WiP: Example on howto use restconf notifications

Start script with ./subscribe_ietf_system.py --url "https://10.10.10.100" --user admin --password admin --no-verify-ssl --no-filter
2026-07-26 18:53:01 +02:00 · 2025-12-18 12:31:54 +01:00
777 changed files with 13446 additions and 49989 deletions
@@ -1,10 +1,8 @@
 Limited free support is only available using the online resources of the
-project on GitHub, and Discord, see <https://github.com/kernelkit/infix>:
+project on GitHub, and Discord, see <https://github.com/kernelkit>:

-&nbsp;&nbsp; :house: <https://www.kernelkit.org> — home page, blog, news, howto's and tutorials  
-&nbsp;&nbsp; :package: <https://github.com/kernelkit/infix/releases/latest> — latest release  
 &nbsp;&nbsp; :speech_balloon: <https://github.com/orgs/kernelkit/discussions>  
-&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>  
+&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>

 Support contracts, development of new features, fast-tracking of reviews
 and contributions, customer branding of Infix, and even customer specific
@@ -19,15 +19,10 @@ jobs:
          - aarch64_qemu_boot
          - bpi_r3_sd_boot
          - bpi_r3_emmc_boot
-          - bpi_r64_sd_boot
-          - bpi_r64_emmc_boot
          - cn9130_crb_boot
          - fireant_boot
          - nanopi_r2s_boot
-          - rpi2_boot
          - rpi64_boot
-          - sama7g54_ek_emmc_boot
-          - sama7g54_ek_sd_boot
    env:
      MAKEFLAGS: -j5
    steps:
@@ -68,11 +63,24 @@ jobs:

          echo "Building ${defconfig}_defconfig, version ${version}-${rev}, artifact ${archive} ..."

-      - uses: kernelkit/actions/cache-restore@v1
+      - name: Restore Cache of dl/
+        uses: actions/cache@v4
        with:
-          target: ${{ matrix.defconfig }}
-          dl-prefix: dl-boot
-          ccache-prefix: ccache-boot
+          path: dl/
+          key: dl-boot-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-boot-
+            dl-
+
+      - name: Restore Cache of .ccache/
+        uses: actions/cache@v4
+        with:
+          path: .ccache/
+          key: ccache-boot-${{ matrix.defconfig }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-boot-${{ matrix.defconfig }}-
+            ccache-boot-
+            ccache-

      - name: Configure ${{ matrix.defconfig }}_defconfig
        run: |
@@ -8,13 +8,14 @@ on:
        type: choice
        required: true
        options:
-          - raspberrypi-rpi2
          - raspberrypi-rpi64
          - bananapi-bpi-r3
-          - bananapi-bpi-r64
          - friendlyarm-nanopi-r2s
-          - microchip-sama7g54-ek
        default: 'raspberrypi-rpi64'
+      use_latest_release:
+        description: 'Use latest release artifacts instead of workflow artifacts'
+        type: boolean
+        default: false

 jobs:
  create-image:
@@ -52,45 +53,28 @@ jobs:
      - name: Set bootloader and target based on board
        run: |
          case "${{ inputs.board }}" in
-            raspberrypi-rpi2)
-              echo "BOOTLOADER=rpi2-boot" >> $GITHUB_ENV
-              echo "ARCH=arm" >> $GITHUB_ENV
-              echo "BUILD_EMMC=false" >> $GITHUB_ENV
-              ;;
            raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=false" >> $GITHUB_ENV
              ;;
            bananapi-bpi-r3)
-              echo "BOOTLOADER_SD=bpi-r3-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r3-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
-              ;;
-            bananapi-bpi-r64)
-              echo "BOOTLOADER_SD=bpi-r64-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r64-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER_SD=bpi_r3_sd_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi_r3_emmc_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=true" >> $GITHUB_ENV
              ;;
            friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=false" >> $GITHUB_ENV
              ;;
-            microchip-sama7g54-ek)
-              echo "BOOTLOADER_SD=sama7g54-ek-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=sama7g54-ek-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=arm" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
-              ;;
            *)
              echo "Error: Unknown board ${{ inputs.board }}"
              exit 1
              ;;
          esac
-          echo "Arch: $ARCH for board: ${{ inputs.board }}"
+          echo "Target: $TARGET for board: ${{ inputs.board }}"
          if [ "$BUILD_EMMC" = "true" ]; then
            echo "Building both SD and eMMC images"
            echo "SD Bootloader: $BOOTLOADER_SD"
@@ -101,12 +85,16 @@ jobs:
          fi

      - name: Download bootloader artifacts
+        if: ${{ !inputs.use_latest_release }}
        run: |
-          # Download bootloader from latest-boot release tag
+          # Download from latest bootloader build workflow on main branch
+          gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
+          BOOT_RUN_ID=$(cat latest_boot_run_id)
+
          if [ "$BUILD_EMMC" = "true" ]; then
            # Download both SD and eMMC bootloaders for boards that support both
            echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_SD} --dir temp_bootloader_sd/
            mkdir -p output_sd/images
            cd temp_bootloader_sd/
            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -114,7 +102,7 @@ jobs:
            rm -rf temp_bootloader_sd/

            echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_EMMC} --dir temp_bootloader_emmc/
            mkdir -p output_emmc/images
            cd temp_bootloader_emmc/
            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
@@ -127,7 +115,7 @@ jobs:
            ls -la output_emmc/images/
          else
            # Single bootloader for boards that only support SD
-            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/

            # Extract bootloader directly to output/images
            cd temp_bootloader/
@@ -142,6 +130,7 @@ jobs:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Infix artifacts
+        if: ${{ !inputs.use_latest_release }}
        run: |
          # Download from latest Kernelkit Trigger workflow for main branch
          gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
@@ -149,7 +138,7 @@ jobs:

          if [ "$BUILD_EMMC" = "true" ]; then
            # Copy Infix artifacts to both SD and eMMC output directories
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/

            cd temp_infix/
            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -163,7 +152,7 @@ jobs:
            ls -la output_emmc/images/
          else
            # Single output directory for SD-only boards
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/

            # Extract Infix directly to output/images
            cd temp_infix/
@@ -177,6 +166,58 @@ jobs:
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

+      - name: Download from latest releases
+        if: ${{ inputs.use_latest_release }}
+        run: |
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Download both SD and eMMC bootloaders
+            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            mkdir -p output_sd/images
+            cd temp_bootloader_sd/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            cd ../
+            rm -rf temp_bootloader_sd/
+
+            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            mkdir -p output_emmc/images
+            cd temp_bootloader_emmc/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_bootloader_emmc/
+
+            # Download Infix once and extract to both directories
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "SD files extracted to output_sd/images:"
+            ls -la output_sd/images/
+            echo "eMMC files extracted to output_emmc/images:"
+            ls -la output_emmc/images/
+          else
+            # Download latest bootloader release
+            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            cd temp_bootloader/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_bootloader/
+
+            # Download latest Infix release
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "All files extracted to output/images:"
+            ls -la output/images/
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Verify extracted files
        run: |
          if [ "$BUILD_EMMC" = "true" ]; then
@@ -208,7 +249,7 @@ jobs:
            export BR2_EXTERNAL_INFIX_PATH=$PWD
            export RELEASE=""
            export INFIX_ID="infix"
-            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
+            ./utils/mkimage.sh ${{ inputs.board }}
          fi

      - name: Create eMMC image
@@ -306,11 +347,10 @@ jobs:
          # SD Card & eMMC Image Build Complete! 🚀

          **Board:** ${{ inputs.board }}
-          **Arch:** ${{ env.ARCH }}
+          **Target:** ${{ env.TARGET }}
          **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
          **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
-          **Bootloader Source:** latest-boot release
-          **Infix Source:** Latest workflow run on main
+          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}

          ## Created Images
          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
@@ -323,10 +363,9 @@ jobs:
          # SD Card Image Build Complete! 🚀

          **Board:** ${{ inputs.board }}
-          **Arch:** ${{ env.ARCH }}
+          **Target:** ${{ env.TARGET }}
          **Bootloader:** ${{ env.BOOTLOADER }}
-          **Bootloader Source:** latest-boot release
-          **Infix Source:** Latest workflow run on main
+          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}

          ## Created Images
          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
@@ -20,16 +20,24 @@ jobs:
    runs-on: [self-hosted, release]
    strategy:
      matrix:
-        target: [aarch64, arm, x86_64]
+        target: [aarch64, x86_64]
      fail-fast: false
    steps:
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
+
      - uses: actions/checkout@v4
        with:
          clean: true
          submodules: recursive

-      - uses: kernelkit/actions/podman-cleanup@v1
-
      - name: Set Release Variables
        id: vars
        run: |
@@ -40,10 +48,24 @@ jobs:
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT

-      - uses: kernelkit/actions/cache-restore@v1
+      - name: Restore Cache of dl/
+        if: ${{ inputs.use_cache }}
+        uses: actions/cache@v4
        with:
-          target: ${{ matrix.target }}
-          enabled: ${{ inputs.use_cache }}
+          path: dl/
+          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-
+
+      - name: Restore Cache of .ccache/
+        if: ${{ inputs.use_cache }}
+        uses: actions/cache@v4
+        with:
+          path: .ccache/
+          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-${{ matrix.target }}-
+            ccache-

      - name: Configure & Build
        env:
@@ -78,6 +78,15 @@ jobs:
          rm -rf ./* || true
          rm -rf ./.??* || true
          ls -la ./
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true

      - name: Checkout infix repo
        uses: actions/checkout@v4
@@ -89,8 +98,6 @@ jobs:
          submodules: recursive
          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}

-      - uses: kernelkit/actions/podman-cleanup@v1
-
      - name: Run pre-build script
        if: ${{ inputs.pre_build_script != '' }}
        run: |
@@ -120,9 +127,22 @@ jobs:
          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
          echo "Building target ${target}_defconfig"

-      - uses: kernelkit/actions/cache-restore@v1
+      - name: Restore Cache of dl/
+        uses: actions/cache@v4
        with:
-          target: ${{ env.TARGET }}
+          path: dl/
+          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-
+
+      - name: Restore Cache of .ccache/
+        uses: actions/cache@v4
+        with:
+          path: .ccache/
+          key: ccache-${{ env.TARGET }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-${{ env.TARGET }}-
+            ccache-

      - name: Configure ${{ env.TARGET }}
        run: |
@@ -133,6 +153,10 @@ jobs:
          podman rm -af || true
          pkill -9 -f rootlessport || true

+      - name: Unit Test ${{ env.TARGET }}
+        run: |
+          make test-unit
+
      - name: Prepare parallel build
        id: parallel
        run: |
@@ -1,4 +1,4 @@
-name: Check Kernel 6.18 Release
+name: Check Kernel 6.12 Release

 on:
  schedule:
@@ -17,12 +17,12 @@ jobs:
          fetch-depth: 0
          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}

-      - name: Fetch kernel.org and check for 6.18 release
+      - name: Fetch kernel.org and check for 6.12 release
        id: check
        run: |
          set -e -o pipefail
-          # Fetch the kernel.org frontpage and extract 6.18 version
-          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.18\.\d+' | head -n1)
+          # Fetch the kernel.org frontpage and extract 6.12 version
+          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)

          if [ -z "$CURRENT_VERSION" ]; then
            echo "Failed to fetch kernel version"
@@ -30,7 +30,7 @@ jobs:
          fi

          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          echo "Current 6.18 kernel version: $CURRENT_VERSION"
+          echo "Current 6.12 kernel version: $CURRENT_VERSION"

