 +15,10 @@
                        scriptaddr = "0x48000000";
                        ramdisk_addr_r = "0x4A000000";
 
+		en8811h_fw_part = "0#en8811h_fw";
+		en8811h_fw_dm_dir = "EthMD32.dm.bin";
+		en8811h_fw_dsp_dir = "EthMD32.DSP.bin";
+
                        /* This is a development platform, keep
                         * developer mode statically enabled.
                         */

board/aarch64/friendlyarm-nanopi-r2s/Config.in

@@ -4,6 +4,7 @@ config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
 	select SDCARD_AUX
 	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
+	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	help
 	  FriendlyElec NanoPi R2S is a compact router board based on
 	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.

board/aarch64/friendlyarm-nanopi-r2s/friendlyarm-nanopi-r2s.mk

@@ -4,6 +4,9 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
+	# TODO: for some reason this just locks up the device
+	#       so we'll have to rely on the softdog :-(
+	# $(call KCONFIG_ENABLE_OPT,CONFIG_DW_WATCHDOG)
 
 	# PHY drivers
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
@@ -51,6 +54,10 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)
 
+	# Input layer
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MISC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
+
 	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg

@@ -61,24 +61,49 @@
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {"id": "ntp-server"},
+              {
-              {"id": "broadcast"},
+                "id": "ntp-server"
-              {"id": "domain"},
+              },
-              {"id": "hostname"},
+              {
-              {"id": "dns-server"},
+                "id": "broadcast"
-              {"id": "router"},
+              },
-              {"id": "netmask"},
+              {
-              {"id": "vendor-class", "value": "NanoPi R2S"}
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "NanoPi R2S"
+              }
             ]
           }
         },
         "ietf-ip:ipv6": {
           "infix-dhcpv6-client:dhcp": {
             "option": [
-              {"id": "ntp-server"},
+              {
-              {"id": "client-fqdn"},
+                "id": "ntp-server"
-              {"id": "domain-search"},
+              },
-              {"id": "dns-server"}
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
             ]
           }
         }
@@ -86,21 +111,24 @@
     ]
   },
   "ietf-keystore:keystore": {
-        "asymmetric-keys": {
+    "asymmetric-keys": {
-            "asymmetric-key": [
+      "asymmetric-key": [
-                {
+        {
-                    "name": "genkey",
+          "name": "genkey",
-                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-                    "public-key": "",
+          "public-key": "",
-                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-                    "cleartext-private-key": "",
+          "cleartext-private-key": "",
-                    "certificates": {}
+          "certificates": {}
-                }
-            ]
         }
+      ]
+    }
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -108,6 +136,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -127,6 +163,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -134,11 +201,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
+            "name": "deny-password-access",
-            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }
@@ -152,7 +233,11 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -244,7 +329,7 @@
     "policy": [
       {
         "name": "lan-to-wan",
-	"action": "accept",
+        "action": "accept",
         "ingress": [
           "lan"
         ],
@@ -256,7 +341,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.6"
+    "version": "1.7"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/product/init.d/S01-trigger-udev.sh

@@ -1,3 +0,0 @@
-#!/bin/sh
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add

board/aarch64/linux_defconfig

@@ -39,7 +39,6 @@ CONFIG_ARM64_ERRATUM_1286807=y
 CONFIG_ARM64_ERRATUM_1542419=y
 CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
-CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
 CONFIG_COMPAT=y
 # CONFIG_SUSPEND is not set
@@ -52,7 +51,6 @@ CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_ARMADA_8K_CPUFREQ=y
 CONFIG_ACPI=y
 CONFIG_KPROBES=y
-CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -79,7 +77,6 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -95,12 +92,31 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -109,15 +125,23 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
+CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -134,29 +158,69 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_IPMAC=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -244,6 +308,7 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
+CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -407,10 +472,10 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_GPIO_WATCHDOG=y
+CONFIG_ARM_SBSA_WATCHDOG=y
 CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_MAX77620=y
-CONFIG_MFD_SEC_CORE=y
 CONFIG_MFD_ROHM_BD718XX=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -419,7 +484,6 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_MAX77620=y
 CONFIG_REGULATOR_PCA9450=y
 CONFIG_REGULATOR_QCOM_SPMI=y
-CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_A4TECH is not set
 # CONFIG_HID_APPLE is not set
@@ -429,11 +493,11 @@ CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_CYPRESS is not set
 # CONFIG_HID_EZKEY is not set
 # CONFIG_HID_KENSINGTON is not set
-# CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
 CONFIG_USB_ULPI_BUS=y
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
@@ -451,7 +515,6 @@ CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
 CONFIG_USB_HSIC_USB3503=m
-CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_SNP_UDC_PLAT=y
@@ -485,7 +548,6 @@ CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
 CONFIG_RTC_DRV_PCF8523=y
-CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
 CONFIG_RTC_DRV_PL031=y
@@ -500,7 +562,6 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 # CONFIG_SURFACE_PLATFORMS is not set
 CONFIG_COMMON_CLK_CS2000_CP=y
-CONFIG_COMMON_CLK_S2MPS11=y
 CONFIG_COMMON_CLK_XGENE=y
 CONFIG_COMMON_CLK_BD718XX=y
 CONFIG_MAILBOX=y
@@ -517,7 +578,8 @@ CONFIG_PHY_SAMSUNG_USB2=y
 CONFIG_NVMEM_LAYOUT_ONIE_TLV=y
 CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -536,16 +598,17 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
-CONFIG_CRYPTO_SHA1_ARM64_CE=y
-CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
@@ -557,8 +620,13 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_DETECT_HUNG_TASK=y
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-# CONFIG_SCHED_DEBUG is not set
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_WQ_WATCHDOG=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
+CONFIG_TEST_LOCKUP=m
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
 # CONFIG_STRICT_DEVMEM is not set

