.gitea/workflows/build.yaml

@@ -18,7 +18,7 @@ on:
 
 jobs:
   build:
-    runs-on: talos-rpi5
+    runs-on: [self-hosted, macos]
     timeout-minutes: 180
 
     steps:
@@ -33,7 +33,6 @@ jobs:
           for pkg in make gnu-sed crane; do
             brew list --formula "$pkg" &>/dev/null || brew install "$pkg"
           done
-          echo "/opt/homebrew/opt/gnu-sed/libexec/gnubin" >> "$GITHUB_PATH"
           gmake --version | head -1
 
       - name: Set up Docker Buildx
@@ -67,6 +66,9 @@ jobs:
       - name: Tag release images
         run: gmake release TAG=${{ steps.version.outputs.tag }}
 
+      - name: Run Docker Scout CVE scan
+        run: gmake scout
+
       - name: Compress disk image
         run: |
           # The imager outputs to checkouts/talos/_out/
@@ -89,6 +91,11 @@ jobs:
           REPO="${GITHUB_REPOSITORY}"
           API="${GITEA_URL}/api/v1"
 
+          SCOUT_SECTION=""
+          if [ -f _out/scout-report.md ]; then
+            SCOUT_SECTION=$(cat _out/scout-report.md)
+          fi
+
           # Extract component versions from tag (format: v1.12.3-k6.12.47-1)
           TALOS_VER=$(echo "$TAG" | sed -E 's/^(v[0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
           KERNEL_VER=$(echo "$TAG" | sed -E 's/.*-k([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
@@ -102,7 +109,10 @@ jobs:
 
           ## Artifacts
           - \`metal-arm64.raw.zst\` — Raw disk image for eMMC flashing
-          - \`docker.io/svrnty/talos-rpi5:${TAG}\` — Installer image for talosctl upgrade"
+          - \`docker.io/svrnty/talos-rpi5:${TAG}\` — Installer image for talosctl upgrade
+
+          ## Security Scan
+          ${SCOUT_SECTION}"
 
           # Strip leading whitespace from heredoc-style indentation
           RELEASE_BODY=$(echo "$RELEASE_BODY" | sed 's/^          //')

.gitea/workflows/check-updates.yaml

@@ -13,7 +13,7 @@ on:
 
 jobs:
   check-and-build:
-    runs-on: talos-rpi5
+    runs-on: [self-hosted, macos]
     timeout-minutes: 15
 
     steps:
@@ -27,7 +27,6 @@ jobs:
           for pkg in make gnu-sed crane jq; do
             brew list --formula "$pkg" &>/dev/null || brew install "$pkg"
           done
-          echo "/opt/homebrew/opt/gnu-sed/libexec/gnubin" >> "$GITHUB_PATH"
 
       - name: Check for upstream updates
         id: check

Makefile

@@ -11,8 +11,8 @@
 #   make release             # Tag and push release images
 #   make clean               # Remove checkouts and build artifacts
 
-PKG_VERSION = v1.13.0
-TALOS_VERSION = v1.13.2
+PKG_VERSION = v1.12.0
+TALOS_VERSION = v1.12.3
 SBCOVERLAY_VERSION = main
 
 # Prefer GNU coreutils (macOS: brew install gnu-sed coreutils)
@@ -74,6 +74,7 @@ help:
 	@echo "  overlay    — Build SBC overlay (U-Boot, firmware, DTBs)"
 	@echo "  installer  — Build Talos installer image + raw disk image"
 	@echo "  release    — Tag and push release images"
+	@echo "  scout      — Run Docker Scout CVE scan on all images"
 	@echo "  clean      — Remove checkouts and build artifacts"
 	@echo ""
 	@echo "Variables:"
@@ -115,16 +116,8 @@ patches-talos:
 		git am "$(PATCHES_DIRECTORY)/siderolabs/talos/"*.patch
 
 patches-overlay:
-	@cd "$(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5" && \
-		GO_VER=$$(sed -n 's/^go //p' go.work | head -1) && \
-		GO_MINOR=$$(echo "$$GO_VER" | cut -d. -f1,2) && \
-		if [ "$$GO_MINOR" = "1.24" ]; then \
-			echo "Overlay Go $$GO_VER — applying Go toolchain patch (CVE fix)"; \
-			git am "$(PATCHES_DIRECTORY)/talos-rpi5/sbc-raspberrypi5/0001-"*.patch; \
-		else \
-			echo "Overlay Go $$GO_VER — skipping Go toolchain patch (CVEs fixed upstream)"; \
-		fi && \
-		git am "$(PATCHES_DIRECTORY)/talos-rpi5/sbc-raspberrypi5/0002-"*.patch
+	cd "$(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5" && \
+		git am "$(PATCHES_DIRECTORY)/talos-rpi5/sbc-raspberrypi5/"*.patch
 
 patches: patches-pkgs patches-talos patches-overlay
 
@@ -188,12 +181,8 @@ installer:
 			--base-installer-image="$(INSTALLER_IMAGE):base-$(TALOS_TAG)" \
 			$(IMAGER_COMMON_FLAGS) && \
 		crane push ./_out/installer-arm64.tar $(INSTALLER_IMAGE):$(TALOS_TAG) && \
-		printf "FROM $(INSTALLER_IMAGE):$(TALOS_TAG)\n" | docker buildx build \
-			--platform linux/arm64 \
-			$(ATTESTATION_ARGS) \
-			-t $(INSTALLER_IMAGE):$(TALOS_TAG) --push - && \
 		docker \
-			run --rm -t -v ./_out:/out -v /dev:/dev --privileged --network=host \
+			run --rm -t -v ./_out:/out -v /dev:/dev --privileged \
 			$(IMAGER_IMAGE):$(TALOS_TAG) \
 			metal --arch arm64 \
 			--base-installer-image="$(INSTALLER_IMAGE):$(TALOS_TAG)" \
@@ -204,9 +193,40 @@ installer:
 #
 .PHONY: release
 release:
-	docker buildx imagetools create \
-		-t $(REGISTRY)/$(REGISTRY_USERNAME)/$(IMAGE_NAME):$(TAG) \
-		$(INSTALLER_IMAGE):$(TALOS_TAG)
+	docker pull $(INSTALLER_IMAGE):$(TALOS_TAG) && \
+		docker tag $(INSTALLER_IMAGE):$(TALOS_TAG) $(REGISTRY)/$(REGISTRY_USERNAME)/$(IMAGE_NAME):$(TAG) && \
+		docker push $(REGISTRY)/$(REGISTRY_USERNAME)/$(IMAGE_NAME):$(TAG)
+
+#
+# Scout — Docker Scout CVE scan on all pushed images
+#
+SCOUT_REPORT := _out/scout-report.md
+SCOUT_IMAGES := \
+	$(KERNEL_IMAGE):$(PKGS_TAG) \
+	$(OVERLAY_IMAGE):$(SBCOVERLAY_TAG) \
+	$(IMAGER_IMAGE):$(TALOS_TAG) \
+	$(INSTALLER_IMAGE):base-$(TALOS_TAG) \
+	$(INSTALLER_IMAGE):$(TALOS_TAG)
+
+.PHONY: scout
+scout:
+	@mkdir -p _out
+	@if ! docker scout version >/dev/null 2>&1; then \
+		echo "Docker Scout not available -- skipping CVE scan." > $(SCOUT_REPORT); \
+		exit 0; \
+	fi
+	@echo "# Docker Scout CVE Summary" > $(SCOUT_REPORT)
+	@echo "" >> $(SCOUT_REPORT)
+	@for image in $(SCOUT_IMAGES); do \
+		echo "Scanning $$image ..."; \
+		echo "### $${image##*/}" >> $(SCOUT_REPORT); \
+		echo '```' >> $(SCOUT_REPORT); \
+		docker scout quickview "$$image" --platform linux/arm64 2>&1 >> $(SCOUT_REPORT) || \
+			echo "Scout scan failed for $$image" >> $(SCOUT_REPORT); \
+		echo '```' >> $(SCOUT_REPORT); \
+		echo "" >> $(SCOUT_REPORT); \
+	done
+	@echo "Scout report written to $(SCOUT_REPORT)"
 
 #
 # Clean

README.md

@@ -1,269 +1,101 @@
 # Talos CM5 Builder
 
-Custom Talos Linux images for Raspberry Pi 5 / CM5 on Compute Blade hardware.
-
-<a href="https://git.openharbor.io/svrnty/talos-rpi5/releases" target="_blank"><img src="https://img.shields.io/badge/releases-Gitea-green?logo=gitea&logoColor=white" alt="Gitea Releases"></a>
-<a href="https://hub.docker.com/r/svrnty/talos-rpi5" target="_blank"><img src="https://img.shields.io/docker/v/svrnty/talos-rpi5?sort=semver&label=talos-rpi5&logo=docker&arch=arm64" alt="Docker Hub"></a>
-<a href="https://hub.docker.com/r/svrnty/talos-rpi5" target="_blank"><img src="https://img.shields.io/docker/pulls/svrnty/talos-rpi5?logo=docker" alt="Docker Pulls"></a>
-<a href="https://hub.docker.com/r/svrnty/talos-rpi5" target="_blank"><img src="https://img.shields.io/docker/image-size/svrnty/talos-rpi5?sort=semver&logo=docker&arch=arm64" alt="Docker Image Size"></a>
+Custom Talos Linux images for Raspberry Pi CM5 on Compute Blade hardware.
 
 The official Talos Image Factory does not support CM5 — the mainline kernel lacks CM5 device trees and RP1 driver support. This builder uses the RPi downstream kernel (via [talos-rpi5/talos-builder](https://github.com/talos-rpi5/talos-builder) patches) to produce working CM5 images with our extensions and overclock config.
 
-## Current versions
+## What it builds
 
-| Component | Version |
-|-----------|---------|
-| Talos Linux | <a href="https://github.com/siderolabs/talos" target="_blank"><img src="https://img.shields.io/badge/talos-v1.13.2-blue?logo=kubernetes&logoColor=white" alt="Talos version"></a> |
-| RPi Kernel | <a href="https://github.com/raspberrypi/linux" target="_blank"><img src="https://img.shields.io/badge/kernel-6.12.47-blue?logo=linux&logoColor=white" alt="Kernel version"></a> |
-| iscsi-tools | <a href="https://github.com/siderolabs/extensions" target="_blank"><img src="https://img.shields.io/badge/iscsi--tools-v0.1.6-blue?logo=docker" alt="iscsi-tools version"></a> |
-| util-linux-tools | <a href="https://github.com/siderolabs/extensions" target="_blank"><img src="https://img.shields.io/badge/util--linux--tools-2.40.4-blue?logo=docker" alt="util-linux-tools version"></a> |
+- **Installer image** → `docker.io/svrnty/talos-rpi5:<tag>` (for `talosctl upgrade`)
+- **Raw disk image** → Gitea release `metal-arm64.raw.zst` (for eMMC flashing)
 
-## Image tags
-
-Release images are published to <a href="https://hub.docker.com/r/svrnty/talos-rpi5" target="_blank"><code>docker.io/svrnty/talos-rpi5</code></a> with the format:
-
-```
-v<talos>-k<kernel>-<revision>
-```
-
-For example: `v1.13.2-k6.12.47-1`
-
-| Segment | Meaning |
-|---------|---------|
-| `v1.13.2` | Upstream Talos Linux version |
-| `k6.12.47` | RPi downstream kernel version |
-| `1` | Build revision (bumped for config/patch changes on the same upstream versions) |
+Baked-in config:
+- RPi downstream kernel with CM5/RP1 support
+- Overclock: 2.6GHz (`arm_freq=2600`, `over_voltage_delta=50000`, `arm_boost=1`)
+- Extensions: `iscsi-tools`, `util-linux-tools`
 
 ## Usage
 
-### Install from raw disk image
-
-Download `metal-arm64.raw.zst` from the [latest release](../../releases/latest) and flash to eMMC:
+### Building locally (ARM64 host required)
 
 ```bash
-zstd -d metal-arm64.raw.zst -o metal-arm64.raw
-# Flash to eMMC/SD via your preferred tool (dd, balenaEtcher, etc.)
+make checkouts patches   # Clone and patch sources
+make kernel              # Build RPi kernel
+make overlay             # Build SBC overlay
+make installer           # Build installer + disk image
 ```
 
-### Upgrade an existing node
+### CI/CD (Gitea Actions)
+
+Push a version tag to trigger an automated build:
 
 ```bash
-talosctl upgrade --image docker.io/svrnty/talos-rpi5:v1.13.2-k6.12.47-1 --nodes <node-ip>
+git tag v1.11.5-1
+git push origin v1.11.5-1
 ```
 
-In-place upgrades are fully supported. The image includes patches to force GRUB with `--no-nvram` on arm64 (working around the RPi5/CM5 `SetVariableRT` firmware limitation) and to handle the SBC EFI-only disk layout (no separate BOOT partition).
+The pipeline runs on the ARM64 self-hosted runner and:
+1. Builds the kernel, overlay, and installer
+2. Pushes the installer image to Docker Hub
+3. Creates a Gitea release with the raw disk image
 
-### What's included
+### Upstream update checks
 
-- RPi downstream kernel with CM5/RP1 support (4K page size, aligned with upstream Talos)
-- GRUB bootloader with `--no-nvram` for reliable `talosctl upgrade` on RPi5/CM5
-- SBC EFI-only boot layout support (probe, install, revert all fall back to EFI partition when BOOT partition is absent)
-- Fallback to classic bind mounts on kernels without `open_tree` support (Linux <6.15)
-- Overclock: 2.6GHz (`arm_freq=2600`, `over_voltage_delta=50000`, `arm_boost=1`)
-- PCIe Gen 3 enabled for NVMe (~800 MB/s, via `dtparam=pciex1_gen=3` in `config.txt`)
-- Serial console on GPIO UART0 (`dtoverlay=uart0-pi5`, 115200 baud, even parity)
-- Extensions: `iscsi-tools`, `util-linux-tools`
+A weekly scheduled workflow checks for new Talos and RPi kernel releases and creates Gitea issues when updates are available.
 
-## Known issues
+## CI Secrets
 
-### Serial console (read-only)
+| Secret | Description |
+|--------|-------------|
+| `REGISTRY_USERNAME` | Docker Hub username (org-level) |
+| `REGISTRY_PASSWORD` | Docker Hub access token (org-level) |
 
-The serial console outputs kernel logs, boot messages, and panic traces over GPIO UART0 (`ttyAMA0`) at 115200 baud with **even parity**. Talos Linux has no interactive shell — the console is **read-only** and cannot accept input.
+## Runner Setup (Apple Silicon Mac Mini)
 
-On Pi5/CM5, GPIO 14/15 are not mapped to UART by default (unlike Pi4). The `dtoverlay=uart0-pi5` device tree overlay is required and is applied via `configTxtAppend` (after `disable-bt` and `disable-wifi` — ordering matters).
-
-#### Wiring (Compute Blade)
-
-Connect a **3.3V** USB-to-UART adapter to the front UART header (3-pin: GND, RX, TX). Only two wires are needed for read-only monitoring:
-
-```
-  USB-UART Adapter          Compute Blade (Front UART)
-  ┌──────────────┐          ┌──────────────┐
-  │          GND ├──────────┤ GND          │
-  │           RX ├──────────┤ TX           │
-  │           TX │          │ RX           │
-  └──────────────┘          └──────────────┘
-      3.3V logic              3.3V GPIO
-```
-
-- **Adapter RX** connects to **Blade TX** (adapter receives data from the blade)
-- **GND** to **GND** (common ground reference)
-- Adapter TX is not needed for read-only monitoring (Talos has no shell to send input to)
-
-> **Warning:** CM5 GPIO is **3.3V only**. A 5V logic adapter will crash or damage the board.
-
-Tested with: [USB to TTL Serial Cable (FT232RNL)](https://www.pishop.ca/product/usb-to-ttl-serial-cable-for-raspberry-pi-5-debugging-ft232rnl-chip/) set to 3.3V mode.
-
-#### Reading the console
+The build runner needs:
+- Docker Desktop with Buildx (arm64 native)
+- Gitea `act_runner` registered with labels: `self-hosted`, `macOS`, `arm64`
+- Sufficient disk space for kernel builds (~20GB)
 
 ```bash
-# macOS — use screen with even parity
-screen /dev/cu.usbserial-XXXXXXXX 115200,,cse
+# Install act_runner via Homebrew
+brew install act_runner
 
-# Linux — configure with stty, then read with cat
-stty -F /dev/ttyUSB0 115200 cs8 parenb -parodd
-cat /dev/ttyUSB0
+# Or download directly
+curl -sL https://gitea.com/gitea/act_runner/releases/latest/download/act_runner-darwin-arm64 -o act_runner
+chmod +x act_runner
+
+# Register
+./act_runner register \
+  --instance https://git.openharbor.io \
+  --token <runner-token> \
+  --name mac-mini \
+  --labels self-hosted,macOS,arm64
+
+# Run as service
+./act_runner daemon
 ```
 
-*Upstream: <a href="https://github.com/talos-rpi5/talos-builder/issues/4" target="_blank">talos-builder#4</a>*
+## Structure
 
-### Install disk config ignored on SBCs
-
-Talos ignores the `machine.install.disk` config field on SBC platforms. You **must flash the disk image directly** to your target disk (eMMC, SD, NVMe). For NVMe boot, `dd` the metal image to the NVMe drive and configure the EEPROM boot order (`BOOT_ORDER=0xf416`, `PCIE_PROBE=1`).
-
-*Upstream: <a href="https://github.com/talos-rpi5/talos-builder/issues/22" target="_blank">talos-builder#22</a>*
-
-## Patches
-
-| Patch | Target | Description |
-|-------|--------|-------------|
-| `0001` (pkgs) | Kernel | RPi downstream kernel 6.12.x with CM5/RP1 device tree and driver support |
-| `0001` (talos) | Modules | arm64 kernel module list for RPi downstream kernel |
-| `0002` (talos) | GRUB | `--no-nvram` for `grub-install` on arm64 (U-Boot lacks EFI `SetVariable`) |
-| `0003` (talos) | Bootloader | Force GRUB over sd-boot on arm64 (sd-boot crashes without EFI runtime) |
-| `0004` (talos) | Runtime | Fallback to classic bind mounts on kernels without `open_tree` (Linux <6.15) |
-| `0005` (talos) | GRUB | Handle missing BOOT partition for SBC EFI-only disk layouts (install path) |
-| `0006` (talos) | GRUB | EFI-at-/boot fallback for BOOT-less SBC layouts on the upgrade path |
-| `0007` (talos) | Config | Wait up to 5 min for STATE volume on slow-init disks (CM5 eMMC) — prevents maintenance-mode fall-through on `talosctl upgrade` |
-| `0008` (talos) | Imager | Respect `--insecure` flag for Overlay and OverlayInstaller assets (build-tool only) |
-| `0001` (overlay) | Toolchain | Bump Go to 1.24.13 (CVE fix) |
-| `0002` (overlay) | Upgrade | Detect EFI mount path for SBC layouts (no BOOT partition) |
-
-## Roadmap
-
-This project targets production-ready Talos clusters on RPi5/CM5 hardware.
-
-| Status | Milestone | Description |
-|--------|-----------|-------------|
-| Tested | **4K page size** | Aligned with upstream Talos kernel config. Reduces memory overhead and improves workload compatibility (Longhorn, jemalloc, F2FS, etc.). |
-| Tested | **Reliable in-place upgrades** | Force GRUB bootloader with `--no-nvram` on arm64, handle SBC EFI-only disk layout, tolerate slow eMMC init on CM5 (waits up to 5 min for STATE before falling back to maintenance). Verified end-to-end via canonical 3-CP rolling upgrade `v1.12.4 → v1.13.2`. |
-| Tested | **Kernel <6.15 compatibility** | Unconditional `open_tree` capability check — falls back to classic bind mounts on RPi downstream kernel 6.12.x. |
-| Tested | **Serial console** | GPIO UART0 (`ttyAMA0`) via `dtoverlay=uart0-pi5`. Read-only output at 115200 baud, even parity. Verified on Compute Blade with FT232RNL adapter. |
-| Tested | **NVMe boot support** | `dd` image to NVMe + set EEPROM `BOOT_ORDER=0xf416` and `PCIE_PROBE=1`. Verified on 1TB Kingston NVMe on Compute Blade. |
-
-## NVMe boot
-
-The kernel has NVMe built-in (`CONFIG_BLK_DEV_NVME=y`), so booting from NVMe should work by flashing the disk image directly and configuring the RPi5/CM5 EEPROM.
-
-### 1. Flash the image to NVMe
-
-Connect the NVMe drive via a USB adapter and flash:
-
-```bash
-zstd -d metal-arm64.raw.zst | sudo dd of=/dev/<nvme-device> bs=4M status=progress
-sync
 ```
-
-### 2. Configure EEPROM boot order
-
-Use `rpiboot` to update the CM5 EEPROM. Clone the usbboot repo and edit the boot config:
-
-```bash
-git clone --depth=1 https://github.com/raspberrypi/usbboot
-cd usbboot && make
-# Edit the EEPROM config for CM5
-cp recovery/boot.conf recovery/boot.conf.bak
+.gitea/workflows/
+  build.yaml              # Build pipeline (tag push trigger)
+  check-updates.yaml      # Upstream update checker (weekly cron)
+Makefile                   # Build orchestration
+config/
+  config.txt.append        # CM5 overclock settings
+  extensions.yaml          # System extensions list
+scripts/
+  check-upstream.sh        # Version comparison script
+patches/
+  siderolabs/
+    pkgs/0001-*.patch      # RPi kernel patch
+    talos/0001-*.patch     # Module list patch
+  talos-rpi5/
+    sbc-raspberrypi5/      # Overlay patches (Go toolchain bump)
 ```
 
