board/common: add missing newline at end of /etc/motd

With the changes in 9847a8f we can keep the /etc/motd file with a proper newline at EOF so that also Classic builds make sense. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
.github: adjust release tag variables
2026-07-22 09:13:01 +02:00 · 2024-03-01 20:19:17 +01:00 · 2024-03-01 18:38:22 +01:00 · 2024-03-01 16:03:26 +01:00 · 2024-03-01 14:17:20 +01:00 · 2024-03-01 14:14:33 +01:00
472 changed files with 36790 additions and 6693 deletions
@@ -0,0 +1,37 @@
+<!--- **Summarize** your changes in the title above -->
+
+## Description
+
+<!--
+  -- A description of changes, detailing *why* changes are made.
+  -- Remember: assign a reviewer, or use @mentions if org. member.
+  -->
+
+
+## Other information
+
+<!-- Other relevant info, e.g., before/after screenshots -->
+
+
+## Checklist
+
+Tick relevant boxes, this PR is-a or has-a:
+
+- [ ] Bugfix
+  - [ ] Regression tests
+  - [ ] ChangeLog updates (for next release)
+- [ ] Feature
+  - [ ] YANG model change => revision updated?
+  - [ ] Regression tests added?
+  - [ ] ChangeLog updates (for next release)
+  - [ ] Documentation added?
+- [ ] Code style update (formatting, renaming)
+- [ ] Refactoring (please detail in commit messages)
+- [ ] Build related changes
+- [ ] Documentation content changes
+- [ ] Other (please describe):
+
+
+## References
+
+<!-- Please list references to related issue(s) -->
@@ -1,9 +1,3 @@
-# To enable this workflow of your Infix fork, set the repoistory or
-# organisation variable (not secret):
-#
-#     LATEST_BUILD = true
-#
-# https://docs.github.com/en/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository
 name: Bob the Builder

 on:
@@ -14,7 +8,6 @@ on:

 jobs:
  build:
-    if: ${{ vars.LATEST_BUILD == 'true' }}
    name: Build ${{ matrix.platform }} ${{ matrix.variant }}
    runs-on: ubuntu-latest
    strategy:
@@ -23,7 +16,12 @@ jobs:
        variant: [netconf, classic]
      fail-fast: false
    steps:
-      - uses: actions/checkout@v3
+      - name: Maintenance
+        run: |
+          docker image prune -af
+          docker volume prune -f
+          docker container prune -f
+      - uses: actions/checkout@v4
      - name: Set Build Variables
        id: vars
        run: |
@@ -34,22 +32,25 @@ jobs:
          fi
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+          if [ "$target" = x86_64 ]; then
+              echo "out=$PWD/output"      >> $GITHUB_OUTPUT
+          else
+              echo "out=/mnt/x-$target"   >> $GITHUB_OUTPUT
+          fi
      - name: Restore Cache of dl/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: dl/
-          key: dl-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          key: dl-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
-            dl-${{ matrix.platform }}-${{ matrix.variant }}-
-            dl-${{ matrix.platform }}-
+            dl-${{ matrix.variant }}-
            dl-
      - name: Restore Cache of .ccache/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: .ccache/
-          key: ccache-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ matrix.platform }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
          restore-keys: |
-            ccache-${{ matrix.platform }}-${{ matrix.variant }}-
            ccache-${{ matrix.platform }}-
            ccache-
      - name: Configure & Build
@@ -59,35 +60,49 @@ jobs:
          else
              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
          fi
-          echo "Buildring $target ..."
+          echo "Building $target ..."
+          sudo mkdir ${{ steps.vars.outputs.out }}
+          sudo chown $(id -un):$(id -gn) ${{ steps.vars.outputs.out }}
+          export O=${{ steps.vars.outputs.out }}
          make $target
          make
      - name: Prepare Artifact
        run: |
-          cd output
+          cd ${{ steps.vars.outputs.out }}
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
      - name: Test
        if: matrix.platform == 'x86_64' && matrix.variant == 'netconf'
        run: |
+          export O=${{ steps.vars.outputs.out }}
          make test-qeneth
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
        with:
-          path: output/${{ steps.vars.outputs.tgz }}
+          path: ${{ steps.vars.outputs.out }}/${{ steps.vars.outputs.tgz }}
+          name: artifact-${{ matrix.variant }}-${{ matrix.platform }}
  release:
    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
    name: Upload Latest Build
    needs: build
    runs-on: ubuntu-latest
+    permissions:
+      contents: write
    steps:
-      - uses: actions/download-artifact@v3
-      - uses: pyTooling/Actions/releaser@main
+      - uses: actions/download-artifact@v4
        with:
-          tag: latest
-          rm: false
+          pattern: "artifact-*"
+          merge-multiple: true
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          omitName: true
+          omitBody: true
+          omitBodyDuringUpdate: true
+          prerelease: true
+          tag: "latest"
          token: ${{ secrets.GITHUB_TOKEN }}
-          files: artifact/*
+          artifacts: "*.tar.gz"
      - name: Summary
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,85 @@
+name: Coverity Scan
+
+on:
+  schedule:
+    - cron: '5 0 * * *'
+  workflow_dispatch:
+
+env:
+  PROJECT_NAME: Infix
+  CONTACT_EMAIL: troglobit@gmail.com
+
+jobs:
+  coverity:
+    if: ${{github.repository_owner == 'kernelkit'}}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Fetch latest Coverity Scan MD5
+        id: var
+        env:
+          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
+        run: |
+          wget -q https://scan.coverity.com/download/cxx/linux64         \
+               --post-data "token=$TOKEN&project=${PROJECT_NAME}&md5=1" \
+               -O coverity-latest.tar.gz.md5
+          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT
+      - uses: actions/cache@v4
+        id: cache
+        with:
+          path: coverity-latest.tar.gz
+          key: ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
+          restore-keys: |
+            ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
+            ${{ runner.os }}-coverity-
+            ${{ runner.os }}-coverity
+      - name: Download Coverity Scan
+        env:
+          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
+        run: |
+          if [ ! -f coverity-latest.tar.gz ]; then
+            wget -q https://scan.coverity.com/download/cxx/linux64   \
+                 --post-data "token=$TOKEN&project=${PROJECT_NAME}" \
+                 -O coverity-latest.tar.gz
+          else
+            echo "Latest Coverity Scan available from cache :-)"
+            md5sum coverity-latest.tar.gz
+          fi
+          mkdir coverity
+          tar xzf coverity-latest.tar.gz --strip 1 -C coverity
+      - name: Install dependencies
+        run: |
+          sudo apt-get -y update
+          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
+                       libaugeas-dev libglib2.0-dev libpcre2-dev      \
+                       libuev-dev libite-dev
+      - name: Build dependencies
+        run: |
+          git clone https://github.com/CESNET/libyang.git
+          mkdir libyang/build
+          (cd libyang/build && cmake .. && make all && sudo make install)
+          git clone https://github.com/sysrepo/sysrepo.git
+          mkdir sysrepo/build
+          (cd sysrepo/build && cmake .. && make all && sudo make install)
+          make dep
+      - name: Check applications
+        run: |
+          export PATH=`pwd`/coverity/bin:$PATH
+          cov-build --dir cov-int make check
+      - name: Submit results to Coverity Scan
+        env:
+          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
+        run: |
+          tar czvf ${PROJECT_NAME}.tgz cov-int
+          curl \
+            --form token=$TOKEN \
+            --form email=${CONTACT_EMAIL} \
+            --form file=@${PROJECT_NAME}.tgz \
+            --form version=$(git rev-parse HEAD) \
+            --form description="${PROJECT_NAME} $(git rev-parse HEAD)" \
+            https://scan.coverity.com/builds?project=${PROJECT_NAME}
+      - name: Upload build.log
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverity-build.log
+          path: cov-int/build-log.txt
@@ -0,0 +1,100 @@
+name: Manny the Manager
+
+on:
+  workflow_dispatch:
+    inputs:
+      checkout:
+        required: true
+        type: boolean
+      cleanup:
+        required: true
+        type: boolean
+      peek:
+        required: true
+        type: boolean
+
+jobs:
+  inventory:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Disk usage ...
+        run: |
+          cd
+          du -hs .[^.]*
+      - name: Disk inventory (1/2) ...
+        run: |
+          echo "df -h ========================================================================="
+          df -h
+          echo "mounts ========================================================================"
+          mount
+      - name: File inventory (1/2) ...
+        run: |
+          echo "Current directory: $(pwd)"
+          echo "Files in $HOME ================================================================"
+          ls $HOME
+          echo "Find $HOME ===================================================================="
+          find $HOME
+      - name: Container inventory ...
+        run: |
+          echo "Available container images: ==================================================="
+          docker images
+          echo "Available containers: ========================================================="
+          docker ps -a
+
+  checkout:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Restore Cache of dl/
+        uses: actions/cache@v4
+        with:
+          path: dl/
+          key: dl-netconf-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-netconf-
+            dl-
+      - name: Restore Cache of .ccache/
+        uses: actions/cache@v4
+        with:
+          path: .ccache/
+          key: ccache-x86_64-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-x86_64-
+            ccache-
+      - name: Disk inventory (2/2) ...
+        run: |
+          echo "df -h ========================================================================="
+          df -h
+          echo "mounts ========================================================================"
+          mount
+      - name: File inventory (2/2) ...
+        run: |
+          echo "Current directory: $(pwd)"
+          echo "Files in $HOME ================================================================"
+          ls $HOME
+          echo "Find $HOME ===================================================================="
+          find $HOME
+
+  peeky:
+    if: ${{ inputs.peek }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Peek & Poke ...
+        run: |
+          whoami
+          ls -l /mnt/
+          cat /mnt/DATALOSS_WARNING_README.txt
+          sudo mkdir /mnt/x-aarch64
+          sudo chown $(id -un):$(id -gn) /mnt/x-aarch64
+          ls -l /mnt/
+
+  cleanup:
+    if: ${{ inputs.cleanup }}
+    needs: [inventory, peeky]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Cleaning up cruft ...
+        run: |
+          docker image prune -af
+          docker volume prune -f
+          docker container prune -f
@@ -1,9 +1,3 @@
-# To enable this workflow of your Infix fork, set the repoistory or
-# organisation variable (not secret):
-#
-#     REGRESSION_TEST = true
-#
-# https://docs.github.com/en/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository
 name: Reggie Regression

 on:
@@ -21,40 +15,42 @@ concurrency:

 jobs:
  build:
-    if: ${{ vars.REGRESSION_TEST == 'true' }}
    name: Regression Testing
    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
        with:
          submodules: 'true'
      - name: Set Build Variables
        id: vars
        run: |
-          target=x86_64-minimal
+          target=x86_64
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
      - name: Restore Cache of dl/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: dl/
-          key: dl-x86_64-netconf-${{ hashFiles('.git/modules/buildroot/refs/heads/master', 'package/*/*.hash') }}
+          key: dl-netconf-${{ hashFiles('.git/modules/buildroot/refs/heads/master', 'package/*/*.hash') }}
          restore-keys: |
-            dl-x86_64-netconf-
-            dl-x86_64-
+            dl-netconf-
            dl-
      - name: Restore Cache of .ccache/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: .ccache/
-          key: ccache-x86_64-netconf-${{ hashFiles('.git/modules/buildroot/refs/head/master', 'package/*/*.hash') }}
+          key: ccache-x86_64-${{ hashFiles('.git/modules/buildroot/refs/head/master', 'package/*/*.hash') }}
          restore-keys: |
-            ccache-x86_64-netconf-
            ccache-x86_64-
            ccache-
-      - name: Configure Minimal NETCONF
+      - name: Configure NETCONF
        run: |
-          make x86_64_minimal_defconfig
+          make x86_64_defconfig
+
+      - name: Unit Test
+        run: make test-unit
+
      - name: Build
        run: |
          make
@@ -65,7 +61,7 @@ jobs:
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          path: output/${{ steps.vars.outputs.tgz }}

@@ -1,9 +1,21 @@
+# This job can be started by a git tag or using the workflow dispatch.
+#
+# The version string *must* be of the format: vYY.MM(-alphaN|-betaN|-rcN)
+#
+# In /etc/os-release this string is used for VERSION, VERSION_ID, and
+# IMAGE_VERSION, with the 'v' prefix.  In release artifact filenames,
+# and zip file directory names, the 'v' is dropped per convention.
 name: Release General

 on:
  push:
    tags:
      - 'v[0-9]*.*'
+  workflow_dispatch:
+    inputs:
+      version:
+        required: false
+        type: string

 jobs:
  build:
@@ -16,81 +28,121 @@ jobs:
        variant: [netconf, classic]
      fail-fast: false
    steps:
-      - uses: actions/checkout@v3
-      - name: Set Release Variables
-        id: build
+      - name: Maintenance
        run: |
-          ver=${GITHUB_REF#refs/tags/v}
-          echo "ver=${ver}" >> $GITHUB_OUTPUT
-          if echo $ver | grep -qE '[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
-            echo "pre=true"  >> $GITHUB_OUTPUT
+          docker image prune -af
+          docker volume prune -f
+          docker container prune -f
+      - uses: actions/checkout@v4
+      - name: Set Release Variables
+        id: vars
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+              ver=${{ inputs.version }}
          else
-            echo "pre=false" >> $GITHUB_OUTPUT
+              ver=${GITHUB_REF#refs/tags/}
          fi
+          echo "ver=${ver}" >> $GITHUB_OUTPUT
+          fver=${ver#v}
          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}-${ver}
+              target=${{ matrix.platform }}-${fver}
          else
-              target=${{ matrix.platform }}-${{ matrix.variant }}-${ver}
+              target=${{ matrix.platform }}-${{ matrix.variant }}-${fver}
          fi
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+          echo "out=/mnt/x-$target"       >> $GITHUB_OUTPUT
      - name: Restore Cache of dl/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: dl/
-          key: dl-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          key: dl-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
-            dl-${{ matrix.platform }}-${{ matrix.variant }}-
-            dl-${{ matrix.platform }}-
+            dl-${{ matrix.variant }}-
            dl-
      - name: Restore Cache of .ccache/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: .ccache/
-          key: ccache-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ matrix.platform }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
          restore-keys: |
-            ccache-${{ matrix.platform }}-${{ matrix.variant }}-
            ccache-${{ matrix.platform }}-
            ccache-
      - name: Configure & Build
        env:
-          INFIX_RELEASE: ${{ steps.build.outputs.ver }}
+          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
        run: |
          if [ "${{ matrix.variant }}" = "netconf" ]; then
              target=${{ matrix.platform }}_defconfig
          else
              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
          fi
-          echo "Buildring $target ..."
+          echo "Building $target ..."
+          sudo mkdir ${{ steps.vars.outputs.out }}
+          sudo chown $(id -un):$(id -gn) ${{ steps.vars.outputs.out }}
+          export O=${{ steps.vars.outputs.out }}
          make $target
          make
      - name: Prepare Artifact
        run: |
-          cd output
-          mv images ${{ steps.build.outputs.dir }}
-          ln -s ${{ steps.build.outputs.dir }} images
-          tar chfz ${{ steps.build.outputs.tgz }} ${{ steps.build.outputs.dir }}
-      - uses: actions/upload-artifact@v3
+          cd ${{ steps.vars.outputs.out }}
+          mv images ${{ steps.vars.outputs.dir }}
+          ln -s ${{ steps.vars.outputs.dir }} images
+          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+      - uses: actions/upload-artifact@v4
        with:
-          path: output/${{ steps.build.outputs.tgz }}
+          path: ${{ steps.vars.outputs.out }}/${{ steps.vars.outputs.tgz }}
+          name: artifact-${{ matrix.variant }}-${{ matrix.platform }}
  release:
    name: Release Infix ${{ github.ref_name }}
    needs: build
    runs-on: ubuntu-latest
+    permissions:
+      contents: write
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/download-artifact@v3
+      - uses: actions/checkout@v4
+      - name: Set Release Variables
+        id: rel
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+              ver=${{ inputs.version }}
+          else
+              ver=${GITHUB_REF#refs/tags/}
+          fi
+          echo "ver=${ver}"     >> $GITHUB_OUTPUT
+          if echo $ver | grep -qE 'v[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
+            echo "pre=true"     >> $GITHUB_OUTPUT
+            echo "latest=false" >> $GITHUB_OUTPUT
+          elif echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
+            echo "pre=false"    >> $GITHUB_OUTPUT
+            echo "latest=true"  >> $GITHUB_OUTPUT
+          else
+            echo "pre=false"    >> $GITHUB_OUTPUT
+            echo "latest=false" >> $GITHUB_OUTPUT
+          fi
+          echo "pre=${{ steps.rel.outputs.pre }}"
+          echo "latest=${{ steps.rel.outputs.latest }}"
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
      - name: Extract ChangeLog entry ...
        run: |
-          awk '/-----*/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
+          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
              |head -n -1 > release.md
          cat release.md
      - uses: ncipollo/release-action@v1
        with:
          name: Infix ${{ github.ref_name }}
-          prerelease: ${{ needs.build.outputs.pre }}
+          prerelease: ${{ steps.rel.outputs.pre }}
+          makeLatest: ${{ steps.rel.outputs.latest }}
          bodyFile:  release.md
-          artifacts: artifact/*
+          artifacts: "*.tar.gz*"
      - name: Summary
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
@@ -2,8 +2,8 @@
 	path = buildroot
 	url = ../buildroot.git
 [submodule "9pm"]
-	path = 9pm
+	path = test/9pm
 	url = ../9pm
 [submodule "qeneth"]
-	path = qeneth
+	path = test/qeneth
 	url = ../qeneth.git
@@ -54,7 +54,7 @@ config INFIX_IMAGE_ID

 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix — a Network Operating System"
+	default "Infix -- a Network Operating System"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.
@@ -11,6 +11,10 @@ bmake   = $(MAKE) -C buildroot O=$(O) $1
 all: $(config) buildroot/Makefile
 	@+$(call bmake,$@)

+check dep:
+	@echo "Starting local check, stage $@ ..."
+	@make -C src $@
+
 $(config):
 	@+$(call bmake,list-defconfigs)
 	@echo "\e[7mERROR: No configuration selected.\e[0m"
@@ -18,11 +22,14 @@ $(config):
 	@echo "'make <board>_defconfig' before building an image."
 	@exit 1

-
 %: | buildroot/Makefile
 	@+$(call bmake,$@)

+# Workaround, see board/x86_64/board.mk
+test:
+	@+$(call bmake,$@)
+
 buildroot/Makefile:
 	@git submodule update --init

-.PHONY: all
+.PHONY: all check test
@@ -1,4 +1,6 @@
-<img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480>
+[![License Badge][]][License] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
+
+<img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 <details><summary><b>Documentation</b></summary>

 - **Infix In-Depth**
@@ -16,10 +18,39 @@

 </details>

-Infix is a Linux Network Operating System (NOS) based on [Buildroot][1],
-and [sysrepo][2].  A powerful mix that ease porting to different
-platforms, simplify long-term maintenance, and provide made-easy
-management using NETCONF[^1] (remote) or the built-in [CLI][3].
+Infix is a free, Linux based, immutable Network Operating System (NOS)
+built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
+porting to different platforms, simplify long-term maintenance, and
+provide made-easy management using NETCONF[^1] or the built-in [command
+line interface (CLI)][3] from a console or SSH login.  *Click the
+foldout (▶ Example CLI Session) below for an example.*
+
+Although primarily focused on switches and routers, the core values
+may be appealing for other use-cases as well:
+
+- Runs from a squashfs image on a read-only partition
+- Single configuration file on a separate partition
+- Built around YANG with standard IETF models
+- Linux switchdev provides open switch APIs
+- Atomic upgrades to secondary partition
+- Highly security focused
+
+An immutable[^2] operating system enhances security and inherently makes
+it maintenance-free.  Configuration and data, e.g, containers, is stored
+on separate partitions to ensure complete separation from system files
+and allow for seamless backup, restore, and provisioning.
+
+In itself Infix is perfectly suited for dedicated networking tasks and
+native support for Docker containers provides a versatile platform that
+can easily be adapted to any customer need.  Be it legacy applications,
+network protocols, process monitoring, or edge data analysis, it can run
+close to end equipment.  Either directly connected on dedicated Ethernet
+ports or indirectly using virtual network cables to exist on the same
+LAN as other connected equipment.
+
+The simple design of Infix provides complete control over both system
+and data, minimal cognitive burden, and makes it incredibly easy to get
+started.

 <details><summary><b>Example CLI Session</b></summary>

@@ -29,16 +60,20 @@ is brief example of how to set the IP address of an interface:

 ```
 admin@infix-12-34-56:/> configure
-admin@infix-12-34-56:/config/> edit interfaces interface eth0
-admin@infix-12-34-56:/config/interfaces/interface/eth0/> set ipv4 <TAB>
+admin@infix-12-34-56:/config/> edit interface eth0
+admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
      address     autoconf bind-ni-name      enabled
 	  forwarding  mtu      neighbor
-admin@infix-12-34-56:/config/interfaces/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
-admin@infix-12-34-56:/config/interfaces/interface/eth0/> show
-type ethernetCsmacd;
-ipv4 address 192.168.2.200 prefix-length 24;
-ipv6 enabled true;
-admin@infix-12-34-56:/config/interfaces/interface/eth0/> diff
+admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
+admin@infix-12-34-56:/config/interface/eth0/> show
+type ethernet;
+ipv4 {
+  address 192.168.2.200 {
+    prefix-length 24;
+  }
+}
+ipv6
+admin@infix-12-34-56:/config/interface/eth0/> diff
 interfaces {
  interface eth0 {
 +    ipv4 {
@@ -48,13 +83,15 @@ interfaces {
 +    }
  }
 }
-admin@infix-12-34-56:/config/interfaces/interface/eth0/> leave
-admin@infix-12-34-56:/> show interfaces brief
-lo               UNKNOWN        00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP>
-eth0             UP             52:54:00:12:34:56 <BROADCAST,MULTICAST,UP,LOWER_UP>
-admin@infix-12-34-56:/> show ip brief
-lo               UNKNOWN        127.0.0.1/8 ::1/128
-eth0             UP             192.168.2.200/24 fe80::5054:ff:fe12:3456/64
+admin@infix-12-34-56:/config/interface/eth0/> leave
+admin@infix-12-34-56:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+eth0            ethernet   UP          52:54:00:12:34:56
+                ipv4                   192.168.2.200/24 (static)
+                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
 admin@infix-12-34-56:/> copy running-config startup-config
 ```

@@ -69,6 +106,7 @@ The [following boards](board/aarch64/README.md) are fully supported:
 - Marvell CN9130 CRB
 - Marvell EspressoBIN
 - Microchip SparX-5i PCB135 (eMMC)
+ - NanoPi R2S

 An x86_64 build is also available, primarily intended for development
 and testing, but can also be used for evaluation and demo purposes.  For
@@ -83,6 +121,18 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
 [^1]: NETCONF or RESTCONF, <https://datatracker.ietf.org/doc/html/rfc8040>,
    for more information, see [Infix Variants](doc/variant.md).