board/aarch64/raspberrypi-rpi64/Config.in

@@ -5,7 +5,7 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
-
+	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
 	  of single-board computers (SBC), RPi 3B and later, including the

board/aarch64/raspberrypi-rpi64/README.md

@@ -107,8 +107,10 @@ To configure WiFi as a client, first store your WiFi password in the keystore:
 ```
 admin@infix:/> configure
 admin@infix:/config/> edit keystore symmetric-key mywifi
-admin@infix:/config/keystore/…/mywifi/> set key-format wifi-preshared-key-format
+admin@infix:/config/keystore/…/mywifi/> set key-format passphrase-key-format
-admin@infix:/config/keystore/…/mywifi/> set cleartext-key YourWiFiPassword
+admin@infix:/config/keystore/…/mywifi/> change cleartext-symmetric-key
+Passphrase: ************
+Retype passphrase: ************
 admin@infix:/config/keystore/…/mywifi/> leave
 ```
 

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg

@@ -10,6 +10,13 @@
         "state": {
           "admin-state": "unlocked"
         }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "00"
+        }
       }
     ]
   },
@@ -38,24 +45,45 @@
       {
         "name": "eth0",
         "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {"id": "netmask"},
+              {
-              {"id": "broadcast"},
+                "id": "netmask"
-              {"id": "router"},
+              },
-              {"id": "domain"},
+              {
-              {"id": "hostname"},
+                "id": "broadcast"
-              {"id": "dns-server"},
+              },
-              {"id": "ntp-server"},
+              {
-              {"id": "vendor-class", "value": "Raspberry Pi 4 Model B"}
+                "id": "router"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Raspberry Pi 4 Model B"
+              }
             ]
           }
         }
       },
       {
         "name": "wifi0",
-        "type": "infix-if-type:wifi"
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0"
+        }
       }
     ]
   },
@@ -75,6 +103,9 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -82,6 +113,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -101,6 +140,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -108,11 +178,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
+            "name": "deny-password-access",
-            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }
@@ -126,7 +210,11 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -172,7 +260,7 @@
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
   "infix-meta:meta": {
-    "version": "1.6"
+    "version": "1.7"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/raspberrypi-rpi64/uboot/rpi-env.dtso

@@ -12,6 +12,15 @@
 			boot_targets = "mmc0";
 			ethprime = "eth0";
 
+			/* Memory layout for kernel boot:
+			 *   0x00200000: Kernel relocation address
+			 *   0x04000000: FDT (64MB, gives enough space for kernels up to ~60MB)
+			 *   0x10000000: Ramdisk (Memsize - 256MB)
+			 */
+			kernel_addr_r = "0x00200000";
+			fdt_addr_r = "0x04000000";
+			ramdisk_addr_r = "0x10000000";
+
 			stdout = "serial";
 			stderr = "serial";
 			stdin = "serial";

board/aarch64/rootfs/usr/sbin/wan-monitor.sh

@@ -20,6 +20,7 @@ cleanup()
 {
     rm -f "$LED_FILE"
     rm -f "$PID_FILE"
+    kill %% 2>/dev/null
     exit 0
 }
 
