package/skeleton-init-finit: enable rngd by default

Platforms with /dev/hwrandom use that to see /dev/urandom.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

.github/CHECKLIST.md

@@ -33,4 +33,3 @@ Releases
    - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
  - Ensure the markdown link for the release diff is updated
  - Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
- - Sync tags for all repo. sync activities

.github/SECURITY.md

@@ -1,26 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-If you discover a security vulnerability in Infix, please use GitHub's built-in
-[Report a Vulnerability](https://github.com/kernelkit/infix/security/advisories/new)
-feature for a private and secure disclosure.
-
-When reporting, include:
-
-- A clear description of the vulnerability.
-- Steps to reproduce the issue.
-- Potential impact of the vulnerability.
-
-## Supported Versions
-
-We provide security updates only for the main branch.
-
-Individual support contracts are provided by _Wires_. See
-[Support](https://github.com/kernelkit/infix/blob/main/.github/SUPPORT.md)
-for more information.
-
-## Acknowledgments
-
-We appreciate the efforts of the security community to help improve the security
-of Infix. Thank you for your responsible disclosure.

.github/SUPPORT.md

@@ -6,7 +6,7 @@ project on GitHub, and Discord, see <https://github.com/kernelkit>:
 
 Support contracts, development of new features, fast-tracking of reviews
 and contributions, customer branding of Infix, and even customer specific
-features for dedicated products is provided by _Wires_.
+features for dedicated products is provided by Addiva Elektronik.
 
-&nbsp;&nbsp; :globe_with_meridians: <https://www.wires.se>  
-&nbsp;&nbsp; :e-mail: <mailto:infix@wires.se>
+&nbsp;&nbsp; :globe_with_meridians: <https://www.addiva.se/electronics/>  
+&nbsp;&nbsp; :e-mail: <mailto:ael@addiva.se>

.github/workflows/build-boot.yml

@@ -1,144 +0,0 @@
-name: Build Bootloaders
-
-on:
-  workflow_dispatch:
-    inputs:
-      branch:
-        description: 'Branch to build from'
-        default: 'main'
-        type: string
-
-jobs:
-  build:
-    name: Build ${{ matrix.defconfig }}
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        defconfig:
-          - fireant_boot
-          - cn9130_crb_boot
-          - aarch64_qemu_boot
-          - rpi4_boot
-          - mt7986_sd_boot
-    env:
-      MAKEFLAGS: -j5
-    steps:
-      - name: Cleanup Build Folder
-        run: |
-          ls -la ./
-          rm -rf ./* || true
-          rm -rf ./.??* || true
-          ls -la ./
-
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || github.ref }}
-          clean: true
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          defconfig=${{ matrix.defconfig }}
-          version=$(awk -F'"' '/BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE=/ {print $2}' configs/${defconfig}_defconfig)
-          version=${version:-git}
-          filename=$(echo "${defconfig}" | tr '_' '-')
-
-          # TODO: Replace hardcoded rev with actual revision stepping
-          rev="latest"
-
-          archive="${filename}-${version}-${rev}.tar.gz"
-          dirname="${filename}-${version}-${rev}"
-
-          echo "defconfig=${defconfig}" >> $GITHUB_OUTPUT
-          echo "version=${version}"     >> $GITHUB_OUTPUT
-          echo "rev=${rev}"             >> $GITHUB_OUTPUT
-          echo "archive=${archive}"     >> $GITHUB_OUTPUT
-          echo "dirname=${dirname}"     >> $GITHUB_OUTPUT
-
-          echo "Building ${defconfig}_defconfig, version ${version}-${rev}, artifact ${archive} ..."
-
-      - name: Restore Cache of dl/
-        uses: actions/cache@v4
-        with:
-          path: dl/
-          key: dl-boot-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-boot-
-            dl-
-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-boot-${{ matrix.defconfig }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-boot-${{ matrix.defconfig }}-
-            ccache-boot-
-            ccache-
-
-      - name: Configure ${{ matrix.defconfig }}_defconfig
-        run: |
-          make ${{ matrix.defconfig }}_defconfig
-
-      - name: Build ${{ matrix.defconfig }}_defconfig
-        run: |
-          echo "Building ${{ matrix.defconfig }}_defconfig ..."
-          make -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))
-
-      - name: Resulting size of build
-        run: |
-          printf "Size of output/images/: "
-          ls -l output/images/
-
-      - name: Prepare ${{ matrix.defconfig }} Artifact
-        run: |
-          cd output/
-          mv images ${{ steps.vars.outputs.dirname }}
-          tar cfz ${{ steps.vars.outputs.archive }} ${{ steps.vars.outputs.dirname }}/
-
-      - uses: actions/upload-artifact@v4
-        with:
-          path: output/${{ steps.vars.outputs.archive }}
-          name: artifact-${{ matrix.defconfig }}
-
-  publish:
-    name: Upload Bootloader Artifacts
-    runs-on: ubuntu-latest
-    needs: build
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
-      - uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest-boot"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Bootloader Build Complete! :rocket:
-
-          For the public download links of these bootloader artifacts, please see:
-           <https://github.com/kernelkit/infix/releases/tag/latest-boot>
-          EOF

.github/workflows/build-image.yml

@@ -1,225 +0,0 @@
-name: Create SD Card Images
-
-on:
-  workflow_dispatch:
-    inputs:
-      board:
-        description: 'Board to create image for'
-        type: choice
-        required: true
-        options:
-          - raspberry-pi-4
-          - banana-pi-r3
-        default: 'raspberry-pi-4'
-      use_latest_release:
-        description: 'Use latest release artifacts instead of workflow artifacts'
-        type: boolean
-        default: false
-
-jobs:
-  create-image:
-    name: Create SD Card Image for ${{ inputs.board }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          clean: true
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            genimage \
-            u-boot-tools \
-            parted \
-            gdisk \
-            qemu-utils \
-            dosfstools \
-            e2fsprogs \
-            genext2fs \
-            mtools \
-            jq
-
-      - name: Prepare build environment
-        run: |
-          # Set up directory structure similar to buildroot build
-          mkdir -p output/images
-          mkdir -p build
-
-      - name: Set bootloader and target based on board
-        run: |
-          case "${{ inputs.board }}" in
-            raspberry-pi-4)
-              echo "BOOTLOADER=rpi4_boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
-              ;;
-            banana-pi-r3)
-              echo "BOOTLOADER=mt7986_sd_boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
-              ;;
-            *)
-              echo "Error: Unknown board ${{ inputs.board }}"
-              exit 1
-              ;;
-          esac
-          echo "Using bootloader: $BOOTLOADER and target: $TARGET for board: ${{ inputs.board }}"
-
-      - name: Download bootloader artifacts
-        if: ${{ !inputs.use_latest_release }}
-        run: |
-          # Download from latest bootloader build workflow on main branch
-          gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
-          BOOT_RUN_ID=$(cat latest_boot_run_id)
-
-          gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
-
-          # Extract bootloader directly to output/images
-          cd temp_bootloader/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_bootloader/
-
-          echo "Bootloader files extracted to output/images:"
-          ls -la output/images/
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Download Infix artifacts
-        if: ${{ !inputs.use_latest_release }}
-        run: |
-          # Download from latest Kernelkit Trigger workflow for main branch
-          gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
-          INFIX_RUN_ID=$(cat latest_infix_run_id)
-
-          gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
-
-          # Extract Infix directly to output/images
-          cd temp_infix/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_infix/
-
-          echo "Infix files extracted to output/images:"
-          ls -la output/images/
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Download from latest releases
-        if: ${{ inputs.use_latest_release }}
-        run: |
-          # Download latest bootloader release
-          gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
-          cd temp_bootloader/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_bootloader/
-
-          # Download latest Infix release
-          gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
-          cd temp_infix/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_infix/
-
-          echo "All files extracted to output/images:"
-          ls -la output/images/
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Verify extracted files
-        run: |
-          echo "Files available for mkimage.sh:"
-          ls -la output/images/
-          echo ""
-          echo "File types:"
-          file output/images/* || true
-
-      - name: Create SD card image
-        run: |
-          export BINARIES_DIR=$PWD/output/images
-          export BUILD_DIR=$PWD/build
-          export BR2_EXTERNAL_INFIX_PATH=$PWD
-          export RELEASE=""
-          export INFIX_ID="infix"
-
-          # Use the standardized mkimage.sh path for the selected board
-          #          BOARD_SCRIPT="src/board/${{ inputs.board }}/mkimage.sh"
-          BOARD_SCRIPT="src/board/${{ inputs.board }}/mkimage.sh"
-
-          if [ -f "$BOARD_SCRIPT" ]; then
-            echo "Using board-specific image creation script: $BOARD_SCRIPT"
-            chmod +x "$BOARD_SCRIPT"
-            "$BOARD_SCRIPT"
-          else
-            echo "Error: Board script $BOARD_SCRIPT not found!"
-            exit 1
-          fi
-
-      - name: Verify created image
-        run: |
-          echo "Contents of output/images after mkimage.sh:"
-          ls -lh output/images/
-
-          # Look for SD card image with pattern: *-sdcard.img
-          if ls output/images/*-sdcard.img 1> /dev/null 2>&1; then
-            echo "Found SD card image(s):"
-            for img in output/images/*-sdcard.img; do
-              echo "- $(basename $img)"
-              file "$img"
-              fdisk -l "$img" 2>/dev/null || true
-            done
-          else
-            echo "No SD card image found matching pattern: *-sdcard.img"
-            echo "Available files:"
-            ls -la output/images/
-            exit 1
-          fi
-
-      - name: Upload SD card image
-        uses: actions/upload-artifact@v4
-        with:
-          name: sdcard-image-${{ inputs.board }}-${{ env.BOOTLOADER }}
-          path: |
-            output/images/*-sdcard.img
-          retention-days: 30
-
-      - name: Create checksums
-        run: |
-          cd output/images/
-          for file in *-sdcard.img; do
-            if [ -f "$file" ]; then
-              sha256sum "$file" > "$file.sha256"
-            fi
-          done
-
-      - name: Upload to release
-        uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest-boot"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "output/images/*-sdcard.img*"
-
-      - name: Generate summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # SD Card Image Build Complete! 🚀
-
-          **Board:** ${{ inputs.board }}
-          **Target:** ${{ env.TARGET }}
-          **Bootloader:** ${{ env.BOOTLOADER }}
-          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
-
-          ## Created Images
-          $(find output/images/ -name "*.img" -o -name "*.qcow2" -o -name "*.raw" | xargs ls -lh 2>/dev/null | sed 's/^/- /' || echo "- No images found")
-
-          ## Download
-          The SD card image is available as a workflow artifact above.
-          EOF

.github/workflows/build.yml

@@ -1,57 +1,27 @@
-name: Build
+name: Bob the Builder
 
 on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches:
+      - main
   workflow_dispatch:
     inputs:
-      target:
-        description: "Build target (e.g. aarch64 or aarch64_minimal)"
-        default: "x86_64"
-        type: string
-      parallel:
-        description: 'Massive parallel build of each image'
+      minimal:
+        description: 'Build minimal defconfigs'
+        required: false
         default: true
         type: boolean
-      name:
-        description: "Name (for spin overrides)"
-        default: "infix"
-        type: string
-      infix_repo:
-        description: 'Repo to checkout (for spin overrides)'
-        default: kernelkit/infix
-        type: string
-
-  workflow_call:
-    inputs:
-      target:
-        required: true
-        type: string
-      name:
-        required: true
-        type: string
-      infix_repo:
-        required: false
-        type: string
-        default: kernelkit/infix
-      parallel:
-        required: false
-        type: boolean
-        default: false
-
-env:
-  NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
-  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
-  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
 
 jobs:
   build:
-    name: Build ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+    name: Build Infix ${{ matrix.target }}
     runs-on: [ self-hosted, latest ]
-    env:
-      PARALLEL: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.parallel == 'true' || github.event_name != 'workflow_dispatch' && inputs.parallel == true }}
     strategy:
+      matrix:
+        target: [aarch64, x86_64]
       fail-fast: false
-    outputs:
-      build_id: ${{ steps.vars.outputs.INFIX_BUILD_ID }}
     steps:
       - name: Cleanup Build Folder
         run: |
@@ -60,35 +30,34 @@ jobs:
           rm -rf ./.??* || true
           ls -la ./
 
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
         with:
-          repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
           clean: true
-          fetch-depth: 0
           submodules: recursive
 
       - name: Set Build Variables
         id: vars
         run: |
-          if [ -n "${{ github.event.pull_request.head.sha }}" ]; then
-              # Since PRs are built from an internally generated merge
-              # commit, reverse lookups of PRs and/or commits from
-              # image version information are cumbersome.  Therefore:
-              # explicitly set a build id that references both the PR
-              # and the commit.
-              printf "INFIX_BUILD_ID=pr%d.%.7s\n" \
-                  "${{ github.event.number }}" "${{ github.event.pull_request.head.sha }}" \
-                  | tee -a $GITHUB_OUTPUT $GITHUB_ENV
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+              if [ "${{ github.event.inputs.minimal }}" == "true" ]; then
+                  flavor="_minimal"
+              fi
+          else
+              # Ensure 'release' job get the proper image when building main
+              if [ "$GITHUB_REF_NAME" != "main" ]; then
+                  flavor="_minimal"
+              else
+                  flavor=""
+              fi
+              if ${{ contains(github.event.pull_request.labels.*.name, 'ci:main') }}; then
+                  flavor=""
+              fi
           fi
-
-          target=${{ env.TARGET }}
-          name=${{ env.NAME }}
-          echo "dir=${name}-${target}"        >> $GITHUB_OUTPUT
-          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
-          echo "Building target ${target}_defconfig"
-
+          target=${{ matrix.target }}
+          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+          echo "flv=$flavor"              >> $GITHUB_OUTPUT
+          echo "Building target ${target}${flavor}_defconfig"
       - name: Restore Cache of dl/
         uses: actions/cache@v4
         with:
@@ -101,37 +70,23 @@ jobs:
         uses: actions/cache@v4
         with:
           path: .ccache/
-          key: ccache-${{ env.TARGET }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
           restore-keys: |
-            ccache-${{ env.TARGET }}-
+            ccache-${{ matrix.target }}-
             ccache-
 
-      - name: Configure ${{ env.TARGET }}
+      - name: Configure ${{ matrix.target }}${{ steps.vars.outputs.flv }}
         run: |
-          make ${{ env.TARGET }}_defconfig
+          make ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig
 
-      - name: Unit Test ${{ env.TARGET }}
+      - name: Unit Test ${{ matrix.target }}
         run: |
           make test-unit
 
-      - name: Prepare parallel build
-        id: parallel
+      - name: Build ${{ matrix.target }}${{ steps.vars.outputs.flv }}
         run: |
-
-          if [ "$PARALLEL" == "true" ]; then
-             echo "BR2_PER_PACKAGE_DIRECTORIES=y" >> output/.config
-             MAKE="make -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
-             echo "Building in parallel with -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
-          else
-             echo "Disabling parallel build"
-             MAKE="make"
-          fi
-          echo "MAKE=$MAKE" >> $GITHUB_OUTPUT
-
-      - name: Build ${{ env.TARGET }}
-        run: |
-          echo "Building ${{ env.TARGET }}_defconfig ..."
-          eval "${{ steps.parallel.outputs.MAKE }}"
+          echo "Building ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
+          make
 
       - name:  Check SBOM from Build
         run: |
@@ -152,14 +107,100 @@ jobs:
           printf "Size of output/images/: "
           ls -l output/images/
 
-      - name: Prepare ${{ env.TARGET }} Artifact
+      - name: Prepare ${{ matrix.target }} Artifact
         run: |
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
       - uses: actions/upload-artifact@v4
         with:
           path: output/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ env.TARGET }}
+          name: artifact-${{ matrix.target }}
+
+  test:
+    name: Regression Test of Infix x86_64
+    needs: build
+    runs-on: [ self-hosted, regression ]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          clean: true
+          submodules: recursive
+
+      - name: Set Build Variables
+        id: vars
+        run: |
+          if [ "$GITHUB_REF_NAME" != "main" ]; then
+              flavor="_minimal"
+          else
+              flavor=""
+          fi
+          echo "flv=$flavor"              >> $GITHUB_OUTPUT
+
+      - name: Configure x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          make x86_64${{ steps.vars.outputs.flv }}_defconfig
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
+        run: |
+          ls -l
+          mkdir -p output
+          mv infix-x86_64.tar.gz output/
+          cd output/
+          tar xf infix-x86_64.tar.gz
+          ln -s infix-x86_64 images
+
+      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          make test
+
+      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: cat test/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+
+  release:
+    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
+    name: Upload Latest Build
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          omitName: true
+          omitBody: true
+          omitBodyDuringUpdate: true
+          prerelease: true
+          tag: "latest"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          artifacts: "*.tar.gz*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Latest Build Complete! :rocket:
+
+          For the public download links of these build artifacts, please see:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+          EOF

.github/workflows/coverity.yml

@@ -55,7 +55,7 @@ jobs:
           sudo apt-get -y update
           sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                        libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev
+                       libuev-dev libite-dev
 
       - name: Build dependencies
         run: |
@@ -65,8 +65,6 @@ jobs:
           git clone https://github.com/sysrepo/sysrepo.git
           mkdir sysrepo/build
           (cd sysrepo/build && cmake .. && make all && sudo make install)
-          git clone https://github.com/troglobit/libite.git
-          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
           make dep
 