+[^2]: An immutable operating system is one with read-only file systems,
+    atomic updates, rollbacks, declarative configuration, and workload
+    isolation.  All to improve reliability, scalability, and security.
+    For more information, see <https://ceur-ws.org/Vol-3386/paper9.pdf>
+    and <https://www.zdnet.com/article/what-is-immutable-linux-heres-why-youd-run-an-immutable-linux-distro/>.
+
 [1]: https://buildroot.org/
 [2]: https://www.sysrepo.org/
 [3]: doc/cli/introduction.md
+[License]:         https://en.wikipedia.org/wiki/GPL_license
+[License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
+[Coverity Scan]:   https://scan.coverity.com/projects/29393
+[Coverity Status]: https://scan.coverity.com/projects/29393/badge.svg
+[discord-badge]:   https://img.shields.io/discord/1182652155618918411.svg?logo=discord
+[discord-url]:     https://discord.gg/6bHJWQNVxN
@@ -25,7 +25,7 @@
 /* mpp21: Unused */
 /* mpp22: Unused */
 /* mpp23: Unused */
-#define SFP9_RX_LOS(X)        X("mpp24", cp0_gpio1, 24, GPIO_ACTIVE_HIGH)
+#define DDR_TEN(X)            X("mpp24", cp0_gpio1, 24, GPIO_ACTIVE_HIGH)
 #define ETH9_RESETn(X)        X("mpp25", cp0_gpio1, 25, GPIO_ACTIVE_LOW)
 #define SW_INTn(X)            X("mpp26", cp0_gpio1, 26, IRQ_TYPE_LEVEL_LOW)
 #define SFP9_RS1(X)           X("mpp27", cp0_gpio1, 27, GPIO_ACTIVE_HIGH)
@@ -34,7 +34,7 @@
 #define CP_UA0_TXD(X)         X("mpp30", none, 0, 0)
 #define SFP10_TX_DISABLE(X)   X("mpp31", cp0_gpio1, 31, GPIO_ACTIVE_HIGH)
 #define SFP10_MOD_ABS(X)      X("mpp32", cp0_gpio2,  0, GPIO_ACTIVE_LOW)
-#define I2C_IRQ(X)            X("mpp33", cp0_gpio2,  1, GPIO_ACTIVE_HIGH)
+#define I2C_IRQ(X)            X("mpp33", cp0_gpio2,  1, IRQ_TYPE_LEVEL_LOW)
 #define SFP10_RS0(X)          X("mpp34", cp0_gpio2,  2, GPIO_ACTIVE_HIGH)
 #define CP_I2C1_SDA(X)        X("mpp35", none, 0, 0)
 #define CP_I2C1_SCK(X)        X("mpp36", none, 0, 0)
@@ -54,7 +54,7 @@
 #define USB1_VBUS_ENABLE(X)   X("mpp50", cp0_gpio2, 18, GPIO_ACTIVE_HIGH)
 #define USB1_VBUS_ERROR_OC(X) X("mpp51", cp0_gpio2, 19, GPIO_ACTIVE_HIGH)
 /* mpp52: Unused */
-/* mpp53: Unused */
+#define SFP9_RX_LOS(X)        X("mpp53", cp0_gpio2, 21, GPIO_ACTIVE_HIGH)
 /* mpp54: Unused */
 #define CP_SD_LED(X)          X("mpp55", none,  0, 0)
 #define CP_SD_CLK(X)          X("mpp56", none,  0, 0)
@@ -63,7 +63,7 @@
 #define CP_SD_D1(X)           X("mpp59", none,  0, 0)
 #define CP_SD_D2(X)           X("mpp60", none,  0, 0)
 #define CP_SD_D3(X)           X("mpp61", none,  0, 0)
-#define DDR_TEN(X)            X("mpp62", cp0_gpio2, 30 GPIO_ACTIVE_HIGH)
+/* mpp62: Unused */

 /* Macros to extract MPP info in different formats */
 #define MPP_ID(_mpp, _chip, _no, _flags) _mpp
@@ -6,6 +6,7 @@
 * Device tree for Alder board
 */

+#include <dt-bindings/input/input.h>
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/leds/common.h>

@@ -21,6 +22,12 @@

 	chosen {
 		stdout-path = "serial0:115200n8";
+
+		infix {
+			vpds = <&vpd_cpu &vpd_product &vpd_power>;
+			usb-ports = <&cp0_usb3_1>;
+			usb-port-names = "USB";
+		};
 	};

 	memory@0 {
@@ -71,10 +78,13 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&cp0_i2c0_pins>;

-	eeprom@50 {
+	vpd_cpu: eeprom@50 {
 		// AT24C256C-MAHL-T
 		compatible = "atmel,24c256";
                reg = <0x50>;
+
+		infix,board = "cpu";
+		infix,trusted;
 	};
 };

@@ -159,11 +169,12 @@
 /* System Management */

 &i2c_sysmgmt {
-	eeprom@b {
+	vpd_product: eeprom@b {
 		label = "vpd";
                reg = <0x0b>;
 		compatible = "atmel,24c02";
-		read-only;
+
+		infix,board = "product";

 		nvmem-layout {
 			compatible = "onie,tlv-layout";
@@ -187,53 +198,6 @@
 };


-/* CP SDHCI (Micro-SD) */
-
-/ {
-	cp0_reg_sd_vccq: cp0_sd_vccq@0 {
-		compatible = "regulator-gpio";
-		regulator-name = "cp0_sd_vccq";
-		regulator-min-microvolt = <1800000>;
-		regulator-max-microvolt = <3300000>;
-		/* gpios = <&CP_SD_HST_18_EN>; */
-		states = <1800000 0x1
-			  3300000 0x0>;
-	};
-
-	cp0_reg_sd_vcc: cp0_sd_vcc@0 {
-		compatible = "regulator-fixed";
-		regulator-name = "cp0_sd_vcc";
-		regulator-min-microvolt = <3300000>;
-		regulator-max-microvolt = <3300000>;
-		/* gpio = <&CP_SD_CRD_PWR_OFF>; */
-		enable-active-high;
-		regulator-always-on;
-	};
-};
-
-&cp0_pinctrl {
-	cp0_sdhci_pins: cp0-sdhi-pins-0 {
-		marvell,pins = \
-			CP_SD_CRD_PWR_OFF(MPP_ID), CP_SD_HST_18_EN(MPP_ID),	\
-			CP_SD_CRD_DT(MPP_ID), CP_SD_LED(MPP_ID),		\
-			CP_SD_CLK(MPP_ID), CP_SD_CMD(MPP_ID),			\
-			CP_SD_D0(MPP_ID), CP_SD_D1(MPP_ID), 			\
-			CP_SD_D2(MPP_ID), CP_SD_D3(MPP_ID);
-		marvell,function = "sdio";
-	};
-};
-
-&cp0_sdhci0 {
-	status = "disabled";
-	pinctrl-names = "default";
-	pinctrl-0 = <&cp0_sdhci_pins>;
-	bus-width = <4>;
-	/* cd-gpios = <&CP_SD_CRD_DT>; */
-	vqmmc-supply = <&cp0_reg_sd_vccq>;
-	vmmc-supply = <&cp0_reg_sd_vcc>;
-};
-
-
 /* SPI1 (Boot FLASH) */

 &cp0_pinctrl {
@@ -302,10 +266,11 @@

 &cp0_utmi1 {
 	status = "okay";
+	dr_mode = "host";
 };

 &cp0_usb3_1 {
-	status = "disabled";
+	status = "okay";
 	usb-phy = <&cp0_usb3_0_phy1>;
 	phys = <&cp0_utmi1>, <&cp0_comphy3 1>;
 	phy-names = "usb", "usb3";
@@ -377,42 +342,80 @@
 				};
 			};

-#define SWP(_n, _label, _mac_offs, _phymode, _phy) \
-			port@_n { \
+#define SWP_COMMON(_n, _label, _mac_offs, _phymode, _phy) \
 				reg = <0x ## _n>; \
 				label = _label; \
 				phy-mode = _phymode; \
 				phy-handle = <&_phy>; \
 				\
 				nvmem-cells = <&base_mac _mac_offs>; \
-				nvmem-cell-names = "mac-address"; \
+				nvmem-cell-names = "mac-address"
+
+#define XSWP(_n, _label, _mac_offs, _phy) \
+			port@_n { \
+				SWP_COMMON(_n, _label, _mac_offs, "usxgmii", _phy); \
 			}

-			SWP(9,  "x1",  1, "usxgmii",  xphy9);
-			SWP(a,  "x2",  2, "usxgmii",  xphya);
+#define GSWP(_n, _label, _mac_offs, _phy) \
+			port@_n { \
+				SWP_COMMON(_n, _label, _mac_offs, "gmii", _phy); \
+				\
+				leds { \
+					#address-cells = <1>; \
+					#size-cells = <0>; \
+					\
+					led@0 { \
+						reg = <0>; \
+						function = "tp"; \
+						color = <LED_COLOR_ID_GREEN>; \
+						default-state = "keep"; \
+					}; \
+					led@1 { \
+						reg = <1>; \
+						function = "tp"; \
+						color = <LED_COLOR_ID_YELLOW>; \
+						default-state = "off"; \
+					}; \
+				}; \
+			}

-			SWP(8,  "x3",  3,    "gmii", swphy8);
-			SWP(7,  "x4",  4,    "gmii", swphy7);
-			SWP(6,  "x5",  5,    "gmii", swphy6);
-			SWP(5,  "x6",  6,    "gmii", swphy5);
-			SWP(4,  "x7",  7,    "gmii", swphy4);
-			SWP(3,  "x8",  8,    "gmii", swphy3);
-			SWP(2,  "x9",  9,    "gmii", swphy2);
-			SWP(1, "x10", 10,    "gmii", swphy1);
-#undef SWP
+			XSWP(9,  "x1",  1,  xphy9);
+			XSWP(a,  "x2",  2,  xphya);
+
+			GSWP(8,  "x3",  3, swphy8);
+			GSWP(7,  "x4",  4, swphy7);
+			GSWP(6,  "x5",  5, swphy6);
+			GSWP(5,  "x6",  6, swphy5);
+			GSWP(4,  "x7",  7, swphy4);
+			GSWP(3,  "x8",  8, swphy3);
+			GSWP(2,  "x9",  9, swphy2);
+			GSWP(1, "x10", 10, swphy1);
+#undef GSWP
+#undef XSWP
+#undef SWP_COMMON
 		};

 		mdio {
 			#address-cells = <1>;
 			#size-cells = <0>;
-			swphy1: ethernet-phy@1 { reg = <0x1>; };
-			swphy2: ethernet-phy@2 { reg = <0x2>; };
-			swphy3: ethernet-phy@3 { reg = <0x3>; };
-			swphy4: ethernet-phy@4 { reg = <0x4>; };
-			swphy5: ethernet-phy@5 { reg = <0x5>; };
-			swphy6: ethernet-phy@6 { reg = <0x6>; };
-			swphy7: ethernet-phy@7 { reg = <0x7>; };
-			swphy8: ethernet-phy@8 { reg = <0x8>; };
+
+#define SWPHY(_n) \
+			ethernet-phy@_n { \
+				compatible = "ethernet-phy-ieee802.3-c22"; \
+				reg = <_n>; \
+				eee-broken-100tx; \
+				eee-broken-1000t; \
+			}
+
+			swphy1: SWPHY(1);
+			swphy2: SWPHY(2);
+			swphy3: SWPHY(3);
+			swphy4: SWPHY(4);
+			swphy5: SWPHY(5);
+			swphy6: SWPHY(6);
+			swphy7: SWPHY(7);
+			swphy8: SWPHY(8);
+#undef SWPHY
 		};
 	};
 };
@@ -453,17 +456,59 @@
 	/* 88X3310 specifices 35ns minimum MDC period (28.57 MHz). */
 	clock-frequency = <28571428>;

-	xphy9: ethernet-phy@4 {
-		compatible = "ethernet-phy-ieee802.3-c45";
-		reg = <4>;
-		sfp = <&sfp9>;
-	};
+#define XPHY(_n, _sfp) \
+	ethernet-phy@_n { \
+		compatible = "ethernet-phy-ieee802.3-c45"; \
+		reg = <_n>; \
+		sfp = <&_sfp>; \
+		\
+		leds { \
+			#address-cells = <1>; \
+			#size-cells = <0>; \
+			\
+			led@0 { \
+				reg = <0>; \
+				function = "tp"; \
+				color = <LED_COLOR_ID_YELLOW>; \
+				default-state = "off"; \
+				\
+				marvell,media = "copper"; \
+				marvell,polarity = "active-high"; \
+			}; \
+			led@1 { \
+				reg = <1>; \
+				function = "tp"; \
+				color = <LED_COLOR_ID_GREEN>; \
+				default-state = "keep"; \
+				\
+				marvell,media = "copper"; \
+				marvell,polarity = "active-high"; \
+			}; \
+			\
+			led@2 { \
+				reg = <2>; \
+				function = "sfp"; \
+				color = <LED_COLOR_ID_YELLOW>; \
+				default-state = "off"; \
+				\
+				marvell,media = "fiber"; \
+				marvell,polarity = "active-high"; \
+			}; \
+			led@3 { \
+				reg = <3>; \
+				function = "sfp"; \
+				color = <LED_COLOR_ID_GREEN>; \
+				default-state = "keep"; \
+				\
+				marvell,media = "fiber"; \
+				marvell,polarity = "active-high"; \
+			}; \
+		}; \
+	}

-	xphya: ethernet-phy@5 {
-		compatible = "ethernet-phy-ieee802.3-c45";
-		reg = <5>;
-		sfp = <&sfpa>;
-	};
+	xphy9: XPHY(4, sfp9);
+	xphya: XPHY(5, sfpa);
+#undef XPHY
 };

 / {
@@ -495,23 +540,35 @@

 /* Power Board */

+&cp0_pinctrl {
+	cp0_pwr_gpio_pins: cp0-pwr-gpio-0 {
+		marvell,pins = I2C_IRQ(MPP_ID);
+		marvell,function = "gpio";
+	};
+};
+
 &i2c_pwr {
 	// Shared IRQ on I2C_IRQ
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_pwr_gpio_pins>;

 	// 0x26  U13 PCF8574        GPIO I/O
 	gpio_pwr1: gpio@26 {
 		compatible = "nxp,pcf8574a";
 		#gpio-cells = <2>;
 		gpio-controller;
+                #interrupt-cells = <2>;
+                interrupt-controller;
+		interrupts-extended = I2C_IRQ(MPP_IRQ_REF);
 		reg = <0x26>;
 #define GPIO_PWR1_UNUSED0	gpio_pwr1 0 GPIO_ACTIVE_HIGH
 #define GPIO_PWR1_UNUSED1	gpio_pwr1 1 GPIO_ACTIVE_HIGH
 #define GPIO_POE_PGOOD		gpio_pwr1 2 GPIO_ACTIVE_HIGH
 #define GPIO_RESET_BUTTON	gpio_pwr1 3 GPIO_ACTIVE_LOW
 #define GPIO_VIN1_PGOOD		gpio_pwr1 4 GPIO_ACTIVE_LOW
-#define GPIO_LED_VIN1_ALERT	gpio_pwr1 5 GPIO_ACTIVE_LOW
+#define GPIO_LED_VIN2_ALERT	gpio_pwr1 5 GPIO_ACTIVE_LOW
 #define GPIO_VIN2_PGOOD		gpio_pwr1 6 GPIO_ACTIVE_LOW
-#define GPIO_LED_VIN2_ALERT	gpio_pwr1 7 GPIO_ACTIVE_LOW
+#define GPIO_LED_VIN1_ALERT	gpio_pwr1 7 GPIO_ACTIVE_LOW
 	};

 	//0x27  U3  PCF8574        GPIO LED
@@ -519,6 +576,9 @@
 		compatible = "nxp,pcf8574a";
 		#gpio-cells = <2>;
 		gpio-controller;
+                #interrupt-cells = <2>;
+                interrupt-controller;
+		interrupts-extended = I2C_IRQ(MPP_IRQ_REF);
 		reg = <0x27>;
 #define GPIO_LED2G		gpio_pwr2 0 GPIO_ACTIVE_LOW
 #define GPIO_LED2R		gpio_pwr2 1 GPIO_ACTIVE_LOW
@@ -534,17 +594,41 @@
 	//0x30  U5  TPS23861PWR    PoE Controller broadcast

 	//0x50  U15 AT24C256C      EEPROM
-	eeprom@50 {
+	vpd_power: eeprom@50 {
 		// AT24C256C-MAHL-T
 		compatible = "atmel,24c256";
                reg = <0x50>;
+
+		infix,board = "power";
 	};
 };

+/* Reset button */
+/ {
+	gpio-keys {
+		compatible = "gpio-keys";
+		up {
+			label = "factory-reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&GPIO_RESET_BUTTON>;
+		};
+	};
+};

 /* System LEDs */
-
 / {
+	power-a {
+		compatible = "gpio-charger";
+		charger-type = "mains";
+		gpios = <&GPIO_VIN1_PGOOD>;
+	};
+
+	power-b {
+		compatible = "gpio-charger";
+		charger-type = "mains";
+		gpios = <&GPIO_VIN2_PGOOD>;
+	};
+
 	leds: leds {
 		compatible = "gpio-leds";

@@ -584,28 +668,51 @@
 			gpios = <&GPIO_LED3R>;
 		};

-		led-dbgg {
-			function = LED_FUNCTION_DEBUG;
+		led-bootg {
+			function = LED_FUNCTION_BOOT;
 			color = <LED_COLOR_ID_GREEN>;
 			gpios = <&GPIO_LED4G>;
 		};

-		led-dbgr {
-			function = LED_FUNCTION_DEBUG;
+		led-bootr {
+			function = LED_FUNCTION_BOOT;
 			color = <LED_COLOR_ID_RED>;
 			gpios = <&GPIO_LED4R>;
+			default-state = "on";
+			linux,default-trigger = "timer";
 		};

-		led-vin1_alert {
-			function = "power-1";
+		led-vin1-alert {
+			function = "power-a";
 			color = <LED_COLOR_ID_RED>;
 			gpios = <&GPIO_LED_VIN1_ALERT>;
 		};