          # Get the version from infix defconfig
          INFIX_VERSION=$(grep 'BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=' configs/aarch64_defconfig | cut -d'"' -f2)
@@ -47,7 +47,7 @@ jobs:
              echo "PR already exists for kernel $CURRENT_VERSION, skipping"
            else
              echo "new_release=true" >> $GITHUB_OUTPUT
-              echo "🎉 New 6.18 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
+              echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
            fi
          else
            echo "new_release=false" >> $GITHUB_OUTPUT
@@ -99,7 +99,7 @@ jobs:
          BRANCH_NAME: ${{ steps.branch.outputs.name }}
        run: |
          set -e -o pipefail
-          ./utils/kernel-upgrade.sh linux 6.18 "$BRANCH_NAME"
+          ./utils/kernel-upgrade.sh linux "$BRANCH_NAME"

      - name: Create pull request
        if: steps.check.outputs.new_release == 'true'
@@ -8,8 +8,6 @@ on:
 env:
  PROJECT_NAME: Infix
  CONTACT_EMAIL: troglobit@gmail.com
-  LIBYANG_VERSION: 4.2.2
-  SYSREPO_VERSION: 4.2.10

 jobs:
  coverity:
@@ -57,24 +55,16 @@ jobs:
          sudo apt-get -y update
          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                       libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev libavahi-client-dev
+                       libuev-dev

      - name: Build dependencies
        run: |
-          git clone -b v${LIBYANG_VERSION} --depth 1 https://github.com/CESNET/libyang.git
-          for p in patches/libyang/${LIBYANG_VERSION}/*.patch; do
-            git -C libyang apply < "$p"
-          done
+          git clone https://github.com/CESNET/libyang.git
          mkdir libyang/build
          (cd libyang/build && cmake .. && make all && sudo make install)
-
-          git clone -b v${SYSREPO_VERSION} --depth 1 https://github.com/sysrepo/sysrepo.git
-          for p in patches/sysrepo/${SYSREPO_VERSION}/*.patch; do
-            git -C sysrepo apply < "$p"
-          done
+          git clone https://github.com/sysrepo/sysrepo.git
          mkdir sysrepo/build
          (cd sysrepo/build && cmake .. && make all && sudo make install)
-
          git clone https://github.com/troglobit/libite.git
          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
          make dep
@@ -45,10 +45,22 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: kernelkit/actions/cache-restore@v1
+      - name: Restore Cache of dl/
+        uses: actions/cache@v4
        with:
-          target: x86_64
-          dl-prefix: dl-netconf
+          path: dl/
+          key: dl-netconf-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-netconf-
+            dl-
+      - name: Restore Cache of .ccache/
+        uses: actions/cache@v4
+        with:
+          path: .ccache/
+          key: ccache-x86_64-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-x86_64-
+            ccache-
      - name: Disk inventory (2/2) ...
        run: |
          echo "df -h ========================================================================="
@@ -48,12 +48,20 @@ jobs:
      contents: write
      discussions: write
    steps:
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
+
      - uses: actions/checkout@v4
        with:
          submodules: 'true'

-      - uses: kernelkit/actions/podman-cleanup@v1
-
      - name: Set Release Variables
        id: rel
        run: |
@@ -96,7 +104,11 @@ jobs:

      - name: Extract ChangeLog entry ...
        run: |
-          cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
+          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
+              |head -n -1 > release.md
+          echo "" >> release.md
+          echo "> [!TIP]" >> release.md
+          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
          cat release.md

      - uses: ncipollo/release-action@v1
@@ -60,6 +60,16 @@ jobs:
    name: Regression Test ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
    runs-on: [self-hosted, regression]
    steps:
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
+
      - name: Checkout infix repo
        uses: actions/checkout@v4
        with:
@@ -70,8 +80,6 @@ jobs:
          submodules: recursive
          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}

-      - uses: kernelkit/actions/podman-cleanup@v1
-
      - name: Run pre-test script
        if: ${{ inputs.pre_test_script != '' }}
        run: |
@@ -1,4 +1,4 @@
-name: CI
+name: Kernelkit Trigger

 on:
  pull_request:
@@ -28,7 +28,6 @@ jobs:
    outputs:
      x86_64_target: ${{ steps.set-targets.outputs.x86_64_target }}
      aarch64_target: ${{ steps.set-targets.outputs.aarch64_target }}
-      arm_target: ${{ steps.set-targets.outputs.arm_target }}
    steps:
      - run: |
          echo "Triggering build, logging meta data ..."
@@ -44,40 +43,25 @@ jobs:
             | grep -q "ci:main"; then
            echo "x86_64_target=x86_64_minimal" >> $GITHUB_OUTPUT
            echo "aarch64_target=aarch64_minimal" >> $GITHUB_OUTPUT
-            echo "arm_target=arm_minimal" >> $GITHUB_OUTPUT
          else
            echo "x86_64_target=x86_64" >> $GITHUB_OUTPUT
            echo "aarch64_target=aarch64" >> $GITHUB_OUTPUT
-            echo "arm_target=arm" >> $GITHUB_OUTPUT
          fi
-  unit-test:
-    needs: check-trigger
-    uses: ./.github/workflows/unit-test.yml
-    with:
-      name: "infix"
-      target: ${{ needs.check-trigger.outputs.x86_64_target }}

  build-x86_64:
-    needs: [check-trigger, unit-test]
+    needs: check-trigger
    uses: ./.github/workflows/build.yml
    with:
      name: "infix"
      target: ${{ needs.check-trigger.outputs.x86_64_target }}

  build-aarch64:
-    needs: [check-trigger, unit-test]
+    needs: check-trigger
    uses: ./.github/workflows/build.yml
    with:
      name: "infix"
      target: ${{ needs.check-trigger.outputs.aarch64_target }}

-  build-arm:
-    needs: [check-trigger, unit-test]
-    uses: ./.github/workflows/build.yml
-    with:
-      name: "infix"
-      target: ${{ needs.check-trigger.outputs.arm_target }}
-
  test-run-x86_64:
    needs: [check-trigger, build-x86_64]
    uses: ./.github/workflows/test.yml
@@ -1,116 +0,0 @@
-name: unit-test
-
-on:
-  workflow_dispatch:
-    inputs:
-      target:
-        description: "Build target (e.g. aarch64 or aarch64_minimal)"
-        default: "x86_64"
-        type: string
-      parallel:
-        description: 'Massive parallel build of each image'
-        default: true
-        type: boolean
-      name:
-        description: "Name (for spin overrides)"
-        default: "infix"
-        type: string
-      infix_repo:
-        description: 'Repo to checkout (for spin overrides)'
-        default: kernelkit/infix
-        type: string
-      infix_branch:
-        description: 'Branch/tag/commit to checkout (for spin overrides)'
-        default: ''
-        type: string
-
-  workflow_call:
-    inputs:
-      target:
-        required: true
-        type: string
-      name:
-        required: true
-        type: string
-      infix_repo:
-        required: false
-        type: string
-        default: kernelkit/infix
-      infix_branch:
-        required: false
-        type: string
-        default: ''
-        description: 'Branch/tag/commit to checkout (for spin overrides). Defaults to github.ref if not specified'
-      parallel:
-        required: false
-        type: boolean
-        default: true
-      pre_build_script:
-        required: false
-        type: string
-        default: ''
-        description: 'Optional script to run after checkout (for spin customization)'
-    secrets:
-      CHECKOUT_TOKEN:
-        required: false
-        description: 'Token for cross-repository access'
-
-env:
-  NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
-  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
-  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
-  INFIX_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_branch || inputs.infix_branch }}
-
-jobs:
-  unit-tests:
-    name: Build ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
-    runs-on: [ self-hosted, latest ]
-    env:
-      PARALLEL: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.parallel == 'true' || github.event_name != 'workflow_dispatch' && inputs.parallel == true }}
-    strategy:
-      fail-fast: false
-    steps:
-      - name: Cleanup Build Folder
-        run: |
-          ls -la ./
-          rm -rf ./* || true
-          rm -rf ./.??* || true
-          ls -la ./
-
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
-        with:
-          repository: ${{ env.INFIX_REPO }}
-          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
-          clean: true
-          fetch-depth: 0
-          submodules: recursive
-          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
-
-      - uses: kernelkit/actions/podman-cleanup@v1
-
-      - name: Run pre-build script
-        if: ${{ inputs.pre_build_script != '' }}
-        run: |
-          cat > ./pre-build.sh << 'EOF'
-          ${{ inputs.pre_build_script }}
-          EOF
-          chmod +x ./pre-build.sh
-          bash ./pre-build.sh
-
-      - uses: kernelkit/actions/cache-restore@v1
-        with:
-          target: ${{ env.TARGET }}
-
-      - name: Configure ${{ env.TARGET }}
-        run: |
-          make ${{ env.TARGET }}_defconfig
-
-      - name: Cleanup stale containers and ports
-        run: |
-          podman rm -af || true
-          pkill -9 -f rootlessport || true
-
-      - name: Unit Test ${{ env.TARGET }}
-        run: |
-          make test-unit
@@ -1,8 +1,6 @@
 *~
 .claude
 .gdb_history
-.claude
-AGENTS.md
 /.backup
 /.ccache
 /dl
@@ -16,12 +16,10 @@ if something goes wrong.  Deploy once, trust forever.

 **🤝 Friendly**  
 Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit <kbd>?</kbd> or
-<kbd>TAB</kbd> for context-aware assistance.
-
-Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
-mean you're never stuck.  Whether you're learning networking or managing
-enterprise infrastructure.
+with built-in help for every command — just hit `?` or TAB for
+context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
+[comprehensive documentation][4] mean you're never stuck.  Whether
+you're learning networking or managing enterprise infrastructure.

 **🛡️ Secure**  
 Built with security as a foundation, not an afterthought.  Minimal
@@ -55,24 +53,27 @@ your device, your rules.
   Consistent tooling from development to production deployment.  
   How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!

-## Quick Example
+## See It In Action

 Configure an interface in seconds - the CLI guides you with built-in help:

-<pre><code>admin@infix-12-34-56:/> <b>configure</b>
-admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
-admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4</b> <kbd>TAB</kbd>
-      address     autoconf      bind-ni-name     dhcp 
-      enabled     forwarding    mtu              neighbor
-admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4 address 192.168.2.200 prefix-length 24</b>
-admin@infix-12-34-56:/config/interface/eth0/> <b>show</b>
+<details><summary><b>Click Here for an example CLI Session</b></summary>
+
+```bash
+admin@infix-12-34-56:/> configure
+admin@infix-12-34-56:/config/> edit interface eth0
+admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
+      address     autoconf bind-ni-name      enabled
+      forwarding  mtu      neighbor
+admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
+admin@infix-12-34-56:/config/interface/eth0/> show
 type ethernet;
 ipv4 {
  address 192.168.2.200 {
    prefix-length 24;
  }
 }
-admin@infix-12-34-56:/config/interface/eth0/> <b>diff</b>
+admin@infix-12-34-56:/config/interface/eth0/> diff
 interfaces {
  interface eth0 {
 +    ipv4 {
@@ -82,23 +83,25 @@ interfaces {
 +    }
  }
 }
-admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
-admin@infix-12-34-56:/> <b>show interfaces</b>
-<u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
-lo              ethernet   UP          00:00:00:00:00:00
-                ipv4                   127.0.0.1/8 (static)
-                ipv6                   ::1/128 (static)
+admin@infix-12-34-56:/config/interface/eth0/> leave
+admin@infix-12-34-56:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
 eth0            ethernet   UP          52:54:00:12:34:56
                ipv4                   192.168.2.200/24 (static)
                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
-admin@infix-12-34-56:/> <b>copy running startup</b>
-</code></pre>
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+admin@infix-12-34-56:/> copy running-config startup-config
+```

-Notice how <kbd>TAB</kbd> completion shows available options, `show`
-displays current config, and `diff` shows exactly what changed before
-you commit your changes with the `leave` command.
+Notice how TAB completion shows available options, `show` displays
+current config, and `diff` shows exactly what changed before you
+commit your changes with the `leave` command.