       - name: Check applications

.github/workflows/docs.yml

@@ -1,67 +0,0 @@
-name: User Guide Generator
-
-on:
-  push:
-    branches:
-      - doc
-      - main
-    tags:
-      - 'v*'
-    paths:
-      - 'doc/**'
-      - 'mkdocs.yml'
-      - '.github/workflows/docs.yml'
-
-permissions:
-  contents: write
-
-concurrency:
-  group: "docs-${{ github.ref }}"
-  cancel-in-progress: false
-
-jobs:
-  docs:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.x'
-
-      - name: Install dependencies
-        run: |
-          pipx install mkdocs
-          pipx inject mkdocs mkdocs-material
-          pipx inject mkdocs pymdown-extensions
-          pipx inject mkdocs mkdocs-callouts
-          pipx inject mkdocs mike
-          pipx inject mkdocs mkdocs-to-pdf
-          # Workaround, if pipx inject fails to install symlink
-          ln -s "$(pipx environment -V PIPX_LOCAL_VENVS)/mkdocs/bin/mike" \
-                "$(pipx environment -V PIPX_BIN_DIR)/mike" || true
-
-      - name: Configure Git
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-
-      - name: Deploy dev version
-        if: github.event_name == 'push' && (github.ref == 'refs/heads/doc' || github.ref == 'refs/heads/main')
-        run: |
-          mike deploy --push --update-aliases dev latest
-          mike set-default --push latest
-
-      - name: Deploy tagged version
-        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-        run: |
-          TAG=${GITHUB_REF#refs/tags/v}
-          # Extract YEAR.MONTH from tag (e.g., v25.06.0-beta1 -> 25.06)
-          VERSION=$(echo $TAG | sed -E 's/^([0-9]+\.[0-9]+)(\.[0-9]+)?(-.*)?$/\1/')
-          echo "Deploying tag $TAG as docs version $VERSION"
-          mike deploy --push --update-aliases $VERSION latest
-          mike set-default --push latest

.github/workflows/generic-x86-build.yml

@@ -1,73 +0,0 @@
-name: Generic X86 GitHub Build
-
-on:
-  push:
-
-jobs:
-  build:
-    if: github.repository != 'kernelkit/infix'
-    name: Infix x86_64
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Install build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            bc binutils build-essential bzip2 cpio \
-            diffutils file findutils git gzip \
-            libncurses-dev libssl-dev perl patch \
-            python3 rsync sed tar unzip wget \
-            autopoint bison flex autoconf automake \
-            mtools
-
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
-        with:
-          repository: ${{ github.repository }}
-          ref: ${{ github.ref }}
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          echo "INFIX_BUILD_ID=${{ github.run_id }}" >> $GITHUB_OUTPUT
-          echo "dir=Infix-x86_64" >> $GITHUB_OUTPUT
-          echo "tgz=Infix-x86_64.tar.gz" >> $GITHUB_OUTPUT
-
-      - name: Configure x86_64_minimal
-        run: |
-          make x86_64_minimal_defconfig
-
-      - name: Unit Test x86_64
-        run: |
-          make test-unit
-
-      - name: Build x86_64_minimal
-        run: |
-          make
-
-      - name: Check SBOM
-        run: |
-          make legal-info
-
-      - name: Report Build Size
-        run: |
-          du -sh .
-          du -sh output
-          du -sh dl || true
-          ls -l output/images/
-
-      - name: Prepare Artifact
-        run: |
-          cd output/
-          mv images Infix-x86_64
-          ln -s Infix-x86_64 images
-          tar cfz Infix-x86_64.tar.gz Infix-x86_64
-
-      - uses: actions/upload-artifact@v4
-        with:
-          path: output/Infix-x86_64.tar.gz
-          name: artifact-x86_64
-

.github/workflows/publish.yml

@@ -1,44 +0,0 @@
-name: Publish latest Infix
-
-on:
-  workflow_dispatch:
-  workflow_call:
-
-jobs:
-  publish:
-    name: Upload Latest Build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
-      - uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          replacesArtifacts: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Latest Build Complete! :rocket:
-
-          For the public download links of these build artifacts, please see:
-           <https://github.com/kernelkit/infix/releases/tag/latest>
-          EOF

.github/workflows/release.yml

@@ -85,28 +85,22 @@ jobs:
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
           mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+          tar chfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
 
       - uses: actions/upload-artifact@v4
         with:
           name: artifact-${{ matrix.target }}
           path: output/*.tar.gz
 
-      - uses: actions/upload-artifact@v4
-        with:
-          name: artifact-disk-image-${{ matrix.target }}
-          path: output/images/*.qcow2
-
   release:
     name: Release Infix ${{ github.ref_name }}
     needs: build
     runs-on: [ self-hosted, release ]
     permissions:
       contents: write
-      discussions: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -121,14 +115,12 @@ jobs:
               ver=${GITHUB_REF#refs/tags/}
           fi
           echo "ver=${ver}"     >> $GITHUB_OUTPUT
-          echo "cat="           >> $GITHUB_OUTPUT
           if echo $ver | grep -qE 'v[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
             echo "pre=true"     >> $GITHUB_OUTPUT
             echo "latest=false" >> $GITHUB_OUTPUT
           elif echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
             echo "pre=false"    >> $GITHUB_OUTPUT
             echo "latest=true"  >> $GITHUB_OUTPUT
-            echo "cat=Releases" >> $GITHUB_OUTPUT
           else
             echo "pre=false"    >> $GITHUB_OUTPUT
             echo "latest=false" >> $GITHUB_OUTPUT
@@ -146,11 +138,6 @@ jobs:
           for file in *.tar.gz; do
               sha256sum $file > $file.sha256
           done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi
 
       - name: Extract ChangeLog entry ...
         run: |
@@ -163,9 +150,9 @@ jobs:
           name: Infix ${{ github.ref_name }}
           prerelease: ${{ steps.rel.outputs.pre }}
           makeLatest: ${{ steps.rel.outputs.latest }}
-          discussionCategory: ${{ steps.rel.outputs.cat }}
+          discussionCategory: Releases
           bodyFile:  release.md
-          artifacts: "*.tar.gz*,*.qcow2*"
+          artifacts: "*.tar.gz*"
 
       - name: Summary
         run: |

.github/workflows/test.yml

@@ -1,105 +0,0 @@
-name: Test Infix
-
-on:
-  workflow_dispatch:
-    inputs:
-      infix_repo:
-        description: 'Repo to checkout (for spin overrides)'
-        required: false
-        default: kernelkit/infix
-        type: string
-
-  workflow_call:
-    inputs:
-      target:
-        required: true
-        type: string
-      name:
-        required: true
-        type: string
-      infix_repo:
-        required: false
-        type: string
-        default: kernelkit/infix
-      ninepm-conf:
-        required: false
-        type: string
-        default: ''
-      test-path:
-        required: false
-        type: string
-        default: 'test'
-
-env:
-  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
-  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
-  NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
-  TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}
-
-jobs:
-  test:
-    name: Regression Test ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
-    runs-on: [self-hosted, regression]
-    steps:
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
-        with:
-          repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
-          clean: true
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
-              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
-                   >>$GITHUB_ENV
-          fi
-
-      - name: Configure ${{ env.TARGET }}
-        run: |
-          make ${{ env.TARGET }}_defconfig
-
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Restore ${{ env.TARGET }} output/
-        run: |
-          target=${{ env.TARGET }}
-          name=${{ inputs.name }}
-
-          ls -l
-          mkdir -p output
-          mv ${name}-${target}.tar.gz output/
-          cd output/
-          tar xf ${name}-${target}.tar.gz
-          ln -s ${name}-${target} images
-
-      - name: Regression Test ${{ env.TARGET }}
-        run: |
-          if [ -n "$NINEPM_CONF" ]; then
-            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
-            echo "DEBUG: NINEPM_PROJ_CONFIG is '$NINEPM_PROJ_CONFIG'"
-          fi
-          make test
-
-      - name: Publish Test Result for ${{ env.TARGET }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Generate Test Report for ${{ env.TARGET }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: |
-          make test-dir="$(pwd)/$TEST_PATH" test-report
-
-      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-report
-          path: output/images/test-report.pdf

.github/workflows/trigger.yml

@@ -1,42 +0,0 @@
-name: Kernelkit Trigger
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches:
-      - main
-      - ci-work
-  workflow_dispatch:
-
-concurrency:
-  group: ci-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
-    uses: ./.github/workflows/build.yml
-    with:
-      name: "infix"
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
-
-  build-aarch64:
-    if: startsWith(github.repository, 'kernelkit/')
-    uses: ./.github/workflows/build.yml
-    with:
-      name: "infix"
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'aarch64_minimal' || 'aarch64' }}
-
-  test-run-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
-    needs: build-x86_64
-    uses: ./.github/workflows/test.yml
-    with:
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
-      name: "infix"
-
-  test-publish-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
-    needs: test-run-x86_64
-    uses: ./.github/workflows/publish.yml

.gitignore

@@ -8,4 +8,3 @@
 /test/.venv
 /test/.log
 /local.mk
-/test/spec/Readme.adoc

Config.in

@@ -65,7 +65,7 @@ config INFIX_COMPATIBLE
 
 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix OS — Immutable.Friendly.Secure"
+	default "Infix -- a Network Operating System"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.

README.md

@@ -2,69 +2,55 @@
 
 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 
-Turn any ARM or x86 device into a powerful, manageable network appliance
-in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
-routers, IoT gateways, edge devices, or custom network solutions that
-just work.
+Infix is a free, Linux based, immutable Network Operating System (NOS)
+built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
+porting to different platforms, simplify long-term maintenance, and
+provide made-easy management using NETCONF, RESTCONF[^2], or the
+built-in command line interface (CLI) from a console or SSH login.
 
-## Our Values
+> Click the **▶ Example CLI Session** foldout below for an example, or
+> head on over to the [Infix Documentation](doc/README.md) for more
+> information on how to set up the system.
 
-**🔒 Immutable**  
-Your system never breaks.  Read-only filesystem with atomic upgrades
-means no configuration drift, no corrupted updates, and instant rollback
-if something goes wrong.  Deploy once, trust forever.
+Although primarily focused on switches and routers, the core values
+may be appealing for other use-cases as well:
 
-**🤝 Friendly**  
-Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit `?` or TAB for
-context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
-[comprehensive documentation][4] mean you're never stuck.  Whether
-you're learning networking or managing enterprise infrastructure.
+- Runs from a squashfs image on a read-only partition
+- Single configuration file on a separate partition
+- Built around YANG with standard IETF models
+- Linux switchdev provides open switch APIs
+- Atomic upgrades to secondary partition
+- Highly security focused
 
-**🛡️ Secure**  
-Built with security as a foundation, not an afterthought.  Minimal
-attack surface, separation between system and data, and container
-isolation.  Sleep better knowing your infrastructure is protected.
+An immutable[^1] operating system enhances security and inherently makes
+it maintenance-free.  Configuration and data, e.g, containers, is stored
+on separate partitions to ensure complete separation from system files
+and allow for seamless backup, restore, and provisioning.
 
-## Why Choose Infix
+In itself Infix is perfectly suited for dedicated networking tasks and
+native support for Docker containers provides a versatile platform that
+can easily be adapted to any customer need.  Be it legacy applications,
+network protocols, process monitoring, or edge data analysis, it can run
+close to end equipment.  Either directly connected on dedicated Ethernet
+ports or indirectly using virtual network cables to exist on the same
+LAN as other connected equipment.
 
-**Hardware Flexibility**: Start with a $35 Raspberry Pi, scale to
-enterprise switching hardware.  Same OS, same tools, same reliability.
+The simple design of Infix provides complete control over both system
+and data, minimal cognitive burden, and makes it incredibly easy to get
+started.
 
-**Standards-Based**: Built around YANG models and IETF standards. Learn
-once, use everywhere - no vendor lock-in.
+<details><summary><b>Example CLI Session</b></summary>
 
-**Container Ready**: Run your applications alongside networking
-functions.  GPIO access, dedicated Ethernet ports, custom protocols —
-your device, your rules.
+The CLI configure context is automatically generated from the loaded
+YANG models and their corresponding [sysrepo][2] plugins.  The following
+is brief example of how to set the IP address of an interface:
 