-Add or update these values in `recovery/boot.conf`:
-
-```ini
-BOOT_ORDER=0xf416
-PCIE_PROBE=1
-```
-
-Then flash via USB with the CM5 in USB boot mode (hold nRPIBOOT or disable eMMC boot on your carrier board):
-
-```bash
-sudo ./rpiboot -d recovery
-```
-
-`BOOT_ORDER` is read right-to-left: try NVMe (`6`) first, then SD (`1`), then USB (`4`), then restart (`f`). `PCIE_PROBE=1` is required for non-HAT+ NVMe adapters (Compute Blade, most M.2 carrier boards).
-
-### 3. Boot from NVMe
-
-Power on. The RPi firmware should find the boot partition on NVMe, load U-Boot, and boot Talos.
-
-### Optional: enable PCIe Gen 3
-
-PCIe Gen 3 doubles NVMe throughput (~400 MB/s → ~800 MB/s). Not officially certified by Raspberry Pi but stable on most NVMe drives.
-
-**New installs** — PCIe Gen 3 is enabled by default in images built from this repo (`config.txt.append` includes `dtparam=pciex1_gen=3`).
-
-**Existing nodes** — After a `talosctl upgrade`, the overlay rewrites `config.txt` with the baked-in settings (including PCIe Gen 3). If you need to enable it manually on an older image:
-
-1. Power off the node and remove the NVMe drive
-2. Connect via USB adapter and mount the first (EFI) partition
-3. Add to `config.txt` under the `[pi5]` section:
-   ```ini
-   dtparam=pciex1_gen=3
-   ```
-4. Unmount, reinstall the drive, and power on
-
-To verify after boot:
-```bash
-talosctl -n <ip> dmesg | grep -i pcie
-# Look for "Gen 3" in the PCIe link speed output
-```
-
-## Reference architecture
-
-Recommended storage layout for production Talos clusters on CM5 Compute Blade hardware. Each CM5 has a 32GB eMMC and an M.2 NVMe slot.
-
-| Role | Boot disk | NVMe | EEPROM `BOOT_ORDER` | Rationale |
-|------|-----------|------|---------------------|-----------|
-| **Control plane** | NVMe | Talos OS | `0xf416` (NVMe first) | etcd lives on the STATE partition — NVMe gives ~800 MB/s sequential and ~50K random IOPS for fast consensus and snapshot I/O. |
-| **Postgres / storage** | eMMC | Data (`/var/mnt/data`) | `0xf214` (eMMC first) | Talos OS on eMMC keeps `talosctl upgrade` away from the data drive. The full 1TB NVMe is dedicated to database storage via `machine.disks`. |
-| **Compute workers** | eMMC | None | `0xf214` (eMMC first) | Stateless workloads — no local storage needed. eMMC is more than enough for Talos OS (~2.2GB used). |
-
-### Storage configuration
-
-**Control planes** — no extra config needed. Talos installs to the NVMe automatically when it's the boot disk.
-
-**Postgres / storage nodes** — add `machine.disks` to mount the NVMe as a data volume:
-
-```yaml
-machine:
-    disks:
-        - device: /dev/nvme0n1
-          partitions:
-              - mountpoint: /var/mnt/data
-```
-
-Talos automatically partitions, formats (XFS), and mounts the NVMe on first boot. The data persists across `talosctl upgrade` since upgrades only touch the boot disk (eMMC).
-
-**Compute workers** — no storage config needed.
-
-### EEPROM setup
-
-All CM5 modules require `PCIE_PROBE=1` for NVMe detection on Compute Blade (non-HAT+ carrier). Set via `rpiboot`:
-
-```ini
-# recovery/boot.conf
-BOOT_ORDER=0xf416   # NVMe-first (control planes)
-# or
-BOOT_ORDER=0xf214   # eMMC-first (storage/compute workers)
-PCIE_PROBE=1         # always required
-```
-
-### Overclock
-
-All node types share the same overclock config (baked into the image via `config.txt.append`):
-
-```ini
-dtparam=pciex1_gen=3
-dtoverlay=uart0-pi5
-arm_freq=2600
-over_voltage_delta=50000
-arm_boost=1
-```
-
-Verified stable at 44.6°C max under full CPU + memory + disk stress across 10 nodes with Compute Blade heatsinks.
-
-## Building
-
-For local builds, CI/CD setup, runner configuration, and project structure, see [TECHNICAL.md](TECHNICAL.md).
-
 ## License
 
 This project is licensed under the [Mozilla Public License 2.0](LICENSE).

TECHNICAL.md

@@ -1,87 +0,0 @@
-# Technical Guide
-
-Build infrastructure, CI/CD configuration, and project structure for the Talos CM5 Builder.
-
-## Building locally (ARM64 host required)
-
-```bash
-make checkouts patches   # Clone and patch upstream sources
-make kernel              # Build RPi kernel
-make overlay             # Build SBC overlay
-make installer           # Build installer + disk image
-```
-
-## CI/CD (Gitea Actions)
-
-Push a version tag to trigger an automated build:
-
-```bash
-git tag v1.12.3-k6.12.47-2
-git push origin v1.12.3-k6.12.47-2
-```
-
-The pipeline runs on the ARM64 self-hosted runner and:
-1. Builds the kernel, overlay, and installer
-2. Attaches SBOM attestation (cosign + syft)
-3. Pushes the installer image to Docker Hub
-4. Creates a Gitea release with the raw disk image
-
-### Upstream update checks
-
-A weekly scheduled workflow checks for new Talos and RPi kernel releases and creates Gitea issues when updates are available.
-
-## CI Secrets
-
-| Secret | Description |
-|--------|-------------|
-| `REGISTRY_USERNAME` | Docker Hub username (org-level) |
-| `REGISTRY_PASSWORD` | Docker Hub access token (org-level) |
-
-## Runner Setup (Apple Silicon Mac Mini)
-
-The build runner needs:
-- Docker Desktop with Buildx (arm64 native)
-- Gitea `act_runner` registered with labels: `self-hosted`, `macOS`, `arm64`
-- Sufficient disk space for kernel builds (~20GB)
-
-```bash
-# Install act_runner via Homebrew
-brew install act_runner
-
-# Or download directly
-curl -sL https://gitea.com/gitea/act_runner/releases/latest/download/act_runner-darwin-arm64 -o act_runner
-chmod +x act_runner
-
-# Register
-./act_runner register \
-  --instance https://git.openharbor.io \
-  --token <runner-token> \
-  --name mac-mini \
-  --labels self-hosted,macOS,arm64
-
-# Run as service
-./act_runner daemon
-```
-
-## Project Structure
-
-```
-.gitea/workflows/
-  build.yaml              # Build pipeline (tag push trigger)
-  check-updates.yaml      # Upstream update checker (weekly cron)
-Makefile                   # Build orchestration
-config/
-  config.txt.append        # CM5 overclock settings
-  extensions.yaml          # System extensions list
-scripts/
-  check-upstream.sh        # Version comparison script
-patches/
-  siderolabs/
-    pkgs/0001-*.patch      # RPi kernel patch
-    talos/0001-*.patch     # Module list patch
-    talos/0002-*.patch     # Skip NVRAM writes for GRUB on arm64
-    talos/0003-*.patch     # Force GRUB bootloader on arm64
-  talos-rpi5/
-    sbc-raspberrypi5/      # Overlay patches (Go toolchain bump)
-cosign.pub                 # Public key for verifying image attestations
-```

config/config.txt.append

@@ -1,8 +1,3 @@
-# Enable PCIe Gen 3 for NVMe (~800 MB/s vs ~400 MB/s Gen 2)
-dtparam=pciex1_gen=3
-# Enable GPIO UART0 (ttyAMA0) on Pi5/CM5 for serial console
-# Must load AFTER disable-bt and disable-wifi overlays in config.txt
-dtoverlay=uart0-pi5
 # CM5 Overclock — 2.6GHz stable on Compute Blade with heatsink
 arm_freq=2600
 over_voltage_delta=50000

cosign.pub

@@ -1,4 +0,0 @@
------BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEPkZxXgi280kakXdVwjygCvIs5chd
-Ns/gANqNilq0OZDkmcAzeaKJRkRbiDjqNeW1JLv1CYwN/1olypEdVyjLoQ==
------END PUBLIC KEY-----

patches/siderolabs/pkgs/0001-Patched-for-Raspberry-Pi-5.patch

@@ -1,27 +1,27 @@
-From d60ac2d35158faae78899da5f03479498ac6b317 Mon Sep 17 00:00:00 2001
-From: Mathias Beaulieu-Duncan <mathias@svrnty.io>
-Date: Sat, 14 Feb 2026 13:14:00 -0500
+From d4788cfac4085fd281d2849cc740a9cbfd83a36b Mon Sep 17 00:00:00 2001
+From: Patrick Hunziker <patrick@hunziker.io>
+Date: Mon, 22 Sep 2025 18:47:02 +0200
 Subject: [PATCH] Patched for Raspberry Pi 5
 
 ---
  Pkgfile                   |   8 +-
- kernel/build/config-arm64 | 315 ++++++++++++++++++++++++++------------
+ kernel/build/config-arm64 | 412 +++++++++++++++++++++++---------------
  kernel/build/pkg.yaml     |   2 +-
  kernel/prepare/pkg.yaml   |   6 +-
- 4 files changed, 222 insertions(+), 109 deletions(-)
+ 4 files changed, 263 insertions(+), 165 deletions(-)
 
 diff --git a/Pkgfile b/Pkgfile
-index a272582..ce10086 100644
+index 8799e13..209c74c 100644
 --- a/Pkgfile
 +++ b/Pkgfile
-@@ -97,10 +97,10 @@ vars:
-   kspp_sha256: 640b25473f86557d082f680b0f57653a69f4146e97825673bf582f9a4c8b7739
-   kspp_sha512: 82dae1debbe94a3f82766a8cdbfe59ff8698d433175803458499b76c50b47b89e9280b677a9f16b2a44711badd6f4001aba951a41722a74dd51c03a18b8b9219
+@@ -91,10 +91,10 @@ vars:
+   kspp_sha256: 3e5f3ea80c6e82afd5550211d240daabf0676e900ca651b3a207c6946e04521d
+   kspp_sha512: 6ca9521dc15a5897b490a6e2a3e262f09922f0cbf03e1abba4819f9bdee36e2f08fb5acd7c6cb49d50fcd323cdf571222da42f934fa7d8f55c4fa69be5b2b545
  
 -  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
--  linux_version: 6.18.24
--  linux_sha256: c207c557ce58103b4dda30e26da5203f3d8467c6dadc53d709f6d83ae1d1255f
--  linux_sha512: ad734fae886272f0c22853c885f618711baa2128b6447d6b996c884a16781893b73c65f5cf58087637a44d33ced1e5ecff9ead2fbca0bbeb7686dbbd4628de98
+-  linux_version: 6.17.7
+-  linux_sha256: ddf2ea0d4439e1d57136be3623102af9458f601f5b1cb77e83246e88aea09d0e
+-  linux_sha512: f16f28c395374099ccf21d9df654a31746ed3f09376f7f9eca172579787b7b493d3878cb0a44348c2846bba93f7950f04b0e45235152860e4789fdd2aa9711cb
 +  # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=https://github.com/raspberrypi/linux.git
 +  linux_version: stable_20250916
 +  linux_sha256: 4639fe79697970b71cf708234b71d855a58ce5e28c377a4f7cf6ecbbe40647f3
@@ -30,18 +30,27 @@ index a272582..ce10086 100644
    # renovate: datasource=git-tags extractVersion=^libaio-(?<version>.*)$ depName=https://pagure.io/libaio.git
    libaio_version: 0.3.113
 diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64
-index b095bcd..1aad7d4 100644
+index 65b3647..7ba70c0 100644
 --- a/kernel/build/config-arm64
 +++ b/kernel/build/config-arm64
 @@ -1,6 +1,6 @@
  #
  # Automatically generated file; DO NOT EDIT.
--# Linux/arm64 6.18.24 Kernel Configuration
+-# Linux/arm64 6.17.7 Kernel Configuration
 +# Linux/arm64 6.12.47 Kernel Configuration
  #
- CONFIG_CC_VERSION_TEXT="clang version 22.1.2"
- CONFIG_GCC_VERSION=0
-@@ -294,6 +294,7 @@ CONFIG_TRACEPOINTS=y
+ CONFIG_CC_VERSION_TEXT="gcc (GCC) 15.2.0"
+ CONFIG_CC_IS_GCC=y
+@@ -22,7 +22,7 @@ CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
+ CONFIG_CC_HAS_COUNTED_BY=y
+ CONFIG_CC_HAS_MULTIDIMENSIONAL_NONSTRING=y
+ CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY=y
+-CONFIG_PAHOLE_VERSION=130
++CONFIG_PAHOLE_VERSION=129
+ CONFIG_IRQ_WORK=y
+ CONFIG_BUILDTIME_TABLE_SORT=y
+ CONFIG_THREAD_INFO_IN_TASK=y
+@@ -296,6 +296,7 @@ CONFIG_TRACEPOINTS=y
  CONFIG_CRASH_RESERVE=y
  CONFIG_VMCORE_INFO=y
  CONFIG_KEXEC_CORE=y
@@ -49,7 +58,18 @@ index b095bcd..1aad7d4 100644
  # CONFIG_KEXEC is not set
  CONFIG_KEXEC_FILE=y
  CONFIG_KEXEC_SIG=y
-@@ -665,7 +666,7 @@ CONFIG_CPU_FREQ_STAT=y
+@@ -450,8 +451,8 @@ CONFIG_ROCKCHIP_ERRATUM_3588001=y
+ CONFIG_SOCIONEXT_SYNQUACER_PREITS=y
+ # end of ARM errata workarounds via the alternatives framework
+ 
+-CONFIG_ARM64_4K_PAGES=y
+-# CONFIG_ARM64_16K_PAGES is not set
++# CONFIG_ARM64_4K_PAGES is not set
++CONFIG_ARM64_16K_PAGES=y
+ # CONFIG_ARM64_64K_PAGES is not set
+ # CONFIG_ARM64_VA_BITS_39 is not set
+ CONFIG_ARM64_VA_BITS_48=y
+@@ -660,7 +661,7 @@ CONFIG_CPU_FREQ_STAT=y
  # CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
  # CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
  # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
@@ -58,7 +78,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
  CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
  CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
-@@ -976,7 +977,7 @@ CONFIG_BLK_DEV_WRITE_MOUNTED=y
+@@ -960,7 +961,7 @@ CONFIG_BLK_DEV_WRITE_MOUNTED=y
  # CONFIG_BLK_DEV_ZONED is not set
  CONFIG_BLK_DEV_THROTTLING=y
  # CONFIG_BLK_WBT is not set
@@ -67,7 +87,32 @@ index b095bcd..1aad7d4 100644
  # CONFIG_BLK_CGROUP_FC_APPID is not set
  # CONFIG_BLK_CGROUP_IOCOST is not set
  # CONFIG_BLK_CGROUP_IOPRIO is not set
-@@ -1222,7 +1223,6 @@ CONFIG_ARCH_HAS_ZONE_DMA_SET=y
+@@ -1093,23 +1094,8 @@ CONFIG_COREDUMP=y
+ #
+ # Memory Management options
+ #
+-CONFIG_ZPOOL=y
+ CONFIG_SWAP=y
+-CONFIG_ZSWAP=y
+-# CONFIG_ZSWAP_DEFAULT_ON is not set
+-# CONFIG_ZSWAP_SHRINKER_DEFAULT_ON is not set
+-# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_DEFLATE is not set
+-# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZO is not set
+-# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_842 is not set
+-# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4 is not set
+-# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4HC is not set
+-CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD=y
+-CONFIG_ZSWAP_COMPRESSOR_DEFAULT="zstd"
+-CONFIG_ZSWAP_ZPOOL_DEFAULT_ZSMALLOC=y
+-CONFIG_ZSWAP_ZPOOL_DEFAULT="zsmalloc"
+-CONFIG_ZSMALLOC=y
+-# CONFIG_ZSMALLOC_STAT is not set
+-CONFIG_ZSMALLOC_CHAIN_SIZE=8
++# CONFIG_ZSWAP is not set
+ 
+ #
+ # Slab allocator options
+@@ -1198,7 +1184,6 @@ CONFIG_ARCH_HAS_ZONE_DMA_SET=y
  CONFIG_ZONE_DMA=y
  CONFIG_ZONE_DMA32=y
  CONFIG_ZONE_DEVICE=y
@@ -75,7 +120,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_GET_FREE_REGION=y
  CONFIG_DEVICE_PRIVATE=y
  CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y
-@@ -1398,7 +1398,7 @@ CONFIG_NETLABEL=y
+@@ -1369,7 +1354,7 @@ CONFIG_NETLABEL=y
  # CONFIG_MPTCP is not set
  CONFIG_NETWORK_SECMARK=y
  CONFIG_NET_PTP_CLASSIFY=y
@@ -84,7 +129,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_NETFILTER=y
  CONFIG_NETFILTER_ADVANCED=y
  CONFIG_BRIDGE_NETFILTER=y
-@@ -1460,8 +1460,7 @@ CONFIG_NF_TABLES_INET=y
+@@ -1431,8 +1416,7 @@ CONFIG_NF_TABLES_INET=y
  CONFIG_NF_TABLES_NETDEV=y
  CONFIG_NFT_NUMGEN=y
  CONFIG_NFT_CT=y
@@ -94,7 +139,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_NFT_LOG=y
  CONFIG_NFT_LIMIT=y
  CONFIG_NFT_MASQ=y
-@@ -2259,6 +2258,7 @@ CONFIG_TURRIS_MOX_RWTM=y
+@@ -2230,6 +2214,7 @@ CONFIG_TURRIS_MOX_RWTM=y
  CONFIG_TURRIS_MOX_RWTM_KEYCTL=y
  # CONFIG_ARM_FFA_TRANSPORT is not set
  # CONFIG_GOOGLE_FIRMWARE is not set
@@ -102,7 +147,7 @@ index b095bcd..1aad7d4 100644
  
  #
  # EFI (Extensible Firmware Interface) Support
-@@ -2442,6 +2442,7 @@ CONFIG_OF_RESERVED_MEM=y
+@@ -2413,6 +2398,7 @@ CONFIG_OF_RESERVED_MEM=y
  CONFIG_OF_RESOLVE=y
  CONFIG_OF_OVERLAY=y
  CONFIG_OF_NUMA=y
@@ -110,7 +155,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_PARPORT is not set
  CONFIG_PNP=y
  CONFIG_PNP_DEBUG_MESSAGES=y
-@@ -2486,7 +2487,7 @@ CONFIG_BLK_DEV_UBLK=m
+@@ -2445,7 +2431,7 @@ CONFIG_BLK_DEV_UBLK=m
  #
  CONFIG_NVME_AUTH=m
  CONFIG_NVME_CORE=y
@@ -119,7 +164,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_NVME_MULTIPATH=y
  # CONFIG_NVME_VERBOSE_ERRORS is not set
  CONFIG_NVME_HWMON=y
-@@ -2512,6 +2513,7 @@ CONFIG_NVME_TARGET_AUTH=y
+@@ -2471,6 +2457,7 @@ CONFIG_NVME_TARGET_AUTH=y
  #
  # Misc devices
  #
@@ -127,7 +172,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_AD525X_DPOT is not set
  # CONFIG_DUMMY_IRQ is not set
  # CONFIG_PHANTOM is not set
-@@ -2521,7 +2523,7 @@ CONFIG_NVME_TARGET_AUTH=y
+@@ -2480,7 +2467,7 @@ CONFIG_NVME_TARGET_AUTH=y
  # CONFIG_ICS932S401 is not set
  CONFIG_ENCLOSURE_SERVICES=y
  # CONFIG_HI6421V600_IRQ is not set
@@ -136,7 +181,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_QCOM_COINCELL is not set
  # CONFIG_QCOM_FASTRPC is not set
  # CONFIG_APDS9802ALS is not set
-@@ -2545,6 +2547,8 @@ CONFIG_SRAM=y
+@@ -2504,6 +2491,8 @@ CONFIG_SRAM=y
  # CONFIG_MARVELL_CN10K_DPI is not set
  # CONFIG_MCHP_LAN966X_PCI is not set
  # CONFIG_C2PORT is not set
@@ -145,7 +190,7 @@ index b095bcd..1aad7d4 100644
  
