confd: fix annoying warning in log

This fixes the annoying libyang warning after commit da29771.

    confd[3375]: libyang[0]: Invalid argument ctx_node (lyd_find_xpath()).

This happens when the diff is used in the wrong event when it is NULL.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

.github/CHECKLIST.md

@@ -27,10 +27,17 @@ Pull Requests
 Releases
 --------
 
+Recommended checkpoints, use at your own discretion:
+
  - Make at least one -betaN release to verify the GitHub workflow well in time release day
    - Stuff happens, remember kernelkit/infix#735
  - Make at least one -rcN to flush out any issues in customer repos
    - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
+ - Verify release artifacts (checksums, completeness, no corrupted files)
+ - Test on actual hardware for at least one architecture
+ - Review ChangeLog for completeness
+ - Check for release-blocking issues
+ - Verify generated GNS3 appliance, no marketplace update on -rc builds
  - Ensure the markdown link for the release diff is updated
  - Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
  - Sync tags for all repo. sync activities

.github/workflows/bitsign.yml

@@ -0,0 +1,215 @@
+name: bitSign Infix Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_version:
+        description: 'Release version (e.g., v25.08.0)'
+        required: true
+        type: string
+  push:
+    branches: [ sign-with-bitsign ]
+
+jobs:
+  sign-infix-release:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Validate release version format
+      id: validate
+      run: |
+        # Use default version for push events, input version for manual dispatch
+        if [ "${{ github.event_name }}" = "push" ]; then
+          VERSION="v25.08.0"
+          echo "Using default version for push trigger: $VERSION"
+        else
+          VERSION="${{ inputs.release_version }}"
+          echo "Using input version for manual trigger: $VERSION"
+        fi
+
+        # Check if version starts with 'v' and has proper format
+        if ! echo "$VERSION" | grep -qE '^v[0-9]+\.[0-9]+(\.[0-9]+)?(-alpha[0-9]*|-beta[0-9]*|-rc[0-9]*)?$'; then
+          echo "❌ Invalid version format. Expected format: vYY.MM(.PP)(-alphaN|-betaN|-rcN)"
+          echo "Examples: v25.08.0, v25.08.0-alpha1, v25.08.0-rc1"
+          exit 1
+        fi
+
+        # Extract version without 'v' prefix for filename
+        FILE_VERSION="${VERSION#v}"
+        FILENAME="infix-x86_64-${FILE_VERSION}.tar.gz"
+        RELEASE_URL="https://github.com/kernelkit/infix/releases/download/${VERSION}/${FILENAME}"
+
+        echo "✅ Version format valid"
+        echo "file_version=${FILE_VERSION}" >> $GITHUB_OUTPUT
+        echo "filename=${FILENAME}" >> $GITHUB_OUTPUT
+        echo "release_url=${RELEASE_URL}" >> $GITHUB_OUTPUT
+
+    - name: Download Infix release
+      run: |
+        RELEASE_URL="${{ steps.validate.outputs.release_url }}"
+        FILENAME="${{ steps.validate.outputs.filename }}"
+
+        echo "Downloading Infix release: $FILENAME"
+        echo "From: $RELEASE_URL"
+
+        if ! curl -L "$RELEASE_URL" -o "$FILENAME" --fail --show-error --progress-bar; then
+          echo "❌ Failed to download release file from: $RELEASE_URL"
+          echo "Please verify that the release version exists and contains the x86_64 build."
+          echo "You can check available releases at: https://github.com/kernelkit/infix/releases"
+          exit 1
+        fi
+
+        # Verify download
+        if [ -f "$FILENAME" ] && [ -s "$FILENAME" ]; then
+          FILE_SIZE=$(ls -lh "$FILENAME" | awk '{print $5}')
+          echo "✅ Successfully downloaded: $FILENAME ($FILE_SIZE)"
+        else
+          echo "❌ Failed to download release file"
+          exit 1
+        fi
+
+    - name: Create signing request
+      id: create_request
+      run: |
+        FILENAME="${{ steps.validate.outputs.filename }}"
+        FILE_VERSION="${{ steps.validate.outputs.file_version }}"
+        RELEASE="infix-x86_64-${FILE_VERSION}"
+
+        echo "Creating signing request for $FILENAME..."
+        echo "RELEASE parameter: $RELEASE"
+
+        # Create signing request using bitSign API
+        RESPONSE=$(curl -s -X POST "https://portal.bitsign.se/api/v1/requests" \
+          -H "Authorization: Bearer ${{ secrets.BITSIGN_API_KEY }}" \
+          -F "file=@$FILENAME" \
+          -F "key=bit42-Demo1" \
+          -F "job=Infix-x86" \
+          -F "parameters={\"RELEASE\": \"$RELEASE\"}")
+
+        echo "API Response: $RESPONSE"
+
+        # Check if request was successful
+        if echo "$RESPONSE" | jq -e '.success == true' > /dev/null; then
+          REQUEST_ID=$(echo "$RESPONSE" | jq -r '.requestId')
+          echo "✅ Request created successfully with ID: $REQUEST_ID"
+          echo "request_id=$REQUEST_ID" >> $GITHUB_OUTPUT
+        else
+          echo "❌ Failed to create signing request"
+          echo "$RESPONSE" | jq -r '.error // .message // "Unknown error"'
+          exit 1
+        fi
+
+    - name: Wait for signing completion
+      id: wait_completion
+      run: |
+        REQUEST_ID="${{ steps.create_request.outputs.request_id }}"
+        echo "Waiting for signing completion for request: $REQUEST_ID"
+
+        # Poll status for up to 10 minutes (600 seconds) - longer timeout for larger files
+        MAX_WAIT=600
+        WAITED=0
+
+        while [ $WAITED -lt $MAX_WAIT ]; do
+          RESPONSE=$(curl -s -X GET "https://portal.bitsign.se/api/v1/requests/$REQUEST_ID/status" \
+            -H "Authorization: Bearer ${{ secrets.BITSIGN_API_KEY }}")
+
+          STATUS=$(echo "$RESPONSE" | jq -r '.status')
+          echo "Current status: $STATUS (waited ${WAITED}s)"
+
+          if [ "$STATUS" = "completed" ]; then
+            echo "✅ Signing completed successfully!"
+            break
+          elif [ "$STATUS" = "failed" ]; then
+            echo "❌ Signing failed"
+            echo "$RESPONSE" | jq -r '.error // .message // "Unknown error"'
+            exit 1
+          fi
+
+          sleep 10
+          WAITED=$((WAITED + 10))
+        done
+
+        if [ $WAITED -ge $MAX_WAIT ]; then
+          echo "❌ Timeout: Signing did not complete within ${MAX_WAIT} seconds"
+          exit 1
+        fi
+
+    - name: Download signed file
+      id: download_signed
+      run: |
+        REQUEST_ID="${{ steps.create_request.outputs.request_id }}"
+        FILENAME="${{ steps.validate.outputs.filename }}"
+        FILE_VERSION="${{ steps.validate.outputs.file_version }}"
+        SIGNED_FILENAME="infix-x86_64-${FILE_VERSION}-signed.tar.gz"
+
+        echo "Downloading signed file for request: $REQUEST_ID"
+        echo "Expected signed filename: $SIGNED_FILENAME"
+
+        # Download the signed file
+        curl -X GET "https://portal.bitsign.se/api/v1/requests/$REQUEST_ID/download" \
+          -H "Authorization: Bearer ${{ secrets.BITSIGN_API_KEY }}" \
+          -o "$SIGNED_FILENAME" \
+          --fail --show-error
+
+        if [ -f "$SIGNED_FILENAME" ] && [ -s "$SIGNED_FILENAME" ]; then
+          FILE_SIZE=$(ls -lh "$SIGNED_FILENAME" | awk '{print $5}')
+          echo "Successfully downloaded signed file: $SIGNED_FILENAME ($FILE_SIZE)"
+          echo "signed_filename=$SIGNED_FILENAME" >> $GITHUB_OUTPUT
+
+          # Calculate SHA256 checksums for both files
+          ORIGINAL_SHA256=$(sha256sum "$FILENAME" | cut -d' ' -f1)
+          SIGNED_SHA256=$(sha256sum "$SIGNED_FILENAME" | cut -d' ' -f1)
+          echo "original_sha256=$ORIGINAL_SHA256" >> $GITHUB_OUTPUT
+          echo "signed_sha256=$SIGNED_SHA256" >> $GITHUB_OUTPUT
+        else
+          echo "Failed to download signed file"
+          exit 1
+        fi
+
+    - name: Upload signed artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: signed-infix-${{ steps.validate.outputs.file_version }}
+        path: ${{ steps.download_signed.outputs.signed_filename }}
+        retention-days: 90
+
+    - name: Summary
+      run: |
+        # Determine the actual version used (could be from push or input)
+        if [ "${{ github.event_name }}" = "push" ]; then
+          ACTUAL_VERSION="v25.08.0"
+        else
+          ACTUAL_VERSION="${{ inputs.release_version }}"
+        fi
+
+        cat >> $GITHUB_STEP_SUMMARY << EOF
+        # bitSign Infix Release Signing Complete
+
+        The Infix release has been successfully signed using the bitSign API.
+
+        ## Signing Details
+
+        | Property | Value |
+        |----------|-------|
+        | 📦 **Original File** | \`${{ steps.validate.outputs.filename }}\` (\`${{ steps.download_signed.outputs.original_sha256 }}\`) |
+        | ✍️ **Signed File** | \`${{ steps.download_signed.outputs.signed_filename }}\` (\`${{ steps.download_signed.outputs.signed_sha256 }}\`) |
+        | 🔑 **Signing Key** | \`bit42-Demo1\` |
+        | ⚙️ **Job Type** | \`Infix-x86\` |
+        | 🆔 **Request ID** | \`${{ steps.create_request.outputs.request_id }}\` |
+        | 📋 **Release Version** | \`\$ACTUAL_VERSION\` |
+        | 🌐 **API Endpoint** | \`portal.bitsign.se\` |
+
+        ## Download Files
+
+        > **The signed release file is available as a workflow artifact:**
+        > **\`signed-infix-${{ steps.validate.outputs.file_version }}\`**
+        >
+        > The artifact contains the signed file: \`${{ steps.download_signed.outputs.signed_filename }}\`
+
+        ---
+
+        **Next Steps:** The signed release can now be distributed with cryptographic verification of authenticity.
+        EOF

.github/workflows/build-boot.yml

@@ -16,11 +16,12 @@ jobs:
       fail-fast: false
       matrix:
         defconfig:
-          - fireant_boot
-          - cn9130_crb_boot
           - aarch64_qemu_boot
-          - rpi4_boot
-          - mt7986_sd_boot
+          - bpi_r3_boot
+          - cn9130_crb_boot
+          - fireant_boot
+          - nanopi_r2s_boot
+          - rpi64_boot
     env:
       MAKEFLAGS: -j5
     steps:

.github/workflows/build-image.yml

@@ -8,9 +8,10 @@ on:
         type: choice
         required: true
         options:
-          - raspberry-pi-4
-          - banana-pi-r3
-        default: 'raspberry-pi-4'
+          - raspberrypi-rpi64
+          - bananapi-bpi-r3
+          - friendlyarm-nanopi-r2s
+        default: 'raspberrypi-rpi64'
       use_latest_release:
         description: 'Use latest release artifacts instead of workflow artifacts'
         type: boolean
@@ -52,12 +53,16 @@ jobs:
       - name: Set bootloader and target based on board
         run: |
           case "${{ inputs.board }}" in
-            raspberry-pi-4)
-              echo "BOOTLOADER=rpi4_boot" >> $GITHUB_ENV
+            raspberrypi-rpi64)
+              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
               echo "TARGET=aarch64" >> $GITHUB_ENV
               ;;
-            banana-pi-r3)
-              echo "BOOTLOADER=mt7986_sd_boot" >> $GITHUB_ENV
+            bananapi-bpi-r3)
+              echo "BOOTLOADER=bpi_r3_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
+              ;;
+            friendlyarm-nanopi-r2s)
+              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
               echo "TARGET=aarch64" >> $GITHUB_ENV
               ;;
             *)
@@ -144,19 +149,7 @@ jobs:
           export BR2_EXTERNAL_INFIX_PATH=$PWD
           export RELEASE=""
           export INFIX_ID="infix"
-
-          # Use the standardized mkimage.sh path for the selected board
-          #          BOARD_SCRIPT="src/board/${{ inputs.board }}/mkimage.sh"
-          BOARD_SCRIPT="src/board/${{ inputs.board }}/mkimage.sh"
-
-          if [ -f "$BOARD_SCRIPT" ]; then
-            echo "Using board-specific image creation script: $BOARD_SCRIPT"
-            chmod +x "$BOARD_SCRIPT"
-            "$BOARD_SCRIPT"
-          else
-            echo "Error: Board script $BOARD_SCRIPT not found!"
-            exit 1
-          fi
+          ./utils/mkimage.sh ${{ inputs.board }}
 
       - name: Verify created image
         run: |
@@ -183,7 +176,7 @@ jobs:
         with:
           name: sdcard-image-${{ inputs.board }}-${{ env.BOOTLOADER }}
           path: |
-            output/images/*-sdcard.img
+            output/images/*-sdcard.img*
           retention-days: 30
 
       - name: Create checksums
@@ -218,7 +211,7 @@ jobs:
           **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
 
           ## Created Images
-          $(find output/images/ -name "*.img" -o -name "*.qcow2" -o -name "*.raw" | xargs ls -lh 2>/dev/null | sed 's/^/- /' || echo "- No images found")
+          $(find output/images/ -name "*.img*" -o -name "*.qcow2" -o -name "*.raw" | xargs ls -lh 2>/dev/null | sed 's/^/- /' || echo "- No images found")
 
           ## Download
           The SD card image is available as a workflow artifact above.

.github/workflows/build-release.yml

@@ -0,0 +1,102 @@
+name: Build Release
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+      use_cache:
+        required: false
+        type: boolean
+        default: true
+
+jobs:
+  build:
+    name: Build Infix ${{ inputs.version }} [${{ matrix.target }}]
+    runs-on: [self-hosted, release]
+    strategy:
+      matrix:
+        target: [aarch64, x86_64]
+      fail-fast: false
+    steps:
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
+
+      - uses: actions/checkout@v4
+        with:
+          clean: true
+          submodules: recursive
+
+      - name: Set Release Variables
+        id: vars
+        run: |
+          ver=${{ inputs.version }}
+          echo "ver=${ver}" >> $GITHUB_OUTPUT
+          fver=${ver#v}
+          target=${{ matrix.target }}-${fver}
+          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+
+      - name: Restore Cache of dl/
+        if: ${{ inputs.use_cache }}
+        uses: actions/cache@v4
+        with:
+          path: dl/
+          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-
+
+      - name: Restore Cache of .ccache/
+        if: ${{ inputs.use_cache }}
+        uses: actions/cache@v4
+        with:
+          path: .ccache/
+          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-${{ matrix.target }}-
+            ccache-
+
+      - name: Configure & Build
+        env:
+          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
+        run: |
+          target=${{ matrix.target }}_defconfig
+          echo "Building $target ..."
+          make $target
+          make
+
+      - name: Generate SBOM from Build
+        run: |
+          make legal-info
+
+      - name: Build test specification
+        run: |
+          make test-spec
+
+      - name: Prepare Artifacts
+        run: |
+          cd output/
+          mv images ${{ steps.vars.outputs.dir }}
+          ln -s ${{ steps.vars.outputs.dir }} images
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+
+          mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-${{ matrix.target }}
+          path: output/*.tar.gz
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-disk-image-${{ matrix.target }}
+          path: output/images/*.qcow2

.github/workflows/build.yml

@@ -35,7 +35,7 @@ on:
       parallel:
         required: false
         type: boolean
-        default: false
+        default: true
 
 env:
   NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
@@ -59,6 +59,15 @@ jobs:
           rm -rf ./* || true
           rm -rf ./.??* || true
           ls -la ./
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
 
       - name: Checkout infix repo
         uses: actions/checkout@v4
@@ -110,6 +119,11 @@ jobs:
         run: |
           make ${{ env.TARGET }}_defconfig
 
+      - name: Cleanup stale containers and ports
+        run: |
+          podman rm -af || true
+          pkill -9 -f rootlessport || true
+
       - name: Unit Test ${{ env.TARGET }}
         run: |
           make test-unit

.github/workflows/check-kernel-release.yml

@@ -0,0 +1,115 @@
+name: Check Kernel 6.12 Release
+
+on:
+  workflow_dispatch: # Allow manual triggering
+
+jobs:
+  check-kernel:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out infix repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
+
+      - name: Check out linux repository
+        uses: actions/checkout@v4
+        with:
+          repository: kernelkit/linux
+          path: linux
+          fetch-depth: 0
+          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
+
+      - name: Fetch kernel.org and check for 6.12 release
+        id: check
+        run: |
+          set -e -o pipefail
+          # Fetch the kernel.org frontpage and extract 6.12 version
+          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)
+
+          if [ -z "$CURRENT_VERSION" ]; then
+            echo "Failed to fetch kernel version"
+            exit 1
+          fi
+
+          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
+          echo "Current 6.12 kernel version: $CURRENT_VERSION"
+
+          # Get the latest tag from our linux tree
+          cd linux
+          git fetch origin
+          LATEST_TAG=$(git tag -l "v6.12.*" | sort -V | tail -n1 | sed 's/^v//')
+          cd ..
+
+          echo "latest_tag=$LATEST_TAG" >> $GITHUB_OUTPUT
+          echo "Latest tag in our tree: $LATEST_TAG"
+
+          if [ "$CURRENT_VERSION" != "$LATEST_TAG" ]; then
+            echo "new_release=true" >> $GITHUB_OUTPUT
+            echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (our version: $LATEST_TAG)"
+          else
+            echo "new_release=false" >> $GITHUB_OUTPUT
+            echo "No change - still at $CURRENT_VERSION"
+          fi
+
+      - name: Set up git credentials
+        if: steps.check.outputs.new_release == 'true'
+        run: |
+          set -e -o pipefail
+          git config --global user.email "ael-bot@users.noreply.github.com"
+          git config --global user.name "ael-bot"
+
+          # Configure git to use the token for HTTPS operations
+          git config --global url."https://ael-bot:${{ secrets.KERNEL_UPDATE_TOKEN }}@github.com/".insteadOf "git@github.com:"
+          git config --global url."https://ael-bot:${{ secrets.KERNEL_UPDATE_TOKEN }}@github.com/".insteadOf "https://github.com/"
+
+      - name: Run kernel upgrade script
+        if: steps.check.outputs.new_release == 'true'
+        env:
+          GIT_TERMINAL_PROMPT: 0
+        run: |
+          set -e -o pipefail
+          ./utils/kernel-upgrade.sh linux
+
+      - name: Create pull request
+        if: steps.check.outputs.new_release == 'true'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
+          script: |
+            // Check if PR already exists
+            const { data: pulls } = await github.rest.pulls.list({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              head: `${context.repo.owner}:kernel-upgrade`,
+              state: 'open'
+            });
+
+            if (pulls.length === 0) {
+              const { data: pr } = await github.rest.pulls.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title: `Upgrade to kernel ${{ steps.check.outputs.current_version }}`,
+                head: 'kernel-upgrade',
+                base: 'main',
+                body: `Automated kernel upgrade to version ${{ steps.check.outputs.current_version }}.\n\n**Previous version:** ${{ steps.check.outputs.latest_tag }}\n**New version:** ${{ steps.check.outputs.current_version }}\n**Source:** https://www.kernel.org/\n\nThis PR was automatically created by the kernel release monitoring workflow.`
+              });
+
+              // Add label
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+                labels: ['ci:main']
+              });
+
+              // Request reviews
+              await github.rest.pulls.requestReviewers({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: pr.number,
+                reviewers: ['troglobit', 'wkz', 'mattiaswal']
+              });
+            }

.github/workflows/docs.yml

@@ -41,6 +41,7 @@ jobs:
           pipx inject mkdocs mkdocs-callouts
           pipx inject mkdocs mike
           pipx inject mkdocs mkdocs-to-pdf
+          pipx inject mkdocs mkdocs-glightbox
           # Workaround, if pipx inject fails to install symlink
           ln -s "$(pipx environment -V PIPX_LOCAL_VENVS)/mkdocs/bin/mike" \
                 "$(pipx environment -V PIPX_BIN_DIR)/mike" || true

.github/workflows/generic-x86-build.yml

@@ -10,6 +10,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Free Disk Space
+        uses: jlumbroso/free-disk-space@main
+        with:
+          tool-cache: true
+          android: true
+          dotnet: true
+          haskell: true
+          large-packages: true
+          docker-images: true
+          swap-storage: false
+
       - name: Install build dependencies
         run: |
           sudo apt-get update

.github/workflows/release.yml

@@ -18,96 +18,46 @@ on:
         type: string
 
 jobs:
-  build:
+  set-version:
     if: github.repository == 'kernelkit/infix' && startsWith(github.ref, 'refs/tags/')
-    name: Build Infix ${{ github.ref_name }} [${{ matrix.target }}]
-    runs-on: [ self-hosted, release ]
-    strategy:
-      matrix:
-        target: [aarch64, x86_64]
-      fail-fast: false
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.set-ver.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
-        with:
-          clean: true
-          submodules: recursive
-
-      - name: Set Release Variables
-        id: vars
+      - id: set-ver
         run: |
           if [ -n "${{ inputs.version }}" ]; then
               ver=${{ inputs.version }}
           else
               ver=${GITHUB_REF#refs/tags/}
           fi
-          echo "ver=${ver}" >> $GITHUB_OUTPUT
-          fver=${ver#v}
-          target=${{ matrix.target }}-${fver}
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+          echo "version=${ver}" >> $GITHUB_OUTPUT
 