-For more information, see [CLI documentation][3].
+</details>
+
+> [Full CLI documentation →][3]

 ## Get Started

@@ -108,13 +111,12 @@ containers for any custom functionality you need.

 ### Supported Platforms

- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
+- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
 - **Banana Pi-R3** - Your next home router and gateway
 - **NanoPi R2S** - Compact dual-port router in a tiny package
 - **x86_64** - Run in VMs or on mini PCs for development and testing
 - **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
 - **Microchip SparX-5i** - Enterprise switching capabilities
- **Microchip SAMA7G54-EK** - ARM Cortex-A7
 - **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
 - **StarFive VisionFive2** - RISC-V architecture support

@@ -168,13 +170,13 @@ APIs.
 [0]: https://www.kernel.org
 [1]: https://buildroot.org/ "Buildroot Homepage"
 [2]: https://www.sysrepo.org/ "Sysrepo Homepage"
-[3]: https://www.kernelkit.org/infix/latest/cli/introduction/
-[4]: https://www.kernelkit.org/infix/
-[5]: https://github.com/kernelkit/infix/releases/latest
+[3]: https://kernelkit.org/infix/latest/cli/introduction/
+[4]: https://kernelkit.org/infix/
+[5]: https://github.com/kernelkit/infix/releases
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
-[Release]:         https://github.com/kernelkit/infix/releases/latest
+[Release]:         https://github.com/kernelkit/infix/releases
 [Release Badge]:   https://img.shields.io/github/v/release/kernelkit/infix 
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/
 [GitHub Status]:   https://github.com/kernelkit/infix/actions/workflows/build.yml/badge.svg
@@ -1,6 +1,6 @@
 menu "Board Support"

-source "$BR2_EXTERNAL_INFIX_PATH/board/arm/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"
@@ -1,18 +0,0 @@
-Board Support
-=============
-
-The board support for an architecture always starts with Qemu support,
-this is what each `linux_defconfig` at the very least sets up.  Then
-each `$BR2_ARCH` has additional BSPs, e.g., Banana Pi BPI-R3.
-
-The `board/` directory is matched with the `configs/*_defconfigs` and
-the only execption is `board/common/`, which holds all shared files for
-Infix builds.
-
-Each `board/$BR2_ARCH/` can then have vendor/product sub-directories
-for the BSPs which may contain "fixups" to the base kernel config and
-any additional device tree files that should be included as well.
-
-To rebuild a board-specific package, e.g. NanoPi R2S:
-
-    make friendlyarm-nanopi-r2s-rebuild all
@@ -0,0 +1,5 @@
+if BR2_arm
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/raspberrypi-rpi2/Config.in"
+
+endif
@@ -1,8 +1,7 @@
-Arm 32-bit
-==========
+aarch32
+=======

 Board Specific Documentation
 ----------------------------

- [Microchip SAMA7G54-EK (32-bit)](microchip-sama7g54-ek/)
 - [Raspberry Pi 2 Model B (32-bit)](raspberrypi-rpi2/)
@@ -0,0 +1 @@
+
@@ -1,19 +1,20 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
 CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
-# CONFIG_CPU_ISOLATION is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=16
+CONFIG_LOG_BUF_SHIFT=18
 CONFIG_MEMCG=y
 CONFIG_BLK_CGROUP=y
 CONFIG_CFS_BANDWIDTH=y
@@ -30,15 +31,23 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
-# CONFIG_ARM_ERRATA_643719 is not set
+CONFIG_KEXEC=y
+CONFIG_ARCH_MULTI_V6=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_VIRT=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
 CONFIG_SMP=y
+CONFIG_NR_CPUS=4
 CONFIG_CPU_FREQ=y
-CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
-CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
 CONFIG_CPUFREQ_DT=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_AEABI=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -50,11 +59,7 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_PARTITION_ADVANCED=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
-CONFIG_ZSWAP=y
-CONFIG_ZSWAP_DEFAULT_ON=y
-CONFIG_ZSWAP_SHRINKER_DEFAULT_ON=y
 # CONFIG_COMPAT_BRK is not set
-# CONFIG_BALLOON_COMPACTION is not set
 CONFIG_KSM=y
 CONFIG_CMA=y
 CONFIG_NET=y
@@ -73,6 +78,7 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -88,31 +94,12 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
-CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -121,22 +108,15 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -153,58 +133,29 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_SET=y
-CONFIG_IP_SET_BITMAP_IP=y
-CONFIG_IP_SET_BITMAP_IPMAC=y
-CONFIG_IP_SET_BITMAP_PORT=y
-CONFIG_IP_SET_HASH_IP=y
-CONFIG_IP_SET_HASH_IPMARK=y
-CONFIG_IP_SET_HASH_IPPORT=y
-CONFIG_IP_SET_HASH_IPPORTIP=y
-CONFIG_IP_SET_HASH_IPPORTNET=y
-CONFIG_IP_SET_HASH_IPMAC=y
-CONFIG_IP_SET_HASH_MAC=y
-CONFIG_IP_SET_HASH_NETPORTNET=y
-CONFIG_IP_SET_HASH_NET=y
-CONFIG_IP_SET_HASH_NETNET=y
-CONFIG_IP_SET_HASH_NETPORT=y
-CONFIG_IP_SET_HASH_NETIFACE=y
-CONFIG_IP_SET_LIST_SET=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_SYNPROXY=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -243,21 +194,22 @@ CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_PKTGEN=y
-CONFIG_CFG80211=m
-CONFIG_MAC80211=m
-CONFIG_RFKILL=y
+# CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
+CONFIG_PCI_AARDVARK=y
 CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_ARMADA_8K=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
+CONFIG_RASPBERRYPI_FIRMWARE=y
 CONFIG_FW_CFG_SYSFS=y
 CONFIG_FW_CFG_SYSFS_CMDLINE=y
 CONFIG_OF_OVERLAY=y
@@ -269,6 +221,7 @@ CONFIG_BLK_DEV_NVME=y
 CONFIG_SRAM=y
 CONFIG_EEPROM_AT24=y
 # CONFIG_SCSI_PROC_FS is not set
+CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_SAS_LIBSAS=y
 CONFIG_SCSI_SAS_ATA=y
@@ -277,6 +230,7 @@ CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_MVEBU=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
@@ -299,29 +253,67 @@ CONFIG_VETH=m
 CONFIG_VIRTIO_NET=y
 CONFIG_NLMON=y
 CONFIG_NET_VRF=y
+CONFIG_BCMGENET=y
+CONFIG_SMSC911X=y
+CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_BRCMFMAC=m
+CONFIG_ZD1211RW=m
+CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
 # CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
+CONFIG_TTY_PRINTK=y
+CONFIG_HVC_DRIVER=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
+CONFIG_SPI_BCM2835=y
+CONFIG_SPI_BCM2835AUX=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
+CONFIG_BCM2711_THERMAL=y
+CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
+CONFIG_BCM2835_WDT=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
+CONFIG_DRM=y
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_TOSHIBA_TC358762=m
+CONFIG_DRM_V3D=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_VC4_HDMI_CEC=y
+CONFIG_DRM_SIMPLEDRM=y
+CONFIG_FB=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_SOC=y
+CONFIG_SND_BCM2835_SOC_I2S=y
+CONFIG_HID_GENERIC=m
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
-CONFIG_USB_EHCI_HCD=m
-CONFIG_USB_EHCI_ROOT_HUB_TT=y
-CONFIG_USB_EHCI_HCD_PLATFORM=m
-CONFIG_USB_OHCI_HCD=m
-CONFIG_USB_OHCI_HCD_PLATFORM=m
 CONFIG_USB_STORAGE=y
+CONFIG_USB_DWC2=y
+CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_ETH=m
 CONFIG_USB_ETH_EEM=y
@@ -329,6 +321,8 @@ CONFIG_USB_G_SERIAL=m
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_IPROC=y
+CONFIG_MMC_BCM2835=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
@@ -342,16 +336,23 @@ CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_LEDS_TRIGGER_TRANSIENT=y
 CONFIG_LEDS_TRIGGER_CAMERA=y
 CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
+CONFIG_STAGING=y
+CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
+CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_POSIX_ACL=y
-CONFIG_EXT4_FS=y
+CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -370,24 +371,32 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
-CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_ISO8859_15=y
 CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_CCM=y
 CONFIG_CRYPTO_GCM=y
+# CONFIG_XZ_DEC_ARM is not set
+# CONFIG_XZ_DEC_ARMTHUMB is not set
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY=y
 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 CONFIG_WQ_WATCHDOG=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
 CONFIG_TEST_LOCKUP=m
+# CONFIG_SCHED_DEBUG is not set
+# CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
-# CONFIG_RUNTIME_TESTING_MENU is not set
+# CONFIG_STRICT_DEVMEM is not set
+CONFIG_MEMTEST=y
@@ -2,10 +2,14 @@ config BR2_PACKAGE_RASPBERRYPI_RPI2
 	bool "Raspberry Pi 2 Model B (32-bit ARMv7)"
 	depends on BR2_arm
 	select SDCARD_AUX
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+
 	help
 	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
 	  (SBC) with BCM2836 quad-core Cortex-A7 processor.

-	  This was the only Raspberry Pi model with the BCM2836 and the rare
-	  RPi 2B board revision v1.2 actually got an underclocked BCM2837,
-	  which is the saem Cortex-A53 as the RPi3, but w/o wifi.
+	  This was the only Raspberry Pi model with the BCM2836 and the 2B
+	  actually got a BCM2837 (Cortex-A53) underclocked an w/o wifi in
+	  the v1.2 board revision.
@@ -21,8 +21,9 @@ The board features:
 How to Build
 ------------

-Since there are no pre-built images for ARM 32-bit, you need to build both
-Infix and the bootloader from source.
+Since there are no pre-built images for ARM32, you need to build both Infix
+and the bootloader from source.
+

 1. Clone the repository

@@ -36,12 +37,12 @@ Infix and the bootloader from source.

 3. Build Infix (in another tree)

-        make O=x-arm arm_defconfig
-        make O=x-arm
+        make O=x-arm32 aarch32_defconfig
+        make O=x-arm32

 4. Create the SD card image

-        ./utils/mkimage.sh -b x-boot -r x-arm raspberrypi-rpi2
+        ./utils/mkimage.sh -b x-boot -r x-arm32 raspberrypi-rpi2

 The resulting image can be found in `x-boot/images/infix-arm-sdcard.img`

@@ -91,5 +92,5 @@ Serial settings: 115200 8N1
 > [!WARNING]
 > Use only 3.3V serial adapters. 5V adapters will damage your Raspberry Pi!

