Merge pull request #1445 from kernelkit/lts-kernel-backport

LTS kernel backport + net.d tmpfiles fix

README.md

@@ -167,8 +167,8 @@ APIs.
 [0]: https://www.kernel.org
 [1]: https://buildroot.org/ "Buildroot Homepage"
 [2]: https://www.sysrepo.org/ "Sysrepo Homepage"
-[3]: https://kernelkit.org/infix/latest/cli/introduction/
-[4]: https://kernelkit.org/infix/
+[3]: https://www.kernelkit.org/infix/latest/cli/introduction/
+[4]: https://www.kernelkit.org/infix/
 [5]: https://github.com/kernelkit/infix/releases
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license

board/aarch64/alder-alder/Config.in

@@ -1,5 +1,6 @@
 config BR2_PACKAGE_ALDER_ALDER
 	bool "Alder"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Alder

board/aarch64/bananapi-bpi-r3/README.md

@@ -262,8 +262,8 @@ make aarch64
 ./utils/mkimage.sh -odt emmc bananapi-bpi-r3
 ```
 
-[0]: https://kernelkit.org/posts/flashing-sdcard/
-[1]: https://kernelkit.org/infix/latest/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.kernelkit.org/infix/latest/
 [2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img
 [3]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-emmc.img
 [4]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r3-emmc-boot-2025.01-latest.tar.gz

board/aarch64/marvell-cn9130-crb/Config.in

@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MARVELL_CN9130_CRB
 	bool "Marvell CN9130-CRB"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Customer Reference Board for CN9130

board/aarch64/marvell-espressobin/Config.in

@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MARVELL_ESPRESSOBIN
 	bool "Marvell ESPRESSObin"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Marvell ESPRESSObin

board/aarch64/raspberrypi-rpi64/README.md

@@ -312,13 +312,13 @@ While capable of basic routing tasks, be aware of limitations:
 For applications requiring multiple ports or high performance, consider
 dedicated networking hardware like the [Banana Pi R3][12].
 
-[0]: https://kernelkit.org/posts/flashing-sdcard/
-[1]: https://kernelkit.org/infix/latest/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.kernelkit.org/infix/latest/
 [2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
-[3]: https://kernelkit.org/infix/latest/container/#content-mounts
-[4]: https://kernelkit.org/infix/latest/scripting-restconf/
+[3]: https://www.kernelkit.org/infix/latest/container/#content-mounts
+[4]: https://www.kernelkit.org/infix/latest/scripting-restconf/
 [8]: https://github.com/kernelkit/infix/releases/tag/latest-boot
-[9]: https://kernelkit.org/infix/latest/networking/#wifi
+[9]: https://www.kernelkit.org/infix/latest/networking/#wifi
 [10]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
 [11]: https://www.raspberrypi.com/documentation/
-[12]: https://kernelkit.org/infix/latest/hardware/#banana-pi-bpi-r3
+[12]: https://www.kernelkit.org/infix/latest/hardware/#banana-pi-bpi-r3

board/aarch64/styx-dcp-sc-28p/Config.in

@@ -1,5 +1,6 @@
 config BR2_PACKAGE_STYX_DCP_SC_28P
 	bool "Styx DCP-SC-28P"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Styx DCP-SC-28P

board/arm/microchip-sama7g54-ek/README.md

@@ -112,5 +112,5 @@ Connect a USB-to-serial adapter to the board's debug UART header.
 > [!WARNING]
 > Use only 3.3V serial adapters.
 
-[0]: https://kernelkit.org/posts/flashing-sdcard/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
 [1]: https://www.microchip.com/en-us/development-tool/EV21H18A

board/arm/raspberrypi-rpi2/README.md

@@ -91,5 +91,5 @@ Serial settings: 115200 8N1
 > [!WARNING]
 > Use only 3.3V serial adapters. 5V adapters will damage your Raspberry Pi!
 
-[0]: https://kernelkit.org/posts/flashing-sdcard/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
 [1]: https://www.raspberrypi.com/products/raspberry-pi-2-model-b/

board/common/Config.in

@@ -1,21 +1,11 @@
-
 menu "Images"
 
-comment "DDI Based"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ddi/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ddi-disk/Config.in"
-
-comment "ITB Based"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rootfs/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-qcow/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
-
-comment "General"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-barebox-esp/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-lvm-stub/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"
 
 endmenu

board/common/dracut.conf

@@ -1,102 +0,0 @@
-#Simple dracut config for a system without systemd
-
-#Dracut configuration
-
-show_modules=yes
-i18n_install_all=no
-lvmconf=no
-mdadmconf=no
-early_microcode=no
-hostonly=no
-hostonly_cmdline=no
-use_fstab=no
-kernel_cmdline="rd.break=initqueue"
-do_strip=no
-
-# Dracut modules needed
-add_dracutmodules+=" \
-busybox \
-"
-
-# Modules to ignore
-omit_dracutmodules+=" \
-base \
-bash \
-biosdevname \
-btrfs \
-bluetooth \
-caps \
-cifs \
-connman \
-crypt \
-crypt-gpg \
-dash \
-dbus-broker \
-dbus-daemon \
-dm \
-dmraid \
-dmsquash-live-ntfs \
-dracut-systemd \
-fcoe \
-fcoe-uefi \
-fs-lib \
-iscsi \
-i18n \
-kernel-modules \
-kernel-modules-extra \
-lvmmerge \
-lvm \
-lunmask \
-mdraid \
-memstrack \
-mksh \
-modsign \
-mount-root \
-multipath \
-nbd \
-network-legacy \
-network-wicked \
-nfs \
-nvdimm \
-nvmf \
-parse-lunmask \
-pcsc \
-qemu \
-qemu-net \
-resume \
-rootfs-block \
-rngd \
-shutdown \
-systemd \
-systemd-udevd \
-systemd-coredump \
-systemd-ask-password \
-systemd-timedated \
-systemd-rfkill \
-systemd-resolved \
-systemd-hostnamed \
-systemd-initrd \
-systemd-integritysetup \
-systemd-journald \
-systemd-ldconfig \
-systemd-networkd \
-systemd-timesyncd \
-systemd-veritysetup \
-systemd-modules-load \
-systemd-pcrphase \
-systemd-portabled \
-systemd-pstore \
-systemd-sysctl \
-systemd-repart \
-systemd-sysext \
-systemd-sysusers \
-systemd-tmpfiles \
-squash \
-ssh-client \
-stratis \
-tpm2-tss \
-udev-rules \
-url-lib \
-usrmount \
-virtiofs \
-"

board/common/image/image-barebox-esp/Config.in

@@ -1,6 +0,0 @@
-config IMAGE_BAREBOX_ESP
-	bool "Barebox EFI System Partition"
-	depends on BR2_TARGET_BAREBOX
-	default y if IMAGE_DDI
-	help
-	  An EFI System Partition (ESP) with Barebox installed.

board/common/image/image-barebox-esp/generate.sh

@@ -1,38 +0,0 @@
-#!/bin/sh
-
-set -e
-
-case "$BR2_ARCH" in
-    x86_64)
-	BOOT_EFI=BOOTX64.EFI
-	;;
-    *)
-	echo "Unknown EFI boot path for $BR2_ARCH" >&2
-	exit 1
-	;;
-esac
-
-mkdir -p "${WORKDIR}"/root
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp
-
-cat <<EOF >"${WORKDIR}"/genimage.cfg
-image barebox-esp.vfat {
-	size = "16M"
-	vfat {
-		file EFI/BOOT/$BOOT_EFI {
-			image = $BINARIES_DIR/barebox.efi
-		}
-	}
-}
-
-# Silence genimage warnings
-config {}
-EOF
-
-genimage \
-    --tmppath    "${WORKDIR}"/tmp  \
-    --rootpath   "${WORKDIR}"/root \
-    --inputpath  "${WORKDIR}"      \
-    --outputpath "${BINARIES_DIR}" \
-    --config "${WORKDIR}"/genimage.cfg

board/common/image/image-barebox-esp/image-barebox-esp.mk

@@ -1,7 +0,0 @@
-################################################################################
-#
-# image-barebox-esp
-#
-################################################################################
-
-$(eval $(ix-image))

board/common/image/image-ddi-disk/Config.in

@@ -1,8 +0,0 @@
-menuconfig IMAGE_DDI_DISK
-	bool "LVM2 based provisioning disk (DDI)"
-	depends on IMAGE_BAREBOX_ESP
-	depends on IMAGE_DDI
-	help
-	  Compose a full disk image consisting of an EFI System
-	  Partition (ESP) containing Barebox, and an LVM PV in which
-	  Infix is installed as an LV.

board/common/image/image-ddi-disk/generate.sh

@@ -1,46 +0,0 @@
-#!/bin/sh
-
-set -e
-
-
-mkdir -p "${WORKDIR}"/root
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp
-
-"${BR2_EXTERNAL_INFIX_PATH}"/utils/lvm-mkinternal \
-	"${BINARIES_DIR}"/"${ARTIFACT}".raw >"${WORKDIR}"/internal.lvm
-
-cat <<EOF >"${WORKDIR}"/genimage.cfg
-
-image ${ARTIFACT}.disk {
-	hdimage {
-		partition-table-type = "gpt"
-	}
-
-	partition esp {
-		partition-type-uuid = "esp"
-		image = "$BINARIES_DIR/barebox-esp.vfat"
-	}
-
-	partition esp-backup {
-		partition-type-uuid = "esp"
-		image = "$BINARIES_DIR/barebox-esp.vfat"
-	}
-
-	partition internal {
-		growfs = "true"
-		partition-type-uuid = "lvm"
-		image = "internal.lvm"
-	}
-}
-
-# Silence genimage warnings
-config {}
-EOF
-
-genimage \
-    --tmppath    "${WORKDIR}"/tmp  \
-    --rootpath   "${WORKDIR}"/root \
-    --inputpath  "${WORKDIR}"      \
-    --outputpath "${BINARIES_DIR}" \
-    --config "${WORKDIR}"/genimage.cfg

board/common/image/image-ddi-disk/image-ddi-disk.mk

@@ -1,9 +0,0 @@
-################################################################################
-#
-# image-ddi-disk
-#
-################################################################################
-
-IMAGE_DDI_DISK_DEPENDENCIES := image-barebox-esp image-ddi
-
-$(eval $(ix-image))

board/common/image/image-ddi/Config.in

@@ -1,33 +0,0 @@
-menuconfig IMAGE_DDI
-	bool "Discoverable Disk Image (DDI)"
-	select BR2_TARGET_ROOTFS_SQUASHFS
-	select BR2_PACKAGE_HOST_GENIMAGE
-	help
-	  Create a Discoverable Disk Image containing:
-	  - SquashFS of the root filesystem
-	  - dm-verity hash tree of the root filesystem
-	  - DDI compliant JSON signature object of the hash tree
-
-	  https://uapi-group.org/specifications/specs/discoverable_disk_image/
-
-config IMAGE_DDI_KEY
-	string "signing key"
-	depends on IMAGE_DDI
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
-	help
-	  Path to the private RSA key, in PKCS#8 format, used to sign
-	  the dm-verity hash tree.
-
-config IMAGE_DDI_CERT
-	string "signing cert"
-	depends on IMAGE_DDI
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
-	help
-	  Path to the X509 certificate whose associated public key can
-	  validate the authenticity of the generated signature.
-
-	  The SHA256 fingerprint of this certificate is recorded
-	  alongside the standard PKCS#7 signature in the JSON object,
-	  which can be useful to locate corresponding key on systems
-	  that lack full X509 parsing capabilities.
-

board/common/image/image-ddi/generate.sh

@@ -1,81 +0,0 @@
-#!/bin/sh
-
-# Generate the DDI in two phases. First we create the verity hash tree
-# and signature, then we collect them together with the rootfs in the
-# ddi. The reason for this is that genimage (at least up to v19) can
-# not infer the size of a partition if the image to be placed in it is
-# created by the same genimage instance. With the two-phase approach,
-# we work around that problem and can create a DDI without any wasted
-# space.