-      - name: Restore Cache of dl/
-        uses: actions/cache@v4
-        with:
-          path: dl/
-          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-
-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-${{ matrix.target }}-
-            ccache-
-
-      - name: Configure & Build
-        env:
-          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
-        run: |
-          target=${{ matrix.target }}_defconfig
-          echo "Building $target ..."
-          make $target
-          make
-
-      - name: Generate SBOM from Build
-        run: |
-          make legal-info
-
-      - name: Build test specification
-        run: |
-          make test-spec
-
-      - name: Prepare Artifacts
-        run: |
-          cd output/
-          mv images ${{ steps.vars.outputs.dir }}
-          ln -s ${{ steps.vars.outputs.dir }} images
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
-
-          mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: artifact-${{ matrix.target }}
-          path: output/*.tar.gz
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: artifact-disk-image-${{ matrix.target }}
-          path: output/images/*.qcow2
+  build:
+    needs: set-version
+    uses: ./.github/workflows/build-release.yml
+    with:
+      version: ${{ needs.set-version.outputs.version }}
+      use_cache: true
 
   release:
     name: Release Infix ${{ github.ref_name }}
     needs: build
-    runs-on: [ self-hosted, release ]
+    runs-on: [self-hosted, release]
     permissions:
       contents: write
       discussions: write
     steps:
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
+
       - uses: actions/checkout@v4
         with:
           submodules: 'true'
@@ -156,6 +106,9 @@ jobs:
         run: |
           awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
               |head -n -1 > release.md
+          echo "" >> release.md
+          echo "> [!TIP]" >> release.md
+          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
           cat release.md
 
       - uses: ncipollo/release-action@v1

.github/workflows/test.yml

@@ -41,6 +41,16 @@ jobs:
     name: Regression Test ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
     runs-on: [self-hosted, regression]
     steps:
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
+
       - name: Checkout infix repo
         uses: actions/checkout@v4
         with:
@@ -90,7 +100,8 @@ jobs:
       - name: Publish Test Result for ${{ env.TARGET }}
         # Ensure this runs even if Regression Test fails
         if: always()
-        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+        run: |
+          cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
 
       - name: Generate Test Report for ${{ env.TARGET }}
         # Ensure this runs even if Regression Test fails

.github/workflows/trigger.yml

@@ -14,29 +14,62 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Gate all builds through this check to prevent wasted runs.  Only run on
+  # 'labeled' events when the label is actually 'ci:main'.  Concurrency control
+  # above handles canceling the 'opened' event when 'labeled' arrives quickly
+  # after (e.g., when creating a PR with ci:main already attached). See #1154.
+  check-trigger:
+    if: |
+      startsWith(github.repository, 'kernelkit/') &&
+      (github.event_name != 'pull_request' ||
+       github.event.action != 'labeled' ||
+       github.event.label.name == 'ci:main')
+    runs-on: ubuntu-latest
+    outputs:
+      x86_64_target: ${{ steps.set-targets.outputs.x86_64_target }}
+      aarch64_target: ${{ steps.set-targets.outputs.aarch64_target }}
+    steps:
+      - run: |
+          echo "Triggering build, logging meta data ..."
+          echo "Event  : ${{ github.event_name }}"
+          echo "Action : ${{ github.event.action }}"
+          echo "Ref    : ${{ github.ref }}"
+          echo "PR     : ${{ github.event.pull_request.number }}"
+          echo "Label  : ${{ github.event.label.name }}"
+      - id: set-targets
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]] &&           \
+             ! echo '${{ toJSON(github.event.pull_request.labels.*.name) }}' \
+             | grep -q "ci:main"; then
+            echo "x86_64_target=x86_64_minimal" >> $GITHUB_OUTPUT
+            echo "aarch64_target=aarch64_minimal" >> $GITHUB_OUTPUT
+          else
+            echo "x86_64_target=x86_64" >> $GITHUB_OUTPUT
+            echo "aarch64_target=aarch64" >> $GITHUB_OUTPUT
+          fi
+
   build-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
+    needs: check-trigger
     uses: ./.github/workflows/build.yml
     with:
       name: "infix"
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
+      target: ${{ needs.check-trigger.outputs.x86_64_target }}
 
   build-aarch64:
-    if: startsWith(github.repository, 'kernelkit/')
+    needs: check-trigger
     uses: ./.github/workflows/build.yml
     with:
       name: "infix"
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'aarch64_minimal' || 'aarch64' }}
+      target: ${{ needs.check-trigger.outputs.aarch64_target }}
 
   test-run-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
-    needs: build-x86_64
+    needs: [check-trigger, build-x86_64]
     uses: ./.github/workflows/test.yml
     with:
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
+      target: ${{ needs.check-trigger.outputs.x86_64_target }}
       name: "infix"
 
   test-publish-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
+    if: ${{ github.repository_owner == 'kernelkit' && github.ref_name == 'main' }}
     needs: test-run-x86_64
     uses: ./.github/workflows/publish.yml

.github/workflows/weekly.yml

@@ -0,0 +1,68 @@
+# Weekly release build to catch flaky tests and verify clean builds.
+# Runs without caches (ccache) to ensure reproducibility. See issue #1003.
+name: Weekly Build
+
+on:
+  schedule:
+    - cron: '5 0 * * 6'  # Saturday at 00:05 UTC, same as Coverity
+  workflow_dispatch:
+
+jobs:
+  build:
+    if: github.repository == 'kernelkit/infix'
+    uses: ./.github/workflows/build-release.yml
+    with:
+      version: "latest"
+      use_cache: false
+
+  publish:
+    name: Publish Weekly Build
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums
+        run: |
+          for file in *.tar.gz; do
+            sha256sum $file > $file.sha256
+          done
+          if ls *.qcow2 &>/dev/null; then
+            for file in *.qcow2; do
+              sha256sum "$file" > "$file.sha256"
+            done
+          fi
+
+      - uses: ncipollo/release-action@v1
+        with:
+          tag: latest
+          name: "Latest Weekly Build"
+          prerelease: true
+          makeLatest: false
+          allowUpdates: true
+          removeArtifacts: true
+          body: |
+            Automated weekly build from `${{ github.sha }}`.
+
+            This build runs without caches to catch potential flaky tests and build issues.
+            Not intended for production use - use official releases instead.
+
+            **Commit:** ${{ github.sha }}
+            **Built:** ${{ github.run_id }}
+          artifacts: "*.tar.gz*,*.qcow2*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Weekly Build Published! :package:
+
+          Latest artifacts uploaded to:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+
+          Built from commit: \`${{ github.sha }}\`
+          EOF

Config.in

@@ -1,3 +1,5 @@
+source "$BR2_EXTERNAL_INFIX_PATH/board/Config.in"
+
 menu "Branding"
 
 config INFIX_VENDOR

README.md

@@ -1,6 +1,6 @@
-[![License Badge][]][License] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
+[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
 
-<img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
+<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=480 padding=10>
 
 Turn any ARM or x86 device into a powerful, manageable network appliance
 in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
@@ -129,18 +129,33 @@ deployments.
 
 ## Technical Details
 
-Built on proven open-source foundations ([Buildroot][1] + [sysrepo][2])
-for reliability you can trust:
+<a href="https://bitsign.se">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://bitsign.se/assets/badges/bitsign-badge-dark-mode.png">
+    <source media="(prefers-color-scheme: light)" srcset="https://bitsign.se/assets/badges/bitsign-badge-light-mode.png">
+    <img alt="bitSign - Code Signing" src="https://bitsign.se/assets/badges/bitsign-badge-light-mode.png" align="right" width=150 padding=10>
+  </picture>
+</a>
+
+Built on proven open-source foundations: [Linux][0], [Buildroot][1], and
+[sysrepo][2] — for reliability you can trust:
 
 - **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
 - **YANG Configuration**: Industry-standard models with auto-generated tooling
 - **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
 - **Container Integration**: Docker support with flexible network and hardware access
 - **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
+- **Code Signing**: Releases are cryptographically signed for integrity verification
 
 Perfect for everything from resource-constrained edge devices to
 high-throughput network appliances.
 
+With the entire system modeled in YANG, scalability is no longer an
+issue, be it in development, testing, or end users deploying and
+monitoring their devices.  All knobs and dials are accessible from the
+CLI (console/SSH), or remotely using the native NETCONF or RESTCONF
+APIs.
+
 > Check the *[Latest Build][]* for bleeding-edge features.
 
 ---
@@ -152,6 +167,7 @@ high-throughput network appliances.
 
 ![Alt](https://repobeats.axiom.co/api/embed/5ce7a2a67edc923823afa0f60c327a6e8575b6e9.svg "Repobeats analytics image")
 
+[0]: https://www.kernel.org
 [1]: https://buildroot.org/ "Buildroot Homepage"
 [2]: https://www.sysrepo.org/ "Sysrepo Homepage"
 [3]: https://kernelkit.org/infix/latest/cli/introduction/
@@ -160,6 +176,8 @@ high-throughput network appliances.
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
+[Release]:         https://github.com/kernelkit/infix/releases
+[Release Badge]:   https://img.shields.io/github/v/release/kernelkit/infix 
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/
 [GitHub Status]:   https://github.com/kernelkit/infix/actions/workflows/build.yml/badge.svg
 [Coverity Scan]:   https://scan.coverity.com/projects/29393

board/Config.in

@@ -0,0 +1,7 @@
+menu "Board Support"
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"
+
+endmenu

board/aarch64/Config.in

@@ -0,0 +1,13 @@
+if BR2_aarch64
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/freescale-imx8mp-evk/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/friendlyarm-nanopi-r2s/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-cn9130-crb/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-espressobin/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/microchip-sparx5-pcb135/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/raspberrypi-rpi64/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/styx-dcp-sc-28p/Config.in"
+
+endif

board/aarch64/README.md

@@ -8,4 +8,4 @@ Board Specific Documentation
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
 - [NanoPi R2S](r2s/)
-- [Raspberry Pi 4 b](raspberry-pi-4/)
+- [Raspberry Pi 64-bit](raspberry-pi64/)

board/aarch64/bananapi-bpi-r3/Config.in

@@ -1,4 +1,4 @@
-config BR2_PACKAGE_BANANA_PI_R3
+config BR2_PACKAGE_BANANAPI_BPI_R3
 	bool "Banana Pi R3"
 	depends on BR2_aarch64
 	select BR2_PACKAGE_FEATURE_WIFI

board/aarch64/bananapi-bpi-r3/bananapi-bpi-r3.mk

@@ -1,8 +1,4 @@
-GENIMAGE_CFG="$(BUILD_DIR)/genimage.cfg"
-GENIMAGE_TMP="$(BUILD_DIR)/genimage.tmp"
-BOARD_DIR="$(BR2_EXTERNAL_INFIX_PATH)/src/board/banana-pi-r3"
-
-define BANANA_PI_R3_LINUX_CONFIG_FIXUPS
+define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MEDIATEK)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MACH_MT7986)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_MT7986)
@@ -28,7 +24,7 @@ define BANANA_PI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_USB_XHCI_MTK,m)
 	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_TPHY,m)
 	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_XSPHY,m)
-	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,m)
+	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,y)
 	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_MT6380,m)
 	$(call KCONFIG_SET_OPT,CONFIG_PWM_MEDIATEK,m)
 	$(call KCONFIG_SET_OPT,CONFIG_SENSORS_PWM_FAN,m)

board/aarch64/bananapi-bpi-r3/genimage.cfg.in

@@ -1,20 +1,26 @@
-
 image cfg.ext4 {
         empty = true
         temporary = true
         size = 128M
         ext4 {
                 label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
         }
 }
 
