doc: add information on ospf debug settings

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

.github/workflows/build-image.yml

@@ -12,6 +12,10 @@ on:
           - bananapi-bpi-r3
           - friendlyarm-nanopi-r2s
         default: 'raspberrypi-rpi64'
+      use_latest_release:
+        description: 'Use latest release artifacts instead of workflow artifacts'
+        type: boolean
+        default: false
 
 jobs:
   create-image:
@@ -50,19 +54,19 @@ jobs:
         run: |
           case "${{ inputs.board }}" in
             raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
             bananapi-bpi-r3)
-              echo "BOOTLOADER_SD=bpi-r3-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r3-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER_SD=bpi_r3_sd_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi_r3_emmc_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=true" >> $GITHUB_ENV
               ;;
             friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
             *)
@@ -70,7 +74,7 @@ jobs:
               exit 1
               ;;
           esac
-          echo "Arch: $ARCH for board: ${{ inputs.board }}"
+          echo "Target: $TARGET for board: ${{ inputs.board }}"
           if [ "$BUILD_EMMC" = "true" ]; then
             echo "Building both SD and eMMC images"
             echo "SD Bootloader: $BOOTLOADER_SD"
@@ -81,12 +85,16 @@ jobs:
           fi
 
       - name: Download bootloader artifacts
+        if: ${{ !inputs.use_latest_release }}
         run: |
-          # Download bootloader from latest-boot release tag
+          # Download from latest bootloader build workflow on main branch
+          gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
+          BOOT_RUN_ID=$(cat latest_boot_run_id)
+
           if [ "$BUILD_EMMC" = "true" ]; then
             # Download both SD and eMMC bootloaders for boards that support both
             echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_SD} --dir temp_bootloader_sd/
             mkdir -p output_sd/images
             cd temp_bootloader_sd/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -94,7 +102,7 @@ jobs:
             rm -rf temp_bootloader_sd/
 
             echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_EMMC} --dir temp_bootloader_emmc/
             mkdir -p output_emmc/images
             cd temp_bootloader_emmc/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
@@ -107,7 +115,7 @@ jobs:
             ls -la output_emmc/images/
           else
             # Single bootloader for boards that only support SD
-            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
 
             # Extract bootloader directly to output/images
             cd temp_bootloader/
@@ -122,6 +130,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download Infix artifacts
+        if: ${{ !inputs.use_latest_release }}
         run: |
           # Download from latest Kernelkit Trigger workflow for main branch
           gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
@@ -129,7 +138,7 @@ jobs:
 
           if [ "$BUILD_EMMC" = "true" ]; then
             # Copy Infix artifacts to both SD and eMMC output directories
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
 
             cd temp_infix/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -143,7 +152,7 @@ jobs:
             ls -la output_emmc/images/
           else
             # Single output directory for SD-only boards
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
 
             # Extract Infix directly to output/images
             cd temp_infix/
@@ -157,6 +166,58 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Download from latest releases
+        if: ${{ inputs.use_latest_release }}
+        run: |
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Download both SD and eMMC bootloaders
+            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            mkdir -p output_sd/images
+            cd temp_bootloader_sd/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            cd ../
+            rm -rf temp_bootloader_sd/
+
+            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            mkdir -p output_emmc/images
+            cd temp_bootloader_emmc/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_bootloader_emmc/
+
+            # Download Infix once and extract to both directories
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "SD files extracted to output_sd/images:"
+            ls -la output_sd/images/
+            echo "eMMC files extracted to output_emmc/images:"
+            ls -la output_emmc/images/
+          else
+            # Download latest bootloader release
+            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            cd temp_bootloader/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_bootloader/
+
+            # Download latest Infix release
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "All files extracted to output/images:"
+            ls -la output/images/
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Verify extracted files
         run: |
           if [ "$BUILD_EMMC" = "true" ]; then
@@ -188,7 +249,7 @@ jobs:
             export BR2_EXTERNAL_INFIX_PATH=$PWD
             export RELEASE=""
             export INFIX_ID="infix"
-            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
+            ./utils/mkimage.sh ${{ inputs.board }}
           fi
 
       - name: Create eMMC image
@@ -286,11 +347,10 @@ jobs:
           # SD Card & eMMC Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
-          **Arch:** ${{ env.ARCH }}
+          **Target:** ${{ env.TARGET }}
           **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
           **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
-          **Bootloader Source:** latest-boot release
-          **Infix Source:** Latest workflow run on main
+          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
 
           ## Created Images
           $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
@@ -303,10 +363,9 @@ jobs:
           # SD Card Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
-          **Arch:** ${{ env.ARCH }}
+          **Target:** ${{ env.TARGET }}
           **Bootloader:** ${{ env.BOOTLOADER }}
-          **Bootloader Source:** latest-boot release
-          **Infix Source:** Latest workflow run on main
+          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
 
           ## Created Images
           $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")

.github/workflows/check-kernel-release.yml

@@ -1,4 +1,4 @@
-name: Check Kernel 6.18 Release
+name: Check Kernel 6.12 Release
 
 on:
   schedule:
@@ -17,12 +17,12 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
 
-      - name: Fetch kernel.org and check for 6.18 release
+      - name: Fetch kernel.org and check for 6.12 release
         id: check
         run: |
           set -e -o pipefail
-          # Fetch the kernel.org frontpage and extract 6.18 version
-          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.18\.\d+' | head -n1)
+          # Fetch the kernel.org frontpage and extract 6.12 version
+          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)
 
           if [ -z "$CURRENT_VERSION" ]; then
             echo "Failed to fetch kernel version"
@@ -30,7 +30,7 @@ jobs:
           fi
 
           echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          echo "Current 6.18 kernel version: $CURRENT_VERSION"
+          echo "Current 6.12 kernel version: $CURRENT_VERSION"
 
           # Get the version from infix defconfig
           INFIX_VERSION=$(grep 'BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=' configs/aarch64_defconfig | cut -d'"' -f2)
@@ -47,7 +47,7 @@ jobs:
               echo "PR already exists for kernel $CURRENT_VERSION, skipping"
             else
               echo "new_release=true" >> $GITHUB_OUTPUT
-              echo "🎉 New 6.18 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
+              echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
             fi
           else
             echo "new_release=false" >> $GITHUB_OUTPUT
@@ -99,7 +99,7 @@ jobs:
           BRANCH_NAME: ${{ steps.branch.outputs.name }}
         run: |
           set -e -o pipefail
-          ./utils/kernel-upgrade.sh linux 6.18 "$BRANCH_NAME"
+          ./utils/kernel-upgrade.sh linux "$BRANCH_NAME"
 
       - name: Create pull request
         if: steps.check.outputs.new_release == 'true'

.github/workflows/release.yml

@@ -104,7 +104,11 @@ jobs:
 
       - name: Extract ChangeLog entry ...
         run: |
-          cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
+          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
+              |head -n -1 > release.md
+          echo "" >> release.md
+          echo "> [!TIP]" >> release.md
+          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
           cat release.md
 
       - uses: ncipollo/release-action@v1

.gitignore

@@ -1,7 +1,5 @@
 *~
-.claude
 .gdb_history
-.claude
 /.backup
 /.ccache
 /dl
@@ -11,4 +9,3 @@
 /test/.log
 /local.mk
 /test/spec/Readme.adoc
-

README.md

@@ -16,12 +16,10 @@ if something goes wrong.  Deploy once, trust forever.
 
 **🤝 Friendly**  
 Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit <kbd>?</kbd> or
-<kbd>TAB</kbd> for context-aware assistance.
-
-Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
-mean you're never stuck.  Whether you're learning networking or managing
-enterprise infrastructure.
+with built-in help for every command — just hit `?` or TAB for
+context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
+[comprehensive documentation][4] mean you're never stuck.  Whether
+you're learning networking or managing enterprise infrastructure.
 
 **🛡️ Secure**  
 Built with security as a foundation, not an afterthought.  Minimal
@@ -55,24 +53,27 @@ your device, your rules.
    Consistent tooling from development to production deployment.  
    How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
 
-## Quick Example
+## See It In Action
 
 Configure an interface in seconds - the CLI guides you with built-in help:
 
-<pre><code>admin@infix-12-34-56:/> <b>configure</b>
-admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
-admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4</b> <kbd>TAB</kbd>
-      address     autoconf      bind-ni-name     dhcp 
-      enabled     forwarding    mtu              neighbor
-admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4 address 192.168.2.200 prefix-length 24</b>
-admin@infix-12-34-56:/config/interface/eth0/> <b>show</b>
+<details><summary><b>Click Here for an example CLI Session</b></summary>
+
+```bash
+admin@infix-12-34-56:/> configure
+admin@infix-12-34-56:/config/> edit interface eth0
+admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
+      address     autoconf bind-ni-name      enabled
+      forwarding  mtu      neighbor
+admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
+admin@infix-12-34-56:/config/interface/eth0/> show
 type ethernet;
 ipv4 {
   address 192.168.2.200 {
     prefix-length 24;
   }
 }
-admin@infix-12-34-56:/config/interface/eth0/> <b>diff</b>
+admin@infix-12-34-56:/config/interface/eth0/> diff
 interfaces {
   interface eth0 {
 +    ipv4 {
@@ -82,23 +83,25 @@ interfaces {
 +    }
   }
 }
-admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
-admin@infix-12-34-56:/> <b>show interfaces</b>
-<u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
+admin@infix-12-34-56:/config/interface/eth0/> leave
+admin@infix-12-34-56:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
 eth0            ethernet   UP          52:54:00:12:34:56
                 ipv4                   192.168.2.200/24 (static)
                 ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                 ipv4                   127.0.0.1/8 (static)
                 ipv6                   ::1/128 (static)
-admin@infix-12-34-56:/> <b>copy running startup</b>
-</code></pre>
+admin@infix-12-34-56:/> copy running-config startup-config
+```
 
-Notice how <kbd>TAB</kbd> completion shows available options, `show`
-displays current config, and `diff` shows exactly what changed before
-you commit your changes with the `leave` command.
+Notice how TAB completion shows available options, `show` displays
+current config, and `diff` shows exactly what changed before you
+commit your changes with the `leave` command.
 
-For more information, see [CLI documentation][3].
+</details>
+
+> [Full CLI documentation →][3]
 
 ## Get Started
 
@@ -108,7 +111,7 @@ containers for any custom functionality you need.
 
 ### Supported Platforms
 
-- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
+- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
 - **Banana Pi-R3** - Your next home router and gateway
 - **NanoPi R2S** - Compact dual-port router in a tiny package
 - **x86_64** - Run in VMs or on mini PCs for development and testing

board/README.md

@@ -1,18 +0,0 @@
-Board Support
-=============
-
-The board support for an architecture always starts with Qemu support,
-this is what each `linux_defconfig` at the very least sets up.  Then
-each `$BR2_ARCH` has additional BSPs, e.g., Banana Pi BPI-R3.
-
-The `board/` directory is matched with the `configs/*_defconfigs` and
-the only execption is `board/common/`, which holds all shared files for
-Infix builds.
-
-Each `board/$BR2_ARCH/` can then have vendor/product sub-directories
-for the BSPs which may contain "fixups" to the base kernel config and
-any additional device tree files that should be included as well.
-
-To rebuild a board-specific package, e.g. NanoPi R2S:
-
-    make friendlyarm-nanopi-r2s-rebuild all

board/aarch32/linux_defconfig

@@ -31,11 +31,14 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
+CONFIG_KEXEC=y
 CONFIG_ARCH_MULTI_V6=y
+CONFIG_ARCH_MULTI_V7=y
 CONFIG_ARCH_VIRT=y
 CONFIG_ARCH_BCM=y
 CONFIG_ARCH_BCM2835=y
 CONFIG_SMP=y
+CONFIG_NR_CPUS=4
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
@@ -44,6 +47,7 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPUFREQ_DT=y
 CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_AEABI=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -74,6 +78,7 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -89,31 +94,12 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
-CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -122,22 +108,15 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -154,58 +133,29 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_SET=y
-CONFIG_IP_SET_BITMAP_IP=y
-CONFIG_IP_SET_BITMAP_IPMAC=y
-CONFIG_IP_SET_BITMAP_PORT=y
-CONFIG_IP_SET_HASH_IP=y
-CONFIG_IP_SET_HASH_IPMARK=y
-CONFIG_IP_SET_HASH_IPPORT=y
-CONFIG_IP_SET_HASH_IPPORTIP=y
-CONFIG_IP_SET_HASH_IPPORTNET=y
-CONFIG_IP_SET_HASH_IPMAC=y
-CONFIG_IP_SET_HASH_MAC=y
-CONFIG_IP_SET_HASH_NETPORTNET=y
-CONFIG_IP_SET_HASH_NET=y
-CONFIG_IP_SET_HASH_NETNET=y
-CONFIG_IP_SET_HASH_NETPORT=y
-CONFIG_IP_SET_HASH_NETIFACE=y
-CONFIG_IP_SET_LIST_SET=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_SYNPROXY=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -244,16 +194,16 @@ CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_PKTGEN=y
-CONFIG_CFG80211=m
-CONFIG_MAC80211=m
-CONFIG_RFKILL=y
+# CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
+CONFIG_PCI_AARDVARK=y
 CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_ARMADA_8K=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -271,6 +221,7 @@ CONFIG_BLK_DEV_NVME=y
 CONFIG_SRAM=y
 CONFIG_EEPROM_AT24=y
 # CONFIG_SCSI_PROC_FS is not set
+CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_SAS_LIBSAS=y
 CONFIG_SCSI_SAS_ATA=y
@@ -279,6 +230,7 @@ CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_MVEBU=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
@@ -306,6 +258,8 @@ CONFIG_SMSC911X=y
 CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
 CONFIG_USB_NET_SMSC95XX=y
+CONFIG_BRCMFMAC=m
+CONFIG_ZD1211RW=m
 CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
 CONFIG_INPUT_TOUCHSCREEN=y
@@ -319,19 +273,22 @@ CONFIG_SERIAL_8250_BCM2835AUX=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
+CONFIG_TTY_PRINTK=y
+CONFIG_HVC_DRIVER=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
 CONFIG_SPI_BCM2835=y
 CONFIG_SPI_BCM2835AUX=y
+CONFIG_GPIO_SYSFS=y
 CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
 CONFIG_BCM2711_THERMAL=y
 CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
-CONFIG_I6300ESB_WDT=y
 CONFIG_BCM2835_WDT=y
+CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -339,12 +296,12 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
 CONFIG_DRM=y
 CONFIG_DRM_LOAD_EDID_FIRMWARE=y
-CONFIG_DRM_SIMPLEDRM=y
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_TOSHIBA_TC358762=m
 CONFIG_DRM_V3D=m
 CONFIG_DRM_VC4=m
 CONFIG_DRM_VC4_HDMI_CEC=y
+CONFIG_DRM_SIMPLEDRM=y
 CONFIG_FB=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_SOUND=y
@@ -353,7 +310,6 @@ CONFIG_SND_SOC=y
 CONFIG_SND_BCM2835_SOC_I2S=y
 CONFIG_HID_GENERIC=m
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC2=y
@@ -387,6 +343,7 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_STAGING=y
 CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
 CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
@@ -395,6 +352,8 @@ CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FANOTIFY=y
@@ -417,6 +376,8 @@ CONFIG_NLS_ISO8859_1=y
 CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_CCM=y
 CONFIG_CRYPTO_GCM=y
+# CONFIG_XZ_DEC_ARM is not set
+# CONFIG_XZ_DEC_ARMTHUMB is not set
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
@@ -426,13 +387,9 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
-CONFIG_TEST_LOCKUP=m
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
+# CONFIG_STRICT_DEVMEM is not set
 CONFIG_MEMTEST=y

board/aarch32/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg

@@ -41,31 +41,14 @@
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Raspberry Pi 2 Model B"
-              }
+              {"id": "netmask"},
+              {"id": "broadcast"},
+              {"id": "router"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "ntp-server"},
+              {"id": "vendor-class", "value": "Raspberry Pi 2 Model B"}
             ]
           }
         }
@@ -88,9 +71,6 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -98,14 +78,6 @@
           "user-name": [
             "admin"
           ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
         }
       ]
     },
@@ -125,37 +97,6 @@
           }
         ]
       },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
       {
         "name": "default-deny-all",
         "group": [
@@ -163,25 +104,11 @@
         ],
         "rule": [
           {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
           }
         ]
       }
@@ -195,11 +122,7 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -245,7 +168,7 @@
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
   "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/bananapi-bpi-r3/bananapi-bpi-r3.mk

@@ -6,7 +6,7 @@ define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_GPIO,y)
 	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_WATCHDOG)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg

@@ -17,25 +17,7 @@
         "state": {
           "admin-state": "unlocked"
         }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-	  "band": "2.4GHz",
-	  "channel": "auto"
-	 }
-     },
-     {
-	"name": "radio1",
-	"class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-          "band": "5GHz",
-          "channel": "auto"
       }
-    }
     ]
   },
   "ietf-interfaces:interfaces": {
@@ -117,118 +99,58 @@
       {
         "name": "wan",
         "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Banana Pi BPI-R3"
-              }
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"},
+              {"id": "vendor-class", "value": "Banana Pi BPI-R3"}
             ]
           }
         },
         "ietf-ip:ipv6": {
           "infix-dhcpv6-client:dhcp": {
             "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "client-fqdn"
-              },
-              {
-                "id": "domain-search"
-              },
-              {
-                "id": "dns-server"
-              }
+              {"id": "ntp-server"},
+              {"id": "client-fqdn"},
+              {"id": "domain-search"},
+              {"id": "dns-server"}
             ]
           }
         }
       },
       {
-        "name": "wifi0-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0",
-          "access-point": {
-            "ssid": "Infix",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-	"infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
+        "name": "wifi0",
+        "type": "infix-if-type:wifi"
       },
       {
-        "name": "wifi1-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio1",
-          "access-point": {
-            "ssid": "Infix5Ghz",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-       "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
+        "name": "wifi1",
+        "type": "infix-if-type:wifi"
       }
     ]
   },
   "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
+        "asymmetric-keys": {
+            "asymmetric-key": [
+                {
+                    "name": "genkey",
+                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+                    "public-key": "",
+                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+                    "cleartext-private-key": "",
+                    "certificates": {}
+                }
+            ]
         }
-      ]
-    },
-    "symmetric-keys": {
-      "symmetric-key": [
-        {
-          "name": "wifi",
-          "infix-keystore:symmetric-key": "infixinfix",
-          "infix-keystore:key-format": "infix-crypto-types:wifi-preshared-key-format"
-        }
-      ]
-    }
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -236,14 +158,6 @@
           "user-name": [
             "admin"
           ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
         }
       ]
     },
@@ -263,37 +177,6 @@
           }
         ]
       },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
       {
         "name": "default-deny-all",
         "group": [
@@ -301,25 +184,11 @@
         ],
         "rule": [
           {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
           }
         ]
       }
@@ -333,11 +202,7 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -429,7 +294,7 @@
     "policy": [
       {
         "name": "lan-to-wan",
-        "action": "accept",
+	"action": "accept",
         "ingress": [
           "lan"
         ],
@@ -441,7 +306,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true
@@ -477,3 +342,4 @@
     }
   }
 }
+

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/product/interface-quirks.json

@@ -1,11 +0,0 @@
-{
-    "sfp1": {
-	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
-	"broken-autoneg": true
-    },
-    "sfp2": {
-	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
-	"broken-autoneg": true
-    }
-
-}

board/aarch64/board.mk

@@ -1,4 +1,3 @@
-include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/*/*.mk))
 
 .PHONY: board-enable-qemu-uboot
 board-enable-qemu-uboot:
@@ -20,6 +19,13 @@ board-enable-qemu-uboot:
 			'$$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config' \
 		--enable TARGET_UBOOT_FORMAT_DTB
 
+.PHONY: board-enable-sparx-fit
+board-enable-sparx-fit:
+	@$(call IXMSG,"Enabling SparX-5i compatible FIT options")
+	@BR2_PREFIX= ./utils/config --file $(BR2_CONFIG) \
+	 	--enable FIT_IMAGE \
+	 	--set-str FIT_KERNEL_LOAD_ADDR "0x7 0x00000000"
+
 .PHONY: board-sparx-flash-uboot
 board-sparx-flash-uboot: $(BINARIES_DIR)/u-boot.bin
 	@grep -q 'BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mscc_fireant_pcb135_emmc"' $(BR2_CONFIG) || \

board/aarch64/friendlyarm-nanopi-r2s/Config.in

@@ -4,7 +4,6 @@ config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
 	select SDCARD_AUX
 	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
-	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	help
 	  FriendlyElec NanoPi R2S is a compact router board based on
 	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.

board/aarch64/friendlyarm-nanopi-r2s/friendlyarm-nanopi-r2s.mk

@@ -4,9 +4,6 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
-	# TODO: for some reason this just locks up the device
-	#       so we'll have to rely on the softdog :-(
-	# $(call KCONFIG_ENABLE_OPT,CONFIG_DW_WATCHDOG)
 
 	# PHY drivers
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
@@ -54,10 +51,6 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)
 
-	# Input layer
-	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MISC)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
-
 	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg

@@ -58,52 +58,28 @@
       {
         "name": "wan",
         "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "vendor-class",
-                "value": "NanoPi R2S"
-              }
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"},
+              {"id": "vendor-class", "value": "NanoPi R2S"}
             ]
           }
         },
         "ietf-ip:ipv6": {
           "infix-dhcpv6-client:dhcp": {
             "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "client-fqdn"
-              },
-              {
-                "id": "domain-search"
-              },
-              {
-                "id": "dns-server"
-              }
+              {"id": "ntp-server"},
+              {"id": "client-fqdn"},
+              {"id": "domain-search"},
+              {"id": "dns-server"}
             ]
           }
         }
@@ -111,24 +87,21 @@
     ]
   },
   "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
+        "asymmetric-keys": {
+            "asymmetric-key": [
+                {
+                    "name": "genkey",
+                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+                    "public-key": "",
+                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+                    "cleartext-private-key": "",
+                    "certificates": {}
+                }
+            ]
         }
-      ]
-    }
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -136,14 +109,6 @@
           "user-name": [
             "admin"
           ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
         }
       ]
     },
@@ -163,37 +128,6 @@
           }
         ]
       },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
       {
         "name": "default-deny-all",
         "group": [
@@ -201,25 +135,11 @@
         ],
         "rule": [
           {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
           }
         ]
       }
@@ -233,11 +153,7 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -329,7 +245,7 @@
     "policy": [
       {
         "name": "lan-to-wan",
-        "action": "accept",
+	"action": "accept",
         "ingress": [
           "lan"
         ],
@@ -341,7 +257,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/usr/sbin/wan-monitor.sh

@@ -20,7 +20,6 @@ cleanup()
 {
     rm -f "$LED_FILE"
     rm -f "$PID_FILE"
-    kill %% 2>/dev/null
     exit 0
 }
 
@@ -32,13 +31,11 @@ remaining_time=$((1800 - $(awk '{print int($1)}' /proc/uptime)))
 
 while [ "$remaining_time" -gt 0 ]; do
     check_wan
-    sleep 1 &
-    wait $!
+    sleep 1
     remaining_time=$((remaining_time - 1))
 done
 
 while :; do
     check_wan
-    sleep 5 &
-    wait $!
+    sleep 5
 done

board/aarch64/linux_defconfig

@@ -39,6 +39,7 @@ CONFIG_ARM64_ERRATUM_1286807=y
 CONFIG_ARM64_ERRATUM_1542419=y
 CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
+CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
 CONFIG_COMPAT=y
 # CONFIG_SUSPEND is not set
@@ -51,6 +52,7 @@ CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_ARMADA_8K_CPUFREQ=y
 CONFIG_ACPI=y
 CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -77,6 +79,7 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -92,31 +95,12 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
-CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -125,23 +109,15 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
-CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -158,69 +134,29 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_SET=y
-CONFIG_IP_SET_BITMAP_IP=y
-CONFIG_IP_SET_BITMAP_IPMAC=y
-CONFIG_IP_SET_BITMAP_PORT=y
-CONFIG_IP_SET_HASH_IP=y
-CONFIG_IP_SET_HASH_IPMARK=y
-CONFIG_IP_SET_HASH_IPPORT=y
-CONFIG_IP_SET_HASH_IPPORTIP=y
-CONFIG_IP_SET_HASH_IPPORTNET=y
-CONFIG_IP_SET_HASH_IPMAC=y
-CONFIG_IP_SET_HASH_MAC=y
-CONFIG_IP_SET_HASH_NETPORTNET=y
-CONFIG_IP_SET_HASH_NET=y
-CONFIG_IP_SET_HASH_NETNET=y
-CONFIG_IP_SET_HASH_NETPORT=y
-CONFIG_IP_SET_HASH_NETIFACE=y
-CONFIG_IP_SET_LIST_SET=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
-CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -308,7 +244,6 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
-CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -472,10 +407,10 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_GPIO_WATCHDOG=y
-CONFIG_ARM_SBSA_WATCHDOG=y
 CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_MAX77620=y
+CONFIG_MFD_SEC_CORE=y
 CONFIG_MFD_ROHM_BD718XX=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -484,6 +419,7 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_MAX77620=y
 CONFIG_REGULATOR_PCA9450=y
 CONFIG_REGULATOR_QCOM_SPMI=y
+CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_A4TECH is not set
 # CONFIG_HID_APPLE is not set
@@ -493,11 +429,11 @@ CONFIG_REGULATOR_QCOM_SPMI=y
 # CONFIG_HID_CYPRESS is not set
 # CONFIG_HID_EZKEY is not set
 # CONFIG_HID_KENSINGTON is not set
+# CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
 CONFIG_USB_ULPI_BUS=y
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
@@ -515,6 +451,7 @@ CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
 CONFIG_USB_HSIC_USB3503=m
+CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_SNP_UDC_PLAT=y
@@ -548,6 +485,7 @@ CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
 CONFIG_RTC_DRV_PCF8523=y
+CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
 CONFIG_RTC_DRV_PL031=y
@@ -562,6 +500,7 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 # CONFIG_SURFACE_PLATFORMS is not set
 CONFIG_COMMON_CLK_CS2000_CP=y
+CONFIG_COMMON_CLK_S2MPS11=y
 CONFIG_COMMON_CLK_XGENE=y
 CONFIG_COMMON_CLK_BD718XX=y
 CONFIG_MAILBOX=y
@@ -578,7 +517,7 @@ CONFIG_PHY_SAMSUNG_USB2=y
 CONFIG_NVMEM_LAYOUT_ONIE_TLV=y
 CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT4_FS=y
+CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -605,6 +544,8 @@ CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
@@ -616,13 +557,8 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
-CONFIG_TEST_LOCKUP=m
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
 # CONFIG_STRICT_DEVMEM is not set

