klinfix: Initial add

Infix integration of klish and klish-plugin-sysrepo.

.github/CODE-OF-CONDUCT.md

@@ -0,0 +1,45 @@
+Contributor Code of Conduct
+===========================
+
+As contributors and maintainers of this project, and in the interest of
+fostering an open and welcoming community, we pledge to respect all
+people who contribute through reporting issues, posting feature
+requests, updating documentation, submitting pull requests or patches,
+and other activities.
+
+We are committed to making participation in this project a
+harassment-free experience for everyone, regardless of level of
+experience, gender, gender identity and expression, sexual orientation,
+disability, personal appearance, body size, race, ethnicity, age,
+religion, or nationality.
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery
+* Personal attacks
+* Trolling or insulting/derogatory comments
+* Public or private harassment
+* Publishing other's private information, such as physical or electronic
+  addresses, without explicit permission
+* Other unethical or unprofessional conduct.
+
+Project maintainers have the right and responsibility to remove, edit,
+or reject comments, commits, code, wiki edits, issues, and other
+contributions that are not aligned to this Code of Conduct. By adopting
+this Code of Conduct, project maintainers commit themselves to fairly
+and consistently applying these principles to every aspect of managing
+this project. Project maintainers who do not follow or enforce the Code
+of Conduct may be permanently removed from the project team.
+
+This code of conduct applies both within project spaces and in public
+spaces when an individual is representing the project or its community.
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may
+be reported by opening an issue or contacting one or more of the project
+maintainers.
+
+This Code of Conduct is adapted from the [Contributor Covenant][1],
+[version 1.2.0][2].
+
+[1]: http://contributor-covenant.org
+[2]: http://contributor-covenant.org/version/1/2/0/

.github/CONTRIBUTING.md

@@ -0,0 +1,78 @@
+Contributing to Infix
+=====================
+
+We welcome any and all help in the form of bug reports, fixes, patches
+to add new features -- *preferably as GitHub pull requests*.  Other
+methods are of course also possible: emailing the [maintainers][] a
+patch or even a raw file, a feature request or an alert of a problem.
+
+If you are unsure of what to do, or how to implement an idea or bugfix,
+open an issue with `"[RFC: Unsure if this is a bug ... ?"`, or use the
+GitHub discussions forum, so we can discuss it.  Talking about the code
+first is the best way to get started before submitting a pull request.
+
+Either way, when sending an email, patch, or pull request, start by
+stating the version the change is made against, what it does, and why.
+
+Please take care to ensure you follow the project coding style and the
+commit message format.  If you follow these recommendations you help
+the maintainer(s) and make it easier for them to include your code.
+
+
+Coding Style
+------------
+
+> **Tip:** Always submit code that follows the style of surrounding code!
+
+First of all, lines are allowed to be longer than 72 characters these
+days.  In fact, there exist no enforced maximum, but keeping it around
+100 chars is OK.
+
+The coding style itself is otherwise strictly Linux [KNF][].
+
+
+Commit Messages
+---------------
+
+Commit messages exist to track *why* a change was made.  Try to be as
+clear and concise as possible in your commit messages, and always, be
+proud of your work and set up a proper GIT identity for your commits:
+
+    git config --global user.name "Jane Doe"
+    git config --global user.email jane.doe@example.com
+
+Example commit message from the [Pro Git][gitbook] online book, notice
+how `git commit -s` is used to automatically add a `Signed-off-by`:
+
+    Brief, but clear and concise summary of changes
+    
+    More detailed explanatory text, if necessary.  Wrap it to about 72
+    characters or so.  In some contexts, the first line is treated as
+    the subject of an email and the rest of the text as the body.  The
+    blank line separating the ummary from the body is critical (unless
+    you omit the body entirely); tools like rebase can get confused if
+    you run the two together.
+    
+    Further paragraphs come after blank lines.
+    
+     - Bullet points are okay, too
+    
+     - Typically a hyphen or asterisk is used for the bullet, preceded
+       by a single space, with blank lines in between, but conventions
+       vary here
+    
+    Signed-off-by: Jane Doe <jane.doe@example.com>
+
+
+Code of Conduct
+---------------
+
+It is expected of everyone to respect the [Code of Conduct][conduct].
+The *"maintainers have the right and responsibility to remove, edit,
+or reject comments, commits, code, wiki edits, issues, and other
+contributions that are not aligned to this Code of Conduct."*
+
+[1]:        ../doc/MAINTAINERS
+[KNF]:      https://en.wikipedia.org/wiki/Kernel_Normal_Form
+[gitbook]:  https://git-scm.com/book/ch5-2.html
+[conduct]:  CODE-OF-CONDUCT.md

.github/workflows/build.yml

@@ -0,0 +1,79 @@
+name: Bob the Builder
+
+#on:
+#  push:
+#    branches:
+#      - '*'
+#  pull_request:
+#    branches:
+#      - '*'
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build ${{ matrix.platform }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        platform: [aarch64, amd64]
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set Build Variables
+        id: vars
+        run: |
+          echo "dir=infix-${{ matrix.platform }}"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-${{ matrix.platform }}.tar.gz" >> $GITHUB_OUTPUT
+      - name: Restore Cache of dl/
+        uses: actions/cache@v3
+        with:
+          path: dl/
+          key: dl-${{ matrix.platform }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-${{ matrix.platform }}-
+            dl-
+      - name: Restore Cache of .ccache/
+        uses: actions/cache@v3
+        with:
+          path: .buildroot-ccache/
+          key: ccache-${{ matrix.board }}-os-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-${{ matrix.board }}-os-
+            ccache-${{ matrix.board }}-
+            ccache--os-
+      - name: Configure & Build
+        run: |
+          make ${{ matrix.platform }}_defconfig
+          make
+      - name: Prepare Artifact
+        run: |
+          cd output
+          mv images ${{ steps.vars.outputs.dir }}
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          ls -l
+          ls -l ${{ steps.vars.outputs.dir }}
+      - uses: actions/upload-artifact@v3
+        with:
+          path: output/${{ steps.vars.outputs.tgz }}
+  release:
+    name: Upload Latest Build
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v3
+      - uses: pyTooling/Actions/releaser@main
+        with:
+          tag: latest
+          rm: true
+          token: ${{ secrets.GITHUB_TOKEN }}
+          files: artifact/*
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Latest Build Complete! :rocket:
+          
+          For the public download links of these build artifacts, please see:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+          EOF

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "buildroot"]
 	path = buildroot
-	url = https://github.com/buildroot/buildroot.git
+	url = ../buildroot.git

COPYING

@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

Config.in

@@ -0,0 +1,13 @@
+menu "Packages"
+
+source "$BR2_EXTERNAL_INFIX_PATH/package/Config.in"
+
+endmenu
+
+menu "QEMU Virtualization"
+
+source "$BR2_EXTERNAL_INFIX_PATH/qemu/Config.in"
+
+endmenu
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/Config.in"

Makefile

@@ -13,18 +13,16 @@ all: $(config) buildroot/Makefile
 
 $(config):
 	@+$(call bmake,list-defconfigs)
-	@echo "ERROR: No configuration selected."
+	@echo "\e[7mERROR: No configuration selected.\e[0m"
 	@echo "Please choose a configuration from the list above by running"
 	@echo "'make <board>_defconfig' before building an image."
 	@exit 1
 
-%: buildroot/Makefile
+
+%: | buildroot/Makefile
 	@+$(call bmake,$@)
 
 buildroot/Makefile:
 	@git submodule update --init
 
-run:
-	@echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
-	@(cd $(O)/images && ./qemu.sh)
-
+.PHONY: all

README.md

@@ -0,0 +1,129 @@
+<img align="right" src="doc/text3134.png" alt="Infix Linux Networking Made Easy">
+
+* [Introduction](#introduction)
+* [Hardware](#hardware)
+* [Qemu](#qemu)
+* [GNS3](#gns3)
+* [Building](#building)
+* [Origin & Licensing](origin--licensing)
+
+
+Introduction
+------------
+
+Infix is an embedded Linux Network Operating System (NOS) based on
+[Buildroot][1], [Finit][2], [ifupdown-ng][3], and [Clixon][6].
+Providing an easy-to-maintain and easy-to-port Open Source base for
+networked equipment.
+
+See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
+page for out pre-built images.  The *Latest Build* has the bleeding edge
+images, if possible we recommend using a versioned release.
+
+> Login with user 'root', no password by default on plain builds.  See
+> the online `help` command for an introduction to the system.
+
+
+Hardware
+--------
+
+### aarch64
+
+By default, Infix builds with support for the following boards (you
+may enable additional boards in the config, of course):
+
+- Marvell CN9130 CRB
+- Marvell EspressoBIN
+- Microchip SparX-5i PCB135 (eMMC)
+
+See the aarch64 specific [documentation](board/aarch64/README.md) for more
+information.
+
+### amd64
+
+Primarily intended to be run under [QEMU][] for development & test as
+well as evaluation, demo and [training][] purposes, e.g. using [GNS3][]
+or [Qeneth][7].
+
+
+QEMU
+----
+
+A virtualized instance can easily be launched from a Linux system, with
+Qemu installed, by issuing `make run`.
+
+Some settings, e.g. networking, can be configured via `make menuconfig`
+under `External options -> QEMU virtualization`.
+
+
+GNS3
+----
+
+Download the [latest build][0] of amd64, unpack in a dedicated directory
+and use ["Import Appliance"][9] to install the `.gns3a` file into GNS3.
+Infix will show up in the "Router" category, it has 10 interfaces
+available by default for use as switch ports or routing.
+
+
+Building
+--------
+
+Buildroot is almost stand-alone, but need a few locally installed tools
+to bootstrap itself.  For details, see the [excellent manual][manual].
+Briefly, to build an Infix image; select the target and then make:
+
+    make amd64_defconfig
+    make
+
+Online help is available:
+
+    make help
+
+To see available defconfigs for supported targets, use:
+
+    make list-defconfigs
+
+> **Note:** build dependencies (Debian/Ubuntu): <kbd>sudo apt install make libssl-dev</kbd>
+
+
+Origin & Licensing
+------------------
+
+Infix is entirely built on Open Source components (packages).  Most of
+them, as well as the build system with its helper scripts and tools, is
+from [Buiildroot][1], which is distributed under the terms of the GNU
+General Public License (GPL).  See the file COPYING for details.
+
+Some files in Buildroot contain a different license statement.  Those
+files are licensed under the license contained in the file itself.
+
+Buildroot and Infix also bundle patch files, which are applied to the
+sources of the various packages.  Those patches are not covered by the
+license of Buildroot or Infix.  Instead, they are covered by the license
+of the software to which the patches are applied.  When said software is
+available under multiple licenses, the patches are only provided under
+the publicly accessible licenses.
+
+Infix releases include the license information covering all Open Source
+packages.  This is extracted automatically at build time using the tool
+`make legal-info`.  Any proprietary software built on top of Infix, or
+Buildroot, would need separate auditing to ensure it does not link with
+any GPL[^1] licensed library.
+
+[^1]: Infix image builds use GNU libc (GLIBC) which is covered by the
+	[LGPL][4].  The LGPL *does allow* proprietary software, as long as
+	said software is linking dynamically, [not statically][5], to GLIBC.
+
+[0]: https://github.com/kernelkit/infix/releases/tag/latest
+[1]: https://buildroot.org/
+[2]: https://github.com/troglobit/finit
+[3]: https://github.com/ifupdown-ng/ifupdown-ng
+[4]: https://en.wikipedia.org/wiki/GNU_Lesser_General_Public_License
+[5]: https://lwn.net/Articles/117972/
+[6]: https://github.com/clicon/clixon
+[7]: https://github.com/wkz/qeneth
+[9]: https://docs.gns3.com/docs/using-gns3/beginners/import-gns3-appliance/
+[QEMU]: https://www.qemu.org/
+[GNS3]: https://gns3.com/
+[training]: https://addiva-elektronik.github.io/
+[manual]: https://buildroot.org/downloads/manual/manual.html

TODO.org

@@ -0,0 +1,22 @@
+* TODO doc: User Guide
+
+- Feature set and scope, e.g.
+  - Device discovery: SSDP, LLDP, mDNS-SD how do they work, interfacing with Windows/macOS/Linux
+  - Network redundancy protocols: STP/RSTP, MRP
+- Configuring the system; using ifupdown2, enabling/disabling services
+- Diagnosing the system; using rmon, port mirroring, debugging services, searching logs
+- Limitations, e.g., PRP/HSR or IEEE 802.1CB will not be possible to support
+- Tips & Trix
+
+* TODO document how to set up passwordless SSH
+* TODO add setup wizard, based on pdmenu
+
+ - setup-port script to tweak ethtool settings
+ - setup-iface script to configure a layer-3 interface
+ - setup-bridge script that creates a new bridge with config from cmdline
+ - setup-firewall script that can do basic firewall rules and masquerading
+
+* TODO split out qemu Config.in to a "make run-menuconfing"
+* TODO rename qemu/ to run/, perhaps?
+* TODO ship qemu/* with output/images/ for stand-alone runs of older builds
+

board/aarch64/README.md

@@ -0,0 +1,67 @@
+aarch64
+=======
+
+Microchip SparX-5i PCB135 (eMMC)
+--------------------------------
+
+At present, only FIT images are supported via the SparX-5i eval
+board's U-Boot, which must contain a valid load address. If you are
+using this board, after selecting your base configuration, run the
+following command to supplement the existing config with the required
+FIT options:
+
+    make board-enable-sparx-fit
+
+### Unbricking
+
+1. Don't load a corrupt bootloader to begin with
+2. Done
+
+If, for some reason, you didn't manage to follow step 1, you can use
+the `FLASH_PROG`(`J4`) connector on the board to access the SPI flash
+directly.
+
+Using a [Bus Blaster][BB3] in combination with [dangerspi][dangerspi],
+you can load a new bootloader. The schematic below details how to
+connect the Bus Blaster to the board, but the concept should be
+portable to any debugger/device based around an FTDI2232 chip.
+
+```
+Bus Blaster:         FLASH_PROG (J4):
+       .---.              .---.
+   VTG >o o| VTG      SCK >o o| GND
+  TRST |o o| GND     MISO |o o| #RESET_FLASH
+   TDI |o o| GND           o o| 3V3
+   TMS |o o| GND      #CS |o o| #SYSRESET
+   TCK  o o| GND     MOSI |o o| GND
+  RTCK  o o| GND          '---'
+   TDO |o o| GND
+ TSRST |o o| GND
+ DBGRQ |o o| GND
+DBGACK |o o| GND
+       '---'
+```
+
+| Bus Blaster | FLASH_PROG     |
+|-------------|----------------|
+| `VTG`       | `3V3`          |
+| `GND`       | `GND`          |
+|             |                |
+| `VTG`       | `#RESET_FLASH` |
+| `GND`       | `#SYSRESET`    |
+|             |                |
+| `TDI`       | `MOSI`         |
+| `TMS`       | `#CS`          |
+| `TCK`       | `SCK`          |
+| `TDO`       | `MISO`         |
+
+With the cable in place, build U-Boot with the correct configuration:
+
+    make fireant_boot_defconfig && make
+
+To flash it to the board, connect the cable to `J4` and run:
+
+    make board-sparx-flash-uboot
+
+[BB3]: http://dangerousprototypes.com/docs/Bus_Blaster#Bus_Blaster_v3
+[dangerspi]: https://github.com/wkz/dangerspi

board/aarch64/board.mk

@@ -0,0 +1,37 @@
+
+.PHONY: board-enable-qemu-uboot
+board-enable-qemu-uboot:
+	@$(call IXMSG,"Enabling build of QEMU compatible U-Boot")
+	./utils/config --file $(BR2_CONFIG) \
+		--enable PACKAGE_HOST_UBOOT_TOOLS \
+		--enable PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT \
+		--enable PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT \
+		--enable TARGET_UBOOT \
+		--enable TARGET_UBOOT_BUILD_SYSTEM_KCONFIG \
+		--enable TARGET_UBOOT_CUSTOM_VERSION \
+		--set-str TARGET_UBOOT_CUSTOM_VERSION_VALUE \
+			"2023.04-rc2" \
+		--set-str TARGET_UBOOT_PATCH \
+			'$$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/patches' \
+	 	--set-str TARGET_UBOOT_BOARD_DEFCONFIG \
+			"qemu_arm64" \
+		--set-str TARGET_UBOOT_CONFIG_FRAGMENT_FILES \
+			'$$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config' \
+		--enable TARGET_UBOOT_FORMAT_DTB
+
+.PHONY: board-enable-sparx-fit
+board-enable-sparx-fit:
+	@$(call IXMSG,"Enabling SparX-5i compatible FIT options")
+	@BR2_PREFIX= ./utils/config --file $(BR2_CONFIG) \
+	 	--enable FIT_IMAGE \
+	 	--set-str FIT_KERNEL_LOAD_ADDR "0x7 0x00000000"
+
+.PHONY: board-sparx-flash-uboot
+board-sparx-flash-uboot: $(BINARIES_DIR)/u-boot.bin
+	@grep -q 'BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mscc_fireant_pcb135_emmc"' $(BR2_CONFIG) || \
+		{ echo Build tree does not seem to be configured for SparX-5i eval board; exit 1; }
+	@echo Erasing...
+	@dangerspi.py erase 0 0x100000
+	@echo Programming...
+	@dangerspi.py write 0 0x100000 <$<
+	@echo Done...