-## Use Cases
-
-1. **Home Labs & Hobbyists**:  
-   Transform a Raspberry Pi into a full-featured router with WiFi  
-1. **IoT & Edge Computing**:  
-   Bridge devices to the cloud with reliable, updatable gateways  
-1. **Small Business Networks**:  
-   Enterprise-grade features without the complexity or cost  
-1. **Developers & Makers**:  
-   Test networking concepts, prototype IoT solutions, or build custom
-   appliances
-1. **Network Professionals**:  
-   Consistent tooling from development to production deployment.  
-   How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
-
-## See It In Action
-
-Configure an interface in seconds - the CLI guides you with built-in help:
-
-<details><summary><b>Click Here for an example CLI Session</b></summary>
-
-```bash
+```
 admin@infix-12-34-56:/> configure
 admin@infix-12-34-56:/config/> edit interface eth0
 admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
       address     autoconf bind-ni-name      enabled
-      forwarding  mtu      neighbor
+	  forwarding  mtu      neighbor
 admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
 admin@infix-12-34-56:/config/interface/eth0/> show
 type ethernet;
@@ -73,6 +59,7 @@ ipv4 {
     prefix-length 24;
   }
 }
+ipv6
 admin@infix-12-34-56:/config/interface/eth0/> diff
 interfaces {
   interface eth0 {
@@ -95,69 +82,43 @@ lo              ethernet   UP          00:00:00:00:00:00
 admin@infix-12-34-56:/> copy running-config startup-config
 ```
 
-Notice how TAB completion shows available options, `show` displays
-current config, and `diff` shows exactly what changed before you
-commit your changes with the `leave` command.
-
+[Click here][3] for more details.
 </details>
 
-> [Full CLI documentation →][3]
+Infix can run on many different types of architectures and boards, much
+thanks to Linux and Buildroot.  Currently the focus is on 64-bit ARM
+devices, optionally with switching fabric supported by Linux switchdev.
+The [following boards](board/aarch64/README.md) are fully supported:
 
-## Get Started
+ - Marvell CN9130 CRB
+ - Marvell EspressoBIN
+ - Microchip SparX-5i PCB135 (eMMC)
+ - StarFive VisionFive2
+ - NanoPi R2S
 
-Get [pre-built images][5] for your hardware.  Use the CLI, web
-interface, or standard NETCONF/RESTCONF tools, e.g., `curl`.  Add
-containers for any custom functionality you need.
+An x86_64 build is also available, primarily intended for development
+and testing, but can also be used for evaluation and demo purposes.  For
+more information, see: [Infix in Virtual Environments](doc/virtual.md).
 
-### Supported Platforms
+> See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
+> page for our pre-built images.  The *[Latest Build][]* has bleeding
+> edge images, if possible we recommend using a versioned release.
+>
+> For *customer specific builds* of Infix, see your product repository.
 
-- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
-- **Banana Pi-R3** - Your next home router and gateway
-- **NanoPi R2S** - Compact dual-port router in a tiny package
-- **x86_64** - Run in VMs or on mini PCs for development and testing
-- **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
-- **Microchip SparX-5i** - Enterprise switching capabilities
-- **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
-- **StarFive VisionFive2** - RISC-V architecture support
+[^1]: An immutable operating system is one with read-only file systems,
+    atomic updates, rollbacks, declarative configuration, and workload
+    isolation.  All to improve reliability, scalability, and security.
+    For more information, see <https://ceur-ws.org/Vol-3386/paper9.pdf>
+    and <https://www.zdnet.com/article/what-is-immutable-linux-heres-why-youd-run-an-immutable-linux-distro/>.
 
-*Why start with Raspberry Pi?* It's affordable, widely available, has
-built-in WiFi + Ethernet, and runs the exact same Infix OS you'd deploy
-in production. Perfect for learning, prototyping, or even small-scale
-deployments.
+[^2]: Partial RESTCONF support, features like HTTP PATCH, OPTIONS, HEAD,
+    and copying between datastores are still missing.
 
-> 📖 **[Complete documentation][4]** • 💬 **[Join our Discord][discord-url]**
-
-## Technical Details
-
-Built on proven open-source foundations ([Buildroot][1] + [sysrepo][2])
-for reliability you can trust:
-
-- **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
-- **YANG Configuration**: Industry-standard models with auto-generated tooling
-- **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
-- **Container Integration**: Docker support with flexible network and hardware access
-- **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
-
-Perfect for everything from resource-constrained edge devices to
-high-throughput network appliances.
-
-> Check the *[Latest Build][]* for bleeding-edge features.
-
----
-
-<div align="center">
-  <a href="https://github.com/wires-se"><img src="https://raw.githubusercontent.com/wires-se/.github/main/profile/play.svg" width=300></a>
-  <br />Infix development is sponsored by <a href="https://wires.se">Wires</a>
-</div>
-
-![Alt](https://repobeats.axiom.co/api/embed/5ce7a2a67edc923823afa0f60c327a6e8575b6e9.svg "Repobeats analytics image")
-
-[1]: https://buildroot.org/ "Buildroot Homepage"
-[2]: https://www.sysrepo.org/ "Sysrepo Homepage"
-[3]: https://kernelkit.org/infix/latest/cli/introduction/
-[4]: https://kernelkit.org/infix/
-[5]: https://github.com/kernelkit/infix/releases
-[Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
+[1]: https://buildroot.org/
+[2]: https://www.sysrepo.org/
+[3]: doc/cli/introduction.md
+[Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/

board/aarch64/README.md

@@ -4,8 +4,6 @@ aarch64
 Board Specific Documentation
 ----------------------------
 
-- [Banana Pi R3](banana-pi-r3/)
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
 - [NanoPi R2S](r2s/)
-- [Raspberry Pi 4 b](raspberry-pi-4/)

board/aarch64/banana-pi-r3/README.md

@@ -1,27 +0,0 @@
-# Banana Pi R3
-
-## Support level
-Full support for all Infix enabled features including switched ethernet ports, WiFi,
-and SFP interfaces. The board includes comprehensive hardware support for
-MediaTek MT7986 SoC features.
-
-### Hardware features
-The Banana Pi R3 is a high-performance networking board featuring:
-- MediaTek MT7986 ARM Cortex-A53 quad-core processor
-- 4x Gigabit LAN ports (lan1-lan4)
-- 1x Gigabit WAN port
-- 2x SFP ports (sfp1, sfp2) for fiber connectivity
-- Dual WiFi interfaces (wifi0 for 2.4GHz, wifi1 for 5GHz)
-- USB support
-- SD card boot support
-
-### Network configuration
-The board comes preconfigured with:
-- 4 switched LAN ports for internal networking
-- Dedicated WAN port with DHCP client enabled
-- SFP ports for high-speed fiber connections
-- Dual WiFi interfaces for wireless connectivity
-
-### Pre-built images
-SD card image: [infix-bpi-r3-sdcard.img](https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img)
-

board/aarch64/cn9130-crb/README.md

@@ -128,9 +128,5 @@ SD-card partition.
 > If possible, serve `infix-aarch64.pkg` over HTTP instead, as
 > libcurl's TFTP implementation is quite slow.
 
-## Console Port
-
-The console port runs at 115200 baud, 8N1.
-
 [release]: https://github.com/kernelkit/infix/releases
 [mvebu64boot]: https://github.com/addiva-elektronik/mvebu64boot

board/aarch64/dts/marvell/cn9130-crb-A.dts

@@ -3,7 +3,7 @@
  * Copyright (C) 2020 Marvell International Ltd.
  */
 
-#include "arm64/marvell/cn9130-crb.dtsi"
+#include "cn9130-crb.dtsi"
 
 / {
 	model = "Marvell Armada CN9130-CRB-A";

board/aarch64/dts/marvell/cn9130-patched.dtsi

@@ -1,4 +1,4 @@
-#include <arm64/marvell/cn9130.dtsi>
+#include "cn9130.dtsi"
 
 &cp0_syscon0 {
 	cp0_pinctrl: pinctrl {

board/aarch64/dts/microchip/sparx5_pcb135_emmc_no_psci.dts

@@ -5,7 +5,7 @@
  */
 
 /dts-v1/;
-#include <arm64/microchip/sparx5_pcb135_emmc.dts>
+#include "sparx5_pcb135_emmc.dts"
 
 &cpu0 {
 	enable-method = "spin-table";

board/aarch64/dts/styx/dcp-sc-28p.dtsi

@@ -265,38 +265,14 @@
 	};
 };
 
-#define SWP_LED \
+#define SWP_LED(_func) \
 	leds { \
 		#address-cells = <1>; \
 		#size-cells = <0>; \
 		\
 		led@0 { \
 			reg = <0>; \
-			function = "tp"; \
-			color = <LED_COLOR_ID_GREEN>; \
-			default-state = "keep"; \
-		}; \
-		led@1 { \
-			reg = <1>; \
-			function = "aux"; \
-			color = <LED_COLOR_ID_GREEN>; \
-			default-state = "off"; \
-		}; \
-	}
-
-/* SFP LEDs
- * Rev A. LEDs do not work at all
- * Rev B. only outer-most (green) LEDs work
- */
-
-#define SFP_LED \
-	leds { \
-		#address-cells = <1>; \
-		#size-cells = <0>; \
-		\
-		led@0 { \
-			reg = <0>; \
-			function = "sfp"; \
+			function = _func; \
 			color = <LED_COLOR_ID_GREEN>; \
 			default-state = "keep"; \
 		}; \
@@ -311,7 +287,7 @@
 		phy-mode = "10gbase-r"; \
 		managed = "in-band-status"; \
 		sfp = <_sfp>; \
-		SFP_LED; \
+		SWP_LED("sfp"); \
 	}
 
 #define XSWCPU(_n, _eth) \
@@ -345,7 +321,7 @@
 		nvmem-cell-names = "mac-address"; \
 		phy-mode = "gmii"; \
 		phy-handle = <_phy>; \
-		SWP_LED; \
+		SWP_LED("tp"); \
 	}
 
 #define GPHY(_n) \

board/aarch64/linux_defconfig

@@ -34,10 +34,6 @@ CONFIG_PROFILING=y
 CONFIG_ARCH_SPARX5=y
 CONFIG_ARCH_MVEBU=y
 CONFIG_ARCH_VEXPRESS=y
-CONFIG_ARM64_ERRATUM_2441007=y
-CONFIG_ARM64_ERRATUM_1286807=y
-CONFIG_ARM64_ERRATUM_1542419=y
-CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
 CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
@@ -61,7 +57,6 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CMA=y
-CONFIG_CMA_AREAS=7
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_XDP_SOCKETS=y
@@ -170,6 +165,7 @@ CONFIG_BRIDGE_EBT_REDIRECT=m
 CONFIG_BRIDGE_EBT_SNAT=m
 CONFIG_BRIDGE_EBT_LOG=m
 CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BPFILTER=y
 CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_BRIDGE_MRP=y
@@ -231,7 +227,6 @@ CONFIG_SCSI_SAS_ATA=y
 CONFIG_SCSI_VIRTIO=y
 CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
-CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
 CONFIG_AHCI_MVEBU=y
 CONFIG_PATA_OF_PLATFORM=y
@@ -287,7 +282,6 @@ CONFIG_NET_DSA_MV88E6XXX_PTP=y
 CONFIG_MVNETA=m
 CONFIG_MVPP2=m
 # CONFIG_NET_VENDOR_MELLANOX is not set
-# CONFIG_NET_VENDOR_META is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 CONFIG_SPARX5_SWITCH=y
 # CONFIG_NET_VENDOR_MICROSEMI is not set
@@ -359,14 +353,13 @@ CONFIG_SERIAL_XILINX_PS_UART=y
 CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
 CONFIG_SERIAL_MVEBU_UART=y
 CONFIG_VIRTIO_CONSOLE=y
-CONFIG_HW_RANDOM_CN10K=m
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_GPIO=y
 CONFIG_I2C_MUX_PCA954x=y
 CONFIG_I2C_MUX_PINCTRL=y
-CONFIG_I2C_DESIGNWARE_CORE=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_MV64XXX=y
 CONFIG_I2C_SLAVE=y
 CONFIG_SPI=y
@@ -502,7 +495,6 @@ CONFIG_EXTCON_USB_GPIO=y
 CONFIG_IIO=y
 CONFIG_TI_ADC081C=y
 CONFIG_PWM=y
-CONFIG_RESET_GPIO=y
 CONFIG_PHY_MVEBU_CP110_COMPHY=y
 CONFIG_PHY_MVEBU_CP110_UTMI=y
 CONFIG_PHY_SAMSUNG_USB2=y
@@ -531,13 +523,13 @@ CONFIG_9P_FS=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_SECURITY=y
-CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
 CONFIG_CRYPTO_SHA1_ARM64_CE=y
 CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0

board/aarch64/qemu/uboot/extras.config

@@ -1,3 +0,0 @@
-# QEMU-specific U-Boot config
-# Enable PCI MMC for QEMU virtualized environment
-CONFIG_MMC_PCI=y

board/aarch64/r2s/README.md

@@ -101,13 +101,6 @@ Worth noting, unlike many other boards, the Rockchip family of chipsets
 runs the UART at 1500000 bps (1.5 Mbps) 8N1.
 
 
-Console Port
-------------
-
-Unlike many other boards, the NanoPi R2S console, and in fact all
-Rockchip family chipsets, runs at 1500000 bps (1.5 Mbps) 8N1. 
-
-
 Secure Boot
 -----------
 

board/aarch64/r2s/linux_defconfig

@@ -230,6 +230,7 @@ CONFIG_MAC80211_LEDS=y
 CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
+# CONFIG_ETHTOOL_NETLINK is not set
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
@@ -480,6 +481,7 @@ CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_GPIO=m
 CONFIG_I2C_RK3X=y
 CONFIG_I2C_SLAVE=y

board/aarch64/r2s/rootfs/etc/factory-config.cfg

@@ -153,7 +153,7 @@
         }
       ]
     },
-    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo="
   },
   "infix-dhcp-client:dhcp-client": {
     "client-if": [

board/aarch64/raspberry-pi-4/README.md

@@ -1,46 +0,0 @@
-# Raspberry Pi 4 b
-
-## Support level
-Full support for base board but not any extension board on the
-GPIOs.
-
-### Touch screen
-The [Raspberry Pi touch display v1][RPI-TOUCH] is supported, including
-touch functionality. There are multiple touchscreens on the market for
-Raspberry Pi, but only the official (first version with 800x480
-resolution) is currently supported. Infix supplies all drivers
-required to utilize the hardware, but you need to add the actual
-graphical application in a container.
-
-There are some important considerations you need to know about when
-using Infix for graphical applications. The container needs access to
-/dev/dri/ to be able to access the graphics card, and it also needs
-access to /run/udev to be able to find the input devices.
-
-Example of running Doom in Infix:
-
-```cli
-	admin@example:/> configure
-	admin@example:/config/> edit container doom
-	admin@example:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
-	admin@example:/config/container/doom/> set privileged
-	admin@example:/config/container/doom/> edit mount udev
-	admin@example:/config/container/doom/mount/udev/> set type bind
-	admin@example:/config/container/doom/mount/udev/> set target /run/udev/
-	admin@example:/config/container/doom/mount/udev/> set source /run/udev/
-	admin@example:/config/container/doom/mount/udev/> end
-	admin@example:/config/container/doom/mount/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
-	admin@example:/config/container/doom/mount/xorg.conf/> set target /etc/X11/xorg.conf
-	admin@example:/config/container/doom/mount/xorg.conf/> end
-	admin@example:/config/container/doom/> edit volume var
-	admin@example:/config/container/doom/volume/var/> set target /var
-	admin@example:/config/container/doom/volume/var/> leave
-	admin@example:/>
-
-```
-
-### Pre-built images
-SD card image: [infix-rpi4-sdcard.img](https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi4-sdcard.img)
-
-
-[RPI-TOUCH]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/

board/aarch64/rootfs/etc/rauc/system.conf

@@ -6,12 +6,6 @@ mountprefix=/var/lib/rauc/mnt
 bundle-formats=-plain
 max-bundle-download-size=1073741824
 
-[log.event-log]
-filename=/var/log/upgrade-json.log
-format=json-pretty
-max-size=1M
-max-files=5
-
 [keyring]
 directory=/etc/rauc/keys
 

board/common/README.txt

@@ -45,11 +45,11 @@ The default credentials for the demo builds is
     login: admin
     password: admin
 
-    Infix OS — Immutable.Friendly.Secure v24.09.0-rc1 (hvc0)
+    Infix -- a Network Operating System v24.09.0-rc1 (hvc0)
     infix-00-00-00 login: admin
     Password: 
     .-------.
-    |  . .  | Infix OS — Immutable.Friendly.Secure
+    |  . .  | Infix -- a Network Operating System
     |-. v .-| https://kernelkit.org
     '-'---'-'
 
@@ -122,9 +122,9 @@ There's a lot of tutorials and guides online, start here:
 About
 -----
 
-Infix is a free, Linux-based, immutable operating system built around
-Buildroot, and sysrepo.  A powerful mix that ease porting to different
-platforms, simplify long-term maintenance, and provide easy management
-using NETCONF, RESTCONF, or the built-in command line interface (CLI)
-from a console or SSH login.
+Infix is a free, Linux based, immutable Network Operating System (NOS)
+built on Buildroot, and sysrepo.  A powerful mix that ease porting to
+different platforms, simplify long-term maintenance, and provide easy
+management using NETCONF, RESTCONF, or the built-in command line
+interface (CLI) from a console or SSH login.
 

board/common/busybox_defconfig

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.36.1
-# Sun Feb  9 12:25:37 2025
+# Tue Oct 22 13:12:02 2024
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -17,7 +17,7 @@ CONFIG_SHOW_USAGE=y
 CONFIG_FEATURE_VERBOSE_USAGE=y
 # CONFIG_FEATURE_COMPRESS_USAGE is not set
 CONFIG_LFS=y
-CONFIG_PAM=y
+# CONFIG_PAM is not set
 CONFIG_FEATURE_DEVPTS=y
 CONFIG_FEATURE_UTMP=y
 CONFIG_FEATURE_WTMP=y
@@ -325,7 +325,7 @@ CONFIG_FEATURE_STAT_FILESYSTEM=y
 CONFIG_STTY=y
 CONFIG_SUM=y
 CONFIG_SYNC=y
-CONFIG_FEATURE_SYNC_FANCY=y
+# CONFIG_FEATURE_SYNC_FANCY is not set
 CONFIG_FSYNC=y
 # CONFIG_TAC is not set
 CONFIG_TAIL=y
@@ -336,7 +336,7 @@ CONFIG_TEST=y
 CONFIG_TEST1=y
 CONFIG_TEST2=y
 CONFIG_FEATURE_TEST_64=y
-CONFIG_TIMEOUT=y
+# CONFIG_TIMEOUT is not set
 CONFIG_TOUCH=y
 CONFIG_FEATURE_TOUCH_SUSV3=y
 CONFIG_TR=y
@@ -357,7 +357,7 @@ CONFIG_BASE32=y
 CONFIG_BASE64=y
 CONFIG_UUENCODE=y
 CONFIG_WC=y
-CONFIG_FEATURE_WC_LARGE=y
+# CONFIG_FEATURE_WC_LARGE is not set
 CONFIG_WHO=y
 CONFIG_W=y
 CONFIG_USERS=y

board/common/mkdisk.sh

@@ -83,7 +83,7 @@ genboot()
 {
     if [ -d "$bootdata" ]; then
 	bootimg=$(cat <<EOF
-image $BINARIES_DIR/efi-part.vfat {
