diff --git a/sys/conf/Makefile.arm b/sys/conf/Makefile.arm
index af6ce7136636..d3047406e31c 100644
--- a/sys/conf/Makefile.arm
+++ b/sys/conf/Makefile.arm
@@ -1,107 +1,102 @@
 # Makefile.arm -- with config changes.
 # Copyright 1990 W. Jolitz
 #	from: @(#)Makefile.i386	7.1 5/10/91
 #
 # Makefile for FreeBSD
 #
 # This makefile is constructed from a machine description:
 #	config machineid
 # Most changes should be made in the machine description
 #	/sys/arm/conf/``machineid''
 # after which you should do
 #	 config machineid
 # Generic makefile changes should be made in
 #	/sys/conf/Makefile.arm
 # after which config should be rerun for all machines.
 #
 
 # Which version of config(8) is required.
 %VERSREQ=	600013
 
 STD8X16FONT?=	iso
 
 .if !defined(S)
 .if exists(./@/.)
 S=	./@
 .else
 S=	../../..
 .endif
 .endif
 .include "$S/conf/kern.pre.mk"
 
 INCLUDES+= -I$S/contrib/libfdt -I$S/contrib/device-tree/include -I$$/dts/include
 
 LINUX_DTS_VERSION!=	awk '/freebsd,dts-version/ { sub(/;$$/,"", $$NF); print $$NF }' $S/dts/freebsd-compatible.dts
 CFLAGS += -DLINUX_DTS_VERSION=\"${LINUX_DTS_VERSION}\"
 
 .if !defined(DEBUG)
 STRIP_FLAGS = -S
 .endif
 
 # We don't support gcc's thump interwork stuff, so disable it
 CFLAGS.gcc += -mno-thumb-interwork
 
 # We generally don't want fpu instructions in the kernel.
 CFLAGS.clang += -mfpu=none
 
 .if !empty(DDB_ENABLED)
 CFLAGS += -funwind-tables
 .endif
 
 # "makeoptions KERNVIRTADDR=" is now optional, supply the default value.
 .if empty(KERNVIRTADDR)
 KERNVIRTADDR= 0xc0000000
 .endif
 
 # Use a custom SYSTEM_LD command to generate the elf kernel, so we can
 # set the text segment start address, and also strip the "arm mapping
 # symbols" which have names like $a.0 and $d.2; see the document
 # "ELF for the ARM architecture" for more info on the mapping symbols.
 SYSTEM_LD= \
 	${SYSTEM_LD_BASECMD} \
 	    --defsym='text_start=kernbase + SIZEOF_HEADERS' \
 	    -o ${.TARGET} ${SYSTEM_OBJS} vers.o; \
 	$(OBJCOPY) \
 	    --wildcard \
 	    --strip-symbol='$$[adt]*' \
 	    ${.TARGET}
 
 # Generate the .bin (no elf headers) kernel as an extra build output.
 # We must relink to generate the .bin kernel, because without headers the
 # location of everything changes.  We also strip the ARM marker symbols.
-KERNEL_EXTRA+= ${KERNEL_KO}.bin
-KERNEL_EXTRA_INSTALL+= ${KERNEL_KO}.bin
-
 ${KERNEL_KO}.bin: ${SYSTEM_DEP} vers.o
 	@echo "linking ${.TARGET}"
 	@${SYSTEM_LD_BASECMD} \
 	    --defsym='text_start=kernbase' \
 	    -o ${.TARGET} ${SYSTEM_OBJS} vers.o
 	${SIZE} ${.TARGET}
 	@${OBJCOPY} \
 	    --wildcard \
 	    --strip-symbol='$$[adt]*' \
 	    --output-target=binary \
 	    ${.TARGET}
 	@chmod 755 ${.TARGET}
 
 # hack because genassym.c includes sys/bus.h which includes these.
 genassym.o: bus_if.h device_if.h
 
 %BEFORE_DEPEND
 
 %OBJS
 
 %FILES.c
 
 %FILES.s
 
 %FILES.m
 
 %CLEAN
 
-CLEAN+=	${KERNEL_KO}.bin
-
 %RULES
 	
 .include "$S/conf/kern.post.mk"
diff --git a/sys/conf/Makefile.arm64 b/sys/conf/Makefile.arm64
index 77c36fa6ce6c..435326cadd9d 100644
--- a/sys/conf/Makefile.arm64
+++ b/sys/conf/Makefile.arm64
@@ -1,101 +1,95 @@
 # Makefile.arm64 -- with config changes.
 # Copyright 1990 W. Jolitz
 #	from: @(#)Makefile.i386	7.1 5/10/91
 #	from FreeBSD: src/sys/conf/Makefile.i386,v 1.255 2002/02/20 23:35:49
 #
 # Makefile for FreeBSD
 #
 # This makefile is constructed from a machine description:
 #	config machineid
 # Most changes should be made in the machine description
 #	/sys/arm64/conf/``machineid''
 # after which you should do
 #	 config machineid
 # Generic makefile changes should be made in
 #	/sys/conf/Makefile.arm64
 # after which config should be rerun for all machines.
 #
 
 # Which version of config(8) is required.
 %VERSREQ=	600012
 
 .if !defined(S)
 S=	../../..
 .endif
 .include "$S/conf/kern.pre.mk"
 