board/aarch64/boot.script

@@ -0,0 +1,7 @@
+blkmap get boot dev devnum
+load blkmap ${devnum} ${kernel_addr_r} /boot/Image
+#TODO: LOAD FDT
+
+setenv bootargs "${bootargs_root} ${bootargs_rauc} ${bootargs_log}"
+
+booti ${kernel_addr_r} ${ramdisk} ${fdt_addr}

board/aarch64/dts/microchip/sparx5_pcb135_emmc_no_psci.dts

@@ -0,0 +1,22 @@
+/* Upstream device trees specify regular PSCI support for SparX-5i,
+ * but the U-Boot that Microchip ships does not actually support it.
+ * Therefore, wrap the upstream version to disable PSCI and revert to
+ * spin tables for SMP bringup.
+ */
+
+/dts-v1/;
+#include "microchip/sparx5_pcb135_emmc.dts"
+
+&cpu0 {
+	enable-method = "spin-table";
+	cpu-release-addr = <0x0 0x0000fff8>;
+};
+
+&cpu1 {
+	enable-method = "spin-table";
+	cpu-release-addr = <0x0 0x0000fff8>;
+};
+
+/ {
+	/delete-node/ psci;
+};

board/aarch64/espressobin/genimage.cfg

@@ -0,0 +1,25 @@
+image cfg.ext4 {
+	ext4 {
+		label = "cfg"
+	}
+	empty = true
+	size = 16M
+}
+
+image sdcard.img {
+	hdimage {
+	}
+
+	partition rootfs {
+		partition-type = 0x83
+		image = "rootfs.ext4"
+	}
+
+	partition cfg {
+		partition-type = 0x83
+		image = "cfg.ext4"
+	}
+}
+
+# Silence genimage warnings
+config {}

board/aarch64/linux_defconfig

@@ -0,0 +1,459 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_SMP=y
+CONFIG_ARCH_SPARX5=y
+CONFIG_ARCH_MVEBU=y
+CONFIG_ARCH_VEXPRESS=y
+CONFIG_ARM64_VA_BITS_48=y
+CONFIG_SCHED_MC=y
+CONFIG_NR_CPUS=64
+CONFIG_COMPAT=y
+# CONFIG_SUSPEND is not set
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
+CONFIG_ARM_ARMADA_8K_CPUFREQ=y
+CONFIG_ACPI=y
+CONFIG_ARM64_CRYPTO=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+# CONFIG_GCC_PLUGINS is not set
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_KSM=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CMA=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_NET_IPIP=y
+CONFIG_NET_IPGRE_DEMUX=y
+CONFIG_NET_IPGRE=y
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_NET_IPVTI=y
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETFILTER=y
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_NF_LOG_IPV6=m
+CONFIG_BRIDGE=y
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_BRIDGE_MRP=y
+CONFIG_BRIDGE_CFM=y
+CONFIG_NET_DSA=y
+CONFIG_VLAN_8021Q=y
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_L3_MASTER_DEV=y
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_AARDVARK=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_ARMADA_8K=y
+CONFIG_UEVENT_HELPER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_FW_CFG_SYSFS=y
+CONFIG_FW_CFG_SYSFS_CMDLINE=y
+CONFIG_MTD=y
+CONFIG_MTD_BLOCK=y
+CONFIG_MTD_BLOCK2MTD=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_NAND_MARVELL=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_OF_OVERLAY=y
+CONFIG_BLK_DEV_NULL_BLK=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_NVME=y
+CONFIG_SRAM=y
+CONFIG_EEPROM_AT24=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_SCSI_SAS_LIBSAS=y
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_VIRTIO=y
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_MVEBU=y
+CONFIG_PATA_PLATFORM=y
+CONFIG_PATA_OF_PLATFORM=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_INIT=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=y
+CONFIG_DUMMY=y
+CONFIG_NET_TEAM=y
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=y
+CONFIG_NET_TEAM_MODE_LOADBALANCE=y
+CONFIG_MACVLAN=y
+CONFIG_MACVTAP=y
+CONFIG_IPVLAN=y
+CONFIG_IPVTAP=y
+CONFIG_VXLAN=y
+CONFIG_GENEVE=y
+CONFIG_BAREUDP=y
+CONFIG_MACSEC=y
+CONFIG_TUN=y
+CONFIG_VETH=y
+CONFIG_VIRTIO_NET=y
+CONFIG_NLMON=y
+CONFIG_NET_VRF=y
+CONFIG_NET_DSA_MV88E6XXX=y
+CONFIG_NET_DSA_MV88E6XXX_PTP=y
+# CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_NET_VENDOR_ADAPTEC is not set
+# CONFIG_NET_VENDOR_AGERE is not set
+# CONFIG_NET_VENDOR_ALACRITECH is not set
+# CONFIG_NET_VENDOR_ALTEON is not set
+# CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AMD is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
+# CONFIG_NET_VENDOR_ARC is not set
+# CONFIG_NET_VENDOR_ATHEROS is not set
+# CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_VENDOR_CADENCE is not set
+# CONFIG_NET_VENDOR_CAVIUM is not set
+# CONFIG_NET_VENDOR_CHELSIO is not set
+# CONFIG_NET_VENDOR_CISCO is not set
+# CONFIG_NET_VENDOR_CORTINA is not set
+# CONFIG_NET_VENDOR_DEC is not set
+# CONFIG_NET_VENDOR_DLINK is not set
+# CONFIG_NET_VENDOR_EMULEX is not set
+# CONFIG_NET_VENDOR_EZCHIP is not set
+# CONFIG_NET_VENDOR_GOOGLE is not set
+# CONFIG_NET_VENDOR_HISILICON is not set
+# CONFIG_NET_VENDOR_HUAWEI is not set
+CONFIG_MVNETA=y
+CONFIG_MVPP2=y
+# CONFIG_NET_VENDOR_MELLANOX is not set
+# CONFIG_NET_VENDOR_MICREL is not set
+CONFIG_SPARX5_SWITCH=y
+# CONFIG_NET_VENDOR_MICROSEMI is not set
+# CONFIG_NET_VENDOR_MYRI is not set
+# CONFIG_NET_VENDOR_NI is not set
+# CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETERION is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
+# CONFIG_NET_VENDOR_NVIDIA is not set
+# CONFIG_NET_VENDOR_OKI is not set
+# CONFIG_NET_VENDOR_PACKET_ENGINES is not set
+# CONFIG_NET_VENDOR_PENSANDO is not set
+# CONFIG_NET_VENDOR_QLOGIC is not set
+# CONFIG_NET_VENDOR_BROCADE is not set
+# CONFIG_NET_VENDOR_QUALCOMM is not set
+# CONFIG_NET_VENDOR_RDC is not set
+CONFIG_8139CP=y
+# CONFIG_NET_VENDOR_RENESAS is not set
+# CONFIG_NET_VENDOR_ROCKER is not set
+# CONFIG_NET_VENDOR_SAMSUNG is not set
+# CONFIG_NET_VENDOR_SEEQ is not set
+# CONFIG_NET_VENDOR_SILAN is not set
+# CONFIG_NET_VENDOR_SIS is not set
+# CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_SOCIONEXT is not set
+# CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SUN is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
+# CONFIG_NET_VENDOR_TEHUTI is not set
+# CONFIG_NET_VENDOR_TI is not set
+# CONFIG_NET_VENDOR_VIA is not set
+# CONFIG_NET_VENDOR_WIZNET is not set
+# CONFIG_NET_VENDOR_XILINX is not set
+CONFIG_SFP=y
+CONFIG_MARVELL_PHY=y
+CONFIG_MARVELL_10G_PHY=y
+CONFIG_MICREL_PHY=y
+CONFIG_MICROCHIP_PHY=y
+CONFIG_MICROCHIP_T1_PHY=y
+CONFIG_MICROSEMI_PHY=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_MVUSB=y
+CONFIG_MDIO_MSCC_MIIM=y
+CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_CDC_EEM=y
+# CONFIG_USB_NET_CDC_NCM is not set
+# CONFIG_USB_NET_NET1080 is not set
+# CONFIG_USB_NET_CDC_SUBSET is not set
+# CONFIG_USB_NET_ZAURUS is not set
+# CONFIG_WLAN is not set
+CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_GPIO=y
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_SERIO_SERPORT is not set
+CONFIG_SERIO_AMBAKMI=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_XILINX_PS_UART=y
+CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
+CONFIG_SERIAL_MVEBU_UART=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_GPIO=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_MUX_PINCTRL=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
+CONFIG_I2C_MV64XXX=y
+CONFIG_I2C_SLAVE=y
+CONFIG_SPI=y
+CONFIG_SPI_ARMADA_3700=y
+CONFIG_SPI_NXP_FLEXSPI=y
+CONFIG_SPI_PL022=y
+CONFIG_SPI_MUX=y
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPMI=y
+CONFIG_PINCTRL_MICROCHIP_SGPIO=y
+CONFIG_PINCTRL_OCELOT=y
+CONFIG_GPIO_DWAPB=y
+CONFIG_GPIO_PL061=y
+CONFIG_GPIO_XGENE=y
+CONFIG_GPIO_PCA953X=y
+CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_GPIO_MAX77620=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_POWER_RESET_XGENE=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_BATTERY_BQ27XXX=y
+CONFIG_CHARGER_GPIO=y
+CONFIG_SENSORS_SPARX5=y
+CONFIG_SENSORS_JC42=y
+CONFIG_SENSORS_LM90=m
+CONFIG_SENSORS_INA2XX=m
+CONFIG_THERMAL_EMULATION=y
+CONFIG_ARMADA_THERMAL=y
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_SYSFS=y
+CONFIG_SOFT_WATCHDOG=y
+CONFIG_ARMADA_37XX_WATCHDOG=y
+CONFIG_I6300ESB_WDT=y
+CONFIG_MFD_MAX77620=y
+CONFIG_MFD_SEC_CORE=y
+CONFIG_MFD_ROHM_BD718XX=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_BD718XX=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_REGULATOR_MAX77620=y
+CONFIG_REGULATOR_PCA9450=y
+CONFIG_REGULATOR_QCOM_SPMI=y
+CONFIG_REGULATOR_S2MPS11=y
+# CONFIG_HID_GENERIC is not set
+# CONFIG_HID_A4TECH is not set
+# CONFIG_HID_APPLE is not set
+# CONFIG_HID_BELKIN is not set
+# CONFIG_HID_CHERRY is not set
+# CONFIG_HID_CHICONY is not set
+# CONFIG_HID_CYPRESS is not set
+# CONFIG_HID_EZKEY is not set
+# CONFIG_HID_KENSINGTON is not set
+# CONFIG_HID_LOGITECH is not set
+# CONFIG_HID_MICROSOFT is not set
+# CONFIG_HID_MONTEREY is not set
+CONFIG_USB=y
+CONFIG_USB_OTG=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_MVEBU=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC2=y
+CONFIG_USB_CHIPIDEA=y
+CONFIG_USB_CHIPIDEA_UDC=y
+CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_ISP1760=y
+CONFIG_USB_HSIC_USB3503=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_USB_ULPI=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_SNP_UDC_PLAT=y
+CONFIG_TYPEC=y
+CONFIG_TYPEC_TCPM=y
+CONFIG_TYPEC_TCPCI=y
+CONFIG_TYPEC_RT1711H=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_OF_SPARX5=y
+CONFIG_MMC_SPI=y
+CONFIG_MMC_DW=y
+CONFIG_MMC_DW_EXYNOS=y
+CONFIG_MMC_DW_K3=y
+CONFIG_MMC_SDHCI_XENON=y
+CONFIG_SCSI_UFSHCD=y
+CONFIG_SCSI_UFSHCD_PLATFORM=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_SYSCON=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_MAX77686=y
+CONFIG_RTC_DRV_PCF8523=y
+CONFIG_RTC_DRV_S5M=y
+CONFIG_RTC_DRV_DS3232=y
+CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_PL031=y
+CONFIG_RTC_DRV_ARMADA38X=y
+CONFIG_DMADEVICES=y
+CONFIG_MV_XOR=y
+CONFIG_MV_XOR_V2=y
+CONFIG_PL330_DMA=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_INPUT=y
+CONFIG_VIRTIO_MMIO=y
+# CONFIG_SURFACE_PLATFORMS is not set
+CONFIG_COMMON_CLK_CS2000_CP=y
+CONFIG_COMMON_CLK_S2MPS11=y
+CONFIG_COMMON_CLK_XGENE=y
+CONFIG_COMMON_CLK_BD718XX=y
+CONFIG_MAILBOX=y
+CONFIG_ARM_SMMU=y
+CONFIG_ARM_SMMU_V3=y
+CONFIG_EXTCON_USB_GPIO=y
+CONFIG_IIO=y
+CONFIG_TI_ADC081C=y
+CONFIG_PWM=y
+CONFIG_PHY_XGENE=y
+CONFIG_PHY_MVEBU_CP110_COMPHY=y
+CONFIG_PHY_SAMSUNG_USB2=y
+CONFIG_MUX_MMIO=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=y
+CONFIG_VIRTIO_FS=y
+CONFIG_OVERLAY_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_SQUASHFS_ZSTD=y
+CONFIG_9P_FS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_SECURITY=y
+CONFIG_CRYPTO_CCM=m
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=0
+CONFIG_IRQ_POLL=y
+CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_FS=y
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_SCHED_DEBUG is not set
+# CONFIG_DEBUG_PREEMPT is not set
+# CONFIG_RCU_TRACE is not set
+CONFIG_FUNCTION_TRACER=y
+# CONFIG_STRICT_DEVMEM is not set
+CONFIG_MEMTEST=y

board/aarch64/rootfs/boot/syslinux/syslinux.conf

@@ -0,0 +1,3 @@
+label Infix (aarch64)
+	kernel /boot/Image
+	append ${bootargs_root} ${bootargs_rauc} ${bootargs_log}

board/aarch64/rootfs/etc/rauc/system.conf

@@ -0,0 +1,21 @@
+[system]
+compatible=infix-aarch64
+bootloader=uboot
+statusfile=/var/lib/rauc/status
+mountprefix=/var/lib/rauc/mnt
+bundle-formats=-plain
+
+[keyring]
+directory=/etc/rauc/keys
+
+[slot.rootfs.0]
+device=/dev/disk/by-partlabel/primary
+bootname=primary
+
+[slot.rootfs.1]
+device=/dev/disk/by-partlabel/secondary
+bootname=secondary
+
+[slot.net.0]
+device=/dev/ram
+bootname=net

board/amd64/genimage.cfg

@@ -0,0 +1,10 @@
+image cfg.ext4 {
+	ext4 {
+		label = "cfg"
+	}
+	empty = true
+	size = 16M
+}
+
+# Silence genimage warnings
+config {}

board/amd64/grub-embed.cfg

@@ -0,0 +1 @@
+set prefix=(hd0,gpt2)/grub

board/amd64/grub.cfg

@@ -0,0 +1,29 @@
+set timeout="1"
+
+set default="primary"
+set log="loglevel=4"
+
+load_env ORDER DEBUG
+
+for slot in $ORDER; do
+    set default="$slot"
+    break
+done
+
+if [ "$DEBUG" ]; then
+    set log="debug"
+fi
+
+submenu "primary" "$log" {
+	set slot="$1"
+	set append="$2"
+	set root=(hd0,gpt3)
+	source /boot/grub/grub.cfg
+}
+
+submenu "secondary" "$log"  {
+	set slot="$1"
+	set append="$2"
+	set root=(hd0,gpt4)
+	source /boot/grub/grub.cfg
+}

board/amd64/grubenv

@@ -0,0 +1,8 @@
+# GRUB Environment Block
+# WARNING: Do not edit this file by tools other than grub-editenv!!!
+ORDER=primary secondary
+primary_OK=1
+secondary_OK=1
+primary_TRY=0
+secondary_TRY=0
+################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################

board/amd64/isolinux.cfg

@@ -0,0 +1,14 @@
+totaltimeout 3000
+default qemu
+timeout 5
+prompt 1
+
+label qemu
+      kernel __KERNEL_PATH__
+      initrd __INITRD_PATH__
+      append root=/dev/sr0 console=ttyS0 quiet
+
+label live
+      kernel __KERNEL_PATH__
+      initrd __INITRD_PATH__
+      append root=/dev/sr0 console=tty0 quiet

board/amd64/linux_defconfig

@@ -0,0 +1,183 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_SMP=y
+CONFIG_EFI=y
+# CONFIG_GCC_PLUGINS is not set
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_NET_IPIP=y
+CONFIG_NET_IPGRE_DEMUX=y
+CONFIG_NET_IPGRE=y
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_NET_IPVTI=y
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETFILTER=y
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_NF_LOG_IPV6=m
+CONFIG_BRIDGE=y
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_BRIDGE_MRP=y
+CONFIG_BRIDGE_CFM=y
+CONFIG_VLAN_8021Q=y
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_PCI=y
+CONFIG_UEVENT_HELPER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_FW_CFG_SYSFS=y
+CONFIG_FW_CFG_SYSFS_CMDLINE=y
+CONFIG_BLK_DEV_NULL_BLK=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_SR=y
+CONFIG_SCSI_VIRTIO=y
+CONFIG_ATA=y
+CONFIG_ATA_PIIX=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=y
+CONFIG_DUMMY=y
+CONFIG_NET_TEAM=y
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=y
+CONFIG_NET_TEAM_MODE_LOADBALANCE=y
+CONFIG_MACVLAN=y
+CONFIG_MACVTAP=y
+CONFIG_IPVLAN=y
+CONFIG_IPVTAP=y
+CONFIG_VXLAN=y
+CONFIG_GENEVE=y
+CONFIG_BAREUDP=y
+CONFIG_MACSEC=y
+CONFIG_TUN=y
+CONFIG_VETH=y
+CONFIG_VIRTIO_NET=y
+CONFIG_NLMON=y
+CONFIG_NET_VRF=y
+CONFIG_E1000=y
+CONFIG_NE2K_PCI=y
+CONFIG_8139CP=y
+# CONFIG_WLAN is not set
+CONFIG_INPUT_EVDEV=y
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_HW_RANDOM_VIRTIO=m
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_SYSFS=y
+CONFIG_SOFT_WATCHDOG=y
+CONFIG_I6300ESB_WDT=y
+CONFIG_DRM=y
+CONFIG_DRM_QXL=y
+CONFIG_DRM_VIRTIO_GPU=y
+CONFIG_DRM_BOCHS=y
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_HDA_INTEL=y
+CONFIG_SND_HDA_GENERIC=y
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_UHCI_HCD=y
+CONFIG_USB_STORAGE=y
+CONFIG_RTC_CLASS=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_INPUT=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
+CONFIG_EXT4_FS=y
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=y
+CONFIG_VIRTIO_FS=y
+CONFIG_OVERLAY_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_SQUASHFS_ZSTD=y
+CONFIG_9P_FS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_FS=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+# CONFIG_FTRACE is not set
+CONFIG_UNWINDER_FRAME_POINTER=y