board/aarch64/raspberrypi-rpi64/README.md

@@ -108,7 +108,7 @@ To configure WiFi as a client, first store your WiFi password in the keystore:
 admin@infix:/> configure
 admin@infix:/config/> edit keystore symmetric-key mywifi
 admin@infix:/config/keystore/…/mywifi/> set key-format wifi-preshared-key-format
-admin@infix:/config/keystore/…/mywifi/> set symmetric-key YourWiFiPassword
+admin@infix:/config/keystore/…/mywifi/> set cleartext-key YourWiFiPassword
 admin@infix:/config/keystore/…/mywifi/> leave
 ```
 

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-compute-module/etc/product/init.d/S01-trigger-udev.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-# Workaround for: https://github.com/kernelkit/infix/issues/1357
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg

@@ -10,13 +10,6 @@
         "state": {
           "admin-state": "unlocked"
         }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "00"
-        }
       }
     ]
   },
@@ -45,45 +38,24 @@
       {
         "name": "eth0",
         "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Raspberry Pi 4 Model B"
-              }
+              {"id": "netmask"},
+              {"id": "broadcast"},
+              {"id": "router"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "ntp-server"},
+              {"id": "vendor-class", "value": "Raspberry Pi 4 Model B"}
             ]
           }
         }
       },
       {
         "name": "wifi0",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0"
-        }
+        "type": "infix-if-type:wifi"
       }
     ]
   },
@@ -103,9 +75,6 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -113,14 +82,6 @@
           "user-name": [
             "admin"
           ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
         }
       ]
     },
@@ -140,37 +101,6 @@
           }
         ]
       },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
       {
         "name": "default-deny-all",
         "group": [
@@ -178,25 +108,11 @@
         ],
         "rule": [
           {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
           }
         ]
       }
@@ -210,11 +126,7 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -260,7 +172,7 @@
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
   "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/product/init.d/S01-trigger-udev.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-# Workaround for: https://github.com/kernelkit/infix/issues/1357
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add

board/aarch64/raspberrypi-rpi64/uboot/rpi-env.dtso

@@ -12,15 +12,6 @@
 			boot_targets = "mmc0";
 			ethprime = "eth0";
 
-			/* Memory layout for kernel boot:
-			 *   0x00200000: Kernel relocation address
-			 *   0x04000000: FDT (64MB, gives enough space for kernels up to ~60MB)
-			 *   0x10000000: Ramdisk (Memsize - 256MB)
-			 */
-			kernel_addr_r = "0x00200000";
-			fdt_addr_r = "0x04000000";
-			ramdisk_addr_r = "0x10000000";
-
 			stdout = "serial";
 			stderr = "serial";
 			stdin = "serial";

board/aarch64/rootfs/usr/share/product/marvell,armada-ap807/etc/support.d/50-marvell-cn913x.sh

@@ -1,26 +0,0 @@
-#!/bin/sh
-
-set -e
-
-ecc_stat()
-{
-    local chan=
-    local base=
-
-    for chan in 0 1; do
-        base=$((0xf0020360 + 0x200 * chan))
-
-        echo "DRAM Channel $chan ECC Status"
-        echo -n "  Log config: "; devmem $((base + 0x0)) 32
-        echo -n "  1b errors:  "; devmem $((base + 0x4)) 32
-        echo -n "  Info 0:     "; devmem $((base + 0x8)) 32
-        echo -n "  Info 1:     "; devmem $((base + 0xc)) 32
-        echo
-    done
-}
-
-[ -n "$1" ] || { echo "usage: $0 OUT-DIR"; exit 1; }
-work="$1"/marvell-cn913x
-mkdir -p "${work}"
-
-ecc_stat >"${work}"/ecc-stat

board/aarch64/styx-dcp-sc-28p/dts/styx/dcp-sc-28p-a.dts

@@ -59,9 +59,3 @@
 		XSWP(a, "e13", 13, &sfp0);
 	};
 };
-
-&cp0_spi1 {
-	spi-flash@0 {
-		broken-flash-reset;
-	};
-};

board/board.mk

@@ -1,3 +1,2 @@
-include $(BR2_EXTERNAL_INFIX_PATH)/board/common/common.mk
 include $(BR2_EXTERNAL_INFIX_PATH)/board/ix-board.mk
--include $(BR2_EXTERNAL_INFIX_PATH)/board/$(patsubst "%",%,$(BR2_ARCH))/board.mk
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/*/*/*.mk))

board/common/Config.in

@@ -1,28 +1,32 @@
-menu "Images"
-
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rootfs/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-qcow/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"
-
-endmenu
-
-config QEMU_SCRIPTS
-	bool "QEMU scripts"
+menuconfig SIGN_ENABLED
+	bool "Image Signing"
 	default y
-	help
-	  Install QEMU scripts and related files in the images
-	  directory, which can be used to launch virtual Infix
-	  instances.
+
+choice
+	prompt "Signing key source"
+	depends on SIGN_ENABLED
+	default SIGN_SRC_DIR
+
+config SIGN_SRC_DIR
+	bool "Directory"
+
+config SIGN_SRC_PKCS11
+	bool "PKCS#11 URL"
+
+endchoice
+
+config SIGN_KEY
+	string "Signing key"
+	depends on SIGN_ENABLED
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development"  if SIGN_SRC_DIR
 
 menuconfig TRUSTED_KEYS
 	bool "Trusted keys for image"
+	depends on SIGN_ENABLED
 	help
 	 Keys that will be accepted for this image
 
+
 config TRUSTED_KEYS_DEVELOPMENT
 	bool "Development key"
 	depends on TRUSTED_KEYS
@@ -35,3 +39,130 @@ config TRUSTED_KEYS_DEVELOPMENT_PATH
 config TRUSTED_KEYS_EXTRA_PATH
 	string "Path to extra keys to include in image"
 	depends on TRUSTED_KEYS
+
+menuconfig DISK_IMAGE
+	bool "Disk image"
+	help
+	  Compose a full disk image with redundant Linux OS partitions,
+	  configuration partition, etc.
+
+	  This is useful when:
+	  - Bringing up a blank system during manufacturing
+	  - Creating a GNS3 appliance
+	  - Developing/debugging issues in the boot process in QEMU
+
+menuconfig DISK_IMAGE_SIZE
+	string "Image size"
+	depends on DISK_IMAGE
+	default "512M"
+	help
+	  Create a disk image of this size.  A K/M/G suffix may be used
+	  to multiply by powers of 1024.  Suffixes like KB/MB/GB may be
+	  used to multiply by powers of 1000.  The image will be split
+	  proportionally to fit the two rootfs, a kernel, a writable
+	  /cfg and /var partiotions.
+
+	  Minimum supported size is 512M.
+
+choice
+	prompt "Bootloader"
+	depends on DISK_IMAGE
+	default DISK_IMAGE_BOOT_EFI if BR2_x86_64
+	default DISK_IMAGE_BOOT_NONE
+
+config DISK_IMAGE_BOOT_NONE
+	bool "None"
+	help
+	  Do not create any bootloader partition in the disk image.
+
+config DISK_IMAGE_BOOT_EFI
+	bool "EFI"
+	help
+	  Create a boot partition from a directory containing an EFI
+	  boot application, e.g. GRUB.
+
+config DISK_IMAGE_BOOT_BIN
+	bool "Binary"
+	help
+	  Create a boot partition from a raw image containing the boot
+	  application, e.g. U-Boot.
+
+endchoice
+
+config DISK_IMAGE_BOOT_DATA
+	string "Bootloader data"
+	depends on DISK_IMAGE
+	depends on DISK_IMAGE_BOOT_EFI || DISK_IMAGE_BOOT_BIN
+	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
+	help
+	  Path to the directory or file holding the bootloader data.
+
+config DISK_IMAGE_BOOT_OFFSET
+	hex "Bootloader offset"
+	depends on DISK_IMAGE
+	depends on DISK_IMAGE_BOOT_EFI || DISK_IMAGE_BOOT_BIN
+	default 0x8000
+	help
+	  Offset at which the bootloader partition is placed. Remember
+	  to make sure that the GPT still fits at the start of the
+	  image.
+
+config DISK_IMAGE_RELEASE_URL
+	string "Infix URL"
+	depends on DISK_IMAGE
+	depends on !BR2_TARGET_ROOTFS_SQUASHFS
+	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
+	help
+	  In situations where Infix itself is not being built, but a
+	  disk image is, i.e. when building a bootloader: place this
+	  Infix release in the primary and secondary partitions.
+
+menuconfig GNS3_APPLIANCE
+	bool "GNS3 Appliance"
+	select DISK_IMAGE
+	default y
+	help
+	  Create a GNS3 appliance description that, together with the
+	  disk image, can be imported into GNS3.
+
+config GNS3_APPLIANCE_RAM
+	int "Reserved RAM (MiB)"
+	depends on GNS3_APPLIANCE
+	default "192"
+	help
+	  Amount of host RAM reserved for an appliance instance.
+
+	  Minimum supported size is 192M.
+
+config GNS3_APPLIANCE_IFNUM
+	int "Number of interfaces"
+	depends on GNS3_APPLIANCE
+	default "1"
+	help
+	  Number of Ethernet interfaces to create for an appliance instance.
+
+menuconfig FIT_IMAGE
+	bool "Traditional FIT image"
+	help
+	  Create a "regular" FIT image where the kernel and DTBs are
+	  stored in the FIT rather than inside the rootfs (like it
+	  normally is in Infix).
+
+	  This is useful when trying out Infix on targets whose
+	  bootloader might not be capable of booting a raw Squash, but
+	  is able to handle an FIT.
+
+config FIT_ARCH
+	string
+	depends on FIT_IMAGE
+	default "arm64" if BR2_aarch64
+
+config FIT_KERNEL_LOAD_ADDR
+	string "Kernel load address"
+	depends on FIT_IMAGE
+
+config SDCARD_AUX
+	bool "Create SD-card aux partition"
+	help
+	  Create and populate aux.ext4 with rootfs.itbh and rauc.status
+	  For use with a static genimage.cfg for, e.g., SD-cards.

board/common/README.txt

@@ -34,7 +34,7 @@ Depending on how your Linux installation is set up, the following may
 require being run with superuser privileges, i.e., you may need to
 repend the command with 'sudo'.
 
-    $ ./qemu/run.sh
+    $ ./qemu.sh
 
 You should now see the Infix init system booting up.  When the final
 "Please press Enter to activate this console." is shown, press Enter
@@ -75,13 +75,13 @@ interface, which requires the following extra package:
 
 We can now enter the configuration:
 
-    $ ./qemu/run.sh -c
+    $ ./qemu.sh -c
 
 Go down to *Networking*, select *TAP*, now you can change the *Number of
 TAPs*, e.g. to 10.  Exit and save the configuration, then you can start
 Qemu again:
 
-    $ ./qemu/run.sh
+   ./qemu.sh
 
 > Make sure to do a factory reset from the CLI, otherwise you will be
 > stuck with that single interface from before.

board/common/busybox_defconfig

@@ -1016,7 +1016,12 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
-# CONFIG_UDHCPC6 is not set
+CONFIG_UDHCPC6_DEFAULT_SCRIPT="/usr/share/udhcpc/default6.script"
+CONFIG_UDHCPC6=y
+CONFIG_FEATURE_UDHCPC6_RFC3646=y
+CONFIG_FEATURE_UDHCPC6_RFC4704=y
+CONFIG_FEATURE_UDHCPC6_RFC4833=y
+CONFIG_FEATURE_UDHCPC6_RFC5970=y
 
 #
 # Common options for DHCP applets

board/common/common.mk

@@ -1,7 +1,4 @@
-include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/image.mk
-include $(BR2_EXTERNAL_INFIX_PATH)/board/common/qemu/qemu.mk
-
-ifeq ($(TRUSTED_KEYS),y)
+ifeq ($(SIGN_ENABLED),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk
 
 TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)

board/common/genimage.cfg.in

@@ -1,5 +1,16 @@
 @BOOTIMG@
 
+image aux.ext4 {
+	mountpoint = "/aux"
+	temporary = true
+	size = @AUXSIZE@
+
+	ext4 {
+		label = "aux"
+		use-mke2fs = true
+	}
+}
+
 image cfg.ext4 {
 	empty = true
 	temporary = true
@@ -22,8 +33,7 @@ image var.ext4 {
 	}
 }
 
-image disk.img {
-	temporary = true
+image @DISKIMG@ {
 	size = @TOTALSIZE@
 	hdimage {
 		partition-table-type = "gpt"
@@ -58,15 +68,5 @@ image disk.img {
 	}
 }
 
-image @QCOWIMG@ {
-	qemu {
-		format = "qcow2"
-	}
-
-	partition disk {
-		image = "disk.img"
-	}
-}
-
 # Silence genimage warnings
 config {}

board/common/image/image-itb-aux/Config.in

@@ -1,10 +0,0 @@
-config IMAGE_ITB_AUX
-	bool "aux partition"
-	depends on IMAGE_ITB_ROOTFS
-	select BR2_PACKAGE_HOST_UBOOT_TOOLS
-	select BR2_PACKAGE_HOST_GENIMAGE
-	help
-	  Create and populate auxiliary partition, aux.ext4, with
-	  metadata needed by U-Boot and RAUC to operate properly on
-	  systems using ITB images. This may then be included as a
-	  partition in a larger disk image.

board/common/image/image-itb-aux/generate.sh

@@ -1,85 +0,0 @@
-#!/bin/sh
-
-set -e
-
-boot="${1}"
-squash="${BINARIES_DIR}"/rootfs.squashfs
-itbh="${BINARIES_DIR}"/rootfs.itbh
-aux="${BINARIES_DIR}"/aux.ext4
-
-mkdir -p "${WORKDIR}"/aux
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp
-
-cp -f "${itbh}" "${WORKDIR}"/aux/primary.itbh
-cp -f "${itbh}" "${WORKDIR}"/aux/secondary.itbh
-
-tstamp=$(date -u +%FT%TZ)
-rootsha=$(sha256sum "${squash}" | cut -d" " -f1)
-rootsize=$(stat -c %s "${squash}")
-cat <<EOF >"${WORKDIR}"/aux/rauc.status
-[slot.rootfs.0]
-bundle.compatible=${COMPATIBLE}
-bundle.version=${VERSION}
-status=ok
-sha256=${rootsha}
-size=${rootsize}
-installed.timestamp=$tstamp
-installed.count=1
-activated.timestamp=$tstamp
-activated.count=1
-
-[slot.rootfs.1]
-bundle.compatible=${COMPATIBLE}
-bundle.version=${VERSION}
-status=ok
-sha256=${rootsha}
-size=${rootsize}
-installed.timestamp=$tstamp
-installed.count=1
-activated.timestamp=$tstamp
-activated.count=1
-EOF
-
-case "${boot}" in
-    uboot)
-	cat <<EOF | mkenvimage -s 0x4000 -o "${WORKDIR}"/aux/uboot.env -
-BOOT_ORDER=primary secondary net
-BOOT_primary_LEFT=1
-BOOT_secondary_LEFT=1
-BOOT_net_LEFT=1
-EOF
-	;;
-    grub)
-	mkdir -p "${WORKDIR}"/aux/grub
-	cp -f "${PKGDIR}"/grub.cfg "${PKGDIR}"/grubenv "${WORKDIR}"/aux/grub
-	;;
-    *)
-	echo "UNSUPPORTED BOOTLOADER ${boot}" >&2
-	exit 1
-esac
-
-cat <<EOF >"${WORKDIR}"/genimage.cfg
-image $(basename ${aux}) {
-	mountpoint = "/"
-	size = 8M
-
-	ext4 {
-		label = "aux"
-		use-mke2fs = true
-		features = "^metadata_csum,^metadata_csum_seed,uninit_bg"
-                extraargs = "-m 0 -i 4096"
-	}
-}
-
-# Silence genimage warnings
-config {}
-EOF
-
-genimage \
-    --loglevel 1 \
-    --tmppath    "${WORKDIR}"/tmp \
-    --rootpath   "${WORKDIR}"/aux \
-    --inputpath  "${WORKDIR}" \
-    --outputpath "$(dirname ${aux})" \
-    --config     "${WORKDIR}"/genimage.cfg

board/common/image/image-itb-aux/grub.cfg

@@ -1,80 +0,0 @@
-set timeout="1"
-
-load_env ORDER DEBUG
-
-if [ -z "$ORDER" ]; then
-    set ORDER="primary secondary"
-fi
-
-set ORDER="$ORDER reboot"
-
-for slot in $ORDER; do
-    if [ -z "$default" ]; then
-        set default="$slot"
-    else
-        # Contrary to what the documentation says, GRUB (2.06) does
-        # not support using titles or IDs in the fallback variable, so
-        # we translate to indices.
-        if [ "$slot" = "primary" ]; then
-            set fallback="$fallback 0"
-        elif [ "$slot" = "secondary" ]; then
-            set fallback="$fallback 1"
-        elif [ "$slot" = "net" ]; then
-            set fallback="$fallback 2"
-        elif [ "$slot" = "reboot" ]; then
-            set fallback="$fallback 3"
-	fi
-    fi
-done
-
-if [ "$DEBUG" ]; then
-    set log="debug"
-else
-    set log="loglevel=4"
-fi
-
-# From board/common/rootfs/etc/partition-uuid
-search -p 107ae911-a97b-4380-975c-7ce1a2dde1e0 --set primary
-search -p 352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02 --set secondary
-
-export primary
-export secondary
-
-submenu "primary" "$log" {
-    set slot="$1"
-    set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
-    set root="($primary)"
-    source /boot/grub/grub.cfg
-}
-
-submenu "secondary" "$log"  {
-    set slot="$1"
-    set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
-    set root="($secondary)"
-    source /boot/grub/grub.cfg
-}
-
-submenu "net" "$log"  {
-    net_dhcp
-
-    if [ "$net_efinet0_dhcp_next_server" -a "$net_efinet0_dhcp_boot_file" ]; then
-	set initrd=(tftp,$net_efinet0_dhcp_next_server)/$net_efinet0_dhcp_boot_file
-	loopback initrd $initrd
-	set root=(initrd)
-
-	set slot="$1"
-	set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 qroot=/dev/ram0 ramdisk_size=65536 $2"
-	source /boot/grub/grub.cfg
-    else
-	if [ -z "$net_efinet0_dhcp_next_server" ]; then
-	    echo "No TFTP server supplied in DHCP response"
-	fi
-	if [ -z "$net_efinet0_dhcp_boot_file" ]; then
-	    echo "No bootfile supplied in DHCP response"
-	fi
-    fi
-}
-
-submenu "reboot" {
-    reboot
-}

board/common/image/image-itb-aux/grubenv

@@ -1,10 +0,0 @@
-# GRUB Environment Block
-# WARNING: Do not edit this file by tools other than grub-editenv!!!
-ORDER=primary secondary net
-primary_OK=1
-secondary_OK=1
-net_OK=1
-primary_TRY=0
-secondary_TRY=0
-net_TRY=0
-#########################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################

board/common/image/image-itb-aux/image-itb-aux.mk

@@ -1,10 +0,0 @@
-################################################################################
-#
-# image-itb-aux
-#
-################################################################################
-
-IMAGE_ITB_AUX_DEPENDENCIES := host-uboot-tools host-genimage image-itb-rootfs
-IMAGE_ITB_AUX_OPTS := $(if $(BR2_TARGET_GRUB2),grub,uboot)
-
-$(eval $(ix-image))

board/common/image/image-itb-dl-release/Config.in

@@ -1,15 +0,0 @@
-menuconfig IMAGE_ITB_DL_RELEASE
-	bool "Download existing release"
-	depends on !BR2_TARGET_ROOTFS_SQUASHFS
-	help
-	  This is primarily used by target specific builds, where the
-	  bootloader artifact needs to be combined with an existing
-	  Infix image, to create a full disk image that can be
-	  provisioned to an SD-card or eMMC.
-
-config IMAGE_ITB_DL_RELEASE_URL
-	string "URL"
-	depends on IMAGE_ITB_DL_RELEASE
-	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
-	help
-	  URL to release tarball.

board/common/image/image-itb-dl-release/generate.sh

@@ -1,25 +0,0 @@
-#!/bin/sh
-
-set -e
-
-squash="${BINARIES_DIR}"/rootfs.squashfs
-aux="${BINARIES_DIR}"/aux.ext4
-
-[ -f "${squash}" ] && [ -f "${aux}" ] && exit 0
-
-archive="${WORKDIR}/$(basename ${URL})"
-[ -f "${archive}" ] || wget -O"${archive}" "${URL}"
-
-echo "Unpacking..."
-tar -xa --strip-components=1 -C "${BINARIES_DIR}" -f "${archive}"
-
-auxsize=$(stat -c %s "${aux}")
-if [ "${auxsize}" -gt $((8 << 20)) ]; then
-    # In older releases, 16M aux.ext4 images were generated. In order
-    # to keep the image-itb-qcow logic simpler, trim it 8M, which we
-    # always generate nowadays.
-    echo "WARNING: Auxiliary partition is unexpectedly large. Resizing..."
-    resize2fs "${aux}" 8M
-    truncate -s 8M "${aux}"
-    tune2fs -l "${aux}"
-fi

board/common/image/image-itb-dl-release/image-itb-dl-release.mk

@@ -1,9 +0,0 @@
-################################################################################
-#
-# image-itb-dl-release
-#
-################################################################################
-
-IMAGE_ITB_DL_RELEASE_CONFIG_VARS := URL
-
-$(eval $(ix-image))

board/common/image/image-itb-gns3a/Config.in

@@ -1,23 +0,0 @@
-menuconfig IMAGE_ITB_GNS3A
-	bool "GNS3 Appliance (ITB)"
-	depends on BR2_x86_64
-	select IMAGE_ITB_QCOW
-	help
-	  Create a GNS3 appliance description that, together with the
-	  disk image, can be imported into GNS3.
-
-config IMAGE_ITB_GNS3A_RAM
-	int "Reserved RAM (MiB)"
-	depends on IMAGE_ITB_GNS3A
-	default "192"
-	help
-	  Amount of host RAM reserved for an appliance instance.
-
-	  Minimum supported size is 192M.
-
-config IMAGE_ITB_GNS3A_IFNUM
-	int "Number of interfaces"
-	depends on IMAGE_ITB_GNS3A
-	default "1"
-	help
-	  Number of Ethernet interfaces to create for an appliance instance.

board/common/image/image-itb-gns3a/generate.sh

@@ -1,59 +0,0 @@
-#!/bin/sh
-
-set -e
-
-bios="${BINARIES_DIR}"/OVMF.fd
-qcow="${BINARIES_DIR}"/"${ARTIFACT}".qcow2
-gns3a="${BINARIES_DIR}"/"${ARTIFACT}".gns3a
-
-cat <<EOF >"${gns3a}"
-{
-    "name": "${ARTIFACT} devel",
-    "category": "router",
-    "description": "${ARTIFACT} development appliance",
-    "vendor_name": "Kernelkit",
-    "vendor_url": "https://kernelkit.org",
-    "product_name": "${ARTIFACT} devel",
-    "registry_version": 6,
-    "status": "experimental",
-    "maintainer": "Kernelkit",
-    "maintainer_email": "null@kernelkit.org",
-    "usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
-    "port_name_format": "eth{0}",
-    "linked_clone": true,
-    "qemu": {
-        "adapter_type": "virtio-net-pci",
-        "adapters": ${IFNUM},
-        "ram": ${RAM},
-        "cpus": 1,
-        "hda_disk_interface": "virtio",
-        "arch": "x86_64",
-        "console_type": "telnet",
-        "bios_image": "$(basename ${bios})",
-        "kvm": "allow"
-    },
-    "images": [
-        {
-            "filename": "$(basename "${bios}")",
-            "filesize": $(stat --printf='%s' "${bios}"),
-            "md5sum": "$(md5sum "${bios}" | awk '{print $1}')",
-            "version": "0.0"
-        },
-        {
-            "filename": "$(basename "${qcow}")",
-            "filesize": $(stat --printf='%s' "${qcow}"),
-            "md5sum": "$(md5sum "${qcow}" | awk '{print $1}')",
-            "version": "${VERSION}"
-        }
-    ],
-    "versions": [
-        {
-            "name": "${VERSION}",
-            "images": {
-                "bios_image": "$(basename ${bios})",
-                "hda_disk_image": "$(basename ${qcow})"
-            }
-        }
-    ]
-}
-EOF

board/common/image/image-itb-gns3a/image-itb-gns3a.mk

@@ -1,10 +0,0 @@
-################################################################################
-#
-# image-itb-gns3a
-#
-################################################################################
-
-IMAGE_ITB_GNS3A_DEPENDENCIES := image-itb-qcow
-IMAGE_ITB_GNS3A_CONFIG_VARS  := IFNUM RAM
-
-$(eval $(ix-image))

board/common/image/image-itb-qcow/Config.in

@@ -1,68 +0,0 @@
-menuconfig IMAGE_ITB_QCOW
-	bool "QEMU disk image (ITB)"
-	depends on (IMAGE_ITB_ROOTFS && IMAGE_ITB_AUX) || IMAGE_ITB_DL_RELEASE
-	select BR2_PACKAGE_HOST_GENIMAGE
-	help
-	  Compose a full disk image with redundant Linux OS partitions,