-
-set -e
-
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp "${WORKDIR}"/verity
-
-cat <<EOF >"${WORKDIR}"/genimage-verity.cfg
-image rootfs.verity {
-	verity {
-        	image = "rootfs.squashfs"
-	}
-}
-
-image rootfs.verity-sig {
-	verity-sig {
-        	image = "rootfs.verity"
-		cert = "${CERT}"
-		key = "${KEY}"
-	}
-}
-
-config {}
-EOF
-
-genimage \
-    --loglevel 1 \
-    --tmppath    "${WORKDIR}"/tmp \
-    --rootpath   "${WORKDIR}" \
-    --inputpath  "${BINARIES_DIR}" \
-    --outputpath "${WORKDIR}"/verity \
-    --config     "${WORKDIR}"/genimage-verity.cfg
-
-case "${BR2_ARCH}" in
-    "x86_64")
-	arch=x86-64
-	;;
-    *)
-	echo "ERROR: missing mapping from ${BR2_ARCH} to genimage arch" >&2
-	exit 1
-	;;
-esac
-
-cat <<EOF >"${WORKDIR}"/genimage-ddi.cfg
-image ${ARTIFACT}.raw {
-	hdimage {
-		partition-table-type = "gpt"
-	}
-
-	partition root {
-		partition-type-uuid = "root-${arch}"
-		image = "rootfs.squashfs"
-	}
-	partition root-verity {
-		partition-type-uuid = "root-${arch}-verity"
-		image = "${WORKDIR}/verity/rootfs.verity"
-	}
-	partition root-verity-sig {
-		partition-type-uuid = "root-${arch}-verity-sig"
-		image = "${WORKDIR}/verity/rootfs.verity-sig"
-	}
-}
-
-config {}
-EOF
-
-genimage \
-    --loglevel 1 \
-    --tmppath    "${WORKDIR}"/tmp \
-    --rootpath   "${WORKDIR}" \
-    --inputpath  "${BINARIES_DIR}" \
-    --outputpath "${BINARIES_DIR}" \
-    --config     "${WORKDIR}"/genimage-ddi.cfg

board/common/image/image-ddi/genimage.cfg

@@ -1,32 +0,0 @@
-image rootfs.verity {
-	verity {
-        	image = "rootfs.squashfs"
-	}
-}
-
-image rootfs.verity-sig {
-	verity-sig {
-        	image = "rootfs.verity"
-		cert = "@CERT@"
-		key = "@KEY@"
-	}
-}
-
-image @ARTIFACT@.raw {
-	hdimage {
-		partition-table-type = "gpt"
-	}
-
-	partition root {
-		partition-type-uuid = "root-@ARCH@"
-		image = "rootfs.squashfs"
-	}
-	partition root-verity {
-		partition-type-uuid = "root-@ARCH@-verity"
-		image = "rootfs.verity"
-	}
-	partition root-verity-sig {
-		partition-type-uuid = "root-@ARCH@-verity-sig"
-		image = "rootfs.verity-sig"
-	}
-}

board/common/image/image-ddi/image-ddi.mk

@@ -1,10 +0,0 @@
-################################################################################
-#
-# image-ddi
-#
-################################################################################
-
-IMAGE_DDI_DEPENDENCIES := host-genimage rootfs-squashfs
-IMAGE_DDI_CONFIG_VARS := KEY CERT
-
-$(eval $(ix-image))

board/common/image/image-ddi/rootfs/etc/fstab

@@ -1,15 +0,0 @@
-tmpfs		/tmp		tmpfs	mode=0755,nosuid,nodev	0	0
-tmpfs		/run		tmpfs	mode=0755,nosuid,nodev	0	0
-tmpfs		/media		tmpfs	mode=1755,nosuid,nodev	0	0
-tmpfs		/mnt/tmp	tmpfs	defaults		0	0
-
-# Locate and mount /cfg, /home, /root and /var from the internal
-# volume, wherever that is located - or, as a last resort, setup tmpfs
-# mounts at these points. Setup an ephemeral writable overlay on /etc.
-/usr/libexec/infix/mnt#	/mnt/rw	  helper	none			0	0
-
-# Optional, nice-to-have mounts
-debugfs		/sys/kernel/debug   debugfs	nofail			0	0
-tracefs		/sys/kernel/tracing tracefs	nofail			0	0
-cfgfs		/config		    configfs	nofail,noauto		0	0
-host		/mnt/host	    9p		nofail,noauto,cache=none,msize=16384	0	0

board/common/image/image-ddi/rootfs/usr/libexec/infix/mnt

@@ -1,211 +0,0 @@
-#!/bin/sh
-# Called from /etc/fstab to ensure we have something writable mounted
-# at /cfg, /home, /root, and /var.
-#
-# In the normal case, the "rw" LV from the "internal" LVM VG is used
-# to back all persistant storage. In the event that "internal" is
-# present, but the "rw" LV is missing, one will be provisioned, along
-# with the required BTRFS subvolumes.
-#
-# In all other scenarios where the subvolumes are not available, the
-# system will fall back to temporary storage for all mount points.
-#
-# For /etc, a writable, tmpfs backed, layer is always overlayed on top
-# of the read-only contents from the OS image.
-
-set -e
-
-nm=$(basename "$0")
-need_restore=
-code=0
-
-logmsg()
-{
-    logger -k -t "$nm" -p user.crit "$@"
-}
-
-status()
-{
-    GREEN="$(printf '\033[1;32m')"
-    RED="$(printf '\033[1;31m')"
-    YELLOW="$(printf '\033[1;33m')"
-    BOLD="$(printf '\033[1m')"
-    RESET="$(printf '\033[0m')"
-
-    case $1 in
-        0) color=$GREEN; text=' OK ' ;;
-        1) color=$RED;   text='FAIL' ;;
-        2) color=$YELLOW;text='WARN' ;;
-        *) color=$YELLOW;text=' ⋯  ' ;;
-    esac
-
-    printf '%s[%s%s%s%s]%s ' "$BOLD" "$color" "$text" "$RESET" "$BOLD" "$RESET"
-}
-
-print_start()
-{
-    printf '\r\033[K%s%s' "$(status 3)" "$*" > /dev/console
-    need_restore=YES
-}
-
-print_end()
-{
-    rc=$1; shift
-    if [ $# -gt 0 ]; then
-        printf '\r\033[K%s%s\n' "$(status "$rc")" "$*" > /dev/console
-    else
-        printf '\r%s\n' "$(status "$rc")" > /dev/console
-    fi
-}
-
-# Restore Finit's original progress message so its [ OK ] appears correctly
-print_restore()
-{
-    [ "$need_restore" ] || return 0
-    print_start "Mounting filesystems from /etc/fstab"
-}
-
-# # External button or bootloader changed kernel command line
-# check_factory()
-# {
-#     if [ -f /mnt/cfg/infix/.reset ]; then
-# 	return 0;
-#     fi
-
-#     if grep -q 'finit.cond=factory-reset' /proc/cmdline; then
-# 	return 0;
-#     fi
-
-#     # Add to your br2-external to extend factory-reset check
-#     if [ ! -x /usr/libexec/infix/check-factory ]; then
-# 	return 1;
-#     fi
-
-#     /usr/libexec/infix/check-factory
-# }
-
-# factory_reset()
-# {
-#     find /sys/class/leds/ -type l -exec sh -c 'echo 100 > $0/brightness' {} \;
-#     print_start "Resetting to factory defaults."
-#     logger $opt -p user.notice -t "$nm" "Resetting to factory defaults."
-
-#     rm -rf /mnt/cfg/* /mnt/var/*
-#     sync
-
-#     logger $opt -p user.notice -t "$nm" "Factory reset complete."
-#     print_end 0 "Factory reset complete."
-#     print_restore
-# }
-
-subvols="cfg var root home"
-
-internal_rw_provision()
-{
-    print_start "Provisioning persistent storage on internal volume"
-
-    lvm lvcreate --name rw --extents 50%FREE internal || {
-	logmsg "No rw LV available, nor could it be created"
-	print_end 1
-	return 1
-    }
-
-    mkfs.btrfs -L rw /dev/internal/rw || {
-	logmsg "Could not create BTRFS on rw LV"
-	print_end 1
-	return 1
-    }
-
-    mount -t btrfs /dev/internal/rw /mnt/rw || {
-	logmsg "Failed to mount rw"
-	print_end 1
-	return 1
-    }
-
-    for subvol in $subvols; do
-	btrfs subvolume create /mnt/rw/@"$subvol" || {
-	    logmsg "Failed to create @$subvol on rw"
-	    print_end 1
-	    return 1
-	}
-    done
-
-    umount /mnt/rw || {
-	logmsg "Failed to unmount rw"
-	print_end 1
-	return 1
-    }
-
-    print_end 0
-}
-
-internal_rw_activate()
-{
-    lvm vgs internal || {
-	logmsg "No internal volume available"
-	return 1
-    }
-
-    lvm vgchange -ay internal || {
-	logmsg "Unable to bring internal volume online"
-	return 1
-    }
-
-    # The only condition under which we do BTRFS provisioning is when
-    # the LV is absent. In all other failure scenarios: fall back to
-    # tmpfs and let the user sort it out. This way we do not risk any
-    # loss of data.
-    [ -b /dev/internal/rw ] && return 0
-
-    internal_rw_provision
-}
-
-internal_rw_mount()
-{
-    internal_rw_activate || return 1
-
-    for subvol in $subvols; do
-	mount -t btrfs /dev/internal/rw /"$subvol" -o subvol=@"$subvol" || {
-	    logmsg "Failed to mount /$subvol"
-	    return 1
-	}
-    done
-}
-
-tmpfs_rw_mount()
-{
-    for subvol in $subvols; do
-	mkdir -p -m 0755 /mnt/tmp/"$subvol"
-	mount /mnt/tmp/"$subvol" /"$subvol" -o bind || {
-	    logmsg "Failed to mount temporary /$subvol"
-	    return 1
-	}
-    done
-}
-
-tmpfs_etc_mount()
-{
-    mkdir -p -m 0755 /mnt/tmp/etc/
-    tar c -C /etc . | tar x -C /mnt/tmp/etc
-    mount /mnt/tmp/etc /etc -o bind
-}
-
-exec >/mnt/tmp/mnt.log 2>&1
-
-tmpfs_etc_mount || {
-    code=1
-    logmsg "Failed to make /etc writable"
-}
-
-if ! internal_rw_mount; then
-    code=1
-    print_end 1 "Mounting persistent storage from internal volume"
-    logmsg "Internal volume not found, falling back to tmpfs"
-
-    print_start "Falling back to ephemeral tmpfs storage!"
-    tmpfs_rw_mount
-    print_end $?
-fi
-
-print_restore
-exit $code

board/common/image/image-itb-gns3a/generate.sh

@@ -12,7 +12,7 @@ cat <<EOF >"${gns3a}"
     "category": "router",
     "description": "${ARTIFACT} development appliance",
     "vendor_name": "Kernelkit",
-    "vendor_url": "https://kernelkit.org",
+    "vendor_url": "https://www.kernelkit.org",
     "product_name": "${ARTIFACT} devel",
     "registry_version": 6,
     "status": "experimental",

board/common/image/image-lvm-stub/Config.in

@@ -1,8 +0,0 @@
-config IMAGE_LVM_STUB
-	bool "LVM2 stub image"
-	default y if IMAGE_DDI
-	help
-	  An empty LVM2 physical volume attached to the internal
-	  volume group. This is useful as a base image for persistent
-	  storage in QEMU emulation scenarios where the OS is supplied
-	  in a separate image.

board/common/image/image-lvm-stub/generate.sh

@@ -1,34 +0,0 @@
-#!/bin/sh
-
-set -e
-
-
-mkdir -p "${WORKDIR}"/root
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp
-
-"${BR2_EXTERNAL_INFIX_PATH}"/utils/lvm-mkinternal >"${WORKDIR}"/stub.lvm
-
-cat <<EOF >"${WORKDIR}"/genimage.cfg
-image lvm-stub.disk {
-	hdimage {
-		partition-table-type = "gpt"
-	}
-
-	partition internal {
-		growfs = "true"
-		image = "stub.lvm"
-		partition-type-uuid = "lvm"
-	}
-}
-
-# Silence genimage warnings
-config {}
-EOF
-
-genimage \
-    --tmppath    "${WORKDIR}"/tmp  \
-    --rootpath   "${WORKDIR}"/root \
-    --inputpath  "${WORKDIR}"      \
-    --outputpath "${BINARIES_DIR}" \
-    --config "${WORKDIR}"/genimage.cfg

board/common/image/image-lvm-stub/image-lvm-stub.mk

@@ -1,7 +0,0 @@
-################################################################################
-#
-# image-lvm-stub
-#
-################################################################################
-
-$(eval $(ix-image))

board/common/image/image-readme/README.md

@@ -50,7 +50,7 @@ The default credentials for the demo builds is
     Password: 
     .-------.
     |  . .  | Infix OS — Immutable.Friendly.Secure
-    |-. v .-| https://kernelkit.org
+    |-. v .-| https://www.kernelkit.org
     '-'---'-'
 
     Run the command 'cli' for interactive OAM

board/common/image/ix-image.mk

@@ -10,7 +10,6 @@ $(1): $$($(2)_DEPENDENCIES)
 	PKGDIR=$$($(2)_DIR) \
 	WORKDIR=$$(BUILD_DIR)/$(1) \
 	BINARIES_DIR=$$(BINARIES_DIR) \
-	BR2_ARCH=$$(BR2_ARCH) \
 	BR2_EXTERNAL_INFIX_PATH=$$(BR2_EXTERNAL_INFIX_PATH) \
 	ARTIFACT=$$(INFIX_ARTIFACT) \
 	COMPATIBLE=$$(INFIX_COMPATIBLE) \
@@ -20,7 +19,6 @@ $(1): $$($(2)_DEPENDENCIES)
 
 ifeq ($$($(2)),y)
 TARGETS_ROOTFS += $(1)
-BR2_ROOTFS_OVERLAY := "$$(realpath $$(pkgdir)/rootfs) $$(call qstrip,$$(BR2_ROOTFS_OVERLAY))"
 endif
 
 endef

board/common/initramfs/01infix-lib64/module-setup.sh

@@ -1,15 +0,0 @@
-#!/bin/bash
-
-check() {
-    return 0
-}
-
-depends() {
-    return 0
-}
-
-install() {
-    # Not sure if this should be handled by buildroot's merged-usr
-    # module. Fix it here for now.