  #
  # EEPROM support
-@@ -2623,7 +2627,7 @@ CONFIG_ISCSI_BOOT_SYSFS=y
+@@ -2581,7 +2570,7 @@ CONFIG_ISCSI_BOOT_SYSFS=y
  # CONFIG_SCSI_BNX2X_FCOE is not set
  # CONFIG_BE2ISCSI is not set
  # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
@@ -154,7 +199,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_SCSI_3W_9XXX is not set
  # CONFIG_SCSI_3W_SAS is not set
  # CONFIG_SCSI_ACARD is not set
-@@ -2641,13 +2645,13 @@ CONFIG_SCSI_HISI_SAS_PCI=m
+@@ -2599,13 +2588,13 @@ CONFIG_SCSI_HISI_SAS_PCI=m
  # CONFIG_SCSI_ESAS2R is not set
  # CONFIG_MEGARAID_NEWGEN is not set
  # CONFIG_MEGARAID_LEGACY is not set
@@ -171,7 +216,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_SCSI_HPTIOP is not set
  # CONFIG_SCSI_BUSLOGIC is not set
  # CONFIG_SCSI_MYRB is not set
-@@ -2697,7 +2701,7 @@ CONFIG_SATA_PMP=y
+@@ -2655,7 +2644,7 @@ CONFIG_SATA_PMP=y
  #
  # Controllers with non-SFF native interface
  #
@@ -180,7 +225,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_SATA_MOBILE_LPM_POLICY=0
  CONFIG_SATA_AHCI_PLATFORM=y
  # CONFIG_AHCI_BRCM is not set
-@@ -2744,7 +2748,7 @@ CONFIG_SATA_RCAR=y
+@@ -2702,7 +2691,7 @@ CONFIG_SATA_RCAR=y
  # PATA SFF controllers with BMDMA
  #
  # CONFIG_PATA_ALI is not set
@@ -189,7 +234,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_PATA_ARTOP is not set
  # CONFIG_PATA_ATIIXP is not set
  # CONFIG_PATA_ATP867X is not set
-@@ -2759,17 +2763,17 @@ CONFIG_PATA_AMD=m
+@@ -2717,17 +2706,17 @@ CONFIG_PATA_AMD=m
  # CONFIG_PATA_IT8213 is not set
  # CONFIG_PATA_IT821X is not set
  # CONFIG_PATA_JMICRON is not set
@@ -210,7 +255,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_PATA_SERVERWORKS is not set
  # CONFIG_PATA_SIL680 is not set
  # CONFIG_PATA_SIS is not set
-@@ -2806,7 +2810,7 @@ CONFIG_MD_RAID0=y
+@@ -2762,7 +2751,7 @@ CONFIG_MD_RAID0=y
  CONFIG_MD_RAID1=y
  CONFIG_MD_RAID10=y
  CONFIG_MD_RAID456=m
@@ -219,7 +264,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_BCACHE_DEBUG is not set
  # CONFIG_BCACHE_ASYNC_REGISTRATION is not set
  CONFIG_BLK_DEV_DM_BUILTIN=y
-@@ -2935,7 +2939,7 @@ CONFIG_ATM_DRIVERS=y
+@@ -2890,7 +2879,7 @@ CONFIG_ATM_DRIVERS=y
  # end of Distributed Switch Architecture drivers
  
  CONFIG_ETHERNET=y
@@ -228,7 +273,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_NET_VENDOR_3COM=y
  # CONFIG_VORTEX is not set
  # CONFIG_TYPHOON is not set
-@@ -2963,7 +2967,7 @@ CONFIG_AMD_XGBE=y
+@@ -2918,7 +2907,7 @@ CONFIG_AMD_XGBE=y
  CONFIG_NET_XGENE=y
  # CONFIG_NET_XGENE_V2 is not set
  CONFIG_NET_VENDOR_AQUANTIA=y
@@ -237,7 +282,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_NET_VENDOR_ARC=y
  # CONFIG_EMAC_ROCKCHIP is not set
  CONFIG_NET_VENDOR_ASIX=y
-@@ -2977,16 +2981,16 @@ CONFIG_ALX=m
+@@ -2932,16 +2921,16 @@ CONFIG_ALX=m
  CONFIG_NET_VENDOR_BROADCOM=y
  # CONFIG_B44 is not set
  CONFIG_BCMGENET=y
@@ -258,7 +303,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_BNXT_SRIOV=y
  CONFIG_BNXT_FLOWER_OFFLOAD=y
  # CONFIG_BNXT_DCB is not set
-@@ -3002,7 +3006,7 @@ CONFIG_NET_VENDOR_CAVIUM=y
+@@ -2957,7 +2946,7 @@ CONFIG_NET_VENDOR_CAVIUM=y
  # CONFIG_THUNDER_NIC_VF is not set
  # CONFIG_THUNDER_NIC_BGX is not set
  # CONFIG_THUNDER_NIC_RGX is not set
@@ -267,7 +312,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_LIQUIDIO is not set
  # CONFIG_LIQUIDIO_VF is not set
  CONFIG_NET_VENDOR_CHELSIO=y
-@@ -3015,7 +3019,7 @@ CONFIG_CHELSIO_T4VF=m
+@@ -2970,7 +2959,7 @@ CONFIG_CHELSIO_T4VF=m
  CONFIG_CHELSIO_INLINE_CRYPTO=y
  CONFIG_CHELSIO_IPSEC_INLINE=m
  CONFIG_NET_VENDOR_CISCO=y
@@ -276,7 +321,52 @@ index b095bcd..1aad7d4 100644
  CONFIG_NET_VENDOR_CORTINA=y
  # CONFIG_GEMINI_ETHERNET is not set
  CONFIG_NET_VENDOR_DAVICOM=y
-@@ -3114,7 +3118,7 @@ CONFIG_MVPP2=y
+@@ -3029,30 +3018,29 @@ CONFIG_NET_VENDOR_HUAWEI=y
+ # CONFIG_HINIC3 is not set
+ CONFIG_NET_VENDOR_I825XX=y
+ CONFIG_NET_VENDOR_INTEL=y
+-CONFIG_LIBETH=m
+-CONFIG_LIBIE=m
+-CONFIG_LIBIE_ADMINQ=m
+-CONFIG_E100=m
+-CONFIG_E1000=m
+-CONFIG_E1000E=m
+-CONFIG_IGB=m
++CONFIG_LIBETH=y
++CONFIG_LIBIE=y
++CONFIG_E100=y
++CONFIG_E1000=y
++CONFIG_E1000E=y
++CONFIG_IGB=y
+ CONFIG_IGB_HWMON=y
+-CONFIG_IGBVF=m
+-CONFIG_IXGBE=m
++CONFIG_IGBVF=y
++CONFIG_IXGBE=y
+ CONFIG_IXGBE_HWMON=y
+ # CONFIG_IXGBE_DCB is not set
+ CONFIG_IXGBE_IPSEC=y
+-CONFIG_IXGBEVF=m
++CONFIG_IXGBEVF=y
+ CONFIG_IXGBEVF_IPSEC=y
+-CONFIG_I40E=m
++CONFIG_I40E=y
+ # CONFIG_I40E_DCB is not set
+-CONFIG_IAVF=m
+-CONFIG_I40EVF=m
+-CONFIG_ICE=m
++CONFIG_IAVF=y
++CONFIG_I40EVF=y
++CONFIG_ICE=y
+ CONFIG_ICE_HWMON=y
+ CONFIG_ICE_SWITCHDEV=y
+ # CONFIG_FM10K is not set
+-CONFIG_IGC=m
++CONFIG_IGC=y
+ # CONFIG_IDPF is not set
+ # CONFIG_JME is not set
+ CONFIG_NET_VENDOR_ADI=y
+@@ -3066,7 +3054,7 @@ CONFIG_MVPP2=y
  # CONFIG_MVPP2_PTP is not set
  # CONFIG_PXA168_ETH is not set
  # CONFIG_SKGE is not set
@@ -285,7 +375,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_SKY2_DEBUG is not set
  # CONFIG_OCTEONTX2_AF is not set
  # CONFIG_OCTEONTX2_PF is not set
-@@ -3198,15 +3202,15 @@ CONFIG_NET_VENDOR_PENSANDO=y
+@@ -3147,15 +3135,15 @@ CONFIG_NET_VENDOR_PENSANDO=y
  # CONFIG_IONIC is not set
  CONFIG_NET_VENDOR_QLOGIC=y
  # CONFIG_QLA3XXX is not set
@@ -304,7 +394,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_QED_FCOE=y
  CONFIG_NET_VENDOR_BROCADE=y
  # CONFIG_BNA is not set
-@@ -3219,12 +3223,12 @@ CONFIG_NET_VENDOR_RDC=y
+@@ -3167,12 +3155,12 @@ CONFIG_NET_VENDOR_RDC=y
  # CONFIG_R6040 is not set
  CONFIG_NET_VENDOR_REALTEK=y
  # CONFIG_8139CP is not set
@@ -319,7 +409,44 @@ index b095bcd..1aad7d4 100644
  # CONFIG_RTASE is not set
  CONFIG_NET_VENDOR_RENESAS=y
  # CONFIG_SH_ETH is not set
-@@ -3384,7 +3388,7 @@ CONFIG_TERANETICS_PHY=y
+@@ -3209,23 +3197,22 @@ CONFIG_SMSC911X=y
+ CONFIG_NET_VENDOR_SOCIONEXT=y
+ # CONFIG_SNI_NETSEC is not set
+ CONFIG_NET_VENDOR_STMICRO=y
+-CONFIG_STMMAC_ETH=m
++CONFIG_STMMAC_ETH=y
+ # CONFIG_STMMAC_SELFTESTS is not set
+-CONFIG_STMMAC_PLATFORM=m
+-CONFIG_DWMAC_DWC_QOS_ETH=m
+-CONFIG_DWMAC_GENERIC=m
+-CONFIG_DWMAC_IPQ806X=m
++CONFIG_STMMAC_PLATFORM=y
++CONFIG_DWMAC_DWC_QOS_ETH=y
++CONFIG_DWMAC_GENERIC=y
++CONFIG_DWMAC_IPQ806X=y
+ # CONFIG_DWMAC_MEDIATEK is not set
+-CONFIG_DWMAC_MESON=m
+-CONFIG_DWMAC_QCOM_ETHQOS=m
+-CONFIG_DWMAC_RENESAS_GBETH=m
+-CONFIG_DWMAC_ROCKCHIP=m
+-CONFIG_DWMAC_SUNXI=m
+-CONFIG_DWMAC_SUN8I=m
+-CONFIG_DWMAC_IMX8=m
++CONFIG_DWMAC_MESON=y
++CONFIG_DWMAC_QCOM_ETHQOS=y
++CONFIG_DWMAC_ROCKCHIP=y
++CONFIG_DWMAC_SUNXI=y
++CONFIG_DWMAC_SUN8I=y
++CONFIG_DWMAC_IMX8=y
+ # CONFIG_DWMAC_INTEL_PLAT is not set
+-CONFIG_DWMAC_TEGRA=m
+-CONFIG_STMMAC_PCI=m
++CONFIG_DWMAC_TEGRA=y
++CONFIG_STMMAC_PCI=y
+ CONFIG_NET_VENDOR_SUN=y
+ # CONFIG_HAPPYMEAL is not set
+ # CONFIG_SUNGEM is not set
+@@ -3330,7 +3317,7 @@ CONFIG_TERANETICS_PHY=y
  CONFIG_DP83822_PHY=y
  CONFIG_DP83TC811_PHY=y
  CONFIG_DP83848_PHY=y
@@ -328,7 +455,16 @@ index b095bcd..1aad7d4 100644
  CONFIG_DP83869_PHY=y
  # CONFIG_DP83TD510_PHY is not set
  # CONFIG_DP83TG720_PHY is not set
-@@ -3433,7 +3437,7 @@ CONFIG_USB_NET_DRIVERS=y
+@@ -3370,7 +3357,7 @@ CONFIG_MDIO_BUS_MUX_MMIOREG=y
+ #
+ # PCS device drivers
+ #
+-CONFIG_PCS_XPCS=m
++CONFIG_PCS_XPCS=y
+ # end of PCS device drivers
+ 
+ # CONFIG_PPP is not set
+@@ -3380,7 +3367,7 @@ CONFIG_USB_NET_DRIVERS=y
  # CONFIG_USB_KAWETH is not set
  CONFIG_USB_PEGASUS=y
  CONFIG_USB_RTL8150=y
@@ -337,7 +473,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_USB_LAN78XX=y
  CONFIG_USB_USBNET=m
  CONFIG_USB_NET_AX8817X=m
-@@ -3483,7 +3487,7 @@ CONFIG_USB_RTL8153_ECM=m
+@@ -3430,7 +3417,7 @@ CONFIG_USB_RTL8153_ECM=m
  # end of Wireless WAN
  
  CONFIG_XEN_NETDEV_FRONTEND=y
@@ -346,7 +482,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_FUJITSU_ES is not set
  CONFIG_USB4_NET=m
  CONFIG_HYPERV_NET=y
-@@ -3756,6 +3760,8 @@ CONFIG_HYPERV_KEYBOARD=y
+@@ -3701,6 +3688,8 @@ CONFIG_HYPERV_KEYBOARD=y
  #
  # Character devices
  #
@@ -355,7 +491,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_TTY=y
  CONFIG_VT=y
  CONFIG_CONSOLE_TRANSLATIONS=y
-@@ -3848,6 +3854,7 @@ CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
+@@ -3793,6 +3782,7 @@ CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
  CONFIG_SERIAL_MVEBU_UART=y
  CONFIG_SERIAL_MVEBU_CONSOLE=y
  # CONFIG_SERIAL_OWL is not set
@@ -363,7 +499,7 @@ index b095bcd..1aad7d4 100644
  # end of Serial drivers
  
  CONFIG_SERIAL_MCTRL_GPIO=y
-@@ -3923,6 +3930,7 @@ CONFIG_TCG_CRB=y
+@@ -3868,6 +3858,7 @@ CONFIG_TCG_CRB=y
  # CONFIG_TCG_TIS_ST33ZP24_SPI is not set
  # CONFIG_XILLYBUS is not set
  # CONFIG_XILLYUSB is not set
@@ -371,7 +507,7 @@ index b095bcd..1aad7d4 100644
  # end of Character devices
  
  #
-@@ -3932,7 +3940,7 @@ CONFIG_I2C=y
+@@ -3877,7 +3868,7 @@ CONFIG_I2C=y
  CONFIG_ACPI_I2C_OPREGION=y
  CONFIG_I2C_BOARDINFO=y
  CONFIG_I2C_CHARDEV=y
@@ -380,7 +516,7 @@ index b095bcd..1aad7d4 100644
  
  #
  # Multiplexer I2C Chip support
-@@ -3951,7 +3959,7 @@ CONFIG_I2C_MUX=m
+@@ -3896,7 +3887,7 @@ CONFIG_I2C_MUX=m
  
  CONFIG_I2C_HELPER_AUTO=y
  CONFIG_I2C_SMBUS=y
@@ -389,7 +525,7 @@ index b095bcd..1aad7d4 100644
  
  #
  # I2C Hardware Bus support
-@@ -3961,6 +3969,7 @@ CONFIG_I2C_ALGOBIT=m
+@@ -3906,6 +3897,7 @@ CONFIG_I2C_ALGOBIT=m
  # PC SMBus host controller drivers
  #
  CONFIG_I2C_CCGX_UCSI=y
@@ -397,7 +533,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_I2C_ALI1535 is not set
  # CONFIG_I2C_ALI1563 is not set
  # CONFIG_I2C_ALI15X3 is not set
-@@ -3968,7 +3977,7 @@ CONFIG_I2C_CCGX_UCSI=y
+@@ -3913,7 +3905,7 @@ CONFIG_I2C_CCGX_UCSI=y
  # CONFIG_I2C_AMD8111 is not set
  # CONFIG_I2C_AMD_MP2 is not set
  # CONFIG_I2C_HIX5HD2 is not set
@@ -406,7 +542,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_I2C_ISCH is not set
  # CONFIG_I2C_PIIX4 is not set
  # CONFIG_I2C_NFORCE2 is not set
-@@ -4085,7 +4094,7 @@ CONFIG_SPI_BCM_QSPI=y
+@@ -4029,7 +4021,7 @@ CONFIG_SPI_BCM_QSPI=y
  # CONFIG_SPI_HISI_KUNPENG is not set
  # CONFIG_SPI_HISI_SFC_V3XX is not set
  # CONFIG_SPI_NXP_FLEXSPI is not set
@@ -415,7 +551,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_SPI_IMX is not set
  # CONFIG_SPI_FSL_SPI is not set
  # CONFIG_SPI_FSL_DSPI is not set
-@@ -4101,6 +4110,7 @@ CONFIG_SPI_ORION=y
+@@ -4046,6 +4038,7 @@ CONFIG_SPI_ORION=y
  CONFIG_SPI_PL022=y
  CONFIG_SPI_ROCKCHIP=y
  # CONFIG_SPI_ROCKCHIP_SFC is not set
@@ -423,7 +559,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_SPI_RSPI is not set
  # CONFIG_SPI_RZV2H_RSPI is not set
  # CONFIG_SPI_RZV2M_CSI is not set
-@@ -4199,7 +4209,7 @@ CONFIG_PINCTRL_AXP209=y
+@@ -4142,7 +4135,7 @@ CONFIG_PINCTRL_AXP209=y
  CONFIG_PINCTRL_BM1880=y
  # CONFIG_PINCTRL_CY8C95X0 is not set
  CONFIG_PINCTRL_MAX77620=y
@@ -432,7 +568,17 @@ index b095bcd..1aad7d4 100644
  # CONFIG_PINCTRL_MICROCHIP_SGPIO is not set
  # CONFIG_PINCTRL_OCELOT is not set
  CONFIG_PINCTRL_RK805=y
-@@ -4395,6 +4405,7 @@ CONFIG_GPIO_GENERIC=y
+@@ -4152,7 +4145,9 @@ CONFIG_PINCTRL_SINGLE=y
+ # CONFIG_PINCTRL_STMFX is not set
+ # CONFIG_PINCTRL_SX150X is not set
+ CONFIG_PINCTRL_ZYNQMP=y
++CONFIG_PINCTRL_RP1=y
+ # CONFIG_PINCTRL_OWL is not set
++CONFIG_PINCTRL_BCM2712=y
+ CONFIG_PINCTRL_BCM2835=y
+ CONFIG_PINCTRL_IPROC_GPIO=y
+ CONFIG_PINCTRL_NS2_MUX=y
+@@ -4332,6 +4327,7 @@ CONFIG_GPIO_GENERIC=y
  # CONFIG_GPIO_AMDPT is not set
  CONFIG_GPIO_RASPBERRYPI_EXP=y
  CONFIG_GPIO_BCM_XGS_IPROC=y
@@ -440,7 +586,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_GPIO_BRCMSTB=y
  # CONFIG_GPIO_CADENCE is not set
  # CONFIG_GPIO_DAVINCI is not set
-@@ -4412,7 +4423,7 @@ CONFIG_GPIO_DWAPB=y
+@@ -4349,7 +4345,7 @@ CONFIG_GPIO_DWAPB=y
  CONFIG_GPIO_MVEBU=y
  CONFIG_GPIO_MXC=y
  CONFIG_GPIO_PL061=y
@@ -449,7 +595,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_GPIO_RCAR=y
  CONFIG_GPIO_ROCKCHIP=y
  CONFIG_GPIO_RTD=y
-@@ -4451,6 +4462,7 @@ CONFIG_GPIO_PCA953X_IRQ=y
+@@ -4388,6 +4384,7 @@ CONFIG_GPIO_PCA953X_IRQ=y
  #
  # MFD GPIO expanders
  #
@@ -457,7 +603,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_GPIO_MAX77620=y
  # end of MFD GPIO expanders
  