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
 image var.ext4 {
         empty = true
         temporary = true
-        size = 1G
+        size = 128M
         ext4 {
                 label = "var"
                 use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
         }
 }
 
@@ -27,19 +33,19 @@ image #INFIX_ID##VERSION#-bpi-r3-sdcard.img {
 	partition bl2 {
 		  image = "bl2.img"
 		  offset = 1024s   # 0x80000 = sector 1024
-		  size = 4M       # 0x400000
+		  size = 4M        # 0x400000
 		  bootable = true
-    }
+	}
 
-    # Factory/calibration data (sectors 9216-13311)
-    partition factory {
-        offset = 4608K  # 0x480000
-        size = 2M       # 0x200000
-    }
+	# Factory/calibration data (sectors 9216-13311)
+	partition factory {
+		offset = 4608K  # 0x480000
+		size = 2M       # 0x200000
+	}
 
-# FIP partition - BL31 + U-Boot (sectors 13312-17407)
+	# FIP partition - BL31 + U-Boot (sectors 13312-17407)
         partition fip {
-	 #       partition-type = 0x83  # Linux filesystem
+#		partition-type = 0x83  # Linux filesystem
                 image = "fip.bin"
                 offset = 13312s
                 size = 4096s

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg

@@ -0,0 +1,333 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "class": "infix-hardware:usb",
+        "name": "USB2",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan4",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "sfp1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {}
+      },
+      {
+        "name": "sfp2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {}
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"}
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0",
+        "type": "infix-if-type:wifi"
+      },
+      {
+        "name": "wifi1",
+        "type": "infix-if-type:wifi"
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+        "asymmetric-keys": {
+            "asymmetric-key": [
+                {
+                    "name": "genkey",
+                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+                    "public-key": "",
+                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+                    "cleartext-private-key": "",
+                    "certificates": {}
+                }
+            ]
+        }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny"
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-address": "::"
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.6"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
+

board/aarch64/friendlyarm-nanopi-r2s/Config.in

@@ -0,0 +1,9 @@
+config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
+	bool "FriendlyElec NanoPi R2S"
+	depends on BR2_aarch64
+	select SDCARD_AUX
+	select BR2_PACKAGE_INPUT_EVENT_DAEMON
+	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
+	help
+	  FriendlyElec NanoPi R2S is a compact router board based on
+	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.

board/aarch64/friendlyarm-nanopi-r2s/dts/Makefile

@@ -0,0 +1 @@
+dtb-y += rockchip/rk3328-nanopi-r2s.dtb

board/aarch64/friendlyarm-nanopi-r2s/dts/rockchip/infix.dtsi

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Common Infix OS defaults
+ */
+
+/ {
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+	};
+};

board/aarch64/friendlyarm-nanopi-r2s/dts/rockchip/rk3328-nanopi-r2s.dts

@@ -0,0 +1,23 @@
+#include <arm64/rockchip/rk3328-nanopi-r2s.dts>
+#include "infix.dtsi"
+
+&rtl8153 {
+	/*
+	 * Fix port number: device is on port 1, not port 2
+	 *
+	 * The kernel's usb_of_get_connect_type() function checks for child
+	 * nodes with a 'reg' property matching the physical port number to
+	 * determine if a USB port is "hard-wired" (internal) vs external.
+	 * With authorized_default=2, only hard-wired ports are automatically
+	 * authorized. The RTL8153 shows up as device 3-1 (hub 3, port 1), so
+	 * reg must be <1> for the kernel to mark it as USB_PORT_CONNECT_TYPE_HARD_WIRED
+	 * and authorize it automatically at boot.
+	 */
+	reg = <1>;
+};
+
+&{/chosen/infix} {
+	/* Expose only the external USB 2.0 port for user management */
+	usb-ports = <&usb_host0_ehci>;
+	usb-port-names = "USB";
+};

board/aarch64/friendlyarm-nanopi-r2s/friendlyarm-nanopi-r2s.mk

@@ -0,0 +1,78 @@
+define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
+	# Rockchip RK3328 SoC
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_ROCKCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
+
+	# PHY drivers
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_INNO_USB2)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_TYPEC)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_ROCKCHIP_USB,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_ROCKCHIP_PCIE,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PHY)
+
+	# Clocks and Power Management
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_ROCKCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RK3328)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_PWM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PWM_ROCKCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR_GPIO)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR_RK808)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CHARGER_RK817)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_RK805)
+
+	# I2C Controller
+	$(call KCONFIG_ENABLE_OPT,CONFIG_I2C_RK3X)
+
+	# I2C/SPI/MFD
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MFD_RK8XX_I2C)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MFD_RK8XX_SPI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SPI_ROCKCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_DRV_RK808)
+
+	# MMC/Storage
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_DW_ROCKCHIP)
+
+	# PCIe
+	$(call KCONFIG_SET_OPT,CONFIG_PCIE_ROCKCHIP_HOST,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PCIE_ROCKCHIP_DW_HOST)
+
+	# Thermal and ADC
+	$(call KCONFIG_SET_OPT,CONFIG_ROCKCHIP_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_ROCKCHIP_SARADC,m)
+
+	# Crypto
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CRYPTO_DEV_ROCKCHIP)
+
+	# NVMEM
+	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
+	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)
+
+	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_PLATFORM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DWMAC_ROCKCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+
+	# Network: USB Ethernet (LAN port - RTL8153 via USB 3.0)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_NET_DRIVERS,m)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_RTL8152,m)
+
+	# USB 3.0 xHCI Controller (required for RTL8153 LAN port)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_XHCI_HCD)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_XHCI_PLATFORM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3_HOST)
+
+	# USB 2.0 Host
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_HCD)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_HCD_PLATFORM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_ROOT_HUB_TT)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))

board/aarch64/friendlyarm-nanopi-r2s/genimage.cfg.in

@@ -5,21 +5,28 @@ image cfg.ext4 {
 
 	ext4 {
 		label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
 	}
 }
 
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
 image var.ext4 {
 	empty = true
 	temporary = true
-	size = 512M
+	size = 128M
 
 	ext4 {
 		label = "var"
-		use-mke2fs = true
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
 	}
 }
 
-image sdcard.img {
+image #INFIX_ID##VERSION#-nanopi-r2s-sdcard.img {
 	hdimage {
 		partition-table-type = "gpt"
 	}

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg

@@ -5,8 +5,8 @@
   "ietf-hardware:hardware": {
     "component": [
       {
-        "name": "USB",
         "class": "infix-hardware:usb",
+        "name": "USB",
         "state": {
           "admin-state": "unlocked"
         }
@@ -16,24 +16,24 @@
   "ietf-interfaces:interfaces": {
     "interface": [
       {
-        "name": "lan1",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
       },
       {
-        "name": "lan2",
+        "name": "lan",
         "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "lan3",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "lan4",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
       },
       {
         "name": "lo",
@@ -55,28 +55,23 @@
           ]
         }
       },
-      {
-        "name": "sfp1",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "sfp2",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
       {
         "name": "wan",
         "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "wifi0",
-        "type": "infix-if-type:wifi"
-      },
-      {
-        "name": "wifi1",
-        "type": "infix-if-type:wifi"
+        "ietf-ip:ipv6": {},
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"}
+            ]
+          }
+        }
       }
     ]
   },
@@ -168,7 +163,17 @@
     }
   },
   "ietf-system:system": {
-    "hostname": "infix-00-00-00",
+    "hostname": "r2s-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
     "authentication": {
       "user": [
         {
@@ -180,38 +185,67 @@
     },
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
       {
-        "if-name": "wan",
-        "option": [
-          {
-            "id": "ntp-server"
-          },
-          {
-            "id": "broadcast"
-          },
-          {
-            "id": "domain"
-          },
-          {
-            "id": "hostname"
-          },
-          {
-            "id": "dns-server"
-          },
-          {
-            "id": "router"
-          },
-          {
-            "id": "netmask"
-          }
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
         ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
       }
     ]
   },
   "infix-meta:meta": {
-    "version": "1.5"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true
@@ -247,4 +281,3 @@
     }
   }
 }
-

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/product/init.d/S01-trigger-udev.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+udevadm control --reload-rules
+udevadm trigger --subsystem-match=net --action=add

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/udev/rules.d/90-persistent-net.rules

@@ -1,2 +1,2 @@
 ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/ff540000.ethernet/net/eth0", NAME="wan"
-ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/ff600000.usb/xhci-hcd.0.auto/usb3/3-1/3-1:1.0/net/*", NAME="lan"
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/ff600000.usb/xhci-hcd.0.auto/usb5/5-1/5-1:1.0/net/*", NAME="lan"

board/aarch64/linux_defconfig

@@ -56,6 +56,7 @@ CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
+CONFIG_PARTITION_ADVANCED=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_KSM=y
@@ -243,9 +244,6 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
-CONFIG_NET_TEAM=m
-CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
-CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -334,12 +332,20 @@ CONFIG_MDIO_BITBANG=y
 CONFIG_MDIO_MVUSB=m
 CONFIG_MDIO_MSCC_MIIM=y
 CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_USB_RTL8150=m
 CONFIG_USB_RTL8152=m
+CONFIG_USB_LAN78XX=m
 CONFIG_USB_USBNET=m
 CONFIG_USB_NET_CDC_EEM=m
 # CONFIG_USB_NET_CDC_NCM is not set
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=m
 # CONFIG_USB_NET_NET1080 is not set
-# CONFIG_USB_NET_CDC_SUBSET is not set
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_KC2190=y
 # CONFIG_USB_NET_ZAURUS is not set
 # CONFIG_WLAN is not set
 CONFIG_INPUT_EVDEV=y
@@ -427,7 +433,7 @@ CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
 CONFIG_USB_ULPI_BUS=y
-CONFIG_USB=m
+CONFIG_USB=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
@@ -438,6 +444,8 @@ CONFIG_USB_OHCI_HCD_PLATFORM=m
 CONFIG_USB_STORAGE=m
 CONFIG_USB_DWC3=y
 CONFIG_USB_DWC2=y
+CONFIG_USB_DWC2_HOST=y
+CONFIG_USB_DWC2_PCI=y
 CONFIG_USB_CHIPIDEA=m
 CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y

