Merge pull request #1068 from kernelkit/raspberry-pi

Raspberry pi

.github/workflows/build.yml

@@ -1,30 +1,51 @@
-name: Bob the Builder
+name: Build
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches:
-      - main
   workflow_dispatch:
     inputs:
-      minimal:
-        description: 'Build minimal defconfigs'
+      flavor:
+        description: 'Optional build flavor (e.g. _minimal)'
         required: false
-        default: true
-        type: boolean
-      parallell:
+        default: ''
+        type: string
+      parallel:
         description: 'Massive parallel build of each image'
         required: false
         default: true
         type: boolean
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        required: false
+        default: kernelkit/infix
+        type: string
+
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      flavor:
+        required: false
+        type: string
+        default: ''
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+
+env:
+  FLV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.flavor || inputs.flavor }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+
 jobs:
   build:
-    name: Build Infix ${{ matrix.target }}
+    name: Build ${{ inputs.name }} ${{ inputs.target }}
     runs-on: [ self-hosted, latest ]
     strategy:
-      matrix:
-        target: [aarch64, x86_64]
       fail-fast: false
     outputs:
       build_id: ${{ steps.vars.outputs.INFIX_BUILD_ID }}
@@ -36,8 +57,11 @@ jobs:
           rm -rf ./.??* || true
           ls -la ./
 
-      - uses: actions/checkout@v4
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
         with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ github.ref }}
           clean: true
           fetch-depth: 0
           submodules: recursive
@@ -55,26 +79,13 @@ jobs:
                   "${{ github.event.number }}" "${{ github.event.pull_request.head.sha }}" \
                   | tee -a $GITHUB_OUTPUT $GITHUB_ENV
           fi
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-              if [ "${{ github.event.inputs.minimal }}" == "true" ]; then
-                  flavor="_minimal"
-              fi
-          else
-              # Ensure 'release' job get the proper image when building main
-              if [ "$GITHUB_REF_NAME" != "main" ]; then
-                  flavor="_minimal"
-              else
-                  flavor=""
-              fi
-              if ${{ contains(github.event.pull_request.labels.*.name, 'ci:main') }}; then
-                  flavor=""
-              fi
-          fi
-          target=${{ matrix.target }}
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-          echo "flv=$flavor"              >> $GITHUB_OUTPUT
-          echo "Building target ${target}${flavor}_defconfig"
+
+          target=${{ inputs.target }}
+          name=${{ inputs.name }}
+          echo "dir=${name}-${target}"        >> $GITHUB_OUTPUT
+          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
+          echo "flv=$FLV"              >> $GITHUB_OUTPUT
+          echo "Building target ${target}${FLV}_defconfig"
 
       - name: Restore Cache of dl/
         uses: actions/cache@v4
@@ -88,16 +99,16 @@ jobs:
         uses: actions/cache@v4
         with:
           path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ inputs.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
           restore-keys: |
-            ccache-${{ matrix.target }}-
+            ccache-${{ inputs.target }}-
             ccache-
 
-      - name: Configure ${{ matrix.target }}${{ steps.vars.outputs.flv }}
+      - name: Configure ${{ inputs.target }}${{ steps.vars.outputs.flv }}
         run: |
-          make ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig
+          make ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig
 
-      - name: Unit Test ${{ matrix.target }}
+      - name: Unit Test ${{ inputs.target }}
         run: |
           make test-unit
 
@@ -115,9 +126,9 @@ jobs:
           fi
           echo "MAKE=$MAKE" >> $GITHUB_OUTPUT
 
-      - name: Build ${{ matrix.target }}${{ steps.vars.outputs.flv }}
+      - name: Build ${{ inputs.target }}${{ steps.vars.outputs.flv }}
         run: |
-          echo "Building ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
+          echo "Building ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
           eval "${{ steps.parallel.outputs.MAKE }}"
 
       - name:  Check SBOM from Build
@@ -139,7 +150,7 @@ jobs:
           printf "Size of output/images/: "
           ls -l output/images/
 
-      - name: Prepare ${{ matrix.target }} Artifact
+      - name: Prepare ${{ inputs.target }} Artifact
         run: |
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
@@ -149,111 +160,4 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           path: output/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ matrix.target }}
-
-  test:
-    name: Regression Test of Infix x86_64
-    needs: build
-    runs-on: [ self-hosted, regression ]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          clean: true
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
-              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
-                   >>$GITHUB_ENV
-          fi
-
-          if [ "$GITHUB_REF_NAME" != "main" ]; then
-              flavor="_minimal"
-          else
-              flavor=""
-          fi
-          echo "flv=$flavor"              >> $GITHUB_OUTPUT
-
-      - name: Configure x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          make x86_64${{ steps.vars.outputs.flv }}_defconfig
-
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
-        run: |
-          ls -l
-          mkdir -p output
-          mv infix-x86_64.tar.gz output/
-          cd output/
-          tar xf infix-x86_64.tar.gz
-          ln -s infix-x86_64 images
-
-      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          make test
-
-      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: cat test/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: |
-          asciidoctor-pdf \
-          --theme test/9pm/report/theme.yml \
-          -a pdf-fontsdir=test/9pm/report/fonts \
-          test/.log/last/report.adoc \
-          -o test/.log/last/report.pdf
-
-      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-report
-          path: test/.log/last/report.pdf
-
-  release:
-    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
-    name: Upload Latest Build
-    needs: test
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
-      - uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Latest Build Complete! :rocket:
-
-          For the public download links of these build artifacts, please see:
-           <https://github.com/kernelkit/infix/releases/tag/latest>
-          EOF
+          name: artifact-${{ inputs.target }}

.github/workflows/publish.yml

@@ -0,0 +1,43 @@
+name: Publish latest Infix
+
+on:
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  publish:
+    name: Upload Latest Build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          omitName: true
+          omitBody: true
+          omitBodyDuringUpdate: true
+          prerelease: true
+          tag: "latest"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          artifacts: "*.tar.gz*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Latest Build Complete! :rocket:
+
+          For the public download links of these build artifacts, please see:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+          EOF

.github/workflows/test.yml

@@ -0,0 +1,116 @@
+name: Test Infix
+
+on:
+  workflow_dispatch:
+    inputs:
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        required: false
+        default: kernelkit/infix
+        type: string
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      flavor:
+        required: false
+        type: string
+        default: ''
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+      ninepm-conf:
+        required: false
+        type: string
+        default: ''
+      test-path:
+        required: false
+        type: string
+        default: 'test'
+
+env:
+  FLV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.flavor || inputs.flavor }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
+  TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}
+
+jobs:
+  test:
+    name: Regression Test ${{ inputs.name }} ${{ inputs.target }}
+    runs-on: [ self-hosted, regression ]
+    steps:
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ github.ref }}
+          clean: true
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set Build Variables
+        id: vars
+        run: |
+          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
+              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
+                   >>$GITHUB_ENV
+          fi
+
+          echo "flv=$FLV" >> $GITHUB_OUTPUT
+
+      - name: Configure ${{ inputs.target }}${{ steps.vars.outputs.flv }}
+        run: |
+          make ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
+        run: |
+          target=${{ inputs.target }}
+          name=${{ inputs.name }}
+
+          ls -l
+          mkdir -p output
+          mv ${name}-${target}.tar.gz output/
+          cd output/
+          tar xf ${name}-${target}.tar.gz
+          ln -s ${name}-${target} images
+
+      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          if [ -n "$NINEPM_CONF" ]; then
+            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
+            echo "DEBUG: NINEPM_PROJ_CONFIG is '$NINEPM_PROJ_CONFIG'"
+          fi
+          make test
+
+      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+
+      - name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: |
+          asciidoctor-pdf \
+          --theme $TEST_PATH/9pm/report/theme.yml \
+          -a pdf-fontsdir=$TEST_PATH/9pm/report/fonts \
+          $TEST_PATH/.log/last/report.adoc \
+          -o $TEST_PATH/.log/last/report.pdf
+
+      - name: Upload Test Report as Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-report
+          path: ${{ env.TEST_PATH }}/.log/last/report.pdf
+