 INCLUDES+= -I$S/contrib/libfdt -I$S/contrib/device-tree/include
 
 LINUX_DTS_VERSION!=	awk '/freebsd,dts-version/ { sub(/;$$/,"", $$NF); print $$NF }' $S/dts/freebsd-compatible.dts
 CFLAGS += -DLINUX_DTS_VERSION=\"${LINUX_DTS_VERSION}\"
 
 PERTHREAD_SSP_ENABLED!=	grep PERTHREAD_SSP opt_global.h || true ; echo
 .if !empty(PERTHREAD_SSP_ENABLED)
 . if ${COMPILER_TYPE} == "clang" && ${COMPILER_VERSION} >= 130000
 ARM64_SSP_CFLAGS = -mstack-protector-guard=sysreg
 ARM64_SSP_CFLAGS += -mstack-protector-guard-reg=sp_el0
 ARM64_SSP_CFLAGS += -mstack-protector-guard-offset=0
 . else
 ARM64_SSP_CFLAGS += -DPERTHREAD_SSP_WARNING
 .  warning "Compiler is too old to support PERTHREAD_SSP"
 . endif
 CFLAGS += ${ARM64_SSP_CFLAGS}
 ARCH_FLAGS += ${ARM64_SSP_CFLAGS}
 .endif
 
 # Use a custom SYSTEM_LD command to generate the elf kernel, so we can
 # set the text segment start address, and also strip the "arm mapping
 # symbols" which have names like $a.0 and $d.2; see the document
 # "ELF for the ARM architecture" for more info on the mapping symbols.
 SYSTEM_LD= \
 	${SYSTEM_LD_BASECMD} \
 	    --defsym='text_start=kernbase + SIZEOF_HEADERS' \
 	    -o ${.TARGET} ${SYSTEM_OBJS} vers.o; \
 	$(OBJCOPY) \
 	    --wildcard \
 	    --strip-symbol='$$[adtx]*' \
 	    ${.TARGET}
 
-# Generate the .bin (booti images) kernel as an extra build output.
-# The targets and rules to generate these appear near the end of the file.
-KERNEL_EXTRA+= ${KERNEL_KO}.bin
-KERNEL_EXTRA_INSTALL+= ${KERNEL_KO}.bin
-
 .if !empty(DDB_ENABLED) || !empty(DTRACE_ENABLED) || !empty(HWPMC_ENABLED)
 CFLAGS += -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer
 .endif
 
 %BEFORE_DEPEND
 
 %OBJS
 
 %FILES.c
 
 %FILES.s
 
 %FILES.m
 
 %CLEAN
-CLEAN+=	${KERNEL_KO}.bin
 
 %RULES
 
 .include "$S/conf/kern.post.mk"
 
 # Create a kernel.bin file...
 # Copy the kernel to u-boot's booti image format (the elf headers are
 # stripped and a custom binary head blob is prepended), saving the
 # output in a temp file.  We also strip arm "marker" symbols which are
 # used only by elf toolchains.  Read the symbols from kernel.full and pass
 # them to arm_kernel_boothdr.awk, which generates a binary header blob
 # that goes on the front of the stripped kernel.  Cat the header blob
 # and the temp file together to make the kernel.bin file.
 ${KERNEL_KO}.bin: ${FULLKERNEL}
 	@${OBJCOPY} --wildcard --strip-symbol='$$[adtx]*' \
 	    --output-target=binary ${FULLKERNEL} ${.TARGET}.temp
 	@{ ${NM} ${FULLKERNEL} | \
 	    ${AWK} -f $S/tools/arm_kernel_boothdr.awk -v hdrtype=v8booti && \
 	    cat ${.TARGET}.temp; \
 	 } > ${.TARGET}
 	@rm ${.TARGET}.temp
 	@echo "created ${.TARGET} from ${.ALLSRC}"
diff --git a/sys/conf/kern.opts.mk b/sys/conf/kern.opts.mk
index cc6f8a1d8755..d9d96a133250 100644
--- a/sys/conf/kern.opts.mk
+++ b/sys/conf/kern.opts.mk
@@ -1,219 +1,224 @@
 
 # Options set in the build system which affect the building of kernel
 # modules. These select which parts to compile in or out (eg INET) or which
 # parts to omit (eg CDDL or SOURCELESS_HOST). Some of these will cause
 # config.mk to define symbols in various opt_*.h files.
 
 #
 # Define MK_* variables (which are either "yes" or "no") for users
 # to set via WITH_*/WITHOUT_* in /etc/src.conf and override in the
 # make(1) environment.
 # These should be tested with `== "no"' or `!= "no"' in makefiles.
 # The NO_* variables should only be set by makefiles for variables
 # that haven't been converted over.
 #
 
 # Note: bsd.own.mk must be included before the rest of kern.opts.mk to make
 # building on 10.x and earlier work. This should be removed when that's no
 # longer supported since it confounds the defaults (since it uses the host's
 # notion of defaults rather than what's default in current when building
 # within sys/modules).
 .include <bsd.own.mk>
 
 # These options are used by the kernel build process (kern.mk and kmod.mk)
 # They have to be listed here so we can build modules outside of the
 # src tree.
 