board/aarch64/r2s/linux_defconfig

@@ -1,743 +0,0 @@
-CONFIG_SYSVIPC=y
-CONFIG_POSIX_MQUEUE=y
-CONFIG_AUDIT=y
-CONFIG_NO_HZ_IDLE=y
-CONFIG_HIGH_RES_TIMERS=y
-CONFIG_BPF_SYSCALL=y
-CONFIG_BPF_JIT=y
-CONFIG_PREEMPT=y
-CONFIG_IRQ_TIME_ACCOUNTING=y
-CONFIG_BSD_PROCESS_ACCT=y
-CONFIG_BSD_PROCESS_ACCT_V3=y
-CONFIG_TASKSTATS=y
-CONFIG_TASK_DELAY_ACCT=y
-CONFIG_TASK_XACCT=y
-CONFIG_PSI=y
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=18
-CONFIG_MEMCG=y
-CONFIG_BLK_CGROUP=y
-CONFIG_CFS_BANDWIDTH=y
-CONFIG_RT_GROUP_SCHED=y
-CONFIG_CGROUP_PIDS=y
-CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_HUGETLB=y
-CONFIG_CPUSETS=y
-CONFIG_CGROUP_DEVICE=y
-CONFIG_CGROUP_CPUACCT=y
-CONFIG_CGROUP_PERF=y
-CONFIG_CGROUP_BPF=y
-CONFIG_NAMESPACES=y
-CONFIG_USER_NS=y
-CONFIG_SCHED_AUTOGROUP=y
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_EXPERT=y
-CONFIG_KALLSYMS_ALL=y
-CONFIG_PROFILING=y
-CONFIG_KEXEC_FILE=y
-CONFIG_ARCH_ROCKCHIP=y
-CONFIG_ARM64_VA_BITS_48=y
-CONFIG_SCHED_MC=y
-CONFIG_SCHED_SMT=y
-CONFIG_NR_CPUS=8
-CONFIG_COMPAT=y
-CONFIG_RANDOMIZE_BASE=y
-# CONFIG_SUSPEND is not set
-CONFIG_ARM_PSCI_CPUIDLE=y
-CONFIG_CPU_FREQ=y
-CONFIG_CPU_FREQ_STAT=y
-CONFIG_CPU_FREQ_GOV_POWERSAVE=m
-CONFIG_CPU_FREQ_GOV_USERSPACE=y
-CONFIG_CPU_FREQ_GOV_ONDEMAND=y
-CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
-CONFIG_CPUFREQ_DT=y
-CONFIG_ARM_SCMI_CPUFREQ=y
-CONFIG_ACPI_CPPC_CPUFREQ=m
-CONFIG_ACPI=y
-CONFIG_ACPI_APEI=y
-CONFIG_ACPI_APEI_GHES=y
-CONFIG_ACPI_APEI_MEMORY_FAILURE=y
-CONFIG_ACPI_APEI_EINJ=y
-CONFIG_VIRTUALIZATION=y
-CONFIG_KVM=y
-CONFIG_KPROBES=y
-CONFIG_JUMP_LABEL=y
-# CONFIG_GCC_PLUGINS is not set
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
-# CONFIG_COMPAT_BRK is not set
-CONFIG_KSM=y
-CONFIG_MEMORY_FAILURE=y
-CONFIG_TRANSPARENT_HUGEPAGE=y
-CONFIG_CMA=y
-CONFIG_CMA_AREAS=20
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_XDP_SOCKETS=y
-CONFIG_XDP_SOCKETS_DIAG=y
-CONFIG_IP_MULTICAST=y
-CONFIG_IP_ADVANCED_ROUTER=y
-CONFIG_IP_MULTIPLE_TABLES=y
-CONFIG_IP_ROUTE_MULTIPATH=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-CONFIG_NET_IPIP=m
-CONFIG_NET_IPGRE_DEMUX=m
-CONFIG_NET_IPGRE=m
-CONFIG_NET_IPGRE_BROADCAST=y
-CONFIG_IP_MROUTE=y
-CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
-CONFIG_IP_PIMSM_V1=y
-CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
-CONFIG_IPV6_SIT=m
-CONFIG_IPV6_GRE=m
-CONFIG_IPV6_MULTIPLE_TABLES=y
-CONFIG_IPV6_SUBTREES=y
-CONFIG_IPV6_MROUTE=y
-CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
-CONFIG_IPV6_PIMSM_V2=y
-CONFIG_NETWORK_PHY_TIMESTAMPING=y
-CONFIG_NETFILTER=y
-CONFIG_BRIDGE_NETFILTER=y
-CONFIG_NETFILTER_NETLINK_QUEUE=y
-CONFIG_NETFILTER_NETLINK_LOG=y
-CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_TABLES=y
-CONFIG_NF_TABLES_INET=y
-CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_CT=m
-CONFIG_NFT_CONNLIMIT=m
-CONFIG_NFT_LOG=m
-CONFIG_NFT_LIMIT=m
-CONFIG_NFT_MASQ=m
-CONFIG_NFT_REDIR=m
-CONFIG_NFT_NAT=m
-CONFIG_NFT_TUNNEL=m
-CONFIG_NFT_QUEUE=m
-CONFIG_NFT_REJECT=m
-CONFIG_NFT_COMPAT=m
-CONFIG_NFT_HASH=m
-CONFIG_NFT_SOCKET=m
-CONFIG_NFT_OSF=m
-CONFIG_NFT_DUP_NETDEV=m
-CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
-CONFIG_NETFILTER_XT_TARGET_LOG=m
-CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
-CONFIG_NETFILTER_XT_MATCH_BPF=m
-CONFIG_NETFILTER_XT_MATCH_CGROUP=m
-CONFIG_NETFILTER_XT_MATCH_COMMENT=m
-CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
-CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
-CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-CONFIG_NETFILTER_XT_MATCH_DSCP=m
-CONFIG_NETFILTER_XT_MATCH_HELPER=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-CONFIG_NETFILTER_XT_MATCH_MAC=m
-CONFIG_NETFILTER_XT_MATCH_MARK=m
-CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_AH=m
-CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_MANGLE=m
-CONFIG_IP6_NF_RAW=m
-CONFIG_IP6_NF_NAT=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
-CONFIG_IP6_NF_TARGET_NPT=m
-CONFIG_NF_TABLES_BRIDGE=m
-CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
-CONFIG_NF_CONNTRACK_BRIDGE=y
-CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
-CONFIG_BRIDGE_EBT_802_3=m
-CONFIG_BRIDGE_EBT_AMONG=m
-CONFIG_BRIDGE_EBT_ARP=m
-CONFIG_BRIDGE_EBT_IP=m
-CONFIG_BRIDGE_EBT_IP6=m
-CONFIG_BRIDGE_EBT_LIMIT=m
-CONFIG_BRIDGE_EBT_MARK=m
-CONFIG_BRIDGE_EBT_PKTTYPE=m
-CONFIG_BRIDGE_EBT_STP=m
-CONFIG_BRIDGE_EBT_VLAN=m
-CONFIG_BRIDGE_EBT_ARPREPLY=m
-CONFIG_BRIDGE_EBT_DNAT=m
-CONFIG_BRIDGE_EBT_MARK_T=m
-CONFIG_BRIDGE_EBT_REDIRECT=m
-CONFIG_BRIDGE_EBT_SNAT=m
-CONFIG_BRIDGE_EBT_LOG=m
-CONFIG_BRIDGE_EBT_NFLOG=m
-CONFIG_BRIDGE=y
-CONFIG_BRIDGE_VLAN_FILTERING=y
-CONFIG_BRIDGE_MRP=y
-CONFIG_BRIDGE_CFM=y
-CONFIG_VLAN_8021Q=y
-CONFIG_VLAN_8021Q_GVRP=y
-CONFIG_VLAN_8021Q_MVRP=y
-CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBS=m
-CONFIG_NET_SCH_ETF=m
-CONFIG_NET_SCH_TAPRIO=m
-CONFIG_NET_SCH_MQPRIO=m
-CONFIG_NET_SCH_INGRESS=m
-CONFIG_NET_CLS_BASIC=m
-CONFIG_NET_CLS_BPF=m
-CONFIG_NET_CLS_FLOWER=m
-CONFIG_NET_CLS_ACT=y
-CONFIG_NET_ACT_GACT=y
-CONFIG_NET_ACT_MIRRED=y
-CONFIG_NET_ACT_NAT=y
-CONFIG_NET_ACT_SKBEDIT=y
-CONFIG_NET_ACT_VLAN=y
-CONFIG_NET_ACT_BPF=y
-CONFIG_DCB=y
-CONFIG_NETLINK_DIAG=y
-CONFIG_MPLS=y
-CONFIG_NET_MPLS_GSO=y
-CONFIG_MPLS_ROUTING=m
-CONFIG_NET_PKTGEN=y
-CONFIG_BT=m
-# CONFIG_BT_LE is not set
-CONFIG_BT_LEDS=y
-# CONFIG_BT_DEBUGFS is not set
-CONFIG_BT_HCIBTUSB=m
-CONFIG_BT_HCIUART=m
-CONFIG_BT_HCIUART_LL=y
-CONFIG_BT_HCIUART_BCM=y
-CONFIG_BT_HCIUART_QCA=y
-CONFIG_CFG80211=y
-CONFIG_MAC80211=y
-CONFIG_MAC80211_LEDS=y
-CONFIG_RFKILL=y
-CONFIG_NET_9P=y
-CONFIG_NET_9P_VIRTIO=y
-CONFIG_PCI=y
-CONFIG_PCIEPORTBUS=y
-CONFIG_PCI_IOV=y
-CONFIG_PCI_PASID=y
-CONFIG_HOTPLUG_PCI=y
-CONFIG_HOTPLUG_PCI_ACPI=y
-CONFIG_PCI_HOST_GENERIC=y
-CONFIG_PCIE_ROCKCHIP_HOST=m
-CONFIG_PCIE_ROCKCHIP_DW_HOST=y
-CONFIG_PCI_ENDPOINT=y
-CONFIG_PCI_ENDPOINT_CONFIGFS=y
-CONFIG_PCI_EPF_TEST=m
-CONFIG_DEVTMPFS=y
-CONFIG_DEVTMPFS_MOUNT=y
-CONFIG_FW_LOADER_USER_HELPER=y
-CONFIG_VEXPRESS_CONFIG=y
-CONFIG_ARM_SCMI_PROTOCOL=y
-CONFIG_ARM_SCPI_PROTOCOL=y
-CONFIG_EFI_CAPSULE_LOADER=y
-CONFIG_MTD=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_CFI_ADV_OPTIONS=y
-CONFIG_MTD_CFI_INTELEXT=y
-CONFIG_MTD_CFI_AMDSTD=y
-CONFIG_MTD_CFI_STAA=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_PHYSMAP_OF=y
-CONFIG_MTD_DATAFLASH=y
-CONFIG_MTD_SST25L=y
-CONFIG_MTD_BLOCK2MTD=y
-CONFIG_MTD_RAW_NAND=y
-CONFIG_MTD_NAND_DENALI_DT=y
-CONFIG_MTD_SPI_NOR=y
-CONFIG_OF_OVERLAY=y
-CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_NBD=m
-CONFIG_VIRTIO_BLK=y
-CONFIG_BLK_DEV_NVME=m
-CONFIG_SRAM=y
-CONFIG_PCI_ENDPOINT_TEST=m
-CONFIG_EEPROM_AT24=m
-CONFIG_EEPROM_AT25=m
-CONFIG_UACCE=m
-# CONFIG_SCSI_PROC_FS is not set
-CONFIG_BLK_DEV_SD=y
-CONFIG_SCSI_SAS_ATA=y
-CONFIG_SCSI_HISI_SAS=y
-CONFIG_SCSI_HISI_SAS_PCI=y
-CONFIG_MEGARAID_SAS=y
-CONFIG_SCSI_MPT3SAS=m
-CONFIG_SCSI_VIRTIO=y
-CONFIG_ATA=y
-CONFIG_SATA_AHCI=y
-CONFIG_SATA_AHCI_PLATFORM=y
-CONFIG_AHCI_CEVA=y
-CONFIG_SATA_SIL24=y
-CONFIG_PATA_OF_PLATFORM=y
-CONFIG_MD=y
-# CONFIG_MD_BITMAP_FILE is not set
-CONFIG_BLK_DEV_DM=y
-CONFIG_DM_INIT=y
-CONFIG_DM_VERITY=y
-CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
-CONFIG_NETDEVICES=y
-CONFIG_BONDING=m
-CONFIG_DUMMY=m
-CONFIG_WIREGUARD=m
-CONFIG_MACVLAN=m
-CONFIG_MACVTAP=m
-CONFIG_IPVLAN=m
-CONFIG_IPVTAP=m
-CONFIG_VXLAN=m
-CONFIG_GENEVE=m
-CONFIG_BAREUDP=m
-CONFIG_MACSEC=m
-CONFIG_TUN=m
-CONFIG_VETH=m
-CONFIG_VIRTIO_NET=y
-CONFIG_NLMON=y
-CONFIG_NET_VRF=y
-# CONFIG_NET_VENDOR_3COM is not set
-# CONFIG_NET_VENDOR_ADAPTEC is not set
-# CONFIG_NET_VENDOR_AGERE is not set
-# CONFIG_NET_VENDOR_ALACRITECH is not set
-# CONFIG_NET_VENDOR_ALTEON is not set
-# CONFIG_NET_VENDOR_AMAZON is not set
-# CONFIG_NET_VENDOR_AMD is not set
-# CONFIG_NET_VENDOR_AQUANTIA is not set
-# CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_VENDOR_ASIX is not set
-CONFIG_ATL2=m
-CONFIG_ALX=m
-# CONFIG_NET_VENDOR_BROADCOM is not set
-# CONFIG_NET_VENDOR_CADENCE is not set
-# CONFIG_NET_VENDOR_CAVIUM is not set
-# CONFIG_NET_VENDOR_CHELSIO is not set
-# CONFIG_NET_VENDOR_CISCO is not set
-# CONFIG_NET_VENDOR_CORTINA is not set
-# CONFIG_NET_VENDOR_DEC is not set
-# CONFIG_NET_VENDOR_DLINK is not set
-# CONFIG_NET_VENDOR_EMULEX is not set
-# CONFIG_NET_VENDOR_EZCHIP is not set
-# CONFIG_NET_VENDOR_GOOGLE is not set
-# CONFIG_NET_VENDOR_HISILICON is not set
-# CONFIG_NET_VENDOR_HUAWEI is not set
-# CONFIG_NET_VENDOR_INTEL is not set
-# CONFIG_NET_VENDOR_LITEX is not set
-# CONFIG_NET_VENDOR_MARVELL is not set
-# CONFIG_NET_VENDOR_MELLANOX is not set
-# CONFIG_NET_VENDOR_MICREL is not set
-# CONFIG_NET_VENDOR_MICROCHIP is not set
-# CONFIG_NET_VENDOR_MICROSEMI is not set
-# CONFIG_NET_VENDOR_MICROSOFT is not set
-# CONFIG_NET_VENDOR_MYRI is not set
-# CONFIG_NET_VENDOR_NI is not set
-# CONFIG_NET_VENDOR_NATSEMI is not set
-# CONFIG_NET_VENDOR_NETERION is not set
-# CONFIG_NET_VENDOR_NETRONOME is not set
-# CONFIG_NET_VENDOR_NVIDIA is not set
-# CONFIG_NET_VENDOR_OKI is not set
-# CONFIG_NET_VENDOR_PACKET_ENGINES is not set
-# CONFIG_NET_VENDOR_PENSANDO is not set
-# CONFIG_NET_VENDOR_QLOGIC is not set
-# CONFIG_NET_VENDOR_BROCADE is not set
-# CONFIG_NET_VENDOR_QUALCOMM is not set
-# CONFIG_NET_VENDOR_RDC is not set
-CONFIG_8139CP=m
-CONFIG_8139TOO=m
-# CONFIG_8139TOO_PIO is not set
-CONFIG_R8169=m
-# CONFIG_NET_VENDOR_RENESAS is not set
-# CONFIG_NET_VENDOR_ROCKER is not set
-# CONFIG_NET_VENDOR_SAMSUNG is not set
-# CONFIG_NET_VENDOR_SEEQ is not set
-# CONFIG_NET_VENDOR_SILAN is not set
-# CONFIG_NET_VENDOR_SIS is not set
-# CONFIG_NET_VENDOR_SOLARFLARE is not set
-# CONFIG_NET_VENDOR_SMSC is not set
-# CONFIG_NET_VENDOR_SOCIONEXT is not set
-CONFIG_STMMAC_ETH=y
-# CONFIG_DWMAC_GENERIC is not set
-# CONFIG_NET_VENDOR_SUN is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
-# CONFIG_NET_VENDOR_TEHUTI is not set
-# CONFIG_NET_VENDOR_TI is not set
-# CONFIG_NET_VENDOR_VIA is not set
-# CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_XILINX is not set
-CONFIG_LED_TRIGGER_PHY=y
-CONFIG_AX88796B_PHY=y
-CONFIG_DAVICOM_PHY=m
-CONFIG_REALTEK_PHY=y
-CONFIG_ROCKCHIP_PHY=y
-CONFIG_MDIO_BITBANG=y
-CONFIG_MDIO_BUS_MUX_MULTIPLEXER=y
-CONFIG_MDIO_BUS_MUX_MMIOREG=y
-CONFIG_USB_RTL8150=m
-CONFIG_USB_RTL8152=m
-CONFIG_USB_USBNET=y
-CONFIG_USB_NET_AX8817X=m
-CONFIG_USB_NET_AX88179_178A=m
-CONFIG_USB_NET_CDC_NCM=m
-CONFIG_USB_NET_DM9601=m
-CONFIG_USB_NET_SMSC75XX=m
-CONFIG_USB_NET_SMSC95XX=m
-CONFIG_USB_NET_NET1080=m
-CONFIG_USB_NET_PLUSB=m
-CONFIG_USB_NET_MCS7830=m
-CONFIG_USB_NET_CDC_SUBSET=m
-# CONFIG_USB_NET_ZAURUS is not set
-CONFIG_ATH10K=m
-CONFIG_ATH10K_PCI=m
-CONFIG_WCN36XX=m
-# CONFIG_WLAN_VENDOR_ATMEL is not set
-# CONFIG_WLAN_VENDOR_BROADCOM is not set
-# CONFIG_WLAN_VENDOR_INTEL is not set
-# CONFIG_WLAN_VENDOR_INTERSIL is not set
-# CONFIG_WLAN_VENDOR_MARVELL is not set
-# CONFIG_WLAN_VENDOR_MEDIATEK is not set
-CONFIG_RTL8180=m
-CONFIG_RTL8187=m
-CONFIG_RTL_CARDS=m
-CONFIG_RTL8192CE=m
-CONFIG_RTL8192SE=m
-CONFIG_RTL8192DE=m
-CONFIG_RTL8723AE=m
-CONFIG_RTL8723BE=m
-CONFIG_RTL8188EE=m
-CONFIG_RTL8192EE=m
-CONFIG_RTL8821AE=m
-CONFIG_RTL8192CU=m
-CONFIG_RTL8XXXU=m
-CONFIG_RTL8XXXU_UNTESTED=y
-CONFIG_RTW88=m
-CONFIG_RTW88_8822BE=m
-CONFIG_RTW88_8822BS=m
-CONFIG_RTW88_8822BU=m
-CONFIG_RTW88_8822CE=m
-CONFIG_RTW88_8822CS=m
-CONFIG_RTW88_8822CU=m
-CONFIG_RTW88_8723DE=m
-CONFIG_RTW88_8723DS=m
-CONFIG_RTW88_8723DU=m
-CONFIG_RTW88_8821CE=m
-CONFIG_RTW88_8821CS=m
-CONFIG_RTW88_8821CU=m
-CONFIG_RTW88_DEBUG=y
-CONFIG_RTW89=m
-CONFIG_RTW89_8851BE=m
-CONFIG_RTW89_8852AE=m
-CONFIG_RTW89_8852BE=m
-CONFIG_RTW89_8852CE=m
-CONFIG_RTW89_DEBUGMSG=y
-# CONFIG_WLAN_VENDOR_RSI is not set
-# CONFIG_WLAN_VENDOR_TI is not set
-# CONFIG_WLAN_VENDOR_ZYDAS is not set
-# CONFIG_WLAN_VENDOR_QUANTENNA is not set
-CONFIG_INPUT_FF_MEMLESS=y
-CONFIG_INPUT_EVDEV=y
-CONFIG_INPUT_EVBUG=y
-CONFIG_KEYBOARD_GPIO=y
-CONFIG_KEYBOARD_GPIO_POLLED=y
-# CONFIG_INPUT_MOUSE is not set
-CONFIG_INPUT_MISC=y
-CONFIG_INPUT_RK805_PWRKEY=y
-# CONFIG_SERIO_SERPORT is not set
-CONFIG_SERIO_AMBAKMI=y
-CONFIG_VT_HW_CONSOLE_BINDING=y
-CONFIG_LEGACY_PTY_COUNT=16
-CONFIG_SERIAL_8250=y
-CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_EXTENDED=y
-CONFIG_SERIAL_8250_SHARE_IRQ=y
-CONFIG_SERIAL_8250_DW=y
-CONFIG_SERIAL_8250_RT288X=y
-CONFIG_SERIAL_OF_PLATFORM=y
-CONFIG_SERIAL_AMBA_PL010=y
-CONFIG_SERIAL_AMBA_PL010_CONSOLE=y
-CONFIG_SERIAL_AMBA_PL011=y
-CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
-CONFIG_SERIAL_DEV_BUS=y
-CONFIG_VIRTIO_CONSOLE=y
-CONFIG_HW_RANDOM_VIRTIO=m
-CONFIG_TCG_TPM=y
-CONFIG_TCG_TIS_I2C_INFINEON=y
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_MUX=y
-CONFIG_I2C_MUX_PCA954x=y
-CONFIG_I2C_GPIO=m
-CONFIG_I2C_RK3X=y
-CONFIG_I2C_SLAVE=y
-CONFIG_SPI=y
-CONFIG_SPI_BITBANG=m
-CONFIG_SPI_CADENCE_QUADSPI=y
-CONFIG_SPI_DESIGNWARE=m
-CONFIG_SPI_DW_DMA=y
-CONFIG_SPI_DW_MMIO=m
-CONFIG_SPI_PL022=y
-CONFIG_SPI_ROCKCHIP=y
-CONFIG_SPI_SPIDEV=m