.github/workflows/trigger.yml

@@ -0,0 +1,37 @@
+name: Self Trigger
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches:
+      - main
+      - ci-workflow-redesign
+  workflow_dispatch:
+
+jobs:
+  build-x86_64:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: "x86_64"
+      name: "infix"
+      flavor: "_minimal"
+
+  build-aarch64:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: "aarch64"
+      name: "infix"
+      flavor: "_minimal"
+
+  test-run-x86_64:
+    needs: build-x86_64
+    uses: ./.github/workflows/test.yml
+    with:
+      target: "x86_64"
+      name: "infix"
+
+  test-publish-x86_64:
+    needs: test-run-x86_64
+    uses: ./.github/workflows/publish.yml
+

board/aarch64/rpi/bcm2711-rpi-4-b-dts.patch

@@ -1,14 +0,0 @@
---- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts	2025-04-28 00:13:06.880003668 +0200
-+++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts	2025-04-28 00:14:17.708941263 +0200
-@@ -14,6 +14,11 @@
- 	chosen {
- 		/* 8250 auxiliary UART instead of pl011 */
- 		stdout-path = "serial1:115200n8";
-+
-+		infix {
-+			/* Default admin user password: 'admin' */
-+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
-+		};
- 	};
- 
- 	cam1_reg: regulator-cam1 {

board/aarch64/rpi/rootfs/boot/syslinux/syslinux.conf

@@ -1,16 +0,0 @@
-default rpi4b
-menu title Boot Menu
-prompt 1
-timeout 30
-
-label rpi4b
-        menu label Infix on Raspberry Pi 4B
-	kernel /boot/Image
-	devicetree /boot/broadcom/bcm2711-rpi-4-b.dtb
-	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}
-
-label rpi400
-	menu label Infix on Raspberry Pi 400
-	kernel /boot/Image
-	devicetree /boot/broadcom/bcm2711-rpi-400.dtb
-	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}

board/aarch64/rpi/rootfs/etc/watchdogd.conf

@@ -1,6 +0,0 @@
-# Broadcom BCM2835 Watchdog timer
-device /dev/watchdog0 {
-    timeout    = 60
-    interval   = 5
-    safe-exit  = true
-}

board/common/post-build.sh

@@ -114,6 +114,12 @@ grep -qsE '^/bin/true$$' "$TARGET_DIR/etc/shells" \
 grep -qsE '^/bin/false$$' "$TARGET_DIR/etc/shells" \
         || echo "/bin/false" >> "$TARGET_DIR/etc/shells"
 
+boards=$(${BR2_EXTERNAL_INFIX_PATH}/board/common/selected-boards.sh ${BR2_EXTERNAL_INFIX_PATH} ${O})
+
+for board in $boards; do
+	[ ! -f "${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh" ] && continue
+	${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh
+done
 # Allow clish (symlink to /usr/bin/klish) to be a login shell
 grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
         || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"

board/common/post-image.sh

@@ -108,3 +108,11 @@ rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
 
 # Quick intro for beginners, with links to more information
 cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"
+
+boards=$(${BR2_EXTERNAL_INFIX_PATH}/board/common/selected-boards.sh ${BR2_EXTERNAL_INFIX_PATH} ${O})
+for board in $boards; do
+	[ ! -f "${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-image.sh" ] && continue
+	RELEASE=$(ver)
+	export INFIX_ID RELEASE
+	${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-image.sh
+done

board/common/rootfs/etc/watchdogd.conf

@@ -0,0 +1,165 @@
+# /etc/watchdogd.conf sample
+# Commented out values are program defaults.
+#
+# The checker/monitor `warning` and `critical` levels are 0.00-1.00,
+# i.e. 0-100%, except for load average which can vary a lot between
+# systems and use-cases, not just because of the number of CPU cores.
+# Use the `script = ...` setting to call script when `warning` and
+# `critical` are reached for a monitor.  In `critical` the monitor
+# otherwise triggers an unconditional reboot.
+#
+# NOTE: `critical` is optional, omitting it disables the reboot action.
+#
+
+### Watchdogs ##########################################################
+# Global settings that can be overridden per watchdog
+
+# Do not set WDT timeout and kick interval too low, the daemon runs at
+# SCHED_OTHER level with all other tasks, unless the process supervisor
+# is enabled.  The monitor plugins (below) need CPU time as well.
+#timeout   = 20
+#interval  = 10
+
+# With safe-exit enabled (true) the daemon will ask the driver disable
+# the WDT before exiting (SIGINT).  However, some WDT drivers (or HW)
+# may not support this.
+#safe-exit = true
+
+# Multiple watchdogs can be kicked, the default, even if no .conf file
+# is found or device node given on the command line, is /dev/watchdog
+device /dev/watchdog {
+    timeout    = 60
+    interval   = 5
+    safe-exit  = true
+}
+
+#device /dev/watchdog2 {
+#    timeout    = 20
+#    interval   = 10
+#    safe-exit  = true
+#}
+
+### Supervisor #########################################################
+# Instrumented processes can have their main loop supervised.  Processes
+# subscribe to this service using the libwdog API, see the docs for more
+# on this.  When the supervisor is enabled and the priority is set to a
+# value > 0, watchdogd runs as a SCHED_RR process with elevated realtime
+# priority.  When disabled, or the priority is set to zero (0), it runs
+# as a regular SCHED_OTHER process, this is the default.
+#
+# When a supervised process fails to meet its deadline, the daemon will
+# perform an unconditional reset having saved the reset reason.  If a
+# script is provided in this section it will be called instead.  The
+# script is called as:
+#
+#    script.sh supervisor CODE PID LABEL
+#
+# Availabel CODEs for the reset reason are avilable in wdog.h
+#
+#supervisor {
+#    !!!REMEMBER TO ENABLE reset-reason (below) AS WELL!!!
+#    enabled  = true
+#    priority = 98
+#    script = "/path/to/supervisor-script.sh"
+#}
+
+### Reset reason #######################################################
+# The following section controls if/how the reset reason & reset counter
+# is tracked.  By default this is disabled, since not all systems allow
+# writing to disk, e.g. embedded systems using MTD devices with limited
+# number of write cycles.
+#
+# The default file setting is a non-volatile path, according to the FHS.
+# It can be changed to another location, but make sure that location is
+# writable first.
+reset-reason {
+    enabled = true
+    file    = "/var/lib/misc/watchdogd.state"
+}
+
+### Checkers/Monitors ##################################################
+#
+# Script or command to run instead of reboot when a monitor plugin
+# reaches any of its critical or warning level.  Setting this will
+# disable the built-in reboot on critical, it is therefore up to the
+# script to perform reboot, if needed.  The script is called as:
+#
+#    script.sh {filenr, fsmon, loadavg, meminfo} {crit, warn} VALUE
+#
+#script = "/path/to/reboot-action.sh"
+
+# Monitors file descriptor leaks based on /proc/sys/fs/file-nr
+filenr {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 0.9
+    critical = 1.0
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
+# Monitors a file system, blocks and inode usage against watermarks
+# The script is called with fsmon as the first argument and there
+# are two environment variables FSMON_NAME, for the monitored path,
+# and FSMON_TYPE indicating either 'blocks' or 'inodes'.
+#fsmon /var {
+#    enabled = true
+#    interval = 300
+#    logmark  = false
+#    warning  = 0.95
+#    critical = 1.0
+#    script = "/path/to/alt-reboot-action.sh"
+#}
+
+# Monitors load average based on sysinfo() from /proc/loadavg
+# The level is composed from the average of the 1 and 5 min marks.
+loadavg {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 1.0
+    critical = 2.0
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
+# Monitors free RAM based on data from /proc/meminfo
+meminfo {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 0.9
+    critical = 0.95
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
+# Monitor temperature.  The critical value is unset by default, so no
+# action is taken at that watermark (by default).  Both the critical and
+# warning watermarks are relative to the trip/critical/max value from
+# sysfs.  The warning is default 0.9, i.e., 90% of critical.  Use script
+# to to reset the fan controller or poweroff(8) the system.
+#
+# Each temp monitor caches the last 10 values, calculates the mean, and
+# compares that to the warning and critical levels.  Logging is only
+# done every 10 x interval (if enabled).
+#tempmon /sys/class/hwmon/hwmon0/temp1_input {
+#    enabled  = true
+#    interval = 30
+#    warning  = 0.9
+#    critical = 0.95
+#    logmark  = true
+#    script   = "/script/to/log/and/poweroff.sh"
+#}
+
+# Monitor a generic script, executes 'monitor-script' every 'interval'
+# seconds, with a max runtime of 'timeout' seconds.  When the exit code
+# of the monitor script is above the critical level watchdogd either
+# starts the reboot, or calls the alternate 'script' to determin the
+# next cause of action.
+#generic /path/to/monitor-script.sh {
+#    enabled = true
+#    interval = 300
+#    timeout = 60
+#    warning  = 1
+#    critical = 10
+#    script = "/path/to/alt-reboot-action.sh"
+#}