-    ln -s "lib" "${initdir?}/lib64"
-}

board/common/initramfs/10infix-init/init

@@ -1,279 +0,0 @@
-#!/bin/sh
-
-echo -ne "\e[31m●\e[0m \e[33m●\e[0m \e[32m●\e[0m  Infix Initramfs — " >/dev/console
-source /etc/os-release >/dev/console
-echo "$VERSION"
-
-set -e
-
-getkopt()
-{
-    grep -q -E "(^| )$1( |$)" /proc/cmdline
-}
-
-getkparam()
-{
-    sed -n "s/.*\<$1=\([^ ]*\).*/\1/p" /proc/cmdline
-}
-
-debug_shell()
-{
-    [ "$(getkparam rd.shell)" = "$1" ] || return 0
-
-    exec </dev/console &>/dev/console
-    echo "Starting debug shell at $1"
-    exec sh -i
-}
-
-die()
-{
-    step="${*:-$step}"
-
-    echo -e "\r\e[0K[\e[31mFAIL\e[0m] $step" >/dev/console
-    echo "<0>ix-initramfs: ERROR: $step" >/dev/kmsg
-    debug_shell error
-    exit 1
-}
-
-warn()
-{
-    step="${*:-$step}"
-
-    echo -e "\r\e[0K[\e[33mWARN\e[0m] $step" >/dev/console
-    echo "<5>ix-initramfs: WARNING: $step" >/dev/kmsg
-    debug_shell warning
-}
-
-ok()
-{
-    step="${*:-$step}"
-
-    echo -e "\r\e[0K[\e[32m OK \e[0m] $step" >/dev/console
-    echo "<5>ix-initramfs: $step" >/dev/kmsg
-}
-
-begin()
-{
-    step="$*"
-    echo -ne "[\e[33m ⋯  \e[0m] $step" >/dev/console
-}
-
-debug()
-{
-    echo "<7>ix-initramfs: $*" >/dev/kmsg
-}
-
-mountcore()
-{
-    mount -t proc     proc /proc
-    mount -t sysfs    sys  /sys
-    mount -t devtmpfs dev  /dev
-}
-
-mountroot()
-{
-    mkdir /newroot
-    mount "$1" /newroot || \
-	die "Unable to mount rootfs on $1"
-
-    ok "Mounting root filesystem on $(basename $1)"
-}
-
-switchroot()
-{
-    local innerinit=$(getkparam init)
-
-    ok "Switching to root filesystem"
-    exec switch_root /newroot ${innerinit:-/sbin/init}
-}
-
-internal_get_part()
-{
-    local _i _pv
-
-    for _i in $(seq 50); do
-	_pv=$(lvm pvs --reportformat json \
-		  | jq -r '.report[].pv[] | select(.vg_name == "internal") | .pv_name')
-	if [ "$_pv" ]; then
-	    [ $_i -gt 5 ] && ok
-	    echo "$_pv"
-	    return 0
-	fi
-
-	[ $_i -eq 5 ] && begin "Waiting for the internal volume to come online"
-	sleep .2
-    done
-
-    warn "Proceeding without the internal volume"
-    return 0
-}
-
-internal_inflate()
-{
-    local _dev _growfs _index _part
-
-    getkopt rd.nointernal && return 0
-
-    GPT_PART_GROWFS_BIT=59
-
-    _part=$(internal_get_part)
-    [ "$_part" ] || return 0
-
-    _index=$(cat /sys/class/block/$(basename "$_part")/partition)
-    [ "$_index" ] || return 1
-
-    _dev=/dev/$(basename $(realpath /sys/class/block/$(basename "$_part")/../))
-    [ -b "$_dev" ] || return 1
-
-    sgdisk "$_dev" -A "$_index":get:$GPT_PART_GROWFS_BIT \
-	| grep -q "$_index:$GPT_PART_GROWFS_BIT:1" \
-	|| return 0
-
-    begin "Inflating internal VG in $_part"
-
-    # First, expand the GPT to cover the entire disk and expand the
-    # LVM partition as much as possible.
-    if ! sgdisk "$_dev" \
-	      --disk-guid=random \
-	      --set-alignment=1 \
-	      --move-second-header \
-	      --delete="$_index" \
-	      --largest-new="$_index" --typecode="$_index":8e00 \
-	      >/tmp/internal-inflate.log 2>&1; then
-	warn "Failed to inflate GPT on $_dev"
-	return 0
-    fi
-
-    if ! lvm pvresize "$_part" >>/tmp/internal-inflate.log 2>&1; then
-	warn "Failed to resize PV $_part"
-	return 0
-    fi
-
-    ok "Inflated internal VG in $_part"
-}
-
-addparts()
-{
-    local _disk="$1"
-    local _partscan="/sys/class/block/"$(basename "$_disk")/partscan
-
-    [ -f "$_partscan" ] && [ $(cat "$_partscan") -eq 1 ] && return
-
-    kpartx -a "$_disk" 2>/dev/null || die "addparts: Unable to add partitions from $_disk"
-}
-
-gptuuid_probe()
-{
-    local _uuid=$(echo "$1" | sed -e 's/^GPTUUID=//' | tr ABCDEF abcdef)
-    local _cand _disk _initrd
-
-    [ -f /initrd.image ] && _initrd=/initrd.image
-
-    for _disk in $_initrd $(find /dev/ -type b); do
-	_cand=$(ddi "$_disk" inspect uuid | tr ABCDEF abcdef)
-	[ $? -eq 0 ] || continue
-
-	if [ "$_cand" = "$_uuid" ]; then
-	    ok "Located $_uuid in $_disk"
-	    echo "$_disk"
-	    return
-	fi
-    done
-
-    die "gptuuid_probe: Unable to find disk $_uuid"
-}
-
-ddi_probe()
-{
-    local _disk="$1"
-    local _dm="$(basename $_disk).root"
-    local _hash=$(getkparam rd.ddi.roothash)
-    local _v _trust
-
-    if [ -n "$_hash" ]; then
-	ok "Trusting pre-authenticated root hash"
-	_v="-V $_hash"
-    else
-	_v="-v"
-    fi
-
-    _trust=$(ddi "$_disk" part root open $_v "$_dm" 2>&1 \
-		 || die "ddi_probe: veritysetup of $_disk failed")
-
-    ok "$_trust"
-    ok "Opened verity protected root from $(basename $_disk)"
-    echo /dev/mapper/"$_dm"
-}
-
-lvm_probe()
-{
-    local _vg=$(dirname "$1") _lv=$(basename "$1")
-
-    lvm vgchange -ay "$_vg" &>/dev/null || \
-	die "lvm_probe: Failed to activate the $_vg VG"
-
-    [ -b /dev/"$1" ] || die "lvm_probe: Unable to locate the $_lv LV in $_vg"
-
-    echo /dev/"$1"
-}
-
-lo_probe()
-{
-    local _lo=$(losetup -f || die "probe_lo: found no free loop device for $1")
-    losetup -P "$_lo" "$1" || die "probe_lo: losetup of $1 to $_lo failed"
-
-    debug "lo_probe: setup $_lo backed by $1"
-    echo "$_lo"
-}
-
-probe()
-{
-    local _real _kind
-
-    case "$1" in
-	/*)
-	    _real=$(realpath "$1")
-	    _kind=$(stat -c %F "$_real" 2>/dev/null || true)
-	    case "$_kind" in
-		"block special file")
-		    addparts "$_real"
-		    echo "$_real"
-		    ;;
-		"regular file")
-		    lo_probe "$_real"
-		    ;;
-		"")
-		    die "Unknown root \"$1\""
-		    ;;
-		*)
-		    die "Unsupported root \"$1\": $_kind"
-		    ;;
-	    esac
-	    ;;
-	lvm)
-	    shift
-	    probe $(lvm_probe "$@")
-	    ;;
-	ddi)
-	    shift
-	    ddi_probe $(probe "$@")
-	    ;;
-	GPTUUID=*)
-	    gptuuid_probe "$@"
-	    ;;
-    esac
-}
-
-mountcore
-
-debug_shell internal
-internal_inflate
-
-debug_shell probe
-rootdev=$(probe $(getkparam root | sed -e 's/:/ /g'))
-
-debug_shell mount
-mountroot "$rootdev"
-
-debug_shell switchroot
-switchroot

board/common/initramfs/10infix-init/module-setup.sh

@@ -1,21 +0,0 @@
-#!/bin/bash
-
-progs="blkid ddi dmsetup kpartx jq lvm openssl sgdisk veritysetup"
-
-check() {
-    require_binaries $progs || return 1
-
-    return 0
-}
-
-depends() {
-    return 0
-}
-
-install() {
-    inst_multiple $progs
-    inst '/etc/os-release'
-    inst '/etc/rauc/keys/*'
-
-    cp "$moddir/init" "${initdir?}/init"
-}

board/common/qemu/Config.in.in

@@ -149,7 +149,7 @@ config QEMU_HOST
 
 config QEMU_APPEND
 	string "Extra kernel options"
-	depends on QEMU_LOADER_KERNEL
+	depends on !QEMU_ROOTFS_MMC
 
 config QEMU_EXTRA
 	string "Extra QEMU options"

board/common/qemu/ddi/Config.in.in

@@ -1,279 +0,0 @@
-mainmenu "QEMU @ARCH@ Virtualization"
-
-config QEMU_@ARCH@
-	bool
-	default y
-
-config QEMU_ARCH
-	string
-	default "@ARCH@"
-
-config QEMU_VIRTIO_BUS
-	string
-	default "device"  if QEMU_arm
-	default "pci"
-
-config QEMU_BIN_DDI
-	string
-	default "@IMAGE@"
-
-config QEMU_BIN_DISK
-	string
-	default "@DISK@"
-
-config QEMU_BIN_ESP
-	string
-	default "@ESP@"
-
-config QEMU_BIN_KERNEL
-	string
-	depends on QEMU_LOADER_QEMU
-	default "../zImage"  if QEMU_arm
-	default "../Image"   if QEMU_aarch64
-	default "../bzImage" if QEMU_x86_64
-
-config QEMU_BIN_LVM_STUB
-	string
-	default "../lvm-stub.disk"
-
-
-choice
-	prompt "Loader"
-	default QEMU_LOADER_QEMU
-
-config QEMU_LOADER_QEMU
-	bool "QEMU"
-
-config QEMU_LOADER_OVMF
-	bool "OVMF (UEFI)"
-
-endchoice
-
-config QEMU_BIN_BIOS
-	string
-	depends on !QEMU_LOADER_KERNEL
-	default "OVMF.fd" if QEMU_LOADER_OVMF
-
-menu "Machine"
-
-config QEMU_MACHINE
-	string "Machine"
-	default "pc" if QEMU_x86_64
-	default "virt"
-
-config QEMU_CPU
-	string "CPU"
-	default "host" if QEMU_x86_64
-	default "cortex-a53" if QEMU_aarch64
-	default "max"
-
-config QEMU_RAM
-	string "RAM size (k/M/G)"
-	default "384M"
-
-choice
-     prompt "Console"
-     default QEMU_CONSOLE_VIRTIO
-
-config QEMU_CONSOLE_VIRTIO
-     bool "Virtio (hvc0)"
-
-config QEMU_CONSOLE_SERIAL
-     bool "Serial (ttyS0/ttyAMA0)"
-
-endchoice
-
-config QEMU_CONSOLE
-     string
-     default "hvc0" if QEMU_CONSOLE_VIRTIO
-     default "ttyAMA0" if QEMU_arm
-     default "ttyAMA0" if QEMU_aarch64
-     default "ttyS0"
-
-endmenu
-
-menu "Disks & Filesystems"
-
-config QEMU_DISK_INITRD
-     bool "Use the DDI as initrd"
-     depends on QEMU_LOADER_QEMU
-     help
-       Pass, and boot from, the DDI as the initial RAM disk.
-
-       This is useful to test netbooting scenarios, e.g., in
-       combination with an empty system disk to simulate an initial
-       deployment.
-
-comment "System disk"
-
-choice
-     prompt "Interface"
-     default QEMU_DISK_SYS_IF_VIRTIO
-
-config QEMU_DISK_SYS_IF_VIRTIO
-     bool "virtio"
-     help
-       Attach system disks using virtio block devices.
-
-endchoice
-
-choice
-     prompt "Contents"
-     default QEMU_DISK_SYS_SPLIT
-
-config QEMU_DISK_SYS_EMPTY
-     bool "Empty disk"
-     help
-       Attach an empty disk.
-
-       This is useful for testing things like installing Infix from a
-       USB mass storage device (see "USB Mass Storage" below).
-
-config QEMU_DISK_SYS_FULL
-     bool "Full system disk"
-     help
-       Use the full system disk containing:
-       - EFI partition (and backup) with Barebox
-       - LVM PV with Infix installed
-
-       This is useful when testing system upgrades, fallback
-       mechanisms related to corrupt disks etc.
-
-       WARNING: Usage of this option is fraught with peril as
-       incremental builds of Infix are likely to cause corruption in
-       the QCoW2 layer. If you do not understand the meaning of this
-       you most likely to NOT want to make use of this feature.
-
-config QEMU_DISK_SYS_NONE
-     bool "None"
-     help
-       Do not attach any system disk.
-
-       This is useful for testing how Infix behaves when no persistent
-       storage is available - a common scenario during bringup of a
-       new board.