-[0]: https://www.kernelkit.org/posts/flashing-sdcard/
+[0]: https://kernelkit.org/posts/flashing-sdcard/
 [1]: https://www.raspberrypi.com/products/raspberry-pi-2-model-b/
@@ -1,19 +1,13 @@
 # Raspberry Pi 2 Model B specific kernel configuration
 define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
-
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SOUND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
-	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835_SOC_I2S,y)
-	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_KEYBOARD)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_TOUCHSCREEN)
 	$(call KCONFIG_SET_OPT,CONFIG_INPUT_MOUSEDEV,m)
 	$(call KCONFIG_SET_OPT,CONFIG_HID_GENERIC,m)
-	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)

 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
@@ -21,58 +15,46 @@ define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DMA_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_FIRMWARE)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ARM_RASPBERRYPI_CPUFREQ)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_BCM2835)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PWM_BCM2835)
 	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_BCM2835,m)
-	$(call KCONFIG_SET_OPT,CONFIG_SPI_BCM2835,y)
-	$(call KCONFIG_SET_OPT,CONFIG_SPI_BCM2835AUX,y)
-	$(call KCONFIG_SET_OPT,CONFIG_SENSORS_RASPBERRYPI_HWMON,m)
-	$(call KCONFIG_SET_OPT,CONFIG_BCM2711_THERMAL,y)
 	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
-	$(call KCONFIG_SET_OPT,CONFIG_MMC_SDHCI_IPROC,y)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_BCM2835AUX)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_AMBA_PL011)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_AMBA_PL011_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
-	$(call KCONFIG_SET_OPT,CONFIG_BCMGENET,y)
 	$(call KCONFIG_SET_OPT,CONFIG_SMSC911X,y)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_USBNET)
-	$(call KCONFIG_SET_OPT,CONFIG_USB_LAN78XX,y)
-	$(call KCONFIG_SET_OPT,CONFIG_USB_NET_SMSC95XX,y)
 	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,y)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_KMS_HELPER)
-	$(call KCONFIG_SET_OPT,CONFIG_DRM_SIMPLEDRM,y)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_V3D,m)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_VC4,m)
+	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
+
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_VC4_HDMI_CEC)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_LOAD_EDID_FIRMWARE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_PANEL_BRIDGE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_BRIDGE)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_TOSHIBA_TC358762,m)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_PANEL_SIMPLE,m)
-	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)

 	$(call KCONFIG_ENABLE_OPT,CONFIG_FB)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_FBDEV_EMULATION)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)

-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC2)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_NOP_USB_XCEIV)
+	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)
 endef

 $(eval $(ix-board))
@@ -54,8 +54,7 @@
                "id": "domain"
              },
              {
-                "id": "hostname",
-                "value": "auto"
+                "id": "hostname"
              },
              {
                "id": "dns-server"
@@ -89,9 +88,6 @@
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -99,14 +95,6 @@
          "user-name": [
            "admin"
          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
        }
      ]
    },
@@ -126,37 +114,6 @@
          }
        ]
      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
      {
        "name": "default-deny-all",
        "group": [
@@ -164,25 +121,11 @@
        ],
        "rule": [
          {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
          }
        ]
      }
@@ -2,7 +2,6 @@ if BR2_aarch64

 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/freescale-imx8mp-evk/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/friendlyarm-nanopi-r2s/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-cn9130-crb/Config.in"
@@ -4,8 +4,7 @@ aarch64
 Board Specific Documentation
 ----------------------------

- [Banana Pi BPi-R3](banana-pi-r3/)
- [Banana Pi BPi-R64](banana-pi-r64/)
+- [Banana Pi R3](banana-pi-r3/)
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
 - [NanoPi R2S](r2s/)
@@ -1,6 +1,5 @@
 config BR2_PACKAGE_ALDER_ALDER
 	bool "Alder"
 	depends on BR2_aarch64
-	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Alder
@@ -5,7 +5,6 @@ config BR2_PACKAGE_BANANAPI_BPI_R3
 	select BR2_PACKAGE_LINUX_FIRMWARE
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7986
-	select BR2_PACKAGE_LINUX_FIRMWARE_AIROHA_EN8811H
 	select SDCARD_AUX
 	help
 	  Build Banana PI R3 support
@@ -1,29 +1,20 @@
-# Banana Pi BPI-R3 / BPI-R3 Mini
+# Banana Pi BPI-R3

 <img src="bananapi-bpi-r3.webp" alt="The board" width=800 padding=10>

 ## Overview

-The Banana Pi BPI-R3 and BPI-R3 Mini are high-performance networking
-boards with full Infix support for all enabled features including
-Ethernet, WiFi, and SFP interfaces.
-
-Both boards share the same SoC and most peripherals.  The key
-differences are:
-
-| Feature         | BPI-R3             | BPI-R3 Mini             |
-|-----------------|--------------------|-------------------------|
-| Ethernet switch | Yes (4x LAN + WAN) | No (WAN/LAN ports only) |
-| SD card slot    | Yes                | No                      |
+The Banana Pi R3 is a high-performance networking board with full Infix
+support for all enabled features including switched Ethernet ports, WiFi,
+and SFP interfaces.

 ### Hardware Features

 - MediaTek MT7986 ARM Cortex-A53 quad-core processor @ 2.0 GHz
 - 2 GB DDR4 RAM
- 8 GB eMMC storage
- microSD card slot (BPI-R3 only)
- 5x Gigabit Ethernet ports with switch core (BPI-R3 only)
- 2x SFP cages for fiber connectivity (1G/2.5G) (BPI-R3 only)
+- 8 GB eMMC storage + microSD card slot
+- 5x Gigabit Ethernet ports (4x LAN, 1x WAN)
+- 2x SFP cages for fiber connectivity (1G/2.5G)
 - Dual-band WiFi (2.4 GHz + 5 GHz)
 - USB 3.0 port
 - Mini PCIe slot
@@ -32,20 +23,16 @@ differences are:

 Infix comes preconfigured with:

- **LAN ports** (lan1-lan4): Bridged for internal networking (BPI-R3 only)
+- **LAN ports** (lan1-lan4): Bridged for internal networking
 - **WAN port**: DHCP client enabled for internet connectivity
- **SFP ports** (sfp1, sfp2): Available for configuration (BPI-R3 only)
+- **SFP ports** (sfp1, sfp2): Available for configuration
 - **WiFi interfaces** (wifi0, wifi1): Available for configuration

 ## Getting Started

-### BPI-R3: Quick Start with SD Card
+### Quick Start with SD Card

-The easiest way to get started with the BPI-R3 is using an SD card:
-
-> [!NOTE]
-> SD card boot works but we have observed stability issues. For production
-> use or long-term reliability, we recommend installing to eMMC (see below).
+The easiest way to get started is using an SD card:

 1. **Download the SD card image:** [infix-bpi-r3-sdcard.img][2]
 2. **Flash the image to an SD card:** see [this guide][0]
@@ -58,12 +45,6 @@ The easiest way to get started with the BPI-R3 is using an SD card:
   - Connect to LAN port or console (115200 8N1)
   - Default login: `admin` / `admin`

-### BPI-R3 Mini: Getting Started
-
-The BPI-R3 Mini does not have an SD card slot, so you must install
-directly to eMMC.  See [Installing to eMMC — BPI-R3
-Mini](#bpi-r3-mini) below.
-
 ### Boot Switch Reference

 The BPI-R3 has a 4-position DIP switch that controls boot media:
@@ -72,49 +53,59 @@ The BPI-R3 has a 4-position DIP switch that controls boot media:

 | Position | Mode        | Description                           |
 |----------|-------------|---------------------------------------|
-| 0000     | SD card     | Boot from microSD card                |
-| 0110     | eMMC        | Boot from internal eMMC (recommended) |
+| 0000     | SD card     | Boot from microSD card (recommended)  |
+| 0110     | eMMC        | Boot from internal eMMC storage       |
 | 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |

 > [!NOTE]
-> Switch position is read from left to right: "0" = OFF, "1" = ON.
+> Switch position is read from left to right: "0" = OFF, "1" = ON.  
 > When the DIP switch is in the "UP" position it is OFF(0).

-## Installing to eMMC
+## Advanced: Installing to eMMC

 For production deployments or better performance, you can install Infix
-to the internal eMMC storage.
+to the internal eMMC storage. This is more complex but provides faster
+boot times and eliminates the external SD card.

-> [!IMPORTANT]
-> While Infix boots on both SD card and eMMC on the BPI-R3, we have
-> observed stability issues with SD cards on this platform. **eMMC is
-> recommended** for reliable operation.
+### Why Use eMMC?
+
+**Advantages:**
+
+- Faster boot and better performance
+- No external SD card to manage
+- More robust for industrial/embedded deployments
+
+**Disadvantages:**
+
+- More complex installation process
+- Requires intermediate NAND boot step
+- Harder to recover from errors

 ### Prerequisites

 - FTDI USB-to-serial cable (3.3V) for console access
+- microSD card with Infix (for initial boot)
 - USB flash drive (FAT32 formatted)
- microSD card with Infix, for initial boot (BPI-R3 only)
 - Downloaded files (see below)

 ### Required Files

 Download and place these files on a FAT32-formatted USB drive:

-1. **Infix eMMC image:**
-   - [infix-bpi-r3-emmc.img][3] (Complete system image)
-2. **eMMC bootloader** (extracted from):
-   - [bpi-r3-emmc-boot-2025.01-latest.tar.gz][4]
-   - Extract `bl2.img` from the tarball to your USB drive
-3. **Intermediate NAND bootloader** (BPI-R3 only, from Frank-W's U-Boot):
+1. **Intermediate NAND bootloader** (from Frank-W's U-Boot):
   - [bpi-r3_spim-nand_bl2.img][5] (BL2 loader)
   - [bpi-r3_spim-nand_fip.bin][6] (FIP image)
+2. **Infix eMMC image:**
+   - [infix-bpi-r3-emmc.img][3] (Complete system image)
+3. **eMMC bootloader** (extracted from):
+   - [bpi-r3-emmc-boot-2025.01-latest.tar.gz][4]
+   - Extract `bl2.img` from the tarball to your USB drive

 > [!WARNING]
 > The following process involves multiple boot mode changes.  Take your
-> time and verify each step carefully.
+> time verify each step carefully.

-### BPI-R3
+### Installation Steps

 #### Step 1: Boot from SD card

@@ -176,48 +167,13 @@ mmc partconf 0 1 1 0

 Your BPI-R3 should now boot Infix from internal eMMC storage!

-### BPI-R3 Mini
-
-The BPI-R3 Mini does not have an SD card slot, so you have to go
-through the factory-installed Linux (OpenWRT) to flash the Infix
-bootloader and OS to eMMC.
-
-#### Step 1: Boot from NAND (factory default)
-
-<img src="r3mini_nandboot2.png" alt="BPI-R3 Mini NAND boot switch position" width=400>
-
-1. Ensure boot switches are set to NAND mode (factory default)
-2. Place `infix-bpi-r3-emmc.img` and `bl2.img` on a USB drive
-3. Power on and boot into Linux
-4. Mount the USB drive to `/mnt`
-
-#### Step 2: Flash Infix to eMMC
-
-From the Linux shell:
-
-```
-echo 0 > /proc/sys/kernel/printk
-dd if=/mnt/infix-bpi-r3-emmc.img of=/dev/mmcblk0
-echo 0 > /sys/block/mmcblk0boot0/force_ro
-dd if=/mnt/bl2.img of=/dev/mmcblk0boot0
-sync
-```
-
-#### Step 3: Boot from eMMC
-
-<img src="r3mini_emmcboot.png" alt="BPI-R3 Mini eMMC boot switch position" width=400>
-
-1. Power off the board
-2. Set boot switches to eMMC mode (see image above)
-3. Power on
-
 ## Troubleshooting

 ### Board won't boot

 - Verify boot switch positions (check twice!)
 - Ensure power supply provides adequate current (12V/2A recommended)
- Try booting from SD card with switches at **0000** (BPI-R3 only)
+- Try booting from SD card with switches at **0000**

 ### Can't break into U-Boot

@@ -229,9 +185,9 @@ sync

 - Boot from NAND (**1010**) and verify eMMC image was written
 - Check USB drive contents - ensure all files are present
- Re-run the eMMC boot configuration step
+- Re-run Step 5 (eMMC boot configuration)