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -308,16 +308,52 @@ def probe_qemusystem(out):
     subprocess.run("initctl -nbq cond set qemu".split(), check=False)
     return 0
 
+def rasberry_pi_4_usb_ports(out):
+    out["usb-ports"] = [
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized_default"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-1/authorized",
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-0:1.0/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized_default"
+        },
+        {
+            "name": "USB3",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/2-0:1.0/authorized"
+        }
+    ]
 
 def probe_dtsystem(out):
     """Probe DTS based system, expects a VPD in ONIE PROM format."""
     dtsys = DTSystem()
     vpds = dtsys.infix_vpds()
-    dtsys.infix_usb_devices(out)
+
     model = dtsys.base.str("model")
     if model:
         out["product-name"] = model
 
+    # Since rpi4 has USB on PCIe, there is no phandle reference
+    if model and model.startswith("Raspberry Pi 4"):
+        rasberry_pi_4_usb_ports(out)
+    else:
+        dtsys.infix_usb_devices(out)
     out["compatible"] = dtsys.base.str_array("compatible")
 
     staticpw = dtsys.infix.str("factory-password-hash")

board/common/selected-boards.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+#
+# Check if an infix board is selected
+
+if [ $# -ne 2 ]; then
+	echo "usage: $0 <INFIX-DIR> <OUTPUT>"
+	exit 1
+fi
+ROOT=$1
+O=$2
+BOARD_SRC_DIR="${ROOT}/src/board"
+BOARD_PACKAGE_DIR="${ROOT}/package/board"
+CONFIG_FILE="${O}/.config"
+
+is_board_enabled() {
+    local symbol=$1
+
+    if [ -f "$CONFIG_FILE" ]; then
+        if grep -q "^${symbol}=y" "$CONFIG_FILE" 2>/dev/null; then
+            return 0  # enabled
+        else
+            return 1  # disabled or not set
+        fi
+    else
+        echo "Warning: No .config file found. Run 'make menuconfig' first."
+        return 1
+    fi
+}
+
+get_actual_config_symbol() {
+    local board_name=$1
+    local config_file="${BOARD_PACKAGE_DIR}/$board_name/Config.in"
+
+    if [ -f "$config_file" ]; then
+        # Extract the first config symbol from the Config.in file
+        local symbol=$(grep -m1 "^config " "$config_file" 2>/dev/null | awk '{print $2}')
+        if [ -n "$symbol" ]; then
+            echo "$symbol"
+            return 0
+        fi
+    fi
+
+    # Fallback to predicted symbol if no Config.in found
+    echo "BR2_PACKAGE_BOARD_$(echo "$board_name" | tr '[:lower:]' '[:upper:]' | tr '-' '_')"
+    return 1
+}
+
+boards=""
+
+for board_path in "$BOARD_SRC_DIR"/*; do
+    if [ -d "$board_path" ]; then
+        board_name=$(basename "$board_path")
+        config_symbol=$(get_actual_config_symbol "$board_name")
+
+        if is_board_enabled "$config_symbol"; then
+	    boards="$boards $board_name"
+        fi
+    fi
+done
+
+echo "$boards"

configs/aarch64_defconfig

@@ -134,6 +134,7 @@ BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
+BR2_PACKAGE_RASPBERRY_PI_4=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y