@@ -31,11 +32,13 @@ remaining_time=$((1800 - $(awk '{print int($1)}' /proc/uptime)))
 
 while [ "$remaining_time" -gt 0 ]; do
     check_wan
-    sleep 1
+    sleep 1 &
+    wait $!
     remaining_time=$((remaining_time - 1))
 done
 
 while :; do
     check_wan
-    sleep 5
+    sleep 5 &
+    wait $!
 done

board/aarch64/rootfs/usr/share/product/marvell,armada-ap807/etc/support.d/50-marvell-cn913x.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -e
+
+ecc_stat()
+{
+    local chan=
+    local base=
+
+    for chan in 0 1; do
+        base=$((0xf0020360 + 0x200 * chan))
+
+        echo "DRAM Channel $chan ECC Status"
+        echo -n "  Log config: "; devmem $((base + 0x0)) 32
+        echo -n "  1b errors:  "; devmem $((base + 0x4)) 32
+        echo -n "  Info 0:     "; devmem $((base + 0x8)) 32
+        echo -n "  Info 1:     "; devmem $((base + 0xc)) 32
+        echo
+    done
+}
+
+[ -n "$1" ] || { echo "usage: $0 OUT-DIR"; exit 1; }
+work="$1"/marvell-cn913x
+mkdir -p "${work}"
+
+ecc_stat >"${work}"/ecc-stat

board/aarch64/styx-dcp-sc-28p/dts/styx/dcp-sc-28p-a.dts

@@ -59,3 +59,9 @@
 		XSWP(a, "e13", 13, &sfp0);
 	};
 };
+
+&cp0_spi1 {
+	spi-flash@0 {
+		broken-flash-reset;
+	};
+};

board/arm/Config.in

@@ -0,0 +1,6 @@
+if BR2_arm
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/arm/microchip-sama7g54-ek/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/arm/raspberrypi-rpi2/Config.in"
+
+endif

board/arm/README.md

@@ -1,5 +1,5 @@
-aarch32
+Arm 32-bit
-=======
+==========
 
 Board Specific Documentation
 ----------------------------

board/arm/board.mk

@@ -0,0 +1 @@
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/arm/*/*.mk))

board/arm/linux_defconfig

@@ -31,14 +31,11 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
-CONFIG_KEXEC=y
 CONFIG_ARCH_MULTI_V6=y
-CONFIG_ARCH_MULTI_V7=y
 CONFIG_ARCH_VIRT=y
 CONFIG_ARCH_BCM=y
 CONFIG_ARCH_BCM2835=y
 CONFIG_SMP=y
-CONFIG_NR_CPUS=4
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
@@ -47,7 +44,6 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPUFREQ_DT=y
 CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
-CONFIG_AEABI=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -78,7 +74,6 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -94,12 +89,31 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -108,15 +122,22 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -133,29 +154,58 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_IPMAC=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_MATCH_SRH=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
-CONFIG_IP6_NF_NAT=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -194,16 +244,16 @@ CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_PKTGEN=y
-# CONFIG_WIRELESS is not set
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
-CONFIG_PCI_AARDVARK=y
 CONFIG_PCI_HOST_GENERIC=y
-CONFIG_PCIE_ARMADA_8K=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -221,7 +271,6 @@ CONFIG_BLK_DEV_NVME=y
 CONFIG_SRAM=y
 CONFIG_EEPROM_AT24=y
 # CONFIG_SCSI_PROC_FS is not set
-CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_SAS_LIBSAS=y
 CONFIG_SCSI_SAS_ATA=y
@@ -230,7 +279,6 @@ CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
-CONFIG_AHCI_MVEBU=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
@@ -258,8 +306,6 @@ CONFIG_SMSC911X=y
 CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
 CONFIG_USB_NET_SMSC95XX=y
-CONFIG_BRCMFMAC=m
-CONFIG_ZD1211RW=m
 CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
 CONFIG_INPUT_TOUCHSCREEN=y
@@ -273,22 +319,19 @@ CONFIG_SERIAL_8250_BCM2835AUX=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
-CONFIG_TTY_PRINTK=y
-CONFIG_HVC_DRIVER=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
 CONFIG_SPI_BCM2835=y
 CONFIG_SPI_BCM2835AUX=y
-CONFIG_GPIO_SYSFS=y
 CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
 CONFIG_BCM2711_THERMAL=y
 CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
-CONFIG_BCM2835_WDT=y
 CONFIG_I6300ESB_WDT=y
+CONFIG_BCM2835_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -296,12 +339,12 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
 CONFIG_DRM=y
 CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_SIMPLEDRM=y
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_TOSHIBA_TC358762=m
 CONFIG_DRM_V3D=m
 CONFIG_DRM_VC4=m
 CONFIG_DRM_VC4_HDMI_CEC=y
-CONFIG_DRM_SIMPLEDRM=y
 CONFIG_FB=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_SOUND=y
@@ -310,6 +353,7 @@ CONFIG_SND_SOC=y
 CONFIG_SND_BCM2835_SOC_I2S=y
 CONFIG_HID_GENERIC=m
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC2=y
@@ -343,7 +387,6 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_STAGING=y
 CONFIG_SND_BCM2835=m
-CONFIG_VIDEO_BCM2835=m
 CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
@@ -352,7 +395,8 @@ CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -371,13 +415,13 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
 CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_CCM=y
 CONFIG_CRYPTO_GCM=y
-# CONFIG_XZ_DEC_ARM is not set
-# CONFIG_XZ_DEC_ARMTHUMB is not set
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
@@ -387,9 +431,13 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_DETECT_HUNG_TASK=y
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-# CONFIG_SCHED_DEBUG is not set
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_WQ_WATCHDOG=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
+CONFIG_TEST_LOCKUP=m
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
-# CONFIG_STRICT_DEVMEM is not set
 CONFIG_MEMTEST=y