-
-config QEMU_DISK_SYS_SPLIT
-     bool "Split ESP/DDI/LVM"
-     help
-       Attach the EFI System partition, containing Barebox; the raw
-       DDI image; and an (initially empty) LVM stub for persistent
-       storage - each as a separate disk.
-
-       This is the simplest way of testing out incremental builds of
-       Infix. Since the DDI is attached as a raw read-only disk, there
-       is no risk of CoW corruption like with a full system disk.
-
-       NOTE: In this setup, the size below refers to the size of the
-       LVM stub.
-
-endchoice
-
-config QEMU_DISK_SYS_SIZE
-	string "Size (k/M/G)"
-	default "8G"
-
-comment "USB mass storage"
-
-choice
-     prompt "Contents"
-     default QEMU_DISK_USB_NONE
-
-config QEMU_DISK_USB_DISK
-     bool "Full system disk"
-     help
-       Attach the full system disk containing:
-       - EFI partition (and backup) with Barebox
-       - LVM PV with Infix installed
-
-config QEMU_DISK_USB_NONE
-     bool "None"
-     help
-       Do not attach any disk over USB.
-
-endchoice
-
-config QEMU_DISK_USB_SIZE
-	string "Size (k/M/G)"
-	depends on !QEMU_DISK_USB_NONE
-	default "4G"
-
-comment "Host filesystem passthrough (9P)"
-
-config QEMU_DISK_HOST
-	string "Path"
-	default "/tmp"
-
-endmenu
-
-menu "Networking"
-
-choice
-     prompt "Mode"
-     default QEMU_NET_USER
-
-config QEMU_NET_BRIDGE
-     bool "Bridged"
-
-config QEMU_NET_NONE
-     bool "None"
-
-config QEMU_NET_ROCKER
-     bool "Rocker"
-
-config QEMU_NET_TAP
-     bool "TAP"
-
-config QEMU_NET_USER
-     bool "User"
-
-endchoice
-
-config QEMU_NET_MODE
-	string
-	default "bridge" if QEMU_NET_BRIDGE
-	default "none"   if QEMU_NET_NONE
-	default "rocker" if QEMU_NET_ROCKER
-	default "tap"    if QEMU_NET_TAP
-	default "user"   if QEMU_NET_USER
-
-config QEMU_NET_MODEL
-	string "Interface model"
-	default "virtio-net-device" if QEMU_arm
-	default "virtio-net-pci"
-	help
-	  The default virtio NIC works for most use-cases, but if you
-	  want to play with low-level stuff like ethtool, you might
-	  want to test the Intel 82545EM driver, e1000.
-
-	  Note: ARM 32-bit uses virtio-net-device (MMIO) by default.
-
-config QEMU_NET_BRIDGE_DEV
-	string "Bridge device"
-	depends on QEMU_NET_BRIDGE
-	default "virbr0"
-
-config QEMU_NET_USER_OPTS
-	string "User mode options"
-	depends on QEMU_NET_USER
-	help
-	  Extra -nic user,<OPTIONS>
-
-config QEMU_NET_TAP_N
-	int "Number of TAPs"
-	depends on QEMU_NET_TAP
-	default 1
-
-config QEMU_NET_PORTS
-	int "Number of Rocker switch ports"
-	depends on QEMU_NET_ROCKER
-	default 10
-
-endmenu
-
-config QEMU_EXTRA
-	string "Extra QEMU options"
-
-config QEMU_APPEND
-	string "Extra kernel options"
-	depends on QEMU_LOADER_QEMU

board/common/qemu/ddi/run.sh

@@ -1,480 +0,0 @@
-#!/bin/sh
-# This script can be used to start an Infix OS image in Qemu.  It reads
-# either a .config, generated from Config.in, or qemu.cfg from a release
-# tarball, for the required configuration data.
-#
-# Debian/Ubuntu users can change the configuration post-release, install
-# the kconfig-frontends package:
-#
-#    sudo apt install kconfig-frontends
-#
-# and then call this script with:
-#
-#    ./run.sh -c
-#
-# To bring up a menuconfig dialog.  Select `Exit` and save the changes.
-# For more help, see:_
-#
-#    ./run.sh -h
-#
-# shellcheck disable=SC3037
-
-# Add /sbin to PATH for mkfs.ext4 and such (not default in debian)
-export PATH="/sbin:/usr/sbin:$PATH"
-
-qdir=$(dirname "$(readlink -f "$0")")
-imgdir=$(readlink -f "${qdir}/..")
-prognm=$(basename "$0")
-
-usage()
-{
-    cat <<EOF
-usage: $prognm [OPTIONS] [-- KERNEL-ARGS]
-
-Start Infix in a VM.
-
-Any arguments after -- are passed to the kernel, provided that QEMU's
-native loader is being used (i.e., not UEFI, for example).  This
-includes a second --, which the kernel uses to delimit between kernel
-arguments and those passed to the init process.
-
-Options:
-  -0
-    Clear any copy-on-write layers, resetting all disks to their
-    initial states, and exit.
-
-  -c
-    Run menuconfig to change Qemu settings.  This requires the
-    'kconfig-frontends' package (Debian/Ubuntu).
-
-  -G
-    Skip config generation. This is useful if you are testing out new
-    QEMU features by manually modifying qemu.cfg.
-
-  -h
-    Show this help message
-
-Example:
-
-  $prognm -- loglevel=4 -- finit.debug
-
-  Will set the kernel's loglevel to 4, and pass finit.debug as an
-  argument to PID 1.
-
-EOF
-}
-
-die()
-{
-    echo "$prognm: $*" >&2
-    exit 1
-}
-
-binpath()
-{
-    case "$1" in
-	./*|../*)
-	    # Relative paths are relative to the location of .config
-	    printf "$qdir/$1"
-	    ;;
-	*)
-	    printf "$1"
-	    ;;
-    esac
-}
-
-q()
-{
-    local _cmd="$1"
-    shift
-
-    case "$_cmd" in
-	sect)
-	    printf ' \\\n\t' >>"$qdir"/qemu.sh
-
-	    case $# in
-		1)
-		    printf -- "-$1" >>"$qdir"/qemu.sh
-		    _delim=" "
-		    ;;
-		2)
-		    printf -- "-$1 $2" >>"$qdir"/qemu.sh
-		    _delim=","
-		    ;;
-		*)
-		    die "q sect: Invalid arguments"
-		    ;;
-	    esac
-	    ;;
-	param)
-	    [ $# -eq 2 ] || die "q param: Takes exactly two arguments"
-	    printf -- "$_delim$1=$2" >>"$qdir"/qemu.sh
-	    _delim=","
-	    ;;
-	option)
-	    [ $# -eq 1 ] || die "q option: Takes exactly one argument"
-	    printf -- "$_delim$1" >>"$qdir"/qemu.sh
-	    _delim=","
-	    ;;
-	*)
-	    die "q: Unknown command: $_cmd"
-	    ;;
-    esac
-}
-
-q_sect_device_virtio()
-{
-    q sect device virtio-$1-$QEMU_VIRTIO_BUS
-}
-
-q_add_disk()
-{
-    if [ "$QEMU_DISK_SYS_IF_VIRTIO" ]; then
-    	q_sect_device_virtio blk
-	q param drive "$1"
-    else
-	die "Unknown system disk interface"
-    fi
-}
-
-q_sect_device_usb()
-{
-    if [ -z "$usb_bus_added" ]; then
-	q sect usb
-	q sect device usb-ehci
-	q param id ehci
-	usb_bus_added=YES
-    fi
-
-    q sect device "$1"
-    q param bus ehci.0
-}
-
-qcowed()
-{
-    local _qcow="$qdir"/"$1".qcow2
-    local _base _size
-
-    if [ -f "$_qcow" ] && qemu-img check -q "$_qcow"; then
-	echo "$_qcow"
-	return
-    fi
-
-    rm -f "$_qcow"
-
-    case $# in
-	2)
-	    _size="$2"
-
-	    qemu-img create -q -f qcow2 "$_qcow" "$_size" \
-		|| die "Unable to create $1"
-	    ;;
-	3)
-
-	    _base="$2"
-	    _size="$3"
-
-	    [ "$_size" = "auto" ] && _size=
-
-	    qemu-img create -q -f qcow2 -F raw \
-		     -o backing_file="$_base" "$_qcow" $_size \
-		|| die "Unable to create CoW layer for $_base"
-	    ;;
-	*)
-	    die "qcowed: usage: qcowed <name> [<backing-file>] <size>"
-	    ;;
-    esac
-
-    echo "$_qcow"
-}
-
-append()
-{
-    echo -n " $*" >>"$qdir"/append
-}
-
-gen_machine()
-{
-    q sect machine
-    q param type  "$QEMU_MACHINE"
-    q param accel kvm:tcg
-
-    q sect cpu "$QEMU_CPU"
-
-    q sect m
-    q param size "$QEMU_RAM"
-}
-
-gen_loader()
-{
-    if [ "$QEMU_LOADER_QEMU" ]; then
-	q sect kernel $(binpath "$QEMU_BIN_KERNEL")
-    elif [ "$QEMU_LOADER_OVMF" ]; then
-	q sect bios $(binpath "$QEMU_BIN_BIOS")
-    fi
-}
-
-gen_serial()
-{
-    q sect display none
-
-    q_sect_device_virtio serial
-
-    q sect chardev stdio
-    q param id  console0
-    q param mux on
-
-    q sect mon
-    q param chardev console0
-
-    case "$QEMU_CONSOLE" in
-	hvc0)
-	    q sect device virtconsole
-	    q param nr      0
-	    q param name    console
-	    q param chardev console0
-	    ;;
-	ttyS0|ttyAMA0)
-	    q sect serial chardev:console0
-	    ;;
-	*)
-	    die "Unsupported console: $QEMU_CONSOLE"
-	    ;;
-    esac
-
-    append console="$QEMU_CONSOLE"
-
-    [ "$V" ] && append debug || append loglevel=4
-}
-
-gpt_uuid()
-{
-    sgdisk "$1" -p | awk '
-    	BEGIN { err = 1; } END { exit(err); }
-	/^Creating new GPT/ { exit; }
-
-	/^Disk identifier \(GUID\): / {
-	    print($4); err = 0; exit;
-	}' || die "Unable to determine GPT UUID of $1"
-}
-
-gen_disk_sys_empty()
-{
-    q sect drive
-    q param id        disk-sys
-    q param format    qcow2
-    q param if        none
-    q param file      $(qcowed disk-sys "$QEMU_DISK_SYS_SIZE")
-
-    q_add_disk disk-sys
-}
-
-gen_disk_sys_full()
-{
-    q sect drive
-    q param id        disk-sys
-    q param format    qcow2
-    q param if        none
-    q param file      $(qcowed disk-sys $(binpath "$QEMU_BIN_DISK") \
-			       "$QEMU_DISK_SYS_SIZE")
-
-    q_add_disk disk-sys
-
-    append root=ddi:lvm:internal/$(basename "$QEMU_BIN_DDI")
-}
-
-gen_disk_sys_split()
-{
-    # EFI System Partition
-    q sect drive
-    q param id        disk-esp
-    q param format    qcow2
-    q param if        none
-    q param file      $(qcowed disk-esp $(binpath "$QEMU_BIN_ESP") auto)
-
-    q_add_disk disk-esp
-
-    # LVM stub
-    q sect drive
-    q param id        disk-sys
-    q param format    qcow2
-    q param if        none
-    q param file      $(qcowed disk-sys $(binpath "$QEMU_BIN_LVM_STUB") \
-			       "$QEMU_DISK_SYS_SIZE")
-
-    q_add_disk disk-sys
-
-    # DDI (ro)
-    q sect drive
-    q param id        disk-ddi
-    q param format    raw
-    q param file      $(binpath "$QEMU_BIN_DDI")
-    q param if        none
-    q param read-only on
-
-    q_add_disk disk-ddi
-
-    append root=ddi:GPTUUID=$(gpt_uuid $(binpath "$QEMU_BIN_DDI"))
-}
-
-gen_disk_sys()
-{
-    [ "$QEMU_DISK_SYS_NONE" ] && return
-
-    if [ "$QEMU_DISK_SYS_EMPTY" ]; then
-	gen_disk_sys_empty
-    elif [ "$QEMU_DISK_SYS_FULL" ]; then
-	gen_disk_sys_full
-    elif [ "$QEMU_DISK_SYS_SPLIT" ]; then
-	gen_disk_sys_split
-    else
-	die "Unknown system disk mode"
-    fi
-}
-
-gen_disk_usb()
-{
-    [ "$QEMU_DISK_USB_NONE" ] && return
-
-    if [ "$QEMU_DISK_USB_DISK" ]; then
-	q sect drive
-	q param id        disk-usb
-	q param format    qcow2
-	q param file      $(qcowed disk-usb \
-				$(binpath "$QEMU_BIN_DISK") \
-				"$QEMU_DISK_USB_SIZE")
-	q param if        none
-
-	q_sect_device_usb usb-storage
-	q param drive disk-usb
-    else
-	die "Unknown USB attachment"
-    fi
-}
-
-gen_disk_initrd()
-{
-    [ "$QEMU_DISK_INITRD" ] || return
-
-    q sect initrd $(binpath "$QEMU_BIN_DDI")
-    append root=ddi:/initrd.image
-}
-
-internal_is_available()
-{
-    [ "$QEMU_DISK_SYS_FULL" ] || [ "$QEMU_DISK_SYS_SPLIT" ] \
-	|| [ "$QEMU_DISK_USB_DISK" ]
-}
-
-gen_disks()
-{
-    gen_disk_sys
-    gen_disk_usb
-
-    gen_disk_initrd
-
-    internal_is_available || append rd.nointernal
-}
-
-gen_gdb()
-{
-    # Create a UNIX socket on the host that is connected to a virtio
-    # console in the guest, which gdbserver can attach to for
-    # userspace debugging.