configs/rpi4_defconfig

@@ -1,201 +0,0 @@
-BR2_aarch64=y
-BR2_cortex_a72=y
-BR2_ARM_FPU_VFPV4=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
-BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
-BR2_GLOBAL_PATCH_DIR="board/raspberrypi/patches ${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_TARGET_GENERIC_HOSTNAME="infix"
-BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
-BR2_INIT_FINIT=y
-BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
-BR2_SYSTEM_BIN_SH_BASH=y
-BR2_TARGET_GENERIC_GETTY_PORT="@console"
-BR2_TARGET_GENERIC_GETTY_TERM="xterm"
-BR2_SYSTEM_DHCP="eth0"
-BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
-BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
-BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
-BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-image.sh"
-BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
-BR2_LINUX_KERNEL_PATCH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711-rpi-4-b-dts.patch"
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711_defconfig"
-BR2_LINUX_KERNEL_DTS_SUPPORT=y
-BR2_LINUX_KERNEL_INTREE_DTS_NAME="broadcom/bcm2711-rpi-4-b broadcom/bcm2711-rpi-400"
-BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
-BR2_LINUX_KERNEL_INSTALL_TARGET=y
-BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
-BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
-BR2_PACKAGE_XZ=y
-BR2_PACKAGE_STRACE=y
-BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_JQ=y
-BR2_PACKAGE_E2FSPROGS=y
-BR2_PACKAGE_ARMBIAN_FIRMWARE=y
-BR2_PACKAGE_ARMBIAN_FIRMWARE_AP6255=y
-BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI=y
-BR2_PACKAGE_LINUX_FIRMWARE=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XXX=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366B1=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366C0=y
-BR2_PACKAGE_RPI_FIRMWARE=y
-BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4=y
-BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4_X=y
-BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/config.txt"
-BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/cmdline.txt"
-BR2_PACKAGE_DBUS_CXX=y
-BR2_PACKAGE_DBUS_GLIB=y
-BR2_PACKAGE_DBUS_TRIGGERD=y
-BR2_PACKAGE_EUDEV_RULES_GEN=y
-# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_EVEMU=y
-BR2_PACKAGE_EVTEST=y
-BR2_PACKAGE_GPTFDISK=y
-BR2_PACKAGE_GPTFDISK_SGDISK=y
-BR2_PACKAGE_INPUT_EVENT_DAEMON=y
-BR2_PACKAGE_MDIO_TOOLS=y
-BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
-BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
-BR2_PACKAGE_LIBSSH_OPENSSL=y
-BR2_PACKAGE_LIBSSH2=y
-BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBOPENSSL_BIN=y
-BR2_PACKAGE_LIBINPUT=y
-BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_NETOPEER2_CLI=y
-BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_LINUX_PAM=y
-BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
-BR2_PACKAGE_ONIGURUMA=y
-BR2_PACKAGE_AVAHI_DAEMON=y
-BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
-BR2_PACKAGE_CHRONY=y
-BR2_PACKAGE_CONNTRACK_TOOLS=y
-BR2_PACKAGE_DNSMASQ=y
-BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FRR=y
-BR2_PACKAGE_HOSTAPD=y
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPROUTE2=y
-BR2_PACKAGE_IPTABLES_NFTABLES=y
-BR2_PACKAGE_IPUTILS=y
-BR2_PACKAGE_IW=y
-BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
-BR2_PACKAGE_NETCALC=y
-BR2_PACKAGE_NETCAT_OPENBSD=y
-BR2_PACKAGE_NETSNMP=y
-BR2_PACKAGE_NFTABLES=y
-BR2_PACKAGE_NGINX=y
-BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_NMAP=y
-BR2_PACKAGE_NMAP_NCAT=y
-BR2_PACKAGE_NMAP_NMAP=y
-BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_OPENRESOLV=y
-BR2_PACKAGE_OPENSSH=y
-BR2_PACKAGE_SOCAT=y
-BR2_PACKAGE_TCPDUMP=y
-BR2_PACKAGE_TRACEROUTE=y
-BR2_PACKAGE_ULOGD=y
-BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIRELESS_REGDB=y
-BR2_PACKAGE_WIRELESS_TOOLS=y
-BR2_PACKAGE_WPA_SUPPLICANT=y
-BR2_PACKAGE_BASH_COMPLETION=y
-BR2_PACKAGE_SUDO=y
-BR2_PACKAGE_TTYD=y
-BR2_PACKAGE_GETENT=y
-BR2_PACKAGE_HTOP=y
-BR2_PACKAGE_IRQBALANCE=y
-BR2_PACKAGE_KMOD_TOOLS=y
-BR2_PACKAGE_PWGEN=y
-BR2_PACKAGE_RAUC=y
-BR2_PACKAGE_RAUC_DBUS=y
-BR2_PACKAGE_RAUC_GPT=y
-BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
-BR2_PACKAGE_SYSKLOGD=y
-BR2_PACKAGE_SYSKLOGD_LOGGER=y
-BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_LESS=y
-BR2_PACKAGE_MG=y
-BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_arm64"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/extras.config"
-BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
-BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
-BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/rpi-env.dtso"
-BR2_PACKAGE_HOST_DOSFSTOOLS=y
-BR2_PACKAGE_HOST_E2FSPROGS=y
-BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
-BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_KMOD_XZ=y
-BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_IMAGE_ID="${INFIX_ID}-rpi4"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_CONFD=y
-BR2_PACKAGE_GENCERT=y
-BR2_PACKAGE_STATD=y
-BR2_PACKAGE_FACTORY=y
-BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
-BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
-BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
-BR2_PACKAGE_FINIT_PLUGIN_RTC=y
-BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
-BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
-BR2_PACKAGE_FINIT_PLUGIN_TTY=y
-BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_IITO=y
-BR2_PACKAGE_KEYACK=y
-BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
-BR2_PACKAGE_LOWDOWN=y
-BR2_PACKAGE_MCD=y
-BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_NETBROWSE=y
-BR2_PACKAGE_PODMAN=y
-BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
-BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
-BR2_PACKAGE_PODMAN_DRIVER_VFS=y
-BR2_PACKAGE_SHOW=y
-BR2_PACKAGE_TETRIS=y
-BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
-SDCARD_AUX=y

doc/ChangeLog.md

@@ -3,6 +3,15 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
+[v25.07.0][UNRELEASED] -
+-------------------------
+
+### Changes
+- Raspberry Pi 4 is now a part of the aarch64 image, as well as a SDcard
+  image for initial deployments.
+
+
+### Fixes
 [v25.06.0][] - 2025-07-01
 -------------------------
 
@@ -1594,6 +1603,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
  - N/A
 
 [buildroot]:  https://buildroot.org/
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.06.1...HEAD
 [v25.06.0]:   https://github.com/kernelkit/infix/compare/v25.05.1...v26.06.0
 [v25.05.1]:   https://github.com/kernelkit/infix/compare/v25.05.0...v25.05.1
 [v25.05.0]:   https://github.com/kernelkit/infix/compare/v25.04.0...v25.05.0