board/arm/microchip-sama7g54-ek/Config.in

@@ -0,0 +1,7 @@
+config BR2_PACKAGE_MICROCHIP_SAMA7G54_EK
+	bool "Microchip SAMA7G54-EK Evaluation Kit"
+	depends on BR2_arm
+	select SDCARD_AUX
+	help
+	  Support for the Microchip SAMA7G54 Evaluation Kit featuring
+	  a Cortex-A7 processor with MACB Gigabit Ethernet and MMC storage.

board/arm/microchip-sama7g54-ek/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2026 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

board/arm/microchip-sama7g54-ek/README.md

@@ -0,0 +1,116 @@
+Microchip SAMA7G54-EK
+=====================
+
+The [SAMA7G54-EK][1] is an evaluation kit for the Microchip SAMA7G5 series,
+featuring an ARM Cortex-A7 processor @ 800 MHz with 512 MB DDR3L RAM.
+
+The board features:
+
+- 2x MACB Gigabit Ethernet ports
+- 8 GB eMMC (SDMMC0) + microSD card slot (SDMMC1)
+- QSPI NOR flash
+- USB 2.0 host ports
+- CAN bus interfaces
+- Flexcom serial ports (UART, SPI, I2C)
+
+How to Build
+------------
+
+Since there are no pre-built images for ARM 32-bit, you need to build
+both Infix and the bootloader from source.
+
+### SD Card
+
+1. Build the bootloader
+
+        make O=x-boot-sama7g54 sama7g54_ek_sd_boot_defconfig
+        make O=x-boot-sama7g54
+
+2. Build Infix
+
+        make O=x-arm arm_defconfig
+        make O=x-arm
+
+3. Create the SD card image
+
+        ./utils/mkimage.sh -b x-boot-sama7g54 -r x-arm microchip-sama7g54-ek
+
+### eMMC
+
+1. Build the bootloader
+
+        make O=x-boot-sama7g54-emmc sama7g54_ek_emmc_boot_defconfig
+        make O=x-boot-sama7g54-emmc
+
+2. Build Infix (same as above, skip if already built)
+
+        make O=x-arm arm_defconfig
+        make O=x-arm
+
+3. Create the eMMC image
+
+        ./utils/mkimage.sh -b x-boot-sama7g54-emmc -r x-arm -t emmc microchip-sama7g54-ek
+
+Flashing to SD Card
+-------------------
+
+[Flash the image][0] to a microSD card (at least 2 GB):
+
+```bash
+sudo dd if=x-boot-sama7g54/images/infix-arm-sdcard.img of=/dev/sdX \
+        bs=1M status=progress oflag=direct
+```
+
+You can also use `bmaptool` for faster writes:
+
+```bash
+sudo bmaptool copy x-boot-sama7g54/images/infix-arm-sdcard.img /dev/sdX
+```
+
+> [!WARNING]
+> Ensure `/dev/sdX` is the correct device for your SD card and not used
+> by the host system!  Use `lsblk` to verify.
+
+Flashing to eMMC
+-----------------
+
+The SAMA7G5EK has an on-board 8 GB eMMC (SDMMC0/mmc0).  Jumper J22
+controls if booting from onboard storage is allowed or not; open means
+allowed.  When open, the SW4 button can also prevent booting from eMMC
+if held at power on.
+
+The easiest method is to flash from a running SD card system:
+
+1. Boot the board from SD card
+2. Transfer the eMMC image to the board (USB drive, network, etc.)
+3. Flash the eMMC:
+
+        sudo bmaptool copy emmc.img /dev/mmcblk0
+
+4. Power off, remove SD card, and boot from eMMC
+
+Booting the Board
+-----------------
+
+1. Insert the flashed SD card (or ensure eMMC is flashed)
+2. Connect an Ethernet cable
+3. Power up the board
+4. Find the assigned IP and SSH in, default login: `admin` / `admin`
+
+Console Port
+------------
+
+The debug console is on Flexcom3 (active by default):
+
+- Baud rate: 115200
+- Data bits: 8
+- Parity: None
+- Stop bits: 1
+
+Connect a USB-to-serial adapter to the board's debug UART header.
+
+> [!WARNING]
+> Use only 3.3V serial adapters.
+
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.microchip.com/en-us/development-tool/EV21H18A