-CONFIG_SPMI=y
-CONFIG_PPS=y
-# CONFIG_PTP_1588_CLOCK is not set
-CONFIG_DEBUG_PINCTRL=y
-CONFIG_PINCTRL_RK805=y
-CONFIG_PINCTRL_SINGLE=y
-CONFIG_GPIO_SYSFS=y
-CONFIG_GPIO_GENERIC_PLATFORM=y
-CONFIG_GPIO_MAX732X=y
-CONFIG_GPIO_PCA953X=y
-CONFIG_GPIO_PCA953X_IRQ=y
-CONFIG_POWER_RESET_GPIO_RESTART=y
-CONFIG_POWER_RESET_SYSCON=y
-CONFIG_SYSCON_REBOOT_MODE=y
-CONFIG_CHARGER_RK817=y
-CONFIG_SENSORS_ARM_SCMI=y
-CONFIG_SENSORS_ARM_SCPI=y
-CONFIG_SENSORS_PWM_FAN=m
-CONFIG_CPU_THERMAL=y
-CONFIG_THERMAL_EMULATION=y
-CONFIG_ROCKCHIP_THERMAL=m
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_SYSFS=y
-CONFIG_SOFT_WATCHDOG=y
-CONFIG_MFD_RK8XX_I2C=y
-CONFIG_MFD_RK8XX_SPI=y
-# CONFIG_MFD_VEXPRESS_SYSREG is not set
-CONFIG_REGULATOR=y
-CONFIG_REGULATOR_DEBUG=y
-CONFIG_REGULATOR_FIXED_VOLTAGE=y
-CONFIG_REGULATOR_USERSPACE_CONSUMER=y
-CONFIG_REGULATOR_NETLINK_EVENTS=y
-CONFIG_REGULATOR_GPIO=y
-CONFIG_REGULATOR_PWM=y
-CONFIG_REGULATOR_RK808=y
-CONFIG_REGULATOR_VCTRL=y
-# CONFIG_HID_SUPPORT is not set
-CONFIG_USB_ULPI_BUS=y
-CONFIG_USB_CONN_GPIO=y
-CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
-CONFIG_USB_DYNAMIC_MINORS=y
-CONFIG_USB_OTG=y
-CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_EHCI_HCD=y
-CONFIG_USB_EHCI_ROOT_HUB_TT=y
-CONFIG_USB_EHCI_HCD_PLATFORM=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_OHCI_HCD_PLATFORM=y
-CONFIG_USB_ACM=m
-CONFIG_USB_STORAGE=y
-CONFIG_USB_MUSB_HDRC=y
-CONFIG_USB_DWC3=y
-CONFIG_USB_DWC2=y
-CONFIG_USB_SERIAL=m
-CONFIG_USB_SERIAL_GENERIC=y
-CONFIG_USB_SERIAL_SIMPLE=m
-CONFIG_USB_SERIAL_CP210X=m
-CONFIG_USB_SERIAL_FTDI_SIO=m
-CONFIG_USB_SERIAL_PL2303=m
-CONFIG_USB_SERIAL_OPTION=m
-CONFIG_NOP_USB_XCEIV=y
-CONFIG_USB_ULPI=y
-CONFIG_USB_GADGET=y
-CONFIG_USB_SNP_UDC_PLAT=y
-CONFIG_USB_BDC_UDC=y
-CONFIG_USB_CONFIGFS=m
-CONFIG_USB_CONFIGFS_SERIAL=y
-CONFIG_USB_CONFIGFS_ACM=y
-CONFIG_USB_CONFIGFS_OBEX=y
-CONFIG_USB_CONFIGFS_NCM=y
-CONFIG_USB_CONFIGFS_ECM=y
-CONFIG_USB_CONFIGFS_ECM_SUBSET=y
-CONFIG_USB_CONFIGFS_RNDIS=y
-CONFIG_USB_CONFIGFS_EEM=y
-CONFIG_USB_CONFIGFS_MASS_STORAGE=y
-CONFIG_USB_CONFIGFS_F_FS=y
-CONFIG_MMC=y
-CONFIG_MMC_BLOCK_MINORS=32
-CONFIG_MMC_ARMMMCI=y
-CONFIG_MMC_SDHCI=y
-CONFIG_MMC_SDHCI_ACPI=y
-CONFIG_MMC_SDHCI_PLTFM=y
-CONFIG_MMC_SDHCI_OF_ARASAN=y
-CONFIG_MMC_SDHCI_CADENCE=y
-CONFIG_MMC_SDHCI_F_SDH30=y
-CONFIG_MMC_SPI=y
-CONFIG_MMC_DW=y
-CONFIG_MMC_DW_HI3798CV200=y
-CONFIG_MMC_DW_K3=y
-CONFIG_MMC_DW_ROCKCHIP=y
-CONFIG_SCSI_UFSHCD=y
-CONFIG_SCSI_UFSHCD_PLATFORM=y
-CONFIG_NEW_LEDS=y
-CONFIG_LEDS_CLASS=y
-CONFIG_LEDS_CLASS_FLASH=y
-CONFIG_LEDS_CLASS_MULTICOLOR=y
-CONFIG_LEDS_GPIO=y
-CONFIG_LEDS_PWM=y
-CONFIG_LEDS_SYSCON=y
-CONFIG_LEDS_TRIGGER_TIMER=y
-CONFIG_LEDS_TRIGGER_DISK=y
-CONFIG_LEDS_TRIGGER_HEARTBEAT=y
-CONFIG_LEDS_TRIGGER_CPU=y
-CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
-CONFIG_LEDS_TRIGGER_PANIC=y
-CONFIG_LEDS_TRIGGER_NETDEV=y
-CONFIG_RTC_CLASS=y
-CONFIG_RTC_DRV_RK808=y
-CONFIG_RTC_DRV_EFI=y
-CONFIG_RTC_DRV_PL030=y
-CONFIG_RTC_DRV_PL031=y
-CONFIG_DMADEVICES=y
-CONFIG_PL330_DMA=y
-CONFIG_SYNC_FILE=y
-CONFIG_VIRTIO_PCI=y
-CONFIG_VIRTIO_BALLOON=y
-CONFIG_VIRTIO_INPUT=y
-CONFIG_VIRTIO_MMIO=y
-# CONFIG_VHOST_MENU is not set
-CONFIG_STAGING=y
-CONFIG_RTLLIB=m
-CONFIG_RTL8192E=m
-CONFIG_RTL8723BS=m
-CONFIG_R8712U=m
-CONFIG_RTS5208=m
-# CONFIG_SURFACE_PLATFORMS is not set
-CONFIG_COMMON_CLK_SCMI=y
-CONFIG_COMMON_CLK_SCPI=y
-CONFIG_COMMON_CLK_PWM=y
-CONFIG_HWSPINLOCK=y
-# CONFIG_FSL_ERRATUM_A008585 is not set
-# CONFIG_HISILICON_ERRATUM_161010101 is not set
-# CONFIG_ARM64_ERRATUM_858921 is not set
-CONFIG_ARM_MHU=y
-CONFIG_PLATFORM_MHU=y
-CONFIG_IOMMU_IO_PGTABLE_ARMV7S=y
-CONFIG_ROCKCHIP_IOMMU=y
-CONFIG_ARM_SMMU=y
-CONFIG_ARM_SMMU_V3=y
-CONFIG_ROCKCHIP_IODOMAIN=y
-CONFIG_ROCKCHIP_DTPM=m
-CONFIG_ROCKCHIP_PM_DOMAINS=y
-CONFIG_DEVFREQ_GOV_USERSPACE=m
-CONFIG_EXTCON_USB_GPIO=y
-CONFIG_MEMORY=y
-CONFIG_IIO=y
-CONFIG_MAX9611=m
-CONFIG_ROCKCHIP_SARADC=m
-CONFIG_IIO_ST_LSM6DSX=m
-CONFIG_SENSORS_ISL29018=m
-CONFIG_VCNL4000=m
-CONFIG_IIO_ST_MAGN_3AXIS=m
-CONFIG_MPL3115=m
-CONFIG_PWM=y
-CONFIG_PWM_ROCKCHIP=y
-CONFIG_RESET_GPIO=y
-CONFIG_PHY_ROCKCHIP_DPHY_RX0=m
-CONFIG_PHY_ROCKCHIP_EMMC=y
-CONFIG_PHY_ROCKCHIP_INNO_HDMI=m
-CONFIG_PHY_ROCKCHIP_INNO_USB2=y
-CONFIG_PHY_ROCKCHIP_INNO_CSIDPHY=m
-CONFIG_PHY_ROCKCHIP_INNO_DSIDPHY=m
-CONFIG_PHY_ROCKCHIP_PCIE=m
-CONFIG_PHY_ROCKCHIP_TYPEC=y
-CONFIG_PHY_ROCKCHIP_USB=m
-CONFIG_POWERCAP=y
-CONFIG_ARM_SCMI_POWERCAP=y
-CONFIG_DTPM=y
-CONFIG_ARM_SMMU_V3_PMU=m
-CONFIG_NVMEM_RMEM=m
-CONFIG_NVMEM_ROCKCHIP_EFUSE=m
-CONFIG_NVMEM_ROCKCHIP_OTP=m
-CONFIG_TEE=y
-CONFIG_OPTEE=y
-CONFIG_MUX_MMIO=y
-CONFIG_INTERCONNECT=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-CONFIG_EXT4_FS_POSIX_ACL=y
-CONFIG_BTRFS_FS=y
-CONFIG_BTRFS_FS_POSIX_ACL=y
-CONFIG_FANOTIFY=y
-CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
-CONFIG_QUOTA=y
-CONFIG_AUTOFS_FS=y
-CONFIG_FUSE_FS=y
-CONFIG_VIRTIO_FS=y
-CONFIG_OVERLAY_FS=y
-CONFIG_MSDOS_FS=y
-CONFIG_VFAT_FS=y
-CONFIG_FAT_DEFAULT_UTF8=y
-CONFIG_EXFAT_FS=y
-CONFIG_PROC_KCORE=y
-CONFIG_PROC_CHILDREN=y
-CONFIG_TMPFS=y
-CONFIG_TMPFS_POSIX_ACL=y
-CONFIG_HUGETLBFS=y
-CONFIG_EFIVAR_FS=y
-CONFIG_JFFS2_FS=y
-CONFIG_JFFS2_FS_XATTR=y
-CONFIG_SQUASHFS=y
-CONFIG_SQUASHFS_LZO=y
-CONFIG_SQUASHFS_XZ=y
-CONFIG_SQUASHFS_ZSTD=y
-CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
-CONFIG_NFS_V4_1=y
-CONFIG_NFS_V4_2=y
-CONFIG_ROOT_NFS=y
-CONFIG_9P_FS=y
-CONFIG_NLS_DEFAULT="iso8859-15"
-CONFIG_NLS_CODEPAGE_437=y
-CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_ISO8859_15=y
-CONFIG_NLS_UTF8=y
-CONFIG_SECURITY=y
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_CURVE25519=m
-CONFIG_CRYPTO_ECHAINIV=y
-CONFIG_CRYPTO_LZO=y
-CONFIG_CRYPTO_ZSTD=y
-CONFIG_CRYPTO_ANSI_CPRNG=y
-CONFIG_CRYPTO_USER_API_RNG=m
-CONFIG_CRYPTO_GHASH_ARM64_CE=y
-CONFIG_CRYPTO_SHA1_ARM64_CE=y
-CONFIG_CRYPTO_SHA2_ARM64_CE=y
-CONFIG_CRYPTO_SHA512_ARM64_CE=m
-CONFIG_CRYPTO_SHA3_ARM64=m
-CONFIG_CRYPTO_SM3_ARM64_CE=m
-CONFIG_CRYPTO_AES_ARM64_BS=m
-CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
-CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=m
-CONFIG_CRYPTO_DEV_ROCKCHIP=y
-CONFIG_CRYPTO_DEV_CCREE=m
-CONFIG_PACKING=y
-CONFIG_INDIRECT_PIO=y
-CONFIG_CRC_CCITT=m
-CONFIG_CRC8=y
-CONFIG_DMA_CMA=y
-CONFIG_CMA_SIZE_MBYTES=32
-CONFIG_PRINTK_TIME=y
-CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
-CONFIG_MAGIC_SYSRQ=y
-CONFIG_DEBUG_FS=y
-CONFIG_DETECT_HUNG_TASK=y
-# CONFIG_SCHED_DEBUG is not set
-CONFIG_FUNCTION_TRACER=y
-CONFIG_MEMTEST=y