board/amd64/rootfs/boot/grub/grub.cfg

@@ -0,0 +1,3 @@
+menuentry "Infix" --id infix {
+	linux /boot/bzImage root=PARTLABEL=$slot rauc.slot=$slot console=ttyS0 $append nokaslr
+}

board/amd64/rootfs/etc/rauc/system.conf

@@ -0,0 +1,18 @@
+[system]
+compatible=infix-x86_64
+bootloader=grub
+grubenv=/mnt/aux/grub/grubenv
+statusfile=/var/lib/rauc/status
+mountprefix=/var/lib/rauc/mnt
+bundle-formats=-plain
+
+[keyring]
+directory=/etc/rauc/keys
+
+[slot.rootfs.0]
+device=/dev/disk/by-partlabel/primary
+bootname=primary
+
+[slot.rootfs.1]
+device=/dev/disk/by-partlabel/secondary
+bootname=secondary

board/common/Config.in

@@ -0,0 +1,79 @@
+comment "Image Signing"
+
+choice
+	prompt "Signing key source"
+	default SIGN_SRC_DIR
+
+config SIGN_SRC_DIR
+	bool "Directory"
+
+config SIGN_SRC_PKCS11
+	bool "PKCS#11 URL"
+
+endchoice
+
+config SIGN_KEY
+	string "Signing key"
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/dev-key" if SIGN_SRC_DIR
+
+comment "Additional Artifacts"
+
+# For /etc/os-release, uses CondtionArchitechture= from systemd.unit(5)
+config INFIX_ARCH
+	string
+	default "arm"     if BR2_arm
+	default "arm64"   if BR2_aarch64
+	default "mips64"  if BR2_mips64
+	default "riscv64" if BR2_riscv
+	default "x86_64"  if BR2_x86_64
+
+menuconfig DISK_IMAGE
+	bool "Disk image"
+	help
+	  Compose a full disk image with redundant firmware partitions,
+	  configuration partition, etc.
+
+	  This is useful when:
+	  - Bringing up a blank system during manufacturing
+	  - Creating a GNS3 appliance
+	  - Developing/debugging issues in the boot process in QEMU
+
+config DISK_IMAGE_SIZE
+	string "Image size"
+	depends on DISK_IMAGE
+	default "512M"
+	help
+	  Create a disk image of this size. Suffixes like K/M/G may be
+	  used to multiply by powers of 1024. Suffixes like KB/MB/GB may
+	  be used to multiply by powers of 1000.
+
+	  Minimum supported size is 512M.
+
+config GNS3_APPLIANCE
+	bool "GNS3 Appliance"
+	select DISK_IMAGE
+	default y if BR2_x86_64
+	help
+	  Create a GNS3 appliance description that, together with the
+	  disk image, can be imported into GNS3.
+
+menuconfig FIT_IMAGE
+	bool "Traditional FIT image"
+	help
+	  Create a "regular" FIT image where the kernel and DTBs are
+	  stored in the FIT rather than inside the rootfs (like it
+	  normally is in Infix).
+
+	  This is useful when trying out Infix on targets whose
+	  bootloader might not be capable of booting a raw Squash, but
+	  is able to handle an FIT.
+
+config FIT_ARCH
+	string
+	depends on FIT_IMAGE
+	default "arm64" if BR2_aarch64
+
+config FIT_KERNEL_LOAD_ADDR
+	string "Kernel load address"
+	depends on FIT_IMAGE
+

board/common/common.mk

@@ -0,0 +1,9 @@
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk
+
+define RAUC_POST_BUILD_INSTALL_CERT
+	@$(call IXMSG,"Installing signing cert for RAUC")
+	mkdir -p $(TARGET_DIR)/etc/rauc/keys
+	$(foreach crt,$(shell ls $(SIGN_KEY)/*.crt), \
+		cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)
+endef
+RAUC_POST_BUILD_HOOKS += RAUC_POST_BUILD_INSTALL_CERT

board/common/dev-key/infix.crt

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFbTCCA1WgAwIBAgIUAW8J6lminthZoomqqt4Hmv1UcJEwDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yMzAyMjAxNDEyMDZaGA8yMTIz
+MDEyNzE0MTIwNlowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAL2RAAmRNp688DoFAQZaeHGMHTjsYSG4vdk38xuZ
+iY2GBdzKQB7JfvGSAqzrn1BVN0AsYmc5ZZG6W10CecKrHU8EbBgdEfB4iRHmYbnS
+nBAB6MTv1m4TDG9Ic0E7TEHFLNWi7u+TPIQGFlqeXdoE0jh6d7tFZJlkSzJaEPGW
+O4IjhWV1Ow2+Erwaz6Vgm8t6PTgrPtJMo7+UTIlLkjhIp99OR+vQdSsEBimxg0uc
+E3qvDMOvyBqshYQsJn8EX+L6X5g7cigk/RmeoYZ8hu2/dwxhvoK1kfTfKSzBQzTq
+d9/Y9ASVcmbRx3e9qdyK+yxfMMv0ujYoiv0sslw7ZvtJ0EvaLkzgls6BwMdZqmAC
+S/JkZUtPK3J14lvDtpr5gD1yIABf36T0b3WUxVCAccmbfzDbY4EGEgHowGZW9wkF
+mzVgZ1gta9mxzFsE1OipMMlVu+GOts91qESWSzj4hxn8tVNbfWraWKWXJHDAAnsF
+jBZg6UHybxLIlb6igyiCeDjFzC0iVAhiPu45kfSjYqIhbngZdxVGKeTGTzrkFBT8
+XT8jJazSwAJX3gCMbzVqcgwL/+JhJABAWlm8hDMI/13eYC4mDETQEeBWx0ywtNz6
+hC4QItiJkHB2F51T9bJwXJiT3UUUUUy9aeFqRVI153jy9sOsXEx6Cl5u1X0JoZYB
+PW5nAgMBAAGjUzBRMB0GA1UdDgQWBBTHl9X576dPVGUaJTisvr9bG91RuzAfBgNV
+HSMEGDAWgBTHl9X576dPVGUaJTisvr9bG91RuzAPBgNVHRMBAf8EBTADAQH/MA0G
+CSqGSIb3DQEBCwUAA4ICAQBKyqzQ1CAhGG/Thtpnu6BOkyt3Kp7XH55S2f4zShHE
+AtW0L56NOF1ASBm0+bTwmd4S6AEIpcG9oO7opqcnFncJtTFcMnTPYH55ldUmp/FW
+bR1ICwGgW3y5tFnC3BicTbhHBgoh73oGJFPbCCsvZgeu8duygG3ULERw60xkjJGN
+ZvNTk8AEmdmwXnkKeHuEojm7WAuIJbc7wy6dIjJonffJekCgI2NjSTweA3bLb2m4
+bpUSv19aRPDXH8kYjguLTpjYHF6TjV3gsWSX0gBwmYqZK/kHwObqV85oT9iCRbmy
+ErP0XkYHtPyed+W/jTtW7tVPj7PctV9CYCUmLVyHS8C1JCpCkaLWlR/UUwGC2DKH
+gYksFxrZbVk6ApzRAd5Oza6EExSQf5FmHf4YLj4qon7WArbY7tqBkV7k4FCjEQIk
+B45oH0kg1b0zyK4LL+d0UVcPB6PN9sLQf8Dgjhu34ls14x5cjVW5rpTqpekuMAJn
+E+PXXOYFhrwchCp/CC/SIWC1aglNiXr0+ZOKFyxYXNzQ0D2X7WKhRxgsCOVB9ZuX
+tL1RSP4qLtEL+pMRus+uGT85pz2N7JHBc7yTX6yGecFBkZ9iXJIQTOJAb5z1+VBE
+Ey/boWpVqK8sEZKAIdnOKF+GWUQEDGhdwZiTiSNzcALw1QBnBecOj1Up0RToDeQ/
+wg==
+-----END CERTIFICATE-----

board/common/dev-key/infix.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC9kQAJkTaevPA6
+BQEGWnhxjB047GEhuL3ZN/MbmYmNhgXcykAeyX7xkgKs659QVTdALGJnOWWRultd
+AnnCqx1PBGwYHRHweIkR5mG50pwQAejE79ZuEwxvSHNBO0xBxSzVou7vkzyEBhZa
+nl3aBNI4ene7RWSZZEsyWhDxljuCI4VldTsNvhK8Gs+lYJvLej04Kz7STKO/lEyJ
+S5I4SKffTkfr0HUrBAYpsYNLnBN6rwzDr8garIWELCZ/BF/i+l+YO3IoJP0ZnqGG
+fIbtv3cMYb6CtZH03ykswUM06nff2PQElXJm0cd3vancivssXzDL9Lo2KIr9LLJc
+O2b7SdBL2i5M4JbOgcDHWapgAkvyZGVLTytydeJbw7aa+YA9ciAAX9+k9G91lMVQ
+gHHJm38w22OBBhIB6MBmVvcJBZs1YGdYLWvZscxbBNToqTDJVbvhjrbPdahElks4
++IcZ/LVTW31q2lillyRwwAJ7BYwWYOlB8m8SyJW+ooMogng4xcwtIlQIYj7uOZH0
+o2KiIW54GXcVRinkxk865BQU/F0/IyWs0sACV94AjG81anIMC//iYSQAQFpZvIQz
+CP9d3mAuJgxE0BHgVsdMsLTc+oQuECLYiZBwdhedU/WycFyYk91FFFFMvWnhakVS
+Ned48vbDrFxMegpebtV9CaGWAT1uZwIDAQABAoICACLGFJGst65Kzm52OIfn1KxP
+nZSxl+fNsdXE862ebqMtcKnd2AFNySGbPS5nUqQz3ZzCB5MT7lPbMaNQLvHM3eV+
+1C1gN8g69Dn6XvbtcX9mOkLWFCnBCMjpK2tN62EtQFo4N0hvY+x8CWG6J1E1DTMb
+FBegVSHmSf0ElJMckfH/fhrsdFbDBUDIUkrt++ZJmC1TkYSWVntwQtH0sO/uNA08
+mOjjJnsrk83WKFWYXeJldhv3hOePujZSuwUV0lkawKp2TSycDGnEtbCr6zx1oOr+
+iyoDELEwtqblFOUCFddUPv8QQxolZUfL3Pr967FqDNN9IyOIMGbc6iMNKojyM2lF
+oasOFqTcw/slGIAKOgISshT4EJulix1FNYXk8qFTjJTXkiFeNdqbgFvprE+ivoX+
+qhVt+9bexWdZDf1USGX/POSb5AMoa2OAwMpv06UueF4Uin9ImxdHJhi8EGwPbqk+
+czSBPz2lelgeX7Cq0tqTWnKY5SskDGKapKSMiF7L6bbmNSNg1PdE/EVSNriP5/n5
+mE+b3oVpg136B3ExgGnQ1h4JmrcNp1VLa7FTaluMAbvzg6IFPx2fiKDzMwjlqDxq
+sGUqTfaUB2mH5STeeidwBB9Y5NdKBc4zl5d0bjUyR8LAAgET1GHdmvFIlgUmBKZQ
+u6quaFy7JtJBYGl43y2xAoIBAQDMT699Tkq/aws28UrbfMlMtIDyXjqZSdq13HDh
+vFCjRBMYy4zjhbjQIxU+zXPRi2FYgMffjyuJ1MABCbGDlgwaGQ9DuKnrs+VVpw2o
+UL+D25kVxQJQuwCYK+Iy1cwb2IQM+68hvnuemYqnT7zSMl3sqEwNeZ5YiZCgg90S
+SIv1kYTVmjoTHsLR0jdLXfGTWr1AL3+X/vlkl0WxjcJrSNa8wlcqiMwnVdI2r9Zd
+NF+HVNeh8IKrkoCvBfK7BzUhMRKtritcH0xycxxt80WO6PzcRoVDxu44HJN0cDnZ
+OhsK0DoZdaBIiEWUFqzo04kDz0iSSvxKJ43+/03oVg8XBNL1AoIBAQDthltLpys6
+4p6vGj7feOmJDuA1E1M+MUttnfaX3FKMYVk8idTaoRBXM/tqWhNJHldCJjliG6tt
+sWLSruYWs+VwUmBntNNDH753FW1INZPN7Mrb/kiVx1JXBKNtoymCxNxQq1Jut2c9
+lDEUZp1wY96RBZfUhkxAMCc23Z/S4xKNLw5X9+isC/AUlVCa1sM87zD/pVbQ1P2x
+rvCcU75sa1h84FBBF7mGYd+oZBaK12Xw8ZHPsRgdznkhHwNHXlO9HgcX2DQ56vpn
+Hl2syZT1UOB+W4IkGHbPWtDGUDaI9bzarEJ6T0dP7Qdqana4HioGMu4aqgxiapre
+6s9CSXb1nvprAoIBAQCC31hOL+R5kRvx6cZFqj1XwRgIKIvovQI4FCjKsFIHAwgo
+jdqFs5aa3J4zSG+z/lAw3O0rKw58j6ceAxOOcoL2BK9edd+CeA2jPArnkjHbSMNa
+yoOdKuxKjXGrln/UJnEPz/hy6Q1OnpPOcKlHC7RWb8enqgvgMt5Ns6ncmFPuzXQF
+T3F75extcvawdFDWTv2DK+nTdyRRZwThoyiyiEnlR6eGO3Jqj/LDzQbHVVEL4zDt
+Lp7FQGblti2x2AAUbtbEIhjsPbA+b7X6SCZ6UIwInbOnorndf5CEuY6Usz+3QYK1
+5D7ztza6kXvY+AeARTr7WsUYyxWODgPdm6K24AQxAoIBAEiRrxz7Exsnl+HZu/Hc
+6EUGtXuhzuIGf4wbIfcdyl63c2MqnUy6vtpVuG+y24eQbIp6UTfnSkX2V0IVS5kO
+F4BsuqWUuqMcdL2/Xycbr2/P896o3xZb0o1hjmj1273nVYSUA1huUm2e9CvOejWX
+Xa2jLtMwwOUvkRuTNLxiwg0+njxEMuM1toEjaYAVM4tPbQH+Svr8yBHcaAjrERfg
+6CUnB34LuJQVHRc+lSCQVMX7mFgDPGIG7j0vU3ofmKgEH5iqZrJ3V0/gGDCtWgRl
+VGFmpelPTCVoErc0VKUdpziMPrdNt3T07zoVEvaHyMEiGFsvLx92gKCwzufquByt
+GMcCggEATu40rFJOUA5at5WK9uI2TwR2ZVO2wgfu7kUiVmQJZmkMuQKhER0lkRxU
+eWtME0JYLprWwvIBRmR0y4IBohJBGAxR7CWJsxnrBJxplc/Nf3ziFs3DY75EPKAP
+pwbl41BFHqdLfee9OOJGHRXT7YlAsHxl0X2pBfrnV+HhG2hcWoFxuclVOsAGbdxt
+0C4zbyjGqfpDkFLbFcGcN09NSRsBEKB2kgM4i4zAtW/kTXLl16l+UBApXx2vkkDz
+XuB+ikwqAZE+LNMwy9Oxmfq6mzpt9D5wwtw3dasMzvK9Tr+DC6ctHjCNl3e2fKkP
+hE4TY9HQcE7tdZysxkzni6CX77WRiQ==
+-----END PRIVATE KEY-----

board/common/genimage.cfg

@@ -0,0 +1,65 @@
+
+image aux.ext4 {
+	mountpoint = "/aux"
+	temporary = true
+	size = 2M
+
+	ext4 {
+		label = "aux"
+	}
+}
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
+	ext4 {
+		label = "cfg"
+	}
+}
+
+image var.ext4 {
+	empty = true
+	temporary = true
+	# 44M - 24k (GPT backup)
+	size = 45032k
+
+	ext4 {
+		label = "var"
+	}
+}
+
+image mmc.img {
+	size = 512M
+	hdimage {
+		partition-table-type = "gpt"
+	}
+
+	partition aux {
+		offset = 2M
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		image = "rootfs.squashfs"
+		size = 224M
+	}
+
+	partition secondary {
+		bootable = true
+		image = "rootfs.squashfs"
+		size = 224M
+	}
+
+	partition cfg {
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		image = "var.ext4"
+	}
+}
+
+# Silence genimage warnings
+config {}

board/common/genimage.cfg.in

@@ -0,0 +1,66 @@
+@BOOTIMG@
+
+image aux.ext4 {
+	mountpoint = "/aux"
+	temporary = true
+	size = @AUXSIZE@
+
+	ext4 {
+		label = "aux"
+	}
+}
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = @CFGSIZE@
+
+	ext4 {
+		label = "cfg"
+	}
+}
+
+image var.ext4 {
+	empty = true
+	temporary = true
+	size = @VARSIZE@
+
+	ext4 {
+		label = "var"
+	}
+}
+
+image disk.img {
+	size = @TOTALSIZE@
+	hdimage {
+		partition-table-type = "gpt"
+	}
+
+@BOOTPART@
+
+	partition aux {
+		offset = @AUXOFFS@
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		image = "rootfs.squashfs"
+		size = @IMGSIZE@
+	}
+
+	partition secondary {
+		image = "rootfs.squashfs"
+		size = @IMGSIZE@
+	}
+
+	partition cfg {
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		image = "var.ext4"
+	}
+}
+
+# Silence genimage warnings
+config {}

board/common/lib.sh

@@ -0,0 +1,19 @@
+ixmsg()
+{
+    printf "\e[37;44m#!:   $@\e[0m\n"
+}
+
+die()
+{
+    echo "$@" >&2
+    exit 1
+}
+
+load_cfg()
+{
+    local tmp=$(mktemp -p /tmp)
+
+    grep "$1" $BR2_CONFIG >$tmp
+    .  $tmp
+    rm $tmp
+}