 KLDXREF_CMD?=	kldxref
 
 __DEFAULT_YES_OPTIONS = \
     AUTOFS \
     BHYVE \
     BLUETOOTH \
     CCD \
     CDDL \
     CRYPT \
     CUSE \
     DTRACE \
     EFI \
     FORMAT_EXTENSIONS \
     INET \
     INET6 \
     IPFILTER \
     IPSEC_SUPPORT \
     ISCSI \
     KERNEL_SYMBOLS \
     NETGRAPH \
     OFED \
     PF \
     SCTP_SUPPORT \
     SOURCELESS_HOST \
     SOURCELESS_UCODE \
     SPLIT_KERNEL_DEBUG \
     TESTS \
     USB_GADGET_EXAMPLES \
     ZFS
 
 __DEFAULT_NO_OPTIONS = \
     BHYVE_SNAPSHOT \
+    KERNEL_BIN \
     KERNEL_RETPOLINE \
     RATELIMIT \
     REPRODUCIBLE_BUILD \
     VERIEXEC
 
-# Some options are totally broken on some architectures. We disable
-# them. If you need to enable them on an experimental basis, you
-# must change this code.
-# Note: These only apply to the list of modules we build by default
-# and sometimes what is in the opt_*.h files by default.
-# Kernel config files are unaffected, though some targets can be
-# affected by KERNEL_SYMBOLS, FORMAT_EXTENSIONS, CTF and SSP.
+# Some options are totally broken on some architectures. We disable them. If you
+# need to enable them on an experimental basis, you must change this code.
+# Note: These only apply to the list of modules we build by default and
+# sometimes what is in the opt_*.h files by default.  Kernel config files are
+# unaffected, though some targets can be affected by KERNEL_BIN, KERNEL_SYMBOLS,
+# FORMAT_EXTENSIONS, CTF and SSP.
 
 # Broken on 32-bit arm, kernel module compile errors
 .if ${MACHINE_CPUARCH} == "arm"
 BROKEN_OPTIONS+= OFED
 .endif
 
 # Things that don't work based on toolchain support.
 .if ${MACHINE} != "i386" && ${MACHINE} != "amd64"
 BROKEN_OPTIONS+= KERNEL_RETPOLINE
 .endif
 
 # EFI doesn't exist on powerpc or riscv and is broken on i386
 .if ${MACHINE:Mpowerpc} || ${MACHINE:Mriscv} || ${MACHINE} == "i386"
 BROKEN_OPTIONS+=EFI
 .endif
 
+# We only generate kernel.bin on arm and arm64, otherwise they break the build.
+.if ${MACHINE} != "arm" && ${MACHINE} != "arm64"
+BROKEN_OPTIONS+=KERNEL_BIN
+.endif
+
 .if ${MACHINE_CPUARCH} == "i386" || ${MACHINE_CPUARCH} == "amd64"
 __DEFAULT_NO_OPTIONS += FDT
 .else
 __DEFAULT_YES_OPTIONS += FDT
 .endif
 
 __SINGLE_OPTIONS = \
 	INIT_ALL
 
 __INIT_ALL_OPTIONS=	none pattern zero
 __INIT_ALL_DEFAULT=	none
 .if ${MACHINE} == "amd64"
 # PR251083 conflict between INIT_ALL_ZERO and ifunc memset
 BROKEN_SINGLE_OPTIONS+=	INIT_ALL zero none
 .endif
 
 # expanded inline from bsd.mkopt.mk to avoid share/mk dependency
 
 # Those that default to yes
 .for var in ${__DEFAULT_YES_OPTIONS}
 .if !defined(MK_${var})
 .if defined(WITHOUT_${var})			# WITHOUT always wins
 MK_${var}:=	no
 .else
 MK_${var}:=	yes
 .endif
 .else
 .if ${MK_${var}} != "yes" && ${MK_${var}} != "no"
 .error "Illegal value for MK_${var}: ${MK_${var}}"
 .endif
 .endif # !defined(MK_${var})
 .endfor
 .undef __DEFAULT_YES_OPTIONS
 
 # Those that default to no
 .for var in ${__DEFAULT_NO_OPTIONS}
 .if !defined(MK_${var})
 .if defined(WITH_${var}) && !defined(WITHOUT_${var}) # WITHOUT always wins
 MK_${var}:=	yes
 .else
 MK_${var}:=	no
 .endif
 .else
 .if ${MK_${var}} != "yes" && ${MK_${var}} != "no"
 .error "Illegal value for MK_${var}: ${MK_${var}}"
 .endif
 .endif # !defined(MK_${var})
 .endfor
 .undef __DEFAULT_NO_OPTIONS
 
 #
 # MK_* options which are always no, usually because they are
 # unsupported/badly broken on this architecture.
 #
 .for var in ${BROKEN_OPTIONS}
 MK_${var}:=	no
 .endfor
 .undef BROKEN_OPTIONS
 
 #
 # Group options set an OPT_FOO variable for each option.
 #
 .for opt in ${__SINGLE_OPTIONS}
 .if !defined(__${opt}_OPTIONS) || empty(__${opt}_OPTIONS)
 .error __${opt}_OPTIONS not defined or empty
 .endif
 .if !defined(__${opt}_DEFAULT) || empty(__${opt}_DEFAULT)
 .error __${opt}_DEFAULT undefined or empty
 .endif
 .if defined(${opt})
 OPT_${opt}:=	${${opt}}
 .else
 OPT_${opt}:=	${__${opt}_DEFAULT}
 .endif
 .if empty(OPT_${opt}) || ${__${opt}_OPTIONS:M${OPT_${opt}}} != ${OPT_${opt}}
 .error Invalid option OPT_${opt} (${OPT_${opt}}), must be one of: ${__${opt}_OPTIONS}
 .endif
 .endfor
 .undef __SINGLE_OPTIONS
 
 .for opt val rep in ${BROKEN_SINGLE_OPTIONS}
 .if ${OPT_${opt}} == ${val}
 OPT_${opt}:=	${rep}
 .endif
 .endfor
 #end of bsd.mkopt.mk expanded inline.
 