-### Reverting to SD card (BPI-R3 only)
+### Reverting to SD card

 Simply set boot switches back to **0000** and boot from SD card. The
 eMMC installation does not affect SD card functionality.
@@ -262,8 +218,8 @@ make aarch64
 ./utils/mkimage.sh -odt emmc bananapi-bpi-r3
 ```

-[0]: https://www.kernelkit.org/posts/flashing-sdcard/
-[1]: https://www.kernelkit.org/infix/latest/
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://kernelkit.org/infix/latest/
 [2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img
 [3]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-emmc.img
 [4]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r3-emmc-boot-2025.01-latest.tar.gz
@@ -6,10 +6,9 @@ define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_GPIO,y)
 	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_WATCHDOG)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
-	$(call KCONFIG_SET_OPT,CONFIG_AIR_EN8811H_PHY,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
 	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)
@@ -1 +1 @@
-dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb mediatek/mt7986a-bananapi-bpi-r3-mini.dtb
+dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb
@@ -1,4 +1,2 @@
-#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
-
 #include "mt7986a-bananapi-bpi-r3.dtsi"
 #include "mt7986a-bananapi-bpi-r3-emmc.dtsi"
@@ -1,12 +0,0 @@
-#include <arm64/mediatek/mt7986a-bananapi-bpi-r3-mini.dts>
-
-#include "mt7986a-bananapi-bpi-r3.dtsi"
-#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"
-
-&phy0 {
-	compatible = "ethernet-phy-id03a2.a411";
-};
-&phy1 {
-	compatible = "ethernet-phy-id03a2.a411";
-};
-
@@ -1,2 +0,0 @@
-#include "mt7986a-bananapi-bpi-r3.dtsi"
-#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"
@@ -1,4 +1,2 @@
-#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
-
 #include "mt7986a-bananapi-bpi-r3.dtsi"
 #include "mt7986a-bananapi-bpi-r3-sd.dtsi"
@@ -1,3 +1,5 @@
+#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
+
 / {
 	chosen {
 		infix {
@@ -8,22 +10,7 @@
 		};
 	};
 };
-/*
-From 236317dd4e55512933dcdaec3d0b4a0824f5e5bd Mon Sep 17 00:00:00 2001
-From: Shiji Yang <yangshiji66@outlook.com>
-Date: Sun, 10 Aug 2025 18:11:01 +0800
-Subject: [PATCH] arm64: dts: mediatek: mt7986: increase ATF reserved memory to
- 256 kiB

-The latest Mediatek open-source Trusted Firmware-A project has
-reserved 256 KiB for BL2 and BL31. It is better to increase the
-reserved memory region in the Linux kernel to protect the data.
-
-https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/patches-6.12/199-arm64-dts-mediatek-mt7986-increase-ATF-reserved-memo.patch
-*/
-&secmon_reserved {
-	reg = <0 0x43000000 0 0x40000>;
-};
 &cpu_thermal {
 	/delete-node/ trips;
 	/delete-node/ cooling-maps;
@@ -51,11 +51,6 @@ image #INFIX_ID##VERSION#-bpi-r3-#TARGET#.img {
                size = 4096s
        }

-	partition en8811h_fw {
-		size = 10M
-		image = "en8811h-fw.bin"
-	}
-
        partition aux {
                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
                image = "aux.ext4"
@@ -17,24 +17,6 @@
        "state": {
          "admin-state": "unlocked"
        }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "DE",
-          "band": "2.4GHz",
-          "channel": "auto"
-        }
-      },
-      {
-        "name": "radio1",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "DE",
-          "band": "5GHz",
-          "channel": "auto"
-        }
      }
    ]
  },
@@ -130,8 +112,7 @@
                "id": "domain"
              },
              {
-                "id": "hostname",
-                "value": "auto"
+                "id": "hostname"
              },
              {
                "id": "dns-server"
@@ -169,36 +150,12 @@
        }
      },
      {
-        "name": "wifi0-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0",
-          "access-point": {
-            "ssid": "Infix",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
+        "name": "wifi0",
+        "type": "infix-if-type:wifi"
      },
      {
-        "name": "wifi1-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio1",
-          "access-point": {
-            "ssid": "Infix5Ghz",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
+        "name": "wifi1",
+        "type": "infix-if-type:wifi"
      }
    ]
  },
@@ -214,22 +171,10 @@
          "certificates": {}
        }
      ]
-    },
-    "symmetric-keys": {
-      "symmetric-key": [
-        {
-          "name": "wifi",
-          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
-          "key-format": "infix-crypto-types:passphrase-key-format"
-        }
-      ]
    }
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -237,14 +182,6 @@
          "user-name": [
            "admin"
          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
        }
      ]
    },
@@ -264,37 +201,6 @@
          }
        ]
      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
      {
        "name": "default-deny-all",
        "group": [
@@ -302,25 +208,11 @@
        ],
        "rule": [
          {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
          }
        ]
      }
@@ -0,0 +1,3 @@
+#!/bin/sh
+udevadm control --reload-rules
+udevadm trigger --subsystem-match=net --action=add
@@ -1,11 +0,0 @@
-{
-    "sfp1": {
-	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
-	"broken-autoneg": true
-    },
-    "sfp2": {
-	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
-	"broken-autoneg": true
-    }
-
-}
@@ -1,446 +0,0 @@
-{
-  "ieee802-dot1ab-lldp:lldp": {
-    "infix-lldp:enabled": true
-  },
-  "ietf-hardware:hardware": {
-    "component": [
-      {
-        "name": "USB",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "class": "infix-hardware:usb",
-        "name": "USB2",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "DE",
-          "band": "2.4GHz",
-          "channel": "auto"
-        }
-      },
-      {
-        "name": "radio1",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "DE",
-          "band": "5GHz",
-          "channel": "auto"
-        }
-      }
-    ]
-  },
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "br0",
-        "type": "infix-if-type:bridge",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "192.168.0.1",
-              "prefix-length": 24
-            }
-          ]
-        }
-      },
-      {
-        "name": "lan",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lo",
-        "type": "infix-if-type:loopback",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "127.0.0.1",
-              "prefix-length": 8
-            }
-          ]
-        },
-        "ietf-ip:ipv6": {
-          "address": [
-            {
-              "ip": "::1",
-              "prefix-length": 128
-            }
-          ]
-        }
-      },
-      {
-        "name": "wan",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv4": {
-          "infix-dhcp-client:dhcp": {
-            "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname",
-                "value": "auto"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Banana Pi BPI-R3"
-              }
-            ]
-          }
-        },
-        "ietf-ip:ipv6": {
-          "infix-dhcpv6-client:dhcp": {
-            "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "client-fqdn"
-              },
-              {
-                "id": "domain-search"
-              },
-              {
-                "id": "dns-server"
-              }
-            ]
-          }
-        }
-      },
-      {
-        "name": "wifi0-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0",
-          "access-point": {
-            "ssid": "Infix",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "wifi1-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio1",
-          "access-point": {
-            "ssid": "Infix5Ghz",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      }
-    ]
-  },
-  "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
-        }
-      ]
-    },
-    "symmetric-keys": {
-      "symmetric-key": [
-        {
-          "name": "wifi",
-          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
-          "key-format": "infix-crypto-types:passphrase-key-format"
-        }
-      ]
-    }
-  },
-  "ietf-netconf-acm:nacm": {
-    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
-    "groups": {
-      "group": [
-        {
-          "name": "admin",
-          "user-name": [
-            "admin"
-          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
-        }
-      ]
-    },
-    "rule-list": [
-      {
-        "name": "admin-acl",
-        "group": [
-          "admin"
-        ],
-        "rule": [
-          {
-            "name": "permit-all",
-            "module-name": "*",
-            "access-operations": "*",
-            "action": "permit",
-            "comment": "Allow 'admin' group complete access to all operations and data."
-          }
-        ]
-      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
-      {
-        "name": "default-deny-all",
-        "group": [
-          "*"
-        ],
-        "rule": [
-          {
-            "name": "deny-password-access",
-            "path": "/ietf-system:system/authentication/user/password",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
-          }
-        ]
-      }
-    ]
-  },
-  "ietf-netconf-server:netconf-server": {
-    "listen": {
-      "endpoints": {
-        "endpoint": [
-          {
-            "name": "default-ssh",
-            "ssh": {
-              "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
-              },
-              "ssh-server-parameters": {
-                "server-identity": {
-                  "host-key": [
-                    {
-                      "name": "default-key",
-                      "public-key": {
-                        "central-keystore-reference": "genkey"
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        ]
-      }
-    }
-  },
-  "ietf-system:system": {
-    "hostname": "bpi-%m",
-    "ntp": {
-      "server": [
-        {
-          "name": "default",
-          "udp": {
-            "address": "pool.ntp.org"
-          }
-        }
-      ]
-    },
-    "authentication": {
-      "user": [
-        {
-          "name": "admin",
-          "password": "$factory$",
-          "infix-system:shell": "bash"
-        }
-      ]
-    },
-    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
-  },
-  "infix-dhcp-server:dhcp-server": {
-    "option": [
-      {
-        "id": "ntp-server",
-        "address": "auto"
-      },
-      {
-        "id": "dns-server",
-        "address": "auto"
-      },
-      {
-        "id": "router",
-        "address": "auto"
-      }
-    ],
-    "subnet": [
-      {
-        "subnet": "192.168.0.0/24",
-        "pool": {
-          "start-address": "192.168.0.100",
-          "end-address": "192.168.0.250"
-        }
-      }
-    ]
-  },
-  "infix-firewall:firewall": {
-    "default": "wan",
-    "zone": [
-      {
-        "name": "lan",
-        "action": "accept",
-        "interface": [
-          "br0"
-        ]
-      },
-      {
-        "name": "wan",
-        "action": "drop",
-        "interface": [
-          "wan"
-        ],
-        "service": [
-          "dhcpv6-client"
-        ]
-      }
-    ],
-    "policy": [
-      {
-        "name": "lan-to-wan",
-        "action": "accept",
-        "ingress": [
-          "lan"
-        ],
-        "egress": [
-          "wan"
-        ],
-        "masquerade": true
-      }
-    ]
-  },
-  "infix-meta:meta": {
-    "version": "1.7"
-  },
-  "infix-services:mdns": {
-    "enabled": true
-  },
-  "infix-services:ssh": {
-    "enabled": true,
-    "hostkey": [
-      "genkey"
-    ],
-    "listen": [
-      {
-        "name": "ipv4",