-		led-vin2_alert {
-			function = "power-2";
+		led-vin2-alert {
+			function = "power-b";
 			color = <LED_COLOR_ID_RED>;
 			gpios = <&GPIO_LED_VIN2_ALERT>;
 		};
 	};
 };
+
+/* Watchdog */
+
+&cp0_pinctrl {
+	watchdog_pins: watchdog-pins {
+		marvell,pins = WDT_TICKLE(MPP_ID);
+		marvell,function = "gpio";
+	};
+};
+
+/ {
+        sysmgmt-watchdog {
+                pinctrl-names = "default";
+                pinctrl-0 = <&watchdog_pins>;
+                compatible = "linux,wdt-gpio";
+                gpios = WDT_TICKLE(MPP_GPIO_REF);
+                always-running;
+                hw_algo = "toggle";
+                hw_margin_ms = <20000>; /* toggle period must be below 1 minute */
+        };
+};
@@ -21,7 +21,6 @@ CONFIG_CFS_BANDWIDTH=y
 CONFIG_RT_GROUP_SCHED=y
 CONFIG_CGROUP_PIDS=y
 CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_HUGETLB=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
@@ -32,7 +31,6 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
-CONFIG_SMP=y
 CONFIG_ARCH_SPARX5=y
 CONFIG_ARCH_MVEBU=y
 CONFIG_ARCH_VEXPRESS=y
@@ -49,12 +47,6 @@ CONFIG_CPUFREQ_DT=y
 CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_ARMADA_8K_CPUFREQ=y
 CONFIG_ACPI=y
-CONFIG_ARM64_CRYPTO=y
-CONFIG_CRYPTO_SHA1_ARM64_CE=y
-CONFIG_CRYPTO_SHA2_ARM64_CE=y
-CONFIG_CRYPTO_GHASH_ARM64_CE=y
-CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
-CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_KPROBES=y
 CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
@@ -67,10 +59,8 @@ CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CMA=y
 CONFIG_NET=y
 CONFIG_PACKET=y
-CONFIG_UNIX=y
 CONFIG_XDP_SOCKETS=y
 CONFIG_XDP_SOCKETS_DIAG=y
-CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
 CONFIG_IP_MULTIPLE_TABLES=y
@@ -112,7 +102,6 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
-CONFIG_NFT_OBJREF=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
@@ -186,9 +175,7 @@ CONFIG_VLAN_8021Q=y
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
 CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBQ=y
 CONFIG_NET_CLS_BASIC=y
-CONFIG_NET_CLS_TCINDEX=y
 CONFIG_NET_CLS_BPF=y
 CONFIG_NET_CLS_FLOWER=y
 CONFIG_NETLINK_DIAG=y
@@ -236,7 +223,6 @@ CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_AHCI_PLATFORM=y
 CONFIG_AHCI_MVEBU=y
-CONFIG_PATA_PLATFORM=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
@@ -325,6 +311,7 @@ CONFIG_8139CP=y
 # CONFIG_NET_VENDOR_WIZNET is not set
 # CONFIG_NET_VENDOR_XILINX is not set
 CONFIG_SFP=y
+CONFIG_AX88796B_PHY=y
 CONFIG_MARVELL_PHY=y
 CONFIG_MARVELL_10G_PHY=m
 CONFIG_MICREL_PHY=y
@@ -332,12 +319,12 @@ CONFIG_MICROCHIP_PHY=y
 CONFIG_MICROCHIP_T1_PHY=y
 CONFIG_MICROSEMI_PHY=m
 CONFIG_MDIO_BITBANG=y
-CONFIG_MDIO_MVUSB=y
+CONFIG_MDIO_MVUSB=m
 CONFIG_MDIO_MSCC_MIIM=y
 CONFIG_MDIO_BUS_MUX_MMIOREG=y
-CONFIG_USB_RTL8152=y
-CONFIG_USB_USBNET=y
-CONFIG_USB_NET_CDC_EEM=y
+CONFIG_USB_RTL8152=m
+CONFIG_USB_USBNET=m
+CONFIG_USB_NET_CDC_EEM=m
 # CONFIG_USB_NET_CDC_NCM is not set
 # CONFIG_USB_NET_NET1080 is not set
 # CONFIG_USB_NET_CDC_SUBSET is not set
@@ -371,7 +358,6 @@ CONFIG_I2C_MV64XXX=y
 CONFIG_I2C_SLAVE=y
 CONFIG_SPI=y
 CONFIG_SPI_ARMADA_3700=y
-CONFIG_SPI_NXP_FLEXSPI=y
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
 CONFIG_SPI_MUX=y
@@ -384,6 +370,7 @@ CONFIG_GPIO_PL061=y
 CONFIG_GPIO_XGENE=y
 CONFIG_GPIO_PCA953X=y
 CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_GPIO_PCF857X=y
 CONFIG_GPIO_MAX77620=y
 CONFIG_POWER_RESET_GPIO_RESTART=y
 CONFIG_POWER_RESET_XGENE=y
@@ -400,6 +387,7 @@ CONFIG_ARMADA_THERMAL=y
 CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
+CONFIG_GPIO_WATCHDOG=y
 CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_MAX77620=y
@@ -425,30 +413,31 @@ CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
-CONFIG_USB=y
+CONFIG_USB_ULPI_BUS=y
+CONFIG_USB=m
 CONFIG_USB_OTG=y
-CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_XHCI_MVEBU=y
-CONFIG_USB_EHCI_HCD=y
-CONFIG_USB_EHCI_HCD_PLATFORM=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_OHCI_HCD_PLATFORM=y
-CONFIG_USB_STORAGE=y
+CONFIG_USB_XHCI_HCD=m
+CONFIG_USB_XHCI_MVEBU=m
+CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_EHCI_HCD_PLATFORM=m
+CONFIG_USB_OHCI_HCD=m
+CONFIG_USB_OHCI_HCD_PLATFORM=m
+CONFIG_USB_STORAGE=m
 CONFIG_USB_DWC3=y
 CONFIG_USB_DWC2=y
-CONFIG_USB_CHIPIDEA=y
+CONFIG_USB_CHIPIDEA=m
 CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
-CONFIG_USB_HSIC_USB3503=y
+CONFIG_USB_HSIC_USB3503=m
 CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_SNP_UDC_PLAT=y
 CONFIG_TYPEC=y
-CONFIG_TYPEC_TCPM=y
-CONFIG_TYPEC_TCPCI=y
-CONFIG_TYPEC_RT1711H=y
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_RT1711H=m
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_ARMMMCI=y
@@ -460,7 +449,6 @@ CONFIG_MMC_SPI=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_EXYNOS=y
 CONFIG_MMC_DW_K3=y
-CONFIG_MMC_CQHCI=y
 CONFIG_MMC_SDHCI_XENON=y
 CONFIG_SCSI_UFSHCD=y
 CONFIG_SCSI_UFSHCD_PLATFORM=y
@@ -469,8 +457,10 @@ CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_SYSCON=y
 CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
 CONFIG_RTC_DRV_PCF8523=y
@@ -499,7 +489,6 @@ CONFIG_EXTCON_USB_GPIO=y
 CONFIG_IIO=y
 CONFIG_TI_ADC081C=y
 CONFIG_PWM=y
-CONFIG_PHY_XGENE=y
 CONFIG_PHY_MVEBU_CP110_COMPHY=y
 CONFIG_PHY_MVEBU_CP110_UTMI=y
 CONFIG_PHY_SAMSUNG_USB2=y
@@ -508,13 +497,11 @@ CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
-CONFIG_EXT4_FS=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FANOTIFY=y
 CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA=y
-CONFIG_AUTOFS4_FS=y
 CONFIG_FUSE_FS=y
 CONFIG_VIRTIO_FS=y
 CONFIG_OVERLAY_FS=y
@@ -532,17 +519,21 @@ CONFIG_SECURITY=y
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_IRQ_POLL=y
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_KERNEL=y
-CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_DETECT_HUNG_TASK=y
 # CONFIG_SCHED_DEBUG is not set
-# CONFIG_DEBUG_PREEMPT is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
 # CONFIG_STRICT_DEVMEM is not set
@@ -0,0 +1,4 @@
+label Infix on NanoPi R2S
+  kernel /boot/Image
+  devicetree /boot/rk3328-nanopi-r2s.dtb
+  append root=/dev/mmcblk0p1 rw rootwait bonding.max_bonds=0 dummy.numdummies=0 fb_tunnels=none quiet
@@ -0,0 +1,38 @@
+image cfg.ext4 {
+	ext4 {
+		label = "cfg"
+	}
+	empty = true
+	size = 16M
+}
+
+image sdcard.img {
+	hdimage {
+	}
+
+	partition u-boot-tpl-spl-dtb {
+		in-partition-table = "no"
+		image = "idbloader.img"
+		offset = 32K
+	}
+
+	partition u-boot-dtb {
+		in-partition-table = "no"
+		image = "u-boot.itb"
+		offset = 8M
+	}
+
+	partition rootfs {
+		partition-type = 0x83
+		offset = 16M
+		image = "rootfs.ext4"
+	}
+
+	partition cfg {
+		partition-type = 0x83
+		image = "cfg.ext4"
+	}
+}
+
+# Silence genimage warnings
+config {}
@@ -0,0 +1,654 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_NUMA_BALANCING=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EXPERT=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_KEXEC_FILE=y
+CONFIG_CRASH_DUMP=y
+CONFIG_ARCH_ACTIONS=y
+CONFIG_ARCH_ROCKCHIP=y
+CONFIG_ARCH_VEXPRESS=y
+CONFIG_ARM64_VA_BITS_48=y
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_SMT=y
+CONFIG_NUMA=y
+CONFIG_COMPAT=y
+CONFIG_RANDOMIZE_BASE=y
+CONFIG_HIBERNATION=y
+CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
+CONFIG_ENERGY_MODEL=y
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+CONFIG_CPUFREQ_DT=y
+CONFIG_ACPI_CPPC_CPUFREQ=m
+CONFIG_ARM_SCMI_CPUFREQ=y
+CONFIG_ACPI=y
+CONFIG_ACPI_APEI=y
+CONFIG_ACPI_APEI_GHES=y
+CONFIG_ACPI_APEI_MEMORY_FAILURE=y
+CONFIG_ACPI_APEI_EINJ=y
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=y
+CONFIG_JUMP_LABEL=y
+# CONFIG_GCC_PLUGINS is not set
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_KSM=y
+CONFIG_MEMORY_FAILURE=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CMA=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_NET_IPIP=y
+CONFIG_NET_IPGRE_DEMUX=y
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_IPV6=m
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_NET_DSA=m
+CONFIG_NET_DSA_TAG_OCELOT=m
+CONFIG_NET_DSA_TAG_OCELOT_8021Q=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBS=m
+CONFIG_NET_SCH_ETF=m
+CONFIG_NET_SCH_TAPRIO=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_FLOWER=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_GACT=m
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_GATE=m
+CONFIG_BT=m
+CONFIG_BT_HIDP=m
+# CONFIG_BT_LE is not set
+CONFIG_BT_LEDS=y
+# CONFIG_BT_DEBUGFS is not set
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_LL=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIUART_QCA=y
+CONFIG_CFG80211=y
+CONFIG_MAC80211=y
+CONFIG_MAC80211_LEDS=y
+CONFIG_RFKILL=y
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_PASID=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_ACPI=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_ROCKCHIP_HOST=m
+CONFIG_PCIE_ROCKCHIP_DW_HOST=y
+CONFIG_PCI_ENDPOINT=y
+CONFIG_PCI_ENDPOINT_CONFIGFS=y
+CONFIG_PCI_EPF_TEST=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_ARM_SCMI_PROTOCOL=y
+CONFIG_ARM_SCPI_PROTOCOL=y
+CONFIG_EFI_CAPSULE_LOADER=y
+CONFIG_MTD=y
+CONFIG_MTD_BLOCK=y
+CONFIG_MTD_CFI=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_INTELEXT=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_PHYSMAP_OF=y
+CONFIG_MTD_DATAFLASH=y
+CONFIG_MTD_SST25L=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_NAND_DENALI_DT=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_OF_OVERLAY=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=m
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_NVME=m
+CONFIG_SRAM=y
+CONFIG_PCI_ENDPOINT_TEST=m
+CONFIG_EEPROM_AT24=m
+CONFIG_EEPROM_AT25=m
+CONFIG_UACCE=m
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_HISI_SAS=y
+CONFIG_SCSI_HISI_SAS_PCI=y
+CONFIG_MEGARAID_SAS=y
+CONFIG_SCSI_MPT3SAS=m
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_CEVA=y
+CONFIG_SATA_SIL24=y
+CONFIG_PATA_OF_PLATFORM=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_MD=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_ZERO=m
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=y
+CONFIG_WIREGUARD=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_VXLAN=y
+CONFIG_GENEVE=m
+CONFIG_BAREUDP=m
+CONFIG_TUN=y
+CONFIG_VETH=m
+CONFIG_VIRTIO_NET=m
+# CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_NET_VENDOR_ACTIONS is not set
+# CONFIG_NET_VENDOR_ADAPTEC is not set
+# CONFIG_NET_VENDOR_AGERE is not set
+# CONFIG_NET_VENDOR_ALACRITECH is not set
+# CONFIG_NET_VENDOR_ALTEON is not set
+# CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AMD is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
+# CONFIG_NET_VENDOR_ARC is not set
+# CONFIG_NET_VENDOR_ASIX is not set
+CONFIG_ATL2=m
+CONFIG_ALX=m
+# CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_VENDOR_CADENCE is not set
+# CONFIG_NET_VENDOR_CAVIUM is not set
+# CONFIG_NET_VENDOR_CHELSIO is not set
+# CONFIG_NET_VENDOR_CISCO is not set
+# CONFIG_NET_VENDOR_CORTINA is not set
+# CONFIG_NET_VENDOR_DEC is not set
+# CONFIG_NET_VENDOR_DLINK is not set
+# CONFIG_NET_VENDOR_EMULEX is not set
+# CONFIG_NET_VENDOR_EZCHIP is not set
+# CONFIG_NET_VENDOR_GOOGLE is not set
+# CONFIG_NET_VENDOR_HISILICON is not set
+# CONFIG_NET_VENDOR_HUAWEI is not set
+# CONFIG_NET_VENDOR_INTEL is not set
+# CONFIG_NET_VENDOR_LITEX is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+# CONFIG_NET_VENDOR_MELLANOX is not set
+# CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROCHIP is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
+# CONFIG_NET_VENDOR_MICROSOFT is not set
+# CONFIG_NET_VENDOR_MYRI is not set
+# CONFIG_NET_VENDOR_NI is not set
+# CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETERION is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
+# CONFIG_NET_VENDOR_NVIDIA is not set
+# CONFIG_NET_VENDOR_OKI is not set
+# CONFIG_NET_VENDOR_PACKET_ENGINES is not set
+# CONFIG_NET_VENDOR_PENSANDO is not set
+# CONFIG_NET_VENDOR_QLOGIC is not set
+# CONFIG_NET_VENDOR_BROCADE is not set
+# CONFIG_NET_VENDOR_QUALCOMM is not set
+# CONFIG_NET_VENDOR_RDC is not set
+CONFIG_8139CP=m
+CONFIG_8139TOO=m
+# CONFIG_8139TOO_PIO is not set
+CONFIG_R8169=m
+# CONFIG_NET_VENDOR_RENESAS is not set
+# CONFIG_NET_VENDOR_ROCKER is not set
+# CONFIG_NET_VENDOR_SAMSUNG is not set
+# CONFIG_NET_VENDOR_SEEQ is not set
+# CONFIG_NET_VENDOR_SILAN is not set
+# CONFIG_NET_VENDOR_SIS is not set
+# CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_SOCIONEXT is not set
+CONFIG_STMMAC_ETH=y
+# CONFIG_DWMAC_GENERIC is not set
+# CONFIG_NET_VENDOR_SUN is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
+# CONFIG_NET_VENDOR_TEHUTI is not set
+# CONFIG_NET_VENDOR_TI is not set
+# CONFIG_NET_VENDOR_VIA is not set
+# CONFIG_NET_VENDOR_WIZNET is not set
+# CONFIG_NET_VENDOR_XILINX is not set
+CONFIG_AX88796B_PHY=y
+CONFIG_MICREL_PHY=y
+CONFIG_MICROSEMI_PHY=y
+CONFIG_AT803X_PHY=m
+CONFIG_REALTEK_PHY=y
+CONFIG_ROCKCHIP_PHY=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BCM_UNIMAC=m
+CONFIG_MDIO_THUNDER=y
+CONFIG_MDIO_BUS_MUX_MULTIPLEXER=y
+CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=m
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_ATH10K=m
+CONFIG_ATH10K_PCI=m
+CONFIG_WCN36XX=m
+# CONFIG_WLAN_VENDOR_ATMEL is not set
+# CONFIG_WLAN_VENDOR_BROADCOM is not set
+# CONFIG_WLAN_VENDOR_CISCO is not set
+# CONFIG_WLAN_VENDOR_INTEL is not set
+# CONFIG_WLAN_VENDOR_INTERSIL is not set
+# CONFIG_WLAN_VENDOR_MARVELL is not set
+# CONFIG_WLAN_VENDOR_MEDIATEK is not set
+CONFIG_RTL8180=m
+CONFIG_RTL8187=m
+CONFIG_RTL_CARDS=m
+CONFIG_RTL8192CE=m
+CONFIG_RTL8192SE=m
+CONFIG_RTL8192DE=m
+CONFIG_RTL8723AE=m
+CONFIG_RTL8723BE=m
+CONFIG_RTL8188EE=m
+CONFIG_RTL8192EE=m
+CONFIG_RTL8821AE=m
+CONFIG_RTL8192CU=m
+CONFIG_RTL8XXXU=m
+CONFIG_RTL8XXXU_UNTESTED=y
+CONFIG_RTW88=m
+CONFIG_RTW88_8822BE=m
+CONFIG_RTW88_8822BS=m
+CONFIG_RTW88_8822BU=m
+CONFIG_RTW88_8822CE=m
+CONFIG_RTW88_8822CS=m
+CONFIG_RTW88_8822CU=m
+CONFIG_RTW88_8723DE=m
+CONFIG_RTW88_8723DS=m
+CONFIG_RTW88_8723DU=m
+CONFIG_RTW88_8821CE=m
+CONFIG_RTW88_8821CS=m
+CONFIG_RTW88_8821CU=m
+CONFIG_RTW88_DEBUG=y
+CONFIG_RTW89=m
+CONFIG_RTW89_8851BE=m
+CONFIG_RTW89_8852AE=m
+CONFIG_RTW89_8852BE=m
+CONFIG_RTW89_8852CE=m
+CONFIG_RTW89_DEBUGMSG=y
+# CONFIG_WLAN_VENDOR_RSI is not set
+# CONFIG_WLAN_VENDOR_TI is not set
+# CONFIG_WLAN_VENDOR_ZYDAS is not set
+# CONFIG_WLAN_VENDOR_QUANTENNA is not set
+CONFIG_NET_FAILOVER=y
+CONFIG_INPUT_FF_MEMLESS=y
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_RK805_PWRKEY=y
+# CONFIG_SERIO_SERPORT is not set
+CONFIG_SERIO_AMBAKMI=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_LEGACY_PTY_COUNT=16
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_RT288X=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL010=y
+CONFIG_SERIAL_AMBA_PL010_CONSOLE=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_HW_RANDOM_VIRTIO=m
+CONFIG_TCG_TPM=y
+CONFIG_TCG_TIS_I2C_INFINEON=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_RK3X=y
+CONFIG_I2C_SLAVE=y
+CONFIG_SPI=y
+CONFIG_SPI_BITBANG=m
+CONFIG_SPI_CADENCE_QUADSPI=y
+CONFIG_SPI_DESIGNWARE=m
+CONFIG_SPI_DW_DMA=y
+CONFIG_SPI_DW_MMIO=m
+CONFIG_SPI_PL022=y
+CONFIG_SPI_ROCKCHIP=y
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPMI=y
+CONFIG_PPS=y
+# CONFIG_PTP_1588_CLOCK is not set
+CONFIG_DEBUG_PINCTRL=y
+CONFIG_PINCTRL_RK805=y
+CONFIG_PINCTRL_SINGLE=y
+CONFIG_GPIO_ALTERA=m
+CONFIG_GPIO_DWAPB=y
+CONFIG_GPIO_MB86S7X=y
+CONFIG_GPIO_PL061=y
+CONFIG_GPIO_XGENE=y
+CONFIG_GPIO_MAX732X=y
+CONFIG_GPIO_PCA953X=y
+CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_POWER_RESET_XGENE=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_SYSCON_REBOOT_MODE=y
+CONFIG_BATTERY_SBS=m
+CONFIG_BATTERY_BQ27XXX=y
+CONFIG_BATTERY_MAX17042=m
+CONFIG_CHARGER_BQ25890=m
+CONFIG_CHARGER_BQ25980=m
+CONFIG_SENSORS_ARM_SCMI=y
+CONFIG_SENSORS_ARM_SCPI=y
+CONFIG_SENSORS_LM90=m
+CONFIG_SENSORS_PWM_FAN=m
+CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
+CONFIG_CPU_THERMAL=y
+CONFIG_THERMAL_EMULATION=y
+CONFIG_ROCKCHIP_THERMAL=m
+CONFIG_WATCHDOG=y
+CONFIG_ARM_SP805_WATCHDOG=y
+CONFIG_ARM_SBSA_WATCHDOG=y
+CONFIG_DW_WATCHDOG=y
+CONFIG_ARM_SMC_WATCHDOG=y
+CONFIG_MFD_RK8XX_I2C=y
+CONFIG_MFD_RK8XX_SPI=y
+CONFIG_MFD_STMFX=y
+CONFIG_REGULATOR_DEBUG=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_REGULATOR_PWM=y
+CONFIG_REGULATOR_RK808=y
+CONFIG_REGULATOR_VCTRL=y
+CONFIG_REGULATOR_VEXPRESS=m
+# CONFIG_HID_GENERIC is not set
+# CONFIG_USB_HID is not set
+CONFIG_USB_CONN_GPIO=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_DYNAMIC_MINORS=y
+CONFIG_USB_OTG=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_ACM=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_MUSB_HDRC=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC2=y
+CONFIG_USB_CHIPIDEA=y
+CONFIG_USB_CHIPIDEA_UDC=y
+CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_ISP1760=y
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_SIMPLE=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_HSIC_USB3503=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_USB_ULPI=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_SNP_UDC_PLAT=y
+CONFIG_USB_BDC_UDC=y
+CONFIG_USB_CONFIGFS=m
+CONFIG_USB_CONFIGFS_SERIAL=y
+CONFIG_USB_CONFIGFS_ACM=y
+CONFIG_USB_CONFIGFS_OBEX=y
+CONFIG_USB_CONFIGFS_NCM=y
+CONFIG_USB_CONFIGFS_ECM=y
+CONFIG_USB_CONFIGFS_ECM_SUBSET=y
+CONFIG_USB_CONFIGFS_RNDIS=y
+CONFIG_USB_CONFIGFS_EEM=y
+CONFIG_USB_CONFIGFS_MASS_STORAGE=y
+CONFIG_USB_CONFIGFS_F_FS=y
+CONFIG_TYPEC=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TPS6598X=m
+CONFIG_TYPEC_HD3SS3220=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_ACPI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_OF_ARASAN=y
+CONFIG_MMC_SDHCI_CADENCE=y
+CONFIG_MMC_SDHCI_F_SDH30=y
+CONFIG_MMC_SPI=y
+CONFIG_MMC_DW=y
+CONFIG_MMC_DW_EXYNOS=y
+CONFIG_MMC_DW_HI3798CV200=y
+CONFIG_MMC_DW_K3=y
+CONFIG_MMC_DW_ROCKCHIP=y
+CONFIG_MMC_MTK=y
+CONFIG_MMC_SDHCI_XENON=y
+CONFIG_MMC_SDHCI_AM654=y
+CONFIG_SCSI_UFSHCD=y
+CONFIG_SCSI_UFSHCD_PLATFORM=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_CLASS_FLASH=y
+CONFIG_LEDS_CLASS_MULTICOLOR=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_SYSCON=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_DISK=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_RK808=y
+CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_PL030=y
+CONFIG_RTC_DRV_PL031=y
+CONFIG_DMADEVICES=y
+CONFIG_PL330_DMA=y
+CONFIG_SYNC_FILE=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_INPUT=y
+CONFIG_VIRTIO_MMIO=y
+# CONFIG_VHOST_MENU is not set
+CONFIG_STAGING=y
+CONFIG_PRISM2_USB=m
+CONFIG_RTLLIB=m
+CONFIG_RTL8192E=m
+CONFIG_RTL8723BS=m
+CONFIG_R8712U=m
+CONFIG_RTS5208=m
+# CONFIG_SURFACE_PLATFORMS is not set
+CONFIG_COMMON_CLK_SCMI=y
+CONFIG_COMMON_CLK_SCPI=y
+CONFIG_COMMON_CLK_PWM=y
+CONFIG_HWSPINLOCK=y
+# CONFIG_FSL_ERRATUM_A008585 is not set
+# CONFIG_HISILICON_ERRATUM_161010101 is not set
+# CONFIG_ARM64_ERRATUM_858921 is not set
+CONFIG_ARM_MHU=y
+CONFIG_PLATFORM_MHU=y
+CONFIG_IOMMU_IO_PGTABLE_ARMV7S=y
+CONFIG_ROCKCHIP_IOMMU=y
+CONFIG_ARM_SMMU=y
+CONFIG_ARM_SMMU_V3=y
+CONFIG_ROCKCHIP_IODOMAIN=y
+CONFIG_ROCKCHIP_DTPM=m
+CONFIG_ROCKCHIP_PM_DOMAINS=y
+CONFIG_DEVFREQ_GOV_USERSPACE=m
+CONFIG_EXTCON_PTN5150=m
+CONFIG_EXTCON_USB_GPIO=y
+CONFIG_MEMORY=y
+CONFIG_IIO=y
+CONFIG_MAX9611=m
+CONFIG_ROCKCHIP_SARADC=m
+CONFIG_IIO_ST_LSM6DSX=m
+CONFIG_SENSORS_ISL29018=m
+CONFIG_VCNL4000=m
+CONFIG_IIO_ST_MAGN_3AXIS=m
+CONFIG_MPL3115=m
+CONFIG_PWM=y
+CONFIG_PWM_ROCKCHIP=y
+CONFIG_PHY_ROCKCHIP_DPHY_RX0=m
+CONFIG_PHY_ROCKCHIP_EMMC=y
+CONFIG_PHY_ROCKCHIP_INNO_HDMI=m
+CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_PHY_ROCKCHIP_INNO_CSIDPHY=m
+CONFIG_PHY_ROCKCHIP_INNO_DSIDPHY=m
+CONFIG_PHY_ROCKCHIP_PCIE=m
+CONFIG_PHY_ROCKCHIP_TYPEC=y
+CONFIG_PHY_ROCKCHIP_USB=m
+CONFIG_POWERCAP=y
+CONFIG_ARM_SCMI_POWERCAP=y
+CONFIG_DTPM=y
+CONFIG_DTPM_CPU=y
+CONFIG_DTPM_DEVFREQ=y
+CONFIG_ARM_SMMU_V3_PMU=m
+CONFIG_NVMEM_RMEM=m
+CONFIG_NVMEM_ROCKCHIP_EFUSE=m
+CONFIG_NVMEM_ROCKCHIP_OTP=m
+CONFIG_TEE=y
+CONFIG_OPTEE=y
+CONFIG_MUX_MMIO=y
+CONFIG_INTERCONNECT=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_OVERLAY_FS=m
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_HUGETLBFS=y
+CONFIG_EFIVAR_FS=y
+CONFIG_SQUASHFS=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_V4_1=y
+CONFIG_NFS_V4_2=y
+CONFIG_ROOT_NFS=y
+CONFIG_9P_FS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_SECURITY=y
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_CURVE25519=m
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_BLAKE2B=m
+CONFIG_CRYPTO_XXHASH=m
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_USER_API_RNG=m
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA512_ARM64_CE=m
+CONFIG_CRYPTO_SHA3_ARM64=m
+CONFIG_CRYPTO_SM3_ARM64_CE=m
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_BS=m
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=m
+CONFIG_CRYPTO_DEV_ROCKCHIP=y
+CONFIG_CRYPTO_DEV_CCREE=m
+CONFIG_INDIRECT_PIO=y
+CONFIG_CRC_CCITT=m
+CONFIG_CRC8=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=32
+CONFIG_PRINTK_TIME=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_FS=y
+# CONFIG_SCHED_DEBUG is not set
+# CONFIG_FTRACE is not set
+CONFIG_MEMTEST=y
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+BOARD_DIR="$(dirname $0)"
+
+install -m 0644 -D $BOARD_DIR/extlinux.conf $TARGET_DIR/boot/extlinux/extlinux.conf
@@ -0,0 +1,14 @@
+--- a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts	2023-11-08 14:09:07.000000000 +0100
+++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts	2024-01-22 07:31:14.949550828 +0100
+@@ -20,6 +20,11 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial2:1500000n8";
+
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+ 	};
+ 
+ 	gmac_clk: gmac-clock {
@@ -1,4 +1,4 @@
 label Infix (aarch64)
 	kernel /boot/Image
 	fdtdir /boot
-	append ${bootargs_root} ${bootargs_rauc} ${bootargs_log}
+	append ${bootargs_root} ${bootargs_log} -- ${bootargs_user}
@@ -6,3 +6,8 @@ if [ -L "$TARGET_DIR/etc/dropbear" ]; then
 	rm    "$TARGET_DIR/etc/dropbear"
 	mkdir "$TARGET_DIR/etc/dropbear"
 fi
+
+# Classic builds don't have D-Bus
+if [ -f "$TARGET_DIR/etc/dnsmasq.conf" ]; then
+    sed -i '/enable-dbus/d' "$TARGET_DIR/etc/dnsmasq.conf"
+fi
@@ -1 +1 @@
-run [S] /lib/infix/swup --
+run [S] /libexec/infix/swup --
@@ -47,18 +47,18 @@ ram([0-9]*)        root:disk 660 >rd/%1
 loop([0-9]+)       root:disk 660 >loop/%1
 sr[0-9]*           root:cdrom 660 @ln -sf $MDEV cdrom
 fd[0-9]*           root:floppy 660
-#SUBSYSTEM=block;.* root:disk 660 */lib/infix/storage-device
+#SUBSYSTEM=block;.* root:disk 660 */libexec/infix/storage-device