+image efi-part.vfat {
 	size = $bootsize
 	vfat {
 		file EFI {
@@ -98,7 +98,7 @@ EOF
 		offset = $bootoffs
 		partition-type-uuid = U
 		bootable = true
-		image = $BINARIES_DIR/efi-part.vfat
+		image = efi-part.vfat
 	}
 EOF
 		  )
@@ -127,7 +127,7 @@ bootdata=
 diskimg=disk.img
 bootimg=
 bootpart=
-tmpimage=$(mktemp)
+
 while getopts "a:b:B:n:s:" opt; do
     case ${opt} in
 	a)
@@ -166,7 +166,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vdiskimg=$tmpimage \
+	  -vdiskimg=$diskimg \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -211,7 +211,5 @@ genimage \
     --rootpath "$root" \
     --tmppath  "$tmp" \
     --inputpath "$BINARIES_DIR" \
+    --outputpath "$BINARIES_DIR" \
     --config "$root/genimage.cfg"
-
-qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
-rm "$tmpimage"

board/common/mkrauc.sh

@@ -2,6 +2,8 @@
 
 set -e
 
+GIT_VERSION=$(git -C "$BR2_EXTERNAL_INFIX_PATH" describe --always --dirty --tags)
+
 name=$1
 compat=$2
 sign=$3
@@ -24,7 +26,7 @@ cp -f "$BINARIES_DIR/rootfs.itbh"     "$work/rootfs.itbh"
 cat >"$work/manifest.raucm" <<EOF
 [update]
 compatible=${compat}
-version=${INFIX_VERSION}
+version=${GIT_VERSION}
 
 [bundle]
 format=verity

board/common/post-build.sh

@@ -39,6 +39,22 @@ if [ -n "${ID_LIKE}" ]; then
     ID="${ID} ${ID_LIKE}"
 fi
 
+if [ -z "$GIT_VERSION" ]; then
+    infix_path="$BR2_EXTERNAL_INFIX_PATH"
+    if [ -n "$INFIX_OEM_PATH" ]; then
+	# Use version from br2-external OEM:ing Infix
+	infix_path="$INFIX_OEM_PATH"
+    fi
+    GIT_VERSION=$(git -C "$infix_path" describe --always --dirty --tags)
+fi
+
+# Override VERSION in /etc/os-release and filenames for release builds
+if [ -n "$INFIX_RELEASE" ]; then
+    VERSION="$INFIX_RELEASE"
+else
+    VERSION=$GIT_VERSION
+fi
+
 if [ -n "$INFIX_IMAGE_ID" ]; then
     NAME="$INFIX_IMAGE_ID"
 else
@@ -55,12 +71,12 @@ rm -f "$TARGET_DIR/etc/os-release"
 {
     echo "NAME=\"$INFIX_NAME\""
     echo "ID=$INFIX_ID"
-    echo "PRETTY_NAME=\"$INFIX_TAGLINE $INFIX_VERSION\""
+    echo "PRETTY_NAME=\"$INFIX_TAGLINE $VERSION\""
     echo "ID_LIKE=\"${ID}\""
     echo "DEFAULT_HOSTNAME=$BR2_TARGET_GENERIC_HOSTNAME"
-    echo "VERSION=\"${INFIX_VERSION}\""
-    echo "VERSION_ID=${INFIX_VERSION}"
-    echo "BUILD_ID=\"${INFIX_BUILD_ID}\""
+    echo "VERSION=\"${VERSION}\""
+    echo "VERSION_ID=${VERSION}"
+    echo "BUILD_ID=\"${GIT_VERSION}\""
     if [ -n "$INFIX_IMAGE_ID" ]; then
 	echo "IMAGE_ID=\"$INFIX_IMAGE_ID\""
     fi
@@ -86,7 +102,7 @@ rm -f "$TARGET_DIR/etc/os-release"
     fi
 } > "$TARGET_DIR/etc/os-release"
 
-echo "$INFIX_TAGLINE $INFIX_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
+echo "$INFIX_TAGLINE $VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
 
 # In case of ambguities, this is what the image was built from
 cp "$BR2_CONFIG" "$TARGET_DIR/usr/share/infix/config"
@@ -114,12 +130,6 @@ grep -qsE '^/bin/true$$' "$TARGET_DIR/etc/shells" \
 grep -qsE '^/bin/false$$' "$TARGET_DIR/etc/shells" \
         || echo "/bin/false" >> "$TARGET_DIR/etc/shells"
 
-boards=$(${BR2_EXTERNAL_INFIX_PATH}/board/common/selected-boards.sh ${BR2_EXTERNAL_INFIX_PATH} ${O})
-
-for board in $boards; do
-	[ ! -f "${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh" ] && continue
-	${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh
-done
 # Allow clish (symlink to /usr/bin/klish) to be a login shell
 grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
         || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"

board/common/post-image.sh

@@ -23,7 +23,7 @@ if [ -n "$IMAGE_ID" ]; then
 else
     NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
 fi
-diskimg=disk.qcow2
+diskimg=disk.img
 
 ver()
 {
@@ -48,7 +48,7 @@ fi
 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
     ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk$(ver).qcow2"
+    diskimg="${NAME}-disk$(ver).img"
     bootcfg=
     if [ "$DISK_IMAGE_BOOT_DATA" ]; then
 	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
@@ -86,27 +86,25 @@ if [ "$FIT_IMAGE" = "y" ]; then
     $common/mkfit.sh
 fi
 
-# Only for regular builds, not bootloader-only builds
 if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
     rel=$(ver)
     ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
     if [ -n "$rel" ]; then
-	ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
+	ln -sf "$BINARIES_DIR/${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
     fi
-
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
-
-    # Menuconfig support for modifying Qemu args in release tarballs
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
-    sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
-	-e "s/@DISK_IMG@/$diskimg/"   \
-	< "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in.in" \
-	> "$BINARIES_DIR/Config.in"
-    rm -f "$BINARIES_DIR/qemu.cfg"
-    CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
-	   "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
-    rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
-
-    # Quick intro for beginners, with links to more information
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"
 fi
+
+# Menuconfig support for modifying Qemu args in release tarballs
+cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
+cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
+sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
+    -e "s/@DISK_IMG@/$diskimg/"   \
+    < "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in.in" \
+    > "$BINARIES_DIR/Config.in"
+rm -f "$BINARIES_DIR/qemu.cfg"
+CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
+       "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
+rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
+
+# Quick intro for beginners, with links to more information
+cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"

board/common/qemu/Config.in.in

@@ -66,7 +66,7 @@ endchoice
 
 config QEMU_MACHINE
 	string "Select emulated machine"
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max" if QEMU_aarch64
 	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
@@ -78,7 +78,7 @@ config QEMU_MACHINE
 
 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
-	default "448M"
+	default "384M"
 	help
 	  The default, 384 MiB, works for most configurations.  However,
 	  if you get kernel panic with: "System is deadlocked on memory",
@@ -189,7 +189,7 @@ config QEMU_CLOCK
 comment "Networking"
 
 choice
-     prompt "Network Mode"
+     prompt "Mode"
      default QEMU_NET_USER
 
 config QEMU_NET_NONE
@@ -204,9 +204,6 @@ config QEMU_NET_USER
 config QEMU_NET_TAP
      bool "TAP"
 
-config QEMU_NET_ROCKER
-     bool "Rocker"
-
 endchoice
 
 config QEMU_NET_MODEL
@@ -232,8 +229,3 @@ config QEMU_NET_TAP_N
 	int "Number of TAPs"
 	depends on QEMU_NET_TAP
 	default 1
-
-config QEMU_NET_PORTS
-	int "Number of Rocker switch ports"
-	depends on QEMU_NET_ROCKER
-	default 10

board/common/qemu/qemu.sh

@@ -17,10 +17,9 @@
 #
 #    ./qemu.sh -h
 #
-# shellcheck disable=SC3037
 
 # Local variables
-imgdir=$(readlink -f "$(dirname "$0")")
+imgdir=$(readlink -f $(dirname "$0"))
 prognm=$(basename "$0")
 
 usage()
@@ -31,7 +30,6 @@ usage()
     echo "Options:"
     echo "  -c     Run menuconfig to change Qemu settings"
     echo "  -h     This help text"
-    echo "  -k     Keep generated qemu.run script (name shown at end)"
     echo
     echo "Arguments:"
     echo "  ARGS1  Args before the '--' separator are for kernel space"
@@ -56,20 +54,19 @@ die()
 
 load_qemucfg()
 {
-    tmp=$(mktemp -p /tmp)
+    local tmp=$(mktemp -p /tmp)
 
-    grep ^CONFIG_QEMU_ "$1" >"$tmp"
-    # shellcheck disable=SC1090
-    .  "$tmp"
-    rm "$tmp"
+    grep ^CONFIG_QEMU_ $1 >$tmp
+    .  $tmp
+    rm $tmp
 
     [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
     [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
 
-    [ -n "$CONFIG_QEMU_KERNEL" ] && [ -n "$CONFIG_QEMU_BIOS" ] \
+    [ "$CONFIG_QEMU_KERNEL" -a "$CONFIG_QEMU_BIOS" ] \
 	&& die "QEMU_KERNEL conflicts with QEMU_BIOS"
 
-    [ -z "$CONFIG_QEMU_KERNEL" ] && [ -z "$CONFIG_QEMU_BIOS" ] \
+    [ ! "$CONFIG_QEMU_KERNEL" -a ! "$CONFIG_QEMU_BIOS" ] \
 	&& die "QEMU_KERNEL or QEMU_BIOS must be set"
 }
 
@@ -96,7 +93,7 @@ append_args()
 
     if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
 	# Size of initrd, rounded up to nearest kb
-	size=$((($(stat -c %s "$CONFIG_QEMU_ROOTFS") + 1023) >> 10))
+	local size=$((($(stat -c %s $CONFIG_QEMU_ROOTFS) + 1023) >> 10))
 	echo -n "root=/dev/ram0 ramdisk_size=${size} "
     elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	echo -n "root=PARTLABEL=primary "
@@ -120,7 +117,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
     elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=qemu.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
+	echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
     fi
 }
 
@@ -201,24 +198,13 @@ host_args()
 
 net_dev_args()
 {
-    name="e$1"
-    mac=$(printf "02:00:00:00:00:%02x" "$1")
+    local name="e$1"
+    local mac=$(printf "02:00:00:00:00:%02x" $1)
 
     echo -n "-device $CONFIG_QEMU_NET_MODEL,netdev=$name,mac=$mac "
     echo "$name	$mac" >>"$mactab"
 }
 
-rocker_port_args()
-{
-    sw=$1
-    port=$2
-    name="sw${sw}p${port}"
-    mac=$(printf "02:00:00:00:%02x:%02x" "$sw" "$port")
-
-    echo -n "-netdev tap,id=$name,ifname=$name,script=no,downscript=no "
-    echo "$name	$mac" >> "$mactab"
-}
-
 net_args()
 {
     # Infix will pick up this file via fwcfg and install it to /etc
@@ -230,25 +216,14 @@ net_args()
 	echo -n "-netdev bridge,id=e1,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
 	net_dev_args 1
     elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
-	for i in $(seq 1 "$CONFIG_QEMU_NET_TAP_N"); do
+	for i in $(seq 1 $(($CONFIG_QEMU_NET_TAP_N))); do
 	    echo -n "-netdev tap,id=e$i,ifname=qtap$i "
-	    net_dev_args "$i"
-	done
-    elif [ "$CONFIG_QEMU_NET_ROCKER" = "y" ]; then
-	sw=sw0			# Only single switch support atm.
-	echo -n "-device '{\"driver\":\"rocker\", \"name\":\"${sw}\", "
-	echo -n "\"fp_start_macaddr\":\"02:00:00:00:00:01\", "
-	echo -n "\"ports\":["
-	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
-	    [ "$i" -gt 1 ] && echo -n ", "
-	    echo -n "\"${sw}p${i}\""
-	done
-	echo -n "]}' "
-	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
-	    rocker_port_args 0 "$i"
+	    net_dev_args $i
 	done
     elif [ "$CONFIG_QEMU_NET_USER" = "y" ]; then
+	local useropts=
 	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"
+
 	echo -n "-netdev user,id=e1${useropts} "
 	net_dev_args 1
     else
@@ -316,17 +291,18 @@ gdb_args()
 run_qemu()
 {
     if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	if ! qemu-img check "qemu.qcow2"; then
-	    rm -f "qemu.qcow2"
+	if ! qemu-img check "${CONFIG_QEMU_ROOTFS}.qcow2"; then
+	    rm -f "${CONFIG_QEMU_ROOTFS}.qcow2"
 	fi
-	if [ ! -f "qemu.qcow2" ]; then
+	if [ ! -f "${CONFIG_QEMU_ROOTFS}.qcow2" ]; then
 	    echo "Creating qcow2 disk image for Qemu ..."
 	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
-		     -F qcow2 "qemu.qcow2" > /dev/null
+		     -F raw "${CONFIG_QEMU_ROOTFS}.qcow2" > /dev/null
 	fi
     fi
 
-    read -r qemu <<EOF
+    local qemu
+    read qemu <<EOF
 	$CONFIG_QEMU_MACHINE -nodefaults -m $CONFIG_QEMU_MACHINE_RAM \
 	  $(loader_args) \
 	  $(rootfs_args) \
@@ -341,28 +317,18 @@ run_qemu()
 	  $(gdb_args) \
 	  $CONFIG_QEMU_EXTRA
 EOF
-    # Save resulting command to a script, because I cannot for the life
-    # of me figure out how to embed the JSON snippet for Rocker and run
-    # it here without issues, spent way too much time on it -- Joachim
-    run=$(mktemp -t run.qemu.XXX)
-    echo "#!/bin/sh" > "$run"
-    if [ "$CONFIG_QEMU_KERNEL" ]; then
-	echo "$qemu -append \"$(append_args)\" $*" >> "$run"
-    else
-	echo "$qemu $*" >> "$run"
-    fi
-    chmod +x "$run"
 
     echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
     line=$(stty -g)
     stty raw
-    $run
-    stty "$line"
-    if [ -n "$keep" ]; then
-	echo "Keeping generated qemu.run script: $run"
+
+    if [ "$CONFIG_QEMU_KERNEL" ]; then
+	$qemu -append "$(append_args)" "$@"
     else
-	rm "$run"
+	$qemu "$@"
     fi
+
+    stty "$line"
 }
 
 dtb_args()
@@ -398,7 +364,7 @@ generate_dot()
     hostports="<qtap1> qtap1"
     targetports="<e1> e1"
     edges="host:qtap1 -- target:e1 [kind=mgmt];"
-    for tap in $(seq 2 $((CONFIG_QEMU_NET_TAP_N - 1))); do
+    for tap in $(seq 2 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
 	hostports="$hostports | <qtap$tap> qtap$tap "
 	targetports="$targetports | <e$tap> e$tap "
 	edges="$edges host:qtap$tap -- target:e$tap;"
@@ -438,8 +404,7 @@ menuconfig()
     exec kconfig-mconf Config.in
 }
 
-scriptdir=$(dirname "$(readlink -f "$0")")
-cd "$scriptdir" || (echo "Failed cd to $scriptdir"; exit 1)
+cd $(dirname $(readlink -f "$0"))
 
 while [ "$1" != "" ]; do
     case $1 in
@@ -449,9 +414,6 @@ while [ "$1" != "" ]; do
 	-h)
 	    usage
 	    ;;
-	-k)
-	    keep=true
-	    ;;
 	*)
 	    break
     esac

board/common/rootfs/etc/avahi/avahi-autoipd.action

@@ -9,20 +9,46 @@
 #   $3 IP adddress
 
 PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
+NAME="/etc/frr/static.d/$2-zeroconf.conf"
+NEXT="${NAME}+"
 
 log()
 {
     logger -I $$ -t zeroconf -p user.notice "$*"
 }
 
+# Reduce changes needed by comparing with previous route(s)
+act()
+{
+    case $1 in
+	add)
+	    echo "! Generated by avahi-autoipd"  > "$NEXT"
+	    echo "ip route 0.0.0.0/0 $2 254"    >> "$NEXT"
+	    cmp -s "$NAME" "$NEXT" && return
+	    mv "$NEXT" "$NAME"
+	    ;;
+	del)
+	    [ -f "$NAME" ] || return
+	    rm "$NAME"
+	    ;;
+	*)
+	    return
+	    ;;
+    esac
+
+    initctl -nbq restart staticd
+}
+
 case "$1" in
     BIND)
         ip addr flush dev "$2" proto random
         ip addr add "$3"/16 brd 169.254.255.255 scope link dev "$2" proto random
+	act add "$2"
 	log "set ipv4ll $3 on iface $2"
         ;;
 
     CONFLICT|UNBIND|STOP)
+	act del "$2"
         ip addr flush dev "$2" proto random
 	log "clr ipv4ll on iface $2"
         ;;

board/common/rootfs/etc/bash.bashrc

@@ -15,34 +15,18 @@ export PROMPT_COMMAND=prompt_command
 # update the values of LINES and COLUMNS.
 shopt -s checkwinsize
 
-# don't put duplicate lines or lines starting with space in the history.
-export HISTCONTROL=ignoreboth
-
-# append to the history file, don't overwrite it
-shopt -s histappend
-
-# for setting history length see HISTSIZE and HISTFILESIZE in bash(1)
-export HISTSIZE=1000
-export HISTFILESIZE=2000
-
-# case-insensitive filename completion
-bind "set completion-ignore-case on"
-
-# show all completions immediately instead of ringing bell
-bind "set show-all-if-ambiguous on"
-
 log()
 {
     local fn="/var/log/syslog"
     [ -n "$1" ] && fn="/var/log/$1"
-    less +G -r "$fn"
+    less +G "$fn"
 }
 
 follow()
 {
     local fn="/var/log/syslog"
     [ -n "$1" ] && fn="/var/log/$1"
-    less +F -r "$fn"
+    tail -F "$fn"
 }
 
 _logfile_completions()

board/common/rootfs/etc/default/ospfd

@@ -1,2 +0,0 @@
-# --log-level debug
-OSPFD_ARGS="-A 127.0.0.1 -u frr -g frr -f /etc/frr/ospfd.conf --log syslog"

board/common/rootfs/etc/default/rauc

@@ -1 +0,0 @@
-RAUC_ARGS="-s"

board/common/rootfs/etc/default/zebra

@@ -1,2 +0,0 @@
-# --log-level debug
-ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog "

board/common/rootfs/etc/dnsmasq.conf

@@ -3,19 +3,16 @@
 # and similar events feed servers and configuration to dnsmasq.
 domain-needed
 
-# Allow configuration and cache clear over D-Bus
-enable-dbus
+# Only listen to loopback (local system)
+interface=lo
+bind-dynamic
+#listen-address=127.0.0.1,::1
 
-# Disable the following dnsmasq default DHCP options
-#dhcp-option=option:netmask
-#dhcp-option=28			# option:broadcast
-#dhcp-option=option:domain-name
-dhcp-option=option:router
-dhcp-option=option:dns-server
-dhcp-option=12			# option:hostname
+enable-dbus
 
 # Generated by openresolv
 resolv-file=/var/lib/misc/resolv.conf
 
 # Include all files in a directory which end in .conf
 conf-dir=/etc/dnsmasq.d/,*.conf
+

board/common/rootfs/etc/finit.d/available/container@.conf

@@ -1,7 +1,4 @@
-# Start a container instance (%i) and redirect logs to /log/container
-# Give podman enough time to properly shut down the container, kill:30
-# The pre:script, which is responsibe for fetching a remote image, must
-# not have a timeout.  The cleanup should take no longer than a minute.
-sysv    log:prio:local1,tag:%i kill:30 pid:!/run/container:%i.pid \
-	pre:0,/usr/sbin/container cleanup:60,/usr/sbin/container   \
-	[2345] <!> :%i container -n %i -- container %i
+service :%i pid:!/run/k8s-logger-%i.pid <usr/container:%i> \
+	[2345] k8s-logger -cni %i -f local1 /run/containers/%i.fifo -- Logger for container %i
+sysv    :%i pid:!/run/container:%i.pid <pid/k8s-logger:%i> log kill:10 \
+	[2345] container -n %i -- container %i

board/common/rootfs/etc/finit.d/available/mstpd.conf

@@ -1,9 +0,0 @@
-# A single mstpd instance can manage multiple bridges, which are