-@@ -4520,6 +4532,7 @@ CONFIG_POWER_RESET_SYSCON=y
+@@ -4457,6 +4454,7 @@ CONFIG_POWER_RESET_SYSCON=y
  CONFIG_POWER_SUPPLY=y
  # CONFIG_POWER_SUPPLY_DEBUG is not set
  CONFIG_POWER_SUPPLY_HWMON=y
@@ -465,7 +611,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_GENERIC_ADC_BATTERY is not set
  # CONFIG_IP5XXX_POWER is not set
  # CONFIG_TEST_POWER is not set
-@@ -4804,7 +4817,7 @@ CONFIG_AMLOGIC_THERMAL=y
+@@ -4741,7 +4739,7 @@ CONFIG_AMLOGIC_THERMAL=y
  # Broadcom thermal drivers
  #
  CONFIG_BCM2711_THERMAL=y
@@ -474,7 +620,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_BRCMSTB_THERMAL is not set
  CONFIG_BCM_NS_THERMAL=y
  CONFIG_BCM_SR_THERMAL=y
-@@ -4983,6 +4996,7 @@ CONFIG_MFD_MAX77620=y
+@@ -4917,6 +4915,7 @@ CONFIG_MFD_MAX77620=y
  # CONFIG_MFD_QCOM_RPM is not set
  CONFIG_MFD_SPMI_PMIC=y
  # CONFIG_MFD_SY7636A is not set
@@ -482,15 +628,15 @@ index b095bcd..1aad7d4 100644
  # CONFIG_MFD_RDC321X is not set
  # CONFIG_MFD_RT4831 is not set
  # CONFIG_MFD_RT5033 is not set
-@@ -5001,6 +5015,7 @@ CONFIG_MFD_RK8XX_SPI=y
- # CONFIG_MFD_STMPE is not set
- CONFIG_MFD_SUN6I_PRCM=y
- CONFIG_MFD_SYSCON=y
+@@ -4980,6 +4979,7 @@ CONFIG_MFD_SYSCON=y
+ # CONFIG_MFD_KHADAS_MCU is not set
+ # CONFIG_MFD_QCOM_PM8008 is not set
+ # CONFIG_MFD_INTEL_M10_BMC_SPI is not set
 +CONFIG_MFD_RP1=y
- # CONFIG_MFD_TI_AM335X_TSCADC is not set
- # CONFIG_MFD_LP3943 is not set
- # CONFIG_MFD_LP8788 is not set
-@@ -5118,6 +5133,7 @@ CONFIG_REGULATOR_QCOM_SPMI=y
+ # CONFIG_MFD_RSMU_I2C is not set
+ # CONFIG_MFD_RSMU_SPI is not set
+ # end of Multifunction device drivers
+@@ -5046,6 +5046,7 @@ CONFIG_REGULATOR_QCOM_SPMI=y
  # CONFIG_REGULATOR_RAA215300 is not set
  # CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY is not set
  # CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_V2 is not set
@@ -498,7 +644,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_REGULATOR_RK808=y
  # CONFIG_REGULATOR_RT4801 is not set
  # CONFIG_REGULATOR_RT4803 is not set
-@@ -5252,6 +5268,7 @@ CONFIG_V4L_MEM2MEM_DRIVERS=y
+@@ -5179,6 +5180,7 @@ CONFIG_V4L_MEM2MEM_DRIVERS=y
  #
  # Atmel media platform drivers
  #
@@ -506,7 +652,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_VIDEO_BCM2835_UNICAM is not set
  
  #
-@@ -5314,6 +5331,7 @@ CONFIG_V4L_MEM2MEM_DRIVERS=y
+@@ -5241,6 +5243,7 @@ CONFIG_V4L_MEM2MEM_DRIVERS=y
  #
  # Raspberry Pi media platform drivers
  #
@@ -514,7 +660,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_VIDEO_RASPBERRYPI_PISP_BE is not set
  # CONFIG_VIDEO_RP1_CFE is not set
  
-@@ -5390,9 +5408,13 @@ CONFIG_VIDEOBUF2_VMALLOC=m
+@@ -5317,9 +5320,13 @@ CONFIG_VIDEOBUF2_VMALLOC=m
  # CONFIG_VIDEO_THP7312 is not set
  # end of Camera ISPs
  
@@ -529,7 +675,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_VIDEO_DW9714 is not set
  # CONFIG_VIDEO_DW9719 is not set
  # CONFIG_VIDEO_DW9768 is not set
-@@ -5461,6 +5483,7 @@ CONFIG_VIDEO_CAMERA_LENS=y
+@@ -5388,6 +5395,7 @@ CONFIG_VIDEO_CAMERA_LENS=y
  # CONFIG_VIDEO_TW9903 is not set
  # CONFIG_VIDEO_TW9906 is not set
  # CONFIG_VIDEO_TW9910 is not set
@@ -537,7 +683,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_VIDEO_VPX3220 is not set
  
  #
-@@ -5583,7 +5606,6 @@ CONFIG_DRM_DISPLAY_HDMI_HELPER=y
+@@ -5510,7 +5518,6 @@ CONFIG_DRM_DISPLAY_HDMI_HELPER=y
  CONFIG_DRM_DISPLAY_HDMI_STATE_HELPER=y
  CONFIG_DRM_TTM=m
  CONFIG_DRM_EXEC=m
@@ -545,7 +691,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_DRM_BUDDY=m
  CONFIG_DRM_VRAM_HELPER=m
  CONFIG_DRM_TTM_HELPER=m
-@@ -5702,6 +5724,7 @@ CONFIG_DRM_PANEL=y
+@@ -5629,6 +5636,7 @@ CONFIG_DRM_PANEL=y
  # CONFIG_DRM_PANEL_ILITEK_ILI9341 is not set
  # CONFIG_DRM_PANEL_ILITEK_ILI9805 is not set
  # CONFIG_DRM_PANEL_ILITEK_ILI9806E is not set
@@ -553,7 +699,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_DRM_PANEL_ILITEK_ILI9881C is not set
  # CONFIG_DRM_PANEL_ILITEK_ILI9882T is not set
  # CONFIG_DRM_PANEL_INNOLUX_EJ030NA is not set
-@@ -5780,6 +5803,7 @@ CONFIG_DRM_PANEL_SIMPLE=y
+@@ -5706,6 +5714,7 @@ CONFIG_DRM_PANEL_SIMPLE=y
  # CONFIG_DRM_PANEL_SUMMIT is not set
  # CONFIG_DRM_PANEL_SYNAPTICS_R63353 is not set
  # CONFIG_DRM_PANEL_TDO_TL070WSH30 is not set
@@ -561,7 +707,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_DRM_PANEL_TPO_TD028TTEC1 is not set
  # CONFIG_DRM_PANEL_TPO_TD043MTEA1 is not set
  # CONFIG_DRM_PANEL_TPO_TPG110 is not set
-@@ -5789,6 +5813,8 @@ CONFIG_DRM_PANEL_SIMPLE=y
+@@ -5715,6 +5724,8 @@ CONFIG_DRM_PANEL_SIMPLE=y
  # CONFIG_DRM_PANEL_VISIONOX_RM69299 is not set
  # CONFIG_DRM_PANEL_VISIONOX_RM692E5 is not set
  # CONFIG_DRM_PANEL_VISIONOX_VTDR6130 is not set
@@ -570,7 +716,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_DRM_PANEL_WIDECHIPS_WS2401 is not set
  # CONFIG_DRM_PANEL_XINPENG_XPP055C272 is not set
  # end of Display Panels
-@@ -5894,7 +5920,7 @@ CONFIG_DRM_MESON_DW_MIPI_DSI=y
+@@ -5817,7 +5828,7 @@ CONFIG_DRM_MESON_DW_MIPI_DSI=y
  # CONFIG_DRM_XEN_FRONTEND is not set
  # CONFIG_DRM_LIMA is not set
  CONFIG_DRM_PANFROST=m
@@ -579,15 +725,15 @@ index b095bcd..1aad7d4 100644
  # CONFIG_DRM_TIDSS is not set
  # CONFIG_DRM_GUD is not set
  # CONFIG_DRM_ST7571_I2C is not set
-@@ -5911,6 +5937,7 @@ CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
+@@ -5834,6 +5845,7 @@ CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
  # Frame buffer Devices
  #
  CONFIG_FB=y
 +CONFIG_FB_BCM2708=y
  # CONFIG_FB_CIRRUS is not set
  # CONFIG_FB_PM2 is not set
- # CONFIG_FB_CYBER2000 is not set
-@@ -5951,6 +5978,7 @@ CONFIG_FB_HYPERV=y
+ # CONFIG_FB_IMX is not set
+@@ -5875,6 +5887,7 @@ CONFIG_FB_HYPERV=y
  CONFIG_FB_SIMPLE=y
  # CONFIG_FB_SSD1307 is not set
  # CONFIG_FB_SM712 is not set
@@ -595,7 +741,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_FB_CORE=y
  CONFIG_FB_NOTIFY=y
  CONFIG_FB_DEVICE=y
-@@ -5983,6 +6011,7 @@ CONFIG_BACKLIGHT_CLASS_DEVICE=y
+@@ -5907,6 +5920,7 @@ CONFIG_BACKLIGHT_CLASS_DEVICE=y
  # CONFIG_BACKLIGHT_KTD2801 is not set
  # CONFIG_BACKLIGHT_KTZ8866 is not set
  # CONFIG_BACKLIGHT_PWM is not set
@@ -603,7 +749,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_BACKLIGHT_QCOM_WLED is not set
  # CONFIG_BACKLIGHT_ADP8860 is not set
  # CONFIG_BACKLIGHT_ADP8870 is not set
-@@ -6071,7 +6100,55 @@ CONFIG_SND_USB_AUDIO_USE_MEDIA_CONTROLLER=y
+@@ -5994,7 +6008,55 @@ CONFIG_SND_USB_AUDIO_USE_MEDIA_CONTROLLER=y
  # CONFIG_SND_USB_VARIAX is not set
  CONFIG_SND_SOC=m
  CONFIG_SND_SOC_GENERIC_DMAENGINE_PCM=y
@@ -660,7 +806,7 @@ index b095bcd..1aad7d4 100644
  
  #
  # Analog Devices
-@@ -6207,15 +6284,17 @@ CONFIG_SND_SOC_GENERIC_DMAENGINE_PCM=y
+@@ -6130,15 +6192,17 @@ CONFIG_SND_SOC_GENERIC_DMAENGINE_PCM=y
  # CONFIG_SND_MESON_G12A_TOACODEC is not set
  # CONFIG_SND_MESON_G12A_TOHDMITX is not set
  # CONFIG_SND_SOC_MESON_T9015 is not set
@@ -681,7 +827,7 @@ index b095bcd..1aad7d4 100644
  #
  # Renesas
  #
-@@ -6299,6 +6378,8 @@ CONFIG_SND_SOC_I2C_AND_SPI=m
+@@ -6222,6 +6286,8 @@ CONFIG_SND_SOC_I2C_AND_SPI=m
  # CODEC drivers
  #
  # CONFIG_SND_SOC_AC97_CODEC is not set
@@ -690,7 +836,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_SND_SOC_ADAU1372_I2C is not set
  # CONFIG_SND_SOC_ADAU1372_SPI is not set
  # CONFIG_SND_SOC_ADAU1373 is not set
-@@ -6380,6 +6461,7 @@ CONFIG_SND_SOC_HDMI_CODEC=m
+@@ -6302,6 +6368,7 @@ CONFIG_SND_SOC_HDMI_CODEC=m
  # CONFIG_SND_SOC_ICS43432 is not set
  # CONFIG_SND_SOC_IDT821034 is not set
  # CONFIG_SND_SOC_INNO_RK3036 is not set
@@ -698,7 +844,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_SND_SOC_MAX98088 is not set
  # CONFIG_SND_SOC_MAX98090 is not set
  # CONFIG_SND_SOC_MAX98357A is not set
-@@ -6512,6 +6594,7 @@ CONFIG_SND_SOC_HDMI_CODEC=m
+@@ -6432,6 +6499,7 @@ CONFIG_SND_SOC_HDMI_CODEC=m
  # CONFIG_SND_SOC_LPASS_VA_MACRO is not set
  # CONFIG_SND_SOC_LPASS_RX_MACRO is not set
  # CONFIG_SND_SOC_LPASS_TX_MACRO is not set
@@ -706,7 +852,7 @@ index b095bcd..1aad7d4 100644
  # end of CODEC drivers
  
  #
-@@ -6536,18 +6619,18 @@ CONFIG_HID_GENERIC=y
+@@ -6455,18 +6523,18 @@ CONFIG_HID_GENERIC=y
  #
  # Special HID drivers
  #
@@ -730,7 +876,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_HID_CORSAIR is not set
  # CONFIG_HID_COUGAR is not set
  # CONFIG_HID_MACALLY is not set
-@@ -6555,14 +6638,14 @@ CONFIG_HID_CHICONY=m
+@@ -6474,14 +6542,14 @@ CONFIG_HID_CHICONY=m
  # CONFIG_HID_CMEDIA is not set
  # CONFIG_HID_CP2112 is not set
  # CONFIG_HID_CREATIVE_SB0540 is not set
@@ -747,7 +893,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_HID_FT260 is not set
  # CONFIG_HID_GEMBIRD is not set
  # CONFIG_HID_GFRM is not set
-@@ -6580,17 +6663,17 @@ CONFIG_HID_EZKEY=m
+@@ -6499,17 +6567,17 @@ CONFIG_HID_EZKEY=m
  # CONFIG_HID_VIEWSONIC is not set
  # CONFIG_HID_VRC2 is not set
  # CONFIG_HID_XIAOMI is not set
@@ -769,7 +915,29 @@ index b095bcd..1aad7d4 100644
  # CONFIG_HID_LOGITECH_DJ is not set
  # CONFIG_HID_LOGITECH_HIDPP is not set
  CONFIG_LOGITECH_FF=y
-@@ -6622,20 +6705,20 @@ CONFIG_HID_PETALYNX=m
+@@ -6521,17 +6589,17 @@ CONFIG_LOGIWHEELS_FF=y
+ # CONFIG_HID_MAYFLASH is not set
+ # CONFIG_HID_MEGAWORLD_FF is not set
+ CONFIG_HID_REDRAGON=y
+-CONFIG_HID_MICROSOFT=m
+-CONFIG_HID_MONTEREY=m
++CONFIG_HID_MICROSOFT=y
++CONFIG_HID_MONTEREY=y
+ # CONFIG_HID_MULTITOUCH is not set
+ # CONFIG_HID_NINTENDO is not set
+ # CONFIG_HID_NTI is not set
+ # CONFIG_HID_NTRIG is not set
+ # CONFIG_HID_ORTEK is not set
+-CONFIG_HID_PANTHERLORD=m
++CONFIG_HID_PANTHERLORD=y
+ CONFIG_PANTHERLORD_FF=y
+ # CONFIG_HID_PENMOUNT is not set
+-CONFIG_HID_PETALYNX=m
++CONFIG_HID_PETALYNX=y
+ # CONFIG_HID_PICOLCD is not set
+ # CONFIG_HID_PLANTRONICS is not set
+ # CONFIG_HID_PLAYSTATION is not set
+@@ -6541,20 +6609,20 @@ CONFIG_HID_PETALYNX=m
  # CONFIG_HID_RETRODE is not set
  # CONFIG_HID_ROCCAT is not set
  # CONFIG_HID_SAITEK is not set
@@ -793,7 +961,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_HID_TOPRE is not set
  # CONFIG_HID_THINGM is not set
  # CONFIG_HID_THRUSTMASTER is not set
-@@ -6734,6 +6817,7 @@ CONFIG_USB_OHCI_HCD_PLATFORM=y
+@@ -6653,6 +6721,7 @@ CONFIG_USB_OHCI_HCD_PLATFORM=y
  # CONFIG_USB_SL811_HCD is not set
  # CONFIG_USB_R8A66597_HCD is not set
  # CONFIG_USB_RENESAS_USBHS_HCD is not set
@@ -801,7 +969,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_USB_HCD_TEST_MODE is not set
  # CONFIG_USB_XEN_HCD is not set
  CONFIG_USB_RENESAS_USBHS=y
-@@ -6843,13 +6927,13 @@ CONFIG_USB_SERIAL_GENERIC=y
+@@ -6761,13 +6830,13 @@ CONFIG_USB_SERIAL_GENERIC=y
  # CONFIG_USB_SERIAL_AIRCABLE is not set
  # CONFIG_USB_SERIAL_ARK3116 is not set
  # CONFIG_USB_SERIAL_BELKIN is not set
@@ -818,7 +986,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_USB_SERIAL_VISOR is not set
  # CONFIG_USB_SERIAL_IPAQ is not set
  # CONFIG_USB_SERIAL_IR is not set
-@@ -6870,7 +6954,7 @@ CONFIG_USB_SERIAL_FTDI_SIO=m
+@@ -6788,7 +6857,7 @@ CONFIG_USB_SERIAL_FTDI_SIO=m
  # CONFIG_USB_SERIAL_MOS7840 is not set
  # CONFIG_USB_SERIAL_MXUPORT is not set
  # CONFIG_USB_SERIAL_NAVMAN is not set
@@ -827,7 +995,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_USB_SERIAL_OTI6858 is not set
  # CONFIG_USB_SERIAL_QCAUX is not set
  # CONFIG_USB_SERIAL_QUALCOMM is not set
-@@ -7074,31 +7158,32 @@ CONFIG_MMC_BLOCK_MINORS=32
+@@ -6992,31 +7061,32 @@ CONFIG_MMC_BLOCK_MINORS=32
  #
  # MMC/SD/SDIO Host Controller Drivers
  #
@@ -872,7 +1040,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_MMC_MXC is not set
  # CONFIG_MMC_TIFM_SD is not set
  CONFIG_MMC_SPI=y
-@@ -7128,8 +7213,8 @@ CONFIG_MMC_CQHCI=y
+@@ -7046,8 +7116,8 @@ CONFIG_MMC_CQHCI=y
  # CONFIG_MMC_TOSHIBA_PCI is not set
  CONFIG_MMC_BCM2835=y
  # CONFIG_MMC_MTK is not set
@@ -883,7 +1051,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_MMC_SDHCI_AM654 is not set
  # CONFIG_MMC_OWL is not set
  # CONFIG_SCSI_UFSHCD is not set
-@@ -7222,28 +7307,26 @@ CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+@@ -7140,28 +7210,26 @@ CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
  #
  # CONFIG_LEDS_TRIGGER_TRANSIENT is not set
  # CONFIG_LEDS_TRIGGER_CAMERA is not set
@@ -916,7 +1084,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_INFINIBAND_HNS_HIP08=m
  CONFIG_INFINIBAND_IRDMA=m
  CONFIG_MLX4_INFINIBAND=m
-@@ -7302,6 +7385,7 @@ CONFIG_RTC_INTF_DEV=y
+@@ -7219,6 +7287,7 @@ CONFIG_RTC_INTF_DEV=y
  # CONFIG_RTC_DRV_ABB5ZES3 is not set
  # CONFIG_RTC_DRV_ABEOZ9 is not set
  # CONFIG_RTC_DRV_ABX80X is not set
@@ -924,7 +1092,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_RTC_DRV_BRCMSTB=y
  CONFIG_RTC_DRV_DS1307=y
  # CONFIG_RTC_DRV_DS1307_CENTURY is not set
-@@ -7454,6 +7538,7 @@ CONFIG_PL330_DMA=y
+@@ -7371,6 +7440,7 @@ CONFIG_PL330_DMA=y
  CONFIG_TEGRA186_GPC_DMA=y
  CONFIG_TEGRA20_APB_DMA=y
  CONFIG_TEGRA210_ADMA=y
@@ -932,7 +1100,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_XGENE_DMA is not set
  # CONFIG_XILINX_DMA is not set
  # CONFIG_XILINX_XDMA is not set
-@@ -7543,17 +7628,17 @@ CONFIG_VMGENID=y
+@@ -7459,17 +7529,17 @@ CONFIG_VMGENID=y
  # CONFIG_ARM_CCA_GUEST is not set
  CONFIG_VIRTIO_ANCHOR=y
  CONFIG_VIRTIO=y
@@ -956,15 +1124,16 @@ index b095bcd..1aad7d4 100644
  CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
  CONFIG_VIRTIO_DMA_SHARED_BUFFER=y
  # CONFIG_VIRTIO_DEBUG is not set
-@@ -7650,6 +7735,7 @@ CONFIG_COMMON_CLK=y
+@@ -7563,6 +7633,8 @@ CONFIG_COMMON_CLK=y
+ # CONFIG_COMMON_CLK_MAX77686 is not set
  # CONFIG_COMMON_CLK_MAX9485 is not set
  CONFIG_COMMON_CLK_RK808=y
- CONFIG_COMMON_CLK_RP1=y
++CONFIG_COMMON_CLK_RP1=y
 +CONFIG_COMMON_CLK_RP1_SDIO=y
  CONFIG_COMMON_CLK_HI655X=y
  CONFIG_COMMON_CLK_SCMI=y
  CONFIG_COMMON_CLK_SCPI=y
-@@ -8171,6 +8257,8 @@ CONFIG_TEGRA_IOMMU_SMMU=y
+@@ -8065,6 +8137,8 @@ CONFIG_TEGRA_IOMMU_SMMU=y
  # CONFIG_MTK_IOMMU is not set
  # CONFIG_VIRTIO_IOMMU is not set
  # CONFIG_SPRD_IOMMU is not set
@@ -973,10 +1142,11 @@ index b095bcd..1aad7d4 100644
  