 #
 # MK_*_SUPPORT options which default to "yes" unless their corresponding
 # MK_* variable is set to "no".
 #
 .for var in \
     INET \
     INET6
 .if defined(WITHOUT_${var}_SUPPORT) || ${MK_${var}} == "no"
 MK_${var}_SUPPORT:= no
 .else
 .if defined(KERNBUILDDIR)	# See if there's an opt_foo.h
 .if !defined(OPT_${var})
 OPT_${var}!= cat ${KERNBUILDDIR}/opt_${var:tl}.h; echo
 .export OPT_${var}
 .endif
 .if ${OPT_${var}} == ""		# nothing -> no
 MK_${var}_SUPPORT:= no
 .else
 MK_${var}_SUPPORT:= yes
 .endif
 .else				# otherwise, yes
 MK_${var}_SUPPORT:= yes
 .endif
 .endif
 .endfor
 
 .if ${MK_SPLIT_KERNEL_DEBUG} == "no"
 MK_KERNEL_SYMBOLS:=	no
 .endif
 
 .if ${MK_CDDL} == "no"
 MK_DTRACE:=	no
 .endif
 
 # Some modules only compile successfully if option FDT is set, due to #ifdef FDT
 # wrapped around declarations.  Module makefiles can optionally compile such
 # things using .if !empty(OPT_FDT)
 .if !defined(OPT_FDT) && defined(KERNBUILDDIR)
 OPT_FDT!= sed -n '/FDT/p' ${KERNBUILDDIR}/opt_platform.h
 .export OPT_FDT
 .if empty(OPT_FDT)
 MK_FDT:=no
 .else
 MK_FDT:=yes
 .endif
 .endif
diff --git a/sys/conf/kern.post.mk b/sys/conf/kern.post.mk
index bea29507a736..5258cea9441c 100644
--- a/sys/conf/kern.post.mk
+++ b/sys/conf/kern.post.mk
@@ -1,469 +1,478 @@
 
 # Part of a unified Makefile for building kernels.  This part includes all
 # the definitions that need to be after all the % directives except %RULES
 # and ones that act like they are part of %RULES.
 #
 # Most make variables should not be defined in this file.  Instead, they
 # should be defined in the kern.pre.mk so that port makefiles can
 # override or augment them.
 
 .if defined(DTS) || defined(DTSO) || defined(FDT_DTS_FILE)
 .include "dtb.build.mk"
 
 KERNEL_EXTRA+=	${DTB} ${DTBO}
 CLEAN+=		${DTB} ${DTBO}
 
 kernel-install: _dtbinstall
 .ORDER: beforeinstall _dtbinstall
 .endif
 
 # In case the config had a makeoptions DESTDIR...
 .if defined(DESTDIR)
 MKMODULESENV+=	DESTDIR="${DESTDIR}"
 .endif
 SYSDIR?= ${S:C;^[^/];${.CURDIR}/&;:tA}
 MKMODULESENV+=	KERNBUILDDIR="${.CURDIR}" SYSDIR="${SYSDIR}"
 MKMODULESENV+=  MODULE_TIED=yes
 
 .if defined(CONF_CFLAGS)
 MKMODULESENV+=	CONF_CFLAGS="${CONF_CFLAGS}"
 .endif
 
 .if defined(WITH_CTF)
 MKMODULESENV+=	WITH_CTF="${WITH_CTF}"
 .endif
 
 .if !empty(KCSAN_ENABLED)
 MKMODULESENV+=	KCSAN_ENABLED="yes"
 .endif
 
 .if defined(SAN_CFLAGS)
 MKMODULESENV+=	SAN_CFLAGS="${SAN_CFLAGS}"
 .endif
 
 .if defined(GCOV_CFLAGS)
 MKMODULESENV+=	GCOV_CFLAGS="${GCOV_CFLAGS}"
 .endif
 
 .if !empty(COMPAT_FREEBSD32_ENABLED)
 MKMODULESENV+=	COMPAT_FREEBSD32_ENABLED="yes"
 .endif
 
 # Allow overriding the kernel debug directory, so kernel and user debug may be
 # installed in different directories. Setting it to "" restores the historical
 # behavior of installing debug files in the kernel directory.
 KERN_DEBUGDIR?=	${DEBUGDIR}
 
 .MAIN: all
 
 .if !defined(NO_MODULES)
 # Default prefix used for modules installed from ports
 LOCALBASE?=	/usr/local
 
 LOCAL_MODULES_DIR?= ${LOCALBASE}/sys/modules
 
 # Default to installing all modules installed by ports unless overridden
 # by the user.
 .if !defined(LOCAL_MODULES) && exists(${LOCAL_MODULES_DIR})
 LOCAL_MODULES!= ls ${LOCAL_MODULES_DIR}
 .endif
 .endif
 
 .for target in all clean cleandepend cleandir clobber depend install \
     ${_obj} reinstall tags
 ${target}: kernel-${target}
 .if !defined(NO_MODULES)
 ${target}: modules-${target}
 modules-${target}:
 .if !defined(MODULES_WITH_WORLD) && exists($S/modules)
 	cd $S/modules; ${MKMODULESENV} ${MAKE} \
 	    ${target:S/^reinstall$/install/:S/^clobber$/cleandir/}
 .endif
 .for module in ${LOCAL_MODULES}
 	@${ECHODIR} "===> ${module} (${target:S/^reinstall$/install/:S/^clobber$/cleandir/})"
 	@cd ${LOCAL_MODULES_DIR}/${module}; ${MKMODULESENV} ${MAKE} \
 	    DIRPRFX="${module}/" \
 	    ${target:S/^reinstall$/install/:S/^clobber$/cleandir/}
 .endfor
 .endif
 .endfor
 