-	  configuration partition, etc., for systems using ITB images.
-
-	  This is useful when:
-	  - Bringing up a blank system during manufacturing
-	  - Creating a GNS3 appliance
-	  - Developing/debugging issues in the boot process in QEMU
-
-menuconfig IMAGE_ITB_QCOW_SIZE
-	string "Image size"
-	depends on IMAGE_ITB_QCOW
-	default "512M"
-	help
-	  Create a disk image of this size.  A K/M/G suffix may be used
-	  to multiply by powers of 1024.  Suffixes like KB/MB/GB may be
-	  used to multiply by powers of 1000.  The image will be split
-	  proportionally to fit the two rootfs, a kernel, a writable
-	  /cfg and /var partiotions.
-
-	  Minimum supported size is 512M.
-
-choice
-	prompt "Bootloader"
-	depends on IMAGE_ITB_QCOW
-	default IMAGE_ITB_QCOW_BOOT_EFI if BR2_x86_64
-	default IMAGE_ITB_QCOW_BOOT_NONE
-
-config IMAGE_ITB_QCOW_BOOT_NONE
-	bool "None"
-	help
-	  Do not create any bootloader partition in the disk image.
-
-config IMAGE_ITB_QCOW_BOOT_EFI
-	bool "EFI"
-	help
-	  Create a boot partition from a directory containing an EFI
-	  boot application, e.g. GRUB.
-
-config IMAGE_ITB_QCOW_BOOT_BIN
-	bool "Binary"
-	help
-	  Create a boot partition from a raw image containing the boot
-	  application, e.g. U-Boot.
-
-endchoice
-
-config IMAGE_ITB_QCOW_BOOT_DATA
-	string "Bootloader data"
-	depends on IMAGE_ITB_QCOW
-	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
-	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
-	help
-	  Path to the directory or file holding the bootloader data.
-
-config IMAGE_ITB_QCOW_BOOT_OFFSET
-	hex "Bootloader offset"
-	depends on IMAGE_ITB_QCOW
-	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
-	default 0x8000
-	help
-	  Offset at which the bootloader partition is placed. Remember
-	  to make sure that the GPT still fits at the start of the
-	  image.

board/common/image/image-itb-qcow/image-itb-qcow.mk

@@ -1,15 +0,0 @@
-################################################################################
-#
-# image-itb-qcow
-#
-################################################################################
-
-# We can source the rootfs+aux from a local build, or from a
-# downloaded release; so adjust our dependencies accordingly.
-IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_ROOTFS)     := image-itb-rootfs image-itb-aux
-IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_DL_RELEASE) := image-itb-dl-release
-
-IMAGE_ITB_QCOW_DEPENDENCIES := host-genimage $(IMAGE_ITB_QCOW_SRC-y)
-IMAGE_ITB_QCOW_CONFIG_VARS := BOOT_DATA BOOT_OFFSET SIZE
-
-$(eval $(ix-image))

board/common/image/image-itb-rauc/Config.in

@@ -1,27 +0,0 @@
-menuconfig IMAGE_ITB_RAUC
-	bool "RAUC upgrade bundle (ITB)"
-	select IMAGE_ITB_ROOTFS
-	select BR2_PACKAGE_HOST_RAUC
-	help
-	  Create RAUC upgrade bundle, for targets using ITB images,
-	  that can be used to upgrade a running system to this version
-	  of Infix.
-
-config IMAGE_ITB_RAUC_KEY
-	string "signing key"
-	depends on IMAGE_ITB_RAUC
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
-	help
-	  Path to the private key, in PKCS#8 format, used to sign
-	  the RAUC bundle; or a PKCS#11 URI.
-
-config IMAGE_ITB_RAUC_CERT
-	string "signing certificate"
-	depends on IMAGE_ITB_RAUC
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
-	help
-	  Path to the X509 certificate which will be associated with
-	  the bundle signature.
-
-	  NOTE: This cert MUST be included in the trust store of the
-	        system on which this bundle is to be installed.

board/common/image/image-itb-rauc/generate.sh

@@ -1,35 +0,0 @@
-#!/bin/sh
-
-set -e
-
-squash="${BINARIES_DIR}"/rootfs.squashfs
-itbh="${BINARIES_DIR}"/rootfs.itbh
-pkg="${BINARIES_DIR}"/"${ARTIFACT}.pkg"
-
-cp -f "${PKGDIR}"/hooks.sh "${WORKDIR}"/hooks.sh
-
-# RAUC internally uses the file extension to find a suitable install
-# handler, hence the name must be .img
-cp -f "${squash}" "${WORKDIR}"/rootfs.img
-cp -f "${itbh}"   "${WORKDIR}"/rootfs.itbh
-
-cat >"${WORKDIR}"/manifest.raucm <<EOF
-[update]
-compatible=${COMPATIBLE}
-version=${VERSION}
-
-[bundle]
-format=verity
-
-[hooks]
-filename=hooks.sh
-
-[image.rootfs]
-filename=rootfs.img
-hooks=post-install
-EOF
-
-rauc --cert="${CERT}" --key="${KEY}" \
-     bundle "${WORKDIR}" "${pkg}.next"
-
-mv "${pkg}.next" "${pkg}"

board/common/image/image-itb-rauc/image-itb-rauc.mk

@@ -1,10 +0,0 @@
-################################################################################
-#
-# image-itb-rauc
-#
-################################################################################
-
-IMAGE_ITB_RAUC_DEPENDENCIES := host-rauc image-itb-rootfs
-IMAGE_ITB_RAUC_CONFIG_VARS := KEY CERT
-
-$(eval $(ix-image))

board/common/image/image-itb-rootfs/Config.in

@@ -1,20 +0,0 @@
-menuconfig IMAGE_ITB_ROOTFS
-	bool "rootfs.itb+.itbh"
-	select BR2_TARGET_ROOTFS_SQUASHFS
-	select BR2_PACKAGE_HOST_UBOOT_TOOLS
-	help
-	  Create a signed ITB image containing a SquashFS of rootfs
-	  and extract detached header (.itbh) for U-Boot based
-	  targets.
-
-config IMAGE_ITB_ROOTFS_KEY
-	string "signing key"
-	depends on IMAGE_ITB_ROOTFS
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
-	help
-	  Path to the private RSA key, in PKCS#8 format, used to sign
-	  the root filesystem.
-
-	  If the path is prefixed with "<hint>:", then that used as
-	  the "key-name-hint" in the resulting ITB, otherwise the
-	  basename of the path, with any extension removed, is used.

board/common/image/image-itb-rootfs/generate.sh

@@ -1,71 +0,0 @@
-#!/bin/sh
-
-set -e
-
-squash="${BINARIES_DIR}"/rootfs.squashfs
-
-itb="${BINARIES_DIR}"/rootfs.itb
-itbh_size=0x1000
-
-IFS=:
-set ${KEY}
-case $# in
-    1)
-	keyfile="$1"
-	hint=$(basename ${keyfile%.*})
-	;;
-    2)
-	keyfile="$2"
-	hint="$1"
-	;;
-    *)
-	echo "INVALID KEY" >&2
-	exit 1
-	;;
-esac
-
-rsanibbles=$(openssl rsa -in "${KEY}" -noout -modulus | \
-		 sed -e 's/^Modulus=//' | tr -d '\n' | wc -c)
-if [ "${rsanibbles}" -le 0 ]; then
-    echo "ONLY RSA KEYS ARE SUPPORTED" >&2
-    exit 1
-fi
-
-cat >"${WORKDIR}"/rootfs.its <<EOF
-/dts-v1/;
-
-/ {
-	description = "${ARTIFACT}";
-	creator = "infix";
-	#address-cells = <0x1>;
-
-	images {
-		rootfs {
-			description = "rootfs";
-			type = "ramdisk";
-			os = "linux";
-			compression = "none";
-			data = /incbin/("${squash}");
-			signature-1 {
-				algo = "sha256,rsa$((rsanibbles << 2))";
-				key-name-hint = "${hint}";
-			};
-		};
-	};
-
-	configurations {
-		default = "verity";
-		verity {
-			ramdisk = "rootfs";
-		};
-	};
-};
-
-EOF
-
-mkimage -E -p $itbh_size -B $itbh_size \
-	-f "${WORKDIR}"/rootfs.its \
-	-g "${hint}" -G "${keyfile}" \
-	"${itb}"
-
-dd if="${itb}" bs=$((itbh_size)) count=1 of="${itb}h" status=none

board/common/image/image-itb-rootfs/image-itb-rootfs.mk

@@ -1,10 +0,0 @@
-################################################################################
-#
-# image-itb-rootfs
-#
-################################################################################
-
-IMAGE_ITB_ROOTFS_DEPENDENCIES := rootfs-squashfs
-IMAGE_ITB_ROOTFS_CONFIG_VARS := KEY
-
-$(eval $(ix-image))

board/common/image/image-readme/Config.in

@@ -1,6 +0,0 @@
-config IMAGE_README
-	bool "Install README.md in images"
-	help
-	  Install a README.md with useful information about getting
-	  started with Infix in the images directory (thereby also
-	  including it in the resulting release tarball).

board/common/image/image-readme/image-readme.mk

@@ -1,18 +0,0 @@
-################################################################################
-#
-# image-readme
-#
-################################################################################
-
-IMAGE_README_DIR := $(pkgdir)
-
-image-readme: $(BINARIES_DIR)/README.md
-
-$(BINARIES_DIR)/README.md: $(IMAGE_README_DIR)/README.md
-	@$(call IXMSG,"Installing README.md")
-	@mkdir -p $(BINARIES_DIR)
-	@cp $< $@
-
-ifeq ($(IMAGE_README),y)
-TARGETS_ROOTFS += image-readme
-endif

board/common/image/image.mk

@@ -1,2 +0,0 @@
-include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/ix-image.mk
-include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/*/*.mk))

board/common/image/ix-image.mk

@@ -1,26 +0,0 @@
-define inner-ix-image
-
-$(2)_DIR := $$(pkgdir)
-
-$(1): $$($(2)_DEPENDENCIES)
-	@$$(call IXMSG,"$$(if $$($(2)_MESSAGE),$$($(2)_MESSAGE),Creating $(1))")
-	@mkdir -p $$(BUILD_DIR)/$(1)
-	@ \
-	PATH=$$(BR_PATH) \
-	PKGDIR=$$($(2)_DIR) \
-	WORKDIR=$$(BUILD_DIR)/$(1) \
-	BINARIES_DIR=$$(BINARIES_DIR) \
-	BR2_EXTERNAL_INFIX_PATH=$$(BR2_EXTERNAL_INFIX_PATH) \
-	ARTIFACT=$$(INFIX_ARTIFACT) \
-	COMPATIBLE=$$(INFIX_COMPATIBLE) \
-	VERSION=$$(INFIX_VERSION) \
-	$$(foreach var,$$($(2)_CONFIG_VARS),$$(var)=$$($(2)_$$(var)) ) \
-	$$($(2)_DIR)/generate.sh $$($(2)_OPTS)
-
-ifeq ($$($(2)),y)
-TARGETS_ROOTFS += $(1)
-endif
-
-endef
-
-ix-image = $(call inner-ix-image,$(pkgname),$(call UPPERCASE,$(pkgname)))

board/common/mkaux.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+
+rootdir=$BUILD_DIR/genimage.root
+tempdir=$BUILD_DIR/genimage.tmp
+
+cat <<EOF > /tmp/mkaux.cfg
+image aux.ext4 {
+	mountpoint = "/aux"
+	size = 16M
+
+	ext4 {
+		label = "aux"
+		use-mke2fs = true
+		features = "^metadata_csum,^metadata_csum_seed,uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+# Silence genimage warnings
+config {}
+EOF
+
+rm -rf   "$rootdir/aux"
+mkdir -p "$rootdir/aux"
+cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/primary.itbh"
+cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/secondary.itbh"
+cp -f "$BINARIES_DIR/rauc.status" "$rootdir/aux/rauc.status"
+
+mkenvimage -s 0x4000 -o "$rootdir/aux/uboot.env" \
+	   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
+
+rm -rf "$BINARIES_DIR/aux.ext4"
+rm -rf "$tempdir"
+
+genimage \
+    --rootpath   "$rootdir" \
+    --tmppath    "$tempdir" \
+    --inputpath  "$BINARIES_DIR" \
+    --outputpath "$BINARIES_DIR" \
+    --config "/tmp/mkaux.cfg"

board/common/mkdisk.sh

@@ -1,6 +1,8 @@
 #!/bin/sh
 set -e
 
+. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
+
 K=10
 M=20
 G=30
@@ -45,32 +47,43 @@ dimension()
 	exit 1
     fi
 
-    # Place aux right after the GPT...
-    auxoffs=$((32 << K))
+    # Size var to fit whatever is left over. Also reserve another 32K
+    # at the end to make room for the backup GPT.
+    varsize=$(($total - $auxsize - 2 * $imgsize - $cfgsize))
+    if [ "$bootoffs" ]; then
+	varsize=$(($varsize - $bootsize))
+    fi
+    varsize=$(($varsize - (32 << K)))
 
     if [ "$bootoffs" ]; then
-	if [ $((bootoffs)) -lt $((32 << K)) ]; then
-	    echo "Boot partition collides with GPT"
-	    exit 1
-	fi
-
-	# ...unless we have a boot partition, in which case we place
-	# it after that.
-	auxoffs=$((auxoffs + bootsize))
+	# Align the end of the boot partition to an even MiB. E.g. if
+	# boot was dimensioned to 4M, and bootoffs is 32K, then the
+	# final bootsize becomes 4M - 32K, meaning aux will start on
+	# exactly 4M.
+	auxoffs=$bootsize
+	bootsize=$(($bootsize - $bootoffs))
+    else
+	# No bootloader, place aux after GPT, resize it to end on an
+	# even MiB (as is done for boot above).
+	auxoffs=$((32 << K))
+	auxsize=$(($auxsize - $auxoffs))
     fi
+}
 
-    # Finally, size var to fit whatever is left over by subtracting
-    # all other images, plus another 32K at the end for the backup
-    # GPT.
-    varsize=$((total - auxoffs - auxsize - 2 * imgsize - cfgsize - (32 << K)))
+probeboot()
+{
+    # If we have built an EFI app, typically grub, make sure to
+    # include it.
+    if [ -d $BINARIES_DIR/efi-part/EFI ]; then
+	bootoffs=$((32 << K))
+    fi
 }
 
 genboot()
 {
     if [ -d "$bootdata" ]; then
 	bootimg=$(cat <<EOF
-image efi-part.vfat {
-	temporary = true
+image $BINARIES_DIR/efi-part.vfat {
 	size = $bootsize
 	vfat {
 		file EFI {
@@ -85,7 +98,7 @@ EOF
 		offset = $bootoffs
 		partition-type-uuid = U
 		bootable = true
-		image = efi-part.vfat
+		image = $BINARIES_DIR/efi-part.vfat
 	}
 EOF
 		  )
@@ -104,29 +117,44 @@ EOF
     fi
 }
 
-mkdir -p "${WORKDIR}"/root
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp
+common=$(dirname $(readlink -f "$0"))
+root=$BUILD_DIR/genimage.root
+tmp=$BUILD_DIR/genimage.tmp
 
-qcowimg="${ARTIFACT}.qcow2"
-total=$(size2int $SIZE)
-bootoffs=
-bootdata=$BOOT_DATA
+total=$((512 << M))
+bootoffs=$((32 << K))
+bootdata=
+diskimg=disk.img
 bootimg=
 bootpart=
+tmpimage=$(mktemp)
+while getopts "a:b:B:n:s:" opt; do
+    case ${opt} in
+	a)
+	    arch=$OPTARG
+	    ;;
+	b)
+	    bootdata=$OPTARG
+	    ;;
+	B)
+	    bootoffs=$(($OPTARG))
+	    ;;
+	n)
+	    diskimg=${OPTARG}
+	    ;;
+	s)
+	    total=$(size2int $OPTARG)
+	    ;;
+    esac
+done
+shift $((OPTIND - 1))
 
-if [ -n "${BOOT_OFFSET}" ]; then
-    bootoffs=$(($BOOT_OFFSET))
-fi
+mkdir -p $root
 
+probeboot
 dimension
 genboot
 
-. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
-[ -n "${AUX_UUID}" ]
-[ -n "${PRIMARY_UUID}" ]
-[ -n "${SECONDARY_UUID}" ]
-
 # Use awk over sed because replacement text may contain newlines,
 # which sed does not approve of.
 awk \
@@ -138,7 +166,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vqcowimg=$qcowimg \
+	  -vdiskimg=$tmpimage \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -147,7 +175,7 @@ awk \
 		sub(/@IMGSIZE@/, imgsize);
 		sub(/@CFGSIZE@/, cfgsize);
 		sub(/@VARSIZE@/, varsize);
-		sub(/@QCOWIMG@/, qcowimg);
+		sub(/@DISKIMG@/, diskimg);
 		sub(/@BOOTIMG@/, bootimg);
 		sub(/@BOOTPART@/, bootpart);
 		sub(/@AUXUUID@/, auxuuid);
@@ -155,11 +183,35 @@ awk \
 		sub(/@SECONDARYUUID@/, secondaryuuid);
 
 	  }1' \
-	      < $PKGDIR/genimage.cfg.in >$WORKDIR/genimage.cfg
+	      < $common/genimage.cfg.in >$root/genimage.cfg
+
+mkdir -p $root/aux
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
+cp -f $BINARIES_DIR/rauc.status $root/aux/rauc.status
+
+case "$arch" in
+    aarch64)
+	mkenvimage -s 0x4000 -o "$root/aux/uboot.env" \
+		   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
+	;;
+    x86_64)
+	mkdir -p "$root/aux/grub"
+	cp -f "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grub.cfg" \
+	      "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grubenv"  \
+	      "$root/aux/grub/"
+	;;
+    *)
+	;;
+esac
+
+rm -rf "$tmp"
 
 genimage \
-    --tmppath    "${WORKDIR}"/tmp  \
-    --rootpath   "${WORKDIR}"/root \
-    --inputpath  "$BINARIES_DIR"   \
-    --outputpath "$BINARIES_DIR"   \
-    --config "${WORKDIR}"/genimage.cfg
+    --rootpath "$root" \
+    --tmppath  "$tmp" \
+    --inputpath "$BINARIES_DIR" \
+    --config "$root/genimage.cfg"
+
+qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
+rm "$tmpimage"

board/common/mkfit.sh

@@ -0,0 +1,118 @@
+#!/bin/sh
+
+die()
+{
+    echo "$@" >&2
+    exit 1
+}
+
+load_cfg()
+{
+    local tmp=$(mktemp -p /tmp)
+
+    grep ^FIT_ $BR2_CONFIG >$tmp
+    .  $tmp
+    rm $tmp
+}
+
+load_cfg
+[ "$FIT_IMAGE" = "y" ] || exit 0
+
+work=$BUILD_DIR/fit-image-local
+dtbs=$(find $BINARIES_DIR -name '*.dtb')
+kernel=$(find $BINARIES_DIR -name '*Image' | head -n1)
+squash=$BINARIES_DIR/rootfs.squashfs
+
+mkdir -p $work
+gzip <$kernel >$work/Image.gz
+kernel=$work/Image.gz
+
+rm -rf $work/rootfs
+unsquashfs -f -d $work/rootfs $squash
+rm -f $work/rootfs/boot/*Image
+
+squash=$work/rootfs-no-kernel.squashfs
+rm -f $squash
+mksquashfs $work/rootfs $squash
+
+# mkimage will only align images to 4 bytes, but U-Boot will leave
+# both DTB and ramdisk in place when starting the kernel. So we pad
+# all components up to a 4k boundary.
+truncate -s %4k $kernel $dtbs
+
+: >$work/dtbs.itsi
+: >$work/cfgs.itsi
+for dtb in $dtbs; do
+    name=$(basename $dtb .dtb)
+
+    cat <<EOF >>$work/dtbs.itsi
+		$name-dtb {
+			description = "$name";
+			type = "flat_dt";
+			arch = "$FIT_ARCH";
+			compression = "none";
+			data = /incbin/("$dtb");
+		};
+EOF
+    cat <<EOF >>$work/cfgs.itsi
+		$name {
+			description = "$name";
+			kernel = "kernel";
+			ramdisk = "ramdisk";
+			fdt = "$name-dtb";
+		};
+EOF
+done
+
+: >$work/kernel-load.itsi
+if [ "$FIT_KERNEL_LOAD_ADDR" ]; then
+    cat <<EOF >$work/kernel-load.itsi
+			load = <$FIT_KERNEL_LOAD_ADDR>;
+			entry = <$FIT_KERNEL_LOAD_ADDR>;
+EOF
+fi
+
+cat <<EOF >$work/infix.its
+/dts-v1/;
+
+/ {
+	timestamp = <$(date +%s)>;
+	description = "Infix ($FIT_ARCH)";
+	creator = "infix";
+	#address-cells = <0x1>;
+
+	images {
+
+		kernel {
+			description = "Linux";
+			type = "kernel";
+			arch = "$FIT_ARCH";
+			os = "linux";
+$(cat $work/kernel-load.itsi)
+			compression = "gzip";
+			data = /incbin/("$kernel");
+		};
+
+		ramdisk {
+			description = "Infix";
+			type = "ramdisk";
+			os = "linux";
+			arch = "$FIT_ARCH";
+			compression = "none";
+			data = /incbin/("$squash");
+		};
+
+$(cat $work/dtbs.itsi)
+
+	};
+
+	configurations {
+$(cat $work/cfgs.itsi)
+	};
+};
+EOF
+
+mkimage \
+    -E -p 0x1000 \
+    -f $work/infix.its $BINARIES_DIR/infix.itb \
+    || die "Unable to create FIT image"

board/common/mkgns3a.sh

@@ -0,0 +1,103 @@
+#!/bin/sh
+# shellcheck disable=SC1091
+. "$TARGET_DIR/etc/os-release"
+
+if [ -n "$INFIX_RELEASE" ]; then
+    rel="-${INFIX_RELEASE}"
+fi
+
+ARCH=$1
+NM="${2:-custom}${rel}"
+DISK=$3
+RAM=${4:-512}
+IFNUM=${5:-1}
+
+# The aarch64 build currently has no "loader" but instead starts Linux
+# directly, so we need to add a basic cmdline.
+loader_args()
+{
+    if [ "$ARCH" = "aarch64" ]; then
+	cat <<EOF
+"kernel_command_line": "console=ttyAMA0 root=PARTLABEL=primary quiet",
+EOF
+    fi
+}
+
+loader_img()
+{
+    if [ "$ARCH" = "x86_64" ]; then
+	cat <<EOF
+"bios_image": "$loader",
+EOF
+    else
+	cat <<EOF
+"kernel_image": "$loader",
+EOF
+    fi
+}
+
+if [ "$ARCH" = "x86_64" ]; then
+    loader=OVMF.fd
+    accel=allow
+    opts=
+else
+    loader=Image
+    accel=disable
+    opts="-M virt -cpu cortex-a72"
+fi
+
+echo ">> Disk image MD5: $(md5sum "$BINARIES_DIR/$DISK" | awk '{print $1}')"
+
+cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
+{
+    "name": "$NM",
+    "category": "router",
+    "description": "$INFIX_DESC",
+    "vendor_name": "$VENDOR_NAME",
+    "vendor_url": "$VENDOR_HOME",
+    "product_name": "$NAME",
+    "registry_version": 6,
+    "status": "stable",
+    "maintainer": "$VENDOR_NAME",
+    "maintainer_email": "${SUPPORT_URL#mailto:}",
+    "usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
+    "port_name_format": "eth{0}",
+    "linked_clone": true,
+    "qemu": {
+        "adapter_type": "virtio-net-pci",
+        "adapters": ${IFNUM},
+        "ram": ${RAM},
+        "cpus": 1,
+        "hda_disk_interface": "virtio",
+        "arch": "$ARCH",
+        "console_type": "telnet",
+        $(loader_img)
+        $(loader_args)
+        "kvm": "$accel",
+	"options": "$opts"
+    },
+    "images": [
+        {
+            "filename": "$loader",
+            "filesize": $(stat --printf='%s' "$BINARIES_DIR/$loader"),
+            "md5sum": "$(md5sum "$BINARIES_DIR/$loader" | awk '{print $1}')",
+            "version": "0.0"
+        },
+        {
+            "filename": "$DISK",
+            "filesize": $(stat --printf='%s' "$BINARIES_DIR/$DISK"),
+            "md5sum": "$(md5sum "$BINARIES_DIR/$DISK" | awk '{print $1}')",
+            "version": "0.0"
+        }
+    ],
+    "versions": [
+        {
+            "name": "0.0",
+            "images": {
+                $(loader_img)
+                "hda_disk_image": "$DISK"
+            }
+        }
+    ]
+}
+EOF

board/common/mkmmc.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -e
+
+common=$(dirname $(readlink -f "$0"))
+root=$BUILD_DIR/genimage.root
+tmp=$BUILD_DIR/genimage.tmp
+
+
+mkdir -p $root/aux
+cp -f $BINARIES_DIR/uboot-env.bin $root/aux/uboot.env
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
+
+rm -rf $tmp
+
+genimage \
+    --rootpath $root \
+    --tmppath  $tmp \
+    --inputpath $BINARIES_DIR \
+    --outputpath $BINARIES_DIR \
+    --config $common/genimage.cfg

board/common/mkrauc-status.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+
+# Bootstrap a RAUC status file showing the newly created image
+# installed to both the primary and secondary slots. This then bundled
+# in the aux partition in mkdisk.sh, so that RAUC (on the target) can
+# always report the installed versions.
+rauc info --no-verify --output-format=shell $1 >/tmp/rauc-$$.info
+. /tmp/rauc-$$.info
+rm /tmp/rauc-$$.info
+tstamp=$(date -u +%FT%TZ)
+cat <<EOF
+[slot.rootfs.0]
+bundle.compatible=$RAUC_MF_COMPATIBLE
+bundle.version=$RAUC_MF_VERSION
+status=ok
+sha256=$RAUC_IMAGE_DIGEST_0
+size=$RAUC_IMAGE_SIZE_0
+installed.timestamp=$tstamp
+installed.count=1
+activated.timestamp=$tstamp
+activated.count=1
+
+[slot.rootfs.1]
+bundle.compatible=$RAUC_MF_COMPATIBLE
+bundle.version=$RAUC_MF_VERSION
+status=ok
+sha256=$RAUC_IMAGE_DIGEST_0
+size=$RAUC_IMAGE_SIZE_0
+installed.timestamp=$tstamp
+installed.count=1
+activated.timestamp=$tstamp
+activated.count=1
+EOF

board/common/mkrauc.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+set -e
+
+name=$1
+compat=$2
+sign=$3
+
+crt=$(ls $sign/*.crt)
+key=$(ls $sign/*.key)
+
+common=$(dirname "$(readlink -f "$0")")
+
+work=$BUILD_DIR/mkrauc
+mkdir -p "$work"
+
+cp -f "$common/rauc-hooks.sh" "$work/hooks.sh"
+
+# RAUC internally uses the file extension to find a suitable install
+# handler, hence the name must be .img
+cp -f "$BINARIES_DIR/rootfs.squashfs" "$work/rootfs.img"
+cp -f "$BINARIES_DIR/rootfs.itbh"     "$work/rootfs.itbh"
+