 # Run settle-nics every time new NIC appear.
 # If you don't want to auto-populate /etc/mactab with NICs,
 # run 'settle-nis' without '--write-mactab' param.
-#-SUBSYSTEM=net;DEVPATH=.*/net/.*;.*     root:root 600 @/lib/infix/settle-nics --write-mactab
+#-SUBSYSTEM=net;DEVPATH=.*/net/.*;.*     root:root 600 @/libexec/infix/settle-nics --write-mactab

 net/tun[0-9]*   root:netdev 660
 net/tap[0-9]*   root:root 600

 # alsa sound devices and audio stuff
-#SUBSYSTEM=sound;.*  root:audio 660 @/lib/infix/sound-control
+#SUBSYSTEM=sound;.*  root:audio 660 @/libexec/infix/sound-control

 adsp        root:audio 660 >sound/
 audio       root:audio 660 >sound/
@@ -106,7 +106,7 @@ cpu([0-9]+)     root:root 600 =cpu/%1/cpuid
 msr([0-9]+)     root:root 600 =cpu/%1/msr

 # Populate /dev/bus/usb.
-#SUBSYSTEM=usb;DEVTYPE=usb_device;.* root:root 660 */lib/infix/dev-bus-usb
+#SUBSYSTEM=usb;DEVTYPE=usb_device;.* root:root 660 */libexec/infix/dev-bus-usb

 # Catch-all other devices, Right now useful only for debuging.
-#.* root:root 660 */lib/infix/catch-all
+#.* root:root 660 */libexec/infix/catch-all
@@ -2,5 +2,5 @@
 # Probe for various types of harware features

 if dmesg |grep -q QEMU || test -d /sys/module/qemu_fw_cfg; then
-   initctl cond set qemu
+    initctl -nbq cond set qemu
 fi
@@ -23,7 +23,7 @@ config SIGN_KEY
 menuconfig DISK_IMAGE
 	bool "Disk image"
 	help
-	  Compose a full disk image with redundant firmware partitions,
+	  Compose a full disk image with redundant Linux OS partitions,
 	  configuration partition, etc.

 	  This is useful when:
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.36.0
-# Tue Oct  3 18:00:40 2023
+# Thu Feb  8 08:22:32 2024
 #
 CONFIG_HAVE_DOT_CONFIG=y

@@ -1132,9 +1132,9 @@ CONFIG_SV_DEFAULT_SERVICE_DIR=""
 CONFIG_SH_IS_ASH=y
 # CONFIG_SH_IS_HUSH is not set
 # CONFIG_SH_IS_NONE is not set
-CONFIG_BASH_IS_ASH=y
+# CONFIG_BASH_IS_ASH is not set
 # CONFIG_BASH_IS_HUSH is not set
-# CONFIG_BASH_IS_NONE is not set
+CONFIG_BASH_IS_NONE=y
 CONFIG_SHELL_ASH=y
 CONFIG_ASH=y
 CONFIG_ASH_OPTIMIZE_FOR_SIZE=y
@@ -1,3 +1,4 @@
+ifeq ($(SIGN_ENABLED),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk

 define RAUC_POST_BUILD_INSTALL_CERT
@@ -7,3 +8,4 @@ define RAUC_POST_BUILD_INSTALL_CERT
 		cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)
 endef
 RAUC_POST_BUILD_HOOKS += RAUC_POST_BUILD_INSTALL_CERT
+endif
@@ -1,65 +0,0 @@
-
-image aux.ext4 {
-	mountpoint = "/aux"
-	temporary = true
-	size = 2M
-
-	ext4 {
-		label = "aux"
-	}
-}
-
-image cfg.ext4 {
-	empty = true
-	temporary = true
-	size = 16M
-
-	ext4 {
-		label = "cfg"
-	}
-}
-
-image var.ext4 {
-	empty = true
-	temporary = true
-	# 44M - 24k (GPT backup)
-	size = 45032k
-
-	ext4 {
-		label = "var"
-	}
-}
-
-image mmc.img {
-	size = 512M
-	hdimage {
-		partition-table-type = "gpt"
-	}
-
-	partition aux {
-		offset = 2M
-		image = "aux.ext4"
-	}
-
-	partition primary {
-		image = "rootfs.squashfs"
-		size = 224M
-	}
-
-	partition secondary {
-		bootable = true
-		image = "rootfs.squashfs"
-		size = 224M
-	}
-
-	partition cfg {
-		image = "cfg.ext4"
-	}
-
-	partition var {
-		image = "var.ext4"
-	}
-}
-
-# Silence genimage warnings
-config {}
@@ -7,6 +7,7 @@ image aux.ext4 {

 	ext4 {
 		label = "aux"
+		use-mke2fs = true
 	}
 }

@@ -17,6 +18,7 @@ image cfg.ext4 {

 	ext4 {
 		label = "cfg"
+		use-mke2fs = true
 	}
 }

@@ -27,6 +29,7 @@ image var.ext4 {

 	ext4 {
 		label = "var"
+		use-mke2fs = true
 	}
 }

@@ -29,7 +29,7 @@ rm -f "$TARGET_DIR/etc/os-release"
 {
    echo "NAME=\"$INFIX_NAME\""
    echo "ID=$INFIX_ID"
-    echo "PRETTY_NAME=\"$INFIX_TAGLINE\""
+    echo "PRETTY_NAME=\"$INFIX_TAGLINE $VERSION\""
    echo "ID_LIKE=\"${ID}\""
    echo "VERSION=\"${VERSION}\""
    echo "VERSION_ID=${VERSION}"
@@ -22,7 +22,7 @@ diskimg=disk.img
 ver()
 {
    if [ -n "$INFIX_RELEASE" ]; then
-	printf -- "-%s" "$INFIX_RELEASE"
+	printf -- "-%s" "${INFIX_RELEASE#v}"
 	return
    fi
 }
@@ -42,7 +42,7 @@ fi
 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
    ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk.img"
+    diskimg="${NAME}-disk$(ver).img"
    bootcfg=
    if [ "$DISK_IMAGE_BOOT_DATA" ]; then
 	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
@@ -73,10 +73,6 @@ if [ "$FIT_IMAGE" = "y" ]; then
 fi

 if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
-    if [ -z "${NAME##*minimal*}" ]; then
-	NAME=$(echo "$NAME" | sed 's/-minimal//')
-    fi
-
    rel=$(ver)
    ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
    if [ -n "$rel" ]; then
@@ -85,6 +81,7 @@ if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
 fi

 # Menuconfig support for modifying Qemu args in release tarballs
+cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/bin/onieprom" "$BINARIES_DIR/"
 cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
 sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
    -e "s/@DISK_IMG@/$diskimg/"   \
@@ -62,9 +62,24 @@ config QEMU_CONSOLE_SERIAL
 endchoice

 config QEMU_MACHINE
-	string
-	default "qemu-system-aarch64 -M virt -cpu cortex-a72 -m 256M"   if QEMU_aarch64
-	default "qemu-system-x86_64 -M q35,accel=kvm -cpu host -m 256M" if QEMU_x86_64
+	string "Select emulated machine"
+	default "qemu-system-aarch64 -M virt -cpu cortex-a72"   if QEMU_aarch64
+	default "qemu-system-x86_64 -M q35,accel=kvm -cpu host" if QEMU_x86_64
+	help
+	  You should not have to change this setting, although you may
+	  want to tweak it, or change the acceleration.
+
+	  The default is based on the Buildroot architecture, selected by
+	  the defconfig you started with.  Currently Infix supports only
+	  aarch64 (ARM64) and x86_64 (AMD64).
+
+config QEMU_MACHINE_RAM
+	string "RAM size (k/M/G)"
+	default "384M"
+	help
+	  The default, 384 MiB, works for most configurations, even less for
+	  the Infix Classic builds.  However, if you get kernel panic with:
+	  "System is deadlocked on memory", try increasing this one.

 config QEMU_KERNEL
 	string
@@ -103,6 +118,9 @@ config QEMU_RW_VAR
 	default "var.ext4"
 endif

+config QEMU_VPD
+	bool "Emulate a Vital Product Data (VPD) Memory"
+
 config QEMU_HOST
 	string "Export host filesystem path"
 	default "/tmp"
@@ -137,6 +155,10 @@ endchoice
 config QEMU_NET_MODEL
 	string "Interface model"
 	default "virtio-net-pci"
+	help
+	  The default, virtio-net-pci, NIC works for most use-cases, but
+	  if you want to play with low-level stuff like ethtool, you
+	  might want to test the Intel 82545EM driver, e1000.

 config QEMU_NET_BRIDGE_DEV
 	string "Bridge device"
@@ -19,15 +19,27 @@
 #

 # Local variables
+imgdir=$(readlink -f $(dirname "$0"))
 prognm=$(basename "$0")

 usage()
 {
-    echo "usage: $prognm [opts]"
+    echo "Usage:"
+    echo " $prognm [opts] [ARGS]"
    echo
-    echo " -c    Run menuconfig to change Qemu settings"
-    echo " -h    This help text"
+    echo "Options:"
+    echo "  -c     Run menuconfig to change Qemu settings"
+    echo "  -h     This help text"
    echo
+    echo "Arguments:"
+    echo "  ARGS1  Args before the '--' separator are for kernel space"
+    echo "  --     Separator"
+    echo "  ARGS2  Args after the '--' separator are for the init process"
+    echo "         Also, qemu.cfg has QEMU_APPEND which can affect this."
+    echo
+    echo "Example:"
+    echo "  qemu.sh -- finit.debug"
+    echo "___________________________________________________________________"
    echo "Note: 'kconfig-frontends' package (Debian/Ubuntu) must be installed"
    echo "      for -c to work: sudo apt install kconfig-frontents"

@@ -129,6 +141,18 @@ serial_args()
    echo -n "-device virtconsole,nr=1,name=gdbserver,chardev=gdbserver "
 }

+usb_args()
+{
+    USBSTICK="usb.vfat"
+    if ! [ -f $USBSTICK ]; then
+	dd if=/dev/zero of=${USBSTICK} bs=8M count=1 >/dev/null 2>&1
+	mkfs.vfat $USBSTICK >/dev/null 2>&1
+    fi
+    echo -n "-drive if=none,id=usbstick,format=raw,file=${USBSTICK} "
+    echo -n "-usb "
+    echo -n "-device usb-ehci,id=ehci "
+    echo -n "-device usb-storage,bus=ehci.0,drive=usbstick "
+}
 rw_args()
 {
    [ "$CONFIG_QEMU_RW" ] || return
@@ -169,7 +193,7 @@ net_dev_args()
 net_args()
 {
    # Infix will pick up this file via fwcfg and install it to /etc
-    mactab=$(dirname "$CONFIG_QEMU_ROOTFS")/mactab
+    mactab=${imgdir}/mactab
    :> "$mactab"
    echo -n "-fw_cfg name=opt/mactab,file=$mactab "

@@ -192,6 +216,34 @@ net_args()
    fi
 }

+# Vital Product data
+vpd_args()
+{
+    [ "$CONFIG_QEMU_VPD" = "y" ] || return
+
+    vpd_file="${imgdir}/vpd"
+
+    if ! [ -f "$vpd_file" ]; then
+	onieprom="${imgdir}/onieprom"
+
+	# This is you QEMU factory/default password:
+	pwhash=$(echo -n "admin" | mkpasswd -s -m sha256crypt)
+
+	cat <<EOF | "$onieprom" -e >"$vpd_file"
+{
+  "manufacture-date": "$(date +"%m/%d/%Y %H:%M:%S")",
+  "vendor-extension": [
+    [
+      61046,
+      "{\"pwhash\":\"$pwhash\"}"
+    ]
+  ]
+}
+EOF
+    fi
+    echo -n "-fw_cfg name=opt/vpd,file=$vpd_file"
+}
+
 wdt_args()
 {
    echo -n "-device i6300esb -rtc clock=host"
@@ -201,14 +253,16 @@ run_qemu()
 {
    local qemu
    read qemu <<EOF
-	$CONFIG_QEMU_MACHINE \
+	$CONFIG_QEMU_MACHINE -m $CONFIG_QEMU_MACHINE_RAM \
 	  $(loader_args) \
 	  $(rootfs_args) \
 	  $(serial_args) \
 	  $(rw_args) \
+	  $(usb_args) \
 	  $(host_args) \
 	  $(net_args) \
 	  $(wdt_args) \
+	  $(vpd_args) \
 	  $CONFIG_QEMU_EXTRA
 EOF

@@ -316,6 +370,10 @@ else
    load_qemucfg qemu.cfg
 fi

+if [ -z "$QEMU_EXTRA_APPEND" ]; then
+    QEMU_EXTRA_APPEND="$*"
+fi
+
 generate_dot

 echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
@@ -323,4 +381,3 @@ line=$(stty -g)
 stty raw
 run_qemu $(dtb_args)
 stty "$line"
-
@@ -0,0 +1,218 @@
+#!/usr/bin/env python3
+
+import binascii
+import struct
+
+HDRMGC = b"TlvInfo"
+HDRVER = 1
+HDRFMT = ">7sxBH"
+HDRLEN = struct.calcsize(HDRFMT)
+
+CRCFMT = ">BBL"
+CRCLEN = struct.calcsize(CRCFMT)
+
+def pack_varstr(s, maxlen=0xff):
+    b = bytes(s, "ascii")
+    assert(len(b) <= maxlen)
+    return b
+
+def unpack_varstr(b):
+    return b.decode("ascii")
+
+
+def pack_u8(num):
+    return struct.pack("B", num)
+
+def unpack_u8(b):
+    return struct.unpack("B", b)[0]
+
+
+def pack_u16(num):
+    return struct.pack(">H", num)
+
+def unpack_u16(b):
+    return struct.unpack(">H", b)[0]
+
+
+def pack_u32(num):
+    return struct.pack(">L", num)
+
+def unpack_u32(b):
+    return struct.unpack(">L", b)[0]
+
+
+def pack_date(datestr):
+    assert(len(datestr) == 19)
+    return pack_varstr(datestr, 19)
+
+def pack_country(cstr):
+    assert(len(cstr) == 2)
+    return pack_varstr(cstr, 2)
+
+def pack_mac(macstr):
+    return struct.pack("6B", *[int(o, 16) for o in macstr.split(":")])
+
+def unpack_mac(b):
+    o = struct.unpack("6B", b)
+    return f"{o[0]:02x}:{o[1]:02x}:{o[2]:02x}:{o[3]:02x}:{o[4]:02x}:{o[5]:02x}"
+
+OPS = {
+    "varstr":   (pack_varstr, unpack_varstr),
+    "u8":       (pack_u8, unpack_u8),
+    "u16":      (pack_u16, unpack_u16),
+    "u32":      (pack_u32, unpack_u32),
+
+    "date":     (pack_date, unpack_varstr),
+    "country":  (pack_country, unpack_varstr),
+    "mac":      (pack_mac, unpack_mac),
+}
+
+TLV = (
+    { "type": 0x21, "name": "product-name",     "ops": "varstr"  },
+    { "type": 0x22, "name": "part-number",      "ops": "varstr"  },
+    { "type": 0x23, "name": "serial-number",    "ops": "varstr"  },
+    { "type": 0x24, "name": "mac-address",      "ops": "mac"     },
+    { "type": 0x25, "name": "manufacture-date", "ops": "date"    },
+    { "type": 0x26, "name": "device-version",   "ops": "u8"      },
+    { "type": 0x27, "name": "label-revision",   "ops": "varstr"  },
+    { "type": 0x28, "name": "platform-name",    "ops": "varstr"  },
+    { "type": 0x29, "name": "onie-version",     "ops": "varstr"  },
+    { "type": 0x2a, "name": "num-macs",         "ops": "u16"     },
+    { "type": 0x2b, "name": "manufacturer",     "ops": "varstr"  },
+    { "type": 0x2c, "name": "country-code",     "ops": "country" },
+    { "type": 0x2d, "name": "vendor",           "ops": "varstr"  },
+    { "type": 0x2e, "name": "diag-version",     "ops": "varstr"  },
+    { "type": 0x2f, "name": "service-tag",      "ops": "varstr"  },
+)
+
+TLV_VENDOR_EXTENSION = 0xfd
+TLV_CRC32 = 0xfe
+
+def _tlv_by_lambda(fn):
+    info = next(filter(fn, TLV))
+    if "ops" in info:
+        return info, OPS[info["ops"]]
+    else:
+        return info
+
+def tlv_by_name(name):
+    try:
+        return _tlv_by_lambda(lambda info: info["name"] == name)
+    except StopIteration:
+        raise ValueError(f"Unknown type name \"{name}\"")
+
+def tlv_by_type(t):
+    try:
+        return _tlv_by_lambda(lambda info: info["type"] == t)
+    except StopIteration:
+        raise ValueError(f"Unknown type id {t}")
+
+def into_tlv(d):
+    def pack_vendor(exts):
+        out = b""
+        for (iana_pen, val) in exts:
+            b = bytes(val, "utf-8")
+            l = len(b) + struct.calcsize(">L")
+            assert(l <= 0xff)
+            out += struct.pack(">BBL", TLV_VENDOR_EXTENSION, l, iana_pen) + b
+
+        return out
+
+    out = b""
+
+    # Generate all optional data
+    for (k, v) in sorted(d.items()):
+        if k == "vendor-extension":
+            out += pack_vendor(v)
+        else:
+            info, (pack, _) = tlv_by_name(k)
+            val = pack(v)
+            out += struct.pack("BB", info["type"], len(val)) + val
+
+    # Prepend the header now that we know the total length of the
+    # optional fields - make sure sure to include the CRC TLV length,
+    # which is appended in the last step
+    out  = struct.pack(HDRFMT, HDRMGC, HDRVER, len(out) + CRCLEN) + out
+
+    out += struct.pack("BB", TLV_CRC32, struct.calcsize(">L"))
+    out += struct.pack(">L", binascii.crc32(out))
+    return out
+
+def from_tlv(f):
+    d = {}
+
+    def unpack_vendor(ext):
+        head, tail = ext[:4], ext[4:]
+        iana_pen = struct.unpack(">L", head)[0]
+        val = tail.decode("utf-8")
+
+        if "vendor-extension" not in d:
+            d["vendor-extension"] = []
+
+        d["vendor-extension"].append([iana_pen, val])
+
+    head = f.read(HDRLEN)
+    magic, ver, l = struct.unpack(HDRFMT, head)
+    assert(magic == HDRMGC)
+    assert(ver == 1)
+
+    tail = f.read(l)
+    b = head + tail
+    assert(len(b) >= HDRLEN + l)
+
+    crcoffs = HDRLEN + l - CRCLEN
+    t, l, v = struct.unpack(CRCFMT, b[crcoffs:crcoffs+CRCLEN])
+    assert(t == TLV_CRC32)
+    assert(v == binascii.crc32(b[:crcoffs + struct.calcsize("BB")]))
+
+    while len(tail) >= 2:
+        t, l = struct.unpack("BB", tail[:2])
+        v = tail[2:l+2]
+        tail = tail[l+2:]
+
+        if t == TLV_VENDOR_EXTENSION:
+            unpack_vendor(v)
+            continue
+        elif t == TLV_CRC32:
+            break
+
+        info, (_, unpack) = tlv_by_type(t)
+        d[info["name"]] = unpack(v)
+
+    return d
+
+if __name__ == "__main__":
+    import argparse
+    import json
+    import os
+    import sys
+
+    parser = argparse.ArgumentParser(prog='onieprom')
+
+    parser.add_argument("infile", nargs="?", default=sys.stdin, type=argparse.FileType("rb", 0))
+    parser.add_argument("outfile", nargs="?", default=sys.stdout, type=argparse.FileType("wb"))
+
+    parser.add_argument("-e", "--encode", default=False, action="store_true",
+                        help="Encode JSON input to binary output")
+
+    parser.add_argument("-d", "--decode", default=False, action="store_true",
+                        help="Decode binary input to JSON output")
+
+    args = parser.parse_args()
+
+    if (not args.encode) and (not args.decode):
+        c = args.infile.read(1)
+        args.infile.seek(0, 0)
+
+        if c == b"{":
+            args.encode = True
+        elif c == b"T":
+            args.decode = True
+        else:
+            sys.stderr.write("Neither encode nor decode specified, and could not infer operation from input")
+            sys.exit(1)
+
+    if args.encode:
+        args.outfile.buffer.write(into_tlv(json.load(args.infile)))
+    else:
+        args.outfile.write(json.dumps(from_tlv(args.infile)))
@@ -0,0 +1,13 @@
+#!/bin/sh
+Q=$@
+
+/bin/echo -n "$Q, are you sure (y/N)? "
+read -n1 yorn
+echo
+
+if [ x$yorn != "xy" ] && [ x$yorn != "xY" ]; then
+   echo "OK, aborting."
+   exit 1
+fi
+
+exit 0
@@ -0,0 +1 @@
+/usr/bin/mg
@@ -1,141 +0,0 @@
-_cond()
-{
-    initctl -pt cond dump |  awk '{print $4}' | sed 's/<\(.*\)>/\1/'
-}
-
-_ident()
-{
-    if [ -n "$1" ]; then
-	initctl ident | grep -q $1
-    else
-	initctl ident
-    fi
-}
-
-_svc()
-{
-    initctl ls -pt | grep $1 | sed "s/.*\/\(.*\)/\1/g" | sort -u
-}
-
-_enabled()
-{
-    echo "$(_svc enabled)"
-}
-
-_available()
-{
-    all=$(mktemp)
-    ena=$(mktemp)
-    echo "$(_svc available)" >$all
-    echo "$(_svc enabled)"   >$ena
-    grep -v -f $ena $all
-    rm $all $ena
-}
-
-# Determine first non-option word. Usually the command
-_firstword() {
-	local firstword i
-
-	firstword=
-	for ((i = 1; i < ${#COMP_WORDS[@]}; ++i)); do
-		if [[ ${COMP_WORDS[i]} != -* ]]; then
-			firstword=${COMP_WORDS[i]}
-			break
-		fi
-	done
-
-	echo $firstword
-}
-
-# Determine last non-option word. Uusally a sub-command
-_lastword() {
-	local lastword i
-
-	lastword=
-	for ((i = 1; i < ${#COMP_WORDS[@]}; ++i)); do
-		if [[ ${COMP_WORDS[i]} != -* ]] && [[ -n ${COMP_WORDS[i]} ]] && [[ ${COMP_WORDS[i]} != $cur ]]; then
-			lastword=${COMP_WORDS[i]}
-		fi
-	done
-
-	echo $lastword
-}
-
-_initctl()
-{
-    local cur command
-
-    cur=${COMP_WORDS[COMP_CWORD]}
-    prev="${COMP_WORDS[COMP_CWORD-1]}"
-    firstword=$(_firstword)
-    lastword=$(_lastword)
-
-    commands="status cond debug help kill ls log version  list enable	\
-	      disable touch show cat edit create delete reload start	\
-	      stop restart signal cgroup ps top plugins runlevel reboot	\
-	      halt poweroff suspend utmp"
-    cond_cmds="set get clear status dump"
-    cond_types="hook net pid service task usr"
-    signals="int term hup stop tstp cont usr1 usr2 pwr"
-    options="-b --batch				\
-	     -c --create			\
-	     -d --debug				\
-	     -f --force				\
-	     -h --help				\
-	     -j --json				\
-	     -n --noerr				\
-	     -1 --once				\
-	     -p --plain				\
-	     -q --quiet				\
-	     -t --no-heading			\
-	     -v --verbose			\
-	     -V --version"
-
-    case "${firstword}" in
-	enable)
-	    COMPREPLY=($(compgen -W "$(_available)" -- $cur))
-	    ;;
-	disable|touch)
-	    COMPREPLY=($(compgen -W "$(_enabled)" -- $cur))
-	    ;;
-	show|cat|edit|delete)
-	    COMPREPLY=($(compgen -W "$(_svc .)" -- $cur))
-	    ;;
-	start|stop|restart|log|status)
-	    COMPREPLY=($(compgen -W "$(_ident)" -- $cur))
-	    ;;
-	signal|kill)
-	    if $(_ident "${prev}"); then
-		COMPREPLY=($(compgen -W "$signals" -- $cur))
-	    else
-		COMPREPLY=($(compgen -W "$(_ident)" -- $cur))
-	    fi
-	    ;;
-	cond)
-	    case "${lastword}" in
-		set|clear)
-		    compopt -o nospace
-		    COMPREPLY=($(compgen -W "usr/" -- $cur))
-		    ;;
-		get)
-		    COMPREPLY=($(compgen -W "$(_cond)" -- $cur))
-		    ;;
-		dump)
-		    COMPREPLY=($(compgen -W "$cond_types" -- $cur))
-		    ;;
-		*)
-		    COMPREPLY=($(compgen -W "$cond_cmds" -- $cur))
-		    ;;
-	    esac
-	    ;;
-	*)
-	    COMPREPLY=($(compgen -W "$commands" -- $cur))
-	    ;;
-    esac
-
-    if [[ $cur == -* ]]; then
-	COMPREPLY=($(compgen -W "$options" -- $cur))
-    fi
-}
-
-complete -F _initctl initctl
@@ -0,0 +1,27 @@
+# This file defines default behavior and a skeleton for including config
+# snippets from both confd, i.e., ietf-system.yang, and DHCP clients.
+# Default values taken from Debian /etc/chrony/chrony.conf
+
+# *.conf when acting as an NTP server
+confdir /etc/chrony/conf.d
+
+# *.sources from DHCP clients, e.g., /run/chrony-dhcp/$ifname.sources:
+#                                    server 192.0.2.1 iburst
+sourcedir /run/chrony/dhcp-sources.d
+
+# *.sources for NTP servers generated by confd:ietf-system.c
+sourcedir /etc/chrony/sources.d
+
+# Where to store the system clock rate information across reboots.
+driftfile /var/lib/chrony/chrony.drift
+
+# Stop bad estimates upsetting machine clock.
+maxupdateskew 100.0
+
+# Enables kernel synchronisation (every 11 minutes) of the real-time
+# clock. Note that it can’t be used along with the 'rtcfile' directive.
+rtcsync
+
+# Step the system clock instead of slewing it if the adjustment is
+# larger than one second, but only in the first three clock updates.
+makestep 1 3
@@ -0,0 +1 @@
+CHRONY_ARGS="-f /etc/chrony/chrony.conf"
@@ -1,3 +1,3 @@
-run [S]                /lib/infix/probe -- Probing system information
-run [S] <pid/syslogd> /lib/infix/sysctl-sync-ip-conf --
-run [S] <pid/syslogd> /lib/infix/nameif -- Probing network interfaces
+run [S] log:console   /libexec/infix/probe -- Probing system information
+run [S] <pid/syslogd> /libexec/infix/sysctl-sync-ip-conf --
+run [S] <pid/syslogd> /libexec/infix/nameif -- Probing network interfaces
@@ -0,0 +1,4 @@
+service :%i pid:!/run/k8s-logger-%i.pid <usr/container:%i> \
+	[2345] k8s-logger -cni %i -f local1 /run/containers/%i.fifo -- Logger for container %i
+sysv    :%i pid:!/run/container:%i.pid <pid/k8s-logger:%i> kill:10 \
+	[2345] container -n %i -- container %i
@@ -1 +1,5 @@
-service [2345789] log:prio:user.notice rauc service -- Software update service
+set G_MESSAGES_DEBUG=nocolor
+service [2345] <service/dbus/running> \
+	env:-/etc/default/rauc log:prio:user.notice \
+	rauc service $RAUC_ARGS -- Software update service
+
@@ -1,5 +1,5 @@
 # Override Finit plugin
-service cgroup.system name:dbus pid:!/run/messagebus.pid <pid/syslogd>    \
-	[S123456789] /usr/bin/dbus-daemon --nofork --system --syslog-only \
+service cgroup.system name:dbus notify:none pid:!/run/messagebus.pid \
+	[S123456789] <pid/syslogd> /usr/bin/dbus-daemon --nofork --system --syslog-only \
 	-- D-Bus message bus daemon

@@ -12,11 +12,11 @@ debugfs	/sys/kernel/debug	debugfs		nofail			0	0
 cfgfs		/config		configfs	nofail,noauto		0	0

 # The chosen backing storage for the overlays placed on /cfg, /etc,
-# /home, /root, and /var, are determined dynamically by /lib/infix/mnt
+# /home, /root, and /var, are determined dynamically by /libexec/infix/mnt
 # depending on the available devices.
 mnttmp		/mnt/tmp	tmpfs		defaults			0	0
 LABEL=aux	/mnt/aux	auto		noatime,nodiratime,noauto	0	0
 LABEL=var	/mnt/var	auto		noatime,nodiratime,noauto	0	0
 LABEL=cfg	/mnt/cfg	auto		noatime,nodiratime,noauto	0	0
 hostfs		/mnt/host	9p		cache=none,msize=16384,noauto	0	0
-/lib/infix/mnt# /cfg		helper		none				0	0
+/libexec/infix/mnt# /cfg		helper		none				0	0
@@ -0,0 +1,3 @@
+# Do not authorize usb ports before they have been checked in in the device-tree
+options usbcore authorized_default=0
+ 
@@ -0,0 +1,4 @@
+.-------.
+|  . .  | Infix -- a Network Operating System
+|-. v .-| https://kernelkit.github.io
+'-'---'-'
@@ -1,122 +0,0 @@
-
-#user  nobody;
-worker_processes  1;
-
-#error_log  logs/error.log;
-#error_log  logs/error.log  notice;
-#error_log  logs/error.log  info;
-
-#pid        logs/nginx.pid;
-
-
-events {
-    worker_connections  1024;
-}
-
-
-http {
-    include       mime.types;
-    default_type  application/octet-stream;
-
-    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-    #                  '$status $body_bytes_sent "$http_referer" '
-    #                  '"$http_user_agent" "$http_x_forwarded_for"';
-
-    #access_log  logs/access.log  main;
-
-    sendfile        on;
-    #tcp_nopush     on;
-
-    #keepalive_timeout  0;
-    keepalive_timeout  65;
-
-    #gzip  on;
-
-    server {
-        listen       80;
-        server_name  localhost;
-
-        #charset koi8-r;
-
-        #access_log  logs/host.access.log  main;
-
-        location / {
-            root   html;
-            index  index.html index.htm;
-        }
-
-        location /restconf/ {
-            fastcgi_pass unix:/var/run/clixon/restconf.sock;
-            include fastcgi_params;
-        }
-
-        #error_page  404              /404.html;
-
-        # redirect server error pages to the static page /50x.html
-        #
-        error_page   500 502 503 504  /50x.html;
-        location = /50x.html {
-            root   html;
-        }
-
-        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
-        #
-        #location ~ \.php$ {
-        #    proxy_pass   http://127.0.0.1;
-        #}
-
-        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
-        #
-        #location ~ \.php$ {
-        #    root           html;
-        #    fastcgi_pass   127.0.0.1:9000;
-        #    fastcgi_index  index.php;
-        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
-        #    include        fastcgi_params;
-        #}
-
-        # deny access to .htaccess files, if Apache's document root
-        # concurs with nginx's one
-        #
-        #location ~ /\.ht {
-        #    deny  all;
-        #}
-    }
-
-
-    # another virtual host using mix of IP-, name-, and port-based configuration
-    #
-    #server {
-    #    listen       8000;
-    #    listen       somename:8080;
-    #    server_name  somename  alias  another.alias;
-
-    #    location / {
-    #        root   html;
-    #        index  index.html index.htm;
-    #    }
-    #}
-
-
-    # HTTPS server
-    #
-    #server {
-    #    listen       443 ssl;
-    #    server_name  localhost;
-
-    #    ssl_certificate      cert.pem;
-    #    ssl_certificate_key  cert.key;
-
-    #    ssl_session_cache    shared:SSL:1m;
-    #    ssl_session_timeout  5m;
-
-    #    ssl_ciphers  HIGH:!aNULL:!MD5;
-    #    ssl_prefer_server_ciphers  on;
-
-    #    location / {
-    #        root   html;
-    #        index  index.html index.htm;
-    #    }
-    #}
-
-}
@@ -0,0 +1 @@
+Banner /etc/banner
@@ -0,0 +1 @@
+%wheel ALL=(ALL:ALL) NOPASSWD: ALL
@@ -0,0 +1 @@
+local1.*                -/var/log/container
@@ -0,0 +1 @@
+local0.*                -/var/log/upgrade.log
@@ -1 +1,3 @@
-d  /var/lib/chrony	0755 chrony chrony
+d  /var/lib/chrony		0750 chrony chrony
+d  /run/chrony			0750 chrony chrony
+d  /run/chrony/dhcp-sources.d	0755 chrony chrony
@@ -17,10 +17,37 @@

 set -e

-nm=$(basename $0)
+nm=$(basename "$0")
 err=0
 opt="-k"

+# External button or bootloader changed kernel command line
+check_factory()
+{
+    if [ -f /mnt/cfg/infix/.reset ]; then
+	return 0;
+    fi
+
+    if grep -q 'finit.cond=factory-reset' /proc/cmdline; then
+	return 0;
+    fi
+
+    # Add to your br2-external to extend factory-reset check
+    if [ ! -x /libexec/infix/check-factory ]; then
+	return 1;
+    fi
+
+    /libexec/infix/check-factory
+}
+
+factory_reset()
+{
+    # XXX: flash LEDs to confirm factory-reset in progress
+    logger $opt -p user.crit -t "$nm" "Resetting to factory defaults."
+    rm -rf /mnt/cfg/* /mnt/var/*
+    sync
+}
+
 mount_rw()
 {
    # If something is already setup, leave it be.
@@ -60,6 +87,10 @@ mount_overlay()
    mkdir -p -m 0755 "$u"
    mkdir -p -m 0755 "$w"

+    # Ensure that all users in wheel can create the .reset file
+    # on /cfg and upload docker images to /var
+    chgrp wheel "$(dirname "$u")"
+
    mount -t overlay "$tag-overlay" "$dst" \
 	  -o lowerdir="$dst",upperdir="$u",workdir="$w"
 }
@@ -78,12 +109,8 @@ varsrc=/mnt/var
 if ! mount_rw var >/dev/null 2>&1; then
    logger $opt -p user.warn -t "$nm" \
 	   "No persistent storage found for /var, only /var/lib is persisted."
-    varsrc=/mnt/tmp
+    varsrc=/mnt/tmp/infix/var
    vlibsrc=/mnt/cfg/vlib
-else
-    mount_bind "$varsrc" /var
-    varsrc=
-    vlibsrc=
 fi

 cfgsrc=/mnt/cfg
@@ -100,35 +127,23 @@ if ! mount_rw cfg >/dev/null 2>&1; then
    # there's no point in overlaying one ramdisk on top of another.
    vlibsrc=
 else
-    # Check for factory reset
-    if [ -f /mnt/cfg/infix/.reset ]; then
-	logger $opt -p user.crit -t "$nm" "Resetting to factory defaults."
-	rm -rf /mnt/cfg/infix /mnt/var/infix
-	sync
-    fi
-
-    # Check build: NETCONF or Classic
+    # Classic Infix has read-write /etc across boots
    if [ "$VARIANT_ID" != "netconf" ]; then
 	etcsrc=/mnt/cfg
    fi
-
-    # Ensure that all users in wheel can create the .reset file
-    mkdir -p /mnt/cfg/infix
-    chgrp wheel /mnt/cfg/infix
 fi

-mount_overlay cfg  $cfgsrc /cfg
-mount_overlay etc  $etcsrc /etc
-mount_overlay home $cfgsrc /home
-mount_overlay root $cfgsrc /root
+if check_factory; then
+    factory_reset
+fi

-[ "$varsrc" ]  && mount_overlay var "$varsrc"  /var
-[ "$vlibsrc" ] && mount_bind        "$vlibsrc" /var/lib
+mount_overlay cfg  "$cfgsrc" /cfg
+mount_overlay etc  "$etcsrc" /etc
+mount_overlay home "$cfgsrc" /home
+mount_overlay root "$cfgsrc" /root
+mount_bind         "$varsrc" /var

-# Keep transient configs in a ramdisk and symlink out to /cfg for
-# startup.
-mkdir -p /mnt/tmp/infix/db
-ln -s /cfg/startup_db /mnt/tmp/infix/db/startup_db
+[ "$vlibsrc" ] && mount_bind "$vlibsrc" /var/lib

 for tag in $(ls /sys/bus/virtio/devices/*/mount_tag 2>/dev/null); do
    if [ "$(cat $tag | tr -d '\0')" = hostfs ]; then
@@ -7,7 +7,7 @@ inform()
    local level="$1"
    shift

-    logger -p "daemon.$level" -t dagger -c $LOGGER_STDOUT "$@"
+    logger -p "daemon.$level" -I $PPID -t dagger -c $LOGGER_STDOUT "$@"
 }