doc/developers-guide.md

@@ -67,7 +67,8 @@ $ sudo apt install bc binutils build-essential bzip2 cpio \
                    diffutils file findutils git gzip      \
                    libncurses-dev libssl-dev perl patch   \
                    python3 rsync sed tar unzip wget       \
-                   autopoint bison flex autoconf automake
+                   autopoint bison flex autoconf automake \
+                   mtools
 ```
 
 > For details, see the Getting Started and System Requirements sections
@@ -168,36 +169,36 @@ Now you can rebuild `confd`, just as described above, and restart Infix:
 
 ### `statd`
 
-The Infix status daemon, `src/statd`, is responsible for populating the 
-sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions, 
-but unlike `confd`, it relies entirely on `yanger`, a Python script that 
+The Infix status daemon, `src/statd`, is responsible for populating the
+sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions,
+but unlike `confd`, it relies entirely on `yanger`, a Python script that
 gathers data from local linux services and feeds it into sysrepo.
 
 To apply changes, rebuild the image:
 
     make python-statd-rebuild statd-rebuild all
 
-Rebuilding the image and testing on target for every change during 
-development process can be tedious. Instead, `yanger` allows remote 
-execution, running the script directly on the host system (test 
+Rebuilding the image and testing on target for every change during
+development process can be tedious. Instead, `yanger` allows remote
+execution, running the script directly on the host system (test
 container):
 
     infamy0:test # ../src/statd/python/yanger/yanger -x "../utils/ixll -A ssh d3a" ieee802-dot1ab-lldp
 
 `ixll` is a utility script that lets you run network commands using an
-**interface name** instead of a hostname. It makes operations like 
+**interface name** instead of a hostname. It makes operations like
 `ssh`, `scp`, and network discovery easier.
 
-Normally, `yanger` runs commands **locally** to retrieve data 
-(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when 
-executed with `-x "../utils/ixll -A ssh d3a"` it redirects these 
-commands to a remote system connected to the local `d3a` interface via 
-SSH. This setup is used for running `yanger` in an 
+Normally, `yanger` runs commands **locally** to retrieve data
+(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when
+executed with `-x "../utils/ixll -A ssh d3a"` it redirects these
+commands to a remote system connected to the local `d3a` interface via
+SSH. This setup is used for running `yanger` in an
 [interactive test environment](testing.md#interactive-usage). The yanger
-script runs on the `host` system, but key commands are executed on the 
+script runs on the `host` system, but key commands are executed on the
 `target` system.
 
-For debugging or testing, you can capture system command output and 
+For debugging or testing, you can capture system command output and
 replay it later without needing a live system.
 
 To capture:
@@ -211,12 +212,173 @@ To replay:
 This is especially useful when working in isolated environments or debugging
 issues without direct access to the DUT.
 
+### Upgrading Packages
+
+#### Buildroot
+
+Kernelkit maintains an internal [fork of
+Buildroot](https://github.com/kernelkit/buildroot), with branches
+following the naming scheme `YYYY.MM.patch-kkit`
+e.g. `2025.02.1-kkit`, which means a new branch should be created
+whenever Buildroot is updated. These branches should contain **only**
+changes to existing packages (but no new patches), modifications to
+Buildroot itself or upstream backports.
+
+KernelKit track the latest Buildroot LTS (Long-Term Support) release
+and updates. The upgrade of LTS minor releases is expected to have low
+impact and should be done as soon there is a patch release of
+Buildroot LTS is available.
+
+> **Depending on your setup, follow the appropriate steps below.**
+
+🔁 If you **already have** the Buildroot repo locally
+
+1. Navigate to the Buildroot directory
+   ```bash
+    $ cd buildroot
+   ```
+2. Pull the latest changes from KernelKit
+   ```bash
+   $ git pull
+   ```
+3. Fetch the latest tags from upstream
+   ```bash
+   $ git fetch upstream --tags
+   ```
+
+
+🆕 If you don't have the repo locally
+
+1. Clone the Kernelkit Buildroot repository
+   ```bash
+   $ git clone git@github.com:kernelkit/buildroot.git
+   ```
+
+2. Add the upstream remote
+   ```bash
+   $ git remote add upstream https://gitlab.com/buildroot.org/buildroot.git
+   ```
+3. Checkout old KernelKit branch
+   ```bash
+   $ git checkout 2025.02.1-kkit
+   ```
+
+
+🛠  Continue from here (applies to both cases):
+
+4. Create a new branch based on the **previous** KernelKit Buildroot
+   release (e.g.  `2025.02.1-kkit`) and name it according to the naming scheme (e.g. `2025.02.2-kkit`)
+   ```bash
+   $ git checkout -b 2025.02.2-kkit
+   ```
+5. Rebase the new branch onto the corresponding upstream release
+   ```bash
+   $ git rebase 2025.02.2
+   ```
+> [!NOTE] It is **not** allowed to rebase the branch when bumped in Infix.
+
+6. Push the new branch and tags
+   ```bash
+   $ git push origin 2025.02.2-kkit --tags
+   ```
+7. In Infix, checkout new branch of Buildroot
+   ```bash
+   $ cd buildroot
+   $ git fetch
+   $ git checkout 2025.02.2-kkit
+   ```
+8. Push changes
+Commit and push the changes. Don’t forget to update the changelog.
+
+9. Create a pull request.
+
+> [!NOTE] Remember to set the pull request label to `ci:main` to ensure full CI coverage.
+
+
+#### Linux kernel
+
+KernelKit maintains an internal [fork of Linux
+kernel](https://github.com/kernelkit/linux), with branches following
+the naming scheme `kkit-linux-[version].y`, e.g. `kkit-6.12.y`, which
+means a new branch should be created whenever the major kernel version
+is updated. This branch should contain *all* kernel patches used by
+Infix.
+
+KernelKit track the latest Linux kernel LTS (Long-Term Support)
+release and updates. The upgrade of LTS minor releases is expected to
+have low impact and should be done as soon as a patch release of the
+LTS Linux kernel is available.
+
+
+🔁 If you **already have** the Linux kernel repo locally
+
+1. Navigate to the Linux kernel directory
+   ```bash
+   $ cd linux
+   ```
+2. Get latest changes from KernelKit
+   ```bash
+   $ git pull
+   ```
+3. Fetch the latest tags from upstream
+   ```bash
+   $ git fetch upstream --tags
+   ```
+
+🆕 If you don't have the repo locally
+
+1. Clone the KernelKit Linux kernel repository
+   ```bash
+   $ git clone git@github.com:kernelkit/linux.git
+	```
+2. Add the upstream remote
+   ```bash
+   $ git remote add upstream git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+   ```
+
+3. Checkout correct kernel branch
+   ```bash
+   $ git checkout kkit-linux-6.12.y
+   ```
+
+🛠  Continue from here (applies to both cases)
+
+
+4. Rebase on the upstream release
+   ```bash
+   $ git rebase v6.12.29
+   ```
+
+6. Push changes and the tags
+   ```bash
+
+   $ git push -f origin kkit-linux-6.12.y --tags
+   ```
+
+**Move to your infix directory**
+
+7. Generate patches
+   ```bash
+   $ make x86_64_defconfig
+   $ cd output
+   $ ../utils/kernel-refresh.sh -k /path/to/linux -o 6.12.28 -t v6.12.29
+   ```
+   > [!NOTE] See help of `kernel-refresh.sh` script for more information
+
+
+8. Push changes
+   Commit and push the changes. Don’t forget to update the s:changelog:doc/ChangeLog.md.
+
+9. Create a pull request.
+   > [!NOTE] Remember to set the pull request label to `ci:main` to ensure full CI coverage.
+
+
 ### Agree on YANG Model
 
 When making changes to the `confd` and `statd` services, you will often need to update
-the YANG models. If you are adding a new YANG module, it's best to follow the 
+the YANG models. If you are adding a new YANG module, it's best to follow the
 structure of an existing one. However, before making any changes, **always discuss
-them with the Infix core team**. This helps avoid issues later in development and 
+them with the Infix core team**. This helps avoid issues later in development and
 makes pull request reviews smoother.
 
 

package/board/Config.in

@@ -6,5 +6,6 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/board/marvell-cn9130-crb/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/marvell-espressobin/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/microchip-sparx5-pcb135/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/styx-dcp-sc-28p/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/board/raspberry-pi-4/Config.in"
 
 endmenu

package/board/raspberry-pi-4/Config.in

@@ -0,0 +1,41 @@
+config BR2_PACKAGE_RASPBERRY_PI_4
+	bool "Raspberry Pi 4"
+	depends on BR2_aarch64
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+
+	select BR2_PACKAGE_RPI_FIRMWARE
+	select BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4
+	select BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4_X
+	select SDCARD_AUX
+	select BR2_TARGET_UBOOT
+	select BR2_TARGET_UBOOT_FORMAT_CUSTOM
+	select BR2_TARGET_UBOOT_NEEDS_DTC
+	select BR2_TARGET_UBOOT_NEEDS_UBOOT_TOOLS
+	select BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG
+	help
+	  Raspberry pi 4
+
+# Don't redefine - just set conditional defaults
+if BR2_PACKAGE_RASPBERRY_PI_4
+
+config BR2_TARGET_UBOOT_BOARD_DEFCONFIG
+	default "rpi_arm64"
+
+config BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/uboot/extras.config"
+
+config BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME
+	default "arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
+
+config BR2_TARGET_UBOOT_CUSTOM_DTS_PATH
+	default "${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/uboot/rpi-env.dtso"
+
+config BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE
+	default "${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/config.txt"
+
+config BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE
+	default "${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/cmdline.txt"
+
+endif

package/board/raspberry-pi-4/raspberry-pi-4.mk

@@ -0,0 +1,46 @@
+define RASPBERRY_PI_4_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_V3D,m)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_VC4,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_VC4_HDMI_CEC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_LOAD_EDID_FIRMWARE)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_FBDEV_EMULATION)
+
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_TOUCHSCREEN)
+	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN,m)
+
+# RPI
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BRCMSTB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_MBOX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_BCM2835)
+	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_I2C_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_IPROC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2711_THERMAL)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_BCM2835AUX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCMGENET)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))

src/board/raspberry-pi-4/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2025 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

src/board/raspberry-pi-4/config.txt

@@ -12,6 +12,8 @@ kernel=u-boot.bin
 device_tree=bcm2711-rpi-4-b.dtb
 dtoverlay=rpi-env
 dtoverlay=infix-key
+dtoverlay=vc4-kms-v3d-pi4
+dtoverlay=vc4-kms-dsi-ili9881-7inch
 