-# dynamically added/removed by the kernel via the /sbin/bridge-stp
-# usermode helper. We use a manual service so that confd can
-# enable/disable it without an initctl barrier, since it needs to
-# already be running when a bridge interface with spanning tree
-# enabled is created.
-
-service env:-/etc/default/mstpd manual:yes \
-	 [S0123456789] mstpd $MSTPD_ARGS -- Spanning Tree daemon

board/common/rootfs/etc/finit.d/available/netconf.conf

@@ -1,3 +0,0 @@
-service name:netopeer notify:none log env:/etc/default/confd \
-	[12345] <pid/confd> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
-	-- NETCONF server

board/common/rootfs/etc/finit.d/available/rauc.conf

@@ -1,5 +1,5 @@
 set G_MESSAGES_DEBUG=nocolor
 service [2345] <service/dbus/running> \
-	env:-/etc/default/rauc  \
+	env:-/etc/default/rauc log:prio:user.notice \
 	rauc service $RAUC_ARGS -- Software update service
 

board/common/rootfs/etc/finit.d/available/sysklogd.conf

@@ -1,4 +0,0 @@
-# Use <pid/syslogd> as barrier for other system tasks and service that
-# rely on modules, firmware, and device nodes to be ready.
-service if:udevd nowarn env:-/etc/default/sysklogd <run/udevadm:post/success> \
-	[S0123456789] syslogd -8 -F $SYSLOGD_ARGS -- System log daemon

board/common/rootfs/etc/finit.d/available/ttyd.conf

@@ -1 +1 @@
-service [2345] <!> ttyd -i lo -W -p 8001 login -- Web terminal daemon (ttyd)
+service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)

board/common/rootfs/etc/finit.d/available/wifi@.conf

@@ -1,5 +0,0 @@
-service name:wpa_supplicant :%i \
-			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
-			       -- WPA supplicant @%i
-
-task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i

board/common/rootfs/etc/finit.d/enabled/mstpd.conf

@@ -1 +0,0 @@
-../available/mstpd.conf

board/common/rootfs/etc/finit.d/enabled/netconf.conf

@@ -1 +0,0 @@
-../available/netconf.conf

board/common/rootfs/etc/inputrc

@@ -1,66 +0,0 @@
-# /etc/inputrc - global inputrc for libreadline
-
-# Be 8 bit clean.
-set input-meta on
-set output-meta on
-
-# To allow the use of 8bit-characters like the german umlauts, uncomment
-# the line below. However this makes the meta key not work as a meta key,
-# which is annoying to those which don't need to type in 8-bit characters.
-
-# set convert-meta off
-
-# try to enable the application keypad when it is called.  Some systems
-# need this to enable the arrow keys.
-# set enable-keypad on
-
-# see /usr/share/doc/bash/inputrc.arrows for other codes of arrow keys
-
-# do not bell on tab-completion
-# set bell-style none
-# set bell-style visible
-
-# some defaults / modifications for the emacs mode
-$if mode=emacs
-
-# allow the use of the Home/End keys
-"\e[1~": beginning-of-line
-"\e[4~": end-of-line
-
-# allow the use of the Delete/Insert keys
-"\e[3~": delete-char
-"\e[2~": quoted-insert
-
-# mappings for "page up" and "page down" to step to the beginning/end
-# of the history
-# "\e[5~": beginning-of-history
-# "\e[6~": end-of-history
-
-# alternate mappings for "page up" and "page down" to search the history
-"\e[5~": history-search-backward
-"\e[6~": history-search-forward
-
-# mappings for Ctrl-left-arrow and Ctrl-right-arrow for word moving
-"\e[1;5C": forward-word
-"\e[1;5D": backward-word
-"\e[5C": forward-word
-"\e[5D": backward-word
-"\e\e[C": forward-word
-"\e\e[D": backward-word
-
-$if term=rxvt
-"\e[7~": beginning-of-line
-"\e[8~": end-of-line
-"\eOc": forward-word
-"\eOd": backward-word
-$endif
-
-# for non RH/Debian xterm, can't hurt for RH/Debian xterm
-# "\eOH": beginning-of-line
-# "\eOF": end-of-line
-
-# for freebsd console
-# "\e[H": beginning-of-line
-# "\e[F": end-of-line
-
-$endif

board/common/rootfs/etc/machine-id

@@ -1 +0,0 @@
-/var/lib/dbus/machine-id

board/common/rootfs/etc/motd

@@ -1,4 +1,4 @@
 .-------.
-|  . .  | Infix OS — Immutable.Friendly.Secure
+|  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.org
 '-'---'-'

board/common/rootfs/etc/profile.d/alias.sh

@@ -1 +1,2 @@
 alias cli='clish'
+alias cfg='sysrepocfg -f json'

board/common/rootfs/etc/ssh/sshd_config.d/var-keys.conf

@@ -0,0 +1,3 @@
+HostKey /var/lib/ssh/ssh_host_rsa_key
+HostKey /var/lib/ssh/ssh_host_ecdsa_key
+HostKey /var/lib/ssh/ssh_host_ed25519_key

board/common/rootfs/etc/sysctl.d/forwarding.conf

@@ -0,0 +1,3 @@
+net.ipv4.ip_forward=1
+net.ipv4.ip_forward_update_priority=0
+net.ipv6.conf.all.forwarding=1

board/common/rootfs/etc/sysctl.d/ipv4.conf

@@ -1,32 +1 @@
-# Router defaults
-net.ipv4.conf.default.rp_filter=0
-net.ipv4.conf.all.rp_filter=0
-
-net.ipv4.conf.lo.rp_filter=0
-
-net.ipv4.icmp_errors_use_inbound_ifaddr=1
-net.ipv4.conf.all.ignore_routes_with_linkdown=1
-
-# Use neigh information on selection of nexthop for multipath hops
-net.ipv4.fib_multipath_use_neigh=1
-
-# Sane ARP defaults for a switch/router
-net.ipv4.conf.default.arp_announce=2
-net.ipv4.conf.all.arp_announce=2
-
-net.ipv4.conf.default.arp_notify=1
-net.ipv4.conf.all.arp_notify=1
-
-net.ipv4.conf.default.arp_ignore=1
-net.ipv4.conf.all.arp_ignore=1
-
-# IP Routing
-net.ipv4.ip_forward=1
-net.ipv4.ip_forward_update_priority=0
-
 net.ipv4.conf.all.forwarding=0
-net.ipv4.conf.default.forwarding=0
-
-# Multicast group subscriptions
-net.ipv4.igmp_max_memberships=1000
-net.ipv4.neigh.default.mcast_solicit=10

board/common/rootfs/etc/sysctl.d/ipv6.conf

@@ -1,23 +1,5 @@
-# Router defaults
-net.ipv6.route.max_size=131072
-net.ipv6.conf.all.ignore_routes_with_linkdown=1
-
-# IP Routing is disabled by default, enabled globally, and per
-# interface, for each interface in confd.  See also accept_ra.
-net.ipv6.conf.all.forwarding=0
+net.ipv6.conf.all.forwarding=1
 net.ipv6.conf.default.forwarding=0
-
-# Accept router advertisements even when forwarding is enabled
-net.ipv6.conf.all.accept_ra=2
-net.ipv6.conf.default.accept_ra=2
-
-# IPv6 SLAAC
 net.ipv6.conf.all.autoconf=0
 net.ipv6.conf.default.autoconf=0
-
-# Keep permanent addresses on an admin down
-net.ipv6.conf.all.keep_addr_on_down=1
 net.ipv6.conf.default.keep_addr_on_down=1
-
-# Multicast group subscriptions
-net.ipv6.mld_max_msf=512

board/common/rootfs/etc/sysctl.d/readme.txt

@@ -1,145 +0,0 @@
-Many of the defaults here are are taken from the Frr recommendations [1].
-Below are relevant excerpts from the kernel documentation.
-
-
-accept_ra, accept Router Advertisements; autoconfigure using them, also
-           determines whether or not to transmit Router Solicitations.
-           If and only if the functional setting is to accept Router
-           Advertisements, Router Solicitations will be transmitted.
-
-  0 - Do not accept Router Advertisements.
-
-  1 - Accept Router Advertisements if forwarding is disabled.
-
-  2 - Overrule forwarding behaviour. Accept Router Advertisements even
-      if forwarding is enabled.
-
-  Default:
-    - enabled if local forwarding is disabled
-    - disabled if local forwarding is enabled
-
-
-accept_ra_pinfo, learn Prefix Information in Router Advertisement.
-
-   Default:
-    - enabled if accept_ra is enabled
-    - disabled if accept_ra is disabled
-
-
-autoconf, autoconfigure IPv6 addresses using Prefix Information in
-          Router Advertisements.
-
-   Default:
-    - enabled if accept_ra_pinfo is enabled
-    - disabled if accept_ra_pinfo is disabled
-
-
-arp_announce, define restriction level for announcing the local source
-              address from IP packets in ARP requests sent on interface:
-
-  0 - (default) Use any local address, configured on any interface
-
-  1 - Try to avoid local addresses that are not in the target’s subnet
-      for this interface.  Useful when target hosts reachable via this
-      interface require the source IP address in ARP requests to be part
-      of their logical network configured on the receiving interface.
-      When we generate the request we will check all our subnets that
-      include the target IP and will preserve the source address if it
-      is from such subnet. If there is no such subnet we select source
-      address according to the rules for level 2.
-
-  2 - Always use the best local address for this target. In this mode we
-      ignore the source address in the IP packet and try to select local
-      address that we prefer for talks with the target host. Such local
-      address is selected by looking for primary IP addresses on all our
-      subnets on the outgoing interface that include the target address.
-      If no suitable local address is found we select the first local
-      address we have on the outgoing interface or on all other
-      interfaces, with the hope we will receive reply for our request
-      and even sometimes no matter the source IP address we announce.
-
-
-arp_notify, define mode for notification of address and device changes.
-
-  0 - (default): do nothing
-  1 - generate gratuitous arp requests when device is brought up or
-      hardware address changes.
-
-
-arp_ignore, define different modes for sending replies in response to
-            received ARP requests that resolve local target addresses:
-
-  0 - (default): reply for any local target IP address, configured on
-      any interface
-
-  1 - reply only if the target IP address is a local address configured
-      on the incoming interface
-
-  2 - reply only if the target IP address is local address configured on
-      the incoming interface and both with the sender’s IP address are part
-      from same subnet on this interface
-
-  3 - do not reply for local addresses configured with scope host, only
-      resolutions for global and link addresses are replied
-
-  4-7 - reserved
-
-  8 - do not reply for all local addresses
-
-
-arp_accept, define behavior for accepting gratuitous ARP (garp) frames
-      from devices that are not already present in the ARP table:
-
-  0 - don’t create new entries in the ARP table
-
-  1 - create new entries in the ARP table
-
-  2 - create new entries only if the source IP address is in the same
-      subnet as an address configured on the interface that received
-      the garp message.
-
-  Both replies and requests type gratuitous arp will trigger the ARP
-  table to be updated, if this setting is on.  If the ARP table already
-  contains the IP address of the gratuitous arp frame, the arp table
-  will be updated regardless if this setting is on or off.
-
-
-icmp_errors_use_inbound_ifaddr
-
-  0 - (default): icmp error messages are sent with the primary address
-      of the exiting interface.
-
-  1 - the message will be sent with the primary address of the interface
-      that received the packet that caused the icmp error. This is the
-      behaviour many network administrators will expect from a router.
-      And it can make debugging complicated network layouts much easier.
-
-  Note, if no primary address exists for the interface selected, then
-  the primary address of the first non-loopback interface that has one
-  will be used regardless of this setting.
-
-
-rp_filter, reverse path source filtering:
-
-  0 - (default): no source validation.
-
-  1 - Strict mode as defined in RFC3704, 'Strict Reverse Path'.  Each
-      incoming packet is tested against the FIB and if the interface is
-      not the best reverse path the packet check will fail.  By default
-      failed packets are discarded.
-
-  2 - Loose mode as defined in RFC3704, 'Loose Reverse Path'.  Each
-      incoming packet’s source address is also tested against the FIB
-      and if the source address is not reachable via any interface the
-      packet check will fail.
-
-  Current recommended practice in RFC3704 is to enable strict mode to
-  prevent IP spoofing from DDos attacks. If using asymmetric routing or
-  other complicated routing, then loose mode is recommended.
-
-  The max value from conf/{all,interface}/rp_filter is used when doing
-  source validation on the {interface}.
-
-
-
-[1]: https://github.com/FRRouting/frr/blob/master/doc/user/Useful_Sysctl_Settings.md

board/common/rootfs/etc/udev/rules.d/70-rename-wifi.rules

@@ -1 +0,0 @@
-SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"

board/common/rootfs/etc/watchdogd.conf

@@ -1,165 +0,0 @@
-# /etc/watchdogd.conf sample
-# Commented out values are program defaults.
-#
-# The checker/monitor `warning` and `critical` levels are 0.00-1.00,
-# i.e. 0-100%, except for load average which can vary a lot between
-# systems and use-cases, not just because of the number of CPU cores.
-# Use the `script = ...` setting to call script when `warning` and
-# `critical` are reached for a monitor.  In `critical` the monitor
-# otherwise triggers an unconditional reboot.
-#
-# NOTE: `critical` is optional, omitting it disables the reboot action.
-#
-
-### Watchdogs ##########################################################
-# Global settings that can be overridden per watchdog
-
-# Do not set WDT timeout and kick interval too low, the daemon runs at
-# SCHED_OTHER level with all other tasks, unless the process supervisor
-# is enabled.  The monitor plugins (below) need CPU time as well.
-#timeout   = 20
-#interval  = 10
-
-# With safe-exit enabled (true) the daemon will ask the driver disable
-# the WDT before exiting (SIGINT).  However, some WDT drivers (or HW)
-# may not support this.
-#safe-exit = true
-
-# Multiple watchdogs can be kicked, the default, even if no .conf file
-# is found or device node given on the command line, is /dev/watchdog
-device /dev/watchdog {
-    timeout    = 60
-    interval   = 5
-    safe-exit  = true
-}
-
-#device /dev/watchdog2 {
-#    timeout    = 20
-#    interval   = 10
-#    safe-exit  = true
-#}
-
-### Supervisor #########################################################
-# Instrumented processes can have their main loop supervised.  Processes
-# subscribe to this service using the libwdog API, see the docs for more
-# on this.  When the supervisor is enabled and the priority is set to a
-# value > 0, watchdogd runs as a SCHED_RR process with elevated realtime
-# priority.  When disabled, or the priority is set to zero (0), it runs
-# as a regular SCHED_OTHER process, this is the default.
-#
-# When a supervised process fails to meet its deadline, the daemon will
-# perform an unconditional reset having saved the reset reason.  If a
-# script is provided in this section it will be called instead.  The
-# script is called as:
-#
-#    script.sh supervisor CODE PID LABEL
-#
-# Availabel CODEs for the reset reason are avilable in wdog.h
-#
-#supervisor {
-#    !!!REMEMBER TO ENABLE reset-reason (below) AS WELL!!!
-#    enabled  = true
-#    priority = 98
-#    script = "/path/to/supervisor-script.sh"
-#}
-
-### Reset reason #######################################################
-# The following section controls if/how the reset reason & reset counter
-# is tracked.  By default this is disabled, since not all systems allow
-# writing to disk, e.g. embedded systems using MTD devices with limited
-# number of write cycles.
-#
-# The default file setting is a non-volatile path, according to the FHS.
-# It can be changed to another location, but make sure that location is
-# writable first.
-reset-reason {
-    enabled = true
-    file    = "/var/lib/misc/watchdogd.state"
-}
-
-### Checkers/Monitors ##################################################
-#
-# Script or command to run instead of reboot when a monitor plugin
-# reaches any of its critical or warning level.  Setting this will
-# disable the built-in reboot on critical, it is therefore up to the
-# script to perform reboot, if needed.  The script is called as:
-#
-#    script.sh {filenr, fsmon, loadavg, meminfo} {crit, warn} VALUE
-#
-#script = "/path/to/reboot-action.sh"
-
-# Monitors file descriptor leaks based on /proc/sys/fs/file-nr
-filenr {
-#    enabled = true
-    interval = 300
-    logmark  = false
-    warning  = 0.9
-    critical = 1.0
-#    script = "/path/to/alt-reboot-action.sh"
-}
-
-# Monitors a file system, blocks and inode usage against watermarks
-# The script is called with fsmon as the first argument and there
-# are two environment variables FSMON_NAME, for the monitored path,
-# and FSMON_TYPE indicating either 'blocks' or 'inodes'.
-#fsmon /var {
-#    enabled = true
-#    interval = 300
-#    logmark  = false
-#    warning  = 0.95
-#    critical = 1.0
-#    script = "/path/to/alt-reboot-action.sh"
-#}
-
-# Monitors load average based on sysinfo() from /proc/loadavg
-# The level is composed from the average of the 1 and 5 min marks.
-loadavg {
-#    enabled = true
-    interval = 300
-    logmark  = false
-    warning  = 1.0
-    critical = 2.0
-#    script = "/path/to/alt-reboot-action.sh"
-}
-
-# Monitors free RAM based on data from /proc/meminfo
-meminfo {
-#    enabled = true
-    interval = 300
-    logmark  = false
-    warning  = 0.9
-    critical = 0.95
-#    script = "/path/to/alt-reboot-action.sh"
-}
-
-# Monitor temperature.  The critical value is unset by default, so no
-# action is taken at that watermark (by default).  Both the critical and
-# warning watermarks are relative to the trip/critical/max value from