-        "address": "0.0.0.0",
-        "port": 22
-      },
-      {
-        "name": "ipv6",
-        "address": "::",
-        "port": 22
-      }
-    ]
-  },
-  "infix-services:web": {
-    "enabled": true,
-    "console": {
-      "enabled": true
-    },
-    "netbrowse": {
-      "enabled": true
-    },
-    "restconf": {
-      "enabled": true
-    }
-  }
-}
@@ -1,2 +0,0 @@
-ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth0", NAME="lan"
-ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth1", NAME="wan"
@@ -3,9 +3,6 @@ CONFIG_BOOTDELAY=2
 # CONFIG_MMC_PCI is not set
 CONFIG_ENV_IS_NOWHERE=y
 # CONFIG_ENV_IS_IN_MMC is not set
-CONFIG_MULTI_DTB_FIT=y
-CONFIG_OF_LIST="mt7986a-bpi-r3-sd mt7986a-bpi-r3-emmc mt7986a-bpi-r3-mini"
-
 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_MTK=y
@@ -29,17 +26,8 @@ CONFIG_MTD_SPI_NAND=y
 CONFIG_MTK_SPIM=y
 CONFIG_MTK_SNOR=y

-CONFIG_DM_MDIO=y
-CONFIG_DM_ETH_PHY=y
-CONFIG_PHY_ETHERNET_ID=y
-
-CONFIG_PHY_AIROHA=y
-CONFIG_PHY_AIROHA_EN8811H=y
-CONFIG_PHY_AIROHA_FW_IN_MMC=y
-
 CONFIG_CMD_SF=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_MTD=y
-CONFIG_CMD_MDIO=y
 CONFIG_CMD_MTDPARTS=y
 CONFIG_CMD_DM=y
@@ -15,10 +15,6 @@
                       scriptaddr = "0x48000000";
                       ramdisk_addr_r = "0x4A000000";

-		en8811h_fw_part = "0#en8811h_fw";
-		en8811h_fw_dm_dir = "EthMD32.dm.bin";
-		en8811h_fw_dsp_dir = "EthMD32.DSP.bin";
-
                       /* This is a development platform, keep
                        * developer mode statically enabled.
                        */
@@ -1,7 +0,0 @@
-config BR2_PACKAGE_BANANAPI_BPI_R64
-	bool "Banana Pi R64"
-	depends on BR2_aarch64
-	select BR2_PACKAGE_FEATURE_WIFI
-	select SDCARD_AUX
-	help
-	  Build Banana PI R64 support
@@ -1,13 +0,0 @@
-Copyright (c) 2026 The KernelKit Authors
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -1,143 +0,0 @@
-# Banana Pi BPI-R64
-
-## Overview
-
-<img align="right" src="banana_pi_bpi-r64_interface.jpg" alt="Board Overview" width=400 padding=10>
-
-The Banana Pi BPI-R64 is a networking board based on the MediaTek MT7622
-(dual Cortex-A53, AArch64) SoC.
-
-### Hardware Features
-
- MediaTek MT7622 ARM Cortex-A53 dual-core processor @ 1.35 GHz
- 1 GB DDR3L RAM
- 8 GB eMMC storage
- microSD card slot
- MT7531 Gigabit Ethernet switch (4x LAN + 1x WAN)
- MT7603E built-in 2.4 GHz WiFi
- USB 3.0 port
- 2x Mini PCIe slots
-
-### Default Network Configuration
-
-Infix comes preconfigured with:
-
- **LAN ports** (lan0-lan3): Bridged for internal networking
- **WAN port**: DHCP client enabled for internet connectivity
- **WiFi** (wifi0-ap): Bridged to LAN (MT7615 PCIe card if fitted, otherwise MT7603E)
-
-## Boot Switch Reference
-
-<img align="right" src="bpi-r64-sw1.png" alt="SW1 Boot Switch" width=90 padding=10>
-
-The BPI-R64 uses a 2-position DIP switch (SW1) to select the boot device
-order.  The MT7622 Boot ROM tries devices in the order listed and falls
-back to the next if no valid BL2 is found at the expected location.
-
-| SW1 | Boot device | Use case                   |
-|-----|-------------|----------------------------|
-| OFF | eMMC        | Production eMMC boot       |
-| ON  | SD card     | SD card boot / development |
-
-> [!NOTE]
-> SinoVoip has exposed only one bit of the MT7622's two-bit `BOOT_SEL[1:0]`
-> strapping field via SW1, with `BOOT_SEL[1]` hardwired high.  This limits the
-> board to eMMC (`10b`) and SD (`11b`) boot; the SPI-NOR and SPI-NAND modes
-> available on the MT7622 reference board (`00b`, `01b`) are not selectable.
-
-## Getting Started
-
-### Quick Start with SD Card
-
-1. **Flash the image to an SD card** (the filename includes the version, e.g.
-   `infix-25.01-bpi-r64-sdcard.img`):
-
-<img align="right" src="debug-uart.png" alt="Debug UART" width=100 padding=10>
-
-   ```sh
-   dd if=infix-*-bpi-r64-sdcard.img of=/dev/sdX bs=4M status=progress
-   ```
-
-2. **Set boot switch:** SW1 ON (SD card boot)
-3. **Insert SD card and power on**
-4. **Connect console:** 115200 8N1 — use the dedicated Debug UART header
-   just below the 40-pin GPIO header; pins are labeled GND, RX, TX on the board
-5. **Default login:** `admin` / `admin`
-
-## Installing to eMMC
-
-Unlike the BPI-R3 (where SD and eMMC share a bus, requiring a NAND intermediate
-step), the BPI-R64 has separate controllers for SD (mmc1/MSDC1) and eMMC
-(mmc0/MSDC0).  You can write directly to eMMC while booted from SD.
-
-### eMMC Boot ROM Behaviour
-
-> [!IMPORTANT]
-> The MT7622 Boot ROM reads BL2 from the eMMC BOOT0 hardware partition (offset
-> 0), not from the User Data Area where the main disk image lives.  The
-> installation procedure below writes BL2 to BOOT0 separately to handle this.
-
-### Procedure
-
-Boot from SD and write the eMMC image from U-Boot using a FAT32-formatted USB
-drive.
-
-#### Step 1: Boot from SD card
-
-1. Set SW1 to ON (SD boot)
-2. Insert SD card with Infix
-3. Power on and break into U-Boot (press Ctrl-C during boot)
-
-#### Step 2: Write the eMMC image from U-Boot
-
-Place `infix-bpi-r64-emmc.img` and `bl2.img` on a FAT32-formatted USB drive,
-then from the U-Boot prompt:
-
-```
-usb start
-fatload usb 0:1 0x44000000 infix-bpi-r64-emmc.img
-setexpr blocks ${filesize} / 0x200
-mmc dev 0
-mmc write 0x44000000 0x0 ${blocks}
-```
-
-#### Step 3: Write BL2 to eMMC BOOT0
-
-```
-fatload usb 0:1 0x44000000 bl2.img
-mmc partconf 0 1 1 1
-setexpr blkcnt ${filesize} + 0x1ff
-setexpr blkcnt ${blkcnt} / 0x200
-mmc write 0x44000000 0x0 ${blkcnt}
-mmc partconf 0 1 1 0
-```
-
-#### Step 4: Boot from eMMC
-
-1. Power off the board
-2. Set SW1 to OFF (eMMC boot)
-3. Remove SD card and USB drive
-4. Power on
-
-## Platform Notes
-
-### mmc0 = eMMC, mmc1 = SD
-
-On MT7622, MSDC0 (mmc0) is the 8-bit eMMC controller and MSDC1 (mmc1) is the
-4-bit SD card controller — the reverse of many other platforms.
-
-## Building
-
-```sh
-# Bootloader only (SD)
-make O=x-boot-bpir64-sd bpi_r64_sd_boot_defconfig && make O=x-boot-bpir64-sd
-
-# Bootloader only (eMMC)
-make O=x-boot-bpir64-emmc bpi_r64_emmc_boot_defconfig && make O=x-boot-bpir64-emmc
-
-# Compose SD image (pass the Infix rootfs output directory)
-utils/mkimage.sh -b x-boot-bpir64-sd -r x-aarch64/images bananapi-bpi-r64
-
-# Compose eMMC image
-utils/mkimage.sh -b x-boot-bpir64-emmc -r x-aarch64/images -t emmc bananapi-bpi-r64
-```
@@ -1,35 +0,0 @@
-define BANANAPI_BPI_R64_LINUX_CONFIG_FIXUPS
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MEDIATEK)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MACH_MT7622)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_MT7622)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_MT6577)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
-	# Ethernet subsystem clock controller — required for the eth MAC,
-	# MT7531 DSA switch, and HSDMA to get their clocks from &ethsys.
-	# Without this, eth probe fails and the switch is never detected.
-	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_MT7622_ETHSYS)
-	# HIF subsystem clock controller — required for PCIe and USB.
-	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_MT7622_HIFSYS)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
-	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)
-	$(call KCONFIG_SET_OPT,CONFIG_MT7603E,m)
-	$(call KCONFIG_SET_OPT,CONFIG_PCIE_MEDIATEK,m)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_MTK)
-	$(call KCONFIG_SET_OPT,CONFIG_USB_XHCI_MTK,m)
-	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_TPHY,m)
-	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
-	$(call KCONFIG_SET_OPT,CONFIG_MTK_SOC_THERMAL,m)
-	$(call KCONFIG_SET_OPT,CONFIG_I2C_MT65XX,m)
-	$(call KCONFIG_SET_OPT,CONFIG_PWM_MEDIATEK,m)
-	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_MT6380,m)
-	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_MTK_EFUSE,m)
-	$(call KCONFIG_SET_OPT,CONFIG_CRYPTO_DEV_SAFEXCEL,m)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_DRV_MT7622)
-endef
-
-$(eval $(ix-board))
-$(eval $(generic-package))
@@ -1 +0,0 @@
-dtb-y += mediatek/mt7622-bananapi-bpi-r64.dtb
@@ -1,3 +0,0 @@
-#include <arm64/mediatek/mt7622-bananapi-bpi-r64.dts>
-
-#include "mt7622-bananapi-bpi-r64.dtsi"
@@ -1,10 +0,0 @@
-/ {
-	chosen {
-		infix {
-			/* Default admin user password: 'admin' */
-			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
-			usb-ports = <&ssusb>;
-			usb-port-names = "USB";
-		};
-	};
-};
@@ -1,89 +0,0 @@
-image cfg.ext4 {
-        empty = true
-        temporary = true
-        size = 128M
-        ext4 {
-                label = "cfg"
-                use-mke2fs = true
-                features = "uninit_bg"
-                extraargs = "-m 0 -i 4096"
-        }
-}
-
-# The /var partition will be expanded automatically at first boot
-# to use the full size of the SD-card or eMMC media.
-image var.ext4 {
-        empty = true
-        temporary = true
-        size = 128M
-        ext4 {
-                label = "var"
-                use-mke2fs = true
-                features = "uninit_bg"
-                extraargs = "-m 0 -i 4096"
-        }
-}
-
-image #INFIX_ID##VERSION#-bpi-r64-#TARGET#.img {
-        hdimage {
-                partition-table-type = "hybrid"
-                # MT7622 TF-A partition driver detects GPT by checking MBR[0]
-                # for the 0xEE protective entry.  Place it first so that BL2
-                # (with partition-type = 0x83) lands at MBR slot 1.
-                gpt-protective-first = true
-        }
-
-        # BL2 bootloader at sector 1024 (0x80000). The MT7622 Boot ROM scans
-        # the hybrid MBR for a bootable entry and loads BL2 from its offset.
-        # partition-type makes it visible in the MBR at slot 1 (slot 0 holds
-        # the 0xEE protective entry required by the TF-A partition driver).
-        partition bl2 {
-                partition-type = 0x83
-                image = "bl2.img"
-                offset = 1024s
-                size = 1024s
-                bootable = true
-        }
-
-        # Factory/calibration data at fixed offset
-        partition factory {
-                offset = 4608K
-                size = 2M
-        }
-
-        # FIP partition - BL31 + U-Boot
-        partition fip {
-                image = "fip.bin"
-                offset = 13312s
-                size = 4096s
-        }
-
-        partition aux {
-                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
-                image = "aux.ext4"
-        }
-
-        partition primary {
-                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
-                bootable = true
-                size = 250M
-                image = "rootfs.squashfs"
-        }
-
-        partition secondary {
-                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
-                bootable = true
-                size = 250M
-                image = "rootfs.squashfs"
-        }
-
-        partition cfg {
-                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
-                image = "cfg.ext4"
-        }
-
-        partition var {
-                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
-                image = "var.ext4"
-        }
-}
@@ -1,438 +0,0 @@
-{
-  "ieee802-dot1ab-lldp:lldp": {
-    "infix-lldp:enabled": true
-  },
-  "ietf-hardware:hardware": {
-    "component": [
-      {
-        "name": "USB",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "DE",
-          "band": "2.4GHz",
-          "channel": "auto"
-        }
-      }
-    ]
-  },
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "br0",
-        "type": "infix-if-type:bridge",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "192.168.0.1",
-              "prefix-length": 24
-            }
-          ]
-        }
-      },
-      {