+cat >"$work/manifest.raucm" <<EOF
+[update]
+compatible=${compat}
+version=${INFIX_VERSION}
+
+[bundle]
+format=verity
+
+[hooks]
+filename=hooks.sh
+
+[image.rootfs]
+filename=rootfs.img
+hooks=post-install
+EOF
+
+rm -f "$BINARIES_DIR/$name.pkg"
+
+rauc --cert="$crt" --key="$key" \
+     bundle "$work" "$BINARIES_DIR/$name.pkg"

board/common/post-image.sh

@@ -0,0 +1,112 @@
+#!/bin/sh
+# shellcheck disable=SC2086
+
+common=$(dirname "$(readlink -f "$0")")
+. "$common/lib.sh"
+
+# shellcheck disable=SC1091
+. "$TARGET_DIR/etc/os-release"
+
+# The INFIX_* variables may be composed from BR2_* variables,
+# so we source them last.
+load_cfg BR2_ARCH
+load_cfg BR2_DEFCONFIG
+load_cfg BR2_EXTERNAL_INFIX_PATH
+load_cfg BR2_TARGET_ROOTFS
+load_cfg INFIX_ID
+load_cfg INFIX_COMPATIBLE
+
+# The default IMAGE_ID is infix-$BR2_ARCH but can be overridden
+# for imaage names, and compat strings, like infix-r2s
+if [ -n "$IMAGE_ID" ]; then
+    NAME="$IMAGE_ID"
+else
+    NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
+fi
+diskimg=disk.qcow2
+
+ver()
+{
+    if [ -n "$INFIX_RELEASE" ]; then
+	printf -- "-%s" "${INFIX_RELEASE#v}"
+	return
+    fi
+}
+
+load_cfg SIGN_ENABLED
+if [ "$SIGN_ENABLED" = "y" ]; then
+    load_cfg BR2_ARCH
+    load_cfg SIGN_KEY
+
+    ixmsg "Signing SquashFS Image"
+    $common/sign.sh $BR2_ARCH $SIGN_KEY
+
+    ixmsg "Creating RAUC Update Bundle"
+    $common/mkrauc.sh "$NAME$(ver)" $INFIX_COMPATIBLE $SIGN_KEY
+fi
+
+load_cfg DISK_IMAGE
+if [ "$DISK_IMAGE" = "y" ]; then
+    ixmsg "Creating Disk Image"
+    diskimg="${NAME}-disk$(ver).qcow2"
+    bootcfg=
+    if [ "$DISK_IMAGE_BOOT_DATA" ]; then
+	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
+    fi
+
+    if [ "$BR2_TARGET_ROOTFS_SQUASHFS" != "y" ] && \
+       [ ! -f "$BINARIES_DIR/rootfs.squashfs" ]; then
+	ixmsg "  Injecting $DISK_IMAGE_RELEASE_URL"
+	archive="$BINARIES_DIR/$(basename $DISK_IMAGE_RELEASE_URL)"
+	[ -f "$archive" ] || wget -O"$archive" "$DISK_IMAGE_RELEASE_URL"
+	tar -xa --strip-components=1 -C "$BINARIES_DIR" -f "$archive"
+    fi
+
+    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
+    $common/mkdisk.sh -a $BR2_ARCH -n $diskimg -s $DISK_IMAGE_SIZE $bootcfg
+fi
+
+load_cfg SDCARD_AUX
+if [ "$SDCARD_AUX" = "y" ]; then
+    ixmsg "Creating initial rauc.status"
+    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
+    ixmsg "Creating aux.ext4 for sdcard.img"
+    $common/mkaux.sh
+fi
+
+load_cfg GNS3_APPLIANCE
+if [ "$GNS3_APPLIANCE" = "y" ]; then
+    ixmsg "Creating GNS3 Appliance, $GNS3_APPLIANCE_RAM MiB with $GNS3_APPLIANCE_IFNUM ports"
+    $common/mkgns3a.sh $BR2_ARCH $NAME $diskimg $GNS3_APPLIANCE_RAM $GNS3_APPLIANCE_IFNUM
+fi
+
+load_cfg FIT_IMAGE
+if [ "$FIT_IMAGE" = "y" ]; then
+    ixmsg "Creating Traditional FIT Image"
+    $common/mkfit.sh
+fi
+
+# Only for regular builds, not bootloader-only builds
+if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
+    rel=$(ver)
+    ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
+    if [ -n "$rel" ]; then
+	ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
+    fi
+
+    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
+
+    # Menuconfig support for modifying Qemu args in release tarballs
+    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
+    sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
+	-e "s/@DISK_IMG@/$diskimg/"   \
+	< "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in.in" \
+	> "$BINARIES_DIR/Config.in"
+    rm -f "$BINARIES_DIR/qemu.cfg"
+    CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
+	   "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
+    rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
+
+    # Quick intro for beginners, with links to more information
+    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"
+fi

board/common/qemu/Config.in.in

@@ -78,7 +78,7 @@ endchoice
 config QEMU_MACHINE
 	string "Select emulated machine"
 	default "qemu-system-arm     -M virt,accel=kvm:tcg -cpu max" if QEMU_arm
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu cortex-a53" if QEMU_aarch64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
 	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
@@ -99,20 +99,20 @@ config QEMU_MACHINE_RAM
 config QEMU_KERNEL
 	string
 	depends on QEMU_LOADER_KERNEL
-	default "../zImage"  if QEMU_arm
-	default "../Image"   if QEMU_aarch64
-	default "../bzImage" if QEMU_x86_64
+	default "zImage"  if QEMU_arm
+	default "Image"   if QEMU_aarch64
+	default "bzImage" if QEMU_x86_64
 
 config QEMU_BIOS
 	string
 	depends on !QEMU_LOADER_KERNEL
-	default "../u-boot.bin" if QEMU_LOADER_UBOOT
-	default "../OVMF.fd"    if QEMU_LOADER_OVMF
+	default "u-boot.bin" if QEMU_LOADER_UBOOT
+	default "OVMF.fd"    if QEMU_LOADER_OVMF
 
 config QEMU_ROOTFS
 	string
 	default "@DISK_IMG@" if !QEMU_ROOTFS_INITRD
-	default "../rootfs.squashfs" if QEMU_ROOTFS_INITRD
+	default "rootfs.squashfs" if QEMU_ROOTFS_INITRD
 
 config QEMU_DTB_EXTEND
 	bool

board/common/qemu/qemu.mk

@@ -1,45 +0,0 @@
-################################################################################
-#
-# qemu-scripts
-#
-################################################################################
-
-QEMU_SCRIPTS_DIR := $(pkgdir)
-qemu-kconfig = \
-	CONFIG_="CONFIG_" \
-	BR2_CONFIG="$(BINARIES_DIR)/qemu/.config" \
-	$(BUILD_DIR)/buildroot-config/$(1) $(2) "$(BINARIES_DIR)/qemu/Config.in"
-
-ifeq ($(QEMU_SCRIPTS),y)
-
-.PHONY: run
-run:
-	@$(BINARIES_DIR)/qemu/run.sh
-
-.PHONY: run-menuconfig
-run-menuconfig: $(BUILD_DIR)/buildroot-config/mconf
-	@$(call qemu-kconfig,mconf)
-
-qemu-scripts: \
-		$(BINARIES_DIR)/qemu/run.sh \
-		$(BINARIES_DIR)/qemu/Config.in \
-		$(BINARIES_DIR)/qemu/.config
-
-$(BINARIES_DIR)/qemu/run.sh: $(QEMU_SCRIPTS_DIR)/run.sh
-	@$(call IXMSG,"Installing QEMU scripts")
-	@mkdir -p $(dir $@)
-	@cp $< $@
-
-$(BINARIES_DIR)/qemu/Config.in: $(QEMU_SCRIPTS_DIR)/Config.in.in
-	@mkdir -p $(dir $@)
-	@sed \
-		-e "s:@ARCH@:QEMU_$(BR2_ARCH):" \
-		-e "s:@DISK_IMG@:../$(INFIX_ARTIFACT).qcow2:" \
-	< $< >$@
-
-$(BINARIES_DIR)/qemu/.config: $(BINARIES_DIR)/qemu/Config.in
-	@$(call qemu-kconfig,conf,--olddefconfig)
-	@rm -f $@.old
-
-TARGETS_ROOTFS += qemu-scripts
-endif

board/common/qemu/qemu.sh

@@ -10,20 +10,17 @@
 #
 # and then call this script with:
 #
-#    ./run.sh -c
+#    ./qemu.sh -c
 #
 # To bring up a menuconfig dialog.  Select `Exit` and save the changes.
 # For more help, see:_
 #
-#    ./run.sh -h
+#    ./qemu.sh -h
 #
 # shellcheck disable=SC3037
 
-# Add /sbin to PATH for mkfs.ext4 and such (not default in debian)
-export PATH="/sbin:/usr/sbin:$PATH"
-
-qdir=$(dirname "$(readlink -f "$0")")
-imgdir=$(readlink -f "${qdir}/..")
+# Local variables
+imgdir=$(readlink -f "$(dirname "$0")")
 prognm=$(basename "$0")
 
 usage()
@@ -43,7 +40,7 @@ usage()
     echo "         Also, qemu.cfg has QEMU_APPEND which can affect this."
     echo
     echo "Example:"
-    echo "  $prognm -- finit.debug"
+    echo "  qemu.sh -- finit.debug"
     echo "___________________________________________________________________"
     echo "Note: 'kconfig-frontends' package (Debian/Ubuntu) must be installed"
     echo "      for -c to work: sudo apt install kconfig-frontents"
@@ -59,8 +56,12 @@ die()
 
 load_qemucfg()
 {
+    tmp=$(mktemp -p /tmp)
+
+    grep ^CONFIG_QEMU_ "$1" >"$tmp"
     # shellcheck disable=SC1090
-    .  "./.config"
+    .  "$tmp"
+    rm "$tmp"
 
     [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
     [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
@@ -177,8 +178,6 @@ rw_args()
 {
     [ "$CONFIG_QEMU_RW" ] ||  return
 
-    command -v mkfs.ext4 >/dev/null || die "$prognm: cannot find mkfs.ext4"
-
     if ! [ -f "aux.ext4" ]; then
 	dd if=/dev/zero of="aux.ext4" bs=1M count=1 >/dev/null 2>&1
 	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
@@ -248,7 +247,7 @@ rocker_port_args()
 net_args()
 {
     # Infix will pick up this file via fwcfg and install it to /etc
-    mactab=${qdir}/mactab
+    mactab=${imgdir}/mactab
     :> "$mactab"
     echo -n "-fw_cfg name=opt/mactab,file=$mactab "
 
@@ -287,7 +286,7 @@ vpd_args()
 {
     [ "$CONFIG_QEMU_VPD" = "y" ] || return
 
-    vpd_file="${qdir}/vpd"
+    vpd_file="${imgdir}/vpd"
 
     if ! [ -f "$vpd_file" ]; then
 	onieprom="${imgdir}/onieprom"
@@ -431,7 +430,7 @@ dtb_args()
 
 	# Extend it with the environment and signing information in
 	# u-boot.dtb.
-	echo "qemu.dtb ../u-boot.dtb" | \
+	echo "qemu.dtb u-boot.dtb" | \
 	    xargs -n 1 dtc -I dtb -O dts | \
 	    { echo "/dts-v1/;"; sed  -e 's:/dts-v[0-9]\+/;::'; } | \
 	    dtc >qemu-extended.dtb 2>/dev/null
@@ -440,7 +439,7 @@ dtb_args()
 	echo -n "-dtb qemu-extended.dtb "
     else
 	# Otherwise we just use the unmodified one
-	echo -n "-dtb ../u-boot.dtb "
+	echo -n "-dtb u-boot.dtb "
     fi
 }
 
@@ -486,12 +485,13 @@ EOF
 
 menuconfig()
 {
-    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the $$O/images/qemu directory"
+    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the output/images directory"
     command -v kconfig-mconf >/dev/null || die "$prognm: cannot find kconfig-mconf for menuconfig"
     exec kconfig-mconf Config.in
 }
 
-cd "$qdir" || (echo "Failed cd to $qdir"; exit 1)
+scriptdir=$(dirname "$(readlink -f "$0")")
+cd "$scriptdir" || (echo "Failed cd to $scriptdir"; exit 1)
 
 while [ "$1" != "" ]; do
     case $1 in
@@ -510,7 +510,13 @@ while [ "$1" != "" ]; do
     shift
 done
 
-load_qemucfg
+if [ -f .config ]; then
+    # Customized settings from 'qemu.sh -c'
+    load_qemucfg .config
+else
+    # Shipped defaults from release tarball
+    load_qemucfg qemu.cfg
+fi
 
 if [ -z "$QEMU_EXTRA_APPEND" ]; then
     QEMU_EXTRA_APPEND="$*"

board/common/rootfs.its

@@ -0,0 +1,28 @@
+/dts-v1/;
+
+/ {
+	description = "Infix";
+	creator = "infix";
+	#address-cells = <0x1>;
+
+	images {
+		rootfs {
+			description = "Infix";
+			type = "ramdisk";
+			os = "linux";
+			compression = "none";
+			data = /incbin/("rootfs.squashfs");
+			signature-1 {
+				algo = "sha256,rsa4096";
+				key-name-hint = "infix";
+			};
+		};
+	};
+
+	configurations {
+		default = "verity";
+		verity {
+			ramdisk = "rootfs";
+		};
+	};
+};

board/common/rootfs/etc/bash.bashrc

@@ -40,12 +40,11 @@ log()
     less +G -r "$fn"
 }
 
-follow ()
+follow()
 {
     local fn="/var/log/syslog"
     [ -n "$1" ] && fn="/var/log/$1"
-
-    tail -F -n +1 "$fn"
+    less +F -r "$fn"
 }
 
 _logfile_completions()

board/common/rootfs/etc/default/zebra

@@ -1,2 +1,2 @@
 # --log-level debug
-ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog --log-level err"
+ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog "

board/common/rootfs/etc/finit.d/available/container@.conf

@@ -5,5 +5,4 @@
 # 'podman load', must not have a timeout.
 sysv    log:prio:local1,tag:%i kill:30 pid:!/run/container:%i.pid \
 	pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container   \
-	cgroup.system,delegate					  \
 	[2345] <!> :%i container -n %i -- container %i

board/common/rootfs/etc/finit.d/available/hostapd@.conf

@@ -1,3 +0,0 @@
-service <!> name:hostapd :%i \
-	[2345] hostapd -P/var/run/hostapd-%i.pid  /etc/hostapd-%i.conf \
-	-- Wi-Fi Access Point @%i

board/common/rootfs/etc/finit.d/available/restconf.conf

@@ -1,3 +1,3 @@
-service name:rousette notify:none log:null <pid/confd> env:/etc/default/confd \
+service name:rousette notify:none log <pid/confd> env:/etc/default/confd \
 	[12345] rousette --syslog -t $CONFD_TIMEOUT \
 	-- RESTCONF server

board/common/rootfs/etc/finit.d/available/wifi@.conf

@@ -1,3 +1,5 @@
 service name:wpa_supplicant :%i \
-	[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
-	-- Wi-Fi Station @%i
+			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+			       -- WPA supplicant @%i
+
+task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i

board/common/rootfs/etc/fstab

@@ -1,15 +1,23 @@
 # Virtual filesystems
-tmpfs		/run		  tmpfs		mode=0755,nosuid,nodev	0	0
-tmpfs		/media		  tmpfs		mode=1755,nosuid,nodev	0	0
-debugfs		/sys/kernel/debug debugfs	nofail			0	0
-cfgfs		/config		  configfs	nofail,noauto		0	0
+devtmpfs	/dev		devtmpfs	defaults		0	0
+mkdir#-p	/dev/pts	helper		none			0	0
+devpts		/dev/pts	devpts		mode=620,ptmxmode=0666	0	0
+mkdir#-p	/dev/shm	helper		none			0	0
+tmpfs		/dev/shm	tmpfs		mode=0777		0	0
+proc		/proc		proc		defaults		0	0
+tmpfs		/tmp		tmpfs		mode=1777,nosuid,nodev	0	0
+tmpfs		/run		tmpfs		mode=0755,nosuid,nodev	0	0
+tmpfs		/media		tmpfs		mode=1755,nosuid,nodev	0	0
+sysfs		/sys		sysfs		defaults		0	0
+debugfs	/sys/kernel/debug	debugfs		nofail			0	0
+cfgfs		/config		configfs	nofail,noauto		0	0
 
 # The chosen backing storage for the overlays placed on /cfg, /etc,
 # /home, /root, and /var, are determined dynamically by /usr/libexec/infix/mnt
 # depending on the available devices.
 mnttmp		/mnt/tmp	tmpfs	defaults					0	0
-LABEL=aux	/mnt/aux	auto	noatime,nodiratime,noauto			0	0
-LABEL=var	/mnt/var	ext4	noatime,nodiratime,noauto			0	0
-LABEL=cfg	/mnt/cfg	ext4	noatime,nodiratime,noauto			0	0
+LABEL=aux	/mnt/aux	auto	noatime,nodiratime,noauto,errors=remount-ro	0	0
+LABEL=var	/mnt/var	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
+LABEL=cfg	/mnt/cfg	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
 hostfs		/mnt/host	9p	cache=none,msize=16384,noauto			0	0
 /usr/libexec/infix/mnt#	/cfg	helper	none						0	0

board/common/rootfs/etc/nginx/nginx.conf

@@ -19,14 +19,6 @@ http {
 
     include /etc/nginx/enabled/*.conf;
 
-    # Skip 2xx and 3xx
-    # Skip 400 (e.g., rrousette syntax errors)
-    map $status $loggable {
-    	~^[23]  0;
-	400 	0;
-	default 1;
-    }
-
-    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=warn combined if=$loggable;
-    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 warn;
+    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=info;
+    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 info;
 }

board/common/rootfs/etc/profile.d/convenience.sh

@@ -4,14 +4,14 @@ alias ll='ls -alF'
 alias ls='ls --color=auto'
 
 export LANG=C.UTF-8
-export EDITOR=/usr/bin/editor
-export VISUAL=/usr/bin/editor
+export EDITOR=/usr/bin/edit
+export VISUAL=/usr/bin/edit
 export LESS="-P %f (press h for help or q to quit)"
 export LESSOPEN="|/usr/bin/lesspipe.sh %s"
 alias vim='vi'
 alias view='vi -R'
 alias emacs='mg'
-alias sensible-editor=editor
+alias sensible-editor=edit
 alias sensible-pager=pager
 alias hd="hexdump -C"
 

board/common/rootfs/etc/udev/rules.d/60-rename-wifi-phy.rules

@@ -1,3 +0,0 @@
-# Rename WiFi PHY devices from phy0 to radio0 to avoid name clashes
-SUBSYSTEM=="ieee80211", ACTION=="add", KERNEL=="phy*", \
-  RUN+="/bin/sh -c '/usr/sbin/iw phy %k set name radio%n'"

board/common/rootfs/etc/udev/rules.d/70-remove-virtual-wifi-interfaces.rules

@@ -1,7 +0,0 @@
-# Remove kernel-created WiFi interfaces
-# All WiFi interfaces are now virtual interfaces created by confd
-SUBSYSTEM=="net", ACTION=="add", KERNEL=="wlan*", \
-  TEST=="/sys/class/net/$name/phy80211/name", \
-  PROGRAM="/bin/cat /sys/class/net/%k/phy80211/name", \
-  TEST!="/run/wifi-cleaned-%c", \
-  RUN+="/bin/sh -c '/usr/sbin/iw dev %k del && touch /run/wifi-cleaned-%c'"

board/common/rootfs/etc/udev/rules.d/70-rename-wifi.rules

@@ -0,0 +1 @@
+SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"

board/common/rootfs/etc/watchdogd.conf

@@ -90,9 +90,9 @@ reset-reason {
 
 # Monitors file descriptor leaks based on /proc/sys/fs/file-nr
 filenr {
-    enabled = true
-    interval = 3600
-    logmark  = true
+#    enabled = true
+    interval = 300
+    logmark  = false
     warning  = 0.9
     critical = 1.0
 #    script = "/path/to/alt-reboot-action.sh"
@@ -102,42 +102,33 @@ filenr {
 # The script is called with fsmon as the first argument and there
 # are two environment variables FSMON_NAME, for the monitored path,
 # and FSMON_TYPE indicating either 'blocks' or 'inodes'.
-fsmon /var {
-    enabled = true
-    interval = 3600
-    logmark  = true
-    warning  = 0.95
-    critical = 1.0
-#    script = "/path/to/alt-reboot-action.sh"
-}
-
-fsmon /tmp {
-    enabled = true
-    interval = 3600
-    logmark  = true
-    warning  = 0.95
-    critical = 1.0
-#    script = "/path/to/alt-reboot-action.sh"
-}
-
-# Monitors load average based on sysinfo() from /proc/loadavg
-# The level is composed from the average of the 1 and 5 min marks.
-#loadavg {
+#fsmon /var {
 #    enabled = true
 #    interval = 300
-#    logmark  = true
-#    warning  = 1.0
-#    critical = 2.0
+#    logmark  = false
+#    warning  = 0.95
+#    critical = 1.0
 #    script = "/path/to/alt-reboot-action.sh"
 #}
 
+# Monitors load average based on sysinfo() from /proc/loadavg
+# The level is composed from the average of the 1 and 5 min marks.
+loadavg {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 1.0
+    critical = 2.0
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
 # Monitors free RAM based on data from /proc/meminfo
 meminfo {
-    enabled = true
-    interval = 3600
-    logmark  = true
+#    enabled = true
+    interval = 300
+    logmark  = false
     warning  = 0.9
-    critical = 0.97
+    critical = 0.95
 #    script = "/path/to/alt-reboot-action.sh"
 }
 

board/common/rootfs/usr/bin/cfg

@@ -0,0 +1,58 @@
+#!/bin/sh
+# User-friendly wrapper for sysrepocfg
+# TODO: add import/export, copy, ...
+
+# Edit YANG binary types using sysrepo, base64, and duct tape.
+edit()
+{
+    xpath=$1
+    if [ -z "$xpath" ]; then
+	echo "Usage: cfg edit \"/full/xpath/to/binary/leaf\""
+	exit 1
+    fi
+
+    if tmp=$(sysrepocfg -G "$xpath"); then
+	file=$(mktemp)
+
+	echo "$tmp" | base64 -d > "$file"
+	if /usr/bin/editor "$file"; then
+	    tmp=$(base64 -w0 < "$file")
+	    sysrepocfg -S "$xpath" -u "$tmp"
+	fi
+
+	rm -f "$file"
+    else
+	echo "Failed to retrieve value for $xpath"
+	exit 1
+    fi
+}
+
+usage()
+{
+    echo "Usage:"
+    echo "    cfg CMD [ARG]"
+    echo
+    echo "Command:"
+    echo "    edit XPATH   Edit YANG binary type"
+    echo "    help         This help text"
+    echo
+    echo "As a backwards compatible fallback, this script forwards"
+    echo "all other commands as options to sysrepocfg."
+    echo
+
+    exit 0
+}
+
+cmd=$1; shift
+case $cmd in
+    edit)
+	edit "$1"
+	;;
+    help)
+	usage
+	;;
+    *)
+	set -- "$cmd" "$@"
+	exec sysrepocfg -f json "$@"
+	;;
+esac

board/common/rootfs/usr/bin/edit

@@ -0,0 +1 @@
+/etc/alternatives/editor

board/common/rootfs/usr/bin/onieprom

@@ -1,3 +1,5 @@
+#!/usr/bin/env python3
+
 import binascii
 import struct
 
@@ -178,3 +180,39 @@ def from_tlv(f):
         d[info["name"]] = unpack(v)
 
     return d
+
+if __name__ == "__main__":
+    import argparse
+    import json
+    import os
+    import sys
+
+    parser = argparse.ArgumentParser(prog='onieprom')
+
+    parser.add_argument("infile", nargs="?", default=sys.stdin, type=argparse.FileType("rb", 0))
+    parser.add_argument("outfile", nargs="?", default=sys.stdout, type=argparse.FileType("wb"))
+
+    parser.add_argument("-e", "--encode", default=False, action="store_true",
+                        help="Encode JSON input to binary output")
+
+    parser.add_argument("-d", "--decode", default=False, action="store_true",
+                        help="Decode binary input to JSON output")
+
+    args = parser.parse_args()
+
+    if (not args.encode) and (not args.decode):
+        c = args.infile.read(1)
+        args.infile.seek(0, 0)
+
+        if c == b"{":
+            args.encode = True
+        elif c == b"T":
+            args.decode = True
+        else:
+            sys.stderr.write("Neither encode nor decode specified, and could not infer operation from input")
+            sys.exit(1)
+
+    if args.encode:
+        args.outfile.buffer.write(into_tlv(json.load(args.infile)))
+    else:
+        args.outfile.write(json.dumps(from_tlv(args.infile)))

board/common/rootfs/usr/bin/show-legacy

@@ -91,7 +91,7 @@ EOF
 
 is_dhcp_running()
 {
-    copy operational -x /infix-dhcp-server:dhcp-server | jq -r '
+    sysrepocfg -X -f json -m infix-dhcp-server | jq -r '
         ."infix-dhcp-server:dhcp-server".enabled as $global |
         if ."infix-dhcp-server:dhcp-server".subnet? then
                 (."infix-dhcp-server:dhcp-server".subnet[] |
@@ -110,15 +110,15 @@ dhcp()
 
     case $1 in
 	detail)
-	    copy operational -x /infix-dhcp-server:dhcp-server | \
+	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
 		jq -C .
 	    ;;
 	stat*)
-	    copy operational -x /infix-dhcp-server:dhcp-server | \
+	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
 		/usr/libexec/statd/cli-pretty "show-dhcp-server" -s
 	    ;;
 	*)
-	    copy operational -x /infix-dhcp-server:dhcp-server | \
+	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
 		/usr/libexec/statd/cli-pretty "show-dhcp-server"
 	    ;;
     esac
@@ -182,13 +182,13 @@ ifaces()
     else
 	if [ $# -gt 0 ]; then
 	    for iface in $*; do
-		copy operational -x \
+		sysrepocfg -f json -X -d operational -x \
 			   "/ietf-interfaces:interfaces/interface[name='$iface']" | \
 		    /usr/libexec/statd/cli-pretty "show-interfaces" -n "$iface"
 	    done
 	    return
 	fi
-        copy operational -x /ietf-interfaces:interfaces | \
+        sysrepocfg -f json -X -d operational -m ietf-interfaces | \
           /usr/libexec/statd/cli-pretty "show-interfaces"
     fi
 }