-# sysfs.  The warning is default 0.9, i.e., 90% of critical.  Use script
-# to to reset the fan controller or poweroff(8) the system.
-#
-# Each temp monitor caches the last 10 values, calculates the mean, and
-# compares that to the warning and critical levels.  Logging is only
-# done every 10 x interval (if enabled).
-#tempmon /sys/class/hwmon/hwmon0/temp1_input {
-#    enabled  = true
-#    interval = 30
-#    warning  = 0.9
-#    critical = 0.95
-#    logmark  = true
-#    script   = "/script/to/log/and/poweroff.sh"
-#}
-
-# Monitor a generic script, executes 'monitor-script' every 'interval'
-# seconds, with a max runtime of 'timeout' seconds.  When the exit code
-# of the monitor script is above the critical level watchdogd either
-# starts the reboot, or calls the alternate 'script' to determin the
-# next cause of action.
-#generic /path/to/monitor-script.sh {
-#    enabled = true
-#    interval = 300
-#    timeout = 60
-#    warning  = 1
-#    critical = 10
-#    script = "/path/to/alt-reboot-action.sh"
-#}

board/common/rootfs/usr/bin/cfg

@@ -1,58 +0,0 @@
-#!/bin/sh
-# User-friendly wrapper for sysrepocfg
-# TODO: add import/export, copy, ...
-
-# Edit YANG binary types using sysrepo, base64, and duct tape.
-edit()
-{
-    xpath=$1
-    if [ -z "$xpath" ]; then
-	echo "Usage: cfg edit \"/full/xpath/to/binary/leaf\""
-	exit 1
-    fi
-
-    if tmp=$(sysrepocfg -G "$xpath"); then
-	file=$(mktemp)
-
-	echo "$tmp" | base64 -d > "$file"
-	if /usr/bin/editor "$file"; then
-	    tmp=$(base64 -w0 < "$file")
-	    sysrepocfg -S "$xpath" -u "$tmp"
-	fi
-
-	rm -f "$file"
-    else
-	echo "Failed to retrieve value for $xpath"
-	exit 1
-    fi
-}
-
-usage()
-{
-    echo "Usage:"
-    echo "    cfg CMD [ARG]"
-    echo
-    echo "Command:"
-    echo "    edit XPATH   Edit YANG binary type"
-    echo "    help         This help text"
-    echo
-    echo "As a backwards compatible fallback, this script forwards"
-    echo "all other commands as options to sysrepocfg."
-    echo
-
-    exit 0
-}
-
-cmd=$1; shift
-case $cmd in
-    edit)
-	edit "$1"
-	;;
-    help)
-	usage
-	;;
-    *)
-	set -- "$cmd" "$@"
-	exec sysrepocfg -f json "$@"
-	;;
-esac

board/common/rootfs/usr/bin/dir

@@ -21,11 +21,7 @@ dir()
 if [ -d "$1" ]; then
     dir "$1"
 else
-    if [ "$USER" = "root" ]; then
-	dir "$HOME"
-    else
-	dir "/home/$USER"
-    fi
+    dir "$HOME"
     dir "/cfg"
     dir "/log"
 fi

board/common/rootfs/usr/bin/pager

@@ -1,15 +0,0 @@
-#!/bin/sh
-# -d ;; suppress error message "the terminal is dumb"
-# -F :: exit if the entire file can be displayed on the first screen
-# -I :: Ignore case, even for patterns
-# -K :: exit immediately when an interrupt character (usually ^C) is typed
-# -R :: Almost raw control charachters, only ANSI color escape sequences and
-#       OSC 8 hyperlink sequences are output.  Allows veritcal scrolling
-# -r :: Causes "raw" control characters to be displayed, including unicode.
-# -X :: No termcap initialization and deinitialization set to the terminal.
-#       This is what leaves the contents of the output on screen.
-
-export LESS="-P %f (press h for help or q to quit)"
-export LANG=en_US.UTF-8
-
-less -rIKd -FX "$@"

board/common/rootfs/usr/bin/pager

@@ -0,0 +1 @@
+less

board/common/rootfs/usr/bin/show

@@ -70,14 +70,12 @@ options:
   -p            Show plain output, no bells or whistles
 
 commands:
-  dhcp          Show DHCP server
   port PORT     Show port configuration and link information
   ports         Show ports available for bridging
   vlans         Show port groups in bridge
   ifaces        Show interfaces and their addresses
   fdb           Show forwarding database (unicast)
   mdb           Show multicast forwarding database
-  stp           Show spanning tree status
   ip   addr     Show IPv4 addresses
        route    Show routing table
   ipv6 addr     Show IPv6 addresses
@@ -89,41 +87,6 @@ commands:
 EOF
 }
 
-is_dhcp_running()
-{
-    sysrepocfg -X -f json -m infix-dhcp-server | jq -r '
-        ."infix-dhcp-server:dhcp-server".enabled as $global |
-        if ."infix-dhcp-server:dhcp-server".subnet? then
-                (."infix-dhcp-server:dhcp-server".subnet[] |
-                select(.enabled != false)) |
-                if $global != false and . then "true" else "false" end
-        else "false" end
-    ' 2>/dev/null | grep -q true
-}
-
-dhcp()
-{
-    if ! is_dhcp_running; then
-	echo "DHCP server not enabled."
-	exit 0
-    fi
-
-    case $1 in
-	detail)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
-		jq -C .
-	    ;;
-	stat*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
-		/usr/libexec/statd/cli-pretty "show-dhcp-server" -s
-	    ;;
-	*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
-		/usr/libexec/statd/cli-pretty "show-dhcp-server"
-	    ;;
-    esac
-}
-
 # Usage 1: show port eth0
 # Usage 2: show port
 # Usage 3: show ports
@@ -225,12 +188,6 @@ rstp()
     mstpctl showport br0
 }
 
-stp()
-{
-    sysrepocfg -f json -X -d operational -m ietf-interfaces | \
-        /usr/libexec/statd/cli-pretty "show-bridge-stp"
-}
-
 fdb()
 {
     bridge $bopt fdb show
@@ -331,9 +288,6 @@ case $cmd in
     help)
 	usage
 	;;
-    dhcp | dhcp-server)
-	dhcp $*
-	;;
     port*)
 	ports $*
 	;;
@@ -399,9 +353,6 @@ case $cmd in
     span*)
 	rstp
 	;;
-    stp*)
-	stp
-	;;
     sys*)
 	system
 	;;

board/common/rootfs/usr/lib/finit/system/20-hw-wait.conf

@@ -1,9 +0,0 @@
-# Extend finit's default udevadm settle synchronization for situations
-# where device are very slow to probe (see #685)
-run nowarn if:udevd cgroup.init <service/udevd/ready> log \
-	[S] /usr/libexec/infix/hw-wait -- Probing hardware
-
-# Now that everything should be probed, do a final pass over the
-# uevent queue before starting syslogd and everything else
-run nowarn if:udevd cgroup.init :post <service/udevd/ready> log \
-	[S] udevadm settle -t 30 --

board/common/rootfs/usr/lib/tmpfiles.d/frr.conf

@@ -1,2 +1 @@
 d /var/run/frr 0755 frr frr -
-R /var/tmp/frr -    -   -   -

board/common/rootfs/usr/libexec/infix/has-quirk

@@ -1,49 +0,0 @@
-#!/bin/bash
-
-IFQUIRKSFILE=${IFQUIRKSFILE:-/etc/product/interface-quirks.json}
-
-if [ $# -lt 2 ]; then
-        echo "usage: $0 <quirk-name> <ifname>"
-        exit 1
-fi
-
-quirk=$1
-ifname=$2
-
-[ -f "$IFQUIRKSFILE" ] || { echo false && exit; }
-
-match()
-{
-    jq -e  \
-       --arg quirk "$quirk" --arg pattern "$1" \
-       '.[$pattern][$quirk]' "$IFQUIRKSFILE" >/dev/null || return
-
-    echo true
-    exit 0
-}
-
-ethtoolmatch()
-{
-    local pattern="${1#@ethtool:}"
-
-    grep -qFxvf \
-	 <(ethtool -i "$ifname") \
-	 <(echo -n "$pattern" | awk -v FS="=" -v RS=";" '{ printf("%s: %s\n", $1, $2); }') \
-	&& return
-
-    match "@ethtool:$pattern"
-}
-
-
-for pattern in $(jq -r 'keys[]' "$IFQUIRKSFILE"); do
-    case "$pattern" in
-	@ethtool:*)
-	    ethtoolmatch "$pattern"
-	    ;;
-	"$ifname")
-	    match "$ifname"
-	    ;;
-    esac
-done
-
-echo "false"

board/common/rootfs/usr/libexec/infix/hw-wait

@@ -1,41 +0,0 @@
-#!/bin/sh
-# (Ab)use the kernel's device link subsystem to detect consumer side
-# devices that may be very slow to probe (looking at you, mv88e6xxx!).
-
-ident=$(basename "$0")
-
-report()
-{
-    if [ -r "/tmp/$ident" ]; then
-	logger -k -p "user.$1" -t "$ident" "Waited for slow devices:"
-	sort "/tmp/$ident" | uniq -c | logger -k -p "user.$1" -t "$ident"
-    fi
-
-    rm -f "/tmp/$ident"
-}
-
-for _ in $(seq 50); do
-    again=
-
-    for dl in /sys/class/devlink/*; do
-    	[ -r "$dl/status" ] || continue
-
-    	status=$(cat "$dl/status")
-	if [ "$status" = "consumer probing" ]; then
-	    basename "$(readlink "$dl/consumer")" >>"/tmp/$ident"
-	    again=yes
-	fi
-
-    done
-
-    if [ -z "$again" ]; then
-	report notice
-	exit 0
-    fi
-
-    sleep .2
-done
-
-logger -k -p user.error -t "$ident" "Timeout waiting for devices to come online"
-report error
-exit 1

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -8,11 +8,10 @@ import struct
 import subprocess
 import sys
 
-onieprom = importlib.machinery.SourceFileLoader("onieprom", "/bin/onieprom").load_module()
-SYSTEM_JSON = "/run/system.json"
+onieprom = importlib.machinery.SourceFileLoader("onieprom","/bin/onieprom").load_module()
+SYSTEM_JSON   = "/run/system.json"
 KKIT_IANA_PEM = 61046
 
-
 class DTSystem:
     BASE = "/sys/firmware/devicetree/base"
     INFIX = BASE + "/chosen/infix"
@@ -29,9 +28,7 @@ class DTSystem:
             if not os.path.exists(phandle):
                 continue
 
-            with open(phandle, "rb") as f:
-                data = f.read()
-            ph, = struct.unpack(">L", data)
+            ph, = struct.unpack(">L", open(phandle, "rb").read())
             dt[ph] = root
 
         sys = {}
@@ -43,18 +40,14 @@ class DTSystem:
             if not os.path.exists(phandle):
                 continue
 
-            with open(phandle, "rb") as f:
-                data = f.read()
-            ph, = struct.unpack(">L", data)
+            ph, = struct.unpack(">L", open(phandle, "rb").read())
             if ph not in sys:
                 sys[ph] = []
             sys[ph].append(root)
 
         phs = set(list(dt.keys()) + list(sys.keys()))
 
-        self.devs = {ph: [Device(ph, dt.get(ph), s if s is not None else "")
-                          for s in (sys.get(ph) or []) if ph is not None]
-                     for ph in phs}
+        self.devs = { ph: [Device(ph, dt.get(ph), s if s is not None else "") for s in (sys.get(ph) or []) if ph is not None]  for ph in phs }
         self.base = Device(0, None, DTSystem.BASE)
         self.infix = Device(0, None, DTSystem.INFIX)
 
@@ -63,8 +56,7 @@ class DTSystem:
         if not os.path.exists(path):
             return ()
 
-        with open(path, "rb") as f:
-            data = f.read()
+        data = open(path, "rb").read()
         elems = len(data) // struct.calcsize(">L")
         return struct.unpack(">" + elems * "L", data)
 
@@ -77,8 +69,7 @@ class DTSystem:
                 return {}
 
             try:
-                with open(dev.attrpath("nvmem"), "rb", 0) as f:
-                    data = onieprom.from_tlv(f)
+                data = onieprom.from_tlv(open(dev.attrpath("nvmem"), "rb", 0))
             except:
                 data = {}
 
@@ -93,18 +84,14 @@ class DTSystem:
         }
 
     def infix_usb_devices(self, out):
-        names = self.infix.str_array("usb-port-names", ())
-        phs = self.__get_phandle_array("usb-ports")
-        data = dict(zip(names, phs))
+        names=self.infix.str_array("usb-port-names", ())
+        phs=self.__get_phandle_array("usb-ports")
+        data=dict(zip(names,phs))
         if data != {}:
             out["usb-ports"] = []
-        for name, ph in data.items():
-            [out["usb-ports"].extend([{
-                "name": name,
-                "path": dev.attrpath("authorized")}, {
-                    "name": name,
-                    "path": dev.attrpath("authorized_default")
-                }]) for dev in self.devices_from_ph(ph)]
+        for name,ph in data.items():
+            [out["usb-ports"].extend([{"name": name, "path": dev.attrpath("authorized")}, {"name": name, "path": dev.attrpath("authorized_default")}]) for dev in self.devices_from_ph(ph)]
+
 
     def infix_devices(self, kind):
         phs = self.__get_phandle_array(kind)
@@ -114,7 +101,6 @@ class DTSystem:
         flat_devices = [device for sublist in self.infix_devices("vpds") for device in sublist]
         return [self.into_vpd(device) for device in flat_devices]
 
-
 class QEMUSystem:
     BASE = "/sys/firmware/qemu_fw_cfg"
     REV = BASE + "/rev"
@@ -124,8 +110,7 @@ class QEMUSystem:
         data = {}
         if os.path.exists(QEMUSystem.VPD):
             try:
-                with open(QEMUSystem.VPD, "rb", 0) as f:
-                    data = onieprom.from_tlv(f)
+                data = onieprom.from_tlv(open(QEMUSystem.VPD, "rb", 0))
             except:
                 pass
 
@@ -142,27 +127,31 @@ class QEMUSystem:
     def usb_ports(self):
         ports = [
             {
-                "name": "USB",
-                "path": "/sys/bus/usb/devices/usb1/authorized"
-            }, {
-                "name": "USB",
-                "path": "/sys/bus/usb/devices/usb1/authorized_default"
-            }, {
-                "name": "USB2",
-                "path": "/sys/bus/usb/devices/usb2/authorized"
-            }, {
-                "name": "USB2",
-                "path": "/sys/bus/usb/devices/usb2/authorized_default"
-            }]
+            "name": "USB",
+            "path": "/sys/bus/usb/devices/usb1/authorized"
+
+        },
+        {
+            "name": "USB",
+            "path": "/sys/bus/usb/devices/usb1/authorized_default"
+
+        },
+        {
+            "name": "USB2",
+            "path": "/sys/bus/usb/devices/usb2/authorized"
+        },
+        {
+            "name": "USB2",
+            "path": "/sys/bus/usb/devices/usb2/authorized_default"
+
+        }]
         return ports
-
-
 class Device:
     def __init__(self, ph, dtpath, syspath):
         self.ph, self.dtpath, self.syspath = ph, dtpath, syspath
 
     def available(self):
-        return self.syspath is not None
+        return self.syspath != None
 
     def __getitem__(self, attr):
         return self.attr(attr).decode("utf-8").strip("\0")
@@ -170,6 +159,7 @@ class Device:
     def __setitem__(self, attr, value):
         return self.attr(attr, val=value.encode("utf-8"))
 
+
     def attrpath(self, attr):
         return os.path.join(self.syspath, attr)
 
@@ -178,16 +168,13 @@ class Device:
 
     def attr(self, attr, default=None, val=None):
         if not self.hasattr(attr):
-            return default if val is None else False
+            return default if val == None else False
 
         if val:
-            with open(self.attrpath(attr), "wb") as f:
-                f.write(val)
+            open(self.attrpath(attr), "wb").write(value)
             return True
 
-        with open(self.attrpath(attr), "rb") as f:
-            data = f.read()
-        return data
+        return open(self.attrpath(attr), "rb").read()
 
     def str(self, attr, default=None):
         val = self.attr(attr)
@@ -207,9 +194,7 @@ class Device:
         if not self.hasdtattr(attr):
             return default
 
-        with open(self.dtattrpath(attr), "rb") as f:
-            data = f.read()
-        return data
+        return open(self.dtattrpath(attr), "rb").read()
 
     def dtstr(self, attr, default=None):
         val = self.dtattr(attr)
@@ -227,7 +212,6 @@ def vpd_get_json_ve(vpd, pem):
 
     return out
 
-
 def vpd_get_pwhash(vpd):
     if not vpd.get("trusted"):
         return None
@@ -235,9 +219,8 @@ def vpd_get_pwhash(vpd):
     kkit = vpd_get_json_ve(vpd, KKIT_IANA_PEM)
     return kkit.get("pwhash")
 
-
 def vpd_inject(out, vpds):
-    out["vpd"] = {vpd["board"]: vpd for vpd in vpds}
+    out["vpd"] = { vpd["board"]: vpd for vpd in vpds }
 
     product = out["vpd"].get("product", {}).get("data", {})
     hoistattrs = ("vendor", "product-name", "part-number", "serial-number", "mac-address")
@@ -251,7 +234,6 @@ def vpd_inject(out, vpds):
             out["factory-password-hash"] = pwhash
             break
 
-
 def qemu_base_mac():
     """Find MAC address of first non-loopback interface, subtract with 1"""
     base_path = '/sys/class/net'
@@ -262,8 +244,7 @@ def qemu_base_mac():
             continue
         try:
             # pylint: disable=invalid-name
-            fn = os.path.join(base_path, iface, 'address')
-            with open(fn, 'r', encoding='ascii') as f:
+            with open(os.path.join(base_path, iface, 'address'), 'r', encoding='ascii') as f:
                 mac = f.read().strip()
             interfaces.append((mac, iface))
         except FileNotFoundError:
@@ -280,7 +261,6 @@ def qemu_base_mac():
 
     return None
 
-
 def probe_qemusystem(out):
     """Probe Qemu based test systems and 'make run'"""
     admin_hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"
@@ -308,54 +288,15 @@ def probe_qemusystem(out):
     subprocess.run("initctl -nbq cond set qemu".split(), check=False)
     return 0
 
-def rasberry_pi_4_usb_ports(out):
-    out["usb-ports"] = [
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized"
-        },
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized_default"
-        },
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-1/authorized",
-        },
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-0:1.0/authorized"
-        },
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized"
-        },
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized_default"
-        },
-        {
-            "name": "USB3",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/2-0:1.0/authorized"
-        }
-    ]
-
 def probe_dtsystem(out):
     """Probe DTS based system, expects a VPD in ONIE PROM format."""
     dtsys = DTSystem()
     vpds = dtsys.infix_vpds()
-
+    dtsys.infix_usb_devices(out)