-    q sect chardev socket
-    q param id     gdbserver
-    q param path   "$qdir"/gdbserver.sock
-    q param server on
-    q param wait   off
-
-    q sect device virtconsole
-    q param nr      1
-    q param name    gdbserver
-    q param chardev gdbserver
-
-    # Create a UNIX socket on the host that is connected to QEMU's GDB
-    # stub, for bootloader/kernel debugging.
-    q sect chardev socket
-    q param id gdbqemu
-    q param path   "$qdir"/gdbqemu.sock
-    q param server on
-    q param wait   off
-
-    q sect gdb chardev:gdbqemu
-}
-
-gen_all()
-{
-    local _append
-
-    : >"$qdir"/append
-    cat <<EOF >"$qdir"/qemu.sh
-#!/bin/sh
-
-echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
-
-line=\$(stty -g)
-stty raw
-trap 'stty "\$line"' EXIT INT TERM
-
-qemu-system-$QEMU_ARCH -nodefaults \\
-EOF
-    chmod +x "$qdir"/qemu.sh
-
-    gen_machine
-    gen_loader
-    gen_serial
-    gen_disks
-    gen_gdb
-
-    if [ "$QEMU_LOADER_QEMU" ]; then
-	_append=$(cat "$qdir"/append)
-	q sect append "\"$_append $QEMU_APPEND $*\""
-    fi
-
-    echo >>"$qdir"/qemu.sh
-}
-
-menuconfig()
-{
-    command -v kconfig-mconf >/dev/null \
-	|| die "cannot find kconfig-mconf for menuconfig"
-
-    CONFIG_= KCONFIG_CONFIG="$qdir"/.config \
-	   kconfig-mconf "$qdir"/Config.in
-}
-
-_generate=YES
-
-while getopts "0cGh-" opt; do
-    case ${opt} in
-	0)
-	    echo "Clearing all copy-on-write layers" >&2
-	    rm -f "$qdir"/*.qcow2
-	    exit 0
-	    ;;
-	c)
-	    menuconfig
-	    ;;
-	G)
-	    _generate=
-	    ;;
-	h)
-	    usage && exit 0
-	    ;;
-	-)
-	    break
-	    ;;
-	*)
-	    usage && exit 1
-	    ;;
-    esac
-done
-shift $((OPTIND - 1))
-
-# shellcheck disable=SC1090
-. "$qdir"/.config
-
-[ "$_generate" ] && gen_all "$*"
-
-exec "$qdir"/qemu.sh

board/common/qemu/qemu.mk

@@ -4,15 +4,9 @@
 #
 ################################################################################
 
-qemu-scripts-dir := $(pkgdir)/$(if $(IMAGE_DDI),ddi,itb)
-qemu-image := ../$(INFIX_ARTIFACT).$(if $(IMAGE_DDI),raw,qcow2)
-qemu-disk := $(if $(IMAGE_DDI_DISK),../$(INFIX_ARTIFACT).disk)
-qemu-esp := $(if $(IMAGE_BAREBOX_ESP),../barebox-esp.vfat)
-
-qemu-kconfig-prefix := $(if $(IMAGE_DDI),,CONFIG_)
-
+QEMU_SCRIPTS_DIR := $(pkgdir)
 qemu-kconfig = \
-	CONFIG_="$(qemu-kconfig-prefix)" \
+	CONFIG_="CONFIG_" \
 	BR2_CONFIG="$(BINARIES_DIR)/qemu/.config" \
 	$(BUILD_DIR)/buildroot-config/$(1) $(2) "$(BINARIES_DIR)/qemu/Config.in"
 
@@ -31,19 +25,17 @@ qemu-scripts: \
 		$(BINARIES_DIR)/qemu/Config.in \
 		$(BINARIES_DIR)/qemu/.config
 
-$(BINARIES_DIR)/qemu/run.sh: $(qemu-scripts-dir)/run.sh
+$(BINARIES_DIR)/qemu/run.sh: $(QEMU_SCRIPTS_DIR)/run.sh
 	@$(call IXMSG,"Installing QEMU scripts")
 	@mkdir -p $(dir $@)
 	@cp $< $@
 
-$(BINARIES_DIR)/qemu/Config.in: $(qemu-scripts-dir)/Config.in.in
+$(BINARIES_DIR)/qemu/Config.in: $(QEMU_SCRIPTS_DIR)/Config.in.in
 	@mkdir -p $(dir $@)
 	@sed \
-		-e "s:@ARCH@:$(BR2_ARCH):g" \
-		-e "s:@IMAGE@:$(qemu-image):g" \
-		-e "s:@DISK@:$(qemu-disk):g" \
-		-e "s:@ESP@:$(qemu-esp):g" \
-	<$< >$@
+		-e "s:@ARCH@:QEMU_$(BR2_ARCH):" \
+		-e "s:@DISK_IMG@:../$(INFIX_ARTIFACT).qcow2:" \
+	< $< >$@
 
 $(BINARIES_DIR)/qemu/.config: $(BINARIES_DIR)/qemu/Config.in
 	@$(call qemu-kconfig,conf,--olddefconfig)

board/common/rootfs/etc/motd

@@ -1,4 +1,4 @@
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'

board/common/rootfs/usr/bin/ddi

@@ -1,343 +0,0 @@
-#!/bin/sh
-
-set -e
-
-capath=/etc/rauc/keys
-
-usage()
-{
-    local _ddi="$(basename $0)"
-
-    cat <<EOF
-usage: $_ddi [<options>] <image> <command> [<args>]
-
-Discoverable Disk Image manipulation
-
-  Options:
-
-    -A <arch>
-      Override the system architecture.
-
-    -C <path>
-      Source trusted signing keys from the supplied directory.
-      Default: $capath
-
-    -h
-      Show this message and exit.
-
-  Commands:
-
-    inspect <property>
-
-      uuid
-        Print GPT disk identifier
-
-    part <partition> <command> [<args]
-      Where <partition> is one of:
-        root       The first root partition
-
-        open [<options>] <name>
-
-          Create a device mapping for the specified partition, called
-          <name>.
-
-          Options:
-
-          -v
-            Use the associated dm-verity hash tree, whose root hash is
-            available in the associated signature partition.
-
-          -V <root-hash>
-            Use the associated dm-verity hash tree, along with an
-            externally validated root hash.
-
-        verify [<options>]
-
-          Verify that the specified partition exists and, optionally,
-          is accompanied by a trusted dm-verity hash tree.
-
-          Options:
-
-          -v
-            Require the presence of an associated dm-verity hash tree,
-            whose root hash is available in the associated signature
-            partition.
-
-          -V <root-hash>
-            Require the presence of an associated dm-verity hash tree
-            whose root hash matches the provided one.
-
-  Examples:
-
-    Map and mount the verity protected SquashFS root partition from an
-    image:
-      $_ddi infix-x86_64.raw part root open -v infix
-      mount -t squashfs /dev/mapper/infix /opt
-
-EOF
-}
-
-X86_64_CODE_ROOT=0x8304
-X86_64_CODE_ROOT_VERITY=0x830c
-X86_64_CODE_ROOT_VERITY_SIG=0x8370
-
-die()
-{
-    echo "ERROR: $*" >&2
-    exit 1
-}
-
-ok()
-{
-    echo "$*" >&2
-}
-
-setup_arch()
-{
-    case "$1" in
-	x86_64)
-	    CODE_ROOT=$X86_64_CODE_ROOT
-	    CODE_ROOT_VERITY=$X86_64_CODE_ROOT_VERITY
-	    CODE_ROOT_VERITY_SIG=$X86_64_CODE_ROOT_VERITY_SIG
-	    ;;
-	*)
-	    die "Unsupported architecture"
-    esac
-}
-
-setup_work()
-{
-    local _umask
-
-    _umask=$(umask)
-    umask 077
-    workdir=$(mktemp -d)
-    umask $_umask
-
-    trap 'rm -rf "$workdir"' EXIT INT TERM
-}
-
-ddi_to_block()
-{
-    local _kind _lo
-
-    _kind=$(stat -Lc %F "$1")
-    case "$_kind" in
-	"block special file")
-	    echo "$1"
-	    return
-	    ;;
-	"regular file")
-	    _lo=$(losetup -f || die "Found no free loop device for $1")
-	    losetup -P "$_lo" "$1" || die "Failed to setup loop device of $1"
-	    echo "$_lo"
-	    return
-	    ;;
-    esac
-
-    die "$1 is a $_kind, only regular and block devices are supported"
-}
-
-ddi_get_part_info()
-{
-    local _code _item
-
-    case "$2" in
-	root) _code="$CODE_ROOT";;
-	root-verity) _code="$CODE_ROOT_VERITY";;
-	root-verity-sig) _code="$CODE_ROOT_VERITY_SIG";;
-	*) die "Unknown partition type \"$1\"" ;;
-    esac
-    _code=$(printf "%04X" "$_code")
-    _item=${3:-exists}
-
-    sgdisk "$1" -p | awk -v code="$_code" -v item="$_item" '
-    	   /^[ ]*[0-9]+/ {
-	       if ($6 != code)
-	       	  next;
-
-	       if (item == "exists") exit(0);
-	       if (item == "index") { print($1); exit(0); }
-
-	       exit(1);
-	   }
-    '
-}
-
-ddi_get_part_dev()
-{
-    local _dev _index _lvuuid _subsys
-
-    _index=$(ddi_get_part_info "$1" "$2" index \
-		 || die "No $2 partition found on $1")
-
-    _subsys=$(dmsetup info -c --noheadings -o subsystem "$1" 2>/dev/null || true)
-    if [ "$_subsys" = "LVM" ]; then
-	_lvuuid=$(dmsetup info -c --noheadings -o uuid "$1")
-	_dev=/dev/mapper/$(dmsetup info -c --noheadings -o name -u "part${_index}-$_lvuuid")
-    else
-	_dev=$(basename "$1")
-	_dev=$(find /sys/block/"$_dev"/ -mindepth 1 -maxdepth 1 -type d  \
-		    -name "${_dev}$_index" -o -name "${_dev}p$_index")
-	_dev=/dev/$(basename "$_dev")
-    fi
-
-    [ -b "$_dev" ] || die "Failed to locate $2 partition in $1"
-
-    echo "$_dev"
-}
-
-ddi_get_root_hash()
-{
-    local _subj
-
-    command -v openssl >/dev/null || die "Missing dependency: openssl"
-    command -v jq >/dev/null || die "Missing dependency: jq"
-
-    jq -r .rootHash "$1" | tr -d '\n' >"$workdir"/hash \
-	|| die "Invalid signature: rootHash is missing"
-
-    jq -r .signature "$1" | base64 -d >"$workdir"/sig \
-	|| die "Invalid signature: signature data is missing"
-
-    openssl cms -verify -verify_retcode -CApath "$capath" \
-	    -content  "$workdir"/hash \
-	    -in       "$workdir"/sig  -inform DER \
-	    -certsout "$workdir"/certs >/dev/null 2>&1 \
-	|| die "Signature verification failed"
-
-    _subj=$(openssl x509 -noout -subject <"$workdir"/certs | sed -e 's/^subject=//')
-    ok "Trusting root hash signature from $_subj"
-
-    cat "$workdir"/hash
-}
-
-ddipart_get_verity()
-{
-    local _hash
-
-    while getopts "vV:" opt; do
-	case "$opt" in
-	    V)
-		vkind="${kind}-verity"
-		vhash="$OPTARG"
-		;;
-	    v)
-		vkind="${kind}-verity"
-		;;
-	esac
-    done
-
-    [ "$vkind" ] || return
-
-    vpart=$(ddi_get_part_dev "$img" "$vkind")
-
-    [ "$vhash" ] && return
-
-    vskind="${vkind}-sig"
-    vspart=$(ddi_get_part_dev "$img" "$vskind")
-    vhash=$(ddi_get_root_hash "$vspart")
-}
-
-ddipart_open()
-{
-    [ "$vpart" ] || die "$kind partition is already accessible at $part"
-
-    shift $((OPTIND - 1))
-
-    veritysetup open "$part" "$1" "$vpart" "$vhash"
-}
-
-ddipart_verify()
-{
-    [ "$vpart" ] || return
-
-    veritysetup verify "$part" "$vpart" "$vhash"
-    ok "Image in $img has $kind partition with valid dm-verity hash tree"
-}
-
-ddipart()
-{
-    local _cmd
-
-    kind="$1"
-    shift
-
-    ddi_get_part_info "$img" "$kind" \
-	|| die "No $kind partition found on $img"
-
-    _cmd="$1"
-    shift
-
-    case "$_cmd" in
-	open|verify)
-	    img=$(ddi_to_block $img)
-	    part=$(ddi_get_part_dev "$img" "$kind")
-	    ddipart_get_verity "$@"
-
-	    ddipart_$_cmd "$@"
-	    ;;
-	*)
-	    die "Unknown partition command \"$_cmd\""
-	    ;;
-    esac
-}
-
-ddiinspect()
-{
-    case "$1" in
-	uuid)
-	    sgdisk "$img" -p | awk '
-    	    	BEGIN { err = 1; } END { exit(err); }
-		/^Creating new GPT/ { exit; }
-
-		/^Disk identifier \(GUID\): / {
-	       	    print($4); err = 0; exit;
-	   	}'
-	    ;;
-	*)
-	    die "Unknown property: $1"
-	    ;;
-    esac
-}
-
-_arch=$(uname -m)
-
-while getopts "A:C:h" opt; do
-    case ${opt} in
-	A)
-	    _arch="$OPTARG"
-	    ;;
-	C)
-	    capath="$OPTARG"
-	    ;;
-	h)
-	    usage && exit 0
-	    ;;
-    esac
-done
-shift $((OPTIND - 1))
-
-if [ $# -lt 2 ]; then
-    usage && exit 1
-fi
-
-img="$1"
-cmd="$2"
-shift 2
-
-setup_arch "$_arch"
-setup_work
-
-case "$cmd" in
-    inspect)
-	ddiinspect "$@"
-	;;
-    part)
-	ddipart "$@"
-	;;
-    *)
-	echo "Unknown command \"$cmd\"" >2
-	exit 1
-	;;
-esac

board/common/rootfs/usr/sbin/container

@@ -23,7 +23,8 @@ dir=""
 all=""
 env=""
 port=""
-force=
+force=${force:-}
+reset_volumes=
 
 # Variable shared across subshells
 export meta_sha=""
@@ -227,7 +228,7 @@ fetch()
 
     if out=$(eval "$cmd" 2>&1); then
 	log "$file downloaded successfully."