board/common/mkdisk.sh

@@ -0,0 +1,184 @@
+#!/bin/sh
+
+set -e
+
+K=10
+M=20
+G=30
+
+size2int()
+{
+    # Use truncate's error message to convert input like "1K to "1024"
+    # for us.
+    #
+    # - What do you mean by "fragile"?!
+    truncate -s $1 /dev/null 2>&1 | awk '{ print($7); }'
+}
+
+dimension()
+{
+
+    if [ $total -ge $((4 << G)) ]; then
+	bootsize=$(( 8 << M))
+	auxsize=$((  8 << M))
+	imgsize=$((  1 << G))
+	cfgsize=$((512 << M))
+	# var is at least ~1.5G
+    elif [ $total -ge $((2 << G)) ]; then
+	bootsize=$(( 8 << M))
+	auxsize=$((  8 << M))
+	imgsize=$((512 << M))
+	cfgsize=$((256 << M))
+	# var is at least ~1.75G
+    elif [ $total -ge $((1 << G)) ]; then
+	bootsize=$(( 4 << M))
+	auxsize=$((  4 << M))
+	imgsize=$((256 << M))
+	cfgsize=$(( 64 << M))
+	# var is at least ~0.5G
+    elif [ $total -ge $((512 << M)) ]; then
+	bootsize=$(( 4 << M))
+	auxsize=$((  4 << M))
+	imgsize=$((192 << M))
+	cfgsize=$(( 16 << M))
+	# var is at least ~100M
+    else
+	echo "Can't create disk images smaller than 512M"
+	exit 1
+    fi
+
+    # Size var to fit whatever is left over. Also reserve another 32K
+    # at the end to make room for the backup GPT.
+    varsize=$(($total - $auxsize - 2 * $imgsize - $cfgsize))
+    if [ "$bootoffs" ]; then
+	varsize=$(($varsize - $bootsize))
+    fi
+    varsize=$(($varsize - (32 << K)))
+
+    if [ "$bootoffs" ]; then
+	# Align the end of the boot partition to an even MiB. E.g. if
+	# boot was dimensioned to 4M, and bootoffs is 32K, then the
+	# final bootsize becomes 4M - 32K, meaning aux will start on
+	# exactly 4M.
+	auxoffs=$bootsize
+	bootsize=$(($bootsize - $bootoffs))
+    else
+	# No bootloader, place aux after GPT, resize it to end on an
+	# even MiB (as is done for boot above).
+	auxoffs=$((32 << K))
+	auxsize=$(($auxsize - $auxoffs))
+    fi
+}
+
+probeboot()
+{
+    # If we have built an EFI app, typically grub, make sure to
+    # include it.
+    if [ -d $BINARIES_DIR/efi-part/EFI ]; then
+	bootoffs=$((32 << K))
+    fi
+}
+
+genboot()
+{
+    if [ -d $BINARIES_DIR/efi-part/EFI ]; then
+	bootimg=$(cat <<EOF
+image efi-part.vfat {
+	size = $bootsize
+	vfat {
+		file EFI {
+			image = $BINARIES_DIR/efi-part/EFI
+		}
+	}
+}
+EOF
+		  )
+	bootpart=$(cat <<EOF
+	partition efi {
+		offset = $bootoffs
+		partition-type-uuid = U
+		bootable = true
+		image = efi-part.vfat
+	}
+EOF
+		  )
+
+    fi
+}
+
+common=$(dirname $(readlink -f "$0"))
+root=$BUILD_DIR/genimage.root
+tmp=$BUILD_DIR/genimage.tmp
+
+total=$((512 << M))
+bootoffs=
+bootimg=
+bootpart=
+
+while getopts "a:s:" opt; do
+    case ${opt} in
+	a)
+	    arch=$OPTARG
+	    ;;
+	s)
+	    total=$(size2int $OPTARG)
+	    ;;
+    esac
+done
+shift $((OPTIND - 1))
+
+mkdir -p $root
+
+probeboot
+dimension
+genboot
+
+# Use awk over sed because replacement text may contain newlines,
+# which sed does not approve of.
+awk \
+	  -vtotal=$total \
+	  -vauxsize=$auxsize -vauxoffs=$auxoffs \
+	  -vimgsize=$imgsize \
+	  -vcfgsize=$cfgsize \
+	  -vvarsize=$varsize \
+	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
+	  '{
+		sub(/@TOTALSIZE@/, total);
+		sub(/@AUXSIZE@/, auxsize);
+		sub(/@AUXOFFS@/, auxoffs);
+		sub(/@IMGSIZE@/, imgsize);
+		sub(/@CFGSIZE@/, cfgsize);
+		sub(/@VARSIZE@/, varsize);
+
+		sub(/@BOOTIMG@/, bootimg);
+		sub(/@BOOTPART@/, bootpart);
+	  }1' \
+	      < $common/genimage.cfg.in >$root/genimage.cfg
+
+mkdir -p $root/aux
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
+
+case "$arch" in
+    aarch64)
+	mkenvimage -s 0x4000 -o $root/aux/uboot.env \
+		   $BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt
+	;;
+    x86_64)
+	mkdir -p $root/aux/grub
+	cp -f $BR2_EXTERNAL_INFIX_PATH/board/amd64/grub.cfg \
+	      $BR2_EXTERNAL_INFIX_PATH/board/amd64/grubenv  \
+	   $root/aux/grub/
+	;;
+    *)
+	;;
+esac
+
+rm -rf $tmp
+
+genimage \
+    --rootpath $root \
+    --tmppath  $tmp \
+    --inputpath $BINARIES_DIR \
+    --outputpath $BINARIES_DIR \
+    --config $root/genimage.cfg

board/common/mkfit.sh

@@ -0,0 +1,108 @@
+#!/bin/sh
+
+die()
+{
+    echo "$@" >&2
+    exit 1
+}
+
+load_cfg()
+{
+    local tmp=$(mktemp -p /tmp)
+
+    grep ^FIT_ $BR2_CONFIG >$tmp
+    .  $tmp
+    rm $tmp
+}
+
+load_cfg
+[ "$FIT_IMAGE" = "y" ] || exit 0
+
+work=$(pwd)/build/fit-image-local
+dtbs=$(find $BINARIES_DIR -name '*.dtb')
+kernel=$(find $BINARIES_DIR -name '*Image' | head -n1)
+squash=$BINARIES_DIR/rootfs.squashfs
+
+mkdir -p $work
+
+# mkimage will only align images to 4 bytes, but U-Boot will leave
+# both DTB and ramdisk in place when starting the kernel. So we pad
+# all components up to a 4k boundary.
+truncate -s %4k $kernel $dtbs
+
+: >$work/dtbs.itsi
+: >$work/cfgs.itsi
+for dtb in $dtbs; do
+    name=$(basename $dtb .dtb)
+
+    cat <<EOF >>$work/dtbs.itsi
+		$name-dtb {
+			description = "$name";
+			type = "flat_dt";
+			arch = "$FIT_ARCH";
+			compression = "none";
+			data = /incbin/("$dtb");
+		};
+EOF
+    cat <<EOF >>$work/cfgs.itsi
+		$name {
+			description = "$name";
+			kernel = "kernel";
+			ramdisk = "ramdisk";
+			fdt = "$name-dtb";
+		};
+EOF
+done
+
+: >$work/kernel-load.itsi
+if [ "$FIT_KERNEL_LOAD_ADDR" ]; then
+    cat <<EOF >$work/kernel-load.itsi
+			load = <$FIT_KERNEL_LOAD_ADDR>;
+			entry = <$FIT_KERNEL_LOAD_ADDR>;
+EOF
+fi
+
+cat <<EOF >$work/infix.its
+/dts-v1/;
+
+/ {
+	timestamp = <$(date +%s)>;
+	description = "Infix ($FIT_ARCH)";
+	creator = "infix";
+	#address-cells = <0x1>;
+
+	images {
+
+		kernel {
+			description = "Linux";
+			type = "kernel";
+			arch = "$FIT_ARCH";
+			os = "linux";
+$(cat $work/kernel-load.itsi)
+			compression = "none";
+			data = /incbin/("$kernel");
+		};
+
+		ramdisk {
+			description = "Infix";
+			type = "ramdisk";
+			os = "linux";
+			arch = "$FIT_ARCH";
+			compression = "none";
+			data = /incbin/("$squash");
+		};
+
+$(cat $work/dtbs.itsi)
+
+	};
+
+	configurations {
+$(cat $work/cfgs.itsi)
+	};
+};
+EOF
+
+mkimage \
+    -E -p 0x1000 \
+    -f $work/infix.its $BINARIES_DIR/infix.itb \
+    || die "Unable to create FIT image"

board/common/mkgns3a.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+
+cat <<EOF >"$BINARIES_DIR/infix.gns3a"
+{
+    "name": "infix",
+    "category": "router",
+    "description": "Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling.",
+    "vendor_name": "KernelKit",
+    "vendor_url": "https://github.com/kernelkit/",
+    "product_name": "Infix",
+    "registry_version": 6,
+    "status": "stable",
+    "maintainer": "KernelKit",
+    "maintainer_email": "kernelkit@googlegroups.com",
+    "usage": "Default login is 'root', no password.\n\nType 'help' for an overview of commands and relevant configuration files.\n\nThe /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address  eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
+    "port_name_format": "eth{0}",
+    "linked_clone": true,
+    "qemu": {
+        "adapter_type": "virtio-net-pci",
+        "adapters": 10,
+        "ram": 512,
+        "cpus": 1,
+        "hda_disk_interface": "virtio",
+        "arch": "x86_64",
+        "console_type": "telnet",
+        "kvm": "allow"
+    },
+    "images": [
+        {
+            "filename": "OVMF.fd",
+            "filesize": $(stat --printf='%s' "$BINARIES_DIR/OVMF.fd"),
+            "md5sum": "$(md5sum "$BINARIES_DIR/OVMF.fd" | awk '{print $1}')",
+            "version": "0.0"
+        },
+        {
+            "filename": "disk.img",
+            "filesize": $(stat --printf='%s' "$BINARIES_DIR/disk.img"),
+            "md5sum": "$(md5sum "$BINARIES_DIR/disk.img" | awk '{print $1}')",
+            "version": "0.0"
+        }
+    ],
+    "versions": [
+        {
+            "name": "0.0",
+            "images": {
+                "bios_image": "OVMF.fd",
+                "hda_disk_image": "disk.img"
+            }
+        }
+    ]
+}
+EOF

board/common/mkmmc.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -e
+
+common=$(dirname $(readlink -f "$0"))
+root=$BUILD_DIR/genimage.root
+tmp=$BUILD_DIR/genimage.tmp
+
+
+mkdir -p $root/aux
+cp -f $BINARIES_DIR/uboot-env.bin $root/aux/uboot.env
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
+
+rm -rf $tmp
+
+genimage \
+    --rootpath $root \
+    --tmppath  $tmp \
+    --inputpath $BINARIES_DIR \
+    --outputpath $BINARIES_DIR \
+    --config $common/genimage.cfg

board/common/mkrauc.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+
+set -e
+
+GIT_VERSION=$(git -C $BR2_EXTERNAL_INFIX_PATH describe --always --dirty --tags)
+
+arch=$1
+sign=$2
+
+crt=$(ls $sign/*.crt)
+key=$(ls $sign/*.key)
+
+common=$(dirname $(readlink -f "$0"))
+
+work=$BUILD_DIR/mkrauc
+mkdir -p $work
+
+cp -f $common/rauc-hooks.sh $work/hooks.sh
+
+# RAUC internally uses the file extension to find a suitable install
+# handler, hence the name must be .img
+cp -f $BINARIES_DIR/rootfs.squashfs $work/rootfs.img
+cp -f $BINARIES_DIR/rootfs.itbh $work/rootfs.itbh
+
+cat >$work/manifest.raucm <<EOF
+[update]
+compatible=infix-${arch}
+version=${GIT_VERSION}
+
+[bundle]
+format=verity
+
+[hooks]
+filename=hooks.sh
+
+[image.rootfs]
+filename=rootfs.img
+hooks=post-install
+EOF
+
+rm -f $BINARIES_DIR/infix-$arch.pkg
+
+rauc --cert=$crt --key=$key \
+    bundle $work $BINARIES_DIR/infix-$arch.pkg

board/common/post-build.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+. "$BR2_CONFIG"
+. "$TARGET_DIR/usr/lib/os-release"
+if [ -n "${ID_LIKE}" ]; then
+    ID="${ID} ${ID_LIKE}"
+fi
+
+GIT_VERSION=$(git -C $BR2_EXTERNAL_INFIX_PATH describe --always --dirty --tags)
+
+# This is a symlink to /usr/lib/os-release, so we remove this to keep
+# original Buildroot information.
+rm "$TARGET_DIR/etc/os-release"
+{
+	echo "NAME=\"Infix\""
+	echo "VERSION=${GIT_VERSION}"
+	echo "ID=infix"
+	echo "ID_LIKE=\"${ID}\""
+	echo "VERSION_ID=${GIT_VERSION}"
+	echo "BUILD_ID=\"${NAME} ${VERSION}\""
+	echo "PRETTY_NAME=\"Infix by KernelKit\""
+	echo "ARCHITECTURE=\"${INFIX_ARCH}\""
+	echo "HOME_URL=https://github.com/KernelKit"
+} > "$TARGET_DIR/etc/os-release"
+
+echo "Infix by KernelKit $GIT_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
+
+# Allow pdmenu (setup) to be a login shell
+grep -qsE '^/usr/bin/pdmenu$$' "$TARGET_DIR/etc/shells" \
+        || echo "/usr/bin/pdmenu" >> "$TARGET_DIR/etc/shells"

board/common/post-image.sh

@@ -1,16 +1,33 @@
 #!/bin/sh
 
-# shellcheck disable=SC1090
-. "$BR2_CONFIG" 2>/dev/null
+common=$(dirname "$(readlink -f "$0")")
+. $common/lib.sh
 
-cat <<-EOF >"$BINARIES_DIR/qemu.sh"
-	#!/bin/sh
-	line=\$(stty -g)
-	stty raw
-	qemu-system-x86_64 -M pc -cpu kvm64 -enable-kvm -nographic		\\
-	    -kernel bzImage -append "rootwait root=/dev/vda console=ttyS0"	\\
-	    -drive file=rootfs.ext2,if=virtio,format=raw			\\
-	    -net nic,model=virtio -net user
-	stty "\$line"
-EOF
-chmod +x "$BINARIES_DIR/qemu.sh"
+load_cfg BR2_EXTERNAL_INFIX_PATH
+
+load_cfg BR2_ARCH
+load_cfg SIGN_KEY
+
+ixmsg "Signing SquashFS Image"
+$common/sign.sh $BR2_ARCH $SIGN_KEY
+
+ixmsg "Creating RAUC Update Bundle"
+$common/mkrauc.sh $BR2_ARCH $SIGN_KEY
+
+load_cfg DISK_IMAGE
+if [ "$DISK_IMAGE" = "y" ]; then
+    ixmsg "Creating Disk Image"
+    $common/mkdisk.sh -a $BR2_ARCH
+fi
+
+load_cfg GNS3_APPLIANCE
+if [ "$GNS3_APPLIANCE" = "y" ]; then
+    ixmsg "Creating GNS3 Appliance"
+    $common/mkgns3a.sh
+fi
+
+load_cfg FIT_IMAGE
+if [ "$FIT_IMAGE" = "y" ]; then
+    ixmsg "Creating Traditional FIT Image"
+    $common/mkfit.sh
+fi

board/common/rauc-hooks.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+        slot-post-install)
+                [ "$RAUC_SLOT_CLASS" = "rootfs" ] || break
+
+		echo "Updating signature information for $RAUC_SLOT_BOOTNAME"
+
+		itbh=$(dirname $RAUC_IMAGE_NAME)/rootfs.itbh
+		cp $itbh /mnt/aux/$RAUC_SLOT_BOOTNAME.itbh
+		sync
+                ;;
+        *)
+                exit 1
+                ;;
+esac

board/common/rootfs.its

@@ -0,0 +1,28 @@
+/dts-v1/;
+
+/ {
+	description = "Infix";
+	creator = "infix";
+	#address-cells = <0x1>;
+
+	images {
+		rootfs {
+			description = "Infix";
+			type = "ramdisk";
+			os = "linux";
+			compression = "none";
+			data = /incbin/("rootfs.squashfs");
+			signature-1 {
+				algo = "sha256,rsa4096";
+				key-name-hint = "infix";
+			};
+		};
+	};
+
+	configurations {
+		default = "verity";
+		verity {
+			ramdisk = "rootfs";
+		};
+	};
+};