board/arm/microchip-sama7g54-ek/dts/Makefile

@@ -0,0 +1 @@
+dtb-y += microchip/at91-sama7g5ek.dtb

board/arm/microchip-sama7g54-ek/dts/microchip/at91-sama7g5ek.dts

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Infix OS device tree for Microchip SAMA7G5 Evaluation Kit
+ */
+
+#include <arm/microchip/at91-sama7g5ek.dts>
+#include "infix.dtsi"
+
+/ {
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+};
+
+/* Thermal sensor disabled until OTP is calibrated */
+&thermal_sensor {
+	status = "disabled";
+};

board/arm/microchip-sama7g54-ek/genimage.cfg.in

@@ -0,0 +1,85 @@
+# Disk image for Microchip SAMA7G5EK (sama7g5 evaluation kit)
+
+image boot.vfat {
+	vfat {
+		files = {
+			"boot.bin",
+			"u-boot.bin"
+		}
+	}
+
+	size = 16M
+}
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
+	ext4 {
+		label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
+image var.ext4 {
+	empty = true
+	temporary = true
+	size = 128M
+
+	ext4 {
+		label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+image #INFIX_ID##VERSION#-sama7g54-ek-#TARGET#.img {
+	hdimage {
+		partition-table-type = "hybrid"
+	}
+
+	partition boot {
+		partition-type = 0xC
+		bootable = "true"
+		image = "boot.vfat"
+		offset = 1M
+	}
+
+	partition aux {
+		partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 250M
+		image = "rootfs.squashfs"
+	}
+
+	partition secondary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 250M
+		image = "rootfs.squashfs"
+	}
+
+	partition cfg {
+		partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+		image = "var.ext4"
+	}
+}
+
+# Silence genimage warnings
+config {}

board/arm/microchip-sama7g54-ek/microchip-sama7g54-ek.mk

@@ -0,0 +1,69 @@
+# Microchip SAMA7G54-EK kernel configuration fixups
+define MICROCHIP_SAMA7G54_EK_LINUX_CONFIG_FIXUPS
+	# AT91/Microchip SoC
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_AT91)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SOC_SAMA7G5)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ATMEL_CLOCKSOURCE_TCB)
+
+	# Serial console (FLEXCOM)
+	# Use ttyAT naming to avoid major/minor conflict with the
+	# 8250 driver (needed by Raspberry Pi 2 in the shared ARM config)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_ATMEL)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_ATMEL_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_ATMEL_TTYAT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MFD_ATMEL_FLEXCOM)
+
+	# Network: MACB Ethernet
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MICROCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MACB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MICREL_PHY)
+
+	# MMC/SD
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_PLTFM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_OF_AT91)
+
+	# Pin control and GPIO
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_AT91)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_AT91PIO4)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_SYSFS)
+
+	# I2C and SPI
+	$(call KCONFIG_ENABLE_OPT,CONFIG_I2C_AT91)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SPI_ATMEL)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SPI_ATMEL_QUADSPI)
+
+	# Power management and reset
+	$(call KCONFIG_ENABLE_OPT,CONFIG_POWER_RESET)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_POWER_RESET_AT91_RESET)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_POWER_RESET_AT91_SAMA5D2_SHDWC)
+
+	# Watchdog
+	$(call KCONFIG_ENABLE_OPT,CONFIG_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SAMA5D4_WATCHDOG)
+
+	# DMA and RTC
+	$(call KCONFIG_ENABLE_OPT,CONFIG_AT_XDMAC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_CLASS)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_DRV_AT91SAM9)
+
+	# Crypto hardware acceleration
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CRYPTO_DEV_ATMEL_AES)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CRYPTO_DEV_ATMEL_TDES)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CRYPTO_DEV_ATMEL_SHA)
+
+	# USB Host
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_HCD)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_OHCI_HCD)
+
+	# Regulators
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR_FIXED_VOLTAGE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR_MCP16502)
+
+	# NVMEM for OTP
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NVMEM_MICROCHIP_OTPC)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))