  #
  # Remoteproc drivers
-@@ -9079,8 +9167,9 @@ CONFIG_PWM=y
+@@ -8961,13 +9035,13 @@ CONFIG_PWM=y
+ # CONFIG_PWM_ATMEL_TCB is not set
  # CONFIG_PWM_AXI_PWMGEN is not set
  CONFIG_PWM_BCM2835=y
- CONFIG_PWM_BCM_IPROC=y
+-CONFIG_PWM_BCM_IPROC=y
 +CONFIG_PWM_PIO_RP1=y
  # CONFIG_PWM_BERLIN is not set
 -# CONFIG_PWM_BRCMSTB is not set
@@ -984,7 +1154,12 @@ index b095bcd..1aad7d4 100644
  # CONFIG_PWM_CLK is not set
  # CONFIG_PWM_DWC is not set
  # CONFIG_PWM_FSL_FTM is not set
-@@ -9096,7 +9185,8 @@ CONFIG_PWM_MESON=y
+-# CONFIG_PWM_GPIO is not set
++CONFIG_PWM_GPIO=y
+ # CONFIG_PWM_HIBVT is not set
+ # CONFIG_PWM_IMX1 is not set
+ # CONFIG_PWM_IMX27 is not set
+@@ -8979,7 +9053,8 @@ CONFIG_PWM_MESON=y
  # CONFIG_PWM_OMAP_DMTIMER is not set
  # CONFIG_PWM_PCA9685 is not set
  CONFIG_PWM_RASPBERRYPI_POE=y
@@ -994,7 +1169,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_PWM_RENESAS_TPU is not set
  CONFIG_PWM_ROCKCHIP=y
  # CONFIG_PWM_SPRD is not set
-@@ -9120,7 +9210,7 @@ CONFIG_ARM_GIC_V3_ITS=y
+@@ -9003,7 +9078,7 @@ CONFIG_ARM_GIC_V3_ITS=y
  CONFIG_ARM_GIC_V5=y
  CONFIG_IRQ_MSI_LIB=y
  # CONFIG_AL_FIC is not set
@@ -1003,7 +1178,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_BCM7038_L1_IRQ=y
  CONFIG_BCM7120_L2_IRQ=y
  CONFIG_BRCMSTB_L2_IRQ=y
-@@ -9334,6 +9424,7 @@ CONFIG_ARM64_BRBE=y
+@@ -9212,6 +9287,7 @@ CONFIG_ARM64_BRBE=y
  # CONFIG_ARM_DMC620_PMU is not set
  # CONFIG_MARVELL_CN10K_TAD_PMU is not set
  # CONFIG_ALIBABA_UNCORE_DRW_PMU is not set
@@ -1011,7 +1186,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_HISI_PMU=m
  CONFIG_HISI_PCIE_PMU=m
  CONFIG_HNS3_PMU=m
-@@ -9379,6 +9470,7 @@ CONFIG_NVMEM_LAYOUTS=y
+@@ -9257,6 +9333,7 @@ CONFIG_NVMEM_LAYOUTS=y
  # CONFIG_NVMEM_LAYOUT_U_BOOT_ENV is not set
  # end of Layout Types
  
@@ -1019,7 +1194,7 @@ index b095bcd..1aad7d4 100644
  CONFIG_NVMEM_BCM_OCOTP=y
  # CONFIG_NVMEM_IMX_IIM is not set
  # CONFIG_NVMEM_IMX_OCOTP is not set
-@@ -9787,8 +9879,30 @@ CONFIG_INTEGRITY_TRUSTED_KEYRING=y
+@@ -9668,8 +9745,30 @@ CONFIG_INTEGRITY_TRUSTED_KEYRING=y
  CONFIG_INTEGRITY_PLATFORM_KEYRING=y
  CONFIG_LOAD_UEFI_KEYS=y
  CONFIG_INTEGRITY_AUDIT=y
@@ -1052,7 +1227,7 @@ index b095bcd..1aad7d4 100644
  # CONFIG_EVM is not set
  # CONFIG_DEFAULT_SECURITY_SELINUX is not set
  # CONFIG_DEFAULT_SECURITY_APPARMOR is not set
-@@ -9985,7 +10099,7 @@ CONFIG_CRYPTO_LZO=y
+@@ -9868,7 +9967,7 @@ CONFIG_CRYPTO_LZO=y
  # CONFIG_CRYPTO_842 is not set
  # CONFIG_CRYPTO_LZ4 is not set
  # CONFIG_CRYPTO_LZ4HC is not set
@@ -1061,7 +1236,15 @@ index b095bcd..1aad7d4 100644
  # end of Compression
  
  #
-@@ -10238,7 +10352,6 @@ CONFIG_ARCH_HAS_DMA_PREP_COHERENT=y
+@@ -10046,7 +10145,6 @@ CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA=y
+ CONFIG_CRYPTO_LIB_CHACHA_GENERIC=y
+ CONFIG_CRYPTO_LIB_CHACHA=y
+ CONFIG_CRYPTO_LIB_CURVE25519_GENERIC=y
+-CONFIG_CRYPTO_LIB_CURVE25519_INTERNAL=y
+ CONFIG_CRYPTO_LIB_CURVE25519=y
+ CONFIG_CRYPTO_LIB_DES=y
+ CONFIG_CRYPTO_LIB_POLY1305_RSIZE=9
+@@ -10123,7 +10221,6 @@ CONFIG_ARCH_HAS_DMA_PREP_COHERENT=y
  CONFIG_ARCH_HAS_FORCE_DMA_UNENCRYPTED=y
  CONFIG_SWIOTLB=y
  # CONFIG_SWIOTLB_DYNAMIC is not set
@@ -1069,11 +1252,19 @@ index b095bcd..1aad7d4 100644
  CONFIG_DMA_NEED_SYNC=y
  # CONFIG_DMA_RESTRICTED_POOL is not set
  CONFIG_DMA_NONCOHERENT_MMAP=y
+@@ -10276,6 +10373,7 @@ CONFIG_UBSAN_BOUNDS_STRICT=y
+ CONFIG_UBSAN_SHIFT=y
+ # CONFIG_UBSAN_DIV_ZERO is not set
+ # CONFIG_UBSAN_UNREACHABLE is not set
++CONFIG_UBSAN_SIGNED_WRAP=y
+ CONFIG_UBSAN_BOOL=y
+ CONFIG_UBSAN_ENUM=y
+ # CONFIG_UBSAN_ALIGNMENT is not set
 diff --git a/kernel/build/pkg.yaml b/kernel/build/pkg.yaml
-index 40f25d5..b5f96ce 100644
+index f797dd4..b44030e 100644
 --- a/kernel/build/pkg.yaml
 +++ b/kernel/build/pkg.yaml
-@@ -28,7 +28,7 @@ steps:
+@@ -27,7 +27,7 @@ steps:
        {{ else }}
        - |
          cd /src
@@ -1083,11 +1274,11 @@ index 40f25d5..b5f96ce 100644
          cd /src
  
 diff --git a/kernel/prepare/pkg.yaml b/kernel/prepare/pkg.yaml
-index 6c6e61d..5df67c3 100644
+index 6408110..b507e5d 100644
 --- a/kernel/prepare/pkg.yaml
 +++ b/kernel/prepare/pkg.yaml
-@@ -6,8 +6,8 @@ dependencies:
-   - image: "{{ .LLVM_IMAGE }}:{{ .TOOLS_REV }}"
+@@ -5,8 +5,8 @@ dependencies:
+   - stage: base
  steps:
    - sources:
 -      - url: https://cdn.kernel.org/pub/linux/kernel/v{{ regexReplaceAll "(\\d+)(.\\d+)(\\.\\d+)?$" .linux_version "${1}" }}.x/linux-{{ .linux_version }}.tar.xz
@@ -1097,7 +1288,7 @@ index 6c6e61d..5df67c3 100644
          sha256: "{{ .linux_sha256 }}"
          sha512: "{{ .linux_sha512 }}"
        - url: https://github.com/a13xp0p0v/kernel-hardening-checker/archive/{{ .kspp_ref }}.tar.gz
-@@ -19,7 +19,7 @@ steps:
+@@ -18,7 +18,7 @@ steps:
      prepare:
        - |
          mkdir -p /src