 # To use an external initramfs file
 #initramfs rootfs.cpio.gz
@@ -20,11 +22,7 @@ dtoverlay=infix-key
 # If the text shown on the screen disappears off the edge, comment this out
 disable_overscan=1
 
-# How much memory in MB to assign to the GPU on Pi models having
-# 256, 512 or 1024 MB total memory
-gpu_mem_256=100
-gpu_mem_512=100
-gpu_mem_1024=100
+gpu_mem=256
 
 # Enable UART0 for serial console on ttyAMA0
 enable_uart=1

src/board/raspberry-pi-4/dts/Makefile

@@ -0,0 +1 @@
+dtb-y += broadcom/bcm2711-rpi-4-b.dtb

src/board/raspberry-pi-4/dts/broadcom/bcm2711-rpi-4-b.dts

@@ -0,0 +1,22 @@
+#include <arm64/broadcom/bcm2711-rpi-4-b.dts>
+
+/ {
+	framebuffer@3e402000 {
+		compatible = "simple-framebuffer";
+		reg = <0x3e402000 0x1000>;
+		width = <800>;
+		height = <480>;
+		stride = <1600>;
+		format = "r5g6b5";
+		status = "okay";
+	};
+	chosen {
+		/* 8250 auxiliary UART instead of pl011 */
+		stdout-path = "serial1:115200n8";
+
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+	};
+};

src/board/raspberry-pi-4/genimage.cfg.in

@@ -29,7 +29,7 @@ image var.ext4 {
 	}
 }
 
-image sdcard.img {
+image #INFIX_ID##VERSION#-rpi4-sdcard.img {
 	hdimage {
 		partition-table-type = "gpt"
 	}

src/board/raspberry-pi-4/post-image.sh

@@ -1,5 +1,6 @@
 #!/bin/sh
 set -e
+#. "$BR2_CONFIG" 2>/dev/null
 
 BOARD_DIR=$(dirname "$0")
 GENIMAGE_CFG="${BUILD_DIR}/genimage.cfg"
@@ -18,17 +19,22 @@ find "${BINARIES_DIR}" -type f -name '*.dtbo' -exec mv '{}' "${BINARIES_DIR}/rpi
 
 # Create FILES array for the genimage.cfg generation
 FILES=""
-for f in "${BINARIES_DIR}"/*.dtb "${BINARIES_DIR}"/rpi-firmware/*; do
+for f in "${BINARIES_DIR}"/rpi-firmware/*; do
     case "$f" in
         *~|*.bak) continue ;;
     esac
+    echo "${FILES}" | grep -q `basename $f` && continue # If already exist it has been added by us.
     FILES="${FILES}\t\t\t\"${f#"${BINARIES_DIR}/"}\",\n"
 done
 
+echo $FILES
 KERNEL=$(sed -n 's/^kernel=//p' "${BINARIES_DIR}/rpi-firmware/config.txt")
 FILES="${FILES}\t\t\t\"${KERNEL}\""
 
-sed "s|#BOOT_FILES#|${FILES}|" "${BOARD_DIR}/genimage.cfg.in" > "${GENIMAGE_CFG}"
+
+sed "s|#BOOT_FILES#|${FILES}|" "${BOARD_DIR}/genimage.cfg.in" | \
+sed "s|#VERSION#|${RELEASE}|"  | \
+sed "s|#INFIX_ID#|${INFIX_ID}|" > "${GENIMAGE_CFG}"
 
 ROOTPATH_TMP=$(mktemp -d)
 trap 'rm -rf \"$ROOTPATH_TMP\"' EXIT

src/board/raspberry-pi-4/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg

@@ -2,6 +2,17 @@
   "ieee802-dot1ab-lldp:lldp": {
     "infix-lldp:enabled": true
   },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
   "ietf-interfaces:interfaces": {
     "interface": [
       {
@@ -27,6 +38,10 @@
       {
         "name": "eth0",
         "type": "infix-if-type:ethernet"
+      },
+      {
+        "name": "wifi0",
+        "type": "infix-if-type:wifi"
       }
     ]
   },
@@ -35,9 +50,9 @@
       "asymmetric-key": [
         {
           "name": "genkey",
-          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
           "public-key": "",
-          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
           "cleartext-private-key": "",
           "certificates": {}
         }
@@ -79,7 +94,7 @@
         ],
         "rule": [
           {
-            "name":  "deny-password-read",
+            "name": "deny-password-read",
             "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
@@ -127,7 +142,7 @@
           "udp": {
             "address": "pool.ntp.org"
           },
-	  "iburst": true
+          "iburst": true
         }
       ]
     },
@@ -173,7 +188,7 @@
     ]
   },
   "infix-meta:meta": {
-    "infix-meta:version": "1.2"
+    "version": "1.5"
   },
   "infix-services:mdns": {
     "enabled": true
@@ -189,5 +204,23 @@
     "restconf": {
       "enabled": true
     }
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
   }
 }

src/board/raspberry-pi-4/rootfs/usr/share/product/raspberrypi,4-model-b/usr/libexec/confd/product/gen-interfaces

@@ -0,0 +1,6 @@
+cat <<EOF
+   {
+        "name": "wifi0",
+        "type": "infix-if-type:wifi",
+   }
+EOF

src/board/raspberry-pi-4/uboot/rpi-env.dtso

@@ -9,7 +9,7 @@
 			ixbootdelay = "0.5";
 			bootdelay = "-2";
 			bootmenu_delay = "10";
-			boot_targets = "mmc1";
+			boot_targets = "mmc0";
 			ethprime = "eth0";
 			bootcmd = "run ixboot";
 

src/confd/bin/gen-interfaces

@@ -97,6 +97,7 @@ filter_iface_ports()
     for phy in $ifaces; do
         found=""
         for port in $ports; do
+            [ -d "/sys/class/net/${port}/wireless" ] && continue
             if [ "$port" = "$phy" ]; then
                found=true
                break
@@ -147,7 +148,6 @@ ports=$(ip -d -j link show group port | jq -r '
 
 # Remaining external interfaces not classified as switch ports
 ifaces="$(filter_iface_ports "$phys_ifaces" "$ports")"
-
 cat <<EOF
 {
   "ietf-interfaces:interfaces": {
@@ -193,7 +193,7 @@ cat <<EOF
       }
 $(for iface in $ifaces; do gen_iface_json "$iface"; done)
 $(for iface in $ports;  do gen_iface_json "$iface" "$bridge"; done)
-    ]
+      ]
 EOF
 if [ "$dhcp" = "true" ] && [ -n "$bridge" ]; then
 cat <<EOF

test/case/ietf_interfaces/speed_duplex_copper/speed_duplex_copper.adoc

@@ -1,6 +1,10 @@
 === Interface Speed Duplex (Copper)
 ==== Description
-Verify that auto-negotiation results in expected speed/duplex mode.
+Verify that the interface operates at the expected speed/duplex in two scenarios:
+
+1. Fixed configuration – host and target are both manually set to a specific speed/duplex
+2. Auto-negotiation – host advertises selectable modes and the target negotiates
+ to the highest common speed/duplex.
 