board/common/rootfs/bin/chom

@@ -0,0 +1,116 @@
+#!/bin/sh
+#set -x
+
+mode=/mnt/cfg/infix/.use_etc
+boot=/tmp/.boot_mode
+if [ -f $boot ]; then
+    current=$(cat $boot)
+else
+    current="unknown"
+fi
+m=on
+n=off
+p=off
+
+select_mode()
+{
+    if [ -f $mode ]; then
+	m=off
+	if grep -qi profinet $boot; then
+	    n=off
+	    p=on
+	else
+	    n=on
+	    p=off
+	fi
+    fi
+
+    exec 3>&1
+    selection=$(dialog --erase-on-exit --no-tags \
+		    --hline "Arrow keys + space to select, enter to confirm" \
+		    --backtitle "Select Operating Mode" \
+		    --title "Select Operating Mode" \
+		    --radiolist "System currently runs in: $current mode" 13 60 1 \
+		    "1" "Managed NETCONF, XML datastore" "$m" \
+		    "2" "Native Linux, /etc datastore"   "$n" \
+		    "3" "PROFINET, /etc variant"         "$p" \
+		    2>&1 1>&3)
+    exit_status=$?
+    exec 3>&-
+    case $exit_status in
+	1)			# cancel
+	    exit 0
+	    ;;
+	255)			# escape
+	    exit 1
+	    ;;
+    esac
+}
+
+usage()
+{
+    cat <<EOF
+usage:
+  chom [-h] [etc | netconf]
+
+options:
+  -h            Show this help text
+
+arguments:
+  etc           Change to Linux native mode, /etc
+  netconf       Change to NETCONF mode, XML
+  profinet      Change to PROFINET mode, /etc variant
+
+EOF
+}
+
+case $1 in
+    -h)
+	usage
+	exit 0
+	;;
+    net* | xml)
+	selection=1
+	;;
+    nat* | etc*)
+	selection=2
+	;;
+    profinet)
+	selection=3
+	;;
+    *)
+	;;
+esac
+
+if [ -z "$selection" ]; then
+    use_dialog=1
+    select_mode
+fi
+
+case $selection in
+    1)
+	rm -f $mode 2>/dev/null
+	grep -qi netconf $boot 2>/dev/null && exit 0
+	result="Manageed NETCONF"
+	;;
+    2)
+	echo "native /etc" > $mode
+	grep -qi native $boot  2>/dev/null && exit 0
+	result="Native Linux, /etc"
+	;;
+    3)
+	echo "PROFINET" > $mode
+	grep -qi profinet $boot  2>/dev/null && exit 0
+	result="PROFINET"
+	;;
+esac
+
+if [ -n "$use_dialog" ]; then
+    dialog --erase-on-exit --cr-wrap --title "Activate Mode Change?" --yesno "\n   Reboot to $result mode now?" 8 50
+    if [ $? -eq 0 ]; then
+	reboot
+    fi
+fi
+
+echo "Remember to reboot later to activate the change."
+exit 0

board/common/rootfs/bin/help

@@ -0,0 +1,690 @@
+#!/bin/sh
+# COLUMS and ROWS should be set on the console, if not, use fallback
+if [ -z "$COLUMNS" ]; then
+	if command -v tput; then
+		COLUMNS=$(tput cols)
+	else
+		COLUMNS=80
+	fi
+fi
+
+h1()
+{
+	STR="$*"
+	if [ -n "$plain" ]; then
+		echo "$STR" | tr '[:lower:]' '[:upper:]'
+		echo "$STR" | sed 's/./=/g'
+	else
+		printf "\033[7m%-${COLUMNS}s\033[0m" "$STR"
+	fi
+}
+
+h2()
+{
+	STR="$*"
+	if [ -n "$plain" ]; then
+		echo "$STR"
+		echo "$STR" | sed 's/./-/g'
+	else
+		printf "\033[1m%-${COLUMNS}s\033[0m" "$STR"
+	fi
+}
+
+ul()
+{
+	if [ -n "$plain" ]; then
+		echo "__${*}__"
+	else
+		printf "\033[54%s\033[0m" "$*"
+	fi
+}
+
+em()
+{
+	if [ -n "$plain" ]; then
+		echo "**${*}**"
+	else
+		printf "\033[5m%s\033[0m" "$*"
+	fi
+}
+
+overview()
+{
+	cat <<EOF
+$(h1 "Help System            Press 'Q' to quit | Arrow keys and PgUp/PgDn to scroll")
+
+$(h2 "See Also")
+  help edit            Tutorial on VI and Mg editors
+  help net             Network set up introduction
+  setup                User friendly setup and diagnostic tool
+
+$(h2 "General Syntax")
+  cmd [optional arg]   E.g., use 'date -h' to get help for date command
+
+$(h2 "File system")
+  pwd | ls | cd        Show directory, contents, or change directory
+  cat file             Show file contents
+  vi  | mg [file]      Edit file with the VI or Micro Emacs editor
+
+$(h2 "Services")
+  initctl list         Lists all configurable services (svc's)
+  initctl enable svc   Enable a service 'svc'
+  initctl reload       Reload init process' state, start/stop svc's
+  initctl start svc    Start a stopped service 'svc'
+  initctl stop svc     Stop 'svc'
+  initctl restart svc  Restart a running 'svc'
+  initctl status [svc] Display running status of all services, or one 'svc'
+
+$(h2 "Tools")
+  setup                User friendly setup and diagnostic tool
+  date    [-h]         Display current time, or sets the system date
+  factory              Factory reset the device (on the next boot)
+  hwclock [-h]         Query or set the hardware clock (RTC)
+  logout | Ctrl-D      Log out from TTY
+  mdio | mvls          Low-level MDIO access, also for Marvell switch status
+  tail -F file         Continuously read from a file Useful for monitoring the
+                       health of services, see 'ls /var/log/' for log files
+  less [file]          Pagers provding easily scrollable content (q quits) >
+  more [file]            > e.g., 'cat very-long-file | less'
+  most [file]            > e.g., 'cat very-long-file | most'
+  passwd               Change user password
+  pwgen                Password generator
+  reboot               Restart the device
+  reset                Reset the shell prompt if it gets garbled
+
+$(h2 "Network Tools")
+  ethtool    [-h]      Ethernet stats, and low-level MAC/PHY settings
+  traceroute [-h]      Trace the route ip packets follow going to a host
+  tcpdump    [-h]      Display network packet headers in real-time
+  arping     [-h]      Ping hosts by ARP requests/replies
+  fping      [-h]      Send ICMP ECHO_REQUEST packets to multiple hosts
+  ping       [-h]      Send ICMP ECHO_REQUEST packets to a network host
+  lynx URL   [-h]      The text mode web browser
+  netcalc    [-h]      Calculate IP network settings from a IP address
+  netcat     [-h]      NetCat - TCP/IP swiss army knife (alias: nc)
+  socat      [-h]      Multipurpose socket relay program
+  ttyd       [-h]      Sharing a terminal over the web
+
+  ifconfig   [--help]  See/Reconfigure available network interfaces
+  route      [--help]  Edit the kernel's routing tables
+
+  ifup | ifdown IFACE  Bring up/down interfaces in /etc/network/interfaces
+
+  ip [link|addr]       Manage available network interfaces
+  ip [rule|route]      Manage routing tables
+  bridge [link|vlan]   Manage bridge ports and VLANs
+
+  scp                  Securely copy a file to a remote host file system
+  tftp                 Copy a file to/from a remote host
+  ftpput               Store a local file on a remote machine via FTP
+  ftpget               Retrieve a remote file via FTP
+  wget                 Get a file using HTTP or FTP from a remote host
+
+$(h2 "Overview Commands")
+  df -h                List disk usage (in human readable format)
+  free                 List memory usage
+  ps                   List running processes
+  show [arg]           Show system status, see 'show help' for more info
+  top                  Displays CPU usage and top list of running tasks
+
+$(h2 "Interesting Files")
+  /etc/default/svc     Command line args for service 'svc' (see above)
+  /etc/rc.local        Local setup, runs after all services have started
+  /etc/network/        Directory of networking setup, see 'help net'
+
+$(h2 "Example Commands")
+  cd   /tmp; wget ftp://192.168.55.43/file && cat file
+  cd   /var/log; tftp -p -l messages 192.168.55.43
+  cat  /proc/net/arp
+  edit /etc/network/interfaces
+
+$(h2 "See Also")
+  help edit            Tutorial on VI and Mg editors
+  help net             Network set up introduction
+  setup                User friendly setup and diagnostic tool
+EOF
+}
+
+vi()
+{
+	cat <<EOF
+$(h1 "Visual Editor (vi)")
+Vi is the de facto standard editor in UNIX systems.  It comes with two modes:
+
+  - $(em "Command mode (default):") administrative tasks such as saving files,
+    executing commands, moving the cursor, cutting and pasting lines or words,
+    as well as finding and replacing.  $(em "Return to command mode with Esc")
+
+  - $(em "Insert mode:") Everything that's typed in this mode is interpreted as
+    input and placed in the file.
+
+$(h2 "Navigation commands")
+
+  h - move the cursor one character to the left
+  j - move the cursor down one character
+  k - mode the cursor up one character
+  l - move the cursor right one character
+  b - move to beginning of word, or previous word
+  w - move to next word
+  0 - move to beginning of line
+  $ - move to end of line
+ :0 - move to beginning of file
+  G - move to end of file
+
+$(h2 "Editing commands")
+
+  u - undo last operation
+  x - delete the character the cursor is on
+ cw - change word, from position of cursor
+ dw - delete to end of word
+ dd - delete the line the character is on
+  p - paste (line, word, or char) after cursor
+  P - paste (line, word, or char) before cursor
+
+$(h2 "Saving and quit commands")
+
+  :w            - save the current file
+  :w filename   - save a copy of the file named filename
+  :w!           - try to save the file, even if it is read only
+  :wq           - save and quit vi
+  ZZ            - save and quit vi
+  :wq!          - try to save the file if it is read only, quit if successful
+  :wq filename  - save a copy of the file named filename and quit
+  :wq! filename - save a copy of the file named filename and quit,
+                  override read only permissions if possible
+  :q            - quit vi
+  :q!           - quit vi even if the file has unsaved changes
+
+$(h2 "Enter insert mode")
+
+  a - append new text after the cursor
+  i - insert text before the cursor
+  o - open a new line below the cursor
+  O - open a new line above the cursor
+
+> Return to command mode with Esc
+
+EOF
+}
+
+emacs()
+{
+	cat <<EOF
+$(h1 "Micro Emacs (mg)")
+Mg is a bit more user-friendly than vi.  It has the same familiar interface
+as Notepad, but with slightly different keybindings.
+
+$(h2 "Introduction")
+
+Most commands involve using the Control ("Ctrl") or the Meta ("Alt") key.
+The following conventions are used in the online help:
+
+  C-<chr>   means hold down the Control key while typing the character <chr>
+  M-<chr>   means hold down the Alt key while typing the character <chr>
+
+If you don't have a Meta/Alt key, you can use Esc instead.  Press and release
+the Esc key and then type <chr>. This is equivalent to M-<chr>.
+
+$(h2 "Navigation")
+
+Though arrow keys, Home/End, and PgUp/PgDn usually work, using Mg over serial
+console can sometimes cause these keys to be mismapped by terminal program.
+
+  C-f          Move forward one character (can also use right arrow key)
+  C-b          Move backward one character (can also use left arrow key)
+  C-p          Move up one line (can also use up arrow key)
+  C-n          Move down one line (can also use down arrow key)
+  M-f          Move forward one word
+  M-b          Move backward one word
+  C-a          Move to beginning of line (can also use Home key)
+  C-e          Move to end of line (can also use End key)
+  C-v          Move forward one page (can also use PgDn/Page Down key)
+  M-v          Move backward one page (can also use PgUp/Page Up key)
+  M-<          Move to beginning of file
+  M->          Move to end of file
+  C-x g        Move to line number
+
+$(h2 "Editing")
+
+All edit commands that kill (cut) text is placed in a kill ring (clipboard).
+Note: when marking text, there is no visual mark.
+
+  C-_          Undo, also C-x u
+  M-%          Replace word/string in file, from cursor position
+  M-q          Reformat paragraph (set fill column with C-x f)
+  C-s          Search forward (type C-s again to find next)
+  C-r          Reversed search
+  C-Space      Set beginning of mark (beginning of selected text)
+  C-x C-x      Jump back and forth between mark and cursor position
+  C-x h        Mark whole buffer
+  C-w          Wipe (cut) region from mark to cursor position
+  M-w          Copy region from mark to cursor position
+  C-y          Yank (paste) text from kill ring
+  C-k          Kill (cut) to end of line
+  M-Backspace  Kill (delete) previous word
+  M-d          Kill (delete) next word
+  C-d          Delete character to the right
+  C-o          Open new line at cursor
+
+$(h2 "General Commands")
+
+  C-g          Abort current command
+  C-l          Recenter buffer on current line
+  C-h b        List all keybindings
+  M-!          Run shell command, output in new buffer
+  C-z          Suspend Mg, return to shell, use 'fg' to get back
+  C-x C-f      Open file
+  C-x C-i      Insert file at cursor position
+  C-x C-s      Save file
+  C-x s        Save file (interactive)
+  C-x k        Kill (close) file
+  C-x C-b      List open buffers (files)
+  C-x b        Switch to another buffer
+  C-x C-c      Exit
+
+$(h2 "Window Commands")
+
+  C-x 0        Unsplit, keep other window
+  C-x 1        Unsplit, keep this window
+  C-x 2        Split window in two
+  C-x o        Go to other window
+  C-x p        Go to previous window
+  C-x n        Go to next window
+  C-x ^        Enlarge this split
+
+EOF
+}
+
+editor()
+{
+	case $1 in
+		vi)
+			vi
+			;;
+		ed* | em* | mg)
+			emacs
+			;;
+		*)
+			vi
+			emacs
+			cat <<EOF
+$(h1 "Summary")
+Use Mg or GNU Nano if you are a beginner.  The system is set up to so you can
+use the 'edit' command, which will start GNU Nano:
+
+    edit /etc/rc.local                   # Starts GNU Nano
+
+EOF
+			;;
+	esac
+}
+
+networking()
+{
+	cat <<EOF
+$(h1 "Networking")
+This section details how to set up everything from basic to advanced networking.
+Topics covered include:
+
+ - Static vs Dynamic Addresses
+ - VLAN Interfaces
+ - Bridging Interfaces
+ - Link Aggregation (bonding)
+ - Persistent Configuration
+
+Please note, the terms 'port' and 'interface' may be used interchangably in
+the following text (and elsewher online as well).  Usually the term 'port' is
+reserved for Ethernet links attached to a switch or bridge, while the term
+'interface' more generically refers to the physical interface in a system.
+
+
+$(h2 "Static vs Dynamic Addresses")
+
+An IPv4 address consists of four "octets" separated by periods.  A static IPv4
+address can look like this:
+
+    192.168.1.42
+
+However, for networking to function properly, a device usually needs a netmask,
+default route, NTP server, and at least one DNS address.  Setting all these up
+statically is a lot of work to maintain, in particular with many devices.
+
+For both IPv4 and IPv6 there is an alternative called DHCP.  It is a dynamic
+protocol where a server on request from a client device hands out a "lease" of
+an IP address, as well as lot of other network parameters, including but not
+limited to the ones already mentioned.  A client device can give hints to the
+server, e.g., its hostname, MAC address (default), or other client identifier.
+It is up to the server to honor these hints or not, but it is very common to
+set up the server to honor the client's hostname and automatically update the
+central name server (DNS) when the client is online.
+
+        |  There are many other interesting aspects to DHCP not covered here.
+        |  For instance, DHCP relay servers (proxies), that can be used to
+        |  forward DHCP requests from very large networks to a central server.
+        |  Some relay "agents" even support something called Option 82, which
+        |  when running on a simple switch, can attach port and relay info to
+        |  the client's DHCP request -- allowing the server to assign an IP
+        |  address per port, even on remote switches (with a relay agent).
+
+When your interface is setup with DHCP, use the 'ifconfig' or 'ip addr' tools
+to see which address you got, if needed (see next section).
+
+In cases when the DHCP client cannot find a DHCP server, and thus not obtain a
+lesae, the system falls back to set a link-local address (169.254.*.*).  This
+can be disabled by editing the file /etc/dhcpcd.conf, adding:
+
+    noipv4ll
+
+A link-local address is however very useful, in particular in combination with
+mDNS to discover and access a device you do not know, or do not want to know,
+the IP address to.  See more in the next section.
+
+
+$(h2 "DNS and mDNS")
+
+Managing a central DNS is both painful and time consuming, most networks, and
+in particular industrial, therefore only set up a DNS for static servers and
+resources.  Leaving end devices, switches, and in many cases even routers,
+without a human-friendly name on the network.  This have misled many to think
+that they need to know the IP address, and often opt for static addresses on
+equipment.  Meaning many devices out-of-the-box have a static address set that
+need to be manually changed before the device is deployed on the network.
+
+A less time consuming, and human-friendly, way is to enable mDNS (multicast
+DNS).  With this protocol the device notifies all neighbors on the same LAN
+of how to reach it:
+
+    "Hello everyone, my address is 169.254.47.11, you can call me device.local"
+
+Any other device that also has mDNS enabled can then automaticall update a
+local database of name-to-address mappings.  Usually the name sent out is
+the device's hostname.  (It is up to the device manufacturer to set a useful
+default hostname, i.e., model-01-02-03, where the suffix is the last octets
+of the base MAC address, from the product label on the case.)
+
+As you can see, in combination with a link-local address (previous section)
+mDNS is a very attractive combination that greatly simplify device management.
+
+Tools:
+
+    avahi-browse -a
+    ping foo.local
+
+mDNS, or more correctly mDNS-SD, is also used for *Service Discovery*.  E.g.,
+a printer can publish IPP records with meta data on the printer type and model
+or donwload URL for drivers.  Switches and routers usually publish how they
+can be reached: HTTP/HTTPS and SSH.
+
+Note: there are other mechanisms for device discovery.  Microsoft have been
+      slow to adopt mDNS, having relied on their own SSDP protocol.  For the
+      full experince Apple's "Bonjour" can be installed in Windows.
+
+      mDNS is supported in this product and should be enabled by default.  To
+      verify it works, open the Windows File Explorer (Win+E) and scroll to
+      Network in the left-hand menu.  An icon with a matching hostname can be
+      found there which, when clicked, opens up the device's Web Interface.
+      macOS users have mDNS fully integrated by default.  Linux users can use
+      'mdns-scan' or Avahi, as shown above.  The latter two can also just set
+      their web browsers to https://hostname-01-02-03.local
+
+
+$(h2 "VLAN Interfaces")
+
+A VLAN interface in Linux is an "upper" interface, e.g., 'eth0.1'.  It is
+where you set an IP address and interact with th rest of the world.  The
+base/raw/lower interface, here 'eth0', is the physical interface on which
+Ethernet packets ingress and egress with a VLAN tag.  To create 'eth0.1':
+
+    ip link add eth0.1 link eth0 vlan id 1
+
+In Linux a VLAN interface is a "stackable" entity.  Many VLAN interfaces
+can be built on top of each other.  When injecting a packet on the top
+most interface, the kernel adds the corresponding VLAN "tag" when the
+packet goes down the order of stacked interfaces, and then finally hits
+the physical interface and proceeds to egress onto the media.
+
+    ip link add eth0.1.2 link eth0.1 vlan id 2
+
+Injecting a packet on 'eth0.1.2' creates a double-tagged VLAN frame when
+the packet egresses 'eth0'.  The outermost tag has VID 1 and the inner
+VID is 2.
+
+VLAN interfaces can be used for many things, here we will focus on their
+use as upper interface on a bridge.
+
+
+$(h2 "Bridging Interfaces")
+
+A bridge is the correct name for a switch.  In the context of this text,
+however, we will use the term to refer to the Linux bridge module in the
+kernel, which implements an advanced software switch.  The Linux bridge
+supports "offloading" many switching functions to an underlying switching
+chipset, when available.  This greatly simplifies managing that switch since
+the same tools one use to manage the bridge will, by extension, also be used
+to manage the switch.
+
+To create a bridge in Linux:
+
+    ip link add br0 type bridge
+
+To add three ports (interfaces) to the bridge we use:
+
+    ip link set eth0 master br0
+    ip link set eth1 master br0
+    ip link set eth2 master br0
+
+Bring all ports and the bridge 'up' and you have a working switch!  Any frame
+injected on eth0 (from the outside) can be switched to either of eth1, eth2,
+*or* br0.  As soon as the bridge has learned where end devices are connected,
+none of the other ports will see the traffic -- like a regular switch.
+
+Note: these ports should not (cannot) have any IP address.  Instead, any IP
+      address is set on 'br0'.  To disable IPv6 link-local address, set the
+      /proc/sys/net/ipv6/conf/eth0/disable_ipv6 sysctl file to '1'.
+
+
+$(h2 "Bridging and VLANs")
+
+A VLAN-aware bridge works the same way, only with VLAN separation taken into
+account.  All communication, as well as MAC address learning, is limited to
+ports in the same VLAN.  The syntax is slightly different and requires a few
+more steps:
+
+    ip link add br0 type bridge vlan_filtering 1
+    ip link set eth0 master br0
+    ip link set eth1 master br0
+    ip link set eth2 master br0
+    ip link set eth3 master br0
+
+To assign ports to different VLANs, and make sure they are regular "access"
+ports (untagged).  We assign eth0 and eth1 to VLAN 1 and the others to VLAN 2:
+
+    bridge vlan add vid 1 dev eth0 pvid untagged
+    bridge vlan add vid 1 dev eth1 pvid untagged
+    bridge vlan add vid 2 dev eth2 pvid untagged
+    bridge vlan add vid 2 dev eth3 pvid untagged
+
+Here's the twist, to be able to reach the bridge (switch) itself from each
+VLAN, we need to ensure the bridge itself is a tagged member of each VLAN:
+
+    bridge vlan add vid 1 dev br0 self
+    bridge vlan add vid 2 dev br0 self
+
+This way we can add VLAN interfaces on top of br0, which we in turn can set
+a static or dynamic IP address on:
+
+    ip link add vlan1 link br0 type vlan id 1
+    ip link add vlan2 link br0 type vlan id 2
+
+The resulting stack of interfaces look like this:
+
+                         :
+                vlan1    :     vlan2       Layer-3 :: IP Networking
+                    \\    :    /            _________________________
+                  .-------------.
+                  |     br0     |          Layer-2 :: Switching
+                  '-------------'          _________________________
+                  /   |  :  |   \\
+              eth0 eth1  :  eth2 eth3      Layer-1 :: Link layer
+                         :
+
+
+$(h2 "Persistent Configuration")
+
+A simple end device can get by with the following in /etc/network/interfaces:
+
+    auto lo
+    iface lo inet loopback
+
+    auto eth0
+    iface eth0 inet dhcp
+
+This brings up both the loopback (required for UNIX networking to function),
+and the (presumed only) Ethernet interface.  The loopback gets its standard
+address, 127.0.0.1, and eth0 will request its IP address using DHCP.
+
+To set up the bridge example (above), is actually quite a lot easier than
+using the command line ip and bridge tools.  Create the file 'bridge':
+
+    edit /etc/network/interfaces.d/bridge
+
+Paste in the following content:
+
+    iface e0
+        bridge-access 1
+    iface e1
+        bridge-access 1
+    iface e2
+        bridge-access 2
+    iface e3
+        bridge-access 2
+
+    auto br0
+    iface br0
+        bridge-ports e0 e1 e2 e3 
+        bridge-vlan-aware yes
+        bridge-stp on
+        bridge-vids 1 2
+
+    auto vlan1
+    iface vlan1 inet dhcp
+        vlan-id 1
+        vlan-raw-device br0
+
+    auto vlan2
+    iface vlan2 inet static
+        vlan-id 2
+        vlan-raw-device br0
+        address 192.168.2.1/24
+
+Notice how 'vlan1' only has a DHCP and 'vlan2' uses a static address.  It is
+possible to combine the two if needed.  Use 'inet dhcp' and add an 'address'
+statement to the iface stanza.
+
+
+$(h2 "Port Classification")
+
+The bundled 'show' script is a very handy tool.  It use several tricks to make
+information about the system more accessible.  On switching capable hardware
+products, switch ports are identified early at system bootstrap and placed in
+the 'port' group.  See 'ip link' output:
+
+    ...
+    4: e0: <BROADCAST,MULTICAST> master br0 state UP $(em "group port")
+           link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
+    ...
+
+When running in Qemu or other hardware it may be useful to manually classify
+certain interfaces as ports.  This can be achieved in many ways, here we show
+two.  First /etc/mactab, which is read at boot to rename interfaces according
+their matching MAC address, one interface per line:
+
+    e0    52:54:00:12:34:56
+    e1    52:54:00:12:34:57
+    e2    52:54:00:12:34:58
+    e3    52:54:00:12:34:59
+
+Another way is to add something like this to /etc/rc.local:
+
+    for port in eth0 eth1 eth3 eth4; do
+        ip link set \$port group port
+    done
+
+
+$(h2 "Interesting Files")
+
+ - /etc/dhcpcd.conf             General DHCP and ZeroConf (LL) settings
+ - /etc/network/interfaces      The original, useful for small setups
+ - /etc/network/interfaces.d/*  Snippets, useful for non-trivial setups
+ - /etc/mactab                  Rename interfaces: 'NAME16CHARS WHITESPACE MAC'
+ - /etc/sysctl.conf             Interface and TCP/IP settings, e.g., routing
+ - /etc/sysctl.d/*              Snippets, useful for per-subsystem settings
+
+
+$(h1 "Summary")
+All persistent networking is set up in /etc/network/interfaces using the
+program ifupdown-ng.  The tools to reconfigure networking at runtime are:
+
+   ifup   [-a] [IFACES]
+   ifdown [-a] [IFACES]
+
+When changing the configuration at runtime you usually have to bring the
+affected interfaces down (ifdown e0 e1 e2 e3), if they were set up with
+/etc/network/interfaces before.  Then do the change, and bring it all up
+again.
+
+Both tools understand dependencies between interfaces, so when a 'ifup -a'
+command is received it brings up all interfaces: adding links to br0 before
+adding VLANs, the vlan1 and vlan2 interfaces on top so it of it all.  Then
+finally it can start the DHCP client on vlan1 and set the static IP address
+on vlan2.
+
+       $(em ">>> Be careful with these tools when logged in remotely! <<<")
+
+EOF
+}
+
+topic()
+{
+	topic=$1
+	[ -n "$1" ] && shift
+
+	case $topic in
+	ed*)
+		# shellcheck disable=SC2068
+		editor $*
+		;;
+	net*)
+		networking
+		;;
+	*)
+		overview
+		;;
+	esac
+}
+
+if [ "$1" = "-p" ]; then
+	shift
+	pager="cat"
+	plain="yes"
+else
+	if command -v most; then
+		pager=most
+	elif command -v less; then
+		pager="less -R"
+	elif command -v more; then
+		pager="more"
+	else
+		pager="cat"
+	fi
+fi
+
+if [ -t 1 ] ; then
+	fn=$(mktemp /tmp/system-help.XXXXXX)
+	# shellcheck disable=SC2086,SC2068
+	topic $@ >"$fn"
+	$pager "$fn"
+	rm "$fn"
+else
+	topic "$*"
+fi