@@ -227,7 +227,7 @@ rstp()
 
 stp()
 {
-    copy operational -x /ietf-interfaces:interfaces | \
+    sysrepocfg -f json -X -d operational -m ietf-interfaces | \
         /usr/libexec/statd/cli-pretty "show-bridge-stp"
 }
 
@@ -248,7 +248,7 @@ routes()
     else
 	arg="-i ipv4"
     fi
-    copy operational -x /ietf-routing:routing/ribs | \
+    sysrepocfg -f json -X -d operational -x "/ietf-routing:routing/ribs" | \
 	/usr/libexec/statd/cli-pretty "show-routing-table" $arg
 }
 

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -1,13 +1,13 @@
 #!/usr/bin/env python3
-
+import importlib.machinery
 import json
-import onieprom
 import os
 import shutil
 import struct
 import subprocess
 import sys
 
+onieprom = importlib.machinery.SourceFileLoader("onieprom", "/bin/onieprom").load_module()
 SYSTEM_JSON = "/run/system.json"
 KKIT_IANA_PEM = 61046
 

board/common/rootfs/usr/libexec/infix/iw.py

@@ -1,600 +0,0 @@
-#!/usr/bin/env python3
-"""
-iw command wrapper that returns structured JSON data
-
-Usage:
-    iw.py list                  - List all PHY devices
-    iw.py dev                   - List all interfaces grouped by PHY
-    iw.py info <device>         - Get PHY or interface information
-    iw.py survey <interface>    - Get channel survey data
-"""
-
-import sys
-import json
-import subprocess
-import re
-def decode_iw_ssid(ssid):
-    """Decode iw escaped SSID (\\xHH) to UTF-8, stripping non-printable chars."""
-    try:
-        ssid = ssid.encode().decode('unicode_escape').encode('latin-1').decode('utf-8')
-    except (UnicodeDecodeError, UnicodeEncodeError):
-        return ssid
-    return ''.join(c for c in ssid if c.isprintable())
-
-
-def run_iw(*args):
-    """Run iw command and return output"""
-    try:
-        result = subprocess.run(
-            ['iw'] + list(args),
-            capture_output=True,
-            text=True,
-            timeout=5
-        )
-        if result.returncode == 0:
-            return result.stdout
-        return None
-    except Exception:
-        return None
-
-
-def normalize_phy_name(name):
-    """
-    Convert radioN to phyN or vice versa based on what exists in sysfs.
-    Returns the actual phy name that exists.
-    """
-    import os
-
-    # Try the name as-is first
-    if os.path.exists(f'/sys/class/ieee80211/{name}'):
-        return name
-
-    # Try converting radioN <-> phyN
-    if name.startswith('radio'):
-        phy_name = 'phy' + name[5:]
-        if os.path.exists(f'/sys/class/ieee80211/{phy_name}'):
-            return phy_name
-    elif name.startswith('phy'):
-        radio_name = 'radio' + name[3:]
-        if os.path.exists(f'/sys/class/ieee80211/{radio_name}'):
-            return radio_name
-
-    # Return original if nothing found
-    return name
-
-
-def parse_phy_info(phy_name):
-    """
-    Parse 'iw phy <name> info' output or 'iw <name> info' output
-    Returns: {bands, driver, manufacturer, max_txpower, num_virtual_interfaces, interface_combinations}
-    """
-    # Normalize the phy name
-    actual_phy = normalize_phy_name(phy_name)
-
-    # Try 'iw phy <name> info' first
-    output = run_iw('phy', actual_phy, 'info')
-
-    # If that fails, try 'iw <name> info' (some systems support this)
-    if not output:
-        output = run_iw(actual_phy, 'info')
-
-    if not output:
-        return {}
-
-    result = {
-        'name': phy_name,
-        'bands': [],
-        'driver': None,
-        'manufacturer': None,
-        'max_txpower': None,
-        'num_virtual_interfaces': 0,
-        'interface_combinations': []
-    }
-
-    current_band = None
-    band_num = 0
-    in_combinations = False
-    max_power = None
-
-    for line in output.splitlines():
-        stripped = line.strip()
-
-        # Detect band sections
-        if stripped.startswith('Band '):
-            if current_band and current_band.get('frequencies'):
-                result['bands'].append(current_band)
-            band_num += 1
-            current_band = {
-                'band': band_num,
-                'frequencies': [],
-                'name': None,
-                'ht_capable': False,
-                'vht_capable': False,
-                'he_capable': False
-            }
-            in_combinations = False
-
-        # Parse frequencies (handle both "2412 MHz" and "2412.0 MHz" formats)
-        elif current_band and not in_combinations:
-            freq_match = re.match(r'\* ([0-9.]+) MHz.*?\(([0-9.]+) dBm\)', stripped)
-            if freq_match:
-                freq = int(float(freq_match.group(1)))  # Convert "2412.0" to 2412
-                power = float(freq_match.group(2))
-
-                current_band['frequencies'].append(freq)
-
-                # Track max power
-                if max_power is None or power > max_power:
-                    max_power = power
-
-            # Check capabilities
-            if 'HT ' in stripped or 'High Throughput' in stripped:
-                current_band['ht_capable'] = True
-            if 'VHT' in stripped or 'Very High Throughput' in stripped:
-                current_band['vht_capable'] = True
-            if 'HE ' in stripped or 'High Efficiency' in stripped:
-                current_band['he_capable'] = True
-
-        # Detect interface combinations section
-        if 'valid interface combinations:' in stripped.lower():
-            in_combinations = True
-            continue
-
-        # Parse interface combinations
-        if in_combinations:
-            if stripped.startswith('*'):
-                # Parse combination line
-                comb_info = {'limits': []}
-
-                # Parse limits: #{ type } <= max
-                limit_matches = re.findall(r'#\{\s*([^}]+)\s*\}\s*<=\s*(\d+)', stripped)
-                for types_str, max_val in limit_matches:
-                    types = [t.strip() for t in types_str.split(',')]
-                    comb_info['limits'].append({
-                        'max': int(max_val),
-                        'types': types
-                    })
-
-                # Parse total
-                total_match = re.search(r'total\s*<=\s*(\d+)', stripped)
-                if total_match:
-                    comb_info['max_total'] = int(total_match.group(1))
-
-                # Parse channels
-                channels_match = re.search(r'#channels\s*<=\s*(\d+)', stripped)
-                if channels_match:
-                    comb_info['num_channels'] = int(channels_match.group(1))
-
-                if comb_info.get('limits') or comb_info.get('max_total'):
-                    result['interface_combinations'].append(comb_info)
-
-            elif not stripped.startswith('#') and ':' in stripped and not stripped.startswith('*'):
-                # End of combinations section
-                in_combinations = False
-
-    # Add last band
-    if current_band and current_band.get('frequencies'):
-        result['bands'].append(current_band)
-
-    # Determine band names and assign band numbers
-    for band in result['bands']:
-        if band['frequencies']:
-            freq = band['frequencies'][0]
-            if 2400 <= freq <= 2500:
-                band['name'] = '2.4GHz'
-                band['band'] = 1
-            elif 5150 <= freq <= 5900:
-                band['name'] = '5GHz'
-                band['band'] = 2
-            elif 5955 <= freq <= 7115:
-                band['name'] = '6GHz'
-                band['band'] = 3
-
-    # Set max TX power
-    if max_power is not None:
-        result['max_txpower'] = int(max_power)
-
-    # Get driver and manufacturer from sysfs
-    try:
-        driver_link = subprocess.run(
-            ['readlink', '-f', f'/sys/class/ieee80211/{actual_phy}/device/driver'],
-            capture_output=True, text=True, timeout=1
-        ).stdout.strip()
-
-        if driver_link:
-            driver_name = driver_link.split('/')[-1]
-            result['driver'] = driver_name
-
-            # Map driver to manufacturer
-            driver_lower = driver_name.lower()
-            if 'mt' in driver_lower or 'mediatek' in driver_lower:
-                result['manufacturer'] = 'MediaTek Inc.'
-            elif 'rtw' in driver_lower or 'realtek' in driver_lower:
-                result['manufacturer'] = 'Realtek Semiconductor Corp.'
-            elif 'ath' in driver_lower or 'qca' in driver_lower:
-                result['manufacturer'] = 'Qualcomm Atheros'
-            elif 'iwl' in driver_lower or 'intel' in driver_lower:
-                result['manufacturer'] = 'Intel Corporation'
-            elif 'brcm' in driver_lower or 'broadcom' in driver_lower:
-                result['manufacturer'] = 'Broadcom Inc.'
-    except Exception:
-        pass
-
-    # Count virtual interfaces
-    dev_output = run_iw('dev')
-    if dev_output:
-        # Extract phy number from actual phy name
-        phy_num = None
-        if actual_phy.startswith('radio'):
-            phy_num = actual_phy[5:]
-        elif actual_phy.startswith('phy'):
-            phy_num = actual_phy[3:]
-
-        if phy_num:
-            count = 0
-            current_phy = None
-            for line in dev_output.splitlines():
-                if line.startswith('phy#'):
-                    current_phy = line.replace('phy#', '').strip()
-                elif current_phy == phy_num and 'Interface' in line:
-                    count += 1
-            result['num_virtual_interfaces'] = count
-
-    return result
-
-
-def parse_interface_info(ifname):
-    """
-    Parse 'iw dev <name> info' output
-    Returns: {ifname, iftype, mac, ssid, frequency, channel, txpower, channel_width}
-    """
-    output = run_iw('dev', ifname, 'info')
-    if not output:
-        return {}
-
-    result = {'ifname': ifname}
-
-    for line in output.splitlines():
-        stripped = line.strip()
-
-        # Interface type
-        if stripped.startswith('type '):
-            result['iftype'] = stripped.split()[1]
-
-        # MAC address
-        elif stripped.startswith('addr '):
-            result['mac'] = stripped.split()[1]
-
-        # SSID
-        elif stripped.startswith('ssid '):
-            result['ssid'] = decode_iw_ssid(' '.join(stripped.split()[1:]))
-
-        # Channel/frequency
-        elif stripped.startswith('channel '):
-            parts = stripped.split()
-            if len(parts) >= 2:
-                result['channel'] = int(parts[1])
-            if 'MHz' in stripped:
-                freq_match = re.search(r'\((\d+) MHz', stripped)
-                if freq_match:
-                    result['frequency'] = int(freq_match.group(1))
-            # Channel width
-            if 'width:' in stripped:
-                width_match = re.search(r'width:\s*(\d+)\s*MHz', stripped)
-                if width_match:
-                    result['channel_width'] = f"{width_match.group(1)} MHz"
-
-        # TX power
-        elif stripped.startswith('txpower '):
-            power_match = re.search(r'([0-9.]+) dBm', stripped)
-            if power_match:
-                result['txpower'] = float(power_match.group(1))
-
-    return result
-
-
-def parse_stations(ifname):
-    """
-    Parse 'iw dev <name> station dump' output
-    Returns: list of connected stations with stats
-    """
-    output = run_iw('dev', ifname, 'station', 'dump')
-    if not output:
-        return []
-
-    stations = []
-    current = None
-
-    for line in output.splitlines():
-        stripped = line.strip()
-
-        # New station entry: "Station aa:bb:cc:dd:ee:ff (on wifiX)"
-        if stripped.startswith('Station '):
-            if current:
-                stations.append(current)
-            parts = stripped.split()
-            if len(parts) >= 2:
-                current = {'mac-address': parts[1].lower()}
-            else:
-                current = None
-            continue
-
-        if not current or ':' not in stripped:
-            continue
-
-        key, _, value = stripped.partition(':')
-        key = key.strip()
-        value = value.strip()
-
-        try:
-            if key == 'signal':
-                # Format: "-42 dBm" or "-42 [-44, -45] dBm"
-                current['signal-strength'] = int(value.split()[0])
-            elif key == 'connected time':
-                # Format: "123 seconds"
-                current['connected-time'] = int(value.split()[0])
-            elif key == 'rx bytes':
-                current['rx-bytes'] = value  # counter64: string-encoded
-            elif key == 'tx bytes':
-                current['tx-bytes'] = value  # counter64: string-encoded
-            elif key == 'rx packets':
-                current['rx-packets'] = value  # counter64: string-encoded
-            elif key == 'tx packets':
-                current['tx-packets'] = value  # counter64: string-encoded
-            elif key == 'tx bitrate':
-                # Format: "866.7 MBit/s ..." - convert to 100kbit/s units
-                speed_mbps = float(value.split()[0])
-                current['tx-speed'] = int(speed_mbps * 10)
-            elif key == 'rx bitrate':
-                speed_mbps = float(value.split()[0])
-                current['rx-speed'] = int(speed_mbps * 10)
-            elif key == 'inactive time':
-                # Format: "1234 ms"
-                current['inactive-time'] = int(value.split()[0])
-        except (ValueError, IndexError):
-            continue
-
-    if current:
-        stations.append(current)
-
-    return stations
-
-
-def parse_survey(ifname):
-    """
-    Parse 'iw dev <name> survey dump' output
-    Returns: list of {frequency, in_use, noise, active_time, busy_time, receive_time, transmit_time}
-    """
-    output = run_iw('dev', ifname, 'survey', 'dump')
-    if not output:
-        return []
-
-    channels = []
-    current_channel = None
-
-    for line in output.splitlines():
-        stripped = line.strip()
-
-        # New survey entry
-        if stripped.startswith('Survey data from'):
-            if current_channel:
-                channels.append(current_channel)
-            current_channel = None
-
-        # Frequency
-        elif stripped.startswith('frequency:'):
-            parts = stripped.split()
-            if len(parts) >= 2:
-                freq = int(parts[1])
-                in_use = '[in use]' in stripped
-                current_channel = {
-                    'frequency': freq,
-                    'in_use': in_use
-                }
-
-        # Channel metrics
-        elif current_channel:
-            if stripped.startswith('noise:'):
-                noise_match = re.search(r'(-?\d+) dBm', stripped)
-                if noise_match:
-                    current_channel['noise'] = int(noise_match.group(1))
-
-            elif stripped.startswith('channel active time:'):
-                time_match = re.search(r'(\d+) ms', stripped)
-                if time_match:
-                    current_channel['active_time'] = int(time_match.group(1))
-
-            elif stripped.startswith('channel busy time:'):
-                time_match = re.search(r'(\d+) ms', stripped)
-                if time_match:
-                    current_channel['busy_time'] = int(time_match.group(1))
-
-            elif stripped.startswith('channel receive time:'):
-                time_match = re.search(r'(\d+) ms', stripped)
-                if time_match:
-                    current_channel['receive_time'] = int(time_match.group(1))
-
-            elif stripped.startswith('channel transmit time:'):
-                time_match = re.search(r'(\d+) ms', stripped)
-                if time_match:
-                    current_channel['transmit_time'] = int(time_match.group(1))
-
-    # Add last channel
-    if current_channel:
-        channels.append(current_channel)
-
-    return channels
-
-
-def parse_list():
-    """
-    Parse 'iw list' output
-    Returns: list of PHY names
-    """
-    output = run_iw('list')
-    if not output:
-        return []
-
-    phys = []
-    for line in output.splitlines():
-        match = re.match(r'Wiphy (phy\d+|radio\d+)', line)
-        if match:
-            phys.append(match.group(1))
-
-    return phys
-
-
-def parse_dev():
-    """
-    Parse 'iw dev' output
-    Returns: dict mapping PHY numbers to list of interfaces
-    """
-    output = run_iw('dev')
-    if not output:
-        return {}
-
-    result = {}
-    current_phy = None
-
-    for line in output.splitlines():
-        # PHY line: "phy#0" or "phy#1"
-        if line.startswith('phy#'):
-            current_phy = line.replace('phy#', '').strip()
-            if current_phy not in result:
-                result[current_phy] = []
-        # Interface line: "    Interface wlan0"
-        elif current_phy and 'Interface' in line:
-            ifname = line.split('Interface')[1].strip()
-            result[current_phy].append(ifname)
-
-    return result
-
-
-def parse_link(ifname):
-    """
-    Parse 'iw dev <name> link' output for station mode
-    Returns: {connected, bssid, ssid, frequency, signal, tx_bitrate, rx_bitrate}
-    """
-    output = run_iw('dev', ifname, 'link')
-    if not output:
-        return {'connected': False}
-
-    if 'Not connected' in output:
-        return {'connected': False}
-
-    result = {'connected': True}
-
-    for line in output.splitlines():
-        stripped = line.strip()
-
-        # Connected to aa:bb:cc:dd:ee:ff
-        if stripped.startswith('Connected to '):
-            parts = stripped.split()
-            if len(parts) >= 3:
-                result['bssid'] = parts[2].lower()
-
-        # SSID: NetworkName
-        elif stripped.startswith('SSID: '):
-            result['ssid'] = decode_iw_ssid(stripped[6:])
-
-        # freq: 5180
-        elif stripped.startswith('freq: '):
-            try:
-                result['frequency'] = int(stripped[6:])
-            except ValueError:
-                pass
-
-        # signal: -42 dBm
-        elif stripped.startswith('signal: '):
-            try:
-                result['signal-strength'] = int(stripped.split()[1])
-            except (ValueError, IndexError):
-                pass
-
-        # tx bitrate: 866.7 MBit/s ...
-        elif stripped.startswith('tx bitrate: '):
-            try:
-                speed = float(stripped.split()[2])
-                result['tx-speed'] = int(speed * 10)  # 100kbit/s units
-            except (ValueError, IndexError):
-                pass
-
-        # rx bitrate: 780.0 MBit/s ...
-        elif stripped.startswith('rx bitrate: '):
-            try:
-                speed = float(stripped.split()[2])
-                result['rx-speed'] = int(speed * 10)
-            except (ValueError, IndexError):
-                pass
-
-    return result
-
-
-def main():
-    if len(sys.argv) < 2:
-        print(json.dumps({
-            'error': 'Usage: iw.py <command> [device]',
-            'commands': {
-                'list': 'List all PHY devices',
-                'dev': 'List all interfaces grouped by PHY',
-                'info': 'Get PHY or interface information (requires device)',
-                'survey': 'Get channel survey data (requires interface)',
-                'station': 'Get connected stations in AP mode (requires interface)',
-                'link': 'Get link info in station mode (requires interface)'
-            },
-            'examples': [
-                'iw.py list',
-                'iw.py dev',
-                'iw.py info radio0',
-                'iw.py info wlan0',
-                'iw.py station wifi0',
-                'iw.py link wlan0',
-                'iw.py survey wlan0'
-            ]
-        }, indent=2))
-        sys.exit(1)
-
-    command = sys.argv[1]
-
-    try:
-        if command == 'list':
-            data = parse_list()
-        elif command == 'dev':
-            data = parse_dev()
-        elif command == 'info':
-            if len(sys.argv) < 3:
-                data = {'error': 'info command requires device argument'}
-            else:
-                device = sys.argv[2]
-                # Auto-detect if device is a PHY (phy*/radio*) or interface
-                if device.startswith('phy') or device.startswith('radio'):
-                    data = parse_phy_info(device)
-                else:
-                    data = parse_interface_info(device)
-        elif command == 'station':
-            if len(sys.argv) < 3:
-                data = {'error': 'station command requires interface argument'}
-            else:
-                data = parse_stations(sys.argv[2])
-        elif command == 'link':
-            if len(sys.argv) < 3:
-                data = {'error': 'link command requires interface argument'}
-            else:
-                data = parse_link(sys.argv[2])
-        elif command == 'survey':
-            if len(sys.argv) < 3:
-                data = {'error': 'survey command requires interface argument'}
-            else:
-                data = parse_survey(sys.argv[2])
-        else:
-            data = {'error': f'Unknown command: {command}'}
-
-        print(json.dumps(data, indent=2, ensure_ascii=False))
-
-    except Exception as e:
-        print(json.dumps({'error': str(e)}))
-        sys.exit(1)
-
-
-if __name__ == '__main__':
-    main()

board/common/rootfs/usr/libexec/infix/wifi-channel-map.py