board/arm/microchip-sama7g54-ek/rootfs/etc/rauc/system.conf

@@ -0,0 +1,12 @@
+[system]
+compatible=infix-sama7g54-ek
+bootloader=uboot
+statusfile=/mnt/aux/rauc.status
+
+[slot.rootfs.0]
+device=/dev/disk/by-partlabel/primary
+bootname=primary
+
+[slot.rootfs.1]
+device=/dev/disk/by-partlabel/secondary
+bootname=secondary

board/arm/microchip-sama7g54-ek/rootfs/usr/share/product/microchip,sama7g5ek/etc/product/interface-quirks.json

@@ -0,0 +1,5 @@
+{
+    "@ethtool:driver=macb": {
+        "broken-flow-control": true
+    }
+}

board/arm/microchip-sama7g54-ek/uboot/emmc-extras.config

@@ -0,0 +1 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi sama7g54-ek-env-emmc.dtsi"

board/arm/microchip-sama7g54-ek/uboot/extras.config

@@ -0,0 +1,13 @@
+# Common U-Boot extras for SAMA7G54-EK
+CONFIG_EFI_PARTITION=y
+CONFIG_ENV_IMPORT_FDT=y
+CONFIG_FIT=y
+CONFIG_FIT_SIGNATURE=y
+CONFIG_RSA=y
+CONFIG_RSA_VERIFY=y
+CONFIG_BLKMAP=y
+CONFIG_LZ4=y
+CONFIG_LZMA=y
+CONFIG_CMD_UNLZ4=y
+CONFIG_CMD_UNZIP=y
+CONFIG_CMD_IMI=y

board/arm/microchip-sama7g54-ek/uboot/sama7g54-ek-env-emmc.dtsi

@@ -0,0 +1,19 @@
+/ {
+	config {
+		environment {
+			vendor = "Microchip";
+			bootcmd = "run ixboot";
+			boot_targets = "mmc0";
+			fdtfile = "microchip/at91-sama7g5ek.dtb";
+			fdt_addr_r = "0x62000000";
+			kernel_addr_r = "0x63000000";
+			scriptaddr = "0x68000000";
+			ramdisk_addr_r = "0x69000000";
+			ixbootdelay = "0.5";
+			bootdelay = "-2";
+			bootmenu_delay = "10";
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+			ixbtn-factory = "echo \"No button, use bootmenu\"";
+		};
+	};
+};

board/arm/microchip-sama7g54-ek/uboot/sama7g54-ek-env-sd.dtsi

@@ -0,0 +1,19 @@
+/ {
+	config {
+		environment {
+			vendor = "Microchip";
+			bootcmd = "run ixboot";
+			boot_targets = "mmc1";
+			fdtfile = "microchip/at91-sama7g5ek.dtb";
+			fdt_addr_r = "0x62000000";
+			kernel_addr_r = "0x63000000";
+			scriptaddr = "0x68000000";
+			ramdisk_addr_r = "0x69000000";
+			ixbootdelay = "0.5";
+			bootdelay = "-2";
+			bootmenu_delay = "10";
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+			ixbtn-factory = "echo \"No button, use bootmenu\"";
+		};
+	};
+};

board/arm/microchip-sama7g54-ek/uboot/sd-extras.config

@@ -0,0 +1 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi sama7g54-ek-env-sd.dtsi"

board/arm/raspberrypi-rpi2/Config.in

@@ -5,11 +5,10 @@ config BR2_PACKAGE_RASPBERRYPI_RPI2
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
-
 	help
 	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
 	  (SBC) with BCM2836 quad-core Cortex-A7 processor.
 
-	  This was the only Raspberry Pi model with the BCM2836 and the 2B
+	  This was the only Raspberry Pi model with the BCM2836 and the rare
-	  actually got a BCM2837 (Cortex-A53) underclocked an w/o wifi in
+	  RPi 2B board revision v1.2 actually got an underclocked BCM2837,
-	  the v1.2 board revision.
+	  which is the saem Cortex-A53 as the RPi3, but w/o wifi.

board/arm/raspberrypi-rpi2/README.md

@@ -21,9 +21,8 @@ The board features:
 How to Build
 ------------
 
-Since there are no pre-built images for ARM32, you need to build both Infix
+Since there are no pre-built images for ARM 32-bit, you need to build both
-and the bootloader from source.
+Infix and the bootloader from source.
-
 
 1. Clone the repository
 
@@ -37,12 +36,12 @@ and the bootloader from source.
 