board/common/rootfs/bin/hostnm

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Changes hostname in /etc/hostname and /etc/hosts
+
+current=$(cat /etc/hostname)
+newname=$1
+
+[ -n "$newname" ] || exit 1
+
+sed -i "s/$current/$newname/" /etc/hosts
+sed -i "s/$current/$newname/" /etc/hostname
+
+hostname $newname
+
+initctl touch sysklogd
+initctl touch dnsmasq
+initctl reload

board/common/rootfs/bin/ip

@@ -0,0 +1 @@
+/sbin/ip

board/common/rootfs/bin/show

@@ -0,0 +1,327 @@
+#!/bin/sh
+# Displays basic information about the system
+# shellcheck disable=SC2048,SC2086
+. /etc/os-release
+
+bopt="-c"
+opt="-br"
+all=""
+plain=""
+
+TTY=$(resize)
+eval "$TTY"
+
+# COLUMS and ROWS should be set on the console, if not, use fallback
+if [ -z "$COLUMNS" ]; then
+	if command -v tput; then
+		COLUMNS=$(tput cols)
+	else
+		COLUMNS=80
+	fi
+fi
+
+h1()
+{
+	STR="$*"
+	if [ -n "$plain" ]; then
+		echo "$STR" | tr '[:lower:]' '[:upper:]'
+	else
+		printf "\033[7m%-${COLUMNS}s\033[0m\n" "$STR"
+	fi
+}
+
+h2()
+{
+	STR="$*"
+	if [ -n "$plain" ]; then
+		echo "$STR"
+		echo "$STR" | sed 's/./-/g'
+	else
+		printf "\033[1m%-${COLUMNS}s\033[0m\n" "$STR"
+	fi
+}
+
+dm()
+{
+	if [ -n "$plain" ]; then
+		echo "${*}"
+	else
+		printf "\033[2m%s\033[0m\n" "$*"
+	fi
+}
+
+ul()
+{
+	if [ -n "$plain" ]; then
+		printf "__%s__" "$*"
+	else
+		printf "\033[4%s\033[0m" "$*"
+	fi
+}
+
+em()
+{
+	if [ -n "$plain" ]; then
+		printf "**%s**" "$*"
+	else
+		printf "\033[5m%s\033[0m" "$*"
+	fi
+}
+
+usage()
+{
+	cat <<EOF
+usage:
+  show [opt] cmd
+
+options:
+  -a            Show all, of something
+  -f            Show full output, not brief port/iface listings
+  -h            Show this help text
+  -n            Show output without any footer
+  -p            Show plain output, no bells or whistles
+
+commands:
+  port PORT     Show port configuration and link information
+  ports         Show ports available for bridging
+  vlans         Show port groups in bridge
+  ifaces        Show interfaces and their addresses
+  fdb           Show forwarding database (unicast)
+  mdb           Show multicast forwarding database
+  ip route      Show routing table
+  log [FILE]    Show latest entries from syslog, or other FILE
+  rmon PORT     Show RMON counters for PORT (when applicable)
+  system        Show OS details
+  version       Show OS verson
+EOF
+}
+
+# Usage 1: show port eth0
+# Usage 2: show port
+# Usage 3: show ports
+#
+# The first show ethtool output for 'eth0' (in this case).  The latter
+# two are the same, showing a summary of all interfaces classified as
+# access ports.
+ports()
+{
+	if [ $# -gt 0 ] && [ -e "/sys/class/net/$1" ]; then
+		for port in $*; do
+			ethtool "$port"
+		done
+		return
+	fi
+
+	h1 "PORT             STATE          MAC ADDRESS        FLAGS"
+	if grep -q port /etc/iproute2/group && [ -z "$all" ]; then
+		ip $opt link show group port
+	else
+		ip $opt link show
+	fi
+
+	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
+		dm "______________________________________________________________________________"
+		dm "Use: '[ip|bridge] --help' and '[ip|bridge] link help' for more details."
+	fi
+}
+
+vlans()
+{
+	h1 "INTERFACE         VLAN  FLAGS"
+	bridge $bopt vlan show |tail +2 | awk 'NF { iface=$1; vid=$2; printf("%-16s  %4d  ", iface, vid); for (i=3; i <= NF; i++) printf("%s ", $i); printf("\n"); }'
+	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
+		dm "______________________________________________________________________________"
+		dm "See: 'bridge --help' and 'bridge vlan help' for more details."
+	fi
+}
+
+ifaces()
+{
+	h1 "INTERFACE        STATE          ADDRESS"
+	if [ -n "$all" ]; then
+		ip $opt addr show
+        elif grep -q iface /etc/iproute2/group; then
+                ip $opt addr show group iface
+	else
+		ip $opt addr show |awk '{ if ($1 !~ /eth[0-9]*/ && $1 !~ /.*@NONE/) { print }}'
+	fi
+	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
+		dm "______________________________________________________________________________"
+		dm "See: 'ip --help' and 'ip address help' for more details."
+	fi
+}
+
+log()
+{
+	if [ -n "$1" ] && [ -r "/var/log/$1" ]; then
+		fn="/var/log/$1"
+	else
+		fn="/var/log/syslog"
+	fi
+	if [ -n "$all" ]; then
+		cat $fn
+	else
+		tail -$LINES $fn
+	fi
+	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
+		dm "______________________________________________________________________________"
+		dm "See: 'tail -25 /log/FILE', 'tail -F /log/FILE' to continuously monitor files."
+	fi
+}
+
+rmon()
+{
+	if [ -z "$*" ]; then
+		echo "Missing argument, see 'show port' for available interfaces"
+		exit 1
+	fi
+	for port in $*; do
+		ethtool -S "$port"
+	done
+	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
+		dm "______________________________________________________________________________"
+		dm "See: 'ethtool --help' for more details."
+	fi
+}
+
+rstp()
+{
+	mstpctl showbridge
+	echo "br0 port info"
+	mstpctl showport br0
+}
+
+fdb()
+{
+	bridge $bopt fdb show
+}
+
+mdb()
+{
+	bridge $bopt mdb show
+}
+
+routes()
+{
+	ip $opt route show
+}
+
+igmp()
+{
+	querierctl $@
+}
+
+system()
+{
+	h1 "SYSTEM INFORMATION"
+	echo "System Name        : $(uname -n)"
+	echo "System Boot Mode   : $(cat /tmp/.boot_mode)"
+	echo "System Description : $PRETTY_NAME"
+	echo "System Contact     : $HOME_URL"
+	echo "System Timezone    : $TZ"
+	echo "System Type        : $NAME"
+	echo "System Version     : $(cat /etc/version)"
+	echo "System Arch        : $(uname -m)"
+	echo "Kernel Version     : $(uname -sr)"
+}
+
+version()
+{
+	cat /etc/version
+}
+
+while [ "$1" != "" ]; do
+	case $1 in
+		-a)
+			all=1
+			;;
+		-f)
+			opt=""
+			if [ -n "$plain" ]; then
+				opt="-color=never"
+				bopt="-color=never"
+			fi
+			;;
+		-n)
+			nofoot="yes"
+			;;
+		-p)
+			plain="yes"
+			opt="$opt -color=never"
+			bopt="$bopt -color=never"
+			;;
+		-h)
+			usage
+			exit 0
+			;;
+		*)
+			break
+	esac
+	shift
+done
+
+cmd=$1
+if [ -n "$cmd" ]; then
+	shift
+fi
+
+case $cmd in
+	help)
+		usage
+		;;
+	port*)
+		ports $*
+		;;
+	vlan*)
+		vlans
+		;;
+	fdb)
+		fdb
+		;;
+	mdb)
+		mdb
+		;;
+	if*)
+		ifaces
+		;;
+	ip)
+		cmd=$1
+		shift
+		case $cmd in
+			addr*)
+				ifaces
+				;;
+			route*)
+				routes
+				;;
+			igmp*)
+				igmp $*
+				;;
+			*)
+				usage
+				;;
+		esac
+		;;
+	log)
+		log $1
+		;;
+	rmon)
+		rmon $*
+		;;
+	route*)
+		routes
+		;;
+	span*)
+		rstp
+		;;
+	sys*)
+		system
+		;;
+	ver*)
+		version
+		;;
+	*)
+		usage
+		exit 1
+		;;
+esac

board/common/rootfs/bin/yorn

@@ -0,0 +1,55 @@
+#!/bin/sh
+#set -x
+
+usage()
+{
+    cat <<EOF
+usage:
+  yorn [-h] ["Do you want to run command?" command]
+
+options:
+  -h            Show this help text
+  -p            Show plain output, no bells or whistles
+
+Displays the yes-or-no question and runs command on yes.
+EOF
+}
+
+if [ -z "$1" ]; then
+    usage
+    exit 1
+fi
+
+case $1 in
+    -h)
+	usage
+	exit 0
+	;;
+    -p)
+	plain=1
+	shift
+	;;
+    *)
+	;;
+esac
+
+question=$1
+shift
+command=$*
+if [ -z "$command" ]; then
+    usage
+    exit 1
+fi
+
+if [ -z "$plain" ]; then
+    if dialog --erase-on-exit --colors --defaultno --yesno "\Zb$question\ZB" 0 0; then
+	yorn=y
+    fi
+else
+    # shellcheck disable=SC2162,SC3045
+    read -n 1 -p "$question (y/N): " yorn
+fi
+
+if [ "$yorn" = "y" ] || [ "$yorn" = "Y" ]; then
+    $command
+fi

board/common/rootfs/etc/bash.bashrc

@@ -0,0 +1,11 @@
+# System-wide .bashrc file for interactive bash(1) shells.
+
+# If not running interactively, don't do anything
+[ -z "$PS1" ] && return
+
+# check the window size after each command and, if necessary,
+# update the values of LINES and COLUMNS.
+shopt -s checkwinsize
+
+# Disble built-ins
+enable -n help