-        "name": "lan0",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lan1",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lan2",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lan3",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lo",
-        "type": "infix-if-type:loopback",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "127.0.0.1",
-              "prefix-length": 8
-            }
-          ]
-        },
-        "ietf-ip:ipv6": {
-          "address": [
-            {
-              "ip": "::1",
-              "prefix-length": 128
-            }
-          ]
-        }
-      },
-      {
-        "name": "wan",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv4": {
-          "infix-dhcp-client:dhcp": {
-            "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname",
-                "value": "auto"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Banana Pi BPI-R64"
-              }
-            ]
-          }
-        },
-        "ietf-ip:ipv6": {
-          "infix-dhcpv6-client:dhcp": {
-            "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "client-fqdn"
-              },
-              {
-                "id": "domain-search"
-              },
-              {
-                "id": "dns-server"
-              }
-            ]
-          }
-        }
-      },
-      {
-        "name": "wifi0-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0",
-          "access-point": {
-            "ssid": "Infix",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      }
-    ]
-  },
-  "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
-        }
-      ]
-    },
-    "symmetric-keys": {
-      "symmetric-key": [
-        {
-          "name": "wifi",
-          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
-          "key-format": "infix-crypto-types:passphrase-key-format"
-        }
-      ]
-    }
-  },
-  "ietf-netconf-acm:nacm": {
-    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
-    "groups": {
-      "group": [
-        {
-          "name": "admin",
-          "user-name": [
-            "admin"
-          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
-        }
-      ]
-    },
-    "rule-list": [
-      {
-        "name": "admin-acl",
-        "group": [
-          "admin"
-        ],
-        "rule": [
-          {
-            "name": "permit-all",
-            "module-name": "*",
-            "access-operations": "*",
-            "action": "permit",
-            "comment": "Allow 'admin' group complete access to all operations and data."
-          }
-        ]
-      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
-      {
-        "name": "default-deny-all",
-        "group": [
-          "*"
-        ],
-        "rule": [
-          {
-            "name": "deny-password-access",
-            "path": "/ietf-system:system/authentication/user/password",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
-          }
-        ]
-      }
-    ]
-  },
-  "ietf-netconf-server:netconf-server": {
-    "listen": {
-      "endpoints": {
-        "endpoint": [
-          {
-            "name": "default-ssh",
-            "ssh": {
-              "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
-              },
-              "ssh-server-parameters": {
-                "server-identity": {
-                  "host-key": [
-                    {
-                      "name": "default-key",
-                      "public-key": {
-                        "central-keystore-reference": "genkey"
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        ]
-      }
-    }
-  },
-  "ietf-system:system": {
-    "hostname": "bpi-%m",
-    "ntp": {
-      "server": [
-        {
-          "name": "default",
-          "udp": {
-            "address": "pool.ntp.org"
-          }
-        }
-      ]
-    },
-    "authentication": {
-      "user": [
-        {
-          "name": "admin",
-          "password": "$factory$",
-          "infix-system:shell": "bash"
-        }
-      ]
-    },
-    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
-  },
-  "infix-dhcp-server:dhcp-server": {
-    "option": [
-      {
-        "id": "ntp-server",
-        "address": "auto"
-      },
-      {
-        "id": "dns-server",
-        "address": "auto"
-      },
-      {
-        "id": "router",
-        "address": "auto"
-      }
-    ],
-    "subnet": [
-      {
-        "subnet": "192.168.0.0/24",
-        "pool": {
-          "start-address": "192.168.0.100",
-          "end-address": "192.168.0.250"
-        }
-      }
-    ]
-  },
-  "infix-firewall:firewall": {
-    "default": "wan",
-    "zone": [
-      {
-        "name": "lan",
-        "action": "accept",
-        "interface": [
-          "br0"
-        ]
-      },
-      {
-        "name": "wan",
-        "action": "drop",
-        "interface": [
-          "wan"
-        ],
-        "service": [
-          "dhcpv6-client"
-        ]
-      }
-    ],
-    "policy": [
-      {
-        "name": "lan-to-wan",
-        "action": "accept",
-        "ingress": [
-          "lan"
-        ],
-        "egress": [
-          "wan"
-        ],
-        "masquerade": true
-      }
-    ]
-  },
-  "infix-meta:meta": {
-    "version": "1.7"
-  },
-  "infix-services:mdns": {
-    "enabled": true
-  },
-  "infix-services:ssh": {
-    "enabled": true,
-    "hostkey": [
-      "genkey"
-    ],
-    "listen": [
-      {
-        "name": "ipv4",
-        "address": "0.0.0.0",
-        "port": 22
-      },
-      {
-        "name": "ipv6",
-        "address": "::",
-        "port": 22
-      }
-    ]
-  },
-  "infix-services:web": {
-    "enabled": true,
-    "console": {
-      "enabled": true
-    },
-    "netbrowse": {
-      "enabled": true
-    },
-    "restconf": {
-      "enabled": true
-    }
-  }
-}
@@ -1,14 +0,0 @@
-# Rename MT7531 external switch ports by DT node path.
-
-# The DTS already contains this but it has been observed in the wild
-# that we may end up with names like lan118 rather than by DTS label,
-# so this set of rules, that run after most other rules, match on the
-# OF_FULLNAME which is a stable reference.
-#
-# MT7622 / BPI-R64 switch topology (switch@1f, ports):
-#   port@0 = wan, port@1..4 = lan0..lan3, port@5,6 = cpu
-ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@0", NAME="wan"
-ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@1", NAME="lan0"
-ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@2", NAME="lan1"
-ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@3", NAME="lan2"
-ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@4", NAME="lan3"
@@ -1,2 +0,0 @@
-CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-emmc-env.dtsi"
-CONFIG_SUPPORT_EMMC_BOOT=y
@@ -1,19 +0,0 @@
-CONFIG_AUTOBOOT=y
-CONFIG_BOOTDELAY=2
-# CONFIG_MMC_PCI is not set
-CONFIG_ENV_IS_NOWHERE=y
-# CONFIG_ENV_IS_IN_MMC is not set
-
-CONFIG_USB=y
-CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_XHCI_MTK=y
-CONFIG_PHY=y
-CONFIG_PHY_MTK_TPHY=y
-
-CONFIG_DM_MDIO=y
-CONFIG_DM_ETH_PHY=y
-CONFIG_PHY_ETHERNET_ID=y
-
-CONFIG_CMD_MDIO=y
-CONFIG_CMD_USB=y
-CONFIG_CMD_DM=y
@@ -1,5 +0,0 @@
-#include <mt7622-env.dtsi>
-
-&env {
-	fdtfile = "mediatek/mt7622-bananapi-bpi-r64.dtb";
-};
@@ -1,18 +0,0 @@
-/ {
-	config {
-		env: environment {
-			bootcmd = "run ixboot";
-			boot_targets = "mmc0";
-			ethprime = "eth0";
-			fdt_addr_r = "0x43f00000";
-			kernel_addr_r = "0x44000000";
-			scriptaddr = "0x48000000";
-			ramdisk_addr_r = "0x4A000000";
-
-			/* This is a development platform, keep
-			 * developer mode statically enabled.
-			 */
-			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
-		};
-	};
-};
@@ -1,6 +0,0 @@
-#include <mt7622-env.dtsi>
-
-&env {
-	boot_targets = "mmc1";   /* SD = mmc1 on MT7622 */
-	fdtfile = "mediatek/mt7622-bananapi-bpi-r64.dtb";
-};
@@ -1 +0,0 @@
-CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-sd-env.dtsi"
@@ -4,7 +4,6 @@ config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
 	select SDCARD_AUX
 	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
-	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	help
 	  FriendlyElec NanoPi R2S is a compact router board based on
 	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.
@@ -4,9 +4,6 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
-	# TODO: for some reason this just locks up the device
-	#       so we'll have to rely on the softdog :-(
-	# $(call KCONFIG_ENABLE_OPT,CONFIG_DW_WATCHDOG)

 	# PHY drivers
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
@@ -54,10 +51,6 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)

-	# Input layer
-	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MISC)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
-
 	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)
@@ -71,8 +71,7 @@
                "id": "domain"
              },
              {
-                "id": "hostname",
-                "value": "auto"
+                "id": "hostname"
              },
              {
                "id": "dns-server"
@@ -127,9 +126,6 @@
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -137,14 +133,6 @@
          "user-name": [
            "admin"
          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
        }
      ]
    },
@@ -164,37 +152,6 @@
          }
        ]
      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
      {
        "name": "default-deny-all",
        "group": [
@@ -202,25 +159,11 @@
        ],
        "rule": [
          {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
          }
        ]
      }
@@ -0,0 +1,3 @@
+#!/bin/sh
+udevadm control --reload-rules
+udevadm trigger --subsystem-match=net --action=add
@@ -20,7 +20,6 @@ cleanup()
 {
    rm -f "$LED_FILE"
    rm -f "$PID_FILE"
-    kill %% 2>/dev/null
    exit 0
 }

@@ -32,13 +31,11 @@ remaining_time=$((1800 - $(awk '{print int($1)}' /proc/uptime)))

 while [ "$remaining_time" -gt 0 ]; do
    check_wan
-    sleep 1 &
-    wait $!
+    sleep 1
    remaining_time=$((remaining_time - 1))
 done

 while :; do
    check_wan
-    sleep 5 &
-    wait $!
+    sleep 5
 done
@@ -39,6 +39,7 @@ CONFIG_ARM64_ERRATUM_1286807=y
 CONFIG_ARM64_ERRATUM_1542419=y
 CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
+CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
 CONFIG_COMPAT=y
 # CONFIG_SUSPEND is not set
@@ -51,6 +52,7 @@ CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_ARMADA_8K_CPUFREQ=y
 CONFIG_ACPI=y
 CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -77,6 +79,7 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -92,31 +95,12 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
-CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -125,23 +109,15 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
-CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -158,69 +134,29 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_SET=y
-CONFIG_IP_SET_BITMAP_IP=y
-CONFIG_IP_SET_BITMAP_IPMAC=y
-CONFIG_IP_SET_BITMAP_PORT=y
-CONFIG_IP_SET_HASH_IP=y
-CONFIG_IP_SET_HASH_IPMARK=y
-CONFIG_IP_SET_HASH_IPPORT=y
-CONFIG_IP_SET_HASH_IPPORTIP=y
-CONFIG_IP_SET_HASH_IPPORTNET=y
-CONFIG_IP_SET_HASH_IPMAC=y
-CONFIG_IP_SET_HASH_MAC=y
-CONFIG_IP_SET_HASH_NETPORTNET=y
-CONFIG_IP_SET_HASH_NET=y
-CONFIG_IP_SET_HASH_NETNET=y
-CONFIG_IP_SET_HASH_NETPORT=y
-CONFIG_IP_SET_HASH_NETIFACE=y
-CONFIG_IP_SET_LIST_SET=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
-CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -308,7 +244,6 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
-CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -476,6 +411,7 @@ CONFIG_ARM_SBSA_WATCHDOG=y
 CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_MAX77620=y
+CONFIG_MFD_SEC_CORE=y
 CONFIG_MFD_ROHM_BD718XX=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -484,6 +420,7 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_MAX77620=y
 CONFIG_REGULATOR_PCA9450=y
 CONFIG_REGULATOR_QCOM_SPMI=y
+CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_A4TECH is not set
 # CONFIG_HID_APPLE is not set
@@ -493,16 +430,15 @@ CONFIG_REGULATOR_QCOM_SPMI=y
 # CONFIG_HID_CYPRESS is not set
 # CONFIG_HID_EZKEY is not set
 # CONFIG_HID_KENSINGTON is not set
+# CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
 CONFIG_USB_ULPI_BUS=y
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
 CONFIG_USB_EHCI_HCD=m
-CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_HCD_PLATFORM=m
 CONFIG_USB_OHCI_HCD=m
 CONFIG_USB_OHCI_HCD_PLATFORM=m
@@ -516,6 +452,7 @@ CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
 CONFIG_USB_HSIC_USB3503=m
+CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_SNP_UDC_PLAT=y
@@ -549,6 +486,7 @@ CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
 CONFIG_RTC_DRV_PCF8523=y
+CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
 CONFIG_RTC_DRV_PL031=y
@@ -563,6 +501,7 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 # CONFIG_SURFACE_PLATFORMS is not set
 CONFIG_COMMON_CLK_CS2000_CP=y
+CONFIG_COMMON_CLK_S2MPS11=y
 CONFIG_COMMON_CLK_XGENE=y
 CONFIG_COMMON_CLK_BD718XX=y
 CONFIG_MAILBOX=y
@@ -579,8 +518,7 @@ CONFIG_PHY_SAMSUNG_USB2=y
 CONFIG_NVMEM_LAYOUT_ONIE_TLV=y
 CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_POSIX_ACL=y
-CONFIG_EXT4_FS=y
+CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -599,17 +537,16 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
-CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_ISO8859_15=y
-CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
@@ -623,11 +560,13 @@ CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
 CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY=y
 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 CONFIG_WQ_WATCHDOG=y
 CONFIG_WQ_CPU_INTENSIVE_REPORT=y
 CONFIG_TEST_LOCKUP=m
+# CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
 # CONFIG_STRICT_DEVMEM is not set
@@ -1,6 +1,5 @@
 config BR2_PACKAGE_MARVELL_CN9130_CRB
 	bool "Marvell CN9130-CRB"
 	depends on BR2_aarch64
-	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Customer Reference Board for CN9130
@@ -1,6 +1,5 @@
 config BR2_PACKAGE_MARVELL_ESPRESSOBIN
 	bool "Marvell ESPRESSObin"
 	depends on BR2_aarch64
-	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Marvell ESPRESSObin
@@ -2,7 +2,10 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	bool "Raspberry Pi 64-bit (RPi3 and later)"
 	depends on BR2_aarch64
 	select SDCARD_AUX
-	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
 	  of single-board computers (SBC), RPi 3B and later, including the
@@ -107,10 +107,8 @@ To configure WiFi as a client, first store your WiFi password in the keystore:
 ```
 admin@infix:/> configure
 admin@infix:/config/> edit keystore symmetric-key mywifi
-admin@infix:/config/keystore/…/mywifi/> set key-format passphrase-key-format
-admin@infix:/config/keystore/…/mywifi/> change cleartext-symmetric-key
-Passphrase: ************
-Retype passphrase: ************
+admin@infix:/config/keystore/…/mywifi/> set key-format wifi-preshared-key-format
+admin@infix:/config/keystore/…/mywifi/> set cleartext-symmetric-key YourWiFiPassword
 admin@infix:/config/keystore/…/mywifi/> leave
 ```

@@ -312,13 +310,13 @@ While capable of basic routing tasks, be aware of limitations:
 For applications requiring multiple ports or high performance, consider
 dedicated networking hardware like the [Banana Pi R3][12].

-[0]: https://www.kernelkit.org/posts/flashing-sdcard/
-[1]: https://www.kernelkit.org/infix/latest/
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://kernelkit.org/infix/latest/
 [2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
-[3]: https://www.kernelkit.org/infix/latest/container/#content-mounts
-[4]: https://www.kernelkit.org/infix/latest/scripting-restconf/
+[3]: https://kernelkit.org/infix/latest/container/#content-mounts
+[4]: https://kernelkit.org/infix/latest/scripting-restconf/
 [8]: https://github.com/kernelkit/infix/releases/tag/latest-boot
-[9]: https://www.kernelkit.org/infix/latest/networking/#wifi
+[9]: https://kernelkit.org/infix/latest/networking/#wifi
 [10]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
 [11]: https://www.raspberrypi.com/documentation/
-[12]: https://www.kernelkit.org/infix/latest/hardware/#banana-pi-bpi-r3
+[12]: https://kernelkit.org/infix/latest/hardware/#banana-pi-bpi-r3
@@ -35,4 +35,7 @@ fixup_file=fixup4.dat
 dtoverlay=vc4-kms-v3d-pi4
 lcd_rotate=2

+# Prevent console on DSI
+console=map:0
+
 gpu_mem=256
@@ -43,8 +43,8 @@ image #INFIX_ID##VERSION#-rpi64-sdcard.img {

 	partition boot {
 		partition-type = 0xc
-		image = "boot.vfat"
 		bootable = "true"
+		image = "boot.vfat"
 	}

 	partition aux {
@@ -54,14 +54,16 @@ image #INFIX_ID##VERSION#-rpi64-sdcard.img {

 	partition primary {
 		partition-type-uuid = linux
-		image = "rootfs.squashfs"
+		bootable = "true"
 		size = 250M
+		image = "rootfs.squashfs"
 	}

 	partition secondary {
 		partition-type-uuid = linux
-		image = "rootfs.squashfs"
+		bootable = "true"
 		size = 250M
+		image = "rootfs.squashfs"
 	}

 	partition cfg {
@@ -10,13 +10,6 @@
        "state": {
          "admin-state": "unlocked"
        }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "00"
-        }
      }
    ]
  },
@@ -45,7 +38,6 @@
      {
        "name": "eth0",
        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
        "ietf-ip:ipv4": {
          "infix-dhcp-client:dhcp": {
            "option": [
@@ -62,8 +54,7 @@
                "id": "domain"
              },
              {
-                "id": "hostname",
-                "value": "auto"
+                "id": "hostname"
              },
              {
                "id": "dns-server"
@@ -81,10 +72,7 @@
      },
      {
        "name": "wifi0",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0"
-        }
+        "type": "infix-if-type:wifi"
      }
    ]
  },
@@ -104,9 +92,6 @@
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -114,14 +99,6 @@
          "user-name": [
            "admin"
          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
        }
      ]
    },
@@ -141,37 +118,6 @@
          }
        ]
      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
      {
        "name": "default-deny-all",
        "group": [
@@ -179,25 +125,11 @@
        ],
        "rule": [
          {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
          }
        ]
      }
@@ -1,313 +0,0 @@
-{
-  "ieee802-dot1ab-lldp:lldp": {
-    "infix-lldp:enabled": true
-  },
-  "ietf-hardware:hardware": {
-    "component": [
-      {
-        "name": "USB1",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "name": "USB2",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "name": "USB3",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "00"
-        }
-      }
-    ]
-  },
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "lo",
-        "type": "infix-if-type:loopback",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "127.0.0.1",
-              "prefix-length": 8
-            }
-          ]
-        },
-        "ietf-ip:ipv6": {
-          "address": [
-            {
-              "ip": "::1",
-              "prefix-length": 128
-            }
-          ]
-        }
-      },
-      {
-        "name": "eth0",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "ietf-ip:ipv4": {
-          "infix-dhcp-client:dhcp": {
-            "option": [
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname",
-                "value": "auto"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Raspberry Pi 400"
-              }
-            ]
-          }
-        }
-      },
-      {
-        "name": "wifi0",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0"
-        }
-      }
-    ]
-  },
-  "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
-        }
-      ]
-    }
-  },
-  "ietf-netconf-acm:nacm": {
-    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
-    "groups": {
-      "group": [
-        {
-          "name": "admin",
-          "user-name": [
-            "admin"
-          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
-        }
-      ]
-    },
-    "rule-list": [
-      {
-        "name": "admin-acl",
-        "group": [
-          "admin"
-        ],
-        "rule": [
-          {
-            "name": "permit-all",
-            "module-name": "*",
-            "access-operations": "*",
-            "action": "permit",
-            "comment": "Allow 'admin' group complete access to all operations and data."
-          }
-        ]
-      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
-      {
-        "name": "default-deny-all",
-        "group": [
-          "*"
-        ],
-        "rule": [
-          {
-            "name": "deny-password-access",
-            "path": "/ietf-system:system/authentication/user/password",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
-          }
-        ]
-      }
-    ]
-  },
-  "ietf-netconf-server:netconf-server": {
-    "listen": {
-      "endpoints": {
-        "endpoint": [
-          {
-            "name": "default-ssh",
-            "ssh": {
-              "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
-              },
-              "ssh-server-parameters": {
-                "server-identity": {
-                  "host-key": [
-                    {
-                      "name": "default-key",
-                      "public-key": {
-                        "central-keystore-reference": "genkey"
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        ]
-      }
-    }
-  },
-  "ietf-system:system": {
-    "hostname": "rpi-%m",
-    "ntp": {
-      "enabled": true,
-      "server": [
-        {
-          "name": "ntp.org",
-          "udp": {
-            "address": "pool.ntp.org"
-          },
-          "iburst": true
-        }
-      ]
-    },
-    "authentication": {
-      "user": [
-        {
-          "name": "admin",
-          "password": "$factory$",
-          "infix-system:shell": "bash"
-        }
-      ]
-    },
-    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
-  },
-  "infix-meta:meta": {
-    "version": "1.7"
-  },
-  "infix-services:mdns": {
-    "enabled": true
-  },
-  "infix-services:web": {
-    "enabled": true,
-    "console": {
-      "enabled": true
-    },
-    "netbrowse": {
-      "enabled": true
-    },
-    "restconf": {
-      "enabled": true
-    }
-  },
-  "infix-services:ssh": {
-    "enabled": true,
-    "hostkey": [
-      "genkey"
-    ],
-    "listen": [
-      {
-        "name": "ipv4",
-        "address": "0.0.0.0",
-        "port": 22
-      },
-      {
-        "name": "ipv6",
-        "address": "::",
-        "port": 22
-      }
-    ]
-  }
-}
@@ -1,10 +0,0 @@
-{
-    "eth0": {
-	"comment": "Primary Ethernet controller, native on BCM2711, and smsc95xx on BCM2837",
-	"phy-detached-when-down": true
-    },
-    "@ethtool:driver=smsc95xx": {
-	"comment": "BCM2837 smsc95xx driver does not support disabling flow control",
-        "broken-flow-control": true
-    }
-}
@@ -12,15 +12,6 @@
 			boot_targets = "mmc0";
 			ethprime = "eth0";

-			/* Memory layout for kernel boot:
-			 *   0x00200000: Kernel relocation address
-			 *   0x04000000: FDT (64MB, gives enough space for kernels up to ~60MB)
-			 *   0x10000000: Ramdisk (Memsize - 256MB)
-			 */
-			kernel_addr_r = "0x00200000";
-			fdt_addr_r = "0x04000000";
-			ramdisk_addr_r = "0x10000000";
-
 			stdout = "serial";
 			stderr = "serial";
 			stdin = "serial";
@@ -1,6 +1,5 @@
 config BR2_PACKAGE_STYX_DCP_SC_28P
 	bool "Styx DCP-SC-28P"
 	depends on BR2_aarch64
-	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Styx DCP-SC-28P
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`dtb-y += mediatek/mt7622-bananapi-bpi-r64.dtb`
				`@@ -1 +0,0 @@`
				`CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-sd-env.dtsi"`