 ==== Topology
 ifdef::topdoc[]
@@ -17,17 +21,17 @@ endif::topdoc[]
 ==== Test sequence
 . Set up topology and attach to target DUT
 . Enable target interface
-. Set fixed 10/full
-. Set fixed 10/half
-. Set fixed 100/full
-. Set fixed 100/half
+. Verify fixed 10/full
+. Verify fixed 10/half
+. Verify fixed 100/full
+. Verify fixed 100/half
 . Switch to auto-negotiation mode for target and host
-. Configure host to advertise 10/Full only
-. Configure host to advertise 10/Half only
-. Configure host to advertise 100/Full only
-. Configure host to advertise 100/Half only
-. Configure host to advertise 10/half + 10/full + 100/half
-. Configure host to advertise 10/half + 10/full + 100/half + 100/full + 1000/full
+. Verify auto-negotiation to 10/Full only
+. Verify auto-negotiation to 10/Half only
+. Verify auto-negotiation to 100/Full only
+. Verify auto-negotiation to 100/Half only
+. Verify auto-negotiation to 10/half + 10/full + 100/half
+. Verify auto-negotiation to 10/half + 10/full + 100/half + 100/full + 1000/full
 
 
 <<<

test/case/ietf_interfaces/speed_duplex_copper/test.py

@@ -2,7 +2,11 @@
 """
 Interface Speed Duplex (Copper)
 
-Verify that auto-negotiation results in expected speed/duplex mode.
+Verify that the interface operates at the expected speed/duplex in two scenarios:
+
+1. Fixed configuration – host and target are both manually set to a specific speed/duplex
+2. Auto-negotiation – host advertises selectable modes and the target negotiates
+ to the highest common speed/duplex.
 """
 
 import infamy
@@ -164,22 +168,22 @@ with infamy.Test() as test:
         ns.addip("10.0.0.1")
 
         # Fixed mode tests
-        with test.step("Set fixed 10/full"):
+        with test.step("Verify fixed 10/full"):
             set_host_speed_duplex(hdata, 10, "full")
             set_target_speed_duplex(target, tdata, 10, "full")
             verify_speed_duplex(target, ns, tdata, 10, "full")
 
-        with test.step("Set fixed 10/half"):
+        with test.step("Verify fixed 10/half"):
             set_host_speed_duplex(hdata, 10, "half")
             set_target_speed_duplex(target, tdata, 10, "half")
             verify_speed_duplex(target, ns, tdata, 10, "half")
 
-        with test.step("Set fixed 100/full"):
+        with test.step("Verify fixed 100/full"):
             set_host_speed_duplex(hdata, 100, "full")
             set_target_speed_duplex(target, tdata, 100, "full")
             verify_speed_duplex(target, ns, tdata, 100, "full")
 
-        with test.step("Set fixed 100/half"):
+        with test.step("Verify fixed 100/half"):
             set_host_speed_duplex(hdata, 100, "half")
             set_target_speed_duplex(target, tdata, 100, "half")
             verify_speed_duplex(target, ns, tdata, 100, "half")
@@ -189,27 +193,27 @@ with infamy.Test() as test:
             enable_host_autoneg(hdata)
             enable_target_autoneg(target, tdata)
 
-        with test.step("Configure host to advertise 10/Full only"):
+        with test.step("Verify auto-negotiation to 10/Full only"):
             advertise_host_modes(hdata, ["10full"])
             verify_speed_duplex(target, ns, tdata, 10, "full")
 
-        with test.step("Configure host to advertise 10/Half only"):
+        with test.step("Verify auto-negotiation to 10/Half only"):
             advertise_host_modes(hdata, ["10half"])
             verify_speed_duplex(target, ns, tdata, 10, "half")
 
-        with test.step("Configure host to advertise 100/Full only"):
+        with test.step("Verify auto-negotiation to 100/Full only"):
             advertise_host_modes(hdata, ["100full"])
             verify_speed_duplex(target, ns, tdata, 100, "full")
 
-        with test.step("Configure host to advertise 100/Half only"):
+        with test.step("Verify auto-negotiation to 100/Half only"):
             advertise_host_modes(hdata, ["100half"])
             verify_speed_duplex(target, ns, tdata, 100, "half")
 
-        with test.step("Configure host to advertise 10/half + 10/full + 100/half"):
+        with test.step("Verify auto-negotiation to 10/half + 10/full + 100/half"):
             advertise_host_modes(hdata, ["10half", "10full", "100half"])
             verify_speed_duplex(target, ns, tdata, 100, "half")
 
-        with test.step("Configure host to advertise 10/half + 10/full + 100/half + 100/full + 1000/full"):
+        with test.step("Verify auto-negotiation to 10/half + 10/full + 100/half + 100/full + 1000/full"):
             advertise_host_modes(hdata, ["10half", "10full", "100half", "100full", "1000full"])
             verify_speed_duplex(target, ns, tdata, 1000, "full")
 

test/case/infix_containers/container_host_commands/Readme.adoc

@@ -0,0 +1 @@
+container_host_commands.adoc

test/case/infix_containers/container_host_commands/container_host_commands.adoc

@@ -0,0 +1,29 @@
+=== Host Command Execution from Container
+==== Description
+This test verifies that a container running on Infix can execute commands
+that affect the host system. Specifically, it confirms that the container
+can change the hostname of the host.
+
+==== Topology
+ifdef::topdoc[]
+image::{topdoc}../../test/case/infix_containers/container_host_commands/topology.svg[Host Command Execution from Container topology]
+endif::topdoc[]
+ifndef::topdoc[]
+ifdef::testgroup[]
+image::container_host_commands/topology.svg[Host Command Execution from Container topology]
+endif::testgroup[]
+ifndef::testgroup[]
+image::topology.svg[Host Command Execution from Container topology]
+endif::testgroup[]
+endif::topdoc[]
+==== Test sequence
+. Set up topology and attach to target DUT
+. Set initial hostname
+. Verify initial hostname in operational
+. Include script in OCI image to modify host hostname
+. Verify container has started
+. Verify the new hostname set by the container
+
+
+<<<
+

test/case/infix_containers/container_host_commands/topology.svg

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+ "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+
+<!-- Title: 1x1 Pages: 1 -->
+<svg width="424pt" height="45pt"
+ viewBox="0.00 0.00 424.03 45.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 41)">
+<title>1x1</title>
+<polygon fill="white" stroke="transparent" points="-4,4 -4,-41 420.03,-41 420.03,4 -4,4"/>
+<!-- host -->
+<g id="node1" class="node">
+<title>host</title>
+<polygon fill="none" stroke="black" points="0,-0.5 0,-36.5 100,-36.5 100,-0.5 0,-0.5"/>
+<text text-anchor="middle" x="25" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">host</text>
+<polyline fill="none" stroke="black" points="50,-0.5 50,-36.5 "/>
+<text text-anchor="middle" x="75" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">mgmt</text>
+</g>
+<!-- target -->
+<g id="node2" class="node">
+<title>target</title>
+<polygon fill="none" stroke="black" points="300.03,-0.5 300.03,-36.5 416.03,-36.5 416.03,-0.5 300.03,-0.5"/>
+<text text-anchor="middle" x="325.03" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">mgmt</text>
+<polyline fill="none" stroke="black" points="350.03,-0.5 350.03,-36.5 "/>
+<text text-anchor="middle" x="383.03" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">target</text>
+</g>
+<!-- host&#45;&#45;target -->
+<g id="edge1" class="edge">
+<title>host:mgmt&#45;&#45;target:mgmt</title>
+<path fill="none" stroke="lightgray" stroke-width="2" d="M100,-18.5C100,-18.5 300.03,-18.5 300.03,-18.5"/>
+</g>
+</g>
+</svg>