-	if check "$file"; then
+	if [ -n "$force" ] || check "$file"; then
 	    echo "$dst"
 	    return 0
 	fi
@@ -897,6 +898,9 @@ while [ "$1" != "" ]; do
 	    shift
 	    restart=$1
 	    ;;
+	-R | --reset-volumes)
+	    reset_volumes=true
+	    ;;
 	-s | --simple)
 	    simple=true
 	    ;;
@@ -1108,7 +1112,8 @@ case $cmd in
 	# Remove the old image if it's not used by any other containers
 	if [ -n "$old_image_id" ]; then
 	    # Check if the old image is still in use by any containers
-	    if ! podman ps -a --format '{{.ImageID}}' | grep -q "^${old_image_id}$"; then
+	    old_image_id=${old_image_id:0:12}
+	    if ! podman ps -a --format '{{.ImageID}}' | grep -q "^${old_image_id}"; then
 		log "Removing old image $old_image_id"
 		podman rmi "$old_image_id" 2>/dev/null || true
 	    else
@@ -1250,8 +1255,22 @@ case $cmd in
 	container stop "$name"
 	echo "done"
 
+	# If --reset-volumes requested, delete named volumes so they re-initialize from new image
+	if [ -n "$reset_volumes" ]; then
+	    printf ">> Resetting named volumes (all configuration will be lost): "
+	    grep -oE -- '-v [^ ]+' "$script" | awk '{print $2}' | cut -d: -f1 | \
+	    while read -r vol_name; do
+		if podman volume exists "$vol_name" 2>/dev/null; then
+		    printf "%s " "$vol_name"
+		    log "Removing volume $vol_name"
+		    podman volume rm -f "$vol_name" >/dev/null || true
+		fi
+	    done
+	    echo "done"
+	fi
+
 	# Set force flag to ensure fresh pull/fetch of image
-	force="-f"
+	export force="-f"
 
 	# For remote images, force re-pull
 	case "$img" in
@@ -1273,14 +1292,17 @@ case $cmd in
 	# Recreate container by running the script
 	echo ">> Recreating container ..."
 	if ! "$script"; then
+	    force=
 	    echo ">> Failed recreating container $name"
 	    exit 1
 	fi
+	force=
 
 	# Remove the old image if it's not used by any other containers
 	if [ -n "$old_image_id" ]; then
 	    # Check if the old image is still in use by any containers
-	    if ! podman ps -a --format '{{.ImageID}}' | grep -q "^${old_image_id}$"; then
+	    old_image_id=${old_image_id:0:12}
+	    if ! podman ps -a --format '{{.ImageID}}' | grep -q "^${old_image_id}"; then
 		log "Removing old image $old_image_id"
 		podman rmi "$old_image_id" 2>/dev/null || true
 	    else

board/common/rootfs/usr/share/udhcpc/default.script

@@ -7,7 +7,7 @@ ACTION="$1"
 IP_CACHE="/var/lib/misc/${interface}.cache"
 RESOLV_CONF="/run/resolvconf/interfaces/${interface}.conf"
 NTPFILE="/run/chrony/dhcp-sources.d/${interface}.sources"
-NAME="/etc/netd/conf.d/${interface}-dhcp.conf"
+NAME="/etc/net.d/${interface}-dhcp.conf"
 NEXT="${NAME}+"
 
 [ -n "$broadcast" ] && BROADCAST="broadcast $broadcast"
@@ -118,8 +118,6 @@ set_dhcp_routes()
     # Reduce changes needed by comparing with previous route(s)
     cmp -s "$NAME" "$NEXT" && return
     mv "$NEXT" "$NAME"
-
-    initctl reload netd
 }
 
 clr_dhcp_routes()
@@ -127,8 +125,6 @@ clr_dhcp_routes()
     log "deleting DHCP routes"
     [ -f "$NAME" ] || return
     rm "$NAME"
-
-    initctl reload netd
 }
 
 clr_dhcp_addresses()

board/x86_64/rootfs/etc/ddi-partition-types

@@ -1,3 +0,0 @@
-CODE_ROOT=0x8304
-CODE_ROOT_VERITY=0x830c
-CODE_ROOT_VERITY_SIG=0x8370

configs/aarch64_defconfig

@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -41,9 +41,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
@@ -143,10 +140,10 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y

configs/aarch64_minimal_defconfig

@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -41,9 +41,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
@@ -121,12 +118,11 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y

configs/arm_defconfig

@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -43,9 +43,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
@@ -139,10 +136,10 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_MICROCHIP_SAMA7G54_EK=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y

configs/arm_minimal_defconfig

@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -43,9 +43,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
@@ -121,12 +118,11 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_MICROCHIP_SAMA7G54_EK=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y

configs/riscv64_defconfig

@@ -52,9 +52,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
@@ -170,10 +167,10 @@ BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y

configs/x86_64_defconfig

@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -41,9 +41,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_RNG_TOOLS=y
@@ -142,10 +139,10 @@ BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y

configs/x86_64_minimal_defconfig

@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -37,14 +37,10 @@ BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
-BR2_PACKAGE_CRYPTSETUP=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_RNG_TOOLS=y
@@ -88,7 +84,6 @@ BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_GETENT=y
 BR2_PACKAGE_KMOD_TOOLS=y
-BR2_PACKAGE_MULTIPATH_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
@@ -97,7 +92,6 @@ BR2_PACKAGE_RAUC_NETWORK=y
 BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
-BR2_PACKAGE_UTIL_LINUX_PARTX=y
 BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_WATCHDOGD_GENERIC=y
 BR2_PACKAGE_WATCHDOGD_LOADAVG=y
@@ -108,16 +102,13 @@ BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_CPIO_DRACUT=y
-BR2_TARGET_ROOTFS_CPIO_DRACUT_MODULES="${BR2_EXTERNAL_INFIX_PATH}/board/common/initramfs"
-BR2_TARGET_ROOTFS_CPIO_DRACUT_CONF_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/dracut.conf"
-BR2_TARGET_ROOTFS_INITRAMFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
-BR2_TARGET_BAREBOX=y
-BR2_TARGET_BAREBOX_CUSTOM_VERSION=y
-BR2_TARGET_BAREBOX_CUSTOM_VERSION_VALUE="2025.11.0"
-BR2_TARGET_BAREBOX_BOARD_DEFCONFIG="efi"
-BR2_TARGET_BAREBOX_IMAGE_FILE="barebox.efi"
+BR2_TARGET_EDK2=y
+BR2_TARGET_GRUB2=y
+BR2_TARGET_GRUB2_X86_64_EFI=y
+BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback cat search"
+BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
+BR2_TARGET_GRUB2_INSTALL_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
@@ -126,12 +117,11 @@ BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
@@ -156,6 +146,9 @@ BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-IMAGE_DDI=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

doc/ChangeLog.md

@@ -3,25 +3,48 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
-[v26.02.0][UNRELEASED] -
+[v26.02.1][] - 2026-03-13
 -------------------------
 
 ### Changes
 
-- Upgrade Linux kernel to 6.18.14 (LTS)
-- Upgrade Buildroot to 2025.02.11 (LTS)
-- Upgrade FRR to 10.5.1
-- Add support for Microchip SAMA7G54-EK Evaluation Kit, Arm Cortex-A7
-- Add GPS/GNSS receiver support with NTP reference clock integration
-- Add support for [Banana Pi R3 Mini][BPI-R3-MINI], a 2 port router with 2 WiFi chip,
-  uses the same bootloader as BPI-R3 (eMMC-version)
+- Upgrade Linux kernel to 6.18.17 (LTS)
+- Add support for disabling WiFi and GPS features in builds
+- Add OSPF point-to-multipoint (P2MP) and hybrid interface type support.  This
+  also includes support for setting static neighbors, issue #1426
 
 ### Fixes
 
-N/A
+- Fix #1389: legacy name limit in firewalld triggered problems with policy names
+- Fix #1416: `show firewall` command show an error when the firewall is disabled
+- Fix #1438: default route from DHCP client not set at boot, regression in v26.02.0
+- Fix instabilities in Zebra route manager after Frr upgrade in v26.02.0
+- Fix regression in MVEBU SafeXcel Crypto Engine for Marvell Armada SOCs (37xx,
+  7k, 8k, and CN913x series).  Firmware package lost in v26.01.0
+
+[v26.02.0][] - 2026-03-01
+-------------------------
+
+> [!NOTE]
+> The blog and User Guide have a new address: <https://www.kernelkit.org>
+
+### Changes
+
+- Upgrade Linux kernel to 6.18.15 (LTS)
+- Upgrade Buildroot to 2025.02.11 (LTS)
+- Upgrade FRR to 10.5.1
+- Add support for [Microchip SAMA7G54][SAMA7G54-EK] Evaluation Kit, Arm Cortex-A7
+- Add support for [Banana Pi R3 Mini][BPI-R3-MINI], a 2 port router with 2 WiFi chip,
+  uses the same bootloader as BPI-R3 (eMMC-version)
+- Add GPS/GNSS receiver support with NTP reference clock integration
+- Add `reset-volumes` option to `container upgrade foo` command
+
+### Fixes
+
+- Fix CLI `copy` command problem to copy to scp/sftp destinations
 
 [BPI-R3-MINI]: https://wiki.banana-pi.org/Banana_Pi_BPI-R3_Mini
-
+[SAMA7G54-EK]: https://www.microchip.com/en-us/development-tool/ev21h18a
 
 [v26.01.0][] - 2026-02-03
 -------------------------
@@ -106,7 +129,7 @@ Noteworthy changes and additions in this release are marked below in bold text.
 - Prevent MOTD from showing on non-shell user login attempts
 - Fix mDNS reflector.
 
-[wifi]: https://kernelkit.org/infix/latest/wifi/
+[wifi]: https://www.kernelkit.org/infix/latest/wifi/
 [sd card image]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
 
 
@@ -724,7 +747,7 @@ renamed to ease maintenance, more info below.
   not supported (yet) in Infix, issue #709
 - The default builds now include the curiOS nftables container image,
   which can be used for advanced firewall setups.  For an introduction
-  see <https://kernelkit.org/posts/firewall-container/>
+  see <https://www.kernelkit.org/posts/firewall-container/>
 
 ### Fixes
 
@@ -1927,7 +1950,9 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
  - N/A
 
 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.01.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.02.0...HEAD
+[v26.02.1]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.02.1
+[v26.02.0]:   https://github.com/kernelkit/infix/compare/v26.01.0...v26.02.0
 [v26.01.0]:   https://github.com/kernelkit/infix/compare/v25.11.0...v26.01.0
 [v25.11.0]:   https://github.com/kernelkit/infix/compare/v25.10.0...v25.11.0
 [v25.10.0]:   https://github.com/kernelkit/infix/compare/v25.09.0...v26.10.0

doc/discovery.md

@@ -295,7 +295,7 @@ linux-pc:# ssh admin@infix-c0-ff-ee.local
 (admin@infix-c0-ff-ee.local) Password: 
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-
 
 Run the command 'cli' for interactive OAM
@@ -335,7 +335,7 @@ linux-pc:# ssh admin@infix.local
 (admin@infix.local) Password: 
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-
 
 Run the command 'cli' for interactive OAM

doc/management.md

@@ -87,7 +87,7 @@ example login: <b>admin</b>
 Password:
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'
 
 Run the command 'cli' for interactive OAM

doc/routing.md

@@ -131,6 +131,66 @@ an Ethernet interface can be done as follows.
 admin@example:/config/routing/…/ospf/area/0.0.0.0/interface/e0/>
 </code></pre>
 
+
+### Point-to-Multipoint
+
+Point-to-Multipoint (P2MP) is used when multiple OSPF routers share a
+common network segment but should form individual adjacencies rather
+than electing a Designated Router (DR).  This is common in NBMA-like
+environments, DMVPN, or hub-and-spoke topologies.