     model = dtsys.base.str("model")
     if model:
         out["product-name"] = model
 
-    # Since rpi4 has USB on PCIe, there is no phandle reference
-    if model and model.startswith("Raspberry Pi 4"):
-        rasberry_pi_4_usb_ports(out)
-    else:
-        dtsys.infix_usb_devices(out)
-    out["compatible"] = dtsys.base.str_array("compatible")
-
     staticpw = dtsys.infix.str("factory-password-hash")
     if not out["factory-password-hash"]:
         out["factory-password-hash"] = staticpw
@@ -363,7 +304,6 @@ def probe_dtsystem(out):
     vpd_inject(out, vpds)
     return 0
 
-
 def main():
     out = {
         "vendor": None,
@@ -398,6 +338,5 @@ def main():
     shutil.chown(SYSTEM_JSON, user="root", group="wheel")
     return err
 
-
 if __name__ == "__main__":
     sys.exit(main())

board/common/rootfs/usr/libexec/infix/init.d/05-product

@@ -1,50 +1,22 @@
 #!/bin/sh
-# Find, install, and run product specific files and script in /etc
-# before resuming bootstrap.
-#
-# Use /etc/product/init.d/S01-myscript for scripts, may be a symlink, it
-# will be called with `start` as its only argument.
-#
-# The compatible array is listed in the same order as the device tree,
-# most significant to least.  Hence the reverse.[], to ensure overrides
-# are applied in order of significance.
+# Find and install any product specific files in /etc before bootstrap
 ident=$(basename "$0")
 
-PRODUCT_INIT=/etc/product/init.d
 PREFIXD=/usr/share/product
-COMPATIBLES=$(jq -r '.compatible | reverse.[] | ascii_downcase' /run/system.json)
+PRODUCT=$(jq -r '."product-name" | ascii_downcase' /run/system.json)
 
 note()
 {
     logger -I $$ -k -p user.notice -t "$ident" "$1"
 }
 
-found=false
-for PRODUCT in $COMPATIBLES; do
-    DIR="$PREFIXD/$PRODUCT"
-    if [ -d "$DIR" ]; then
-        note "Using vendor/product-specific defaults for $PRODUCT."
-        for dir in "$DIR"/*; do
-            [ -d "$dir" ] && cp -a "$dir" /
-        done
-        found=true
-    fi
+DIR="$PREFIXD/$PRODUCT"
+if [ -z "$PRODUCT" ] || [ ! -d "$DIR" ]; then
+    note "No vendor/product specific directory found, using built-in defaults."
+    exit 0
+fi
+
+note "Using vendor/product specific defaults."
+for dir in "$DIR"/*; do
+    [ -d "$dir" ] && cp -a "$dir" /
 done
-
-if [ "$found" = false ]; then
-    note "No vendor/product-specific directory found, using built-in defaults."
-fi
-
-# Conditions for bootstrap services, this enables product specific
-# init scripts to prevent select services from starting.
-initctl -nbq cond set led
-
-if [ -d "$PRODUCT_INIT" ]; then
-    note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
-    /usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
-fi
-
-# Product specific init done.
-initctl -nbq cond set product
-
-exit 0

board/common/rootfs/usr/libexec/infix/init.d/20-nameif

@@ -14,6 +14,24 @@ for file in /sys/firmware/qemu_fw_cfg/by_name/opt/mactab/raw /etc/mactab; do
 	fi
 done
 
+# Sometimes the sysfs is not populated when the switch driver is loaded, with the result
+# that the DSA interface was not found (no /dsa/tagging entry in sysfs. See issue #685.
+#
+# This mitigates that problem by waiting for sysfs to come up if a DSA switch is found
+if [ -n "$(devlink -j dev info | jq -r '.info.[].driver' | grep -q mv88e6085)" ]; then
+	timeout=50
+	while [ -z "$(ls /sys/class/net/*/dsa/tagging)" ]; do
+		timeout=$((timeout-1))
+		if [ $timeout -eq 0 ]; then
+			logger -k -p user.emerg -t "$ident" "Failed to find DSA interface"
+			exit 1
+		fi
+		sleep 0.1
+	done
+
+	logger -k -p user.notice -t "$ident" "Found DSA interface in $timeout seconds"
+fi
+
 # Find CPU interfaces used for connecting to a switch managed by DSA
 for netif in /sys/class/net/*; do
 	iface=$(basename "$netif")
@@ -34,12 +52,6 @@ ports=$(devlink -j port | jq -r '.port[]
 				 | select(.flavour == "physical")
 				 | .netdev')
 for iface in $ports; do
-	# On systems with multiple switch trees, a port may be _both_
-	# a physical port, registered with devlink, _and_ a DSA
-	# port. In those cases, hold on to our initial "internal"
-	# classification.
-	[ $(ip -j link show dev "$iface" | jq -r '.[0].group') = internal ] && continue
-
 	ip link set "$iface" group port
 done
 

board/common/rootfs/usr/libexec/infix/init.d/25-mqprio

@@ -43,15 +43,10 @@ while [ "$1" ]; do
     txqs="$2"
     shift 2
 
-    [ $(/usr/libexec/infix/has-quirk "broken-mqprio" "$iface") = "true" ] && echo "Skipping $iface, does not support mqprio" && continue
     [ $txqs -lt 2 ] && continue
     [ $txqs -gt 8 ] && txqs=8
 
-    output=$(tc qdisc add dev $iface root mqprio hw 1 \
-		num_tc $txqs $(map $txqs) $(queues $txqs) 2>&1) || true
-    if echo "$output" | grep -q "does not support hardware offload"; then
-        echo "Skipping $iface, hardware offload not supported."
-    elif [ -n "$output" ]; then
-	echo "$output"
-    fi
+    tc qdisc add dev $iface root mqprio hw 1 \
+       num_tc $txqs $(map $txqs) $(queues $txqs) || true
 done
+

board/common/rootfs/usr/libexec/infix/init.d/25-qemu

@@ -1,8 +0,0 @@
-#!/bin/sh
-# Initialize speed/duplex of virtio interfaces
-# For virtual test systems (lacp tests)
-
-ifaces=$(ip -d -json link show | jq -r '.[] | select(.parentbus == "virtio") | .ifname')
-for iface in $ifaces; do
-    ethtool -s "$iface" speed 1000 duplex full
-done

board/common/rootfs/usr/libexec/infix/init.d/30-cfg-migrate

@@ -4,14 +4,10 @@
 # the migrate tool inserts old version in name before .cfg extension.
 CONFIG_FILE="/cfg/startup-config.cfg"
 BACKUP_FILE="/cfg/backup/startup-config.cfg"
-BACKUP_DIR="$(dirname "$BACKUP_FILE")"
-
-mkdir -p         "$BACKUP_DIR"
-chown root:wheel "$BACKUP_DIR"
-chmod 0770       "$BACKUP_DIR"
+mkdir -p "$(dirname "$BACKUP_FILE")"
 
 if [ ! -f "$CONFIG_FILE" ]; then
-    logger -I $$ -k -p user.notice -t $(basename "$0")  "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
+    note "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
     exit 0
 elif migrate -cq "$CONFIG_FILE"; then
     exit 0

board/common/rootfs/usr/libexec/infix/init.d/99-done

@@ -1,2 +1,2 @@
 #!/bin/sh
-exec initctl -bq cond set ixinit
+exec initctl -bq cond set ixinit-done

board/common/rootfs/usr/libexec/infix/mksshkey

@@ -1,24 +0,0 @@
-#!/bin/bash
-# Store and convert RSA PUBLIC/PRIVATE KEYs to be able to use them in
-# OpenSSHd.
-set -e
-
-NAME="$1"
-DIR="$2"
-PUBLIC="$3"
-PRIVATE="$4"
-TMP="$(mktemp)"
-
-echo -e '-----BEGIN RSA PRIVATE KEY-----' > "$DIR/$NAME"
-echo "$PRIVATE" >> "$DIR/$NAME"
-echo -e '-----END RSA PRIVATE KEY-----' >> "$DIR/$NAME"
-
-echo -e "-----BEGIN RSA PUBLIC KEY-----" > "$TMP"
-echo -e "$PUBLIC" >> "$TMP"
-echo -e "-----END RSA PUBLIC KEY-----" >> "$TMP"
-
-ssh-keygen -i -m PKCS8 -f "$TMP" > "$DIR/$NAME.pub"
-chmod 0600 "$DIR/$NAME.pub"
-chmod 0600 "$DIR/$NAME"
-chown sshd:sshd "$DIR/$NAME.pub"
-chown sshd:sshd "$DIR/$NAME"

board/common/rootfs/usr/libexec/infix/mnt

@@ -45,6 +45,11 @@ factory_reset()
     find /sys/class/leds/ -type l -exec sh -c 'echo 100 > $0/brightness' {} \;
     logger $opt -p user.crit -t "$nm" "Resetting to factory defaults."
 
+    # Shred all files to prevent restoring contents
+    find /mnt/cfg -type f -exec shred -zu {} \;
+    find /mnt/var -type f -exec shred -zu {} \;
+
+    # Remove any lingering directories and symlinks as well
     rm -rf /mnt/cfg/* /mnt/var/*
 
     logger $opt -p user.crit -t "$nm" "Factory reset complete."

board/common/rootfs/usr/libexec/infix/wifi-scanner

@@ -1,16 +0,0 @@
-#!/bin/sh
-
-if [ $# -ne 1 ]; then
-	echo "usage: $0 <ifname>"
-	exit 1
-fi
-ifname=$1
-
-TIMEOUT=300
-status=$(wpa_cli -i $ifname scan)
-while [ "$status" != "OK" ]; do
-	status=$(wpa_cli -i $ifname scan)
-	TIMEOUT=$((TIMEOUT-1))
-	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
-	sleep 0.5
-done

board/common/rootfs/usr/sbin/container

@@ -1,19 +1,5 @@
-#!/bin/bash
-# This script can be used to start, stop, create, and delete containers.
-# It is what confd use, with the Finit container@.conf template, to set
-# up, run, and delete containers.
-#
-# NOTE: when creating/deleting containers, remember 'initctl reload' to
-#       activate the changes!  In confd this is already handled.
-#
-DOWNLOADS=/var/lib/containers/oci
-BUILTIN=/lib/oci
-BASEDIR=/var/tmp
-container=$0
-checksum=""
-extracted=
-timeout=30
-dir=""
+#!/bin/sh
+
 all=""
 env=""
 port=""
@@ -24,225 +10,80 @@ log()
     logger -I $PPID -t container -p local1.notice -- "$*"
 }
 
-err()
+# Unpacks a given oci-archive.tar[.gz] in the current directory.  Sanity
+# checks, at least one index.json in the top-level dir of the archive.
+# If there are more index files, this function does not handle them.
+unpack_archive()
 {
-    rc=$1; shift
-    logger -I $PPID -t container -p local1.err -- "Error: $*"
-
-    if [ -n "$extracted" ] && [ -n "$tmpdir" ]; then
-	if [ -d "$tmpdir" ]; then
-	    log "Cleaning up temporary directory $tmpdir"
-	    rm -rf "$tmpdir"
-	fi
-    fi
-
-    [ "$rc" -eq 0 ] || exit "$rc"
-}
-
-pidfn()
-{
-    echo "/run/containers/${1}.pid"
-}
-
-check()
-{
-    file=$1
-
-    if [ -z "$checksum" ]; then
-	log "no checksum to verify $file against, continuing."
-	return 0
-    fi
-
-    if echo "${checksum}  ${file}" | "$cmdsum" -c -s; then
-        log "$file checksum verified OK."
-	return 0
-    fi
-
-    got=$("$cmdsum" "${file}" | awk '{print $1}')
-    log "$file checksum mismatch, got $got, expected $checksum, removing file."
-    rm -f "$file"
-
-    return 1
-}
-
-# Fetch an OCI image over ftp/http/https.  Use wget for FTP, which curl
-# empirically does not work well with.  Log progress+ & error to syslog.
-fetch()
-{
-    url=$1
-    file=$(basename "$url")
-    dst="$DOWNLOADS/$file"
-
-    cd "$DOWNLOADS" || return
-    if [ -e "$file" ]; then
-	log "$file already available."
-	if check "$file"; then
-	    echo "$dst"
-	    return 0
-	fi
-    fi
-
-    log "Fetching $url"
-
-    if echo "$url" | grep -qE "^ftp://"; then
-        cmd="wget -q $url"
-    elif echo "$url" | grep -qE "^https?://"; then
-        cmd="curl $creds -sSL --fail -o \"$file\" $url"
-    else
-        log "Unsupported URL scheme: $url"
-        return 1
-    fi
-
-    if out=$(eval "$cmd" 2>&1); then
-	log "$file downloaded successfully."
-	if check "$file"; then
-	    echo "$dst"
-	    return 0
-	fi
-    fi
-
-    # log error message from backend
-    while IFS= read -r line; do
-	log "$line"
-    done <<EOF
-$out
-EOF
-    return 1
-}
-
-# Extracts an oci-archive.tar[.gz] in a temporary directory.  Finds and
-# sanity checks that at least one index.json exist in the archive. This
-# is the OCI directory fed to `podman load` and also used as repo name.
-# NOTE: if there are >1 index.json, this function does not handle them.
-load_archive()
-{
-    uri=$1
-    tag=$2
-    img=$(basename "$uri")
+    image=$1
+    name=$2
 
     # Supported transports for load and create
-    case "$uri" in
+    case "$image" in
 	oci:*)			# Unpacked OCI image
-	    file=${uri#oci:}
+	    file=${image#oci:}
 	    ;;
 	oci-archive:*)		# Packed OCI image, .tar or .tar.gz format
-	    file=${uri#oci-archive:}
+	    file=${image#oci-archive:}
 	    ;;
-	ftp://* | http://* | https://*)
-            if ! file=$(fetch "$uri"); then
-		return 1
-	    fi
-            ;;
 	*)			# docker://*, docker-archive:*, or URL
-	    if podman image exists "$img"; then
-		echo "$img"
-		return 0
-	    fi
-	    # XXX: use --retry=0 with Podman 5.0 or later.
-	    if ! id=$(podman pull --quiet "$uri"); then
-		log "Failed pulling $uri"
-		return 1
-	    fi
-	    # Echo image tag to caller
-	    podman images --filter id="$id" --format "{{.Repository}}:{{.Tag}}"
+	    echo "$image"
 	    return 0
 	    ;;
     esac
 
     if [ ! -e "$file" ]; then
-	if [ -e "$DOWNLOADS/$file" ]; then
-	    file="$DOWNLOADS/$file"
-	elif [ -e "$BUILTIN/$file" ]; then
-	    file="$BUILTIN/$file"
+	if [ -e "/var/lib/containers/oci/$file" ]; then
+	    file="/var/lib/containers/oci/$file"
+	elif [ -e "/lib/oci/$file" ]; then
+	    file="/lib/oci/$file"
 	else
-	    err 1 "cannot find OCI archive $file in URI $uri"
+	    log "Error: cannot find OCI archive $file in search path."
+	    exit 1
 	fi
     fi
 
-    file=$(realpath "$file")
     if [ -d "$file" ]; then
 	index=$(find "$file" -name index.json)
 	if [ -z "$index" ]; then
-	    err 1 "cannot find index.json in OCI image $file"
+	    log "Error: cannot find index.json in OCI image $file"
+	    exit 1
 	fi
     else
-	# Extract files in a temporary directory, because most OCI
-	# archives are flat/bare, all files in the root w/o a dir/
-	tmpdir=$(mktemp -d -p "$BASEDIR") || err 1 "failed creating temporary directory"
-	cd "$tmpdir" || err 1 "failed cd to temporary directory $tmpdir"
-
-	index="$tmpdir/$(tar tf "$file" |grep index.json)"
+	index=$(tar tf "$file" |grep index.json)
 	if [ -z "$index" ]; then
-	    err 1 "invalid OCI archive, cannot find index.json in $file"
+	    log "Error: invalid OCI archive, cannot find index.json in $file"
+	    exit 1
 	fi
 
 	[ -n "$quiet" ] || log "Extracting OCI archive $file ..."
-        tar xf "$file"  || err 1 "failed unpacking $file in $tmpdir"
-	extracted=true
-	cd - >/dev/null || err 0 "failed cd -"
+        tar xf "$file" || (log "Error: failed unpacking $file in $(pwd)"; exit 1)
+	remove=true
     fi
 
     dir=$(dirname "$index")
-
-    # Handle flat tarballs without a sub-directory, because
-    # the $dir name is used as fallback when retagging below.
-    if [ -n "$extracted" ] && [ "$dir" = "$tmpdir" ]; then
-	parent=$(dirname "$dir")
-	dirnam=$(echo "$img" | sed 's/\(.*\)\.tar.*/\1/')
-	tmpdir="${parent}/${dirnam}"
-	mv "$dir" "$tmpdir"
-	dir="$tmpdir"
-    fi
-
-    if basename "$dir" | grep -q ":"; then
-        if [ -z "$tag" ]; then
-            tag=$(basename "$dir")
-        fi
-
-        sanitized_dir=$(echo "$dir" | cut -d':' -f1)
-        mv "$dir" "$sanitized_dir" || err 1 "failed renaming $dir to $sanitized_dir"
-        dir="$sanitized_dir"
-    fi
-
     [ -n "$quiet" ] || log "Loading OCI image $dir ..."
-    output=$(podman load -qi "$dir")
+    podman load -qi "$dir"        >/dev/null
 
-    # Extract image ID from podman load output:
-    # "Loaded image: sha256:cd9d0aaf81be..."
-    if echo "$output" | grep -q "sha256:"; then
-	img_id="${output##*sha256:}"
+    # Rename image from podman default $dir:latest
+    if [ -n "$name" ]; then
+	podman tag "$dir" "$name" >/dev/null
+	podman rmi "$dir"         >/dev/null
     else
-	# Fallback to directory name if no SHA found
-	img_id="$dir"
+	name=$dir
     fi
 
-    # On podman < 4.7.0 we had to retag images from default $dir:latest
-    # From >= 4.7.0 we always tag since loads come in as <none>:<none>
-    if [ -z "$tag" ]; then
-	tag=$(basename "$dir")
+    if [ "$remove" = "true" ]; then
+	rm -rf "$file"
     fi
 
-    # Repo names must be lowercase, and only '[a-z0-9._/-]+' and ':tag'
-    tag=$(printf "%s" "$tag" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9._/:-' '-')
-
-    [ -n "$quiet" ] || log "Tagging loaded image $img_id as $tag"
-    if ! podman tag "$img_id" "$tag"; then
-	err 1 "failed tagging image as $tag"
-    fi
-
-    # Clean up after ourselves
-    if [ -n "$extracted" ]; then
-	log "Cleaning up extracted $dir"
-	rm -rf "$tmpdir"
-    fi
-
-    echo "$tag"
+    echo "$name"
 }
 
 running()
 {
-    status=$(podman inspect -f '{{.State.Status}}' "$1" 2>/dev/null)
-    [ "$status" = "running" ] && return 0
+    run=$(podman inspect "$1" 2>/dev/null |jq .[].State.Running)
+    [ "$run" = "true" ] && return 0
     return 1
 }
 
@@ -261,19 +102,16 @@ create()
 
     # Unpack and load docker-archive/oci/oci-archive, returning image
     # name, or return docker:// URL for download.
-    if ! image=$(load_archive "$image"); then
-	exit 1
-    fi
+    image=$(unpack_archive "$image")
 
     if [ -z "$logging" ]; then
-	logging="--log-driver syslog"
+	logging="--log-driver k8s-file --log-opt path=/run/containers/$name.fifo"
     fi
 
-    # When we get here we've already fetched, or pulled, the image
-    args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
+    args="$args --replace --quiet --cgroup-parent=containers $caps"
     args="$args --restart=$restart --systemd=false --tz=local $privileged"
-    args="$args $vol $mount $hostname $entrypoint $env $port $logging"
-    pidfile=/run/container:${name}.pid
+    args="$args $ro $vol $mount $hostname $entrypoint $env $port $logging"
+    pidfn=/run/container:${name}.pid
 
     [ -n "$quiet" ] || log "---------------------------------------"
     [ -n "$quiet" ] || log "Got name: $name image: $image"
@@ -296,22 +134,22 @@ create()
     fi
 
     # shellcheck disable=SC2048
-    log "podman create --name $name --conmon-pidfile=$pidfile $args $image $*"
-    if podman create --name "$name" --conmon-pidfile="$pidfile" $args "$image" $*; then
-	[ -n "$quiet"  ] || log "Successfully created container $name from $image"
+    log "Calling podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
+    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