patches/siderolabs/talos/0001-Patched-for-Raspberry-Pi-5.patch

@@ -0,0 +1,414 @@
+From 808bd99557797a8175464184202ff4df7c324a55 Mon Sep 17 00:00:00 2001
+From: Patrick Hunziker <patrick@hunziker.io>
+Date: Sat, 8 Nov 2025 11:31:15 +0100
+Subject: [PATCH] Patched for Raspberry Pi 5
+
+---
+ hack/modules-arm64.txt | 367 ++++++++++++++++++-----------------------
+ 1 file changed, 160 insertions(+), 207 deletions(-)
+
+diff --git a/hack/modules-arm64.txt b/hack/modules-arm64.txt
+index 3b11b7551..95c3ee669 100644
+--- a/hack/modules-arm64.txt
++++ b/hack/modules-arm64.txt
+@@ -1,237 +1,190 @@
+-kernel/arch/arm64/lib/xor-neon.ko
++modules.builtin.bin
++modules.builtin.modinfo
++modules.builtin.alias.bin
++modules.dep.bin
++modules.alias
++modules.weakdep
++modules.order
++modules.symbols.bin
++modules.dep
++modules.alias.bin
++modules.softdep
++modules.symbols
++modules.devname
++kernel/crypto/xor.ko
++kernel/crypto/async_tx/async_xor.ko
+ kernel/crypto/async_tx/async_memcpy.ko
+ kernel/crypto/async_tx/async_pq.ko
+ kernel/crypto/async_tx/async_raid6_recov.ko
+ kernel/crypto/async_tx/async_tx.ko
+-kernel/crypto/async_tx/async_xor.ko
+-kernel/crypto/hkdf.ko
+-kernel/crypto/xor.ko
+-kernel/drivers/acpi/video.ko
+-kernel/drivers/ata/ahci.ko
+-kernel/drivers/ata/pata_amd.ko
+-kernel/drivers/ata/pata_marvell.ko
+-kernel/drivers/ata/pata_oldpiix.ko
+-kernel/drivers/ata/pata_sch.ko
+-kernel/drivers/block/nbd.ko
+-kernel/drivers/block/ublk_drv.ko
++kernel/crypto/blake2b_generic.ko
++kernel/crypto/xxhash_generic.ko
++kernel/crypto/zstd.ko
++kernel/net/ipv4/ip_gre.ko
++kernel/net/tls/tls.ko
++kernel/net/openvswitch/vport-gre.ko
++kernel/drivers/infiniband/sw/rxe/rdma_rxe.ko
++kernel/drivers/infiniband/hw/mlx4/mlx4_ib.ko
++kernel/drivers/infiniband/hw/mlx5/mlx5_ib.ko
++kernel/drivers/infiniband/hw/hns/hns-roce-hw-v2.ko
++kernel/drivers/misc/bcm2835_smi.ko
+ kernel/drivers/crypto/tegra/tegra-se.ko
+-kernel/drivers/gpu/drm/drm_buddy.ko
+-kernel/drivers/gpu/drm/drm_exec.ko
+-kernel/drivers/gpu/drm/drm_gpuvm.ko
+-kernel/drivers/gpu/drm/drm_panel_backlight_quirks.ko
+-kernel/drivers/gpu/drm/drm_suballoc_helper.ko
++kernel/drivers/acpi/video.ko
++kernel/drivers/gpu/drm/vc4/vc4.ko
+ kernel/drivers/gpu/drm/drm_ttm_helper.ko
+-kernel/drivers/gpu/drm/drm_vram_helper.ko
+-kernel/drivers/gpu/drm/hisilicon/hibmc/hibmc-drm.ko
++kernel/drivers/gpu/drm/ttm/ttm.ko
++kernel/drivers/gpu/drm/drm_suballoc_helper.ko
+ kernel/drivers/gpu/drm/scheduler/gpu-sched.ko
++kernel/drivers/gpu/drm/drm_buddy.ko
+ kernel/drivers/gpu/drm/tegra/tegra-drm.ko
+-kernel/drivers/gpu/drm/ttm/ttm.ko
++kernel/drivers/gpu/drm/amd/amdxcp/amdxcp.ko
++kernel/drivers/gpu/drm/amd/amdgpu/amdgpu.ko
++kernel/drivers/gpu/drm/drm_vram_helper.ko
++kernel/drivers/gpu/drm/hisilicon/hibmc/hibmc-drm.ko
++kernel/drivers/gpu/drm/panfrost/panfrost.ko
++kernel/drivers/gpu/drm/display/drm_dp_aux_bus.ko
++kernel/drivers/gpu/drm/v3d/v3d.ko
++kernel/drivers/gpu/drm/drm_exec.ko
+ kernel/drivers/gpu/host1x/host1x.ko
+-kernel/drivers/hid/hid-a4tech.ko
+-kernel/drivers/hid/hid-apple.ko
+-kernel/drivers/hid/hid-belkin.ko
+-kernel/drivers/hid/hid-cherry.ko
+-kernel/drivers/hid/hid-chicony.ko
+-kernel/drivers/hid/hid-cypress.ko
+-kernel/drivers/hid/hid-ezkey.ko
+-kernel/drivers/hid/hid-gyration.ko
+-kernel/drivers/hid/hid-ite.ko
+-kernel/drivers/hid/hid-kensington.ko
+-kernel/drivers/hid/hid-lg-g15.ko
+-kernel/drivers/hid/hid-logitech.ko
+-kernel/drivers/hid/hid-microsoft.ko
+-kernel/drivers/hid/hid-monterey.ko
+-kernel/drivers/hid/hid-petalynx.ko
+-kernel/drivers/hid/hid-pl.ko
+-kernel/drivers/hid/hid-samsung.ko
+-kernel/drivers/hid/hid-sunplus.ko
+-kernel/drivers/hid/hid-topseed.ko
+-kernel/drivers/hwmon/i5k_amb.ko
+-kernel/drivers/i2c/algos/i2c-algo-bit.ko
+-kernel/drivers/i2c/busses/i2c-i801.ko
+-kernel/drivers/i2c/i2c-mux.ko
+-kernel/drivers/infiniband/core/ib_umad.ko
+-kernel/drivers/infiniband/core/ib_uverbs.ko
+-kernel/drivers/infiniband/core/rdma_ucm.ko
+-kernel/drivers/infiniband/hw/hns/hns-roce-hw-v2.ko
+-kernel/drivers/infiniband/hw/irdma/irdma.ko
+-kernel/drivers/infiniband/hw/mlx4/mlx4_ib.ko
+-kernel/drivers/infiniband/hw/mlx5/mlx5_ib.ko
+-kernel/drivers/infiniband/sw/rxe/rdma_rxe.ko
+-kernel/drivers/irqchip/irq-bcm2712-mip.ko
+-kernel/drivers/irqchip/irq-imx-mu-msi.ko
+-kernel/drivers/leds/led-class-multicolor.ko
+-kernel/drivers/mailbox/bcm-flexrm-mailbox.ko
+-kernel/drivers/md/bcache/bcache.ko
+-kernel/drivers/md/dm-bio-prison.ko
+-kernel/drivers/md/dm-cache-smq.ko
+-kernel/drivers/md/dm-cache.ko
+-kernel/drivers/md/dm-integrity.ko
+-kernel/drivers/md/dm-multipath.ko
+-kernel/drivers/md/dm-raid.ko
+-kernel/drivers/md/dm-round-robin.ko
+-kernel/drivers/md/dm-thin-pool.ko
+-kernel/drivers/md/persistent-data/dm-persistent-data.ko
+-kernel/drivers/md/raid456.ko
+-kernel/drivers/misc/hpilo.ko
+-kernel/drivers/mmc/host/sdhci_f_sdh30.ko
+-kernel/drivers/mmc/host/sdhci-acpi.ko
+-kernel/drivers/mmc/host/sdhci-brcmstb.ko
+-kernel/drivers/mmc/host/sdhci-cadence.ko
+-kernel/drivers/mmc/host/sdhci-iproc.ko
+-kernel/drivers/mmc/host/sdhci-msm.ko
+-kernel/drivers/mmc/host/sdhci-of-arasan.ko
+-kernel/drivers/mmc/host/sdhci-of-dwcmshc.ko
+-kernel/drivers/mmc/host/sdhci-of-esdhc.ko
+-kernel/drivers/mmc/host/sdhci-pci.ko
+-kernel/drivers/mmc/host/sdhci-pltfm.ko
+-kernel/drivers/mmc/host/sdhci-tegra.ko
+-kernel/drivers/mmc/host/sdhci-uhs2.ko
+-kernel/drivers/mmc/host/sdhci-xenon-driver.ko
++kernel/drivers/nvme/host/nvme-rdma.ko
++kernel/drivers/nvme/target/nvme-loop.ko
++kernel/drivers/nvme/target/nvmet-fc.ko
++kernel/drivers/nvme/target/nvmet.ko
++kernel/drivers/nvme/target/nvmet-tcp.ko
++kernel/drivers/nvme/target/nvmet-rdma.ko
++kernel/drivers/nvme/common/nvme-auth.ko
++kernel/drivers/net/mdio/mdio-mux-meson-gxl.ko
++kernel/drivers/net/thunderbolt/thunderbolt_net.ko
+ kernel/drivers/net/ethernet/amazon/ena/ena.ko
+-kernel/drivers/net/ethernet/aquantia/atlantic/atlantic.ko
+ kernel/drivers/net/ethernet/atheros/alx/alx.ko
+-kernel/drivers/net/ethernet/broadcom/bnx2.ko
+-kernel/drivers/net/ethernet/broadcom/bnx2x/bnx2x.ko
+-kernel/drivers/net/ethernet/broadcom/bnxt/bnxt_en.ko
+-kernel/drivers/net/ethernet/broadcom/tg3.ko
+-kernel/drivers/net/ethernet/cavium/common/cavium_ptp.ko
+-kernel/drivers/net/ethernet/cisco/enic/enic.ko
+ kernel/drivers/net/ethernet/google/gve/gve.ko
+-kernel/drivers/net/ethernet/hisilicon/hip04_eth.ko
++kernel/drivers/net/ethernet/sfc/sfc.ko
++kernel/drivers/net/ethernet/sfc/siena/sfc-siena.ko
++kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_en.ko
++kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_core.ko
++kernel/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
++kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_pci.ko
++kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_minimal.ko
++kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_i2c.ko
++kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_spectrum.ko
++kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_core.ko
++kernel/drivers/net/ethernet/mellanox/mlxfw/mlxfw.ko
++kernel/drivers/net/ethernet/chelsio/cxgb4/cxgb4.ko
++kernel/drivers/net/ethernet/chelsio/cxgb3/cxgb3.ko
++kernel/drivers/net/ethernet/chelsio/inline_crypto/ch_ipsec/ch_ipsec.ko
++kernel/drivers/net/ethernet/chelsio/cxgb/cxgb.ko
++kernel/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf.ko
+ kernel/drivers/net/ethernet/hisilicon/hisi_femac.ko
+-kernel/drivers/net/ethernet/hisilicon/hix5hd2_gmac.ko
+-kernel/drivers/net/ethernet/hisilicon/hns_mdio.ko
++kernel/drivers/net/ethernet/hisilicon/hip04_eth.ko
+ kernel/drivers/net/ethernet/hisilicon/hns/hnae.ko
+ kernel/drivers/net/ethernet/hisilicon/hns/hns_dsaf.ko
+ kernel/drivers/net/ethernet/hisilicon/hns/hns_enet_drv.ko
+-kernel/drivers/net/ethernet/hisilicon/hns3/hclge-common.ko
+ kernel/drivers/net/ethernet/hisilicon/hns3/hclge.ko
++kernel/drivers/net/ethernet/hisilicon/hns3/hns3.ko
+ kernel/drivers/net/ethernet/hisilicon/hns3/hclgevf.ko
+ kernel/drivers/net/ethernet/hisilicon/hns3/hnae3.ko
+-kernel/drivers/net/ethernet/hisilicon/hns3/hns3.ko
+-kernel/drivers/net/ethernet/intel/e100.ko
+-kernel/drivers/net/ethernet/intel/e1000/e1000.ko
+-kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko
+-kernel/drivers/net/ethernet/intel/i40e/i40e.ko
+-kernel/drivers/net/ethernet/intel/iavf/iavf.ko
+-kernel/drivers/net/ethernet/intel/ice/ice.ko
+-kernel/drivers/net/ethernet/intel/idpf/idpf.ko
+-kernel/drivers/net/ethernet/intel/igb/igb.ko
+-kernel/drivers/net/ethernet/intel/igbvf/igbvf.ko
+-kernel/drivers/net/ethernet/intel/igc/igc.ko
+-kernel/drivers/net/ethernet/intel/ixgbe/ixgbe.ko
+-kernel/drivers/net/ethernet/intel/ixgbevf/ixgbevf.ko
+-kernel/drivers/net/ethernet/intel/libeth/libeth_xdp.ko
+-kernel/drivers/net/ethernet/intel/libeth/libeth.ko
+-kernel/drivers/net/ethernet/intel/libie/libie_adminq.ko
+-kernel/drivers/net/ethernet/intel/libie/libie_fwlog.ko
+-kernel/drivers/net/ethernet/intel/libie/libie.ko
+-kernel/drivers/net/ethernet/marvell/sky2.ko
+-kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_core.ko
+-kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_en.ko
+-kernel/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
+-kernel/drivers/net/ethernet/mellanox/mlxfw/mlxfw.ko
+-kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_core.ko
+-kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_i2c.ko
+-kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_minimal.ko
+-kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_pci.ko
+-kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_spectrum.ko
+-kernel/drivers/net/ethernet/qlogic/qed/qed.ko
+-kernel/drivers/net/ethernet/qlogic/qede/qede.ko
+-kernel/drivers/net/ethernet/qlogic/qlcnic/qlcnic.ko
+-kernel/drivers/net/ethernet/realtek/8139too.ko
+-kernel/drivers/net/ethernet/realtek/r8169.ko
+-kernel/drivers/net/ethernet/sfc/sfc.ko
+-kernel/drivers/net/ethernet/sfc/siena/sfc-siena.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/stmmac-pci.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/stmmac-platform.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/stmmac.ko
+-kernel/drivers/net/mdio.ko
+-kernel/drivers/net/pcs/pcs_xpcs.ko
+-kernel/drivers/net/phy/dp83867.ko
+-kernel/drivers/net/usb/r8152.ko
+-kernel/drivers/net/vmxnet3/vmxnet3.ko
++kernel/drivers/net/ethernet/hisilicon/hns3/hclge-common.ko
++kernel/drivers/net/ethernet/hisilicon/hns_mdio.ko
++kernel/drivers/net/ethernet/hisilicon/hix5hd2_gmac.ko
++kernel/drivers/net/phy/ax88796b.ko
++kernel/drivers/net/usb/sr9800.ko
++kernel/drivers/net/usb/rndis_host.ko
++kernel/drivers/net/usb/cdc_mbim.ko
++kernel/drivers/net/usb/zaurus.ko
++kernel/drivers/net/usb/kalmia.ko
++kernel/drivers/net/usb/usbnet.ko
++kernel/drivers/net/usb/dm9601.ko
++kernel/drivers/net/usb/plusb.ko
++kernel/drivers/net/usb/gl620a.ko
++kernel/drivers/net/usb/cdc_subset.ko
++kernel/drivers/net/usb/smsc75xx.ko
++kernel/drivers/net/usb/cx82310_eth.ko
++kernel/drivers/net/usb/mcs7830.ko
++kernel/drivers/net/usb/ch9200.ko
++kernel/drivers/net/usb/smsc95xx.ko
++kernel/drivers/net/usb/huawei_cdc_ncm.ko
++kernel/drivers/net/usb/r8153_ecm.ko
++kernel/drivers/net/usb/ax88179_178a.ko
++kernel/drivers/net/usb/cdc_eem.ko
++kernel/drivers/net/usb/sierra_net.ko
++kernel/drivers/net/usb/asix.ko
++kernel/drivers/net/usb/net1080.ko
++kernel/drivers/net/usb/cdc-phonet.ko
++kernel/drivers/net/usb/aqc111.ko
++kernel/drivers/net/usb/qmi_wwan.ko
++kernel/drivers/net/usb/sr9700.ko
++kernel/drivers/net/usb/lg-vl600.ko
++kernel/drivers/net/usb/int51x1.ko
++kernel/drivers/net/usb/cdc_ncm.ko
++kernel/drivers/net/usb/cdc_ether.ko
+ kernel/drivers/net/vrf.ko
+-kernel/drivers/nvme/common/nvme-auth.ko
+-kernel/drivers/nvme/host/nvme-rdma.ko
+-kernel/drivers/nvme/host/nvme.ko
+-kernel/drivers/nvme/target/nvme-loop.ko
+-kernel/drivers/nvme/target/nvmet-fc.ko
+-kernel/drivers/nvme/target/nvmet-rdma.ko
+-kernel/drivers/nvme/target/nvmet-tcp.ko
+-kernel/drivers/nvme/target/nvmet.ko
+-kernel/drivers/perf/hisilicon/hisi_pcie_pmu.ko
+-kernel/drivers/perf/hisilicon/hisi_uncore_cpa_pmu.ko
+-kernel/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.ko
+-kernel/drivers/perf/hisilicon/hisi_uncore_hha_pmu.ko
+-kernel/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.ko
+-kernel/drivers/perf/hisilicon/hisi_uncore_pa_pmu.ko
+-kernel/drivers/perf/hisilicon/hisi_uncore_pmu.ko
+-kernel/drivers/perf/hisilicon/hisi_uncore_sllc_pmu.ko
+-kernel/drivers/perf/hisilicon/hisi_uncore_uc_pmu.ko
+-kernel/drivers/perf/hisilicon/hns3_pmu.ko
++kernel/drivers/irqchip/irq-imx-mu-msi.ko
++kernel/drivers/input/misc/uinput.ko
++kernel/drivers/mailbox/bcm-flexrm-mailbox.ko
++kernel/drivers/hwmon/i5k_amb.ko
+ kernel/drivers/scsi/fcoe/libfcoe.ko
+-kernel/drivers/scsi/hisi_sas/hisi_sas_main.ko
++kernel/drivers/scsi/mpi3mr/mpi3mr.ko
++kernel/drivers/scsi/qla2xxx/qla2xxx.ko
++kernel/drivers/scsi/lpfc/lpfc.ko
++kernel/drivers/scsi/qedf/qedf.ko
+ kernel/drivers/scsi/hisi_sas/hisi_sas_v1_hw.ko
+-kernel/drivers/scsi/hisi_sas/hisi_sas_v2_hw.ko
++kernel/drivers/scsi/hisi_sas/hisi_sas_main.ko
+ kernel/drivers/scsi/hisi_sas/hisi_sas_v3_hw.ko
+-kernel/drivers/scsi/hpsa.ko
++kernel/drivers/scsi/hisi_sas/hisi_sas_v2_hw.ko
+ kernel/drivers/scsi/libfc/libfc.ko
+-kernel/drivers/scsi/lpfc/lpfc.ko
+-kernel/drivers/scsi/megaraid/megaraid_sas.ko
+-kernel/drivers/scsi/mpi3mr/mpi3mr.ko
+-kernel/drivers/scsi/mpt3sas/mpt3sas.ko
+-kernel/drivers/scsi/qedf/qedf.ko
+-kernel/drivers/scsi/qla2xxx/qla2xxx.ko
+-kernel/drivers/scsi/smartpqi/smartpqi.ko
+-kernel/drivers/uio/uio_pci_generic.ko
+-kernel/drivers/uio/uio.ko
+-kernel/drivers/usb/serial/ch341.ko
+-kernel/drivers/usb/serial/cp210x.ko
+-kernel/drivers/usb/serial/ftdi_sio.ko
+-kernel/drivers/usb/serial/pl2303.ko
+-kernel/drivers/vdpa/mlx5/mlx5_vdpa.ko
+-kernel/drivers/vdpa/octeon_ep/octep_vdpa.ko
+-kernel/drivers/vdpa/solidrun/snet_vdpa.ko
+-kernel/drivers/vdpa/vdpa_sim/vdpa_sim_blk.ko
+-kernel/drivers/vdpa/vdpa_sim/vdpa_sim_net.ko
+-kernel/drivers/vdpa/vdpa_sim/vdpa_sim.ko
+-kernel/drivers/vdpa/vdpa_user/vduse.ko
+-kernel/drivers/vdpa/vdpa.ko
+-kernel/drivers/vdpa/virtio_pci/vp_vdpa.ko
+-kernel/drivers/vfio/pci/vfio-pci-core.ko
++kernel/drivers/thunderbolt/thunderbolt.ko
+ kernel/drivers/vfio/pci/vfio-pci.ko
+-kernel/drivers/vfio/vfio_iommu_type1.ko
++kernel/drivers/vfio/pci/vfio-pci-core.ko
+ kernel/drivers/vfio/vfio.ko
+-kernel/drivers/vhost/vhost_vdpa.ko
+-kernel/drivers/vhost/vringh.ko
+-kernel/drivers/virtio/virtio_balloon.ko
+-kernel/drivers/virtio/virtio_input.ko
+-kernel/drivers/virtio/virtio_mmio.ko
+-kernel/drivers/virtio/virtio_pci_legacy_dev.ko
+-kernel/drivers/virtio/virtio_pci_modern_dev.ko
+-kernel/drivers/virtio/virtio_pci.ko
+-kernel/drivers/virtio/virtio_vdpa.ko
++kernel/drivers/vfio/vfio_iommu_type1.ko
++kernel/drivers/usb/class/cdc-wdm.ko
++kernel/drivers/usb/serial/usb_wwan.ko
++kernel/drivers/usb/serial/option.ko
+ kernel/drivers/watchdog/sbsa_gwdt.ko
++kernel/drivers/md/dm-round-robin.ko
++kernel/drivers/md/raid456.ko
++kernel/drivers/md/persistent-data/dm-persistent-data.ko
++kernel/drivers/md/dm-multipath.ko
++kernel/drivers/md/dm-bio-prison.ko
++kernel/drivers/md/dm-thin-pool.ko
++kernel/drivers/md/dm-raid.ko
++kernel/drivers/md/dm-cache.ko
++kernel/drivers/md/dm-cache-smq.ko
++kernel/drivers/dma/bcm-sba-raid.ko
++kernel/drivers/uio/uio.ko
++kernel/drivers/uio/uio_pci_generic.ko
++kernel/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.ko
++kernel/drivers/perf/hisilicon/hns3_pmu.ko
++kernel/drivers/perf/hisilicon/hisi_uncore_cpa_pmu.ko
++kernel/drivers/perf/hisilicon/hisi_pcie_pmu.ko
++kernel/drivers/perf/hisilicon/hisi_uncore_pa_pmu.ko
++kernel/drivers/perf/hisilicon/hisi_uncore_hha_pmu.ko
++kernel/drivers/perf/hisilicon/hisi_uncore_uc_pmu.ko
++kernel/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.ko
++kernel/drivers/perf/hisilicon/hisi_uncore_pmu.ko
++kernel/drivers/perf/hisilicon/hisi_uncore_sllc_pmu.ko
++kernel/drivers/block/nbd.ko
++kernel/drivers/media/usb/uvc/uvcvideo.ko
++kernel/drivers/media/common/uvc.ko
++kernel/drivers/media/common/videobuf2/videobuf2-vmalloc.ko
++kernel/drivers/media/common/videobuf2/videobuf2-memops.ko
++kernel/drivers/media/common/videobuf2/videobuf2-common.ko
++kernel/drivers/media/common/videobuf2/videobuf2-v4l2.ko
++kernel/drivers/media/v4l2-core/v4l2-dv-timings.ko
++kernel/drivers/media/v4l2-core/videodev.ko
++kernel/drivers/media/mc/mc.ko
++kernel/arch/arm64/lib/xor-neon.ko
++kernel/lib/raid6/raid6_pq.ko
+ kernel/lib/objagg.ko
+ kernel/lib/parman.ko
+-kernel/lib/raid6/raid6_pq.ko
+-kernel/net/ipv4/ip_gre.ko
+-kernel/net/openvswitch/vport-gre.ko
+-kernel/net/tls/tls.ko
++kernel/fs/btrfs/btrfs.ko
++kernel/fs/nfsd/nfsd.ko
++kernel/fs/binfmt_misc.ko
++kernel/sound/core/snd-pcm-dmaengine.ko
++kernel/sound/core/snd.ko
++kernel/sound/core/snd-pcm.ko
++kernel/sound/core/snd-timer.ko
++kernel/sound/soc/codecs/snd-soc-hdmi-codec.ko
++kernel/sound/soc/snd-soc-core.ko
++kernel/sound/soundcore.ko
+ modules.builtin
+-modules.builtin.modinfo
+-modules.order
+-- 
+2.50.1 (Apple Git-155)
+

patches/siderolabs/talos/0001-Replace-modules-arm64.txt-with-RPi-6.12.47-module-se.patch

@@ -1,226 +0,0 @@
-From 6a36399e47baeed36db12deab50e2d9d4a5914ac Mon Sep 17 00:00:00 2001
-From: Mathias Beaulieu-Duncan <mathias@svrnty.io>
-Date: Mon, 18 May 2026 19:02:29 -0400
-Subject: [PATCH] Replace modules-arm64.txt with RPi 6.12.47 module set
-
-The upstream Talos modules-arm64.txt is the list of kernel modules
-included in the arm64 initramfs. Its entries are computed against
-upstream's mainline kernel build; when Talos is built with the RPi
-downstream kernel (6.12.47), several listed modules either don't
-exist or are gated by upstream-only Kconfig options, causing the
-initramfs install step to fail:
-
-    xargs -a modules-arm64.txt -I {} install -D \
-      usr/lib/modules/${KERNEL_VERSION}/{} ...
-    -> exit 123 (one or more inputs missing)
-
-Replace the list with the intersection of:
-- upstream's "wanted in initramfs" entries
-- modules actually produced by our patched RPi 6.12.47 build
-
-Verified by extracting the kernel image's /usr/lib/modules tree and
-intersecting it with upstream's file. 155 modules survive, covering
-all storage/network/crypto modules needed for headless boot. The 86
-dropped modules are SATA/HID/upstream-only crypto helpers irrelevant
-on RPi5/CM5.
----
- hack/modules-arm64.txt | 86 ------------------------------------------
- 1 file changed, 86 deletions(-)
-
-diff --git a/hack/modules-arm64.txt b/hack/modules-arm64.txt
-index 9888d2b0f..a09360aed 100644
---- a/hack/modules-arm64.txt
-+++ b/hack/modules-arm64.txt
-@@ -4,21 +4,13 @@ kernel/crypto/async_tx/async_pq.ko
- kernel/crypto/async_tx/async_raid6_recov.ko
- kernel/crypto/async_tx/async_tx.ko
- kernel/crypto/async_tx/async_xor.ko
--kernel/crypto/hkdf.ko
- kernel/crypto/xor.ko
- kernel/drivers/acpi/video.ko
--kernel/drivers/ata/ahci.ko
--kernel/drivers/ata/pata_amd.ko
--kernel/drivers/ata/pata_marvell.ko
--kernel/drivers/ata/pata_oldpiix.ko
--kernel/drivers/ata/pata_sch.ko
- kernel/drivers/block/nbd.ko
- kernel/drivers/block/ublk_drv.ko
- kernel/drivers/crypto/tegra/tegra-se.ko
- kernel/drivers/gpu/drm/drm_buddy.ko
- kernel/drivers/gpu/drm/drm_exec.ko
--kernel/drivers/gpu/drm/drm_gpuvm.ko
--kernel/drivers/gpu/drm/drm_panel_backlight_quirks.ko
- kernel/drivers/gpu/drm/drm_suballoc_helper.ko
- kernel/drivers/gpu/drm/drm_ttm_helper.ko
- kernel/drivers/gpu/drm/drm_vram_helper.ko
-@@ -27,43 +19,21 @@ kernel/drivers/gpu/drm/scheduler/gpu-sched.ko
- kernel/drivers/gpu/drm/tegra/tegra-drm.ko
- kernel/drivers/gpu/drm/ttm/ttm.ko
- kernel/drivers/gpu/host1x/host1x.ko
--kernel/drivers/hid/hid-a4tech.ko
--kernel/drivers/hid/hid-apple.ko
--kernel/drivers/hid/hid-belkin.ko
--kernel/drivers/hid/hid-cherry.ko
--kernel/drivers/hid/hid-chicony.ko
--kernel/drivers/hid/hid-cypress.ko
--kernel/drivers/hid/hid-ezkey.ko
--kernel/drivers/hid/hid-gyration.ko
--kernel/drivers/hid/hid-ite.ko
--kernel/drivers/hid/hid-kensington.ko
--kernel/drivers/hid/hid-lg-g15.ko
--kernel/drivers/hid/hid-logitech.ko
- kernel/drivers/hid/hid-microsoft.ko
- kernel/drivers/hid/hid-monterey.ko
- kernel/drivers/hid/hid-multitouch.ko
- kernel/drivers/hid/hid-petalynx.ko
- kernel/drivers/hid/hid-pl.ko
--kernel/drivers/hid/hid-samsung.ko
--kernel/drivers/hid/hid-sunplus.ko
--kernel/drivers/hid/hid-topseed.ko
- kernel/drivers/hwmon/i5k_amb.ko
- kernel/drivers/i2c/algos/i2c-algo-bit.ko
--kernel/drivers/i2c/busses/i2c-i801.ko
--kernel/drivers/i2c/i2c-mux.ko
--kernel/drivers/infiniband/core/ib_umad.ko
--kernel/drivers/infiniband/core/ib_uverbs.ko
--kernel/drivers/infiniband/core/rdma_ucm.ko
- kernel/drivers/infiniband/hw/hns/hns-roce-hw-v2.ko
- kernel/drivers/infiniband/hw/irdma/irdma.ko
- kernel/drivers/infiniband/hw/mlx4/mlx4_ib.ko
- kernel/drivers/infiniband/hw/mlx5/mlx5_ib.ko
- kernel/drivers/infiniband/sw/rxe/rdma_rxe.ko
--kernel/drivers/irqchip/irq-bcm2712-mip.ko
- kernel/drivers/irqchip/irq-imx-mu-msi.ko
- kernel/drivers/leds/led-class-multicolor.ko
- kernel/drivers/mailbox/bcm-flexrm-mailbox.ko
--kernel/drivers/md/bcache/bcache.ko
- kernel/drivers/md/dm-bio-prison.ko
- kernel/drivers/md/dm-cache-smq.ko
- kernel/drivers/md/dm-cache.ko
-@@ -74,30 +44,8 @@ kernel/drivers/md/dm-round-robin.ko
- kernel/drivers/md/dm-thin-pool.ko
- kernel/drivers/md/persistent-data/dm-persistent-data.ko
- kernel/drivers/md/raid456.ko
--kernel/drivers/misc/hpilo.ko
--kernel/drivers/mmc/host/sdhci_f_sdh30.ko
--kernel/drivers/mmc/host/sdhci-acpi.ko
--kernel/drivers/mmc/host/sdhci-brcmstb.ko
--kernel/drivers/mmc/host/sdhci-cadence.ko
--kernel/drivers/mmc/host/sdhci-iproc.ko
--kernel/drivers/mmc/host/sdhci-msm.ko
--kernel/drivers/mmc/host/sdhci-of-arasan.ko
--kernel/drivers/mmc/host/sdhci-of-dwcmshc.ko
--kernel/drivers/mmc/host/sdhci-of-esdhc.ko
--kernel/drivers/mmc/host/sdhci-pci.ko
--kernel/drivers/mmc/host/sdhci-pltfm.ko
--kernel/drivers/mmc/host/sdhci-tegra.ko
--kernel/drivers/mmc/host/sdhci-uhs2.ko
--kernel/drivers/mmc/host/sdhci-xenon-driver.ko
- kernel/drivers/net/ethernet/amazon/ena/ena.ko
--kernel/drivers/net/ethernet/aquantia/atlantic/atlantic.ko
- kernel/drivers/net/ethernet/atheros/alx/alx.ko
--kernel/drivers/net/ethernet/broadcom/bnx2.ko
--kernel/drivers/net/ethernet/broadcom/bnx2x/bnx2x.ko
--kernel/drivers/net/ethernet/broadcom/bnxt/bnxt_en.ko
--kernel/drivers/net/ethernet/broadcom/tg3.ko
--kernel/drivers/net/ethernet/cavium/common/cavium_ptp.ko
--kernel/drivers/net/ethernet/cisco/enic/enic.ko
- kernel/drivers/net/ethernet/google/gve/gve.ko
- kernel/drivers/net/ethernet/hisilicon/hip04_eth.ko
- kernel/drivers/net/ethernet/hisilicon/hisi_femac.ko
-@@ -123,12 +71,8 @@ kernel/drivers/net/ethernet/intel/igbvf/igbvf.ko
- kernel/drivers/net/ethernet/intel/igc/igc.ko
- kernel/drivers/net/ethernet/intel/ixgbe/ixgbe.ko
- kernel/drivers/net/ethernet/intel/ixgbevf/ixgbevf.ko
--kernel/drivers/net/ethernet/intel/libeth/libeth_xdp.ko
- kernel/drivers/net/ethernet/intel/libeth/libeth.ko
--kernel/drivers/net/ethernet/intel/libie/libie_adminq.ko
--kernel/drivers/net/ethernet/intel/libie/libie_fwlog.ko
- kernel/drivers/net/ethernet/intel/libie/libie.ko
--kernel/drivers/net/ethernet/marvell/sky2.ko
- kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_core.ko
- kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_en.ko
- kernel/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
-@@ -138,11 +82,6 @@ kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_i2c.ko
- kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_minimal.ko
- kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_pci.ko
- kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_spectrum.ko
--kernel/drivers/net/ethernet/qlogic/qed/qed.ko
--kernel/drivers/net/ethernet/qlogic/qede/qede.ko
--kernel/drivers/net/ethernet/qlogic/qlcnic/qlcnic.ko
--kernel/drivers/net/ethernet/realtek/8139too.ko
--kernel/drivers/net/ethernet/realtek/r8169.ko
- kernel/drivers/net/ethernet/sfc/sfc.ko
- kernel/drivers/net/ethernet/sfc/siena/sfc-siena.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.ko
-@@ -152,25 +91,17 @@ kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.ko
--kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.ko
--kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/stmmac-pci.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/stmmac-platform.ko
- kernel/drivers/net/ethernet/stmicro/stmmac/stmmac.ko
--kernel/drivers/net/mdio.ko
- kernel/drivers/net/pcs/pcs_xpcs.ko
--kernel/drivers/net/pcs/pcs-rzn1-miic.ko
--kernel/drivers/net/phy/dp83867.ko
--kernel/drivers/net/usb/r8152.ko
--kernel/drivers/net/vmxnet3/vmxnet3.ko
- kernel/drivers/net/vrf.ko
- kernel/drivers/nvme/common/nvme-auth.ko
- kernel/drivers/nvme/host/nvme-rdma.ko
--kernel/drivers/nvme/host/nvme.ko
- kernel/drivers/nvme/target/nvme-loop.ko
- kernel/drivers/nvme/target/nvmet-fc.ko
- kernel/drivers/nvme/target/nvmet-rdma.ko
-@@ -191,21 +122,13 @@ kernel/drivers/scsi/hisi_sas/hisi_sas_main.ko
- kernel/drivers/scsi/hisi_sas/hisi_sas_v1_hw.ko
- kernel/drivers/scsi/hisi_sas/hisi_sas_v2_hw.ko
- kernel/drivers/scsi/hisi_sas/hisi_sas_v3_hw.ko
--kernel/drivers/scsi/hpsa.ko
- kernel/drivers/scsi/libfc/libfc.ko
- kernel/drivers/scsi/lpfc/lpfc.ko
--kernel/drivers/scsi/megaraid/megaraid_sas.ko
- kernel/drivers/scsi/mpi3mr/mpi3mr.ko
--kernel/drivers/scsi/mpt3sas/mpt3sas.ko
- kernel/drivers/scsi/qedf/qedf.ko
- kernel/drivers/scsi/qla2xxx/qla2xxx.ko
--kernel/drivers/scsi/smartpqi/smartpqi.ko
- kernel/drivers/uio/uio_pci_generic.ko
- kernel/drivers/uio/uio.ko
--kernel/drivers/usb/serial/ch341.ko
--kernel/drivers/usb/serial/cp210x.ko
--kernel/drivers/usb/serial/ftdi_sio.ko
--kernel/drivers/usb/serial/pl2303.ko
- kernel/drivers/vdpa/mlx5/mlx5_vdpa.ko
- kernel/drivers/vdpa/octeon_ep/octep_vdpa.ko
- kernel/drivers/vdpa/solidrun/snet_vdpa.ko
-@@ -221,12 +144,6 @@ kernel/drivers/vfio/vfio_iommu_type1.ko
- kernel/drivers/vfio/vfio.ko
- kernel/drivers/vhost/vhost_vdpa.ko
- kernel/drivers/vhost/vringh.ko
--kernel/drivers/virtio/virtio_balloon.ko
--kernel/drivers/virtio/virtio_input.ko
--kernel/drivers/virtio/virtio_mmio.ko
--kernel/drivers/virtio/virtio_pci_legacy_dev.ko
--kernel/drivers/virtio/virtio_pci_modern_dev.ko
--kernel/drivers/virtio/virtio_pci.ko
- kernel/drivers/virtio/virtio_vdpa.ko
- kernel/drivers/watchdog/sbsa_gwdt.ko
- kernel/lib/objagg.ko
-@@ -236,6 +153,3 @@ kernel/net/ipv4/ip_gre.ko
- kernel/net/ipv6/ip6_gre.ko
- kernel/net/openvswitch/vport-gre.ko
- kernel/net/tls/tls.ko
--modules.builtin
--modules.builtin.modinfo
--modules.order
--- 
-2.50.1 (Apple Git-155)
-