board/aarch64/r2s/post-build.sh

@@ -1,5 +0,0 @@
-#!/bin/sh
-
-BOARD_DIR="$(dirname $0)"
-
-install -m 0644 -D $BOARD_DIR/extlinux.conf $TARGET_DIR/boot/extlinux/extlinux.conf

board/aarch64/r2s/rootfs/etc/factory-config.cfg

@@ -1,206 +0,0 @@
-{
-  "ieee802-dot1ab-lldp:lldp": {
-    "infix-lldp:enabled": true
-  },
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "lo",
-        "type": "infix-if-type:loopback",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "127.0.0.1",
-              "prefix-length": 8
-            }
-          ]
-        },
-        "ietf-ip:ipv6": {
-          "address": [
-            {
-              "ip": "::1",
-              "prefix-length": 128
-            }
-          ]
-        }
-      },
-      {
-        "name": "lan",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "192.168.2.1",
-              "prefix-length": 24
-            }
-          ]
-        },
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "wan",
-        "type": "infix-if-type:ethernet"
-      }
-    ]
-  },
-  "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
-        }
-      ]
-    }
-  },
-  "ietf-netconf-acm:nacm": {
-    "enable-nacm": true,
-    "groups": {
-      "group": [
-        {
-          "name": "admin",
-          "user-name": [
-            "admin"
-          ]
-        }
-      ]
-    },
-    "rule-list": [
-      {
-        "name": "admin-acl",
-        "group": [
-          "admin"
-        ],
-        "rule": [
-          {
-            "name": "permit-all",
-            "module-name": "*",
-            "access-operations": "*",
-            "action": "permit",
-            "comment": "Allow 'admin' group complete access to all operations and data."
-          }
-        ]
-      },
-      {
-        "name": "default-deny-all",
-        "group": [
-          "*"
-        ],
-        "rule": [
-          {
-            "name":  "deny-password-read",
-            "module-name": "ietf-system",
-            "path": "/ietf-system:system/authentication/user/password",
-            "access-operations": "*",
-            "action": "deny"
-          }
-        ]
-      }
-    ]
-  },
-  "ietf-netconf-server:netconf-server": {
-    "listen": {
-      "endpoints": {
-        "endpoint": [
-          {
-            "name": "default-ssh",
-            "ssh": {
-              "tcp-server-parameters": {
-                "local-address": "::"
-              },
-              "ssh-server-parameters": {
-                "server-identity": {
-                  "host-key": [
-                    {
-                      "name": "default-key",
-                      "public-key": {
-                        "central-keystore-reference": "genkey"
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        ]
-      }
-    }
-  },
-  "ietf-system:system": {
-    "hostname": "r2s",
-    "ntp": {
-      "enabled": true,
-      "server": [
-        {
-          "name": "ntp.org",
-          "udp": {
-            "address": "pool.ntp.org"
-          },
-	  "iburst": true
-        }
-      ]
-    },
-    "authentication": {
-      "user": [
-        {
-          "name": "admin",
-          "password": "$factory$",
-          "infix-system:shell": "bash"
-        }
-      ]
-    },
-    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
-  },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
-      {
-        "if-name": "wan",
-        "option": [
-          {
-            "name": "broadcast"
-          },
-          {
-            "name": "dns"
-          },
-          {
-            "name": "domain"
-          },
-          {
-            "name": "hostname"
-          },
-          {
-            "name": "ntpsrv"
-          },
-          {
-            "name": "router"
-          },
-          {
-            "name": "subnet"
-          }
-        ]
-      }
-    ]
-  },
-  "infix-meta:meta": {
-    "infix-meta:version": "1.2"
-  },
-  "infix-services:mdns": {
-    "enabled": true
-  },
-  "infix-services:web": {
-    "enabled": true,
-    "console": {
-      "enabled": true
-    },
-    "netbrowse": {
-      "enabled": true
-    },
-    "restconf": {
-      "enabled": true
-    }
-  }
-}

board/aarch64/raspberry-pi-4/README.md

@@ -1,46 +0,0 @@
-# Raspberry Pi 4 b
-
-## Support level
-Full support for base board but not any extension board on the
-GPIOs.
-
-### Touch screen
-The [Raspberry Pi touch display v1][RPI-TOUCH] is supported, including
-touch functionality. There are multiple touchscreens on the market for
-Raspberry Pi, but only the official (first version with 800x480
-resolution) is currently supported. Infix supplies all drivers
-required to utilize the hardware, but you need to add the actual
-graphical application in a container.
-
-There are some important considerations you need to know about when
-using Infix for graphical applications. The container needs access to
-/dev/dri/ to be able to access the graphics card, and it also needs
-access to /run/udev to be able to find the input devices.
-
-Example of running Doom in Infix:
-
-```cli
-	admin@example:/> configure
-	admin@example:/config/> edit container doom
-	admin@example:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
-	admin@example:/config/container/doom/> set privileged
-	admin@example:/config/container/doom/> edit mount udev
-	admin@example:/config/container/doom/mount/udev/> set type bind
-	admin@example:/config/container/doom/mount/udev/> set target /run/udev/
-	admin@example:/config/container/doom/mount/udev/> set source /run/udev/
-	admin@example:/config/container/doom/mount/udev/> end
-	admin@example:/config/container/doom/mount/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
-	admin@example:/config/container/doom/mount/xorg.conf/> set target /etc/X11/xorg.conf
-	admin@example:/config/container/doom/mount/xorg.conf/> end
-	admin@example:/config/container/doom/> edit volume var
-	admin@example:/config/container/doom/volume/var/> set target /var
-	admin@example:/config/container/doom/volume/var/> leave
-	admin@example:/>
-
-```
-
-### Pre-built images
-SD card image: [infix-rpi4-sdcard.img](https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi4-sdcard.img)
-
-
-[RPI-TOUCH]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/

board/aarch64/raspberrypi-rpi64/Config.in

@@ -0,0 +1,12 @@
+config BR2_PACKAGE_RASPBERRYPI_RPI64
+	bool "Raspberry Pi 64-bit (RPi3 and later)"
+	depends on BR2_aarch64
+	select SDCARD_AUX
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+
+	help
+	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
+	  of single-board computers (SBC), RPi 3B and later, including the
+	  Raspberry Pi 2W, which shares the same CPU core as RPi 3B.

board/aarch64/raspberrypi-rpi64/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2025 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

board/aarch64/raspberrypi-rpi64/README.md

@@ -0,0 +1,59 @@
+# Raspberry Pi 3B/4B
+
+## Support level
+
+Full support for base board but not any extension board on the GPIOs.
+Other RPi boards of the same generation may work as well, but may need
+some additional testing/work.  A few CM4 variants have been tested and
+seem to work as expected, but YMMV as always.
+
+### Touch screen
+
+The [Raspberry Pi touch display v1][0] is supported on the 4B, including
+touch functionality.  There are multiple touchscreens on the market for
+Raspberry Pi, but currently only the official first version with 800x480
+resolution is supported.  Infix supplies all drivers required to utilize
+the hardware, but you need to add the actual graphical application in a
+container.
+
+There are some important considerations you need to know about when
+using Infix for graphical applications.  The container needs access to
+`/dev/dri/` to be able to access the graphics card, it also need access
+to `/run/udev` to be able to find the input devices.
+
+Example of running Doom in Infix:
+
+```
+admin@example:/> configure
+admin@example:/config/> edit container doom
+admin@example:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
+admin@example:/config/container/doom/> set privileged
+admin@example:/config/container/doom/> edit mount udev
+admin@example:/config/container/doom/mount/udev/> set type bind
+admin@example:/config/container/doom/mount/udev/> set target /run/udev/
+admin@example:/config/container/doom/mount/udev/> set source /run/udev/
+admin@example:/config/container/doom/mount/udev/> end
+admin@example:/config/container/doom/mount/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
+admin@example:/config/container/doom/mount/xorg.conf/> set target /etc/X11/xorg.conf
+admin@example:/config/container/doom/mount/xorg.conf/> end
+admin@example:/config/container/doom/> edit volume var
+admin@example:/config/container/doom/volume/var/> set target /var
+admin@example:/config/container/doom/volume/var/> leave
+admin@example:/>
+```
+
+> [!NOTE]
+> The `xorg.conf` [content mount][2] is a nifty detail of Infix that
+> allows you to keep all the relevant configuration in a single file.
+> The deta is "simply" `base64` encoded, so you do not really need the
+> features of the Infix CLI, everything can be set up remotely [using
+> `curl`][3] if you like.
+
+### Pre-built images
+
+Pre-built SD card images are available here: [infix-rpi64-sdcard.img][sdcard]
+
+[0]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
+[1]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
+[2]: https://kernelkit.org/infix/latest/container/#content-mounts
+[3]: https://kernelkit.org/infix/latest/scripting-restconf/