+
+Infix supports two P2MP variants via the `interface-type` setting:
+
+| **Interface Type**    | **Behavior**                                   |
+|:----------------------|:-----------------------------------------------|
+| `hybrid`              | P2MP with multicast Hellos (broadcast-capable) |
+| `point-to-multipoint` | P2MP with unicast Hellos (non-broadcast)       |
+
+#### Hybrid (broadcast-capable P2MP)
+
+Use `hybrid` when all neighbors on the segment can receive multicast.
+Hello packets are sent to the standard OSPF multicast address (224.0.0.5)
+and neighbors are discovered automatically — no manual neighbor
+configuration is needed.
+
+<pre class="cli"><code>admin@example:/config/> <b>edit routing control-plane-protocol ospfv2 name default ospf</b>
+admin@example:/config/routing/…/ospf/> <b>set area 0.0.0.0 interface e0 interface-type hybrid</b>
+admin@example:/config/routing/…/ospf/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+#### Non-broadcast P2MP
+
+Use `point-to-multipoint` when the network does not support multicast.
+Hello packets are sent as unicast directly to each configured neighbor.
+Since neighbors cannot be discovered automatically, they must be
+configured explicitly using static neighbors (see below).
+
+<pre class="cli"><code>admin@example:/config/> <b>edit routing control-plane-protocol ospfv2 name default ospf</b>
+admin@example:/config/routing/…/ospf/> <b>set area 0.0.0.0 interface e0 interface-type point-to-multipoint</b>
+admin@example:/config/routing/…/ospf/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+
+### Static Neighbors
+
+When using non-broadcast interface types (such as `point-to-multipoint`),
+OSPF cannot discover neighbors via multicast.  Static neighbors must be
+configured so the router knows where to send unicast Hello packets.
+
+<pre class="cli"><code>admin@example:/config/> <b>edit routing control-plane-protocol ospfv2 name default ospf</b>
+admin@example:/config/routing/…/ospf/> <b>set area 0.0.0.0 interface e0 static-neighbors neighbor 10.0.123.2</b>
+admin@example:/config/routing/…/ospf/> <b>set area 0.0.0.0 interface e0 static-neighbors neighbor 10.0.123.3</b>
+admin@example:/config/routing/…/ospf/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+> [!NOTE]
+> Static neighbors are only needed for non-broadcast interface types.
+> With `hybrid` (or `broadcast`), neighbors are discovered automatically
+> via multicast.
+
 ### OSPF global settings
 
 In addition to *area* and *interface* specific settings, OSPF provides

doc/scripting-prod.md

@@ -336,7 +336,7 @@ It should now be possible to access the switch from the PC via SSH (or NETCONF).
 admin@fe80::0053:00ff:fe06:1101%eth1's password:
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'
 
 Run the command 'cli' for interactive OAM

doc/scripting.md

@@ -88,7 +88,7 @@ Warning: Permanently added 'fe80::ff:fe00:0%eth0' (ED25519) to the list of known
 admin@fe80::ff:fe00:0%eth0's password: *****
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'
 
 Run the command 'cli' for interactive OAM

doc/testing.md

@@ -152,7 +152,7 @@ infix-00-00-00 login: admin
 Password:
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'
 
 Run the command 'cli' for interactive OAM

doc/upgrade.md

@@ -170,7 +170,7 @@ example login: <b>admin</b>
 Password:
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'
 
 Run the command 'cli' for interactive OAM

mkdocs.yml

@@ -170,6 +170,6 @@ plugins:
 
 extra:
   generator: false
-  homepage: https://kernelkit.org/
+  homepage: https://www.kernelkit.org/
   version:
     provider: mike

package/confd/confd.mk

@@ -30,6 +30,11 @@ CONFD_CONF_OPTS += --enable-wifi
 else
 CONFD_CONF_OPTS += --disable-wifi
 endif
+ifeq ($(BR2_PACKAGE_FEATURE_GPS),y)
+CONFD_CONF_OPTS += --enable-gps
+else
+CONFD_CONF_OPTS += --disable-gps
+endif
 define CONFD_INSTALL_EXTRA
 	for fn in confd.conf resolvconf.conf; do \
 		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
@@ -80,6 +85,12 @@ define CONFD_INSTALL_YANG_MODULES_WIFI
 	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/wifi.inc
 endef
 endif
+ifeq ($(BR2_PACKAGE_FEATURE_GPS),y)
+define CONFD_INSTALL_YANG_MODULES_GPS
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/gps.inc
+endef
+endif
 
 # PER_PACKAGE_DIR
 # Since the last package in the dependency chain that runs sysrepoctl is confd, we need to
@@ -109,6 +120,7 @@ CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_EXTRA
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WIFI
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_GPS
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_IN_ROMFS
 CONFD_TARGET_FINALIZE_HOOKS += CONFD_CLEANUP
 

package/netd/Config.in

@@ -2,9 +2,10 @@ config BR2_PACKAGE_NETD
 	bool "netd"
 	select BR2_PACKAGE_LIBITE
 	select BR2_PACKAGE_LIBCONFUSE
+	select BR2_PACKAGE_LIBEV
 	help
 	  Network route daemon. Manages static routes and RIP routing.
-	  Reads configuration from /etc/netd/conf.d/*.conf.
+	  Reads configuration from /etc/net.d/*.conf.
 
 	  With FRR: Full routing via gRPC, vtysh, or frr.conf.
 	  Without FRR: Standalone Linux backend via rtnetlink.

package/netd/netd.mk

@@ -4,13 +4,13 @@
 #
 ################################################################################
 
-NETD_VERSION = 1.0
+NETD_VERSION = 1.1.0
 NETD_SITE_METHOD = local
 NETD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/netd
 NETD_LICENSE = BSD-3-Clause
 NETD_LICENSE_FILES = LICENSE
 NETD_REDISTRIBUTE = NO
-NETD_DEPENDENCIES = libite libconfuse jansson
+NETD_DEPENDENCIES = libite libconfuse jansson libev
 NETD_AUTORECONF = YES
 
 NETD_CONF_ENV = CFLAGS="$(INFIX_CFLAGS)"
@@ -34,6 +34,10 @@ else
 NETD_CONF_OPTS += --without-frr
 endif
 
+define NETD_INSTALL_EXTRA
+	cp $(NETD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/etc/tmpfiles.d/netd.conf
+endef
+
 NETD_TARGET_FINALIZE_HOOKS += NETD_INSTALL_EXTRA
 
 $(eval $(autotools-package))

package/netd/tmpfiles.conf

@@ -0,0 +1 @@
+d  /etc/net.d		- - -

package/skeleton-init-finit/skeleton/etc/default/zebra

@@ -1,2 +1,2 @@
 # --log-level debug
-ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog --log-level err"
+ZEBRA_ARGS="-A 127.0.0.1 -a -s 90000000 -u frr -g frr --log syslog --log-level err"

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/mgmtd.conf

@@ -1,2 +1,3 @@
 service <!> pid:!/run/frr/mgmtd.pid env:-/etc/default/mgmtd \
-	[2345] mgmtd $MGMTD_ARGS -- FRR MGMT daemon
+	[2345] mgmtd $MGMTD_ARGS \
+	-- FRR MGMT daemon

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/ospfd.conf

@@ -1,2 +1,3 @@
-service <!pid/zebra> env:-/etc/default/ospfd \
-	[2345] ospfd $OSPFD_ARGS -- OSPF daemon
+service <!pid/zebra> pid:!/run/frr/ospfd.pid env:-/etc/default/ospfd \
+	[2345] ospfd $OSPFD_ARGS \
+	-- OSPF daemon

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/ripd.conf

@@ -1,3 +1,3 @@
-service <pid/zebra> env:-/etc/default/ripd \
-	[2345] ripd $RIPD_ARGS
+service <pid/zebra> pid:!/run/frr/ripd.pid env:-/etc/default/ripd \
+	[2345] ripd $RIPD_ARGS \
 	-- RIP daemon

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/zebra.conf

@@ -1,3 +1,3 @@
-service <!pid/mgmtd> pid:!/run/frr/zebra.pid env:-/etc/default/zebra  \
-	[2345] zebra $ZEBRA_ARGS
+service <!pid/mgmtd> pid:!/run/frr/zebra.pid env:-/etc/default/zebra \
+	[2345] zebra $ZEBRA_ARGS \
 	-- Zebra routing daemon

package/skeleton-init-finit/skeleton/etc/frr/daemons

@@ -1,5 +1,4 @@
-# Default FRR daemons file for Infix - confd overwrites on routing changes.
-# watchfrr, zebra, mgmtd, and staticd are always started by frrinit.sh.
+# Default FRR daemons file used with watchfrr, started by frrinit.sh.
 ospfd=no
 ripd=no
 bfdd=no
@@ -25,4 +24,3 @@ staticd_options="-A 127.0.0.1"
 bfdd_options="   -A 127.0.0.1"
 
 frr_profile="traditional"
-

package/skeleton-init-finit/skeleton/etc/frr/mgmtd.conf

@@ -0,0 +1 @@
+! Empty stub — mgmtd reads its own config at startup; file must exist to avoid log noise.

package/skeleton-init-finit/skeleton/etc/frr/ripd.conf

@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.

package/skeleton-init-finit/skeleton/etc/frr/ripngd.conf

@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.

package/skeleton-init-finit/skeleton/etc/frr/staticd.conf

@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.

package/skeleton-init-finit/skeleton/etc/frr/zebra.conf

@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.

patches/firewalld/2.3.1/0001-Silence-warnings-about-old-backends.patch

@@ -1,7 +1,7 @@
 From 03f273fc540082d1eaa23bd9b5847e695afd8283 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 25 Sep 2025 15:00:54 +0200
-Subject: [PATCH] Silence warnings about old backends
+Subject: [PATCH 1/2] Silence warnings about old backends
 Organization: Wires
 
 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

patches/firewalld/2.3.1/0002-fix-functions-lift-iptables-name-length-limit-when-u.patch

@@ -0,0 +1,95 @@
+From 6ab218fe7f2c7027cc5347e3b082285870c502e6 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Fri, 6 Mar 2026 07:44:38 +0100
+Subject: [PATCH 2/2] fix(functions): lift iptables name length limit when
+ using nftables
+Organization: Wires
+
+The max_zone_name_len() and max_policy_name_len() functions return 17
+and 18 respectively, derived from iptables' 28-char netfilter chain name
+limit.  These limits are applied unconditionally in Zone.check_name()
+and Policy.check_name() regardless of the active backend.
+
+When FirewallBackend=nftables nftables imposes no such restriction, so
+user-defined zone and policy names (e.g. "appletv-to-lan-guest", 20
+chars) that exceed the iptables-derived limit are incorrectly rejected.
+
+Add _nftables_backend() which reads firewalld.conf directly so the check
+can be skipped without threading backend context through to check_name()
+call sites, which have no access to all_io_objects.  When nftables is
+active, both functions return sys.maxsize, effectively disabling the
+length check.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/firewall/functions.py | 31 ++++++++++++++++++++++++++++++-
+ 1 file changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/src/firewall/functions.py b/src/firewall/functions.py
+index 27c862fd..1b8a32ce 100644
+--- a/src/firewall/functions.py
++++ b/src/firewall/functions.py
+@@ -10,9 +10,10 @@ import os
+ import os.path
+ import shlex
+ import string
++import sys
+ import tempfile
+ from firewall.core.logger import log
+-from firewall.config import FIREWALLD_TEMPDIR, FIREWALLD_PIDFILE
++from firewall.config import FIREWALLD_CONF, FIREWALLD_TEMPDIR, FIREWALLD_PIDFILE
+ 
+ NOPRINT_TRANS_TABLE = {
+     # Limit to C0 and C1 code points. Building entries for all unicode code
+@@ -576,12 +577,35 @@ def ppid_of_pid(pid):
+     return pid
+ 
+ 
++def _nftables_backend():
++    """Return True if FirewallBackend=nftables is configured in firewalld.conf.
++
++    When using nftables the iptables-derived 28-char chain name limit does not
++    apply.  Reading the config file directly avoids threading backend context
++    through check_name() call sites, which have no access to all_io_objects.
++    """
++    try:
++        with open(FIREWALLD_CONF) as f:
++            for line in f:
++                line = line.strip()
++                if line.startswith("FirewallBackend="):
++                    return line.split("=", 1)[1].strip() == "nftables"
++    except OSError:
++        pass
++    return False
++
++
+ def max_policy_name_len():
+     """
+     iptables limits length of chain to (currently) 28 chars.
+     The longest chain we create is POST_<policy>_allow,
+     which leaves 28 - 11 = 17 chars for <policy>.
++
++    When using the nftables backend, nftables imposes no practical name length
++    restriction, so we return sys.maxsize to lift the check entirely.
+     """
++    if _nftables_backend():
++        return sys.maxsize
+     from firewall.core.ipXtables import POLICY_CHAIN_PREFIX
+     from firewall.core.base import SHORTCUTS
+ 
+@@ -594,7 +618,12 @@ def max_zone_name_len():
+     Netfilter limits length of chain to (currently) 28 chars.