utils/ixbin

@@ -0,0 +1,269 @@
+#!/bin/sh
+
+set -e
+
+usage()
+{
+    cat <<EOF
+usage: $0 COMMAND [ARGS...]
+
+Update contents of Infix images
+
+Commands:
+
+  unpack PKG KEY-DIR DIR
+
+    Unpack the RAUC bundle PKG and the root filesystem contained in
+    it, using the keys stored in KEY-DIR, and store the results in
+    DIR.
+
+  pack DIR [KEY-DIR] PKG
+
+    Repackage the (possibly modified) root filesystem in DIR, updating
+    all signatures as necessary using the keys stored in KEY-DIR (or
+    the keys used to unpack the bundle, if not specified) and store
+    the resulting bundle in PKG.
+
+  exec DIR COMMAND [ARGS...]
+
+    Run COMMAND, possibly with ARGS, from the root of the filesystem
+    in DIR, inside of a fakeroot context that allows otherwise
+    privileged operations such as ownership modifications.
+
+  help
+
+    Show this message and exit.
+
+Key directories:
+
+  KEY-DIR arguments must reference a directory that contains the
+  public/private keypair used to verify/sign an image. Most commonly,
+  board/common/signing-keys/development from the Infix source tree is
+  used to validate the input image.
+
+Example:
+
+  Include a custom file inside a prebuilt Infix image, assign it to
+  the UID/GID 1337; and package up the results, signing it with the
+  same developer key that was used to create it:
+
+    ixbin unpack infix-aarch64.pkg ~/infix/board/common/signing-keys/development tmp
+    cp VBRUN300.DLL tmp/rootfs/lib/
+    ixbin exec tmp chown 1337:1337 lib/VBRUN300.DLL
+    ixbin pack tmp infix-vb3-aarch64.pkg
+
+EOF
+}
+
+msg()
+{
+    printf "\e[37;44mixbin: %-80s\e[0m\n" "$*"
+}
+
+err()
+{
+    printf "\e[37;41mixbin: ERROR: %-73s\e[0m\n" "$*" >&2
+}
+
+die()
+{
+    err "$*"
+    exit 1
+}
+
+ensuredeps()
+{
+    local DEPS="fakeroot mksquashfs unsquashfs awk env mkimage truncate dtc fdtget rauc"
+    local missing=
+
+    for dep in $DEPS; do
+	command -v $dep >/dev/null && continue
+	missing="$missing $dep"
+    done
+
+    if [ -n "$missing" ]; then
+	die "Missing dependencies:$missing"
+    fi
+}
+
+squnpack()
+{
+    local sq="$WORKDIR"/pkg/rootfs.img
+
+    # Capture the original compression algo and block size for when we
+    # resquash it later on.
+    unsquashfs -s "$sq" | awk '
+    	       /^Compression/ { printf(" -comp %s", $2); }
+	       /^Block size/ { printf(" -b %s", $3); }
+    ' >"$WORKDIR"/mksquash-opts
+
+    $FAKEROOT unsquashfs -d "$WORKDIR"/rootfs "$sq"
+}
+
+sqexec()
+{
+    $FAKEROOT env -C "$WORKDIR"/rootfs "$@"
+}
+
+sqpack()
+{
+    $FAKEROOT mksquashfs "$WORKDIR"/rootfs "$WORKDIR"/pkg/rootfs.img \
+	      $(cat "$WORKDIR"/mksquash-opts) -noappend "$@"
+}
+
+sqsign()
+{
+    local its="$1"
+    local keys="$2"
+    local hsize="$3"
+    local out="$4"
+
+    mkimage -E -p "$hsize" -B "$hsize" -k "$keys" -f "$its" "$WORKDIR"/sign.itb
+    truncate -s $(($hsize)) "$WORKDIR"/sign.itb
+    mv "$WORKDIR"/sign.itb "$out"
+}
+
+sqresign()
+{
+    local keys="$1"
+    local sq="$WORKDIR"/pkg/rootfs.img
+    local itbh="$WORKDIR"/pkg/rootfs.itbh
+
+    signsize=$(printf '0x%x' $(fdtget "$itbh" /images/rootfs data-position))
+
+    dtc -I dtb -O dts "$itbh" | awk -v sq="$sq" '
+    	/timestamp =/ || /data-\w+ =/ || /signer-\w+ =/ || /value =/{
+		/* Remove old signature */
+		next;
+	}
+
+	/compression = "none"/ {
+		/* Splice in reference to the squash */
+		print;
+		sub("compression", "data");
+		sub("\"none\"", sprintf("/incbin/(\"%s\")", sq));
+		print;
+		next;
+	}
+
+	{
+		/* Keep the rest as-is */
+		print;
+	};
+    ' >"$WORKDIR"/resign.its
+
+    sqsign "$WORKDIR"/resign.its "$keys" "$signsize" "$itbh"
+}
+
+unpack()
+{
+    local pkg="$1"
+    local keys="$2"
+    WORKDIR=$(readlink -f "$3")
+
+    case "$#" in
+	3)
+	    ;;
+	*)
+	    echo "Usage: ixbin unpack PKG KEYS DIR" >&2
+	    exit 1
+    esac
+
+    local crt=$(ls "$keys"/*.crt | head -n1)
+    [ -r "$crt" ] || die "No public key found in $keys"
+
+    msg "Setting up working directory"
+    mkdir -p "$WORKDIR"
+    cp -a "$keys" "$WORKDIR"/in-keys
+
+    touch "$WORKDIR"/fakeroot-state
+    FAKEROOT="fakeroot -i $WORKDIR/fakeroot-state -s $WORKDIR/fakeroot-state"
+
+    msg "Unpacking RAUC bundle"
+    rauc --keyring="$crt" extract "$pkg" "$WORKDIR"/pkg
+    msg "Unpacking Squash filesystem"
+    squnpack
+    msg "OK, $WORKDIR/rootfs can now be modified"
+}
+
+run()
+{
+    WORKDIR=$(readlink -f "$1")
+    shift
+
+    [ -r "$WORKDIR"/fakeroot-state ] || \
+	die "$WORKDIR does not contain an unpacked image"
+    FAKEROOT="fakeroot -i $WORKDIR/fakeroot-state -s $WORKDIR/fakeroot-state"
+
+    sqexec "$@"
+}
+
+pack()
+{
+    WORKDIR=$(readlink -f "$1")
+    local keys="$2"
+    local pkg="$3"
+
+    case "$#" in
+	3)
+	    ;;
+	2)
+	    keys="$WORKDIR"/in-keys
+	    pkg="$2"
+	    ;;
+	*)
+	    echo "Usage: ixbin pack DIR [KEYS] DIR" >&2
+	    exit 1
+    esac
+
+    [ -r "$WORKDIR"/fakeroot-state ] || \
+	die "$WORKDIR does not contain an unpacked image"
+
+    local crt=$(ls "$keys"/*.crt | head -n1)
+    [ -r "$crt" ] || die "No public key found in $keys"
+
+    local key=$(ls "$keys"/*.key | head -n1)
+    [ -r "$crt" ] || die "No private key found in $keys"
+
+    FAKEROOT="fakeroot -i $WORKDIR/fakeroot-state -s $WORKDIR/fakeroot-state"
+
+    msg "Packing up Squash filesystem"
+    sqpack
+    [ -f "$WORKDIR"/pkg/rootfs.itbh ] && {
+	msg "Updating Squash filesystem signature"
+	sqresign "$keys"
+    }
+
+    msg "Creating RAUC bundle"
+    rauc --keyring="$crt" --cert="$crt" --key="$key" bundle "$WORKDIR"/pkg "$pkg"
+    msg "OK, updated bundle available in $pkg"
+}
+
+if [ $# -lt 1 ]; then
+    usage
+    exit 1
+fi
+
+cmd="$1"
+shift
+
+case "$cmd" in
+    unpack)
+	ensuredeps
+	unpack "$@"
+	;;
+    "exec")
+	ensuredeps
+	run "$@"
+	;;
+    pack)
+	ensuredeps
+	pack "$@"
+	;;
+    help)
+	usage
+	;;
+    *)
+	die "Unknown command \"$cmd\""
+	;;
+esac