+	[ -n "$quiet" ] || log "Successfully created container $name from $image"
+	rm -f "/run/containers/env/${name}.env"
 	[ -n "$manual" ] || start "$name"
-
-	# Should already be enabled by confd (this is for manual use)
-	initctl -bnq enable "container@${name}.conf"
 	exit 0
     fi
 
-    err 1 "failed creating container $name, please check the configuration."
+    log "Error: failed creating container $name, please check the configuration."
+    exit 1
 }
 
 delete()
 {
     name=$1
+    image=$2
 
     if [ -z "$name" ]; then
 	echo "Usage:"
@@ -319,31 +157,18 @@ delete()
 	exit 1
     fi
 
-    # Should already be stopped, but if not ...
-    container stop "$name" >/dev/null
-
-    while running "$name"; do
-	log "$name: still running, waiting for it to stop ..."
-	_=$((timeout -= 1))
-	if [ $timeout -le 0 ]; then
-	    err 1 "timed out waiting for container $1 to stop before deleting it."
-	fi
-	sleep 1
-    done
-
     podman rm -vif "$name" >/dev/null 2>&1
     [ -n "$quiet" ] || log "Container $name has been removed."
-
-    cnt=$(podman image prune -af | wc -l)
-    log "Pruned $cnt image(s)"
 }
 
 waitfor()
 {
+    timeout=$2
     while [ ! -f "$1" ]; do
 	_=$((timeout -= 1))
 	if [ $timeout -le 0 ]; then
-	    err 1 "timed out waiting for $1, aborting!"
+	    log "Timeout waiting for $1, aborting!"
+	    exit 1
 	fi
 	sleep 1;
     done
@@ -358,7 +183,7 @@ start()
 	return
     fi
 
-    initctl start container:$name
+    initctl -bq cond set "container:$name"
     # Real work is done by wrap() courtesy of finit sysv emulation
 }
 
@@ -371,7 +196,7 @@ stop()
 	return
     fi
 
-    initctl stop container:$name
+    initctl -bq cond clr "container:$name"
     # Real work is done by wrap() courtesy of finit sysv emulation
 }
 
@@ -379,27 +204,8 @@ wrap()
 {
     name=$1
     cmd=$2
-    pidfile=$(pidfn "$name")
 
-    # Containers have three phases: setup, running, and teardown.
-
-    # The setup phase may run forever in the background trying to fetch
-    # the image.  It saves its PID in /run/containers/${name}.pid
-    if [ "$cmd" = "stop" ] && [ -f "$pidfile" ]; then
-        pid=$(cat "$pidfile")
-
-	# Check if setup is still running ...
-	if kill -0 "$pid" 2>/dev/null; then
-            kill "$pid"
-            wait "$pid" 2>/dev/null
-        fi
-
-        rm -f "$pidfile"
-        return 0
-    fi
-
-    # Skip "echo $name" from podman start in log
-    podman "$cmd" "$name" >/dev/null
+    podman "$cmd" "$name"
 }
 
 # Removes network $1 from all containers
@@ -430,19 +236,6 @@ netrestart()
     done
 }
 
-cleanup()
-{
-    pidfile=$(pidfn "$name")
-
-    log "Received signal, exiting."
-    if [ -n "$name" ] && [ -f "$pidfile" ]; then
-	log "$name: in setup phase, removing $pidfile ..."
-	rm -f "$pidfile"
-    fi
-
-    exit 1
-}
-
 usage()
 {
 	cat <<EOF
@@ -455,7 +248,6 @@ options:
       --dns-search LIST    Set host lookup search list when creating container
       --cap-add CAP        Add capability to unprivileged container
       --cap-drop CAP       Drop capability, for privileged containter
-      --checksum TYPE:SUM  Use md5/sha256/sha512 to verify ftp/http/https archives
   -c, --creds USR[:PWD]    Credentials to pass to curl -u for remote ops
   -d, --detach             Detach a container started with 'run IMG [CMD]'
   -e, --env FILE           Environment variables when creating container
@@ -475,15 +267,14 @@ options:
                            Syntax: [[ip:][hostPort]:]containerPort[/protocol]
   -q, --quiet              Quiet operation, called from confd
   -r, --restart POLICY     One of "no", "always", or "on-failure:NUM"
+      --read-only          Do not create a writable layer
   -s, --simple             Show output in simplified format
-  -t, --timeout SEC        Set timeout for delete/restart commands, default: 30
   -v, --volume NAME:PATH   Create named volume mounted inside container on PATH
 
 commands:
   create   NAME IMAGE NET  Create container NAME using IMAGE with networks NET
   delete  [network] NAME   Remove container NAME or network NAME from all containers
   exec     NAME CMD        Run a command inside a container
-  flush                    Clean up lingering containers and associated anonymous volumes
   find    [ifname PID]     Find PID of container where '--net IFNAME' currently lives
                            or, find the name of our IFNAME inside the container @PID
   help                     Show this help text
@@ -494,13 +285,11 @@ commands:
   restart [network] NAME   Restart a (crashed) container or container(s) using network
   run      NAME [CMD]      Run a container interactively, with an optional command
   save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
-  setup    NAME            Create and set up container as a Finit task
-  shell   [CMD]            Start a shell, or run CMD, inside a container
+  shell                    Start a shell inside a container
   show    [image | volume] Show containers, images, or volumes
   stat                     Show continuous stats about containers (Ctrl-C aborts)
   start   [NAME]           Start a container, see -n
   stop    [NAME]           Stop a container, see -n
-  upgrade  NAME            Upgrade a running container (stop, pull, restart)
   volume  [prune]          Prune unused volumes
 EOF
 }
@@ -518,25 +307,6 @@ while [ "$1" != "" ]; do
 	    shift
 	    caps="$caps --cap-drop=$1"
 	    ;;
-	--checksum)
-	    shift
-	    type="${1%%:*}"
-	    checksum="${1#*:}"
-	    case "$type" in
-		md5)
-		    cmdsum=md5sum
-		    ;;
-		sha256)
-		    cmdsum=sha256sum
-		    ;;
-		sha512)
-		    cmdsum=sha512sum
-		    ;;
-		*)
-		    err 1 "Unsupported checksum type: $type"
-		    ;;
-	    esac
-	    ;;
 	-c | --creds)
 	    shift
 	    creds="-u $1"
@@ -581,10 +351,11 @@ while [ "$1" != "" ]; do
 	--log-path)
 	    shift
 	    logging="$logging --log-opt path=$1"
+	    log_path="$1"
 	    ;;
 	-m | --mount)
 	    shift
-	    mount="$mount --mount=$1"
+	    mount="--mount=$1"
 	    ;;
 	--manual)
 	    manual=true
@@ -615,13 +386,12 @@ while [ "$1" != "" ]; do
 	    shift
 	    restart=$1
 	    ;;
+	--read-only)
+	    ro="--read-only=true"
+	    ;;
 	-s | --simple)
 	    simple=true
 	    ;;
-	-t | --timeout)
-	    shift
-	    timeout=$1
-	    ;;
 	-v | --volume)
 	    shift
 	    vol="$vol -v $1"
@@ -638,8 +408,6 @@ if [ -n "$cmd" ]; then
     shift
 fi
 
-trap cleanup INT HUP TERM
-
 case $cmd in
     # Does not work atm., cannot attach to TTY because
     # we monitor 'podman start -ai foo' with Finit.
@@ -652,24 +420,15 @@ case $cmd in
 	;;
     delete)
 	cmd=$1
-	[ -n "$name" ] || name=$2
+	name=$2
 	if [ "$cmd" = "network" ] && [ -n "$name" ]; then
 	    netwrm "$name"
 	else
-	    [ -n "$name" ] || name=$1
-	    delete "$name"
+	    delete "$@"
 	fi
 	;;
     exec)
-	if [ -z "$name" ]; then
-	    name="$1"
-	    shift
-	fi
-	podman exec -i "$name" "$@"
-	;;
-    flush)
-	echo "Cleaning up any lingering containers";
-	podman rm -av $force
+	podman exec -it "$@"
 	;;
     find)
 	cmd=$1
@@ -696,12 +455,25 @@ case $cmd in
 	usage
 	;;
     load)
+	url=$1
+	name=$2
 	# shellcheck disable=SC2086
-	name=$(load_archive "$1" $2)
-	[ -n "$name" ] || exit 1
+	if echo "$url" | grep -q "://"; then
+	    file=$(basename "$url")
+            curl -k $creds -Lo "$file" "$url"
+	else
+            file="$url"
+	fi
+
+	# shellcheck disable=SC2086
+	name=$(unpack_archive "$file" $name)
 
 	# Show resulting image(s) matching $name
-	podman images -n "$name"
+	if [ -n "$name" ]; then
+	    podman images -n "$name"
+	else
+	    exit 1
+	fi
 	;;
     locate)			# Find where the host's ifname lives
 	if [ -z "$network" ]; then
@@ -728,9 +500,9 @@ case $cmd in
 		podman images $all --format "{{.Repository}}:{{.Tag}}"
 		;;
 	    oci)
-		find $BUILTIN $DOWNLOADS -type f 2>/dev/null
+		find /lib/oci /var/lib/containers/oci -type f 2>/dev/null
 		;;
-	    *)
+	    *)		
 		podman ps $all --format "{{.Names}}"
 		;;
 	esac
@@ -770,44 +542,8 @@ case $cmd in
 	    gzip "$file"
 	fi
 	;;
-    setup)
-	[ -n "$name" ] || err 1 "setup: missing container name."
-	script=/run/containers/${name}.sh
-	[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."
-
-	# Save our PID in case we get stuck here and someone wants to
-	# stop us, e.g., due to reconfiguration or reboot.
-	pidfile=$(pidfn "${name}")
-	echo $$ > "$pidfile"
-
-	while ! "$script"; do
-            log "${name}: setup failed, waiting for network changes ..."
-
-	    # Timeout and retry after 60 seconds, on SIGTERM, or when
-	    # any network event is caught.
-	    timeout -s TERM -k 1 60 sh -c \
-		    'ip monitor address route 2>/dev/null | head -n1 >/dev/null' || true
-
-	    # On IP address/route changes, wait a few seconds more to ensure
-	    # the system has ample time to react and set things up for us.
-	    log "${name}: retrying ..."
-	    sleep 2
-	done
-
-	rm -f "$pidfile"
-	cnt=$(podman image prune -f | wc -l)
-	log "setup: pruned $cnt image(s)"
-	;;
     shell)
-	if [ -z "$name" ]; then
-	    name="$1"
-	    shift
-	fi
-	if [ $# -gt 0 ]; then
-	    podman exec -i "$name" sh -c "$*"
-	else
-	    podman exec -it "$name" sh -l
-	fi
+	podman exec -it "$1" sh -l
 	;;
     show)
 	cmd=$1
@@ -860,10 +596,12 @@ case $cmd in
 	    else
 		name=$1
 		stop "$name"
+		timeout=20
 		while running "$name"; do
 		    _=$((timeout -= 1))
 		    if [ $timeout -le 0 ]; then
-			err 1 "timed out waiting for container $1 to stop before restarting it."
+			log "Timeout waiting for container $1 to stop before restarting it."
+			exit 1
 		    fi
 		    sleep 1
 		done
@@ -889,7 +627,7 @@ case $cmd in
 	;;
     upgrade)
 	# Start script used to initially create container
-	script=/run/containers/${1}.sh
+	script=/var/lib/containers/active/S01-${1}.sh
 
 	# Find container image
 	img=$(podman inspect "$1" | jq -r .[].ImageName)
@@ -900,15 +638,15 @@ case $cmd in
 
 	# Likely an OCI archive, or local directory, assume user has updated image.
 	if echo "$img" | grep -Eq '^localhost/'; then
-	    file=$(awk '/^# meta-image:/ {print $3}' "$script")
-	    echo ">> Upgrading container $1 using $file ..."
+	    file=$(awk '{s=$NF} END{print s}' "$script")
+	    echo "Upgrading container ${1} with local archive: $file ..."
 	else
 	    printf ">> Stopping ... "
 	    podman stop "$1"
 	    printf ">> "
 	    podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
-	    echo ">> Starting $1 ..."
 	fi
+	echo ">> Starting $1 ..."
 	if ! "$script"; then
 	    echo ">> Failed recreating container $1"
 	    exit 1
@@ -920,7 +658,7 @@ case $cmd in
 	[ -n "$cmd" ] && shift
 	case $cmd in
 	    prune)
-		podman volume prune $force
+		podman volume $force prune
 		;;
 	    *)
 		false
@@ -928,22 +666,6 @@ case $cmd in
 	esac
 	;;
     *)
-	if [ -n "$SERVICE_SCRIPT_TYPE" ] && [ -n "$SERVICE_ID" ]; then
-	    case "$SERVICE_SCRIPT_TYPE" in
-		pre)
-		    # Called as pre-script from Finit service
-		    exec $container -q -n "$SERVICE_ID" setup
-		    ;;
-		cleanup)
-		    # Called as cleanup-script from Finit service
-		    log "Calling $container -n $SERVICE_ID delete"
-		    exec $container -q -n "$SERVICE_ID" delete
-		    ;;
-		*)
-		    false
-		    ;;
-	    esac
-	fi
 	usage
 	exit 1
 	;;

board/common/rootfs/usr/share/udhcpc/default.script

@@ -23,22 +23,12 @@ fi
 
 log()
 {
-    logger -I $$ -t udhcpc -p user.notice "${interface}: $*"
-}
-
-dbg()
-{
-    logger -I $$ -t udhcpc -p user.debug "${interface}: $*"
-}
-
-err()
-{
-    logger -I $$ -t udhcpc -p user.err "${interface}: $*"
+    logger -I $$ -t udhcpc -p user.notice "$*"
 }
 
 wait_for_ipv6_default_route()
 {
-    dbg "waiting for IPv6 default route to be installed."
+    log "waiting for IPv6 default route to be installed."
     while [ $IF_WAIT_DELAY -gt 0 ]; do
 	if ip -6 route list proto dhcp dev $interface | grep -q default; then
 	    return
@@ -47,7 +37,7 @@ wait_for_ipv6_default_route()
 	printf "."
 	: $((IF_WAIT_DELAY -= 1))
     done
-    err "Timed out waiting for IPv6 default route!"
+    log "Timed out witing for IPv6 default route!"
 }
 
 # RFC3442: If the DHCP server returns both a Classless
@@ -60,7 +50,7 @@ set_dhcp_routes()
 	# format: dest1/mask gw1 ... destn/mask gwn
 	set -- $staticroutes
 	while [ -n "$1" -a -n "$2" ]; do
-	    dbg "adding route $1 via $2 metric $metric tag 100"
+	    log "adding route $1 via $2 dev $interface proto dhcp"
 	    echo "ip route $1 $2 $metric tag 100" >> "$NEXT"
 	    shift 2
 	done
@@ -79,7 +69,7 @@ set_dhcp_routes()
 
 clr_dhcp_routes()
 {
-    log "deleting DHCP routes"
+    log "deleting DHCP routes from $interface"
     [ -f "$NAME" ] || return
     rm "$NAME"
 
@@ -94,7 +84,7 @@ clr_dhcp_addresses()
     for addr in $addrs; do
 	ip="$(echo "$addr" | jq -r '."local"')"
 	prefix="$(echo "$addr" | jq -r '."prefixlen"')"
-	log "removing $ip/$prefix"
+	log "removing $ip/$prefix from $interface"
 	ip addr del "$ip/$prefix" dev "$interface"
     done
 }
@@ -125,7 +115,7 @@ case "$ACTION" in
 	    /usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
 	fi
 
-	if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto dhcp; then
+	if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto 5; then
 	    echo "$ip" > "$IP_CACHE"
 	fi
 	if [ -n "$ipv6" ] ; then
@@ -152,12 +142,12 @@ case "$ACTION" in
 	fi
 
 	if [ -n "$search_list" ]; then
-	    dbg "adding search $search_list"
+	    log "adding search $search_list"
 	    echo "search $search_list # $interface" >> $RESOLV_CONF
 	fi
 
 	for i in $dns ; do
-	    dbg "adding dns $i"
+	    log "adding dns $i"
 	    echo "nameserver $i # $interface" >> $RESOLV_CONF
 	    resolvconf -u
 	done
@@ -165,7 +155,7 @@ case "$ACTION" in
 	if [ -n "$ntpsrv" ]; then
 	    truncate -s 0 "$NTPFILE"
 	    for srv in $ntpsrv; do
-		dbg "got NTP server $srv"
+		log "got NTP server $srv"
 		echo "server $srv iburst" >> "$NTPFILE"
 	    done
 	    chronyc reload sources >/dev/null

board/common/uboot/extras.config

@@ -20,6 +20,7 @@ CONFIG_CMD_SETEXPR_FMT=y
 
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
+CONFIG_MMC_PCI=y
 CONFIG_CMD_MMC=y
 
 CONFIG_FS_SQUASHFS=y

board/common/uboot/scripts/ixpreboot.sh

@@ -33,7 +33,7 @@ for tgt in "${boot_targets}"; do
 	setexpr ixmenu_n ${ixmenu_n} + 1
 
 	if load ${devtype} ${devnum}:${auxpart} ${loadaddr} /uboot.env; then
-	    env import -c ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact
+	    env import -b ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact
 	fi
 
 	if test -n "${DEBUG}"; then

board/common/uboot/uboot.mk

@@ -17,23 +17,14 @@ endef
 # U-Boot build tree. This will then be built in to the final U-Boot
 # image's control DT via the CONFIG_DEVICE_TREE_INCLUDES option (see
 # extras.config).
-#
-# Some platforms, most notably Raspberry Pi, load the device tree
-# from the SPL, effectively overriding the built-in control DT.
-# For that we bundle an overlay that can be included instead.
 define UBOOT_PRE_BUILD_INSTALL_KEY
-	$(HOST_DIR)/bin/dtc -a 1024 <(echo '/dts-v1/; / { signature {}; };') \
-		>$(@D)/infix-key.dtb
+	$(HOST_DIR)/bin/dtc <(echo '/dts-v1/; / { signature {}; };') >$(@D)/infix-key.dtb
 	$(foreach key, \
 		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
 		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
-		| sed -e 's:/dts-v[0-9]\+/;::' \
-		| tee $(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi \
-		| sed -e '1i\/dts-v1/;\n/plugin/;\n' -e '/^$$/d' -e 's:/ {:\&{/} {:' \
-		>$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtso
-
+	| sed -e 's:/dts-v[0-9]\+/;::' >$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi
 	rm $(@D)/infix-key.dtb
 endef
 UBOOT_PRE_BUILD_HOOKS += UBOOT_PRE_BUILD_INSTALL_KEY

board/riscv64/rootfs/etc/rauc/system.conf

@@ -6,12 +6,6 @@ mountprefix=/var/lib/rauc/mnt
 bundle-formats=-plain
 max-bundle-download-size=1073741824
 
-[log.event-log]
-filename=/var/log/upgrade-json.log
-format=json-pretty
-max-size=1M
-max-files=5
-
 [keyring]
 directory=/etc/rauc/keys
 

board/x86_64/linux_defconfig

@@ -33,7 +33,6 @@ CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
 CONFIG_SMP=y
 CONFIG_EFI=y
-CONFIG_KPROBES=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -145,6 +144,7 @@ CONFIG_BRIDGE_EBT_REDIRECT=m
 CONFIG_BRIDGE_EBT_SNAT=m
 CONFIG_BRIDGE_EBT_LOG=m
 CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BPFILTER=y
 CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_BRIDGE_MRP=y
@@ -161,14 +161,12 @@ CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
-CONFIG_NET_SWITCHDEV=y
 CONFIG_NET_PKTGEN=y
 # CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
-CONFIG_PCI_MSI=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -210,7 +208,6 @@ CONFIG_NET_VRF=y
 CONFIG_E1000=y
 CONFIG_NE2K_PCI=y
 CONFIG_8139CP=y
-CONFIG_ROCKER=y
 # CONFIG_WLAN is not set
 CONFIG_INPUT_EVDEV=y
 CONFIG_SERIAL_8250=y
@@ -261,12 +258,11 @@ CONFIG_NLS_ISO8859_1=y
 CONFIG_CRYPTO_AES=y
 CONFIG_CRYPTO_GCM=y
 CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-CONFIG_FUNCTION_TRACER=y
+# CONFIG_FTRACE is not set
 CONFIG_UNWINDER_FRAME_POINTER=y