patches/siderolabs/talos/0002-Skip-NVRAM-writes-for-GRUB-on-arm64.patch

@@ -1,33 +0,0 @@
-From 2db8797af370535aba7c5694cd291bba8e6c5a67 Mon Sep 17 00:00:00 2001
-From: Mathias Beaulieu-Duncan <mathias@svrnty.io>
-Date: Fri, 13 Feb 2026 19:08:41 -0500
-Subject: [PATCH 2/3] Skip NVRAM writes for GRUB on arm64
-
-On arm64 platforms like RPi5/CM5, the UEFI firmware (U-Boot) does not
-support EFI runtime SetVariable, causing grub-install to fail when
-efibootmgr tries to create NVRAM boot entries. Since arm64-efi systems
-boot by convention (finding BOOTAA64.efi on the ESP), NVRAM boot
-entries are unnecessary.
-
-Pass --no-nvram to grub-install on arm64 to allow in-place upgrades
-via talosctl upgrade to succeed.
----
- .../machined/pkg/runtime/v1alpha1/bootloader/grub/install.go    | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/install.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/install.go
-index 6f5c9f8..766374b 100644
---- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/install.go
-+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/install.go
-@@ -196,7 +196,7 @@ func (c *Config) install(opts options.InstallOptions) (*options.InstallResult, e
- 			args = append(args, "--efi-directory="+filepath.Join(opts.MountPrefix, constants.EFIMountPoint))
- 		}
- 
--		if opts.ImageMode {
-+		if opts.ImageMode || opts.Arch == arm64 {
- 			args = append(args, "--no-nvram")
- 		}
- 
--- 
-2.50.1 (Apple Git-155)
-

patches/siderolabs/talos/0003-Force-GRUB-bootloader-on-arm64.patch

@@ -1,74 +0,0 @@
-From 1393b3f013e758f6bb52d14006d3a7e7db348930 Mon Sep 17 00:00:00 2001
-From: Mathias Beaulieu-Duncan <mathias@svrnty.io>
-Date: Fri, 13 Feb 2026 19:08:58 -0500
-Subject: [PATCH 3/3] Force GRUB bootloader on arm64
-
-On arm64 platforms like RPi5/CM5, the UEFI firmware (U-Boot) exposes
-/sys/firmware/efi but does not support EFI runtime SetVariable. This
-causes sd-boot to fail when trying to write EFI variables during
-installation/upgrade.
-
-Force GRUB on arm64 in two places:
-
-- NewAuto(): When no existing bootloader is detected, create a GRUB
-  config instead of sd-boot. This handles fresh installs.
-
-- Probe(): When an existing GRUB config is not found, skip sd-boot
-  probing and return a fresh GRUB config. This handles the first
-  upgrade on SBC images that ship with sd-boot UKI files — the
-  upgrade transitions from sd-boot to GRUB automatically.
-
-Combined with the --no-nvram patch and the SBC EFI-only layout patch,
-this enables reliable in-place upgrades via talosctl upgrade on
-RPi5/CM5 hardware, including the first upgrade from a fresh flash.
-
-Ref: https://github.com/siderolabs/talos/issues/10859
-Ref: https://github.com/talos-rpi5/talos-builder/issues/21
----
- .../machined/pkg/runtime/v1alpha1/bootloader/bootloader.go | 15 +++++++++++++++
- 1 file changed, 15 insertions(+)
-
-diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/bootloader.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/bootloader.go
-index f084e09..5c388c1 100644
---- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/bootloader.go
-+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/bootloader.go
-@@ -8,6 +8,7 @@ package bootloader
- import (
- 	"fmt"
- 	"os"
-+	goruntime "runtime"
-
- 	"github.com/siderolabs/go-blockdevice/v2/block"
- 	"github.com/siderolabs/go-blockdevice/v2/partitioning/gpt"
-@@ -56,7 +57,17 @@ func Probe(disk string, options options.ProbeOptions) (Bootloader, error) {
-
- 		return grubBootloader, nil
- 	}
-
-+	// On arm64, sd-boot requires EFI SetVariable runtime service which is
-+	// not available on platforms like RPi5/CM5 (U-Boot). Skip sd-boot
-+	// probing and return a fresh GRUB config to transition from sd-boot
-+	// to GRUB on the first upgrade.
-+	if goruntime.GOARCH == "arm64" {
-+		options.Logf("arm64: no GRUB config found, creating new GRUB bootloader (sd-boot not supported)")
-+
-+		return grub.NewConfig(), nil
-+	}
-+
- 	sdbootBootloader, err := sdboot.Probe(disk, options)
- 	if err != nil {
- 		return nil, err
-@@ -73,6 +84,10 @@ func Probe(disk string, options options.ProbeOptions) (Bootloader, error) {
-
- // NewAuto returns a new bootloader based on auto-detection.
- func NewAuto() Bootloader {
-+	if goruntime.GOARCH == "arm64" {
-+		return grub.NewConfig()
-+	}
-+
- 	if sdboot.IsUEFIBoot() {
- 		return sdboot.New()
- 	}
---
-2.50.1 (Apple Git-155)
-

patches/siderolabs/talos/0004-Fallback-to-classic-bind-mounts-on-kernels-without-o.patch

@@ -1,45 +0,0 @@
-From 98366401143dcc31c056a7d96242775f9ba013ca Mon Sep 17 00:00:00 2001
-From: Mathias Beaulieu-Duncan <mathias@svrnty.io>
-Date: Sat, 14 Feb 2026 14:05:15 -0500
-Subject: [PATCH 4/4] Fallback to classic bind mounts on kernels without
- open_tree support
-
-The open_tree syscall on anonymous filesystem file descriptors was added
-in kernel 6.15.0. Talos previously only checked for this capability when
-running in container mode, assuming bare metal always had a sufficiently
-new kernel. However, platforms like RPi5/CM5 use the RPi downstream
-kernel (6.12.x) which lacks this feature, causing shadow bind mount
-failures for /etc files and cascading network initialization failures.
-
-Remove the InContainer() gate so the OpentreeOnAnonymousFS() capability
-check runs on all platforms, enabling the classic (OSRoot) fallback when
-the kernel does not support the newer mount API.
----
- .../pkg/runtime/v1alpha2/v1alpha2_controller.go       | 11 ++++++-----
- 1 file changed, 6 insertions(+), 5 deletions(-)
-
-diff --git a/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go b/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go
-index 29b297654..653a45d57 100644
---- a/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go
-+++ b/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go
-@@ -113,11 +113,12 @@ func (ctrl *Controller) Run(ctx context.Context, drainer *runtime.Drainer) error
- 
- 	networkBindMountTarget = constants.SystemResolvedPath
- 
--	// While running in container, we don't have control over kernel version
--	// shipped with the machine. If the kernel does not support open_tree syscall
--	// on anonymous filesystem file descriptors, we need to fallback to the classic,
--	// less secure mode. This capability was added in kernel 6.15.0.
--	if ctrl.v1alpha1Runtime.State().Platform().Mode().InContainer() {
-+	// If the kernel does not support open_tree syscall on anonymous filesystem
-+	// file descriptors, we need to fallback to the classic, less secure mode.
-+	// This capability was added in kernel 6.15.0. This check is needed for
-+	// containers (where the host kernel is unknown) and for bare metal platforms
-+	// running older kernels such as the RPi downstream kernel (6.12.x).
-+	{
- 		opentreeOnAnonymous, err := runtime.KernelCapabilities().OpentreeOnAnonymousFS()
- 		if err != nil {
- 			return err
--- 
-2.50.1 (Apple Git-155)
-

patches/siderolabs/talos/0005-Handle-missing-BOOT-partition-for-GRUB-on-SBC-layout.patch

@@ -1,296 +0,0 @@
-From cf9dfa043b21b393003ca4c2facebdd8e570f547 Mon Sep 17 00:00:00 2001
-From: Mathias Beaulieu-Duncan <mathias@svrnty.io>
-Date: Mon, 16 Feb 2026 11:31:08 -0500
-Subject: [PATCH] Handle missing BOOT partition for GRUB on SBC layouts
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-On SBC platforms like RPi5/CM5, the disk layout has no separate BOOT
-(XFS) partition — all boot assets (kernel, initramfs, GRUB config,
-EFI bootloader, firmware) reside on a single EFI (VFAT) partition.
-
-The GRUB bootloader probe, install, and revert functions all assumed a
-BOOT partition exists, causing talosctl upgrade to fail with "partition
-with label BOOT not found" on these layouts.
-
-Fix all three code paths to fall back to mounting the EFI partition at
-/boot when the BOOT partition is absent:
-
-- probe.go: Try EFI at /boot as fallback when BOOT is missing, so
-  the upgrade can detect the existing GRUB installation
-- install.go: Probe for BOOT existence before including it in mount
-  specs; when absent, mount EFI at /boot and adjust --efi-directory
-- revert.go: Fall back to EFI at /boot for rollback operations
-
-This enables in-place upgrades via talosctl upgrade on SBC platforms
-that use EFI-only disk layouts.
----
- .../runtime/v1alpha1/bootloader/grub/grub.go  |  2 +
- .../v1alpha1/bootloader/grub/install.go       | 49 +++++++++--
- .../runtime/v1alpha1/bootloader/grub/probe.go | 83 ++++++++++++-------
- .../v1alpha1/bootloader/grub/revert.go        | 33 ++++++--
- 4 files changed, 125 insertions(+), 42 deletions(-)
-
-diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go
-index 0cb5b1d4d..093ffecd9 100644
---- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go
-+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go
-@@ -30,6 +30,8 @@ type Config struct {
- 	Fallback       BootLabel
- 	Entries        map[BootLabel]MenuEntry
- 	AddResetOption bool
-+
-+	bootFromEFI bool
- }
- 
- // MenuEntry represents a grub menu entry in the grub config file.
-diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/install.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/install.go
-index d0af22d98..f1ea13e5a 100644
---- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/install.go
-+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/install.go
-@@ -34,12 +34,12 @@ const (
- 
- // Install validates the grub configuration and writes it to the disk.
- func (c *Config) Install(opts options.InstallOptions) (*options.InstallResult, error) {
--	mountSpecs := []mount.Spec{
--		{
--			PartitionLabel: constants.BootPartitionLabel,
--			FilesystemType: partition.FilesystemTypeXFS,
--			MountTarget:    filepath.Join(opts.MountPrefix, constants.BootMountPoint),
--		},
-+	var mountSpecs []mount.Spec
-+
-+	bootMountSpec := mount.Spec{
-+		PartitionLabel: constants.BootPartitionLabel,
-+		FilesystemType: partition.FilesystemTypeXFS,
-+		MountTarget:    filepath.Join(opts.MountPrefix, constants.BootMountPoint),
- 	}
- 
- 	efiMountSpec := mount.Spec{
-@@ -48,6 +48,23 @@ func (c *Config) Install(opts options.InstallOptions) (*options.InstallResult, e
- 		MountTarget:    filepath.Join(opts.MountPrefix, constants.EFIMountPoint),
- 	}
- 
-+	// check if the BOOT partition is present (absent on SBC layouts like RPi5/CM5)
-+	if err := mount.PartitionOp(
-+		opts.BootDisk,
-+		[]mount.Spec{bootMountSpec},
-+		func() error {
-+			return nil
-+		},
-+		[]blkid.ProbeOption{
-+			blkid.WithSkipLocking(true),
-+		},
-+		nil,
-+		nil,
-+		opts.BlkidInfo,
-+	); err == nil {
-+		mountSpecs = append(mountSpecs, bootMountSpec)
-+	}
-+
- 	var efiFound bool
- 
- 	// check if the EFI partition is present
-@@ -65,12 +82,21 @@ func (c *Config) Install(opts options.InstallOptions) (*options.InstallResult, e
- 		opts.BlkidInfo,
- 	); err == nil {
- 		efiFound = true
--	}
- 
--	if efiFound {
-+		if len(mountSpecs) == 0 {
-+			// No BOOT partition (SBC layout): mount EFI at /boot so GRUB
-+			// can find kernel/initramfs/grub.cfg in the expected place.
-+			efiMountSpec.MountTarget = filepath.Join(opts.MountPrefix, constants.BootMountPoint)
-+			c.bootFromEFI = true
-+		}
-+
- 		mountSpecs = append(mountSpecs, efiMountSpec)
- 	}
- 
-+	if len(mountSpecs) == 0 {
-+		return nil, fmt.Errorf("neither BOOT nor EFI partition found on disk %s", opts.BootDisk)
-+	}
-+
- 	err := mount.PartitionOp(
- 		opts.BootDisk,
- 		mountSpecs,
-@@ -318,7 +344,12 @@ func (c *Config) runGrubInstall(ctx context.Context, opts options.InstallOptions
- 		}
- 
- 		if efiMode {
--			args = append(args, "--efi-directory="+filepath.Join(opts.MountPrefix, constants.EFIMountPoint))
-+			efiDir := constants.EFIMountPoint
-+			if c.bootFromEFI {
-+				efiDir = constants.BootMountPoint
-+			}
-+
-+			args = append(args, "--efi-directory="+filepath.Join(opts.MountPrefix, efiDir))
- 		}
- 
- 		if opts.ImageMode || opts.Arch == arm64 {
-diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/probe.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/probe.go
-index f5755592f..771ca2a90 100644
---- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/probe.go
-+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/probe.go
-@@ -19,6 +19,31 @@ import (
- func ProbeWithCallback(disk string, options options.ProbeOptions, callback func(*Config) error) (*Config, error) {
- 	var grubConf *Config
- 
-+	readConfig := func() error {
-+		var err error
-+
-+		grubConf, err = Read(ConfigPath)
-+		if err != nil {
-+			return err
-+		}
-+
-+		if grubConf != nil && callback != nil {
-+			return callback(grubConf)
-+		}
-+
-+		if grubConf == nil {
-+			options.Logf("GRUB: config not found")
-+		}
-+
-+		return nil
-+	}
-+
-+	probeOpts := []mountv3.ManagerOption{
-+		mountv3.WithSkipIfMounted(),
-+		mountv3.WithReadOnly(),
-+	}
-+
-+	// Try BOOT partition first (standard layout)
- 	if err := mount.PartitionOp(
- 		disk,
- 		[]mount.Spec{
-@@ -28,40 +53,42 @@ func ProbeWithCallback(disk string, options options.ProbeOptions, callback func(
- 				MountTarget:    constants.BootMountPoint,
- 			},
- 		},
--		func() error {
--			var err error
--
--			grubConf, err = Read(ConfigPath)
--			if err != nil {
--				return err
--			}
--
--			if grubConf != nil && callback != nil {
--				return callback(grubConf)
--			}
--
--			if grubConf == nil {
--				options.Logf("GRUB: config not found")
--			}
--
--			return nil
--		},
-+		readConfig,
- 		options.BlockProbeOptions,
--		[]mountv3.ManagerOption{
--			mountv3.WithSkipIfMounted(),
--			mountv3.WithReadOnly(),
--		},
-+		probeOpts,
- 		nil,
- 		nil,
- 	); err != nil {
--		if xerrors.TagIs[mount.NotFoundTag](err) {
--			// if partitions are not found, it means GRUB is not installed
--			options.Logf("GRUB: BOOT partition not found, skipping probing")
--
--			return nil, nil
-+		if !xerrors.TagIs[mount.NotFoundTag](err) {
-+			return nil, err
- 		}
- 
--		return nil, err
-+		// BOOT not found, try EFI partition mounted at /boot (SBC layout)
-+		options.Logf("GRUB: BOOT partition not found, trying EFI partition")
-+
-+		if err := mount.PartitionOp(
-+			disk,
-+			[]mount.Spec{
-+				{
-+					PartitionLabel: constants.EFIPartitionLabel,
-+					FilesystemType: partition.FilesystemTypeVFAT,
-+					MountTarget:    constants.BootMountPoint,
-+				},
-+			},
-+			readConfig,
-+			options.BlockProbeOptions,
-+			probeOpts,
-+			nil,
-+			nil,
-+		); err != nil {
-+			if xerrors.TagIs[mount.NotFoundTag](err) {
-+				options.Logf("GRUB: neither BOOT nor EFI partition found, skipping probing")
-+
-+				return nil, nil
-+			}
-+
-+			return nil, err
-+		}
- 	}
- 
- 	return grubConf, nil
-diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/revert.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/revert.go
-index 3e514d65d..95628193b 100644
---- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/revert.go
-+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/revert.go
-@@ -26,6 +26,10 @@ func (c *Config) Revert(disk string) error {
- 		return fmt.Errorf("cannot revert bootloader: %w", bootloaderNotInstalledError{})
- 	}
- 
-+	revertOpts := []mountv3.ManagerOption{
-+		mountv3.WithSkipIfMounted(),
-+	}
-+
- 	err := mount.PartitionOp(
- 		disk,
- 		[]mount.Spec{
-@@ -37,14 +41,33 @@ func (c *Config) Revert(disk string) error {
- 		},
- 		c.revert,
- 		nil,
--		[]mountv3.ManagerOption{
--			mountv3.WithSkipIfMounted(),
--		},
-+		revertOpts,
- 		nil,
- 		nil,
- 	)
--	if err != nil && !xerrors.TagIs[mount.NotFoundTag](err) {
--		return err
-+	if err != nil {
-+		if !xerrors.TagIs[mount.NotFoundTag](err) {
-+			return err
-+		}
-+
-+		// BOOT not found, try EFI partition mounted at /boot (SBC layout)
-+		if err := mount.PartitionOp(
-+			disk,
-+			[]mount.Spec{
-+				{
-+					PartitionLabel: constants.EFIPartitionLabel,
-+					FilesystemType: partition.FilesystemTypeVFAT,
-+					MountTarget:    constants.BootMountPoint,
-+				},
-+			},
-+			c.revert,
-+			nil,
-+			revertOpts,
-+			nil,
-+			nil,
-+		); err != nil && !xerrors.TagIs[mount.NotFoundTag](err) {
-+			return err
-+		}
- 	}
- 
- 	return nil
--- 
-2.50.1 (Apple Git-155)
-

patches/siderolabs/talos/0006-grub-EFI-at-boot-fallback-for-BOOT-less-SBC-layout-i.patch