@@ -1,724 +0,0 @@
-#!/usr/bin/env python3
-"""
-WiFi Channel Visualization Tool
-Shows graphical representation of WiFi channel overlap and utilization
-"""
-
-import sys
-import json
-import argparse
-
-
-class Colors:
-    """ANSI color codes for terminal output"""
-    RESET = '\033[0m'
-    BOLD = '\033[1m'
-    RED = '\033[91m'
-    GREEN = '\033[92m'
-    YELLOW = '\033[93m'
-    BLUE = '\033[94m'
-    MAGENTA = '\033[95m'
-    CYAN = '\033[96m'
-    GRAY = '\033[90m'
-    BG_RED = '\033[101m'
-    BG_GREEN = '\033[102m'
-    BG_YELLOW = '\033[103m'
-    BG_BLUE = '\033[104m'
-    BG_GRAY = '\033[100m'
-
-
-def freq_to_channel(freq):
-    """Convert frequency (MHz) to WiFi channel number"""
-    # 2.4 GHz band
-    if 2412 <= freq <= 2484:
-        if freq == 2484:
-            return 14
-        return (freq - 2412) // 5 + 1
-    # 5 GHz band
-    elif 5170 <= freq <= 5825:
-        return (freq - 5000) // 5
-    # 6 GHz band
-    elif 5955 <= freq <= 7115:
-        return (freq - 5950) // 5
-    return None
-
-
-def get_channel_frequency(channel, band='2.4'):
-    """Get center frequency for a channel"""
-    if band == '2.4':
-        if channel == 14:
-            return 2484
-        return 2412 + (channel - 1) * 5
-    elif band == '5':
-        return 5000 + channel * 5
-    return None
-
-
-def get_busy_percentage(channel_data):
-    """Calculate channel busy percentage"""
-    active = channel_data.get('active-time', 0)
-    busy = channel_data.get('busy-time', 0)
-    if active > 0:
-        return (busy / active) * 100
-    return 0
-
-
-def get_utilization_color(busy_pct):
-    """Get color based on channel utilization"""
-    if busy_pct >= 50:
-        return Colors.RED
-    elif busy_pct >= 25:
-        return Colors.YELLOW
-    elif busy_pct >= 10:
-        return Colors.CYAN
-    else:
-        return Colors.GREEN
-
-
-def draw_channel_graph_2_4ghz(survey_data):
-    """Draw channel overlap graph for 2.4 GHz band"""
-    # Parse survey data
-    channels = {}
-    in_use_channel = None
-
-    for ch_data in survey_data:
-        freq = ch_data.get('frequency')
-        ch_num = freq_to_channel(freq)
-        if ch_num and 1 <= ch_num <= 14:
-            busy_pct = get_busy_percentage(ch_data)
-            channels[ch_num] = {
-                'freq': freq,
-                'noise': ch_data.get('noise', -100),
-                'busy': busy_pct,
-                'in_use': ch_data.get('in-use', False),
-                'active_time': ch_data.get('active-time', 0),
-                'busy_time': ch_data.get('busy-time', 0)
-            }
-            if ch_data.get('in-use'):
-                in_use_channel = ch_num
-
-    if not channels:
-        print("No 2.4 GHz channel data available")
-        return
-
-    print(f"\n{Colors.BOLD}2.4 GHz WiFi Channel Overlap Visualization{Colors.RESET}")
-    print("=" * 80)
-    print(f"Channel width: 20 MHz | Channel spacing: 5 MHz")
-    print(f"Non-overlapping channels: 1, 6, 11 (shown in {Colors.GREEN}green{Colors.RESET})")
-    print()
-
-    # Draw frequency scale
-    print("Frequency (MHz):")
-    print("2400        2420        2440        2460        2480")
-    print("|-----------|-----------|-----------|-----------|")
-
-    # Draw each channel as a bar showing its 20 MHz width
-    # Each channel occupies ~4 adjacent channels worth of space
-    for ch in range(1, 14):
-        if ch not in channels:
-            continue
-
-        data = channels[ch]
-        busy_pct = data['busy']
-        is_in_use = data['in_use']
-        noise = data['noise']
-
-        # Determine color based on status
-        if is_in_use:
-            color = Colors.BG_BLUE
-            marker = '█'
-        elif busy_pct >= 50:
-            color = Colors.RED
-            marker = '▓'
-        elif busy_pct >= 25:
-            color = Colors.YELLOW
-            marker = '▒'
-        elif busy_pct > 0:
-            color = Colors.CYAN
-            marker = '░'
-        else:
-            color = Colors.GRAY
-            marker = '·'
-
-        # Non-overlapping channels get green color
-        if ch in [1, 6, 11] and not is_in_use and busy_pct < 10:
-            color = Colors.GREEN
-
-        # Calculate position (each channel is offset by 5 MHz = 1 position)
-        # Channel 1 is at 2412 MHz, base is 2400
-        offset = ((data['freq'] - 2400) // 5)
-
-        # Draw channel bar (20 MHz = 4 positions wide)
-        line = ' ' * 80
-        line_arr = list(line)
-
-        # Mark the channel span (20 MHz width)
-        for i in range(4):
-            pos = offset + i - 2  # Center the 20 MHz around channel
-            if 0 <= pos < len(line_arr):
-                line_arr[pos] = marker
-
-        # Add channel label
-        label_pos = offset
-        if 0 <= label_pos < len(line_arr) - 5:
-            # Clear space for label
-            for i in range(5):
-                if label_pos + i < len(line_arr):
-                    line_arr[label_pos + i] = ' '
-
-        line = ''.join(line_arr)
-
-        # Status indicators
-        status = ""
-        if is_in_use:
-            status = f" {Colors.BOLD}[IN USE]{Colors.RESET}"
-
-        busy_color = get_utilization_color(busy_pct)
-
-        print(f"{color}Ch{ch:2d}{Colors.RESET} {color}{line}{Colors.RESET} "
-              f"{busy_color}{busy_pct:5.1f}%{Colors.RESET} "
-              f"{noise:4d}dBm{status}")
-
-    print("\n" + "=" * 80)
-    print(f"\n{Colors.BOLD}Legend:{Colors.RESET}")
-    print(f"  {Colors.BG_BLUE}██{Colors.RESET} In use (your network)")
-    print(f"  {Colors.RED}▓▓{Colors.RESET} High usage (>50%)")
-    print(f"  {Colors.YELLOW}▒▒{Colors.RESET} Medium usage (25-50%)")
-    print(f"  {Colors.CYAN}░░{Colors.RESET} Low usage (1-25%)")
-    print(f"  {Colors.GRAY}··{Colors.RESET} Idle (<1%)")
-    print()
-
-
-def draw_channel_list(survey_data):
-    """Draw a simple channel list with utilization bars"""
-    print(f"\n{Colors.BOLD}Channel Utilization{Colors.RESET}")
-    print("=" * 80)
-    print(f"{'Ch':<4} {'Freq':<6} {'Noise':<8} {'Busy%':<8} {'Utilization Bar':<40}")
-    print("-" * 80)
-
-    for ch_data in sorted(survey_data, key=lambda x: x.get('frequency', 0)):
-        freq = ch_data.get('frequency')
-        ch_num = freq_to_channel(freq)
-        if not ch_num:
-            continue
-
-        noise = ch_data.get('noise', -100)
-        busy_pct = get_busy_percentage(ch_data)
-        is_in_use = ch_data.get('in-use', False)
-
-        # Create utilization bar (40 chars wide = 100%)
-        bar_length = int(busy_pct * 40 / 100)
-        bar_color = get_utilization_color(busy_pct)
-
-        if is_in_use:
-            bar = f"{Colors.BG_BLUE}{'█' * bar_length}{Colors.RESET}"
-            marker = f" {Colors.BOLD}◀ IN USE{Colors.RESET}"
-        else:
-            bar = f"{bar_color}{'█' * bar_length}{Colors.RESET}"
-            marker = ""
-
-        empty = '░' * (40 - bar_length)
-
-        print(f"{ch_num:<4} {freq:<6} {noise:<8} {busy_pct:5.1f}%  {bar}{Colors.GRAY}{empty}{Colors.RESET}{marker}")
-
-    print()
-
-
-def draw_overlap_pie(survey_data):
-    """Draw a pie-style visualization of channel group utilization"""
-    # Parse channel data into 3 non-overlapping groups
-    # Group 1: channels 1-5 (centered on ch 1)
-    # Group 2: channels 4-8 (centered on ch 6)
-    # Group 3: channels 9-13 (centered on ch 11)
-
-    channels = {}
-    in_use_channel = None
-
-    for ch_data in survey_data:
-        freq = ch_data.get('frequency')
-        ch_num = freq_to_channel(freq)
-        if ch_num and 1 <= ch_num <= 13:
-            busy_pct = get_busy_percentage(ch_data)
-            channels[ch_num] = {
-                'busy': busy_pct,
-                'noise': ch_data.get('noise', -100),
-                'in_use': ch_data.get('in-use', False)
-            }
-            if ch_data.get('in-use'):
-                in_use_channel = ch_num
-
-    if not channels:
-        return
-
-    # Calculate group utilization (average of channels in each group)
-    groups = [
-        {'name': 'Ch 1', 'channels': [1, 2, 3, 4, 5], 'center': 1},
-        {'name': 'Ch 6', 'channels': [4, 5, 6, 7, 8], 'center': 6},
-        {'name': 'Ch 11', 'channels': [9, 10, 11, 12, 13], 'center': 11},
-    ]
-
-    for group in groups:
-        busy_values = [channels.get(ch, {}).get('busy', 0) for ch in group['channels'] if ch in channels]
-        group['avg_busy'] = sum(busy_values) / len(busy_values) if busy_values else 0
-        group['center_busy'] = channels.get(group['center'], {}).get('busy', 0)
-        group['in_use'] = in_use_channel in group['channels'] if in_use_channel else False
-
-    total_busy = sum(g['avg_busy'] for g in groups)
-
-    print(f"\n{Colors.BOLD}Channel Group Utilization (2.4 GHz){Colors.RESET}")
-    print("=" * 60)
-    print("Non-overlapping channel groups with their overlap zones:\n")
-
-    # Draw ASCII donut/pie
-    pie_width = 50
-
-    # Calculate proportions
-    if total_busy > 0:
-        for group in groups:
-            group['proportion'] = group['avg_busy'] / total_busy
-            group['width'] = max(1, int(group['proportion'] * pie_width))
-    else:
-        for group in groups:
-            group['proportion'] = 1/3
-            group['width'] = pie_width // 3
-
-    # Adjust to exactly fill pie_width
-    total_width = sum(g['width'] for g in groups)
-    if total_width < pie_width:
-        groups[0]['width'] += pie_width - total_width
-
-    # Draw the pie bar
-    pie_chars = ['█', '▓', '░']
-    colors = [Colors.GREEN, Colors.YELLOW, Colors.CYAN]
-
-    pie_line = ""
-    for i, group in enumerate(groups):
-        if group['in_use']:
-            color = Colors.BG_BLUE
-        elif group['avg_busy'] >= 50:
-            color = Colors.RED
-        elif group['avg_busy'] >= 25:
-            color = Colors.YELLOW
-        else:
-            color = Colors.GREEN
-
-        char = pie_chars[i % len(pie_chars)]
-        pie_line += f"{color}{char * group['width']}{Colors.RESET}"
-
-    # Draw centered pie
-    print(f"    ┌{'─' * pie_width}┐")
-    print(f"    │{pie_line}│")
-    print(f"    └{'─' * pie_width}┘")
-
-    # Legend with percentages
-    print()
-    for i, group in enumerate(groups):
-        char = pie_chars[i % len(pie_chars)]
-
-        if group['in_use']:
-            color = Colors.BG_BLUE
-            marker = " ◀ IN USE"
-        elif group['avg_busy'] >= 50:
-            color = Colors.RED
-            marker = ""
-        elif group['avg_busy'] >= 25:
-            color = Colors.YELLOW
-            marker = ""
-        else:
-            color = Colors.GREEN
-            marker = ""
-
-        pct_of_total = group['proportion'] * 100
-        print(f"    {color}{char * 3}{Colors.RESET} {group['name']:>5}: "
-              f"{group['center_busy']:5.1f}% busy (center), "
-              f"{group['avg_busy']:5.1f}% avg in overlap zone, "
-              f"{pct_of_total:4.1f}% of total{marker}")
-
-    # Draw overlap diagram
-    print(f"\n{Colors.BOLD}Channel Overlap Diagram:{Colors.RESET}")
-    print("    Ch:  1   2   3   4   5   6   7   8   9  10  11  12  13")
-    print("        ╔═══════════════════╗")
-    print("    G1: ║ 1 ─ 2 ─ 3 ─ 4 ─ 5 ║         (centered on ch 1)")
-    print("        ╚═══════╦═══════════╝")
-    print("                ╔═══════════════════╗")
-    print("    G2:         ║ 4 ─ 5 ─ 6 ─ 7 ─ 8 ║ (centered on ch 6)")
-    print("                ╚═══════════╦═══════╝")
-    print("                        ╔═══════════════════════╗")
-    print("    G3:                 ║ 9 ─10 ─11 ─12 ─13 ║   (centered on ch 11)")
-    print("                        ╚═══════════════════════╝")
-    print()
-
-
-def generate_svg(survey_data, output_file=None):
-    """Generate SVG image(s) showing channel overlap and utilization for both bands"""
-    # Separate channels by band
-    channels_2_4 = {}
-    channels_5 = {}
-    in_use_2_4 = None
-    in_use_5 = None
-
-    for ch_data in survey_data:
-        freq = ch_data.get('frequency')
-        ch_num = freq_to_channel(freq)
-        if not ch_num:
-            continue
-
-        busy_pct = get_busy_percentage(ch_data)
-        ch_info = {
-            'freq': freq,
-            'busy': busy_pct,
-            'noise': ch_data.get('noise', -100),
-            'in_use': ch_data.get('in-use', False)
-        }
-
-        if 2400 <= freq <= 2500:
-            channels_2_4[ch_num] = ch_info
-            if ch_info['in_use']:
-                in_use_2_4 = ch_num
-        elif 5100 <= freq <= 5900:
-            channels_5[ch_num] = ch_info
-            if ch_info['in_use']:
-                in_use_5 = ch_num
-
-    def busy_to_color(busy_pct, is_in_use=False):
-        if is_in_use:
-            return "#3b82f6"  # Blue
-        elif busy_pct >= 50:
-            return "#ef4444"  # Red
-        elif busy_pct >= 25:
-            return "#f59e0b"  # Yellow/Orange
-        elif busy_pct >= 10:
-            return "#06b6d4"  # Cyan
-        else:
-            return "#22c55e"  # Green
-
-    def generate_band_svg(channels, band, freq_min, freq_max, title, non_overlap_channels=None):
-        if not channels:
-            return None
-
-        width = 900
-        height = 400
-        margin_left = 60
-        margin_right = 40
-        margin_top = 60
-        margin_bottom = 80
-        chart_width = width - margin_left - margin_right
-        chart_height = height - margin_top - margin_bottom
-
-        def freq_to_x(freq):
-            return margin_left + (freq - freq_min) / (freq_max - freq_min) * chart_width
-
-        def busy_to_height(busy_pct):
-            return (busy_pct / 100) * chart_height
-
-        svg_parts = []
-
-        # SVG header
-        svg_parts.append(f'''<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 {width} {height}">
-  <defs>
-    <style>
-      .title {{ font: bold 18px sans-serif; fill: #333; }}
-      .label {{ font: 12px sans-serif; fill: #666; }}
-      .axis {{ font: 10px sans-serif; fill: #333; }}
-      .channel-label {{ font: bold 10px sans-serif; fill: #333; }}
-      .legend {{ font: 12px sans-serif; fill: #333; }}
-    </style>
-  </defs>
-
-  <!-- Background -->
-  <rect width="{width}" height="{height}" fill="#fafafa"/>
-
-  <!-- Title -->
-  <text x="{width/2}" y="30" text-anchor="middle" class="title">{title}</text>
-
-  <!-- Chart area -->
-  <rect x="{margin_left}" y="{margin_top}" width="{chart_width}" height="{chart_height}" fill="#fff" stroke="#ddd"/>
-''')
-
-        # Draw grid lines
-        for pct in [25, 50, 75, 100]:
-            y = margin_top + chart_height - busy_to_height(pct)
-            svg_parts.append(f'  <line x1="{margin_left}" y1="{y}" x2="{margin_left + chart_width}" y2="{y}" stroke="#eee" stroke-dasharray="4,4"/>')
-            svg_parts.append(f'  <text x="{margin_left - 5}" y="{y + 4}" text-anchor="end" class="axis">{pct}%</text>')
-
-        # Y-axis label
-        svg_parts.append(f'  <text x="15" y="{margin_top + chart_height/2}" text-anchor="middle" transform="rotate(-90, 15, {margin_top + chart_height/2})" class="label">Channel Busy %</text>')
-
-        # Draw channels as bars
-        for ch_num, data in sorted(channels.items()):
-            center_freq = data['freq']
-            busy_pct = data['busy']
-            is_in_use = data['in_use']
-
-            # 20 MHz width: ±10 MHz from center
-            x1 = freq_to_x(center_freq - 10)
-            x2 = freq_to_x(center_freq + 10)
-            bar_width = x2 - x1
-            bar_height = busy_to_height(busy_pct)
-            bar_y = margin_top + chart_height - bar_height
-
-            color = busy_to_color(busy_pct, is_in_use)
-            opacity = 0.6 if not is_in_use else 0.8
-
-            # Draw the channel bar
-            svg_parts.append(f'  <rect x="{x1}" y="{bar_y}" width="{bar_width}" height="{bar_height}" fill="{color}" opacity="{opacity}" stroke="{color}" stroke-width="1"/>')
-
-            # Channel label at bottom
-            label_x = freq_to_x(center_freq)
-            svg_parts.append(f'  <text x="{label_x}" y="{margin_top + chart_height + 15}" text-anchor="middle" class="channel-label">{ch_num}</text>')
-
-            # Frequency label (only for some channels to avoid clutter)
-            if band == '2.4' or ch_num in [36, 52, 100, 149, 165]:
-                svg_parts.append(f'  <text x="{label_x}" y="{margin_top + chart_height + 28}" text-anchor="middle" class="axis">{center_freq}</text>')
-
-            # Busy percentage on top of bar (if tall enough)
-            if bar_height > 20:
-                svg_parts.append(f'  <text x="{label_x}" y="{bar_y + 15}" text-anchor="middle" class="channel-label" fill="white">{busy_pct:.0f}%</text>')
-
-        # X-axis labels
-        svg_parts.append(f'  <text x="{margin_left + chart_width/2}" y="{height - 15}" text-anchor="middle" class="label">Channel (Center Frequency MHz)</text>')
-
-        # Legend
-        legend_y = margin_top + 10
-        legend_x = margin_left + chart_width - 150
-        legend_items = [
-            ("#3b82f6", "In Use"),
-            ("#ef4444", "High (>50%)"),
-            ("#f59e0b", "Medium (25-50%)"),
-            ("#06b6d4", "Low (10-25%)"),
-            ("#22c55e", "Idle (<10%)"),
-        ]
-
-        svg_parts.append(f'  <rect x="{legend_x - 10}" y="{legend_y - 5}" width="160" height="{len(legend_items) * 18 + 10}" fill="white" stroke="#ddd" rx="4"/>')
-
-        for i, (color, label) in enumerate(legend_items):
-            y = legend_y + 10 + i * 18
-            svg_parts.append(f'  <rect x="{legend_x}" y="{y - 8}" width="12" height="12" fill="{color}" opacity="0.7"/>')
-            svg_parts.append(f'  <text x="{legend_x + 18}" y="{y + 2}" class="legend">{label}</text>')
-
-        # Non-overlapping channels note (for 2.4 GHz)
-        if non_overlap_channels:
-            svg_parts.append(f'  <text x="{margin_left + 5}" y="{margin_top + chart_height + 50}" class="label">Non-overlapping: Ch {", ".join(map(str, non_overlap_channels))}</text>')
-            for ch in non_overlap_channels:
-                if ch in channels:
-                    center_freq = channels[ch]['freq']
-                    x = freq_to_x(center_freq)
-                    svg_parts.append(f'  <circle cx="{x}" cy="{margin_top + chart_height + 40}" r="8" fill="none" stroke="#22c55e" stroke-width="2"/>')
-                    svg_parts.append(f'  <text x="{x}" y="{margin_top + chart_height + 44}" text-anchor="middle" class="channel-label" fill="#22c55e">{ch}</text>')
-        else:
-            svg_parts.append(f'  <text x="{margin_left + 5}" y="{margin_top + chart_height + 50}" class="label">All channels non-overlapping (20 MHz spacing)</text>')
-
-        svg_parts.append('</svg>')
-        return '\n'.join(svg_parts)
-
-    # Generate SVGs for each band
-    svg_2_4 = generate_band_svg(channels_2_4, '2.4', 2400, 2485,
-                                 "2.4 GHz WiFi Channel Overlap &amp; Utilization",
-                                 [1, 6, 11])
-    svg_5 = generate_band_svg(channels_5, '5', 5150, 5850,
-                               "5 GHz WiFi Channel Utilization",
-                               None)
-
-    # Combine or output separately
-    if svg_2_4 and svg_5:
-        # Combine into one SVG with both bands stacked
-        combined = f'''<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 820">
-  <g transform="translate(0, 0)">
-{svg_2_4.replace('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 400">', '').replace('</svg>', '')}
-  </g>
-  <g transform="translate(0, 410)">
-{svg_5.replace('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 400">', '').replace('</svg>', '')}
-  </g>
-</svg>'''
-        svg_content = combined
-    elif svg_2_4:
-        svg_content = svg_2_4
-    elif svg_5:
-        svg_content = svg_5
-    else:
-        return None
-
-    if output_file:
-        with open(output_file, 'w') as f:
-            f.write(svg_content)
-        print(f"SVG written to: {output_file}")
-    else:
-        print(svg_content)
-
-    return svg_content
-
-
-def draw_recommendations(survey_data, json_output=False):
-    """Analyze channels and provide recommendations"""
-    # Parse channel data
-    channels = {}
-    in_use_channel = None
-
-    for ch_data in survey_data:
-        freq = ch_data.get('frequency')
-        ch_num = freq_to_channel(freq)
-        if ch_num:
-            busy_pct = get_busy_percentage(ch_data)
-            channels[ch_num] = {
-                'busy': busy_pct,
-                'noise': ch_data.get('noise', -100),
-                'in_use': ch_data.get('in-use', False)
-            }
-            if ch_data.get('in-use'):
-                in_use_channel = ch_num
-
-    # Find least congested non-overlapping channels
-    best_channels = []
-    for ch in [1, 6, 11]:
-        if ch in channels:
-            best_channels.append((ch, channels[ch]['busy']))
-
-    best_channels.sort(key=lambda x: x[1])
-
-    # JSON output
-    if json_output:
-        output = {
-            "recommended_channels": [
-                {"channel": ch, "busy_percent": round(busy, 1)}
-                for ch, busy in best_channels
-            ]
-        }
-        if in_use_channel:
-            output["current_channel"] = in_use_channel