 # Handle ports (as defined by the user) that build kernel modules
 .if !defined(NO_MODULES) && defined(PORTS_MODULES)
 #
 # The ports tree needs some environment variables defined to match the new kernel
 #
 # SRC_BASE is how the ports tree refers to the location of the base source files
 .if !defined(SRC_BASE)
 SRC_BASE=	${SYSDIR:H:tA}
 .endif
 # OSVERSION is used by some ports to determine build options
 .if !defined(OSRELDATE)
 # Definition copied from src/Makefile.inc1
 OSRELDATE!=	awk '/^\#define[[:space:]]*__FreeBSD_version/ { print $$3 }' \
 		    ${MAKEOBJDIRPREFIX}${SRC_BASE}/include/osreldate.h
 .endif
 # Keep the related ports builds in the obj directory so that they are only rebuilt once per kernel build
 #
 # Ports search for some dependencies in PATH, so add the location of the
 # installed files
 WRKDIRPREFIX?=	${.OBJDIR}
 PORTSMODULESENV=\
 	env \
 	-u CC \
 	-u CXX \
 	-u CPP \
 	-u MAKESYSPATH \
 	-u MK_AUTO_OBJ \
 	-u MAKEOBJDIR \
 	MAKEFLAGS="${MAKEFLAGS:M*:tW:S/^-m /-m_/g:S/ -m / -m_/g:tw:N-m_*:NMK_AUTO_OBJ=*}" \
 	SYSDIR=${SYSDIR} \
 	PATH=${PATH}:${LOCALBASE}/bin:${LOCALBASE}/sbin \
 	SRC_BASE=${SRC_BASE} \
 	OSVERSION=${OSRELDATE} \
 	WRKDIRPREFIX=${WRKDIRPREFIX}
 
 # The WRKDIR needs to be cleaned before building, and trying to change the target
 # with a :C pattern below results in install -> instclean
 all:
 .for __i in ${PORTS_MODULES}
 	@${ECHO} "===> Ports module ${__i} (all)"
 	cd ${PORTSDIR:U/usr/ports}/${__i}; ${PORTSMODULESENV} ${MAKE} -B clean build
 .endfor
 
 .for __target in install reinstall clean
 ${__target}: ports-${__target}
 ports-${__target}:
 .for __i in ${PORTS_MODULES}
 	@${ECHO} "===> Ports module ${__i} (${__target})"
 	cd ${PORTSDIR:U/usr/ports}/${__i}; ${PORTSMODULESENV} ${MAKE} -B ${__target:C/(re)?install/deinstall reinstall/}
 .endfor
 .endfor
 .endif
 
 .ORDER: kernel-install modules-install
 
 beforebuild: .PHONY
 kernel-all: beforebuild .WAIT ${KERNEL_KO} ${KERNEL_EXTRA}
 
 kernel-cleandir: kernel-clean kernel-cleandepend
 
 kernel-clobber:
 	find . -maxdepth 1 ! -type d ! -name version -delete
 
 kernel-obj:
 
 .if !defined(NO_MODULES)
 modules: modules-all
 modules-depend: beforebuild
 modules-all: beforebuild
 
 .if !defined(NO_MODULES_OBJ)
 modules-all modules-depend: modules-obj
 .endif
 .endif
 
 .if !defined(DEBUG)
 FULLKERNEL=	${KERNEL_KO}
 .else
 FULLKERNEL=	${KERNEL_KO}.full
 ${KERNEL_KO}: ${FULLKERNEL} ${KERNEL_KO}.debug
 	${OBJCOPY} --strip-debug --add-gnu-debuglink=${KERNEL_KO}.debug \
 	    ${FULLKERNEL} ${.TARGET}
 ${KERNEL_KO}.debug: ${FULLKERNEL}
 	${OBJCOPY} --only-keep-debug ${FULLKERNEL} ${.TARGET}
 install.debug reinstall.debug: gdbinit
 	cd ${.CURDIR}; ${MAKE} ${.TARGET:R}
 
 # Install gdbinit files for kernel debugging.
 gdbinit:
 	grep -v '# XXX' ${S}/../tools/debugscripts/dot.gdbinit | \
 	    sed "s:MODPATH:${.OBJDIR}/modules:" > .gdbinit
 	cp ${S}/../tools/debugscripts/gdbinit.kernel ${.CURDIR}
 .if exists(${S}/../tools/debugscripts/gdbinit.${MACHINE_CPUARCH})
 	cp ${S}/../tools/debugscripts/gdbinit.${MACHINE_CPUARCH} \
 	    ${.CURDIR}/gdbinit.machine
 .endif
 .endif
 
 ${FULLKERNEL}: ${SYSTEM_DEP} vers.o
 	@rm -f ${.TARGET}
 	@echo linking ${.TARGET}
 	${SYSTEM_LD}
 .if !empty(MD_ROOT_SIZE_CONFIGURED) && defined(MFS_IMAGE)
 	@sh ${S}/tools/embed_mfs.sh ${.TARGET} ${MFS_IMAGE}
 .endif
 .if ${MK_CTF} != "no"
 	@echo ${CTFMERGE} ${CTFFLAGS} -o ${.TARGET} ...
 	@${CTFMERGE} ${CTFFLAGS} -o ${.TARGET} ${SYSTEM_OBJS} vers.o
 .endif
 .if !defined(DEBUG)
 	${OBJCOPY} --strip-debug ${.TARGET}
 .endif
 	${SYSTEM_LD_TAIL}
 