+     The longest chain we create is POST_<zone>_allow,
+     which leaves 28 - 11 = 17 chars for <zone>.
++
++    When using the nftables backend, nftables imposes no practical name length
++    restriction, so we return sys.maxsize to lift the check entirely.
+     """
++    if _nftables_backend():
++        return sys.maxsize
+     from firewall.core.base import SHORTCUTS
+ 
+     longest_shortcut = max(map(len, SHORTCUTS.values()))
+-- 
+2.43.0
+

patches/linux/6.18.17/0001-net-phy-marvell10g-Support-firmware-loading-on-88X33.patch

@@ -1,8 +1,9 @@
-From 00f89f3ba9f41a1c495dddcb83b2f6bb9f938a0c Mon Sep 17 00:00:00 2001
+From 346def32eb16c04f267c1da13735945c9a54231f Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 01/33] net: phy: marvell10g: Support firmware loading on
  88X3310
+Organization: Wires
 
 When probing, if a device is waiting for firmware to be loaded into
 its RAM, ask userspace for the binary and load it over XMDIO.

patches/linux/6.18.17/0002-net-phy-marvell10g-Fix-power-up-when-strapped-to-sta.patch

@@ -1,8 +1,9 @@
-From 2a31d49efc597de1f30f3067076a77750d29a15f Mon Sep 17 00:00:00 2001
+From 77b517d44bdffdf6b34e6349c1dd2fa3b82f8a49 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 02/33] net: phy: marvell10g: Fix power-up when strapped to
  start powered down
+Organization: Wires
 
 On devices which are hardware strapped to start powered down (PDSTATE
 == 1), make sure that we clear the power-down bit on all units

patches/linux/6.18.17/0003-net-phy-marvell10g-Add-LED-support-for-88X3310.patch

@@ -1,7 +1,8 @@
-From 6b0e8831d0a6303daa38e92f6cf557e476f17539 Mon Sep 17 00:00:00 2001
+From 9e51a2fa9f7aa8bace041a943b517faa47f30624 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 03/33] net: phy: marvell10g: Add LED support for 88X3310
+Organization: Wires
 
 Pickup the LEDs from the state in which the hardware reset or
 bootloader left them, but also support further configuration via

patches/linux/6.18.17/0004-net-phy-marvell10g-Support-LEDs-tied-to-a-single-med.patch

@@ -1,8 +1,9 @@
-From b5c0e5112b0d3e01af0f67c383cb981d83c185d0 Mon Sep 17 00:00:00 2001
+From d6da0f58dc1a27bf6a73ac8842e7830772199550 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 04/33] net: phy: marvell10g: Support LEDs tied to a single
  media side
+Organization: Wires
 
 In a combo-port setup, i.e. where both the copper and fiber interface
 are available to the user, the LEDs may be physically located either

patches/linux/6.18.17/0005-net-phy-Do-not-resume-PHY-when-attaching.patch

@@ -1,7 +1,8 @@
-From 81a6a60b94c633a4c2e3c11ab77252f827f8ea65 Mon Sep 17 00:00:00 2001
+From bbfb5ff1a1deac6617e889e9eae61ad90932372d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 05/33] net: phy: Do not resume PHY when attaching
+Organization: Wires
 
 The PHY should not start negotiating with its link-partner until
 explicitly instructed to do so.
@@ -19,7 +20,7 @@ administratively down.
  1 file changed, 1 deletion(-)
 
 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 7a67c900e79a..5c61faf4b10a 100644
+index 2353d6eced68..9b0983453393 100644
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
 @@ -1750,7 +1750,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
@@ -27,6 +28,6 @@ index 7a67c900e79a..5c61faf4b10a 100644
  		goto error;
  
 -	phy_resume(phydev);
- 	if (!phydev->is_on_sfp_module)
- 		phy_led_triggers_register(phydev);
  
+ 	/**
+ 	 * If the external phy used by current mac interface is managed by

patches/linux/6.18.17/0006-net-bridge-avoid-classifying-unknown-multicast-as-mr.patch

@@ -1,8 +1,9 @@
-From d1187bd54f9d346e1037621822738548e167a668 Mon Sep 17 00:00:00 2001
+From 86d59814723739aae2e0dccc1d5143e99239e517 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 06/33] net: bridge: avoid classifying unknown multicast as
  mrouters_only
+Organization: Wires
 
 Unknown multicast, MAC/IPv4/IPv6, should always be flooded according to
 the per-port mcast_flood setting, as well as to detected and configured
@@ -61,7 +62,7 @@ index c37e52e2f29a..0759bc37d6f0 100644
  		/* shouldn't be called with unsupported options */
  		WARN_ON(1);
 diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
-index a818fdc22da9..3cdb97ded410 100644
+index 525d4eccd194..6278dfc9612f 100644
 --- a/net/bridge/br_device.c
 +++ b/net/bridge/br_device.c
 @@ -89,10 +89,10 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -140,7 +141,7 @@ index dea09096ad0f..f0a613238e0d 100644
  				continue;
  			break;
 diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
-index 1405f1061a54..1ae4b4173821 100644
+index 2cbae0f9ae1f..0c539bf4bebe 100644
 --- a/net/bridge/br_input.c
 +++ b/net/bridge/br_input.c
 @@ -186,9 +186,13 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb

patches/linux/6.18.17/0007-net-bridge-Ignore-router-ports-when-forwarding-L2-mu.patch

@@ -1,8 +1,9 @@
-From d292a3a9ad8ef75d589d51bc7fe11f39371781c0 Mon Sep 17 00:00:00 2001
+From 9fa94b200cb73d0d03f724610e53b8019a6ebad2 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 07/33] net: bridge: Ignore router ports when forwarding L2
  multicast
+Organization: Wires
 
 Multicast router ports are either statically configured or learned from
 control protocol traffic (IGMP/MLD/PIM).  These protocols regulate IP

patches/linux/6.18.17/0008-net-bridge-drop-delay-for-applying-strict-multicast-.patch

@@ -1,8 +1,9 @@
-From 8786298e55fc4b5f108ad18dad5be21acd4ba911 Mon Sep 17 00:00:00 2001
+From 53004f71947c52aab8e6e3fabc3fd5d78a3c643f Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 08/33] net: bridge: drop delay for applying strict multicast
  filtering
+Organization: Wires
 
 This *local* patch drops the initial delay before applying strict multicast
 filtering, introduced in [1] and recently updated in [2].

patches/linux/6.18.17/0009-net-bridge-Differentiate-MDB-additions-from-modifica.patch

@@ -1,8 +1,9 @@
-From be0a8a1d4d6ba0bbf046cd72ebe1710800869ee5 Mon Sep 17 00:00:00 2001
+From 7229b8a8650191d42ff67d584751ab49dbcd7ed8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 09/33] net: bridge: Differentiate MDB additions from
  modifications
+Organization: Wires
 
 Before this change, the reception of an IGMPv3 report (and analogously
 for MLDv2) that adds a new group, would trigger two MDB RTM_NEWMDB

patches/linux/6.18.17/0010-nvmem-layouts-onie-tlv-Let-device-probe-even-when-TL.patch

@@ -1,8 +1,9 @@
-From 75070ac3fb6fdd403039bfc9b14d9edc6c3133dc Mon Sep 17 00:00:00 2001
+From 5b8492fa5bc5b79455e79a8e37498ecb93ee5359 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 10/33] nvmem: layouts: onie-tlv: Let device probe even when
  TLV is invalid
+Organization: Wires
 
 Before this change, probing an NVMEM device, expected to contain a
 valid TLV, would fail if it had not been provisioned yet. But an

patches/linux/6.18.17/0011-net-usb-r8152-add-r8153b-support-for-link-activity-L.patch

@@ -1,8 +1,9 @@
-From 931afb4a82cce9b479f3377a78519ad20a5e2175 Mon Sep 17 00:00:00 2001
+From 9f4c2b07839ef00084ed542c48149f0f335dd760 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 11/33] net: usb: r8152: add r8153b support for link/activity
  LEDs
+Organization: Wires
 
 This patch adds support for the link/activity LEDs on the NanoPi R2S
 and OrangePi R1 Plus.
@@ -18,7 +19,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
  1 file changed, 8 insertions(+)
 
 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index 6a43054d5171..ef8bcb4a7339 100644
+index da8de7b1a489..36d79a77316c 100644
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
 @@ -41,6 +41,11 @@
@@ -33,7 +34,7 @@ index 6a43054d5171..ef8bcb4a7339 100644
  #define R8152_PHY_ID		32
  
  #define PLA_IDR			0xc000
-@@ -7277,6 +7282,9 @@ static void r8153b_init(struct r8152 *tp)
+@@ -7279,6 +7284,9 @@ static void r8153b_init(struct r8152 *tp)
  	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
  	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
  

patches/linux/6.18.17/0012-arm64-dts-mediatek-mt7986a-rename-BPi-R3-ports-to-ma.patch

@@ -1,8 +1,9 @@
-From 23a3579ca235bbc5c4b3417176aef7846ba022b3 Mon Sep 17 00:00:00 2001
+From 3ad4ee7ae3a89aada6d57176c07cef526d9c96eb Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 10 Aug 2025 18:52:54 +0200
 Subject: [PATCH 12/33] arm64: dts: mediatek: mt7986a: rename BPi R3 ports to
  match case
+Organization: Wires
 
 For ref. see: https://wiki.banana-pi.org/File:Bpi-r3_Metal_case.jpg
 

patches/linux/6.18.17/0013-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch

@@ -1,8 +1,9 @@
-From b3eb28e66efdbe13153c13ee492b56e284dd7cc7 Mon Sep 17 00:00:00 2001
+From 3250cc2366b749241d615615ce2ea0d768bb4921 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 20 Aug 2025 21:38:24 +0200
 Subject: [PATCH 13/33] drm/panel-simple: Add a timing for the Raspberry Pi 7"
  panel
+Organization: Wires
 
 The Raspberry Pi 7" 800x480 panel uses a Toshiba TC358762 DSI
 to DPI bridge chip, so there is a requirement for the timings

patches/linux/6.18.17/0014-input-touchscreen-edt-ft5x06-Add-polled-mode.patch

@@ -1,7 +1,8 @@
-From 18b1eb460fefbd0a6dff47dc6900a5948df40a8f Mon Sep 17 00:00:00 2001
+From 642ead96253f70bf7c0fcca3c2fa85e73914bb33 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 21 Aug 2025 11:20:23 +0200
 Subject: [PATCH 14/33] input:touchscreen:edt-ft5x06: Add polled mode
+Organization: Wires
 
 Not all hardware has interrupts therefore we need
 to poll the touchscreen.

patches/linux/6.18.17/0015-FIX-net-dsa-mv88e6xxx-Fix-timeout-on-waiting-for-PPU.patch

@@ -1,8 +1,9 @@
-From 70a3642435e2510a8f16e2115a7b555dc3ec64b4 Mon Sep 17 00:00:00 2001
+From 43a979e0aa5701c0c1c0c0e9d57800bd0ef01faa Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 15/33] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
  PPU on 6393X
+Organization: Wires
 
 In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,

patches/linux/6.18.17/0016-net-dsa-mv88e6xxx-Improve-indirect-register-access-p.patch

@@ -1,8 +1,9 @@
-From a8f89c96786d6dfc6d7c728b92e7ad33ec7cc12b Mon Sep 17 00:00:00 2001
+From 76efa741dff5a8ad7d31a3d6b676c564397c88e6 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 16/33] net: dsa: mv88e6xxx: Improve indirect register access
  perf on 6393
+Organization: Wires
 
 When operating in multi-chip mode, the 6393 family maps a subset of
 commonly used global registers to the outermost address space (in

patches/linux/6.18.17/0017-net-dsa-mv88e6xxx-Honor-ports-being-managed-via-in-b.patch

@@ -1,8 +1,9 @@
-From c1ff82cfcd6786690edce944c5a44616d42426fb Mon Sep 17 00:00:00 2001
+From 7901aa874746fcd698d57099e01690ca591d9361 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 17/33] net: dsa: mv88e6xxx: Honor ports being managed via
  in-band-status
+Organization: Wires
 
 Keep all link parameters in their unforced states when the port is
 declared as being managed via in-band-status, and let the MAC

patches/linux/6.18.17/0018-net-dsa-mv88e6xxx-Limit-rsvd2cpu-policy-to-user-port.patch

@@ -1,8 +1,9 @@
-From dc2e3d0dc7bb298fb4fb25cd9befbac2cadbaa36 Mon Sep 17 00:00:00 2001
+From bff65cd654873c1fe2910f1ab8a757539fa920b7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 18/33] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
  ports on 6393X
+Organization: Wires
 
 For packets with a DA in the IEEE reserved L2 group range, originating
 from a CPU, forward it as normal, rather than classifying it as

patches/linux/6.18.17/0019-net-dsa-tag_dsa-Use-tag-priority-as-initial-skb-prio.patch

@@ -1,8 +1,9 @@
-From 7b41de01eeac05ef76798168f1bf2aebb303410b Mon Sep 17 00:00:00 2001
+From a93d06218d7b7627c5327aa10c612471840eee05 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 19/33] net: dsa: tag_dsa: Use tag priority as initial
  skb->priority
+Organization: Wires
 
 Use the 3-bit priority field from the DSA tag as the initial packet
 priority on ingress to the CPU.