 3. Build Infix (in another tree)
 
-        make O=x-arm32 aarch32_defconfig
+        make O=x-arm arm_defconfig
-        make O=x-arm32
+        make O=x-arm
 
 4. Create the SD card image
 
-        ./utils/mkimage.sh -b x-boot -r x-arm32 raspberrypi-rpi2
+        ./utils/mkimage.sh -b x-boot -r x-arm raspberrypi-rpi2
 
 The resulting image can be found in `x-boot/images/infix-arm-sdcard.img`
 

board/arm/raspberrypi-rpi2/dts/broadcom/infix.dtsi

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Common Infix OS defaults
+ */
+
+/ {
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+	};
+};

board/arm/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg

@@ -41,14 +41,31 @@
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {"id": "netmask"},
+              {
-              {"id": "broadcast"},
+                "id": "netmask"
-              {"id": "router"},
+              },
-              {"id": "domain"},
+              {
-              {"id": "hostname"},
+                "id": "broadcast"
-              {"id": "dns-server"},
+              },
-              {"id": "ntp-server"},
+              {
-              {"id": "vendor-class", "value": "Raspberry Pi 2 Model B"}
+                "id": "router"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Raspberry Pi 2 Model B"
+              }
             ]
           }
         }
@@ -71,6 +88,9 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -78,6 +98,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -97,6 +125,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -104,11 +163,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
+            "name": "deny-password-access",
-            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }
@@ -122,7 +195,11 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -168,7 +245,7 @@
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
   "infix-meta:meta": {
-    "version": "1.6"
+    "version": "1.7"
   },
   "infix-services:mdns": {
     "enabled": true

board/arm/rootfs/boot/syslinux/syslinux.conf

@@ -0,0 +1,4 @@
+label Infix (arm)
+	kernel /boot/zImage
+	fdtdir /boot
+	append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}

board/common/Config.in

@@ -1,11 +1,21 @@
+
 menu "Images"
 
+comment "DDI Based"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ddi/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ddi-disk/Config.in"
+
+comment "ITB Based"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rootfs/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-qcow/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
+
+comment "General"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-barebox-esp/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-lvm-stub/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"
 
 endmenu

board/common/busybox_defconfig

@@ -1016,12 +1016,7 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
-CONFIG_UDHCPC6_DEFAULT_SCRIPT="/usr/share/udhcpc/default6.script"
+# CONFIG_UDHCPC6 is not set
-CONFIG_UDHCPC6=y
-CONFIG_FEATURE_UDHCPC6_RFC3646=y
-CONFIG_FEATURE_UDHCPC6_RFC4704=y
-CONFIG_FEATURE_UDHCPC6_RFC4833=y
-CONFIG_FEATURE_UDHCPC6_RFC5970=y
 
 #
 # Common options for DHCP applets

board/common/dracut.conf

@@ -0,0 +1,102 @@
+#Simple dracut config for a system without systemd
+
+#Dracut configuration
+
+show_modules=yes
+i18n_install_all=no
+lvmconf=no
+mdadmconf=no
+early_microcode=no
+hostonly=no
+hostonly_cmdline=no
+use_fstab=no
+kernel_cmdline="rd.break=initqueue"
+do_strip=no
+
+# Dracut modules needed
+add_dracutmodules+=" \
+busybox \
+"
+
+# Modules to ignore
+omit_dracutmodules+=" \
+base \
+bash \
+biosdevname \
+btrfs \
+bluetooth \
+caps \
+cifs \
+connman \
+crypt \
+crypt-gpg \
+dash \
+dbus-broker \
+dbus-daemon \
+dm \
+dmraid \
+dmsquash-live-ntfs \
+dracut-systemd \
+fcoe \
+fcoe-uefi \
+fs-lib \
+iscsi \
+i18n \
+kernel-modules \
+kernel-modules-extra \
+lvmmerge \
+lvm \
+lunmask \
+mdraid \
+memstrack \
+mksh \
+modsign \
+mount-root \
+multipath \
+nbd \
+network-legacy \
+network-wicked \
+nfs \
+nvdimm \
+nvmf \
+parse-lunmask \
+pcsc \
+qemu \
+qemu-net \
+resume \
+rootfs-block \
+rngd \
+shutdown \
+systemd \
+systemd-udevd \
+systemd-coredump \
+systemd-ask-password \
+systemd-timedated \
+systemd-rfkill \
+systemd-resolved \
+systemd-hostnamed \
+systemd-initrd \
+systemd-integritysetup \
+systemd-journald \
+systemd-ldconfig \
+systemd-networkd \
+systemd-timesyncd \
+systemd-veritysetup \
+systemd-modules-load \
+systemd-pcrphase \
+systemd-portabled \
+systemd-pstore \
+systemd-sysctl \
+systemd-repart \
+systemd-sysext \
+systemd-sysusers \
+systemd-tmpfiles \
+squash \
+ssh-client \
+stratis \
+tpm2-tss \
+udev-rules \
+url-lib \
+usrmount \
+virtiofs \
+"