 OBJS_DEPEND_GUESS+=	offset.inc assym.inc vnode_if.h ${BEFORE_DEPEND:M*.h} \
 			${MFILES:T:S/.m$/.h/}
 
 .for mfile in ${MFILES}
 # XXX the low quality .m.o rules gnerated by config are normally used
 # instead of the .m.c rules here.
 ${mfile:T:S/.m$/.c/}: ${mfile}
 	${AWK} -f $S/tools/makeobjops.awk ${mfile} -c
 ${mfile:T:S/.m$/.h/}: ${mfile}
 	${AWK} -f $S/tools/makeobjops.awk ${mfile} -h
 .endfor
 
 kernel-clean:
 	rm -f *.o *.so *.pico *.ko *.s eddep errs \
 	    ${FULLKERNEL} ${KERNEL_KO} ${KERNEL_KO}.debug \
 	    tags vers.c \
 	    vnode_if.c vnode_if.h vnode_if_newproto.h vnode_if_typedef.h \
 	    ${MFILES:T:S/.m$/.c/} ${MFILES:T:S/.m$/.h/} \
 	    ${CLEAN}
 
 # This is a hack.  BFD "optimizes" away dynamic mode if there are no
 # dynamic references.  We could probably do a '-Bforcedynamic' mode like
 # in the a.out ld.  For now, this works.
 force-dynamic-hack.c:
 	:> ${.TARGET}
 
 force-dynamic-hack.pico: force-dynamic-hack.c Makefile
 	${CC} ${CCLDFLAGS} -shared ${CFLAGS} -nostdlib \
 	    force-dynamic-hack.c -o ${.TARGET}
 
 offset.inc: $S/kern/genoffset.sh genoffset.o
 	NM='${NM}' NMFLAGS='${NMFLAGS}' sh $S/kern/genoffset.sh genoffset.o > ${.TARGET}
 
 genoffset.o: $S/kern/genoffset.c
 	${CC} -c ${CFLAGS:N-flto:N-fno-common} -fcommon $S/kern/genoffset.c
 
 # genoffset_test.o is not actually used for anything - the point of compiling it
 # is to exercise the CTASSERT that checks that the offsets in the offset.inc
 # _lite struct(s) match those in the original(s). 
 genoffset_test.o: $S/kern/genoffset.c offset.inc
 	${CC} -c ${CFLAGS:N-flto:N-fno-common} -fcommon -DOFFSET_TEST \
 	    $S/kern/genoffset.c -o ${.TARGET}
 
 assym.inc: $S/kern/genassym.sh genassym.o genoffset_test.o
 	NM='${NM}' NMFLAGS='${NMFLAGS}' sh $S/kern/genassym.sh genassym.o > ${.TARGET}
 
 genassym.o: $S/$M/$M/genassym.c  offset.inc
 	${CC} -c ${CFLAGS:N-flto:N-fno-common} -fcommon $S/$M/$M/genassym.c
 
 OBJS_DEPEND_GUESS+= opt_global.h
 genoffset.o genassym.o vers.o: opt_global.h
 
 .if !empty(.MAKE.MODE:Unormal:Mmeta) && empty(.MAKE.MODE:Unormal:Mnofilemon)
 _meta_filemon=	1
 .endif
 .if ${MK_DIRDEPS_BUILD} == "no"
 # Skip reading .depend when not needed to speed up tree-walks and simple
 # lookups.  For install, only do this if no other targets are specified.
 # Also skip generating or including .depend.* files if in meta+filemon mode
 # since it will track dependencies itself.  OBJS_DEPEND_GUESS is still used
 # for _meta_filemon but not for _SKIP_DEPEND.
 .if !defined(NO_SKIP_DEPEND) && \
     ((!empty(.MAKEFLAGS:M-V) && empty(.MAKEFLAGS:M*DEP*)) || \
     ${.TARGETS:M*obj} == ${.TARGETS} || \
     ${.TARGETS:M*clean*} == ${.TARGETS} || \
     ${.TARGETS:M*install*} == ${.TARGETS})
 _SKIP_DEPEND=	1
 .endif
 .if defined(_SKIP_DEPEND) || defined(_meta_filemon)
 .MAKE.DEPENDFILE=	/dev/null
 .endif
 .endif
 