board/common/rootfs/etc/dhcpcd.conf

@@ -0,0 +1,51 @@
+# Infix's configuration for dhcpcd.
+# See dhcpcd.conf(5) for details.
+
+# Allow users of this group to interact with dhcpcd via the control socket.
+#controlgroup wheel
+
+# Inform the DHCP server of our hostname for DDNS.
+#hostname
+
+# Use the hardware address of the interface for the Client ID.
+#clientid
+# or
+# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
+# Some non-RFC compliant DHCP servers do not reply with this set.
+# In this case, comment out duid and enable clientid above.
+duid
+
+# Persist interface configuration when dhcpcd exits.
+persistent
+
+# vendorclassid is set to blank to avoid sending the default of
+# dhcpcd-<version>:<os>:<machine>:<platform>
+vendorclassid
+
+# A list of options to request from the DHCP server.
+option domain_name_servers, domain_name, domain_search
+option classless_static_routes
+# Respect the network MTU. This is applied to DHCP routes.
+option interface_mtu
+
+# Request a hostname from the network
+option host_name
+
+# Most distributions have NTP support.
+#option ntp_servers
+
+# Rapid commit support.
+# Safe to enable by default because it requires the equivalent option set
+# on the server to actually work.
+option rapid_commit
+
+# A ServerID is required by RFC2131.
+require dhcp_server_identifier
+
+# Generate SLAAC address using the Hardware Address of the interface
+#slaac hwaddr
+# OR generate Stable Private IPv6 Addresses based from the DUID
+slaac private
+
+# Background immediately, do not wait for DHCP lease (speed up boot process)
+background

board/common/rootfs/etc/dialogrc

@@ -0,0 +1,144 @@
+#
+# Run-time configuration file for dialog
+#
+# Automatically generated by "dialog --create-rc <file>"
+#
+#
+# Types of values:
+#
+# Number     -  <number>
+# String     -  "string"
+# Boolean    -  <ON|OFF>
+# Attribute  -  (foreground,background,highlight?,underline?,reverse?)
+
+# Set aspect-ration.
+aspect = 0
+
+# Set separator (for multiple widgets output).
+separate_widget = ""
+
+# Set tab-length (for textbox tab-conversion).
+tab_len = 0
+
+# Make tab-traversal for checklist, etc., include the list.
+visit_items = OFF
+
+# Shadow dialog boxes? This also turns on color.
+use_shadow = ON
+
+# Turn color support ON or OFF
+use_colors = ON
+
+# Screen color
+screen_color = (WHITE,BLUE,OFF)
+
+# Shadow color
+shadow_color = (BLACK,BLACK,OFF)
+
+# Dialog box color
+dialog_color = (BLACK,CYAN,OFF)
+
+# Dialog box title color
+title_color = (BLACK,CYAN,ON)
+
+# Dialog box border color
+border_color = dialog_color
+
+# Active button color
+button_active_color = (CYAN,BLACK,ON)
+
+# Inactive button color
+button_inactive_color = dialog_color
+
+# Active button key color
+button_key_active_color = (WHITE,BLACK,ON)
+
+# Inactive button key color
+button_key_inactive_color = (WHITE,CYAN,ON)
+
+# Active button label color
+button_label_active_color = button_active_color
+
+# Inactive button label color
+button_label_inactive_color = dialog_color
+
+# Input box color
+inputbox_color = (BLACK,CYAN,OFF)
+
+# Input box border color
+inputbox_border_color = inputbox_color
+
+# Search box color
+searchbox_color = inputbox_color
+
+# Search box title color
+searchbox_title_color = (BLUE,WHITE,ON)
+
+# Search box border color
+searchbox_border_color = (WHITE,WHITE,ON)
+
+# File position indicator color
+position_indicator_color = searchbox_title_color
+
+# Menu box color
+menubox_color = dialog_color
+
+# Menu box border color
+menubox_border_color = dialog_color
+
+# Item color
+item_color = inputbox_color
+
+# Selected item color
+item_selected_color = button_key_active_color
+
+# Tag color
+tag_color = button_inactive_color
+
+# Selected tag color
+tag_selected_color = (CYAN,BLACK,OFF)
+
+# Tag key color
+tag_key_color = button_key_inactive_color
+
+# Selected tag key color
+tag_key_selected_color = (WHITE,BLACK,ON)
+
+# Check box color
+check_color = inputbox_color
+
+# Selected check box color
+check_selected_color = button_key_active_color
+
+# Up arrow color
+uarrow_color = (GREEN,WHITE,ON)
+
+# Down arrow color
+darrow_color = uarrow_color
+
+# Item help-text color
+itemhelp_color = (WHITE,BLACK,OFF)
+
+# Active form text color
+form_active_text_color = button_key_active_color
+
+# Form text color
+form_text_color = (WHITE,CYAN,ON)
+
+# Readonly form item color
+form_item_readonly_color = (CYAN,WHITE,ON)
+
+# Dialog box gauge color
+gauge_color = searchbox_title_color
+
+# Dialog box border2 color
+border2_color = dialog_color
+
+# Input box border2 color
+inputbox_border2_color = inputbox_color
+
+# Search box border2 color
+searchbox_border2_color = inputbox_color
+
+# Menu box border2 color
+menubox_border2_color = dialog_color

board/common/rootfs/etc/dnsmasq.conf

@@ -0,0 +1,14 @@
+# dnsmasq is the system resolver, the file /etc/resolv.conf is
+# managed by openresolv.  DHCP lease, VPN tunnel establishment,
+# and similar events feed servers and configuration to dnsmasq.
+domain-needed
+#interface=lo
+listen-address=127.0.0.1
+enable-dbus
+
+# Generated by openresolv
+resolv-file=/var/lib/misc/resolv.conf
+
+# Include all files in a directory which end in .conf
+conf-dir=/etc/dnsmasq.d/,*.conf
+

board/common/rootfs/etc/finit.conf

@@ -0,0 +1 @@
+set COLORTERM=yes

board/common/rootfs/etc/finit.d/10-infix.conf

@@ -0,0 +1,2 @@
+run [S] /lib/infix/nameif -- Probing network interfaces
+run if:<!boot/netconf> [S] /lib/infix/swup --

board/common/rootfs/etc/finit.d/available/sshd.conf

@@ -0,0 +1,2 @@
+task [S] /lib/infix/ssh-hostkeys --
+service [2345789] <usr/ssh-hostkeys> /usr/sbin/sshd -D -- OpenSSH daemon

board/common/rootfs/etc/finit.d/enabled/sshd.conf

@@ -0,0 +1 @@
+../available/sshd.conf

board/common/rootfs/etc/fstab

@@ -0,0 +1,25 @@
+# Virtual filesystems
+devtmpfs	/dev		devtmpfs	defaults		0	0
+mkdir#-p	/dev/pts	helper		none			0	0
+devpts		/dev/pts	devpts		mode=620,ptmxmode=0666	0	0
+mkdir#-p	/dev/shm	helper		none			0	0
+tmpfs		/dev/shm	tmpfs		mode=0777		0	0
+proc		/proc		proc		defaults		0	0
+tmpfs		/tmp		tmpfs		mode=1777,nosuid,nodev	0	0
+tmpfs		/run		tmpfs		mode=0755,nosuid,nodev	0	0
+sysfs		/sys		sysfs		defaults		0	0
+debugfs	/sys/kernel/debug	debugfs		nofail			0	0
+cfgfs		/config		configfs	nofail,noauto		0	0
+
+# Optional host share when running in Qemu
+hostfs		/host		9p		nofail,cache=none,msize=16384	0	0
+
+# The chosen backing storage for the overlays placed on /cfg, /etc,
+# /home, /root, and /var, are determined dynamically by /lib/infix/mnt
+# depending on the available devices.
+mnttmp		/mnt/tmp	tmpfs		defaults			0	0
+LABEL=aux	/mnt/aux	auto		noatime,nodiratime,noauto	0	0
+LABEL=var	/mnt/var	auto		noatime,nodiratime,noauto	0	0
+LABEL=cfg	/mnt/cfg	auto		noatime,nodiratime,noauto	0	0
+hostfs		/mnt/host	9p		cache=none,msize=16384,noauto	0	0
+/lib/infix/mnt# /cfg		helper		none				0	0

board/common/rootfs/etc/fw_env.config

@@ -0,0 +1 @@
+/mnt/aux/uboot.env 0 0x4000

board/common/rootfs/etc/iproute2/group

@@ -0,0 +1,2 @@
+1 port
+2 iface

board/common/rootfs/etc/issue

@@ -0,0 +1 @@
+\s (\l)

board/common/rootfs/etc/issue.net

@@ -0,0 +1 @@
+\s

board/common/rootfs/etc/mactab

@@ -0,0 +1,3 @@
+# /etc/mactab: rename interfaces, use 'eN' to classify as bridge ports
+# MAC			IFNAME
+# 01:02:03:c0:ff:ee	e0

board/common/rootfs/etc/mdev.conf

@@ -0,0 +1,112 @@
+# NetBox mdev.conf based on https://github.com/slashbeast/mdev-like-a-boss/
+
+# Syntax:
+# [-]devicename_regex user:group mode [=path]|[>path]|[!] [@|$|*cmd args...]
+# [-]$ENVVAR=regex    user:group mode [=path]|[>path]|[!] [@|$|*cmd args...]
+# [-]@maj,min[-min2]  user:group mode [=path]|[>path]|[!] [@|$|*cmd args...]
+#
+# [-]: do not stop on this match, continue reading mdev.conf
+# =: move, >: move and create a symlink
+# !: do not create device node
+# @|$|*: run cmd if $ACTION=remove, @cmd if $ACTION=add, *cmd in all cases
+
+# support module loading on hotplug
+$MODALIAS=.*    root:root 660 @modprobe -b "$MODALIAS"
+
+# null may already exist; therefore ownership has to be changed with command
+null        root:root 666 @chmod 666 $MDEV
+zero        root:root 666
+full        root:root 666
+random      root:root 444
+urandom     root:root 444
+hwrandom    root:root 444
+grsec       root:root 660
+
+# Kernel-based Virtual Machine.
+#kvm     root:kvm 660
+
+# vhost-net, to be used with kvm.
+#vhost-net   root:kvm 660
+
+kmem        root:root 640
+mem         root:root 640
+port        root:root 640
+# console may already exist; therefore ownership has to be changed with command
+console     root:tty 600 @chmod 600 $MDEV
+ptmx        root:tty 666
+pty.*       root:tty 660
+
+# Typical devices
+tty         root:tty 666
+tty[0-9]*   root:tty 660
+vcsa*[0-9]* root:tty 660
+ttyS[0-9]*  root:dialout 660
+
+# block devices
+ram([0-9]*)        root:disk 660 >rd/%1
+loop([0-9]+)       root:disk 660 >loop/%1
+sr[0-9]*           root:cdrom 660 @ln -sf $MDEV cdrom
+fd[0-9]*           root:floppy 660
+#SUBSYSTEM=block;.* root:disk 660 */lib/infix/storage-device
+
+# Run settle-nics every time new NIC appear.
+# If you don't want to auto-populate /etc/mactab with NICs,
+# run 'settle-nis' without '--write-mactab' param.
+#-SUBSYSTEM=net;DEVPATH=.*/net/.*;.*     root:root 600 @/lib/infix/settle-nics --write-mactab
+
+net/tun[0-9]*   root:netdev 660
+net/tap[0-9]*   root:root 600
+
+# alsa sound devices and audio stuff
+#SUBSYSTEM=sound;.*  root:audio 660 @/lib/infix/sound-control
+
+adsp        root:audio 660 >sound/
+audio       root:audio 660 >sound/
+dsp         root:audio 660 >sound/
+mixer       root:audio 660 >sound/
+sequencer.* root:audio 660 >sound/
+
+
+# raid controllers
+cciss!(.*)  root:disk 660 =cciss/%1
+ida!(.*)    root:disk 660 =ida/%1
+rd!(.*)     root:disk 660 =rd/%1
+
+
+fuse        root:root 666
+
+card[0-9]   root:video 660 =dri/
+
+agpgart     root:root 660 >misc/
+psaux       root:root 660 >misc/
+rtc         root:root 664 >misc/
+
+# input stuff
+SUBSYSTEM=input;.* root:plugdev 660
+
+# v4l stuff
+vbi[0-9]    root:video 660 >v4l/
+video[0-9]  root:video 660 >v4l/
+
+# dvb stuff
+dvb.*       root:video 660
+
+# drm etc
+dri/.*      root:video 660
+
+# Don't create old usbdev* devices.
+usbdev[0-9].[0-9]* root:root 660 !
+
+# Stop creating x:x:x:x which looks like /dev/dm-*
+[0-9]+\:[0-9]+\:[0-9]+\:[0-9]+ root:root 660 !
+
+# /dev/cpu support.
+microcode       root:root 600 =cpu/
+cpu([0-9]+)     root:root 600 =cpu/%1/cpuid
+msr([0-9]+)     root:root 600 =cpu/%1/msr
+
+# Populate /dev/bus/usb.
+#SUBSYSTEM=usb;DEVTYPE=usb_device;.* root:root 660 */lib/infix/dev-bus-usb
+
+# Catch-all other devices, Right now useful only for debuging.
+#.* root:root 660 */lib/infix/catch-all

board/common/rootfs/etc/mg

@@ -0,0 +1 @@
+make-backup-files 0

board/common/rootfs/etc/motd

@@ -0,0 +1 @@
+Note: use help, show, and setup commands to set up and diagnose the system.

board/common/rootfs/etc/network/interfaces

@@ -0,0 +1,6 @@
+# interfaces(5) file used by ifup(8) and ifdown(8)
+auto lo
+iface lo inet loopback
+
+source-directory /etc/network/interfaces.d
+

board/common/rootfs/etc/nginx/nginx.conf

@@ -0,0 +1,122 @@
+
+#user  nobody;
+worker_processes  1;
+
+#error_log  logs/error.log;
+#error_log  logs/error.log  notice;
+#error_log  logs/error.log  info;
+
+#pid        logs/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+    #                  '$status $body_bytes_sent "$http_referer" '
+    #                  '"$http_user_agent" "$http_x_forwarded_for"';
+
+    #access_log  logs/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    #keepalive_timeout  0;
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    server {
+        listen       80;
+        server_name  localhost;
+
+        #charset koi8-r;
+
+        #access_log  logs/host.access.log  main;
+
+        location / {
+            root   html;
+            index  index.html index.htm;
+        }
+
+        location /restconf/ {
+            fastcgi_pass unix:/var/run/clixon/restconf.sock;
+            include fastcgi_params;
+        }
+
+        #error_page  404              /404.html;
+
+        # redirect server error pages to the static page /50x.html
+        #
+        error_page   500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   html;
+        }
+
+        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
+        #
+        #location ~ \.php$ {
+        #    proxy_pass   http://127.0.0.1;
+        #}
+
+        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
+        #
+        #location ~ \.php$ {
+        #    root           html;
+        #    fastcgi_pass   127.0.0.1:9000;
+        #    fastcgi_index  index.php;
+        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
+        #    include        fastcgi_params;
+        #}
+
+        # deny access to .htaccess files, if Apache's document root
+        # concurs with nginx's one
+        #
+        #location ~ /\.ht {
+        #    deny  all;
+        #}
+    }
+
+
+    # another virtual host using mix of IP-, name-, and port-based configuration
+    #
+    #server {
+    #    listen       8000;
+    #    listen       somename:8080;
+    #    server_name  somename  alias  another.alias;
+
+    #    location / {
+    #        root   html;
+    #        index  index.html index.htm;
+    #    }
+    #}
+
+
+    # HTTPS server
+    #
+    #server {
+    #    listen       443 ssl;
+    #    server_name  localhost;
+
+    #    ssl_certificate      cert.pem;
+    #    ssl_certificate_key  cert.key;
+
+    #    ssl_session_cache    shared:SSL:1m;
+    #    ssl_session_timeout  5m;
+
+    #    ssl_ciphers  HIGH:!aNULL:!MD5;
+    #    ssl_prefer_server_ciphers  on;
+
+    #    location / {
+    #        root   html;
+    #        index  index.html index.htm;
+    #    }
+    #}
+
+}

board/common/rootfs/etc/pdmenurc

@@ -0,0 +1,76 @@
+#!/usr/bin/pdmenu
+
+title:Setup & Diagnostics
+
+color:desktop:blue:blue
+color:title:blue:white
+color:base:blue:white
+
+menu:main:Main Menu:Use arrow keys, Enter, Escape, and Q to navigate
+	show:_System Settings..::system
+	show:_Network Settings..::network
+	show:_Tools..::tools
+	nop
+	exec:Show _fdb:truncate:show -p fdb
+	exec:Show _mdb:truncate:show -p mdb
+	exec:Show _ports:truncate:show -p ports
+	exec:Show _vlans:truncate:show -p  vlans
+	exec:Show _interfaces:truncate:show -p iface
+	exec:Show _routes:truncate:show -p route
+	nop
+	exec:Show _online users:truncate:w
+	exec:Show _CPU Load::top
+	nop
+	show:_Help..::help
+	exit:_Quit
+
+menu:help:Help:Help Menu
+	exec:Introduction:truncate:/bin/help -p
+	exec:Editors:truncate:/bin/help -p edit
+	exec:Networking:truncate:/bin/help -p net
+	nop
+	exit:_Main menu..
+
+menu:network:Network:Network Settings
+	exec:Show all _links:truncated:ip -br link
+	exec:Show all _addresses:truncated:ip -br address
+	exec:Show managed _interfaces:truncated:ifparse --all
+	nop
+	exec:Take _interface down:edit:ifdown ~Enter name of interface to take down:~
+	exec:Take _interface up:edit:ifup ~Enter name of interface to take up:~
+	nop
+	exec:Edit _dhcpcd.conf::edit /etc/dhcpcd.conf
+	exec:Edit _dnsmasq.conf::edit /etc/dnsmasq.conf
+	exec:Edit _interfaces::edit /etc/network/interfaces
+	exec:Edit _mactab::edit /etc/mactab
+	exec:Edit _sysctl.conf::edit /etc/sysctl.conf
+	nop
+	exit:_Main menu..
+
+menu:system:System:System Settings
+	exec:List _log files:truncate:ls -l /var/log
+	exec:Show _log file:edit,truncate:show -p -a log ~Show logfile, Enter for syslog:syslog~
+	exec:Change _hostname:edit:hostnm ~Enter new hostname \[-a-zA-Z0-9\]:~
+	exec:Change your _password::passwd
+	exec:Edit _rc.local::edit /etc/rc.local
+	nop
+	exec:_Show State of Services:truncate:initctl -p
+	exec:_Reload services:truncate:initctl reload;sleep 2;initctl -p
+	exec:Show _available services:truncate:initctl -p ls
+	exec:_Enable service:edit:initctl enable ~Enter name of service (filename) to enable:~
+	exec:_Disable service:edit:initctl disable ~Enter name of service (filename) to disable:~
+	nop
+	exec:_Change Operating Mode::chom
+	exec:_Factory Reset::yorn "Reboot and factory reset device, are you sure?" factory -y
+	nop
+	exit:_Main menu..
+
+menu:tools:Tools:Tools
+	exec:_Ping:edit,pause:ping ~Enter address (IP or name) to ping:~
+	exec:_Shell Prompt::/bin/bash --login
+	exec:_SSH:edit,pause:ssh ~Enter [username@]address (IP or name) to SSH to:~
+	exec:_Telnet:edit,pause:telnet ~Enter address (IP or name) to telnet to:~
+	exec:_Traceroute:edit,pause:mtr ~Enter address (IP or name) to traceroute to:~
+	exec:Browse _WWW:edit,pause:lynx ~Enter URL to browse:~
+	nop
+	exit:_Main menu..