board/common/image/image-barebox-esp/Config.in

@@ -0,0 +1,6 @@
+config IMAGE_BAREBOX_ESP
+	bool "Barebox EFI System Partition"
+	depends on BR2_TARGET_BAREBOX
+	default y if IMAGE_DDI
+	help
+	  An EFI System Partition (ESP) with Barebox installed.

board/common/image/image-barebox-esp/generate.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+
+set -e
+
+case "$BR2_ARCH" in
+    x86_64)
+	BOOT_EFI=BOOTX64.EFI
+	;;
+    *)
+	echo "Unknown EFI boot path for $BR2_ARCH" >&2
+	exit 1
+	;;
+esac
+
+mkdir -p "${WORKDIR}"/root
+rm -rf   "${WORKDIR}"/tmp
+mkdir -p "${WORKDIR}"/tmp
+
+cat <<EOF >"${WORKDIR}"/genimage.cfg
+image barebox-esp.vfat {
+	size = "16M"
+	vfat {
+		file EFI/BOOT/$BOOT_EFI {
+			image = $BINARIES_DIR/barebox.efi
+		}
+	}
+}
+
+# Silence genimage warnings
+config {}
+EOF
+
+genimage \
+    --tmppath    "${WORKDIR}"/tmp  \
+    --rootpath   "${WORKDIR}"/root \
+    --inputpath  "${WORKDIR}"      \
+    --outputpath "${BINARIES_DIR}" \
+    --config "${WORKDIR}"/genimage.cfg

board/common/image/image-barebox-esp/image-barebox-esp.mk

@@ -0,0 +1,7 @@
+################################################################################
+#
+# image-barebox-esp
+#
+################################################################################
+
+$(eval $(ix-image))

board/common/image/image-ddi-disk/Config.in

@@ -0,0 +1,8 @@
+menuconfig IMAGE_DDI_DISK
+	bool "LVM2 based provisioning disk (DDI)"
+	depends on IMAGE_BAREBOX_ESP
+	depends on IMAGE_DDI
+	help
+	  Compose a full disk image consisting of an EFI System
+	  Partition (ESP) containing Barebox, and an LVM PV in which
+	  Infix is installed as an LV.

board/common/image/image-ddi-disk/generate.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+
+set -e
+
+
+mkdir -p "${WORKDIR}"/root
+rm -rf   "${WORKDIR}"/tmp
+mkdir -p "${WORKDIR}"/tmp
+
+"${BR2_EXTERNAL_INFIX_PATH}"/utils/lvm-mkinternal \
+	"${BINARIES_DIR}"/"${ARTIFACT}".raw >"${WORKDIR}"/internal.lvm
+
+cat <<EOF >"${WORKDIR}"/genimage.cfg
+
+image ${ARTIFACT}.disk {
+	hdimage {
+		partition-table-type = "gpt"
+	}
+
+	partition esp {
+		partition-type-uuid = "esp"
+		image = "$BINARIES_DIR/barebox-esp.vfat"
+	}
+
+	partition esp-backup {
+		partition-type-uuid = "esp"
+		image = "$BINARIES_DIR/barebox-esp.vfat"
+	}
+
+	partition internal {
+		growfs = "true"
+		partition-type-uuid = "lvm"
+		image = "internal.lvm"
+	}
+}
+
+# Silence genimage warnings
+config {}
+EOF
+
+genimage \
+    --tmppath    "${WORKDIR}"/tmp  \
+    --rootpath   "${WORKDIR}"/root \
+    --inputpath  "${WORKDIR}"      \
+    --outputpath "${BINARIES_DIR}" \
+    --config "${WORKDIR}"/genimage.cfg