 kernel-depend: .depend
 SRCS=	assym.inc offset.inc vnode_if.h ${BEFORE_DEPEND} ${CFILES} \
 	${SYSTEM_CFILES} ${GEN_CFILES} ${SFILES} \
 	${MFILES:T:S/.m$/.h/}
 DEPENDOBJS+=	${SYSTEM_OBJS} genassym.o genoffset.o genoffset_test.o
 DEPENDOBJS+=	${CLEAN:M*.o}
 DEPENDFILES=	${DEPENDOBJS:O:u:C/^/.depend./}
 .if ${MAKE_VERSION} < 20160220
 DEPEND_MP?=	-MP
 .endif
 .if defined(_SKIP_DEPEND)
 # Don't bother reading any .meta files
 ${DEPENDOBJS}:	.NOMETA
 .depend:	.NOMETA
 # Unset these to avoid looping/statting on them later.
 .undef DEPENDOBJS
 .undef DEPENDFILES
 .endif	# defined(_SKIP_DEPEND)
 DEPEND_CFLAGS+=	-MD ${DEPEND_MP} -MF.depend.${.TARGET}
 DEPEND_CFLAGS+=	-MT${.TARGET}
 .if !defined(_meta_filemon)
 .if !empty(DEPEND_CFLAGS)
 # Only add in DEPEND_CFLAGS for CFLAGS on files we expect from DEPENDOBJS
 # as those are the only ones we will include.
 DEPEND_CFLAGS_CONDITION= "${DEPENDOBJS:M${.TARGET}}" != ""
 CFLAGS+=	${${DEPEND_CFLAGS_CONDITION}:?${DEPEND_CFLAGS}:}
 .endif
 .for __depend_obj in ${DEPENDFILES}
 .if ${MAKE_VERSION} < 20160220
 .sinclude "${.OBJDIR}/${__depend_obj}"
 .else
 .dinclude "${.OBJDIR}/${__depend_obj}"
 .endif
 .endfor
 .endif	# !defined(_meta_filemon)
 
 # Always run 'make depend' to generate dependencies early and to avoid the
 # need for manually running it.  For the kernel this is mostly a NOP since
 # all dependencies are correctly added or accounted for.  This is mostly to
 # ensure downstream uses of kernel-depend are handled.
 beforebuild: kernel-depend
 
 # Guess some dependencies for when no ${DEPENDFILE}.OBJ is generated yet.
 # For meta+filemon the .meta file is checked for since it is the dependency
 # file used.
 .for __obj in ${DEPENDOBJS:O:u}
 .if defined(_meta_filemon)
 _depfile=	${.OBJDIR}/${__obj}.meta
 .else
 _depfile=	${.OBJDIR}/.depend.${__obj}
 .endif
 .if !exists(${_depfile})
 .if ${SYSTEM_OBJS:M${__obj}}
 ${__obj}: ${OBJS_DEPEND_GUESS}
 .endif
 ${__obj}: ${OBJS_DEPEND_GUESS.${__obj}}
 .elif defined(_meta_filemon)
 # For meta mode we still need to know which file to depend on to avoid
 # ambiguous suffix transformation rules from .PATH.  Meta mode does not
 # use .depend files.  We really only need source files, not headers since
 # they are typically in SRCS/beforebuild already.  For target-specific
 # guesses do include headers though since they may not be in SRCS.
 .if ${SYSTEM_OBJS:M${__obj}}
 ${__obj}: ${OBJS_DEPEND_GUESS:N*.h}
 .endif
 ${__obj}: ${OBJS_DEPEND_GUESS.${__obj}}
 .endif	# !exists(${_depfile})
 .endfor
 
 .NOPATH: .depend ${DEPENDFILES}
 
 .depend: .PRECIOUS ${SRCS}
 
 _ILINKS= machine
 .if ${MACHINE} != ${MACHINE_CPUARCH} && ${MACHINE} != "arm64"
 _ILINKS+= ${MACHINE_CPUARCH}
 .endif
 .if ${MACHINE_CPUARCH} == "i386" || ${MACHINE_CPUARCH} == "amd64"
 _ILINKS+= x86
 .endif
 .if ${MACHINE_CPUARCH} == "amd64"
 _ILINKS+= i386
 .endif
 
 # Ensure that the link exists without depending on it when it exists.
 # Ensure that debug info references the path in the source tree.
 .for _link in ${_ILINKS}
 .if !exists(${.OBJDIR}/${_link})
 ${SRCS} ${DEPENDOBJS}: ${_link}
 .endif
 .if ${_link} == "machine"
 CFLAGS+= -fdebug-prefix-map=./machine=${SYSDIR}/${MACHINE}/include
 .else
 CFLAGS+= -fdebug-prefix-map=./${_link}=${SYSDIR}/${_link}/include
 .endif
 .endfor
 
 ${_ILINKS}:
 	@case ${.TARGET} in \
 	machine) \
 		path=${S}/${MACHINE}/include ;; \
 	*) \
 		path=${S}/${.TARGET}/include ;; \
 	esac ; \
 	${ECHO} ${.TARGET} "->" $$path ; \
 	ln -fns $$path ${.TARGET}
 
 # .depend needs include links so we remove them only together.
 kernel-cleandepend: .PHONY
 	rm -f .depend .depend.* ${_ILINKS}
 
 kernel-tags:
 	@ls .depend.* > /dev/null 2>&1 || \
 	    { echo "you must make all first"; exit 1; }
 	sh $S/conf/systags.sh
 