 abort()
@@ -1 +1 @@
-mg
+/etc/alternatives/editor
@@ -1 +1 @@
-mg
+/etc/alternatives/editor
@@ -0,0 +1,19 @@
+#!/bin/sh
+# Helper script to chronyc, checks if daemon is running
+
+if ! chronyc serverstats >/dev/null; then
+   echo "NTP client not enabled."
+   exit 1
+fi
+
+case $1 in
+    tracking)
+	chronyc tracking
+	;;
+    sources)
+	chronyc sources -v
+	;;
+    *)
+	echo "Unknown NTP command."
+	;;
+esac
@@ -0,0 +1,590 @@
+#!/bin/sh
+
+all=""
+env=""
+port=""
+force=
+
+log()
+{
+    logger -I $PPID -t container -p local1.notice -- "$*"
+}
+
+# Unpacks a given oci-archive.tar[.gz] in the current directory.  Sanity
+# checks, at least one index.json in the top-level dir of the archive.
+# If there are more index files, this function does not handle them.
+unpack_archive()
+{
+    image=$1
+    name=$2
+
+    # Supported transports for load and create
+    case "$image" in
+	oci:*)			# Unpacked OCI image
+	    file=${image#oci:}
+	    ;;
+	oci-archive:*)		# Packed OCI image, .tar or .tar.gz format
+	    file=${image#oci-archive:}
+	    ;;
+	*)			# docker://*, docker-archive:*, or URL
+	    echo "$image"
+	    return 0
+	    ;;
+    esac
+
+    if [ ! -e "$file" ]; then
+	if [ -e "/var/lib/conatainers/oci/$file" ]; then
+	    file="/var/lib/conatainers/oci/$file"
+	elif [ -e "/lib/oci/$file" ]; then
+	    file="/lib/oci/$file"
+	else
+	    log "Error: cannot find OCI archive $file in search path."
+	    exit 1
+	fi
+    fi
+
+    if [ -d "$file" ]; then
+	index=$(find "$file" -name index.json)
+	if [ -z "$index" ]; then
+	    log "Error: cannot find index.json in OCI image $file"
+	    exit 1
+	fi
+    else
+	index=$(tar tf "$file" |grep index.json)
+	if [ -z "$index" ]; then
+	    log "Error: invalid OCI archive, cannot find index.json in $file"
+	    exit 1
+	fi
+
+	[ -n "$quiet" ] || log "Extracting OCI archive $file ..."
+        tar xf "$file" || (log "Error: failed unpacking $file in $(pwd)"; exit 1)
+    fi
+
+    dir=$(dirname "$index")
+    [ -n "$quiet" ] || log "Loading OCI image $dir ..."
+    podman load -qi "$dir"        >/dev/null
+
+    # Rename image from podman default $dir:latest
+    if [ -n "$name" ]; then
+	podman tag "$dir" "$name" >/dev/null
+	podman rmi "$dir"         >/dev/null
+    else
+	name=$dir
+    fi
+
+    echo "$name"
+}
+
+running()
+{
+    run=$(podman inspect "$1" 2>/dev/null |jq .[].State.Running)
+    [ "$run" = "true" ] && return 0
+    return 1
+}
+
+# shellcheck disable=SC2086
+create()
+{
+    name=$1
+    image=$2
+    shift 2
+
+    if [ -z "$name" ] || [ -z "$image" ]; then
+	echo "Usage:"
+	echo "  container create NAME IMAGE"
+	exit 1
+    fi
+
+    # Unpack and load docker-archive/oci/oci-archive, returning image
+    # name, or return docker:// URL for download.
+    image=$(unpack_archive "$image")
+
+    if [ -z "$logging" ]; then
+	logging="--log-driver k8s-file --log-opt path=/run/containers/$name.fifo"
+    fi
+
+    args="$args --cgroup-parent=containers"
+    args="$args --restart=$restart --systemd=false --tz=local $privileged --replace --quiet"
+    args="$args $ro $vol $mount $hostname $entrypoint $env $port $logging"
+    pidfn=/run/container:${name}.pid
+
+    [ -n "$quiet" ] || log "---------------------------------------"
+    [ -n "$quiet" ] || log "Got name: $name image: $image"
+    [ -n "$quiet" ] || log "Got networks: $network"
+
+    if [ -n "$network" ]; then
+	for net in $network; do
+	    args="$args --net=$net"
+	done
+
+	for srv in $dns; do
+	    args="$args --dns=$srv"
+	done
+
+	for domain in $search; do
+	    args="$args --dns-search=$domain"
+	done
+    else
+	network="--net none"
+    fi
+
+    # shellcheck disable=SC2048
+    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
+	[ -n "$quiet" ] || log "Successfully created container $name from $image"
+	rm -f "/run/containers/env/${name}.env"
+	[ -n "$manual" ] || start "$name"
+	exit 0
+    fi
+
+    log "Error: failed creating container $name, please check the configuration."
+    exit 1
+}
+
+delete()
+{
+    name=$1
+    image=$2
+
+    if [ -z "$name" ]; then
+	echo "Usage:"
+	echo "  container delete NAME"
+	exit 1
+    fi
+
+    podman rm -vif "$name" >/dev/null 2>&1
+    [ -n "$quiet" ] || log "Container $name has been removed."
+}
+
+waitfor()
+{
+    timeout=$2
+    while [ ! -f "$1" ]; do
+	_=$((timeout -= 1))
+	if [ $timeout -le 0 ]; then
+	    log "Timeout waiting for $1, aborting!"
+	    exit 1
+	fi
+	sleep 1;
+    done
+}
+
+start()
+{
+    name=$1
+
+    if running "$name"; then
+	[ -n "$quiet" ] || echo "$name: already running."
+	return
+    fi
+
+    initctl -bq cond set "container:$name"
+    # Real work is done by wrap() courtesy of finit sysv emulation
+}
+
+stop()
+{
+    name=$1
+
+    if ! running "$name"; then
+	[ -n "$quiet" ] || echo "$name: not running."
+	return
+    fi
+
+    initctl -bq cond clr "container:$name"
+    # Real work is done by wrap() courtesy of finit sysv emulation
+}
+
+wrap()
+{
+    name=$1
+    cmd=$2
+
+    podman "$cmd" "$name"
+}
+
+# Removes network $1 from all containers
+netwrm()
+{
+    net=$1
+
+    for c in $(podman ps $all --format "{{.Names}}"); do
+	for n in $(podman inspect "$c" |jq -r '.[].NetworkSettings.Networks | keys[]'); do
+	    if [ "$n" = "$net" ]; then
+		podman network disconnect $force "$n" "$c" >/dev/null
+	    fi
+	done
+    done
+}
+
+usage()
+{
+	cat <<EOF
+usage:
+  container [opt] cmd [arg]
+
+options:
+  -a, --all                Show all, of something
+      --dns NAMESERVER     Set nameserver(s) when creating a container
+      --dns-search LIST    Set host lookup search list when creating container
+  -c, --creds USR[:PWD]    Credentials to pass to curl -u for remote ops
+  -d, --detach             Detach a container started with 'run IMG [CMD]'
+  -e, --env FILE           Environment variables when creating container
+      --entrypoint         Disable container image's ENTRYPOINT, run cmd + arg
+  -f, --force              Force operation, e.g. remove
+  -h, --help               Show this help text
+      --hostname NAME      Set hostname when creating container
+      --net NETWORK        Network interface(s) when creating or finding container
+  -l, --log-driver DRV     Log driver to use
+      --log-opt OPT        Logging options to log driver
+      --log-path PATH      Path for k8s-file log pipe
+  -m, --mount HOST:DEST    Bind mount a read-only file inside a container
+      --manual             Do not start container automatically after creation
+  -n, --name NAME          Alternative way of supplying name to start/stop/restart
+      --privileged         Give container extended privileges
+  -p, --publish PORT       Publish ports when creating container
+                           Syntax: [[ip:][hostPort]:]containerPort[/protocol]
+  -q, --quiet              Quiet operation, called from confd
+  -r, --restart POLICY     One of "no", "always", or "on-failure:NUM"
+      --read-only          Do not create a writable layer
+  -s, --simple             Show output in simplified format
+  -v, --volume NAME:PATH   Create named volume mounted inside container on PATH
+
+commands:
+  create   NAME IMAGE NET  Create container NAME using IMAGE with networks NET
+  delete  [network] NAME   Remove container NAME or network NAME from all containers
+  exec     NAME CMD        Run a command inside a container
+  find    [ifname PID]     Find PID of container where '--net IFNAME' currently lives
+                           or, find the name of our IFNAME inside the container @PID
+  help                     Show this help text
+  list    [image | oci]    List names (only) of containers, images, or OCI archives
+  load    [NAME | URL] NM  Load OCI tarball fileNAME or URL to image NM
+  remove   IMAGE           Remove an (unused) container image
+  restart [NAME]           Restart a crashed container
+  run      NAME [CMD]      Run a container interactively, with an optional command
+  save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
+  shell                    Start a shell inside a container
+  show    [image | volume] Show containers, images, or volumes
+  stat                     Show continuous stats about containers (Ctrl-C aborts)
+  start   [NAME]           Start a container, see -n
+  stop    [NAME]           Stop a container, see -n
+  volume  [prune]          Prune unused volumes
+EOF
+}
+
+while [ "$1" != "" ]; do
+    case $1 in
+	-a | --all)
+	    all="-a"
+	    ;;
+	-c | --creds)
+	    shift
+	    creds="-u $1"
+	    ;;
+	-d | --detach)
+	    detach="-d"
+	    ;;
+	--dns)
+	    shift
+	    dns="$dns $1"
+	    ;;
+	--dns-search)
+	    shift
+	    search="$search $1"
+	    ;;
+	-e | --env)
+	    shift
+	    env="$env --env-file=$1"
+	    ;;
+	--entrypoint)
+	    entrypoint="--entrypoint=\"\""
+	    ;;
+	-f | --force)
+	    force="-f"
+	    ;;
+	-h | --help)
+	    usage
+	    exit 0
+	    ;;
+	--hostname)
+	    shift
+	    hostname="--hostname $1"
+	    ;;
+	-l | --log-driver)
+	    shift
+	    logging=" --log-driver=$1"
+	    ;;
+	--log-opt)
+	    shift
+	    logging="$logging --log-opt $1"
+	    ;;
+	--log-path)
+	    shift
+	    logging="$logging --log-opt path=$1"
+	    log_path="$1"
+	    ;;
+	-m | --mount)
+	    shift
+	    mount="--mount=$1"
+	    ;;
+	--manual)
+	    manual=true
+	    ;;
+	-n | --name)
+	    shift
+	    name="$1"
+	    ;;
+	--net)
+	    shift
+	    if [ -n "$network" ]; then
+		network="$network $1"
+	    else
+		network=$1
+	    fi
+	    ;;
+	--privileged)
+	    privileged="--privileged=true"
+	    ;;
+	-p | --publish)
+	    shift
+	    port="$port -p $1"
+	    ;;
+	-q | --quiet)
+	    quiet="-q"
+	    ;;
+	-r | --restart)
+	    shift
+	    restart=$1
+	    ;;
+	--read-only)
+	    ro="--read-only=true"
+	    ;;
+	-s | --simple)
+	    simple=true
+	    ;;
+	-v | --volume)
+	    shift
+	    vol="$vol -v $1"
+	    ;;
+	*)
+	    break
+	    ;;
+    esac
+    shift
+done
+
+cmd=$1
+if [ -n "$cmd" ]; then
+    shift
+fi
+
+case $cmd in
+    # Does not work atm., cannot attach to TTY because
+    # we monitor 'podman start -ai foo' with Finit.
+    # attach)
+    # 	podman attach "$1"
+    # 	;;
+    create)
+	[ -n "$quiet" ] || log "Got create args: $*"
+	create "$@"
+	;;
+    delete)
+	cmd=$1
+	name=$2
+	if [ "$cmd" = "network" ] && [ -n "$name" ]; then
+	    netwrm "$name"
+	else
+	    delete "$@"
+	fi
+	;;
+    exec)
+	podman exec -it "$@"
+	;;
+    find)
+	cmd=$1
+	pid=$2
+	if [ "$cmd" = "ifname" ] && [ -n "$pid" ]; then
+	    nsenter -t "$pid" -n ip -d -j link | \
+		jq --arg ifname "$network" -r '.[] | select(.ifalias==$ifname) | .ifname'
+	else
+	    containers=$(podman ps $all --format "{{.Names}}")
+	    for c in $containers; do
+		json=$(podman inspect "$c")
+		nets=$(echo "$json" |jq -r '.[].NetworkSettings.Networks | keys[]' 2>/dev/null)
+		for n in $nets; do
+		    if [ "$network" = "$n" ]; then
+			pid=$(echo "$json" | jq .[].State.Pid)
+			echo "$pid"
+			exit 0
+		    fi
+		done
+	    done
+	fi
+	;;
+    help)
+	usage
+	;;
+    load)
+	url=$1
+	name=$2
+	# shellcheck disable=SC2086
+	if echo "$url" | grep -q "://"; then
+	    file=$(basename "$url")
+            curl -k $creds -Lo "$file" "$url"
+	else
+            file="$url"
+	fi
+
+	# shellcheck disable=SC2086
+	name=$(unpack_archive "$file" $name)
+
+	# Show resulting image(s) matching $name
+	if [ -n "$name" ]; then
+	    podman images -n "$name"
+	else
+	    exit 1
+	fi
+	;;
+    ls | list)
+	cmd=$1
+	[ -n "$cmd" ] && shift
+	case $cmd in
+	    image*)
+		podman images $all --format "{{.Repository}}:{{.Tag}}"
+		;;
+	    oci)
+		find /lib/oci /var/lib/containers/oci -type f 2>/dev/null
+		;;
+	    *)		
+		podman ps $all --format "{{.Names}}"
+		;;
+	esac
+	;;
+    pull)
+	podman pull "$@"
+	;;
+    remove)
+	podman rmi $all $force -i "$1"
+	;;
+    run)
+	img=$1
+	cmd=$2
+	[ -n "$port" ] || port="-P"
+	if [ -n "$cmd" ]; then
+	    shift 2
+	    [ -n "$detach" ] || echo "Starting $img ENTRYPOINT $cmd :: use Ctrl-p Ctrl-q to detach"
+	    podman run -it --rm $detach $port --entrypoint="$cmd" "$img" "$@"
+	else
+	    [ -n "$detach" ] || echo "Starting $img :: use Ctrl-p Ctrl-q to detach"
+	    podman run -it --rm $detach $port "$img"
+	fi
+	;;
+    save)
+	name=$1
+	file=$2
+	if echo "$file" | grep -q ".gz"; then
+	    file=${file%%.gz}
+	    gzip=true
+	fi
+	if ! echo "$file" | grep -q ".tar"; then
+	    file=${file}.tar
+	    gzip=true
+	fi
+	podman save -o "$file" "$name"
+	if [ -s "$file" ] && [ -n "$gzip" ]; then
+	    gzip "$file"
+	fi
+	;;
+    shell)
+	podman exec -it "$1" sh -l
+	;;
+    show)
+	cmd=$1
+	[ -n "$cmd" ] && shift
+	case $cmd in
+	    image*)
+		if [ -n "$simple" ]; then
+		    podman images $all --format "{{.Names}} {{.Size}}" \
+			| sed 's/\[\(.*\)\] /\1 /g' \
+			| awk '{ printf "%-60s %s %s\n", $1, $2, $3}'
+		else
+		    podman images $all
+		fi
+		;;
+	    volume*)
+		printf "%-20s  CONTAINER\n" "VOLUME"
+		for v in $(podman volume ls --format "{{.Name}}"); do
+		    printf "%-20s" "$v"
+		    podman ps -a --filter volume="$v"  --format '{{.Names}}' | sed 's/^/  /'
+		done
+		;;
+	    *)
+		if [ -n "$simple" ]; then
+		    podman ps $all --format "{{.ID}}  {{.Names}}  {{.Image}}" \
+			| awk '{ printf "%s  %-30s %s\n", $1, $2, $3}'
+		else
+		    podman ps $all
+		fi
+		;;
+	esac
+	;;
+    start)
+	if [ -n "$name" ]; then
+	    wrap "$name" start
+	elif [ -n "$1" ]; then
+	    start "$1"
+	else
+	    usage
+	    exit 1
+	fi
+	;;
+    restart)
+	if [ -n "$name" ]; then
+	    wrap "$name" restart
+	elif [ -n "$1" ]; then
+	    stop  "$1"
+	    start "$1"
+	else
+	    usage
+	    exit 1
+	fi
+	;;
+    stop)
+	if [ -n "$name" ]; then
+	    wrap "$name" stop
+	elif [ -n "$1" ]; then
+	    stop "$1"
+	else
+	    usage
+	    exit 1
+	fi
+	;;
+    stat*)
+	podman stats -i 2
+	;;
+    upgrade)
+	img=$(podman inspect "$1" | jq -r .[].ImageName)
+	if [ -z "$img" ]; then
+	    echo "No such container ($1), or invalid ImageName.  Cannot upgrade."
+	    exit 1;
+	fi
+	podman stop "$1"
+	podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
+	"/var/lib/containers/active/${1}.sh" || (echo "Failed recreating container $1"; exit 1)
+	;;
+    volume)
+	cmd=$1
+	[ -n "$cmd" ] && shift
+	case $cmd in
+	    prune)
+		podman volume $force prune
+		;;
+	    *)
+		false
+		;;
+	esac
+	;;
+    *)
+	usage
+	exit 1
+	;;
+esac
@@ -1,14 +1,16 @@
 #!/bin/sh
-
-# udhcpc script edited by Tim Riker <Tim@Rikers.org>
+# This script expect a system with resolvconf (openresolv) and iproute2

 [ -z "$1" ] && echo "Error: should be called from udhcpc" && exit 1

 ACTION="$1"
-RESOLV_CONF="/etc/resolv.conf"
-[ -e $RESOLV_CONF ] || touch $RESOLV_CONF
+IP_CACHE="/var/lib/misc/${interface}.cache"
+RESOLV_CONF="/run/resolvconf/interfaces/${interface}.conf"
+NTPFILE="/run/chrony/dhcp-sources.d/${interface}.sources"
 [ -n "$broadcast" ] && BROADCAST="broadcast $broadcast"
-[ -n "$subnet" ] && NETMASK="$subnet"
+[ -n "$subnet" ] || subnet=32
+[ -n "$metric" ] || metric=100
+
 # Handle stateful DHCPv6 like DHCPv4
 [ -n "$ipv6" ] && ip="$ipv6/128"

@@ -16,113 +18,139 @@ if [ -z "${IF_WAIT_DELAY}" ]; then
 	IF_WAIT_DELAY=10
 fi

-wait_for_ipv6_default_route() {
-	printf "Waiting for IPv6 default route to appear"
-	while [ $IF_WAIT_DELAY -gt 0 ]; do
-		if ip -6 route list | grep -q default; then
-			printf "\n"
-			return
-		fi
-		sleep 1
-		printf "."
-		: $((IF_WAIT_DELAY -= 1))
-	done
-	printf " timeout!\n"
+log()
+{
+    logger -I $$ -t udhcpc -p user.notice "$*"
 }

-flush_dhcp_addresses() {
-	addrs=$(ip -j addr show dev $interface | jq -c \
-		'.[0].addr_info[] | select(.family == "inet") | select(.protocol == "dhcp")')
-
-	for addr in $addrs; do
-		ip="$(echo "$addr" | jq -r '."local"')"
-		prefix="$(echo "$addr" | jq -r '."prefixlen"')"
-		ip addr del "$ip/$prefix" dev "$interface"
-	done
+wwait_for_ipv6_default_route()
+{
+    log "waiting for IPv6 default route to be installed."
+    while [ $IF_WAIT_DELAY -gt 0 ]; do
+	if ip -6 route list proto dhcp dev $interface | grep -q default; then
+	    return
+	fi
+	sleep 1
+	printf "."
+	: $((IF_WAIT_DELAY -= 1))
+    done
+    log "Timed out witing for IPv6 default route!"
 }

+# RFC3442: If the DHCP server returns both a Classless
+# Static Routes option and a Router option, the DHCP
+# client MUST ignore the Router option.
+set_dhcp_routes()
+{
+    if [ -n "$staticroutes" ]; then
+	# format: dest1/mask gw1 ... destn/mask gwn
+	set -- $staticroutes
+	while [ -n "$1" -a -n "$2" ]; do
+	    log "adding route $1 via $2 dev $interface proto dhcp"
+	    ip route add "$1" via "$2" dev $interface metric $metric proto dhcp
+	    shift 2
+	done
+    elif [ -n "$router" ] ; then
+	for i in $router ; do
+	    ip route add default via $i dev $interface metric $((metric++)) proto dhcp
+	done
+    fi
+}
+
+clr_dhcp_routes()
+{
+    log "deleting DHCP routes from $interface"
+    ip route show proto dhcp dev $interface | while read rt via nh dev dev; do
+	log "removing $rt nh $nh on $dev"
+	ip route del $rt via $nh dev $dev proto dhcp
+    done
+}
+
+clr_dhcp_addresses()
+{
+    addrs=$(ip -j addr show dev $interface \
+		| jq -c '.[0].addr_info[] | select(.family == "inet") | select(.protocol == "dhcp")')
+
+    for addr in $addrs; do
+	ip="$(echo "$addr" | jq -r '."local"')"
+	prefix="$(echo "$addr" | jq -r '."prefixlen"')"
+	log "removing $ip/$prefix from $interface"
+	ip addr del "$ip/$prefix" dev "$interface"
+    done
+}
+
+log "action $ACTION"
 case "$ACTION" in
-	deconfig)
-		flush_dhcp_addresses
+    deconfig)
+	clr_dhcp_addresses
+	clr_dhcp_routes
+	/bin/ip link set dev $interface up

-		/bin/ip link set dev $interface up
+	# drop info from this interface
+	rm -f "$RESOLV_CONF"
+	rm -f "$NTPFILE"
+	if [ -x /usr/sbin/avahi-autoipd ]; then
+	    /usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
+	fi
+	;;

-		# drop info from this interface
-		# resolv.conf may be a symlink to /tmp/, so take care
-		TMPFILE=$(mktemp)
-		grep -vE "# $interface\$" $RESOLV_CONF > $TMPFILE
-		cat $TMPFILE > $RESOLV_CONF
-		rm -f $TMPFILE
+    leasefail|nak)
+	if [ -x /usr/sbin/avahi-autoipd ]; then
+	    /usr/sbin/avahi-autoipd -c $interface || /usr/sbin/avahi-autoipd -wD $interface --no-chroot
+	fi
+	;;

-		if [ -x /usr/sbin/avahi-autoipd ]; then
-			/usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
-		fi
-		;;
+    renew|bound)
+	if [ -x /usr/sbin/avahi-autoipd ]; then
+	    /usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
+	fi

-	leasefail|nak)
-		if [ -x /usr/sbin/avahi-autoipd ]; then
-			/usr/sbin/avahi-autoipd -c $interface || /usr/sbin/avahi-autoipd -wD $interface --no-chroot
-		fi
-		;;
+	if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto 5; then
+	    echo "$ip" > "$IP_CACHE"
+	fi
+	if [ -n "$ipv6" ] ; then
+	    wait_for_ipv6_default_route
+	fi

-	renew|bound)
-		if [ -x /usr/sbin/avahi-autoipd ]; then
-			/usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
-		fi
-		/bin/ip addr add dev $interface $ip/$NETMASK $BROADCAST proto 5
-		if [ -n "$ipv6" ] ; then
-			wait_for_ipv6_default_route
-		fi
+	clr_dhcp_routes
+	set_dhcp_routes

-		# RFC3442: If the DHCP server returns both a Classless
-		# Static Routes option and a Router option, the DHCP
-		# client MUST ignore the Router option.
-		if [ -n "$staticroutes" ]; then
-			echo "deleting routers"
-			route -n | while read dest gw mask flags metric ref use iface; do
-				[ "$iface" != "$interface" -o "$gw" = "0.0.0.0" ] || \
-					route del -net "$dest" netmask "$mask" gw "$gw" dev "$interface"
-			done
+	# set hostname if given
+	if [ -n "$hostname" ]; then
+	    log "setting new hostname: $hostname"
+	    hostname "$hostname"
+	    augtool -s "set /files/etc/hosts/*[ipaddr='127.0.1.1']/canonical $hostname"
+	fi

-			# format: dest1/mask gw1 ... destn/mask gwn
-			set -- $staticroutes
-			while [ -n "$1" -a -n "$2" ]; do
-				route add -net "$1" gw "$2" dev "$interface"
-				shift 2
-			done
-		elif [ -n "$router" ] ; then
-			echo "deleting routers"
-			while route del default gw 0.0.0.0 dev $interface 2> /dev/null; do
-				:
-			done
+	# drop info from this interface
+	truncate -s 0 "$RESOLV_CONF"

-			for i in $router ; do
-				route add default gw $i dev $interface
-			done
-		fi
+	# prefer rfc3397 domain search list (option 119) if available
+	if [ -n "$search" ]; then
+	    search_list=$search
+	elif [ -n "$domain" ]; then
+	    search_list=$domain
+	fi

-		# drop info from this interface
-		# resolv.conf may be a symlink to /tmp/, so take care
-		TMPFILE=$(mktemp)
-		grep -vE "# $interface\$" $RESOLV_CONF > $TMPFILE
-		cat $TMPFILE > $RESOLV_CONF
-		rm -f $TMPFILE
+	if [ -n "$search_list" ]; then
+	    log "adding search $search_list"
+	    echo "search $search_list # $interface" >> $RESOLV_CONF
+	fi

-		# prefer rfc3397 domain search list (option 119) if available
-		if [ -n "$search" ]; then
-			search_list=$search
-		elif [ -n "$domain" ]; then
-			search_list=$domain
-		fi
+	for i in $dns ; do
+	    log "adding dns $i"
+	    echo "nameserver $i # $interface" >> $RESOLV_CONF
+	    resolvconf -u
+	done

-		[ -n "$search_list" ] &&
-			echo "search $search_list # $interface" >> $RESOLV_CONF
-
-		for i in $dns ; do
-			echo adding dns $i
-			echo "nameserver $i # $interface" >> $RESOLV_CONF
-		done
-		;;
+	if [ -n "$ntpsrv" ]; then
+	    truncate -s 0 "$NTPFILE"
+	    for srv in $ntpsrv; do
+		log "got NTP server $srv"
+		echo "server $srv iburst" >> "$NTPFILE"
+	    done
+	    chronyc reload sources >/dev/null
+	fi
 esac

 HOOK_DIR="$0.d"
@@ -8,9 +8,13 @@
 &env {
 	vendor = "infix";
 	bootdelay = "-2";
-	bootcmd = "run ixboot";
+	bootcmd = "run ixbtn";
 	boot_targets = "virtio mmc";

+	ixbtn       = /incbin/("scripts/ixbtn.sh");
+	ixdevmode   = /incbin/("scripts/ixdevmode.sh");
+	ixfactory   = /incbin/("scripts/ixfactory.sh");
+	ixbtn       = /incbin/("scripts/ixbtn.sh");
 	ixboot      = /incbin/("scripts/ixboot.sh");
 	ixbootmedia = /incbin/("scripts/ixbootmedia.sh");
 	ixbootslot  = /incbin/("scripts/ixbootslot.sh");
@@ -1,3 +1,5 @@
+setenv valid_media no
+
 for tgt in "${boot_targets}"; do
    if test "${tgt}" = "mmc0"; then
 	setenv devtype "mmc"
@@ -17,7 +19,7 @@ for tgt in "${boot_targets}"; do
 	    env import -b ${loadaddr} ${filesize} BOOT_ORDER DEBUG
 	fi

-	test -n "${BOOT_ORDER}" || setenv BOOT_ORDER "primary secondary dhcp"
+	test -n "${BOOT_ORDER}" || setenv BOOT_ORDER "primary secondary net"

 	if test -n "${DEBUG}"; then
 	    setenv bootargs_log "debug"
@@ -25,8 +27,16 @@ for tgt in "${boot_targets}"; do
 	    setenv bootargs_log "loglevel=4"
 	fi

+	setenv valid_media yes
 	run ixbootmedia
    fi
 done

+if test "${valid_media}" = "no"; then
+    echo "NO BOOTABLE MEDIA FOUND, falling back to netboot"
+    setenv BOOT_ORDER "net"
+    setenv bootargs_log "debug"
+    run ixbootmedia
+fi
+
 reset
@@ -14,7 +14,13 @@ if test "${prepared}" = "ok"; then
 	if iminfo ${ramdisk_addr_r}; then
 	    echo "${slot}: Booting..."