-            output["current_busy_percent"] = round(channels.get(in_use_channel, {}).get('busy', 0), 1)
-
-        print(json.dumps(output, indent=2))
-        return
-
-    # Text output
-    print(f"\n{Colors.BOLD}Channel Recommendations{Colors.RESET}")
-    print("=" * 80)
-
-    if in_use_channel:
-        print(f"Current channel: {Colors.BOLD}{in_use_channel}{Colors.RESET}")
-        current_busy = channels.get(in_use_channel, {}).get('busy', 0)
-        if current_busy > 50:
-            print(f"  {Colors.RED}⚠{Colors.RESET}  High congestion detected ({current_busy:.1f}% busy)")
-        elif current_busy > 25:
-            print(f"  {Colors.YELLOW}⚠{Colors.RESET}  Moderate congestion ({current_busy:.1f}% busy)")
-        else:
-            print(f"  {Colors.GREEN}✓{Colors.RESET}  Good channel utilization ({current_busy:.1f}% busy)")
-
-    print(f"\nRecommended non-overlapping channels (2.4 GHz):")
-    for i, (ch, busy) in enumerate(best_channels[:3], 1):
-        color = get_utilization_color(busy)
-        marker = "★" if i == 1 else " "
-        print(f"  {marker} Channel {ch:2d}: {color}{busy:5.1f}% busy{Colors.RESET}")
-
-    print()
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description='Visualize WiFi channel overlap and utilization',
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog='''
-Examples:
-  # Read from yanger output (show all sections)
-  yanger -x "ixll -A ssh host sudo" ietf-hardware | %(prog)s
-
-  # Read from file
-  %(prog)s survey_data.json
-
-  # Show only list view
-  %(prog)s --list survey_data.json
-
-  # Show only specific sections
-  %(prog)s --overlap survey_data.json
-  %(prog)s --pie survey_data.json
-  %(prog)s --utilization survey_data.json
-  %(prog)s --recommendations survey_data.json
-  %(prog)s --overlap --pie survey_data.json
-
-  # Output recommendations as JSON
-  %(prog)s --recommendations --json survey_data.json
-
-  # Generate SVG image
-  %(prog)s --svg /tmp/wifi-channels.svg survey_data.json
-  %(prog)s --svg - survey_data.json > output.svg
-        '''
-    )
-    parser.add_argument('file', nargs='?', help='JSON file with hardware data (default: stdin)')
-    parser.add_argument('--list', action='store_true', help='Show simple list view instead of overlap graph')
-    parser.add_argument('--no-color', action='store_true', help='Disable colors')
-    parser.add_argument('--json', action='store_true', help='Output recommendations in JSON format')
-    parser.add_argument('--svg', metavar='FILE', help='Generate SVG image to FILE (use - for stdout)')
-
-    # Section filters
-    parser.add_argument('--overlap', action='store_true', help='Show only channel overlap visualization (2.4 GHz)')
-    parser.add_argument('--pie', action='store_true', help='Show only channel group pie chart (2.4 GHz)')
-    parser.add_argument('--utilization', action='store_true', help='Show only channel utilization list')
-    parser.add_argument('--recommendations', action='store_true', help='Show only channel recommendations')
-
-    args = parser.parse_args()
-
-    # Disable colors if requested
-    if args.no_color:
-        for attr in dir(Colors):
-            if not attr.startswith('_'):
-                setattr(Colors, attr, '')
-
-    # Read input
-    if args.file:
-        with open(args.file, 'r') as f:
-            data = json.load(f)
-    else:
-        data = json.load(sys.stdin)
-
-    # Extract survey data from hardware components
-    survey_data = []
-    hardware = data.get('ietf-hardware:hardware', {})
-    components = hardware.get('component', [])
-
-    for component in components:
-        if component.get('class') == 'infix-hardware:wifi':
-            wifi_radio = component.get('infix-hardware:wifi-radio', {})
-            survey = wifi_radio.get('survey', {})
-            channels = survey.get('channel', [])
-            if channels:
-                survey_data.extend(channels)
-
-    if not survey_data:
-        print("No WiFi survey data found in input", file=sys.stderr)
-        print("Expected format: yanger ietf-hardware output with wifi-radio survey data", file=sys.stderr)
-        sys.exit(1)
-
-    # Generate SVG if requested (exclusive mode)
-    if args.svg:
-        output_file = None if args.svg == '-' else args.svg
-        generate_svg(survey_data, output_file)
-        return
-
-    # Determine which sections to show
-    # If no section flags are set, show all sections
-    show_all = not (args.overlap or args.pie or args.utilization or args.recommendations)
-
-    show_overlap = show_all or args.overlap
-    show_pie = show_all or args.pie
-    show_utilization = show_all or args.utilization
-    show_recommendations_section = show_all or args.recommendations
-
-    # Draw visualization
-    freqs = [ch.get('frequency', 0) for ch in survey_data]
-    has_2_4ghz = any(2400 <= f <= 2500 for f in freqs)
-
-    if show_overlap and has_2_4ghz and not args.list:
-        draw_channel_graph_2_4ghz(survey_data)
-
-    if show_pie and has_2_4ghz:
-        draw_overlap_pie(survey_data)
-
-    if show_utilization:
-        draw_channel_list(survey_data)
-
-    if show_recommendations_section:
-        draw_recommendations(survey_data, json_output=args.json)
-
-
-if __name__ == '__main__':
-    main()

board/common/rootfs/usr/libexec/infix/wifi-scanner

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+if [ $# -ne 1 ]; then
+	echo "usage: $0 <ifname>"
+	exit 1
+fi
+ifname=$1
+
+TIMEOUT=300
+status=$(wpa_cli -i $ifname scan)
+while [ "$status" != "OK" ]; do
+	status=$(wpa_cli -i $ifname scan)
+	TIMEOUT=$((TIMEOUT-1))
+	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
+	sleep 0.5
+done

board/common/rootfs/usr/libexec/odhcp6c.sh

@@ -1,242 +0,0 @@
-#!/bin/sh
-# DHCPv6 client state update script for odhcp6c
-# This script expects a system with resolvconf (openresolv) and iproute2
-
-[ -z "$1" ] && echo "Error: should be called from odhcp6c" && exit 1
-
-interface="$1"
-state="$2"
-RESOLV_CONF="/run/resolvconf/interfaces/${interface}-ipv6.conf"
-NTPFILE="/run/chrony/dhcp-sources.d/${interface}-ipv6.sources"
-
-[ -n "$metric" ] || metric=5
-
-log()
-{
-	logger -I $$ -t odhcp6c -p user.notice "${interface}: $*"
-}
-
-dbg()
-{
-	logger -I $$ -t odhcp6c -p user.debug "${interface}: $*"
-}
-
-err()
-{
-	logger -I $$ -t odhcp6c -p user.err "${interface}: $*"
-}
-
-teardown_interface()
-{
-	ip -6 route flush dev "$interface"
-	ip -6 address flush dev "$interface" scope global
-}
-
-setup_interface()
-{
-	# Merge RA addresses with DHCP addresses
-	for entry in $RA_ADDRESSES; do
-		duplicate=0
-		addr="${entry%%/*}"
-		for dentry in $ADDRESSES; do
-			daddr="${dentry%%/*}"
-			[ "$addr" = "$daddr" ] && duplicate=1
-		done
-		[ "$duplicate" = "0" ] && ADDRESSES="$ADDRESSES $entry"
-	done
-
-	# Add addresses
-	for entry in $ADDRESSES; do
-		addr="${entry%%,*}"
-		entry="${entry#*,}"
-		preferred="${entry%%,*}"
-		entry="${entry#*,}"
-		valid="${entry%%,*}"
-
-		ip -6 address add "$addr" dev "$interface" preferred_lft "$preferred" valid_lft "$valid" proto dhcp
-		log "assigned address $addr (preferred=$preferred, valid=$valid)"
-	done
-
-	# Add routes from RA
-	for entry in $RA_ROUTES; do
-		addr="${entry%%,*}"
-		entry="${entry#*,}"
-		gw="${entry%%,*}"
-		entry="${entry#*,}"
-		valid="${entry%%,*}"
-		entry="${entry#*,}"
-		metric="${entry%%,*}"
-
-		if [ -n "$gw" ]; then
-			ip -6 route add "$addr" via "$gw" metric "$metric" dev "$interface" from "::/128"
-		else
-			ip -6 route add "$addr" metric "$metric" dev "$interface"
-		fi
-
-		# Add routes for delegated prefixes
-		for prefix in $PREFIXES; do
-			paddr="${prefix%%,*}"
-			[ -n "$gw" ] && ip -6 route add "$addr" via "$gw" metric "$metric" dev "$interface" from "$paddr"
-		done
-	done
-}
-
-handle_prefixes()
-{
-	# $PREFIXES format: "prefix/len,preferred,valid[,class=N][,excluded=...] ..."
-	for entry in $PREFIXES; do
-		addr="${entry%%,*}"
-		entry="${entry#*,}"
-		preferred="${entry%%,*}"
-		entry="${entry#*,}"
-		valid="${entry%%,*}"
-
-		log "received delegated prefix $addr (preferred=$preferred, valid=$valid)"
-
-		# Add unreachable route to prevent routing loops
-		ip -6 route add unreachable "$addr" 2>/dev/null
-
-		# Future: Distribute to downstream interfaces
-	done
-}
-
-handle_dns()
-{
-	truncate -s 0 "$RESOLV_CONF"
-
-	# Combine DHCPv6 DNS ($RDNSS) and RA DNS ($RA_DNS), deduplicating
-	all_dns=""
-	for server in $RDNSS $RA_DNS; do
-		# Simple deduplication: only add if not already in list
-		case " $all_dns " in
-			*" $server "*) ;;
-			*) all_dns="$all_dns $server" ;;
-		esac
-	done
-
-	# Domain search list (DHCPv6 option 24)
-	if [ -n "$DOMAINS" ]; then
-		dbg "adding search domains: $DOMAINS"
-		echo "search $DOMAINS # $interface" >> "$RESOLV_CONF"
-	fi
-
-	# DNS servers
-	for server in $all_dns; do
-		[ -z "$server" ] && continue
-		dbg "adding dns $server"
-		echo "nameserver $server # $interface" >> "$RESOLV_CONF"
-	done
-
-	if [ -n "$all_dns" ]; then
-		resolvconf -u
-	fi
-}
-
-handle_ntp()
-{
-	# DHCPv6 option 56 (NTP server) is provided as $OPTION_56 in hex format
-	# Format: sub-option-code (2 bytes) + length (2 bytes) + data
-	# Sub-option 1 = NTP server address (16 bytes IPv6)
-	#
-	# This is complex to parse in shell. For now, we attempt basic parsing
-	# and fall back to logging a warning if the format is unexpected.
-
-	if [ -n "$OPTION_56" ]; then
-		# Remove all non-hex characters (spaces, colons, etc.) and convert to lowercase
-		hex=$(echo "$OPTION_56" | tr -d '[:space:]:-' | tr '[:upper:]' '[:lower:]')
-
-		truncate -s 0 "$NTPFILE"
-		ntp_found=0
-
-		# Parse option 56: iterate through sub-options
-		# Each sub-option: 2 bytes code + 2 bytes length + data
-		pos=0
-		while [ $pos -lt ${#hex} ]; do
-			# Need at least 4 hex chars (2 bytes) for sub-option code
-			[ $((${#hex} - pos)) -lt 4 ] && break
-
-			# Extract sub-option code (2 bytes = 4 hex chars)
-			subopt_code=$(echo "$hex" | cut -c $((pos+1))-$((pos+4)))
-			pos=$((pos + 4))
-
-			# Need 4 more hex chars for length
-			[ $((${#hex} - pos)) -lt 4 ] && break
-
-			# Extract length (2 bytes = 4 hex chars)
-			subopt_len_hex=$(echo "$hex" | cut -c $((pos+1))-$((pos+4)))
-			subopt_len=$(printf "%d" "0x$subopt_len_hex")
-			pos=$((pos + 4))
-
-			# Sub-option 1 = NTP server address (should be 16 bytes for IPv6)
-			if [ "$subopt_code" = "0001" ] && [ "$subopt_len" -eq 16 ]; then
-				# Extract 16 bytes (32 hex chars) for IPv6 address
-				addr_hex=$(echo "$hex" | cut -c $((pos+1))-$((pos+32)))
-
-				# Convert hex to IPv6 address format
-				# Format: 0123456789abcdef0123456789abcdef -> 0123:4567:89ab:cdef:0123:4567:89ab:cdef
-				ipv6=$(echo "$addr_hex" | sed 's/\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)/\1:\2:\3:\4:\5:\6:\7:\8/')
-
-				dbg "got NTP server $ipv6"
-				echo "server $ipv6 iburst" >> "$NTPFILE"
-				ntp_found=1
-			fi
-
-			# Skip this sub-option's data
-			pos=$((pos + subopt_len * 2))
-		done
-
-		if [ "$ntp_found" -eq 1 ]; then
-			chronyc reload sources >/dev/null 2>&1
-		else
-			dbg "option 56 received but no NTP server addresses found (consider using option 31/SNTP)"
-		fi
-	fi
-}
-
-log "state: $state"
-
-(
-	flock 9
-	case "$state" in
-		started)
-			# Initial state - clean up any stale config
-			teardown_interface
-			;;
-
-		bound)
-			# Fresh lease - tear down and set up from scratch
-			teardown_interface
-			setup_interface
-			handle_prefixes
-			handle_dns
-			handle_ntp
-			;;
-
-		informed|updated|rebound|ra-updated)
-			# Update existing configuration
-			setup_interface
-			[ -n "$PREFIXES" ] && handle_prefixes
-			handle_dns
-			handle_ntp
-			;;
-
-		unbound|stopped)
-			# Lost server or client stopped
-			teardown_interface
-			rm -f "$RESOLV_CONF"
-			rm -f "$NTPFILE"
-			resolvconf -u
-			chronyc reload sources >/dev/null 2>&1
-			;;
-	esac
-) 9>/tmp/odhcp6c.lock.${interface}
-rm -f /tmp/odhcp6c.lock.${interface}
-
-# Run hooks
-HOOK_DIR="/usr/libexec/odhcp6c.d"
-for hook in "${HOOK_DIR}/"*; do
-	[ -f "${hook}" -a -x "${hook}" ] || continue
-	"${hook}" "$interface" "$state"
-done
-
-exit 0

board/common/rootfs/usr/sbin/container

@@ -411,20 +411,10 @@ create()
 	logging="--log-driver syslog"
     fi
 
-    # Build resource limit arguments
-    resource=""
-    if [ -n "$memory" ]; then
-	resource="$resource --memory=$memory"
-    fi
-    if [ -n "$cpu_limit" ]; then
-	resource="$resource --cpu-quota=$cpu_limit"
-    fi
-
     # When we get here we've already fetched, or pulled, the image
-    args="$args --read-only --replace --quiet $caps"
-    args="$args --cgroups=enabled --cgroupns=host --cgroup-parent=system/container@$name"
+    args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
     args="$args --restart=$restart --systemd=false --tz=local $privileged"
-    args="$args $vol $mount $hostname $entrypoint $env $port $logging $resource"
+    args="$args $vol $mount $hostname $entrypoint $env $port $logging"
     pidfile=/run/container:${name}.pid
 
     [ -n "$quiet" ] || log "---------------------------------------"
@@ -726,8 +716,6 @@ options:
       --log-path PATH      Path for k8s-file log pipe
   -m, --mount HOST:DEST    Bind mount a read-only file inside a container
       --manual             Do not start container automatically after creation
-      --memory BYTES       Memory limit in bytes (supports K/M/G suffix)
-      --cpu-limit LIMIT    CPU limit in millicores (1000m = 100% of 1 core)
   -n, --name NAME          Alternative way of supplying name to start/stop/restart
       --privileged         Give container extended privileges
   -p, --publish PORT       Publish ports when creating container
@@ -848,14 +836,6 @@ while [ "$1" != "" ]; do
 	--manual)
 	    manual=true
 	    ;;
-	--memory)
-	    shift
-	    memory="$1"
-	    ;;
-	--cpu-limit)
-	    shift
-	    cpu_limit="$1"
-	    ;;
 	-n | --name)
 	    shift
 	    name="$1"

board/common/rootfs/usr/share/udhcpc/default6.script

@@ -0,0 +1,111 @@
+#!/bin/sh
+# This script expects a system with resolvconf (openresolv) and iproute2
+
+[ -z "$1" ] && echo "Error: should be called from udhcpc6" && exit 1
+
+ACTION="$1"
+RESOLV_CONF="/run/resolvconf/interfaces/${interface}-ipv6.conf"
+NTPFILE="/run/chrony/dhcp-sources.d/${interface}-ipv6.sources"
+
+[ -n "$metric" ] || metric=5
+
+if [ -z "${IF_WAIT_DELAY}" ]; then
+	IF_WAIT_DELAY=10
+fi
+
+log()
+{
+    logger -I $$ -t udhcpc6 -p user.notice "${interface}: $*"
+}
+
+dbg()
+{
+    logger -I $$ -t udhcpc6 -p user.debug "${interface}: $*"
+}
+
+err()
+{
+    logger -I $$ -t udhcpc6 -p user.err "${interface}: $*"
+}
+
+clr_dhcpv6_addresses()
+{
+    addrs=$(ip -j addr show dev $interface \
+		| jq -c '.[0].addr_info[] | select(.family == "inet6") | select(.protocol == "dhcp")')
+
+    for addr in $addrs; do
+	ip="$(echo "$addr" | jq -r '."local"')"
+	prefix="$(echo "$addr" | jq -r '."prefixlen"')"
+	log "removing $ip/$prefix"
+	ip addr del "$ip/$prefix" dev "$interface"
+    done
+}
+
+log "action $ACTION"
+case "$ACTION" in
+    deconfig)
+	clr_dhcpv6_addresses
+
+	# drop info from this interface
+	rm -f "$RESOLV_CONF"
+	rm -f "$NTPFILE"
+	;;
+
+    leasefail|nak)
+	# DHCPv6 lease failed - log it
+	err "DHCPv6 lease failed"
+	;;
+
+    renew|bound)
+	# Add IPv6 address if provided (stateful DHCPv6)
+	if [ -n "$ipv6" ]; then
+	    if /bin/ip addr add dev $interface $ipv6 proto dhcp; then
+		log "assigned address $ipv6"
+	    fi
+	fi
+
+	# Handle delegated prefix (prefix delegation)
+	if [ -n "$ipv6prefix" ]; then
+	    log "received delegated prefix $ipv6prefix"
+	    # Prefix delegation handling could be added here
+	    # For now, just log it - actual routing/distribution
+	    # would need additional configuration
+	fi
+
+	# drop info from this interface
+	truncate -s 0 "$RESOLV_CONF"
+
+	# DHCPv6 domain search list (option 24)
+	if [ -n "$search" ]; then
+	    dbg "adding search $search"
+	    echo "search $search # $interface" >> $RESOLV_CONF
+	fi
+
+	# DHCPv6 DNS servers (option 23)
+	if [ -n "$dns" ]; then
+	    for i in $dns ; do
+		dbg "adding dns $i"
+		echo "nameserver $i # $interface" >> $RESOLV_CONF
+	    done
+	    resolvconf -u
+	fi
+
+	# NTP servers (option 56)
+	if [ -n "$ntpsrv" ]; then
+	    truncate -s 0 "$NTPFILE"
+	    for srv in $ntpsrv; do
+		dbg "got NTP server $srv"
+		echo "server $srv iburst" >> "$NTPFILE"
+	    done
+	    chronyc reload sources >/dev/null
+	fi
+	;;
+esac
+
+HOOK_DIR="$0.d"
+for hook in "${HOOK_DIR}/"*; do
+    [ -f "${hook}" -a -x "${hook}" ] || continue
+    "${hook}" "$ACTION"
+done
+
+exit 0

board/common/sign.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -e
+
+common=$(dirname $(readlink -f "$0"))
+
+cd $BINARIES_DIR
+cp $common/rootfs.its .
+
+mkimage -E -p 0x1000 -B 0x1000 -k $2 -f rootfs.its rootfs.itb
+
+cp rootfs.itb rootfs.itbh
+truncate -s $((0x1000)) rootfs.itbh

board/riscv64/board.mk

@@ -1 +0,0 @@
-include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/*/*.mk))

board/riscv64/linux_defconfig

@@ -358,7 +358,6 @@ CONFIG_SND_SOC_JH7110_TDM=y
 CONFIG_SND_SOC_WM8960=y
 CONFIG_SND_SIMPLE_CARD=y
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
@@ -473,16 +472,8 @@ CONFIG_DEBUG_FS=y
 # CONFIG_SLUB_DEBUG is not set
 CONFIG_DEBUG_RODATA_TEST=y
 CONFIG_DEBUG_WX=y
-CONFIG_PANIC_ON_OOPS=y
-CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY=y
-CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
-CONFIG_TEST_LOCKUP=m
 # CONFIG_SCHED_DEBUG is not set
 CONFIG_STACKTRACE=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60

board/x86_64/linux_defconfig

@@ -53,6 +53,7 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -68,31 +69,12 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
-CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -101,23 +83,15 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
-CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -134,69 +108,29 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_SET=y
-CONFIG_IP_SET_BITMAP_IP=y
-CONFIG_IP_SET_BITMAP_IPMAC=y
-CONFIG_IP_SET_BITMAP_PORT=y
-CONFIG_IP_SET_HASH_IP=y
-CONFIG_IP_SET_HASH_IPMARK=y
-CONFIG_IP_SET_HASH_IPPORT=y
-CONFIG_IP_SET_HASH_IPPORTIP=y
-CONFIG_IP_SET_HASH_IPPORTNET=y
-CONFIG_IP_SET_HASH_IPMAC=y
-CONFIG_IP_SET_HASH_MAC=y
-CONFIG_IP_SET_HASH_NETPORTNET=y
-CONFIG_IP_SET_HASH_NET=y
-CONFIG_IP_SET_HASH_NETNET=y
-CONFIG_IP_SET_HASH_NETPORT=y
-CONFIG_IP_SET_HASH_NETIFACE=y
-CONFIG_IP_SET_LIST_SET=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
-CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -257,7 +191,6 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
-CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -287,7 +220,6 @@ CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_EHCI_HCD=m
 CONFIG_USB_UHCI_HCD=m
@@ -331,13 +263,7 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY=y
-CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_DETECT_HUNG_TASK=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
-CONFIG_TEST_LOCKUP=m
 CONFIG_FUNCTION_TRACER=y
 CONFIG_UNWINDER_FRAME_POINTER=y

configs/aarch32_defconfig

@@ -29,13 +29,12 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.58"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -60,7 +59,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -83,7 +82,6 @@ BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_GETENT=y
@@ -97,23 +95,20 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
@@ -140,12 +135,11 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_ONIEPROM=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
+GNS3_APPLIANCE_RAM=512
+GNS3_APPLIANCE_IFNUM=10

configs/aarch32_minimal_defconfig

@@ -29,13 +29,12 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.58"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -60,7 +59,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -83,7 +82,6 @@ BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_GETENT=y
@@ -97,23 +95,20 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
@@ -140,12 +135,11 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_ONIEPROM=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
+GNS3_APPLIANCE_RAM=512
+GNS3_APPLIANCE_IFNUM=10

configs/aarch64_defconfig

@@ -25,19 +25,20 @@ BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
@@ -63,7 +64,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -102,7 +103,6 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
@@ -120,21 +120,19 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_GO_BIN=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
@@ -149,8 +147,7 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
-BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
@@ -174,18 +171,17 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_NETBROWSE=y
-BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
+GNS3_APPLIANCE_RAM=512
+GNS3_APPLIANCE_IFNUM=10

configs/aarch64_minimal_defconfig

@@ -24,19 +24,22 @@ BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -83,7 +86,6 @@ BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_KMOD_TOOLS=y
@@ -96,20 +98,18 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
@@ -128,6 +128,7 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -143,15 +144,13 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
+DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
+GNS3_APPLIANCE_RAM=512
+GNS3_APPLIANCE_IFNUM=10