 kernel-install: .PHONY
 	@if [ ! -f ${KERNEL_KO} ] ; then \
 		echo "You must build a kernel first." ; \
 		exit 1 ; \
 	fi
 .if exists(${DESTDIR}${KODIR})
 	-thiskernel=`sysctl -n kern.bootfile || echo /boot/kernel/kernel` ; \
 	if [ ! "`dirname "$$thiskernel"`" -ef ${DESTDIR}${KODIR} ] ; then \
 		chflags -R noschg ${DESTDIR}${KODIR} ; \
 		rm -rf ${DESTDIR}${KODIR} ; \
 		rm -rf ${DESTDIR}${KERN_DEBUGDIR}${KODIR} ; \
 	else \
 		if [ -d ${DESTDIR}${KODIR}.old ] ; then \
 			chflags -R noschg ${DESTDIR}${KODIR}.old ; \
 			rm -rf ${DESTDIR}${KODIR}.old ; \
 		fi ; \
 		mv ${DESTDIR}${KODIR} ${DESTDIR}${KODIR}.old ; \
 		if [ -n "${KERN_DEBUGDIR}" -a \
 		     -d ${DESTDIR}${KERN_DEBUGDIR}${KODIR} ]; then \
 			rm -rf ${DESTDIR}${KERN_DEBUGDIR}${KODIR}.old ; \
 			mv ${DESTDIR}${KERN_DEBUGDIR}${KODIR} ${DESTDIR}${KERN_DEBUGDIR}${KODIR}.old ; \
 		fi ; \
 		sysctl kern.bootfile=${DESTDIR}${KODIR}.old/"`basename "$$thiskernel"`" ; \
 	fi
 .endif
 	mkdir -p ${DESTDIR}${KODIR}
 	${INSTALL} -p -m 555 -o ${KMODOWN} -g ${KMODGRP} ${KERNEL_KO} ${DESTDIR}${KODIR}/
 .if defined(DEBUG) && !defined(INSTALL_NODEBUG) && ${MK_KERNEL_SYMBOLS} != "no"
 	mkdir -p ${DESTDIR}${KERN_DEBUGDIR}${KODIR}
 	${INSTALL} -p -m 555 -o ${KMODOWN} -g ${KMODGRP} ${KERNEL_KO}.debug ${DESTDIR}${KERN_DEBUGDIR}${KODIR}/
 .endif
 .if defined(KERNEL_EXTRA_INSTALL)
 	${INSTALL} -p -m 555 -o ${KMODOWN} -g ${KMODGRP} ${KERNEL_EXTRA_INSTALL} ${DESTDIR}${KODIR}/
 .endif
 
 
 
 kernel-reinstall:
 	@-chflags -R noschg ${DESTDIR}${KODIR}
 	${INSTALL} -p -m 555 -o ${KMODOWN} -g ${KMODGRP} ${KERNEL_KO} ${DESTDIR}${KODIR}/
 .if defined(DEBUG) && !defined(INSTALL_NODEBUG) && ${MK_KERNEL_SYMBOLS} != "no"
 	${INSTALL} -p -m 555 -o ${KMODOWN} -g ${KMODGRP} ${KERNEL_KO}.debug ${DESTDIR}${KERN_DEBUGDIR}${KODIR}/
 .endif
 
 config.o env.o hints.o vers.o vnode_if.o:
 	${NORMAL_C}
 	${NORMAL_CTFCONVERT}
 
 NEWVERS_ENV+= MAKE="${MAKE}"
 .if ${MK_REPRODUCIBLE_BUILD} != "no"
 NEWVERS_ARGS+= -R
 .endif
 vers.c: .NOMETA_CMP $S/conf/newvers.sh $S/sys/param.h ${SYSTEM_DEP:Nvers.*}
 	${NEWVERS_ENV} sh $S/conf/newvers.sh ${NEWVERS_ARGS} ${KERN_IDENT}
 
 vnode_if.c: $S/tools/vnode_if.awk $S/kern/vnode_if.src
 	${AWK} -f $S/tools/vnode_if.awk $S/kern/vnode_if.src -c
 
 vnode_if.h vnode_if_newproto.h vnode_if_typedef.h: $S/tools/vnode_if.awk \
     $S/kern/vnode_if.src
 vnode_if.h: vnode_if_newproto.h vnode_if_typedef.h
 	${AWK} -f $S/tools/vnode_if.awk $S/kern/vnode_if.src -h
 vnode_if_newproto.h:
 	${AWK} -f $S/tools/vnode_if.awk $S/kern/vnode_if.src -p
 vnode_if_typedef.h:
 	${AWK} -f $S/tools/vnode_if.awk $S/kern/vnode_if.src -q
 
 .if ${MFS_IMAGE:Uno} != "no"
 .if empty(MD_ROOT_SIZE_CONFIGURED)
 embedfs_${MFS_IMAGE:T:R}.o: ${MFS_IMAGE} $S/dev/md/embedfs.S
 	${CC} ${CFLAGS} ${ACFLAGS} -DMFS_IMAGE=\""${MFS_IMAGE}"\" -c \
 	    $S/dev/md/embedfs.S -o ${.TARGET}
 .endif
 .endif
 
+# Generate the .bin (booti images) kernel as an extra build output.
+# The targets and rules to generate these appear in Makefile.$MACHINE
+# if the platform supports it.
+.if ${MK_KERNEL_BIN} != "no"
+KERNEL_EXTRA+= ${KERNEL_KO}.bin
+KERNEL_EXTRA_INSTALL+= ${KERNEL_KO}.bin
+CLEAN+=	${KERNEL_KO}.bin
+.endif
+
 .include "kern.mk"
diff --git a/tools/build/options/WITH_KERNEL_BIN b/tools/build/options/WITH_KERNEL_BIN
new file mode 100644
index 000000000000..b5e008dbd6f0
--- /dev/null
+++ b/tools/build/options/WITH_KERNEL_BIN
@@ -0,0 +1,8 @@
+Generate and install kernel.bin from kernel as part of the normal build and
+install processes for the kernel. Available only on arm and arm64.
+
+Usually this will be added to the kernel config file with:
+
+makeoptions	WITH_KERNEL_BIN=1
+
+though it can also be used on the command line.