board/common/rootfs/etc/profile

@@ -0,0 +1,27 @@
+export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
+
+if [ "$PS1" ]; then
+	if [ "${BASH-}" ] && [ "$BASH" != "/bin/sh" ]; then
+		if [ -f /etc/bash.bashrc ]; then
+			. /etc/bash.bashrc
+		fi
+	else
+		if [ "`id -u`" -eq 0 ]; then
+			export PS1='# '
+		else
+			export PS1='$ '
+		fi
+	fi
+
+	export COLORTERM=truecolor
+fi
+
+export EDITOR='/bin/vi'
+
+# Source configuration files from /etc/profile.d
+for i in /etc/profile.d/*.sh ; do
+	if [ -r "$i" ]; then
+		. $i
+	fi
+done
+unset i

board/common/rootfs/etc/profile.d/convenience.sh

@@ -0,0 +1,19 @@
+alias l='ls -CF'
+alias la='ls -A'
+alias ll='ls -alF'
+alias ls='ls --color=auto'
+
+export EDITOR=/usr/bin/edit
+alias vim='vi'
+alias view='vi -R'
+alias emacs='mg'
+alias sensible-editor=edit
+alias sensible-pager=pager
+
+alias ip='ip --color=auto'
+alias ipb='ip -br'
+alias ipaddr='ip addr'
+alias iplink='ip link'
+alias bridge='bridge --color=auto'
+alias setup='pdmenu; clear'
+alias cli='clixon_cli'

board/common/rootfs/etc/profile.d/ps1.sh

@@ -0,0 +1 @@
+PS1='\u@\h:\w\$ '

board/common/rootfs/etc/profile.d/resize.sh

@@ -0,0 +1,2 @@
+TTY=`resize`
+eval $TTY

board/common/rootfs/etc/rc.local

@@ -0,0 +1,19 @@
+#!/bin/sh
+# This file is run at the very end of runlevel S (bootstrap)
+#
+# Note: 1) not all initctl commands are allowed here
+#       2) to enable IP forwarding, use /etc/sysctl.conf, or /etc/sysctl.d/
+#       3) ensure the script calls `exit 0` at the end
+#
+
+# Uncomment to classify all interfaces starting with 'eth' as ports.
+#for port in $(ip -br link |awk '/eth/{print $1}'); do
+#	ip link set $port group port
+#done
+
+# Uncomment to enable IP masquerading (NAT) of all traffic egressing
+# the WAN interface, here eth0.  E.g., if you are a router for your
+# LAN on eth1.
+#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+
+exit 0

board/common/rootfs/etc/resolvconf.conf

@@ -0,0 +1,10 @@
+# dnsmasq is the system resolver
+name_servers="127.0.0.1"
+
+resolv_conf=/etc/resolv.conf
+resolv_conf_options="edns0 trust-ad"
+
+# dnsmasq specific settings and list of
+# nameservers in non-standard locations
+dnsmasq_conf=/etc/dnsmasq.d/resolvconf.conf
+dnsmasq_resolv=/var/lib/misc/resolv.conf

board/common/rootfs/etc/resolvconf/interface-order

@@ -0,0 +1 @@
+lo

board/common/rootfs/etc/ssh/sshd_config

@@ -0,0 +1 @@
+Include /etc/ssh/sshd_config.d/*.conf

board/common/rootfs/etc/ssh/sshd_config.d/cli.conf

@@ -0,0 +1 @@
+Subsystem cli /usr/bin/clixon_cli

board/common/rootfs/etc/ssh/sshd_config.d/var-keys.conf

@@ -0,0 +1,3 @@
+HostKey /var/lib/ssh/ssh_host_rsa_key
+HostKey /var/lib/ssh/ssh_host_ecdsa_key
+HostKey /var/lib/ssh/ssh_host_ed25519_key

board/common/rootfs/etc/sysctl.conf

@@ -0,0 +1,68 @@
+#
+# /etc/sysctl.conf - Configuration file for setting system variables
+# See /etc/sysctl.d/ for additional system variables.
+# See sysctl.conf (5) for information.
+#
+
+#kernel.domainname = example.com
+
+# Uncomment the following to stop low-level messages on console
+#kernel.printk = 3 4 1 3
+
+###################################################################
+# Functions previously found in netbase
+#
+
+# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
+# Turn on Source Address Verification in all interfaces to
+# prevent some spoofing attacks
+#net.ipv4.conf.default.rp_filter=1
+#net.ipv4.conf.all.rp_filter=1
+
+# Uncomment the next line to enable TCP/IP SYN cookies
+# See http://lwn.net/Articles/277146/
+# Note: This may impact IPv6 TCP sessions too
+#net.ipv4.tcp_syncookies=1
+
+# Uncomment the next line to enable packet forwarding for IPv4
+#net.ipv4.ip_forward=1
+
+# Uncomment the next line to enable packet forwarding for IPv6
+#  Enabling this option disables Stateless Address Autoconfiguration
+#  based on Router Advertisements for this host
+#net.ipv6.conf.all.forwarding=1
+
+
+###################################################################
+# Additional settings - these settings can improve the network
+# security of the host and prevent against some network attacks
+# including spoofing attacks and man in the middle attacks through
+# redirection. Some network environments, however, require that these
+# settings are disabled so review and enable them as needed.
+#
+# Do not accept ICMP redirects (prevent MITM attacks)
+#net.ipv4.conf.all.accept_redirects = 0
+#net.ipv6.conf.all.accept_redirects = 0
+# _or_
+# Accept ICMP redirects only for gateways listed in our default
+# gateway list (enabled by default)
+# net.ipv4.conf.all.secure_redirects = 1
+#
+# Do not send ICMP redirects (we are not a router)
+#net.ipv4.conf.all.send_redirects = 0
+#
+# Do not accept IP source route packets (we are not a router)
+#net.ipv4.conf.all.accept_source_route = 0
+#net.ipv6.conf.all.accept_source_route = 0
+#
+# Log Martian Packets
+#net.ipv4.conf.all.log_martians = 1
+#
+
+###################################################################
+# Magic system request Key
+# 0=disable, 1=enable all, >1 bitmask of sysrq functions
+# See https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html
+# for what other values do
+#kernel.sysrq=438
+

board/common/rootfs/etc/syslog.d/debug.conf

@@ -0,0 +1,3 @@
+*.=debug;\
+auth,authpriv.none;\
+news.none;mail.none	-/var/log/debug

board/common/rootfs/etc/syslog.d/profeth.conf

@@ -0,0 +1 @@
+local7.*		-/var/log/profinet.log

board/common/rootfs/etc/tmpfiles.d/chrony.conf

@@ -0,0 +1 @@
+d  /var/lib/chrony	0755 chrony chrony

board/common/rootfs/etc/tmpfiles.d/nginx.conf

@@ -0,0 +1,2 @@
+d  /var/cache/nginx	0755 www-data www-data
+

board/common/rootfs/etc/tmpfiles.d/snmpd.conf

@@ -0,0 +1 @@
+d  /var/run/agentx	- - -

board/common/rootfs/lib/infix/mnt

@@ -0,0 +1,120 @@
+#!/bin/sh
+
+# Called from /etc/fstab to ensure we have something writable mounted
+# at /cfg, /etc, /home, /root, and /var.
+#
+# /mnt/cfg is used to store device modifications made to /etc, /home,
+# /root.
+#
+# /mnt/var is used as the backins store for /var. If /mnt/var is not
+# available, /mnt/cfg will still be be used to persist /var/lib.
+#
+# If a disk partiion with the corresponding label ("cfg"/"var") is
+# available, that is used to persist changes to the aforementioned
+# directories. Otherwise fall back to a tmpfs based RAM disk. This
+# effectively brings up the system with the default configuration, but
+# obviously any subsequent configuration is ephemeral.
+
+set -e
+
+nm=$(basename $0)
+err=0
+opt="-k"
+
+mount_rw()
+{
+    # If something is already setup, leave it be.
+    mountpoint -q "/$1" && return 0
+
+    # TODO: Also look for UBI partitions
+    mount LABEL="$1" 2>/dev/null && return 0
+
+    return 1
+}
+
+# mkdir -p -m 0755 only applies to the deepest directory
+# shellcheck disable=SC2174
+mount_overlay()
+{
+    tag="$1"
+    src="$2"
+    dst="$3"
+    u="$src/infix/$tag.u"
+    w="$src/infix/$tag.w"
+
+    mkdir -p -m 0755 "$u"
+    mkdir -p -m 0755 "$w"
+
+    mount -t overlay "$tag-overlay" "$dst" \
+	  -o lowerdir="$dst",upperdir="$u",workdir="$w"
+}
+
+# Fall back to console logging if sysklogd is too old
+if ! logger -? |grep -q "Log to kernel"; then
+    opt="-c"
+fi
+
+if ! mount_rw aux >/dev/null 2>&1; then
+    logger $opt -p user.warn -t "$nm" \
+	   "No auxiliary partition found, software updates not supported."
+fi
+
+varsrc=/mnt/var
+if ! mount_rw var >/dev/null 2>&1; then
+    logger $opt -p user.warn -t "$nm" \
+	   "No persistent storage found for /var, only /var/lib is persisted."
+    varsrc=/mnt/tmp
+    vlibsrc=/mnt/cfg
+fi
+
+cfgsrc=/mnt/cfg
+etcsrc=/mnt/tmp
+if ! mount_rw cfg >/dev/null 2>&1; then
+    err=1
+
+    logger $opt -p user.crit -t "$nm" \
+	   "No persistent storage found for /cfg, falling back to tmpfs."
+
+    cfgsrc=/mnt/tmp
+
+    # Even if /mnt/var isn't available, if /mnt/cfg isn't either, then
+    # there's no point in overlaying one ramdisk on top of another.
+    vlibsrc=
+else
+    # Check for factory reset
+    if [ -f /mnt/cfg/infix/.reset ]; then
+	logger $opt -p user.crit -t "$nm" "Resetting to factory defaults."
+	rm -rf /mnt/cfg/infix /mnt/var/infix
+	sync
+    fi
+
+    if /lib/infix/use-etc; then
+	etcsrc=/mnt/cfg
+    fi
+
+    # Ensure that all users in wheel can create the .reset file
+    mkdir -p /mnt/cfg/infix
+    chgrp wheel /mnt/cfg/infix
+fi
+
+mount_overlay cfg  $cfgsrc /cfg
+mount_overlay etc  $etcsrc /etc
+mount_overlay home $cfgsrc /home
+mount_overlay root $cfgsrc /root
+mount_overlay var  $varsrc /var
+
+[ "$vlibsrc" ] && mount_overlay vlib "$vlibsrc" /var/lib
+
+# Keep transient configs in a ramdisk and symlink out to /cfg for
+# startup.
+mkdir -p /mnt/tmp/infix/db
+ln -s /cfg/startup_db /mnt/tmp/infix/db/startup_db
+
+for tag in $(ls /sys/bus/virtio/devices/*/mount_tag 2>/dev/null); do
+    if [ "$(cat $tag | tr -d '\0')" = hostfs ]; then
+	mount hostfs
+	break
+    fi
+done
+
+exit $err

board/common/rootfs/lib/infix/nameif

@@ -0,0 +1,46 @@
+#!/bin/sh
+# Find any switch ports, classify and rename to Infix std
+#
+
+ident=$(basename "$0")
+num=0
+
+# Perform any interface renames as dictated by, first, any Qemu
+# override (for testing), and then the user specific /etc/mactab
+for file in /sys/firmware/qemu_fw_cfg/by_name/opt/mactab/raw /etc/mactab; do
+	if [ -f $file ]; then
+		logger -k -p user.notice -t "$ident" "calling nameif -c $file"
+		nameif -c $file -s
+	fi
+done
+
+# Find CPU interfaces used for connecting to a switch managed by DSA
+for netif in /sys/class/net/*; do
+	iface=$(basename "$netif")
+	[ -f "/sys/class/net/$iface/dsa/tagging" ] || continue
+
+	# Disable SLAAC frames and such, that's for the port interfaces, and
+	# bring it up so we get link events from the ports to the bridge.
+	sysctl -q "net.ipv6.conf.$iface.disable_ipv6=1"
+
+	dsa="dsa$num"
+	logger -k -p user.notice -t "$ident" "Found DSA interface, renaming $iface -> $dsa"
+	ip link set dev "$iface" name $dsa
+	num=$((num + 1))
+done
+
+# Find and mark all switch ports
+ports=$(devlink port 2>/dev/null | awk '/flavour physical/{print $5}')
+for iface in $ports; do
+	ip link set "$iface" group port
+done
+
+# Testing, e.g., using /etc/mactab may use TAP devices to create
+# emulated switch ports, make sure to mark them as well
+ports=$(ip -json link | jq -r '.[].ifname | match("^e[[:digit:]]+").string')
+for iface in $ports; do
+	ip link set "$iface" group port
+done
+
+# At least loopback in iface group
+ip link set lo group iface

board/common/rootfs/lib/infix/ssh-hostkeys

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+for type in ecdsa ed25519 rsa; do
+    [ -f /var/lib/ssh/ssh_host_${type}_key ] \
+	|| ssh-keygen -N "" -t $type -f /var/lib/ssh/ssh_host_${type}_key \
+	|| exit 1
+done
+
+initctl cond set ssh-hostkeys

board/common/rootfs/lib/infix/swup

@@ -0,0 +1,38 @@
+#!/bin/sh
+# Only runs in native /etc and PROFINET nodes.
+
+if initctl cond get boot/profinet; then
+    initctl enable snmpd
+    initctl disable lldpd
+fi
+
+# Factory default: all switch ports in VLAN 1 of br0
+# need to check for 'length > 0' because ip command
+# outputs empty json objects for non-port group ifs
+ports=$(ip -json link show group port | jq -r '.[].ifname | select(length > 0)' | tr "\n" " ")
+[ -f /etc/network/interfaces.d/br0 ] || [ -z "$ports" ] && exit 0
+
+touch /etc/network/interfaces.d/br0
+for port in $ports; do
+    cat <<-EOF >>/etc/network/interfaces.d/br0
+		iface $port
+		    bridge-access 1
+		    post-up ip link set $port group port
+	EOF
+done
+cat <<-EOF >>/etc/network/interfaces.d/br0
+
+	auto br0
+	iface br0
+	    bridge-ports $ports
+	    bridge-vlan-aware yes
+	    bridge-stp on
+	    bridge-vids 1
+
+	auto vlan1
+	iface vlan1 inet dhcp
+	    vlan-id 1
+	    vlan-raw-device br0
+	    post-up ip link set vlan1 group iface
+EOF
+ip link set vlan1 group iface

board/common/rootfs/lib/infix/use-etc

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+if [ -f /mnt/cfg/infix/.use_etc ]; then
+    exit 0
+fi
+
+# Finit's condition system may not yet be bootstrapped when this script
+# is called, e.g., when /etc/fstab is parsed, so we have to manually
+# check for the boot/etc condition.
+awk '
+    $0 == "finit.cond" {
+	cond=1;
+	next;
+    }
+    cond == 1 {
+	use_etc = index($0, "etc") != 0;
+    }
+    END {
+    	exit(use_etc ? 0 : 1);
+    }
+' /proc/1/cmdline

board/common/rootfs/libexec/finit/hook/mount/all/boot-mode.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+# Override boot mode based on user input from setup tool
+
+set_cond()
+{
+    mkdir -p /run/finit/cond/boot
+    ln -s /run/finit/cond/reconf "/run/finit/cond/boot/$1"
+}
+
+# Report to the setup and show tools the current boot mode
+if /lib/infix/use-etc; then
+    if [ -f /mnt/cfg/infix/.use_etc ]; then
+	cat /mnt/cfg/infix/.use_etc > /tmp/.boot_mode
+	if grep -qi profinet /mnt/cfg/infix/.use_etc; then
+	    set_cond profinet
+	else
+	    set_cond etc
+	fi
+    else
+	echo "native /etc"  > /tmp/.boot_mode
+	set_cond etc
+    fi
+else
+    echo "NETCONF" > /tmp/.boot_mode
+    set_cond netconf
+fi

board/common/rootfs/log

@@ -0,0 +1 @@
+var/log