-	    setenv bootargs_rauc "rauc.slot=${slot}"
+	    setenv bootargs_user "rauc.slot=${slot}"
+	    if test "${factory_reset}" = "yes"; then
+		setenv bootargs_user "${bootargs_user} finit.cond=factory-reset"
+	    fi
+	    if test "${dev_mode}" = "yes"; then
+		setenv bootargs_user "${bootargs_user} finit.cond=dev-mode"
+	    fi

 	    blkmap create boot
 	    blkmap get boot dev blkmapnum
@@ -0,0 +1,13 @@
+setenv dev_mode no
+setenv factory_reset no
+
+echo -n "dev-mode:      "
+run ixdevmode
+echo -n "factory-reset: "
+run ixfactory
+
+if test "${dev_mode}" = "yes"; then
+    sleep 1 && run ixboot
+else
+    run ixboot
+fi
@@ -0,0 +1,3 @@
+if button dev-mode; then
+    setenv dev_mode yes
+fi
@@ -0,0 +1,7 @@
+if button factory-reset; then
+    echo "Keep button pressed for 10 seconds to engage reset"
+    if sleep 10 && button factory-reset; then
+	setenv factory_reset yes
+	echo "FACTORY RESET ENGAGED"
+    fi
+fi
@@ -0,0 +1,23 @@
+#!/bin/sh
+# shellcheck disable=SC3045
+
+OUTPUT=$1
+
+read -r -s -p "New password: " password
+>&2 echo
+read -r -s -p "Retype password: " password_again
+>&2 echo
+
+if [ "$password" != "$password_again" ]; then
+    echo "Passwords do not match, try again."
+    exit 1
+fi
+
+if [ -z "$OUTPUT" ]; then
+    echo "$password"
+    exit 0
+fi
+
+umask 0177
+echo "$password" | mkpasswd > "$OUTPUT"
+exit 0
@@ -1 +0,0 @@
-../usr/bin/klish
@@ -0,0 +1,3 @@
+#!/bin/sh
+# Source settings, aliases, and probe terminal size, then hand over to klish
+exec env CLISH=yes bash -ilc /usr/bin/klish
@@ -0,0 +1,88 @@
+#!/bin/sh
+
+# This file is part of avahi.
+#
+# avahi is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as
+# published by the Free Software Foundation; either version 2 of the
+# License, or (at your option) any later version.
+#
+# avahi is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+# License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with avahi; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
+# USA.
+
+set -e
+
+# Command line arguments:
+#   $1 event that happened:
+#          BIND:     Successfully claimed address
+#          CONFLICT: An IP address conflict happened
+#          UNBIND:   The IP address is no longer needed
+#          STOP:     The daemon is terminating
+#   $2 interface name
+#   $3 IP adddress
+
+PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
+
+# Use a different metric for each interface, so that we can set
+# identical routes to multiple interfaces.
+
+METRIC=$((1000 + `cat "/sys/class/net/$2/ifindex" 2>/dev/null || echo 0`))
+
+if [ -x /bin/ip -o -x /sbin/ip ] ; then
+
+    # We have the Linux ip tool from the iproute package
+
+    case "$1" in
+        BIND)
+            ip addr flush dev "$2" label "$2:avahi"
+            ip addr add "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2" proto 6
+            ip route add default dev "$2" metric "$METRIC" scope link proto 17 ||:
+            ;;
+
+        CONFLICT|UNBIND|STOP)
+            ip route del default dev "$2" metric "$METRIC" scope link ||:
+            ip addr del "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2"
+            ;;
+
+        *)
+            echo "Unknown event $1" >&2
+            exit 1
+            ;;
+    esac
+
+elif [ -x /bin/ifconfig -o -x /sbin/ifconfig ] ; then
+
+    # We have the old ifconfig tool
+
+    case "$1" in
+        BIND)
+            ifconfig "$2:avahi" inet "$3" netmask 255.255.0.0 broadcast 169.254.255.255 up
+            route add default dev "$2:avahi" metric "$METRIC" ||:
+            ;;
+
+        CONFLICT|STOP|UNBIND)
+            route del default dev "$2:avahi" metric "$METRIC" ||:
+            ifconfig "$2:avahi" down
+            ;;
+
+        *)
+            echo "Unknown event $1" >&2
+            exit 1
+            ;;
+    esac
+
+else
+
+    echo "No network configuration tool found." >&2
+    exit 1
+
+fi
+
+exit 0
@@ -0,0 +1,143 @@
+{
+    "input": {
+	"path": {
+	    "locate":       { "path": "/run/led/locate" },
+
+	    "status-prime": { "path": "/run/led/status-prime" },
+	    "status-ok":    { "path": "/run/led/status-ok" },
+	    "status-err":   { "path": "/run/led/status-err" },
+	    "status-crit":  { "path": "/run/led/status-crit" },
+
+	    "fault-prime":  { "path": "/run/led/fault-prime" },
+	    "fault-ok":     { "path": "/run/led/fault-ok" },
+	    "fault-err":    { "path": "/run/led/fault-err" },
+	    "fault-crit":   { "path": "/run/led/fault-crit" },
+
+	    "lan-prime":    { "path": "/run/led/lan-prime" },
+	    "lan-ok":       { "path": "/run/led/lan-ok" },
+	    "lan-err":      { "path": "/run/led/lan-err" },
+	    "lan-crit":     { "path": "/run/led/lan-crit" },
+
+	    "startup":   { "path": "/run/finit/cond/run/startup/success" },
+	    "fail-safe": { "path": "/run/finit/cond/run/failure/success" },
+	    "panic":     { "path": "/run/finit/cond/run/failure/failure" }
+	},
+	"udev": {
+	    "power-a": { "subsystem": "power_supply" },
+	    "power-b": { "subsystem": "power_supply" }
+	}
+    },
+
+    "output": {
+	"led-group": {
+	    "port-link-act": {
+		"match": ["*:green:tp", "*:green:sfp", "*:green:port" ],
+
+		"rules": [
+		    { "if": "true", "then": { "trigger": "netdev", "link": 1, "rx": 1, "tx": 1 } }
+		]
+	    },
+	    "port-alarm": {
+		"match": ["*:yellow:tp", "*:yellow:sfp", "*:yellow:port" ],
+
+		"rules": [
+		]
+	    }
+	},
+	"led": {
+	    "red:status": {
+		"rules": [
+		    { "if": "locate", "then": "@off" },
+		    { "if": "panic", "then": "@blink-5hz" },
+		    { "if": "status-crit", "then": "@blink-1hz" },
+		    { "if": "status-err", "then": "@on" }
+		]
+	    },
+	    "green:status": {
+		"rules": [
+		    { "if": "locate", "then": "@blink-1hz" },
+		    { "if": "status-prime", "then": "@blink-1hz" },
+		    { "if": "status-ok", "then": "@on" }
+		]
+	    },
+	    "red:fault": {
+		"rules": [
+		    { "if": "locate", "then": "@off" },
+		    { "if": "panic", "then": "@blink-5hz" },
+		    { "if": "fault-crit", "then": "@blink-1hz" },
+		    { "if": "fault-err", "then": "@on" }
+		]
+	    },
+	    "green:fault": {
+		"rules": [
+		    { "if": "locate", "then": "@blink-1hz" },
+		    { "if": "fault-prime", "then": "@blink-1hz" },
+		    { "if": "fault-ok", "then": "@on" }
+		]
+	    },
+	    "red:lan": {
+		"rules": [
+		    { "if": "locate", "then": "@off" },
+		    { "if": "panic", "then": "@blink-5hz" },
+		    { "if": "lan-crit", "then": "@blink-1hz" },
+		    { "if": "lan-err", "then": "@on" }
+		]
+	    },
+	    "green:lan": {
+		"rules": [
+		    { "if": "locate", "then": "@blink-1hz" },
+		    { "if": "lan-prime", "then": "@blink-1hz" },
+		    { "if": "lan-ok", "then": "@on" }
+		]
+	    },
+
+	    "red:boot": {
+		"rules": [
+		    { "if": "locate", "then": "@off" },
+		    { "if": "panic", "then": "@blink-5hz" },
+		    { "if": "fail-safe", "then": "@blink-5hz" }
+		]
+	    },
+	    "green:boot": {
+		"rules": [
+		    { "if": "locate", "then": "@blink-1hz" },
+		    { "if": "panic", "then": "@off" },
+		    { "if": "startup", "then": "@on" },
+		    { "if": "true", "then": "@blink-1hz" }
+		]
+	    },
+
+	    "red:power-a": {
+		"rules": [
+		    { "if": "panic", "then": "@blink-5hz" },
+		    { "if": "!power-a:online", "then": "@blink-1hz" }
+		]
+	    },
+	    "red:power-b": {
+		"rules": [
+		    { "if": "panic", "then": "@blink-5hz" },
+		    { "if": "!power-b:online", "then": "@blink-1hz" }
+		]
+	    }
+	}
+    },
+
+    "aliases": {
+	"on": {
+	    "brightness": true
+	},
+	"off": {
+	    "brightness": false
+	},
+	"blink-1hz": {
+	    "trigger": "timer",
+	    "delay_on": 500,
+	    "delay_off": 500
+	},
+	"blink-5hz": {
+	    "trigger": "timer",
+	    "delay_on": 100,
+	    "delay_off": 100
+	}
+    }
+}
@@ -0,0 +1 @@
+17	zeroconf
@@ -1 +1,2 @@
 alias cli='clish'
+alias cfg='sysrepocfg -f json'
@@ -0,0 +1,7 @@
+if [ -z "$CLISH" ]; then
+    cat <<EOF
+
+Run the command 'cli' for interactive OAM
+
+EOF
+fi
@@ -1,4 +1,5 @@
-net.ipv6.conf.all.forwarding=0
+net.ipv6.conf.all.forwarding=1
+net.ipv6.conf.default.forwarding=0
 net.ipv6.conf.all.autoconf=0
 net.ipv6.conf.default.autoconf=0
 net.ipv6.conf.default.keep_addr_on_down=1
@@ -1,244 +0,0 @@
-#!/usr/bin/env python3
-import json
-import sys
-import argparse
-
-parser = argparse.ArgumentParser(description="JSON CLI Pretty Printer")
-parser.add_argument("module", help="IETF Module")
-parser.add_argument("-n", "--name", help="Focus on specific name")
-args = parser.parse_args()
-
-class Pad:
-    iface = 16
-    proto = 11
-    state = 12
-    data = 41
-
-class Decore():
-    @staticmethod
-    def decorate(sgr, txt, restore="0"):
-        return f"\033[{sgr}m{txt}\033[{restore}m"
-
-    @staticmethod
-    def invert(txt):
-        return Decore.decorate("7", txt)
-
-    @staticmethod
-    def red(txt):
-        return Decore.decorate("31", txt, "39")
-
-    @staticmethod
-    def green(txt):
-        return Decore.decorate("32", txt, "39")
-
-class Iface:
-    def __init__(self, data):
-        self.data = data
-        self.name = data.get('name', '')
-        self.index = data.get('if-index', '')
-        self.oper_status = data.get('oper-status', '')
-        self.phys_address = data.get('phys-address', '')
-
-        if data.get('statistics'):
-            self.in_octets = data.get('statistics').get('in-octets', '')
-            self.out_octets = data.get('statistics').get('out-octets', '')
-        else:
-            self.in_octets = ''
-            self.out_octets = ''
-
-        self.parent = data.get('ietf-if-extensions:parent-interface', None)
-
-        if self.data.get('ietf-ip:ipv4'):
-            self.mtu = self.data.get('ietf-ip:ipv4').get('mtu', '')
-            self.ipv4_addr = self.data.get('ietf-ip:ipv4').get('address', '')
-        else:
-            self.mtu = ''
-            self.ipv4_addr = []
-
-        if self.data.get('ietf-ip:ipv6'):
-            self.ipv6_addr = self.data.get('ietf-ip:ipv6').get('address', '')
-        else:
-            self.ipv6_addr = []
-
-        if self.data.get('infix-interfaces:bridge-port'):
-            self.bridge = self.data.get('infix-interfaces:bridge-port').get('bridge', None)
-        else:
-            self.bridge = ''
-
-    def is_vlan(self):
-        return self.data['type'] == "infix-if-type:vlan"
-
-    def is_bridge(self):
-        return self.data['type'] == "infix-if-type:bridge"
-
-    def pr_name(self, pipe=""):
-        print(f"{pipe}{self.name:<{Pad.iface - len(pipe)}}", end="")
-
-
-    def pr_proto_ipv4(self, pipe=''):
-        for addr in self.ipv4_addr:
-            origin = f"({addr['origin']})" if addr.get('origin') else ""
-
-            row =  f"{pipe:<{Pad.iface}}"
-            row += f"{'ipv4':<{Pad.proto}}"
-            row += f"{'':<{Pad.state}}{addr['ip']}/{addr['prefix-length']} {origin}"
-            print(row)
-
-    def pr_proto_ipv6(self, pipe=''):
-        for addr in self.ipv6_addr:
-            origin = f"({addr['origin']})" if addr.get('origin') else ""
-
-            row =  f"{pipe:<{Pad.iface}}"
-            row += f"{'ipv6':<{Pad.proto}}"
-            row += f"{'':<{Pad.state}}{addr['ip']}/{addr['prefix-length']} {origin}"
-            print(row)
-
-    def pr_proto_eth(self):
-        row = f"{'ethernet':<{Pad.proto}}"
-        dec = Decore.green if self.oper_status == "up" else Decore.red
-        row += dec(f"{self.oper_status.upper():<{Pad.state}}")
-        row += f"{self.data['phys-address']:<{Pad.data}}"
-        print(row)
-
-    def pr_bridge(self, _ifaces):
-        self.pr_name(pipe="")
-        self.pr_proto_eth()
-
-
-        lowers = []
-        for _iface in [Iface(data) for data in _ifaces]:
-            if _iface.bridge and _iface.bridge == self.name:
-                lowers.append(_iface)
-
-        if lowers:
-            self.pr_proto_ipv4(pipe='│')
-            self.pr_proto_ipv6(pipe='│')
-        else:
-            self.pr_proto_ipv4()
-            self.pr_proto_ipv6()
-
-        for i, lower in enumerate(lowers):
-            pipe = '└ ' if (i == len(lowers) -1)  else '├ '
-            lower.pr_name(pipe)
-            lower.pr_proto_eth()
-
-    def pr_vlan(self, _ifaces):
-        self.pr_name(pipe="")
-        self.pr_proto_eth()
-
-        if self.parent:
-            self.pr_proto_ipv4(pipe='│')
-            self.pr_proto_ipv6(pipe='│')
-        else:
-            self.pr_proto_ipv4()
-            self.pr_proto_ipv6()
-            return
-
-        parent = find_iface(_ifaces, self.parent)
-        if not parent:
-            print(f"Error, didn't find parent interface for vlan {self.name}")
-            sys.exit(1)
-        parent.pr_name(pipe='└ ')
-        parent.pr_proto_eth()
-
-    def pr_iface(self):
-        print(f"{'name':<{20}}: {self.name}")
-        print(f"{'index':<{20}}: {self.index}")
-        if self.mtu:
-            print(f"{'mtu':<{20}}: {self.mtu}")
-        if self.oper_status:
-            print(f"{'operational status':<{20}}: {self.oper_status}")
-        if self.phys_address:
-            print(f"{'physical address':<{20}}: {self.phys_address}")
-
-        if self.ipv4_addr:
-            first = True
-            for addr in self.ipv4_addr:
-                origin = f"({addr['origin']})" if addr.get('origin') else ""
-                key = 'ipv4 addresses' if first else ''
-                colon = ':' if first else ' '
-                row = f"{key:<{20}}{colon} "
-                row += f"{addr['ip']}/{addr['prefix-length']} {origin}"
-                print(row)
-                first = False
-        else:
-                print(f"{'ipv4 addresses':<{20}}:")
-
-        if self.ipv6_addr:
-            first = True
-            for addr in self.ipv6_addr:
-                origin = f"({addr['origin']})" if addr.get('origin') else ""
-                key = 'ipv6 addresses' if first else ''
-                colon = ':' if first else ' '
-                row = f"{key:<{20}}{colon} "
-                row += f"{addr['ip']}/{addr['prefix-length']} {origin}"
-                print(row)
-                first = False
-        else:
-                print(f"{'ipv6 addresses':<{20}}:")
-
-        if self.in_octets and self.out_octets:
-            print(f"{'in-octets':<{20}}: {self.in_octets}")
-            print(f"{'out-octets':<{20}}: {self.out_octets}")
-
-
-def find_iface(_ifaces, name):
-    for _iface in [Iface(data) for data in _ifaces]:
-        if _iface.name == name:
-            return _iface
-
-    return False
-
-
-def pr_interface_list(json):
-    hdr = (f"{'INTERFACE':<{Pad.iface}}"
-           f"{'PROTOCOL':<{Pad.proto}}"
-           f"{'STATE':<{Pad.state}}"
-           f"{'DATA':<{Pad.data}}")
-
-    print(Decore.invert(hdr))
-
-    ifaces = sorted(json["ietf-interfaces:interfaces"]["interface"], key=lambda x: x['name'])
-
-    for iface in [Iface(data) for data in ifaces]:
-        if iface.is_bridge():
-            iface.pr_bridge(ifaces)
-            continue
-
-        if iface.is_vlan():
-            iface.pr_vlan(ifaces)
-            continue
-
-        # These interfaces are printed by there parent, such as bridge
-        if iface.parent:
-            continue
-        if iface.bridge:
-            continue
-
-        iface.pr_name()
-        iface.pr_proto_eth()
-        iface.pr_proto_ipv4()
-        iface.pr_proto_ipv6()
-
-def ietf_interfaces(json, name):
-    if not json or not json.get("ietf-interfaces:interfaces"):
-        print(f"Error, top level \"ietf-interfaces:interfaces\" missing")
-        sys.exit(1)
-
-    if not name:
-        return pr_interface_list(json)
-
-    iface = find_iface(json["ietf-interfaces:interfaces"]["interface"], name)
-    if not iface:
-        print(f"Interface {name} not found")
-        sys.exit(1)
-    return iface.pr_iface()
-
-
-json = json.load(sys.stdin)
-
-if args.module == "ietf-interfaces":
-    sys.exit(ietf_interfaces(json, args.name))
-else:
-    print(f"Error, unknown module {args.module}")
-    sys.exit(1)
@@ -0,0 +1,307 @@
+#!/usr/bin/env python3
+
+import importlib.machinery
+import json
+import os
+import struct
+import subprocess
+import sys
+
+onieprom = importlib.machinery.SourceFileLoader("onieprom","/bin/onieprom").load_module()
+
+KKIT_IANA_PEM = 61046
+
+class DTSystem:
+    BASE = "/sys/firmware/devicetree/base"
+    INFIX = BASE + "/chosen/infix"
+
+    def __init__(self):
+        self.vpdseq = 0
+
+        dt = {}
+        for root, _, files in os.walk(DTSystem.BASE):
+            if "phandle" not in files:
+                continue
+
+            phandle = os.path.join(root, "phandle")
+            if not os.path.exists(phandle):
+                continue
+
+            ph, = struct.unpack(">L", open(phandle, "rb").read())
+            dt[ph] = root
+
+        sys = {}
+        for root, dirs, _ in os.walk("/sys/devices"):
+            if "of_node" not in dirs:
+                continue
+
+            phandle = os.path.join(root, "of_node", "phandle")
+            if not os.path.exists(phandle):
+                continue
+
+            ph, = struct.unpack(">L", open(phandle, "rb").read())
+            if ph not in sys:
+                sys[ph] = []
+            sys[ph].append(root)
+
+        phs = set(list(dt.keys()) + list(sys.keys()))
+
+        self.devs = { ph: [Device(ph, dt.get(ph), s if s is not None else "") for s in (sys.get(ph) or []) if ph is not None]  for ph in phs }
+        self.base = Device(0, None, DTSystem.BASE)
+        self.infix = Device(0, None, DTSystem.INFIX)
+
+    def __get_phandle_array(self, name):
+        path = os.path.join(DTSystem.INFIX, name)
+        if not os.path.exists(path):
+            return ()
+
+        data = open(path, "rb").read()
+        elems = len(data) // struct.calcsize(">L")
+        return struct.unpack(">" + elems * "L", data)
+
+    def devices_from_ph(self, ph):
+        return self.devs.get(ph)
+
+    def into_vpd(self, dev):
+        def parse():
+            if not dev.available():
+                return {}
+
+            try:
+                data = onieprom.from_tlv(open(dev.attrpath("nvmem"), "rb", 0))
+            except:
+                data = {}
+
+            return data
+
+        self.vpdseq += 1
+        return {
+            "board": dev.dtstr("infix,board", f"UNKNOWN{self.vpdseq}"),
+            "available": dev.available(),
+            "trusted": dev.hasdtattr("infix,trusted"),
+            "data": parse(),
+        }
+
+    def infix_usb_devices(self, out):
+        names=self.infix.str_array("usb-port-names")
+        phs=self.__get_phandle_array("usb-ports")
+        data=dict(zip(names,phs))
+        if data != {}:
+            out["usb-ports"] = []
+        for name,ph in data.items():
+            [out["usb-ports"].extend([{"name": name, "path": dev.attrpath("authorized")}, {"name": name, "path": dev.attrpath("authorized_default")}]) for dev in self.devices_from_ph(ph)]
+
+
+    def infix_devices(self, kind):
+        phs = self.__get_phandle_array(kind)
+        return [[d for d in self.devices_from_ph(ph)] for ph in phs]
+
+    def infix_vpds(self):
+        flat_devices = [device for sublist in self.infix_devices("vpds") for device in sublist]
+        return [self.into_vpd(device) for device in flat_devices]
+
+class QEMUSystem:
+    BASE = "/sys/firmware/qemu_fw_cfg"
+    REV = BASE + "/rev"
+    VPD = BASE + "/by_name/opt/vpd/raw"
+
+    def product_vpd(self):
+        data = {}
+        if os.path.exists(QEMUSystem.VPD):
+            try:
+                data = onieprom.from_tlv(open(QEMUSystem.VPD, "rb", 0))
+            except:
+                pass
+
+        return {
+            "board": "product",
+            "available": os.path.exists(QEMUSystem.VPD),
+            "trusted": True,
+            "data": data,
+        }
+
+    def vpds(self):
+        return [self.product_vpd()]
+
+    def usb_ports(self):
+        ports = [
+            {
+            "name": "USB",
+            "path": "/sys/bus/usb/devices/usb1/authorized"
+
+        },
+        {
+            "name": "USB",
+            "path": "/sys/bus/usb/devices/usb1/authorized_default"
+
+        },
+        {
+            "name": "USB2",
+            "path": "/sys/bus/usb/devices/usb2/authorized"
+        },
+        {
+            "name": "USB2",
+            "path": "/sys/bus/usb/devices/usb2/authorized_default"
+
+        }]
+        return ports
+class Device:
+    def __init__(self, ph, dtpath, syspath):
+        self.ph, self.dtpath, self.syspath = ph, dtpath, syspath
+
+    def available(self):
+        return self.syspath != None
+
+    def __getitem__(self, attr):
+        return self.attr(attr).decode("utf-8").strip("\0")
+
+    def __setitem__(self, attr, value):
+        return self.attr(attr, val=value.encode("utf-8"))
+
+
+    def attrpath(self, attr):
+        return os.path.join(self.syspath, attr)
+
+    def hasattr(self, attr):
+        return os.path.exists(self.attrpath(attr))
+
+    def attr(self, attr, default=None, val=None):
+        if not self.hasattr(attr):
+            return default if val == None else False
+
+        if val:
+            open(self.attrpath(attr), "wb").write(value)
+            return True
+
+        return open(self.attrpath(attr), "rb").read()
+
+    def str(self, attr, default=None):
+        val = self.attr(attr)
+        return val.decode("utf-8").strip("\0") if val else default
+
+    def str_array(self, attr, default=None):
+        val = self.attr(attr)
+        return val.decode("utf-8").strip("\0").split("\0") if val else default
+
+    def dtattrpath(self, attr):
+        return os.path.join(self.dtpath, attr)
+
+    def hasdtattr(self, attr):
+        return os.path.exists(self.dtattrpath(attr))
+
+    def dtattr(self, attr, default=None):
+        if not self.hasdtattr(attr):
+            return default
+
+        return open(self.dtattrpath(attr), "rb").read()
+
+    def dtstr(self, attr, default=None):
+        val = self.dtattr(attr)
+        return val.decode("utf-8").strip("\0") if val else default
+
+
+def vpd_get_json_ve(vpd, pem):
+    ves = vpd["data"].get("vendor-extension")
+    if not ves:
+        return {}
+
+    out = {}
+    for ve in filter(lambda ve: ve[0] == pem, ves):
+        out.update(json.loads(ve[1]))
+
+    return out
+
+def vpd_get_pwhash(vpd):
+    if not vpd.get("trusted"):
+        return None
+
+    kkit = vpd_get_json_ve(vpd, KKIT_IANA_PEM)
+    return kkit.get("pwhash")
+
+def vpd_inject(out, vpds):
+    out["vpd"] = { vpd["board"]: vpd for vpd in vpds }
+
+    product = out["vpd"].get("product", {}).get("data", {})
+    hoistattrs = ("vendor", "product-name", "part-number", "serial-number", "mac-address")
+    for attr in hoistattrs:
+        if attr in product:
+            out[attr] = product[attr]
+
+    for vpd in vpds:
+        pwhash = vpd_get_pwhash(vpd)
+        if pwhash:
+            out["factory-password-hash"] = pwhash
+            break
+
+def probe_qemusystem(out):
+    ADMINHASH = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"
+
+    qsys = QEMUSystem()
+    vpds = qsys.vpds()
+    usb_ports = qsys.usb_ports()
+    vpd_inject(out, vpds)
+    out["usb-ports"] = usb_ports
+    for (attr, default) in (
+            ("vendor", "QEMU"),
+            ("product-name", "VM"),
+    ):
+        if not out[attr]:
+            out[attr] = default
+
+    if not out["factory-password-hash"] and \
+       not out["vpd"]["product"]["available"]:
+        # Virtual instance without VPD emulation, fallback to
+        # admin/admin
+        out["factory-password-hash"] = ADMINHASH
+
+    # Let others react to the fact that we are running in QEMU
+    subprocess.run("initctl -nbq cond set qemu".split())
+    return 0
+
+def probe_dtsystem(out):
+    dtsys = DTSystem()
+    vpds = dtsys.infix_vpds()
+    dtsys.infix_usb_devices(out)
+    model = dtsys.base.str("model")
+    if model:
+        out["product-name"] = model
+
+    staticpw = dtsys.infix.str("factory-password-hash")
+    if not out["factory-password-hash"]:
+        out["factory-password-hash"] = staticpw
+
+    vpd_inject(out, vpds)
+    return 0
+
+def main():
+    out = {
+        "vendor": None,
+        "product-name": None,
+        "part-number": None,
+        "serial-number": None,
+        "mac-address": None,
+        "factory-password-hash": None,
+        "vpd": {}
+    }
+    vpds = []
+
+    if os.path.exists(QEMUSystem.REV):
+        err = probe_qemusystem(out)
+    elif os.path.exists(DTSystem.BASE):
+        err = probe_dtsystem(out)
+    else:
+        return 1
+
+    if err:
+        return err
+
+    if not out["factory-password-hash"]:
+        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\nNO FACTORY PASSWORD FOUND\033[0m\n\n")
+        err = 1
+
+    json.dump(out, open("/run/system.json", "w"))
+    os.chmod("/run/system.json", 0o444)
+    return err
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -0,0 +1,38 @@
+#!/bin/sh
+
+set -e
+
+disk=$1
+bootoffs=$2
+
+bootsize=8M
+auxsize=8M
+
+total=$(awk -vdisk="$(basename $disk)" '$4 == disk { print($3 / 1024); }' /proc/partitions)
+if [ "$total" -ge 4096 ]; then
+    imgsize=1024M
+    cfgsize=512M
+elif [ "$total" -ge 2048 ]; then
+    imgsize=512M
+    cfgsize=256M
+elif [ "$total" -ge 1024 ]; then
+    imgsize=256M
+    cfgsize=64M
+elif [ "$total" -ge 512 ]; then
+    imgsize=192M
+    cfgsize=16M
+else
+    echo "$disk is only ${total}M, at least 512M is required" >2
+    exit 1
+fi
+
+sgdisk \
+    -o \
+    -n1:${bootoffs}:+${bootsize} -t1:8301 -c1:boot \
+    -n2::+${auxsize} -t2:8301 -c2:aux \
+    -n3::+${imgsize} -t3:8300 -c3:primary \
+    -n4::+${imgsize} -t4:8300 -c4:secondary \
+    -n5::+${cfgsize} -t5:8302 -c5:cfg \
+    -n6::            -t6:8310 -c6:var \
+    -p \
+    $disk
@@ -0,0 +1,115 @@
+#!/bin/sh
+
+set -e
+
+progname="$0"
+
+usage()
+{
+    cat <<EOF
+Usage: ${progname} <url-to-pkg> <block-dev>
+
+Provision Infix to a system (typically netbooted) with a blank block
+device
+
+  - Downloads an Infix install bundle, using curl(1)
+  - Creates an Infix compatible partition table on the block device
+  - Initializes auxiliary and configuration filesystems and metadata
+  - Installs Infix to both primary and secondary partitions
+
+EOF
+}
+
+step()
+{
+    current="$*"
+    printf "\e[37;44m>>> %-60s\e[0m\n" "${current} ..." >&2
+}
+
+ok()
+{
+    printf "\e[37;42m<<< %-56s  OK\e[0m\n\n" "${current}" >&2
+}
+
+err()
+{
+    printf "\e[37;41m!!! %-56s ERR\e[0m\n\n" "${current}" >&2
+    exit 1
+}
+
+while getopts "h" opt; do
+    case ${opt} in
+	h)
+	    usage && exit 0
+	    ;;
+    esac
+done
+shift $((OPTIND - 1))
+
+if [ $# -lt 2 ]; then
+    usage && exit 1
+fi
+
+url=$1
+blk=$2
+pkg=/tmp/pkg
+
+
+step "Downloading $url"
+curl -o $pkg $url || err
+rauc info $pkg || err
+ok
+
+
+step "Formatting $blk"
+[ -b $blk ] || { echo "$blk is not a block device" >&2; err; }
+/libexec/infix/prod/fdisk $blk || err
+sleep 1
+ok
+
+for part in aux cfg var; do
+    step "Creating $part filesystem"
+    mkfs.ext4 -F -L $part /dev/disk/by-partlabel/$part || err
+    mount /mnt/$part || err
+    ok
+done
+
+step "Bootstrapping aux partition"
+if [ -f /etc/fw_env.config ]; then
+    size_n_file=$(awk '{ print("-s", $3, "-o", $1); }' /etc/fw_env.config)
+    mkenvimage $size_n_file - <<EOF
+BOOT_ORDER=primary secondary net
+BOOT_primary_LEFT=1
+BOOT_secondary_LEFT=1
+BOOT_net_LEFT=1
+EOF
+fi
+ok
+
+step "Preparing installation"
+rm -f /tmp/rauc
+[ -f /etc/default/rauc ] && cp /etc/default/rauc /tmp/rauc
+ok
+
+
+step "Installing to primary partition"
+echo "RAUC_ARGS=--override-boot-slot=secondary" >/etc/default/rauc
+initctl -b restart rauc || err
+rauc install $pkg || err
+ok
+
+
+step "Installing to secondary partition"
+echo "RAUC_ARGS=--override-boot-slot=primary" >/etc/default/rauc
+initctl -b restart rauc || err
+rauc install $pkg || err
+ok
+
+
+step "Finishing installation"
+rm /etc/default/rauc
+[ -f /tmp/rauc ] && cp /tmp/rauc /etc/default/rauc
+initctl -b restart rauc || err
+rauc status mark-active rootfs.0
+rauc status --detailed
+ok
@@ -1,26 +1,28 @@
 test-dir := $(BR2_EXTERNAL_INFIX_PATH)/test
-INFIX_TESTS ?= $(test-dir)/case/all-unit.yaml $(test-dir)/case/all.yaml
+UNIT_TESTS ?= $(test-dir)/case/all-repo.yaml $(test-dir)/case/all-unit.yaml
+INFIX_TESTS ?= $(test-dir)/case/all.yaml