@@ -1,92 +0,0 @@
-From a50511de74db08a0b4426be88bb52ce860a008a4 Mon Sep 17 00:00:00 2001
-From: builder <build@svrnty.io>
-Date: Fri, 22 May 2026 16:10:42 -0400
-Subject: [PATCH] grub: EFI-at-/boot fallback for BOOT-less SBC layout in
- Upgrade path
-
----
- .../v1alpha1/bootloader/grub/upgrade.go       | 43 +++++++++++++++----
- 1 file changed, 35 insertions(+), 8 deletions(-)
-
-diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/upgrade.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/upgrade.go
-index 9e3f86b84..e99bf2939 100644
---- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/upgrade.go
-+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/upgrade.go
-@@ -6,6 +6,7 @@ package grub
- 
- import (
- 	"context"
-+	"fmt"
- 	"path/filepath"
- 
- 	"github.com/siderolabs/go-blockdevice/v2/blkid"
-@@ -18,12 +19,12 @@ import (
- 
- // Upgrade copies new boot assets and updates grub configuration on an existing installation.
- func (c *Config) Upgrade(opts options.InstallOptions) (*options.InstallResult, error) {
--	mountSpecs := []mount.Spec{
--		{
--			PartitionLabel: constants.BootPartitionLabel,
--			FilesystemType: partition.FilesystemTypeXFS,
--			MountTarget:    filepath.Join(opts.MountPrefix, constants.BootMountPoint),
--		},
-+	var mountSpecs []mount.Spec
-+
-+	bootMountSpec := mount.Spec{
-+		PartitionLabel: constants.BootPartitionLabel,
-+		FilesystemType: partition.FilesystemTypeXFS,
-+		MountTarget:    filepath.Join(opts.MountPrefix, constants.BootMountPoint),
- 	}
- 
- 	efiMountSpec := mount.Spec{
-@@ -32,6 +33,23 @@ func (c *Config) Upgrade(opts options.InstallOptions) (*options.InstallResult, e
- 		MountTarget:    filepath.Join(opts.MountPrefix, constants.EFIMountPoint),
- 	}
- 
-+	// check if the BOOT partition is present (absent on SBC layouts like RPi5/CM5)
-+	if err := mount.PartitionOp(
-+		opts.BootDisk,
-+		[]mount.Spec{bootMountSpec},
-+		func() error {
-+			return nil
-+		},
-+		[]blkid.ProbeOption{
-+			blkid.WithSkipLocking(true),
-+		},
-+		nil,
-+		nil,
-+		opts.BlkidInfo,
-+	); err == nil {
-+		mountSpecs = append(mountSpecs, bootMountSpec)
-+	}
-+
- 	var efiFound bool
- 
- 	// check if the EFI partition is present
-@@ -49,12 +67,21 @@ func (c *Config) Upgrade(opts options.InstallOptions) (*options.InstallResult, e
- 		opts.BlkidInfo,
- 	); err == nil {
- 		efiFound = true
--	}
- 
--	if efiFound {
-+		if len(mountSpecs) == 0 {
-+			// No BOOT partition (SBC layout): mount EFI at /boot so GRUB
-+			// can find kernel/initramfs/grub.cfg in the expected place.
-+			efiMountSpec.MountTarget = filepath.Join(opts.MountPrefix, constants.BootMountPoint)
-+			c.bootFromEFI = true
-+		}
-+
- 		mountSpecs = append(mountSpecs, efiMountSpec)
- 	}
- 
-+	if len(mountSpecs) == 0 {
-+		return nil, fmt.Errorf("neither BOOT nor EFI partition found on disk %s", opts.BootDisk)
-+	}
-+
- 	err := mount.PartitionOp(
- 		opts.BootDisk,
- 		mountSpecs,
--- 
-2.50.1 (Apple Git-155)
-

patches/siderolabs/talos/0007-Wait-for-STATE-volume-on-slow-init-disks-in-config-a.patch

@@ -1,114 +0,0 @@
-From 27501076fcb1e183e68313ef0e14092d7f403063 Mon Sep 17 00:00:00 2001
-From: Mathias Beaulieu-Duncan <mathias@svrnty.io>
-Date: Mon, 25 May 2026 17:10:13 -0400
-Subject: [PATCH] Wait for STATE volume on slow-init disks in config acquire
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-On slow-init storage (notably RPi CM5 eMMC, which takes ~2 minutes 13
-seconds from kernel boot to mmc0/CQE-enabled), the config acquire state
-machine's stateDisk step sees STATE in phase=missing during the early
-boot window and immediately transitions to stateEmbedded. With no
-embedded config either, the node falls through to maintenance mode and
-stays there even after the STATE volume later reaches phase=ready —
-the state machine is one-way and never re-enters stateDisk.
-
-Result: in-place upgrades to v1.13.2 on CM5 hardware leave the node in
-maintenance with its on-disk config.yaml intact but unread, until a
-human runs `talosctl apply-config --insecure` to re-feed the same file
-that's already on the STATE filesystem.
-
-This patch makes stateDisk tolerate transient phase=missing for up to
-5 minutes (stateMissingDiskTimeout) before falling through. The outer
-Run loop gets a 5-second ticker so the timeout can fire even when no
-further volume-status events arrive (e.g. truly missing STATE on a
-fresh install). Fast-init hardware sees no change — STATE reaches ready
-within seconds and the existing path runs.
-
-Tested on RPi CM5 (eMMC, 6.12.47 RPi-downstream kernel) — boot path
-that previously dropped to maintenance now waits ~2m15s, sees STATE
-reach ready, and continues to stateDone with the persisted config.
----
- .../pkg/controllers/config/acquire.go         | 37 ++++++++++++++++++-
- 1 file changed, 36 insertions(+), 1 deletion(-)
-
-diff --git a/internal/app/machined/pkg/controllers/config/acquire.go b/internal/app/machined/pkg/controllers/config/acquire.go
-index a70fddb..7a3758f 100644
---- a/internal/app/machined/pkg/controllers/config/acquire.go
-+++ b/internal/app/machined/pkg/controllers/config/acquire.go
-@@ -18,6 +18,7 @@ import (
- 	"path/filepath"
- 	"slices"
- 	"strings"
-+	"time"
- 
- 	"github.com/cosi-project/runtime/pkg/controller"
- 	"github.com/cosi-project/runtime/pkg/safe"
-@@ -86,8 +87,16 @@ type AcquireController struct {
- 	diskConfig                config.Provider
- 	storedEmbeddedConfig      []byte
- 	skipMaskingEmbeddedConfig bool
-+	firstSeenStateMissing     time.Time
- }
- 
-+// stateMissingDiskTimeout is how long stateDisk will wait for the STATE volume
-+// to leave the "missing" phase before falling through to embedded/maintenance.
-+// On slow-init storage (e.g. RPi CM5 eMMC) the volume can take ~2-3 minutes to
-+// appear after kernel boot; transitioning to embedded too eagerly leaves the
-+// node permanently in maintenance even though the on-disk config is intact.
-+const stateMissingDiskTimeout = 5 * time.Minute
-+
- // Name implements controller.Controller interface.
- func (ctrl *AcquireController) Name() string {
- 	return "config.AcquireController"
-@@ -177,11 +186,17 @@ func (ctrl *AcquireController) Run(ctx context.Context, r controller.Runtime, lo
- 	// initialize with empty sources
- 	ctrl.configSourcesUsed = []string{}
- 
-+	// periodic wake-up so stateDisk can re-check slow-init volumes and trip
-+	// its timeout even when no resource events fire.
-+	tick := time.NewTicker(5 * time.Second)
-+	defer tick.Stop()
-+
- 	for {
- 		select {
- 		case <-ctx.Done():
- 			return nil
- 		case <-r.EventCh():
-+		case <-tick.C:
- 		}
- 
- 		// check the spec first
-@@ -262,7 +277,27 @@ func (ctrl *AcquireController) stateDisk(ctx context.Context, r controller.Runti
- 		// wait for the status to be available
- 		return nil, nil, nil
- 	case stateVolumeStatus.TypedSpec().Phase == block.VolumePhaseMissing:
--		// STATE is missing, proceed to stateEmbedded
-+		// STATE is reported missing. On slow-init storage (e.g. RPi CM5 eMMC)
-+		// the volume can take a couple of minutes to appear after kernel boot,
-+		// so wait up to stateMissingDiskTimeout for it to reach ready before
-+		// falling through to embedded/maintenance.
-+		if ctrl.firstSeenStateMissing.IsZero() {
-+			ctrl.firstSeenStateMissing = time.Now()
-+		}
-+
-+		if time.Since(ctrl.firstSeenStateMissing) < stateMissingDiskTimeout {
-+			logger.Info("STATE volume not yet available, waiting",
-+				zap.Duration("elapsed", time.Since(ctrl.firstSeenStateMissing)),
-+				zap.Duration("timeout", stateMissingDiskTimeout),
-+			)
-+
-+			return nil, nil, nil
-+		}
-+
-+		logger.Warn("STATE volume still missing after timeout, proceeding to embedded",
-+			zap.Duration("waited", time.Since(ctrl.firstSeenStateMissing)),
-+		)
-+
- 		return ctrl.stateEmbedded, nil, nil
- 	case stateVolumeStatus.TypedSpec().Phase == block.VolumePhaseReady:
- 		// STATE is ready, proceed to to the action
--- 
-2.50.1 (Apple Git-155)
-

patches/siderolabs/talos/0008-imager-respect-insecure-for-Overlay-and-OverlayInsta.patch

@@ -1,42 +0,0 @@
-From e2bacf8336c63a4d11a54f3978fc15e8bf4362ce Mon Sep 17 00:00:00 2001
-From: Mathias Beaulieu-Duncan <mathias@svrnty.io>
-Date: Mon, 25 May 2026 17:20:32 -0400
-Subject: [PATCH] imager: respect --insecure for Overlay and OverlayInstaller
- assets
-
-The --insecure flag on talosctl imager (and the imager docker image) only
-applied to BaseInstaller, ImageCache, and SystemExtensions assets.
-Overlay.Image and Input.OverlayInstaller never received ForceInsecure,
-so pulling overlay images from an insecure (HTTP) registry failed with
-'http: server gave HTTP response to HTTPS client' even when --insecure
-was passed.
-
-Set ForceInsecure on both overlay-related ContainerAsset references
-when the flag is present, matching how the other inputs are handled.
----
- cmd/installer/cmd/imager/root.go | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/cmd/installer/cmd/imager/root.go b/cmd/installer/cmd/imager/root.go
-index d65b56089..ea16a45b3 100644
---- a/cmd/installer/cmd/imager/root.go
-+++ b/cmd/installer/cmd/imager/root.go
-@@ -120,12 +120,14 @@ var rootCmd = &cobra.Command{
- 					prof.Overlay = &profile.OverlayOptions{
- 						Name: cmdFlags.OverlayName,
- 						Image: profile.ContainerAsset{
--							ImageRef: cmdFlags.OverlayImage,
-+							ImageRef:      cmdFlags.OverlayImage,
-+							ForceInsecure: cmdFlags.Insecure,
- 						},
- 						ExtraOptions: extraOverlayOptions,
- 					}
- 
- 					prof.Input.OverlayInstaller.ImageRef = cmdFlags.OverlayImage
-+					prof.Input.OverlayInstaller.ForceInsecure = cmdFlags.Insecure
- 				}
- 
- 				prof.Input.SystemExtensions = xslices.Map(
--- 
-2.50.1 (Apple Git-155)
-

patches/talos-rpi5/sbc-raspberrypi5/0002-Fix-SBC-overlay-upgrade-detect-EFI-mount-path-for-SB.patch

@@ -1,77 +0,0 @@
-From 5cdfe8ddb717e8de4e9d1c9e3000614ad8a1b5bb Mon Sep 17 00:00:00 2001
-From: Mathias Beaulieu-Duncan <mathias@openharbor.io>
-Date: Wed, 25 Feb 2026 12:41:51 -0500
-Subject: [PATCH] Fix SBC overlay upgrade: detect EFI mount path for SBC
- layouts
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-On SBC platforms (RPi5/CM5), the disk layout has no separate BOOT
-partition. During upgrades, the GRUB install code mounts the EFI
-partition at /boot instead of /boot/EFI. The overlay installer was
-always writing to /boot/EFI, causing config.txt and firmware files
-to end up in the wrong subdirectory — invisible to the firmware.
-
-Detect the SBC layout by checking if config.txt already exists at
-/boot/ (indicating EFI is mounted there), and write files to the
-correct location.
----
- installers/rpi5/src/config.txt |  3 ++-
- installers/rpi5/src/main.go    | 18 +++++++++++++-----
- 2 files changed, 15 insertions(+), 6 deletions(-)
-
-diff --git a/installers/rpi5/src/config.txt b/installers/rpi5/src/config.txt
-index 1445d0e..e38291b 100644
---- a/installers/rpi5/src/config.txt
-+++ b/installers/rpi5/src/config.txt
-@@ -11,7 +11,8 @@ kernel=u-boot.bin
- arm_64bit=1
- # Run as fast as firmware / board allows.
- arm_boost=1
--# Enable the primary/console UART.
-+# Enable UART0 on GPIO 14/15 (Pi5/CM5 requires explicit dt overlay).
-+dtoverlay=uart0-pi5
- enable_uart=1
- # Disable Bluetooth.
- dtoverlay=disable-bt
-diff --git a/installers/rpi5/src/main.go b/installers/rpi5/src/main.go
-index 38cd824..155a86b 100644
---- a/installers/rpi5/src/main.go
-+++ b/installers/rpi5/src/main.go
-@@ -41,13 +41,21 @@ func (i *RpiInstaller) GetOptions(extra rpiOptions) (overlay.Options, error) {
- }
- 
- func (i *RpiInstaller) Install(options overlay.InstallOptions[rpiOptions]) error {
--	err := copy.Dir(filepath.Join(options.ArtifactsPath, "arm64/firmware/boot"), filepath.Join(options.MountPrefix, "/boot/EFI"))
--	if err != nil {
-+	// Determine where the EFI partition is mounted.
-+	// Standard layout: BOOT (XFS) at /boot, EFI (VFAT) at /boot/EFI
-+	// SBC layout:      no BOOT partition, EFI (VFAT) at /boot
-+	efiDir := filepath.Join(options.MountPrefix, "/boot/EFI")
-+
-+	if _, err := os.Stat(filepath.Join(options.MountPrefix, "/boot/config.txt")); err == nil {
-+		// config.txt exists at /boot — EFI partition is mounted at /boot (SBC layout).
-+		efiDir = filepath.Join(options.MountPrefix, "/boot")
-+	}
-+
-+	if err := copy.Dir(filepath.Join(options.ArtifactsPath, "arm64/firmware/boot"), efiDir); err != nil {
- 		return err
- 	}
- 
--	err = copy.File(filepath.Join(options.ArtifactsPath, "arm64/u-boot/rpi5/u-boot.bin"), filepath.Join(options.MountPrefix, "/boot/EFI/u-boot.bin"))
--	if err != nil {
-+	if err := copy.File(filepath.Join(options.ArtifactsPath, "arm64/u-boot/rpi5/u-boot.bin"), filepath.Join(efiDir, "u-boot.bin")); err != nil {
- 		return err
- 	}
- 
-@@ -57,5 +65,5 @@ func (i *RpiInstaller) Install(options overlay.InstallOptions[rpiOptions]) error
- 
- 	configTxt = append(configTxt, []byte("\n"+options.ExtraOptions.ConfigTxtAppend)...)
- 
--	return os.WriteFile(filepath.Join(options.MountPrefix, "/boot/EFI/config.txt"), configTxt, 0o644)
-+	return os.WriteFile(filepath.Join(efiDir, "config.txt"), configTxt, 0o644)
- }
--- 
-2.50.1 (Apple Git-155)
-

scripts/auto-update.sh

@@ -83,11 +83,11 @@ fi
 echo "Running patch smoke test ..." >&2
 if ! gmake checkouts patches; then
   echo "Patches failed to apply!" >&2
-  gmake checkouts-clean >/dev/null 2>&1 || true
+  gmake checkouts-clean 2>/dev/null || true
   echo "patch_failed=true"
   exit 0
 fi
-gmake checkouts-clean >/dev/null 2>&1
+gmake checkouts-clean
 
 # ── Generate tag ────────────────────────────────────────────────────
 TALOS_VER=$(grep '^TALOS_VERSION' "$MAKEFILE" | awk '{print $NF}')
@@ -103,23 +103,5 @@ LAST_BUILD=$(git tag -l "${TAG_PREFIX}-*" \
 NEXT_BUILD=$(( ${LAST_BUILD:-0} + 1 ))
 NEW_TAG="${TAG_PREFIX}-${NEXT_BUILD}"
 
-# ── Update README badges and examples ───────────────────────────────
-README="README.md"
-if [ -f "$README" ]; then
-  OLD_TALOS=$(sed -n 's/.*talos-v\([0-9]*\.[0-9]*\.[0-9]*\).*/\1/p' "$README" | head -1)
-  OLD_KERNEL=$(sed -n 's/.*kernel-\([0-9]*\.[0-9]*\.[0-9]*\).*/\1/p' "$README" | head -1)
-  OLD_TAG=$(sed -n 's/.*\(v[0-9]*\.[0-9]*\.[0-9]*-k[0-9]*\.[0-9]*\.[0-9]*-[0-9]*\).*/\1/p' "$README" | head -1)
-
-  echo "Updating README: talos v${OLD_TALOS} → v${TALOS_VER}, kernel ${OLD_KERNEL} → ${KERNEL_VER}, tag ${OLD_TAG} → ${NEW_TAG}" >&2
-
-  sed -i "s/talos-v${OLD_TALOS}/talos-${TALOS_VER}/g" "$README"
-  sed -i "s/kernel-${OLD_KERNEL}/kernel-${KERNEL_VER}/g" "$README"
-  sed -i "s/\`v${OLD_TALOS}\`/\`${TALOS_VER}\`/g" "$README"
-  sed -i "s/\`k${OLD_KERNEL}\`/\`k${KERNEL_VER}\`/g" "$README"
-  if [ -n "$OLD_TAG" ]; then
-    sed -i "s/${OLD_TAG}/${NEW_TAG}/g" "$README"
-  fi
-fi
-
 echo "Generated tag: $NEW_TAG" >&2
 echo "new_tag=$NEW_TAG"