 test-env = $(test-dir)/env \
 	-f $(BINARIES_DIR)/infix-x86_64.img \
 	-p $(BINARIES_DIR)/infix-x86_64.pkg \
 	$(1) $(2)

-test-env-qeneth = $(call test-env,-q $(test-dir)/virt/dual,$(1))
+test-env-qeneth = $(call test-env,-q $(test-dir)/virt/quad,$(1))
 test-env-run    = $(call test-env,-C -t $(BINARIES_DIR)/qemu.dot,$(1))

-.PHONY: test-%
+test-unit:
+	$(test-dir)/env $(test-dir)/9pm/9pm.py $(UNIT_TESTS)

-test-qeneth:
+test test-qeneth:
 	$(call test-env-qeneth,\
-		$(BR2_EXTERNAL_INFIX_PATH)/9pm/9pm.py \
+		$(BR2_EXTERNAL_INFIX_PATH)/test/9pm/9pm.py \
 			$(INFIX_TESTS))
-test-qeneth-sh:
-	$(call test-env-qeneth,/bin/sh)
+test-sh test-qeneth-sh:
+	$(call test-env-qeneth,-i /bin/sh)

 test-run: | ~/.infix-test-venv
 	$(call test-env-run,\
-		$(BR2_EXTERNAL_INFIX_PATH)/9pm/9pm.py \
+		$(BR2_EXTERNAL_INFIX_PATH)/test/9pm/9pm.py \
 			$(INFIX_TESTS))
 test-run-sh: | ~/.infix-test-venv
 	$(call test-env-run,/bin/sh)
@@ -30,3 +32,5 @@ test-run-play: | ~/.infix-test-venv

 ~/.infix-test-venv:
 	$(test-dir)/docker/init-venv.sh $(test-dir)/docker/pip-requirements.txt
+
+.PHONY: test-unit test test-sh test-qeneth test-qeneth-sh test-run test-run-sh test-run-play
@@ -38,10 +38,8 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_NET=y
 CONFIG_PACKET=y
-CONFIG_UNIX=y
 CONFIG_XDP_SOCKETS=y
 CONFIG_XDP_SOCKETS_DIAG=y
-CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
 CONFIG_IP_MULTIPLE_TABLES=y
@@ -83,7 +81,6 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
-CONFIG_NFT_OBJREF=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
@@ -156,9 +153,7 @@ CONFIG_VLAN_8021Q=y
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
 CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBQ=y
 CONFIG_NET_CLS_BASIC=y
-CONFIG_NET_CLS_TCINDEX=y
 CONFIG_NET_CLS_BPF=y
 CONFIG_NET_CLS_FLOWER=y
 CONFIG_NETLINK_DIAG=y
@@ -224,11 +219,18 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
-CONFIG_USB=y
-CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_EHCI_HCD=y
-CONFIG_USB_UHCI_HCD=y
-CONFIG_USB_STORAGE=y
+CONFIG_USB=m
+CONFIG_USB_XHCI_HCD=m
+CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_UHCI_HCD=m
+CONFIG_USB_STORAGE=m
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_ACTIVITY=y
+CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_SYNC_FILE=y
 CONFIG_VIRTIO_PCI=y
@@ -239,7 +241,6 @@ CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
 CONFIG_EXT4_FS=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
-CONFIG_AUTOFS4_FS=y
 CONFIG_FUSE_FS=y
 CONFIG_VIRTIO_FS=y
 CONFIG_OVERLAY_FS=y
@@ -253,8 +254,8 @@ CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_AES=y
+CONFIG_CRYPTO_GCM=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
@@ -6,6 +6,7 @@ BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
@@ -22,7 +23,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.6"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
@@ -41,6 +42,7 @@ BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_CA_CERTIFICATES=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -77,6 +79,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_DIALOG=y
 BR2_PACKAGE_PDMENU=y
+BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
@@ -13,6 +13,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
@@ -23,7 +25,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.6"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
@@ -32,23 +34,28 @@ BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dt
 BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
@@ -62,8 +69,9 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPTABLES=y
+BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
@@ -82,6 +90,8 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
@@ -107,10 +117,12 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
-INFIX_HOME="https://github.com/kernelkit/infix"
+INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CURIOS_HTTPD=y
+BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
@@ -119,11 +131,18 @@ BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
+BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
-BR2_PACKAGE_NET=y
+BR2_PACKAGE_PODMAN=y
+BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
+BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
+BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_QUERIERD=y
+BR2_PACKAGE_LIBINPUT=y
 DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
@@ -0,0 +1,176 @@
+BR2_aarch64=y
+BR2_cortex_a53=y
+BR2_ARM_FPU_VFPV4=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_TARGET_GENERIC_HOSTNAME="infix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_TERM="xterm"
+BR2_SYSTEM_DHCP="eth0"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
+BR2_GENERATE_LOCALE="en_US en_CA"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh support/scripts/genimage.sh"
+BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
+BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/linux_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="rockchip/rk3328-nanopi-r2s"
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
+BR2_PACKAGE_STRACE=y
+BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_LINUX_FIRMWARE=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT61=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT73=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT2XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_81XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X=y
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_CONNTRACK_TOOLS=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FRR=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPTABLES=y
+BR2_PACKAGE_IPTABLES_NFTABLES=y
+BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NETCAT_OPENBSD=y
+BR2_PACKAGE_NETSNMP=y
+BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NMAP=y
+BR2_PACKAGE_NMAP_NCAT=y
+BR2_PACKAGE_NMAP_NMAP=y
+BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_TRACEROUTE=y
+BR2_PACKAGE_ULOGD=y
+BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_HTOP=y
+BR2_PACKAGE_IRQBALANCE=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_DBUS=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_LESS=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_EXT2=y
+BR2_TARGET_ROOTFS_EXT2_4=y
+BR2_TARGET_ROOTFS_EXT2_SIZE="256M"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="v2.5"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="rk3328"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES=""
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_NEEDS_ARM32_TOOLCHAIN=y
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2021.10"
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="nanopi-r2s-rk3328"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
+BR2_TARGET_UBOOT_NEEDS_OPENSSL=y
+BR2_TARGET_UBOOT_NEEDS_ATF_BL31=y
+BR2_TARGET_UBOOT_NEEDS_ATF_BL31_ELF=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
+BR2_TARGET_UBOOT_SPL=y
+BR2_TARGET_UBOOT_SPL_NAME="idbloader.img"
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+INFIX_VENDOR_HOME="https://github.com/kernelkit"
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_EXECD=y
+BR2_PACKAGE_STATD=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
+BR2_PACKAGE_KEYACK=y
+BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_PODMAN=y
+BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
+BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
+BR2_PACKAGE_PODMAN_DRIVER_VFS=y
+BR2_PACKAGE_TETRIS=y
+BR2_PACKAGE_QUERIERD=y
+BR2_PACKAGE_LIBINPUT=y
+# SIGN_ENABLED is not set
+# GNS3_APPLIANCE is not set
@@ -5,6 +5,7 @@ BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
@@ -21,7 +22,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.6"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,6 +35,7 @@ BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_CA_CERTIFICATES=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -69,6 +71,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_DIALOG=y
 BR2_PACKAGE_PDMENU=y
+BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
@@ -86,7 +89,7 @@ BR2_TARGET_ROOTFS_SQUASHFS=y
 BR2_TARGET_EDK2=y
 BR2_TARGET_GRUB2=y
 BR2_TARGET_GRUB2_X86_64_EFI=y
-BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 fat squash4 part_gpt normal efi_gop configfile loadenv test terminfo terminal echo"
+BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback"
 BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
 BR2_TARGET_GRUB2_INSTALL_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
@@ -12,6 +12,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
@@ -22,13 +24,12 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.6"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -38,13 +39,18 @@ BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_RNG_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
@@ -58,8 +64,9 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPTABLES=y
+BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
@@ -78,6 +85,8 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
@@ -115,6 +124,8 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CURIOS_HTTPD=y
+BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
@@ -123,9 +134,15 @@ BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
+BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
-BR2_PACKAGE_NET=y
+BR2_PACKAGE_PODMAN=y
+BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
+BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
+BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_QUERIERD=y
 GNS3_APPLIANCE_RAM=512
@@ -1,77 +0,0 @@
-BR2_x86_64=y
-BR2_x86_corei7=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
-BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
-BR2_ENABLE_DEBUG=y
-BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_TARGET_GENERIC_HOSTNAME="infix"
-BR2_TARGET_GENERIC_ISSUE="Minfix by KernelKit"
-BR2_INIT_FINIT=y
-BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
-BR2_TARGET_GENERIC_GETTY_TERM="xterm"
-BR2_SYSTEM_DHCP="eth0"
-BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
-BR2_GENERATE_LOCALE="en_US en_CA"
-BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.6"
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
-BR2_LINUX_KERNEL_INSTALL_TARGET=y
-BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
-BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
-BR2_PACKAGE_JQ=y
-BR2_PACKAGE_DBUS_CXX=y
-BR2_PACKAGE_DBUS_GLIB=y
-BR2_PACKAGE_DBUS_TRIGGERD=y
-BR2_PACKAGE_EUDEV_RULES_GEN=y
-# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_LIBOPENSSL_BIN=y
-BR2_PACKAGE_NETOPEER2_CLI=y
-BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_ONIGURUMA=y
-BR2_PACKAGE_AVAHI=y
-BR2_PACKAGE_AVAHI_DAEMON=y
-BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
-BR2_PACKAGE_CHRONY=y
-BR2_PACKAGE_DNSMASQ=y
-BR2_PACKAGE_ETHTOOL=y
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_OPENRESOLV=y
-BR2_PACKAGE_OPENSSH=y
-BR2_PACKAGE_TCPDUMP=y
-BR2_PACKAGE_KMOD_TOOLS=y
-BR2_PACKAGE_BASH_COMPLETION=y
-BR2_PACKAGE_PWGEN=y
-BR2_PACKAGE_SYSKLOGD=y
-BR2_PACKAGE_SYSKLOGD_LOGGER=y
-BR2_PACKAGE_LESS=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_PACKAGE_CONFD=y
-BR2_PACKAGE_STATD=y
-BR2_PACKAGE_FACTORY=y
-BR2_PACKAGE_FINIT_SULOGIN=y
-BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
-BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
-BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
-BR2_PACKAGE_FINIT_PLUGIN_RTC=y
-BR2_PACKAGE_FINIT_PLUGIN_TTY=y
-BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_NET=y
-BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_PYTHON3_PYC_ONLY=y
-# SIGN_ENABLED is not set
-# GNS3_APPLIANCE is not set
@@ -4,6 +4,486 @@ Change Log
 All notable changes to the project are documented in this file.


+[v24.02.0][] - 2024-03-01
+-------------------------
+
+> **Note:** the `root` account is disabled in official builds.  Only the
+> `admin` user can log in to the system.  This can be changed, but only
+> in developer builds: `make menuconfig` -> System configuration ->
+> `[*]Enable root login with password`
+
+### YANG Status
+
+Infix devices support downloading all YANG models over NETCONF, including
+models with submodules.  As a rule, standard models are used as long as
+they map to underlying Linux concepts and services.  All exceptions are
+listed in Infix specific models, detailing deviations and augmentations.
+
+Currently supported models:
+
+ - [ieee802-ethernet-interface][]:
+   - Toggle port speed & duplex auto-negotiation on/off
+   - Set port speed and duplex when auto-negotiation is off
+   - Query port speed/duplex and auto-negotiation status (operational)
+   - **Frame counters:**
+
+    | **YANG**                    | **Linux / Ethtool**               |
+    |-----------------------------|-----------------------------------|
+    | `out-frames`                | `FramesTransmittedOK`             |
+    | `out-multicast-frames`      | `MulticastFramesXmittedOK`        |
+    | `out-broadcast-frames`      | `BroadcastFramesXmittedOK`        |
+    | `in-total-octets`           | `FramesReceivedOK`                |
+    |                             | + `FrameCheckSequenceErrors`      |
+    |                             | + `FramesLostDueToIntMACRcvError` |
+    |                             | + `AlignmentErrors`               |
+    |                             | + `etherStatsOversizePkts`        |
+    |                             | + `etherStatsJabbers`             |
+    | `in-frames`                 | `FramesReceivedOK`                |
+    | `in-multicast-frames`       | `MulticastFramesReceivedOK`       |
+    | `in-broadcast-frames`       | `BroadcastFramesReceivedOK`       |
+    | `in-error-undersize-frames` | `undersize_pkts`                  |
+    | `in-error-fcs-frames`       | `FrameCheckSequenceErrors`        |
+    | `in-good-octets`            | `OctetsReceivedOK`                |
+    | `out-good-octets`           | `OctetsTransmittedOK`             |
+
+ - [ietf-hardware][]:
+   - Populates standard hardware model from corresponding data in device EEPROMs
+   - **augments:**
+     - Initial support for USB ports
+     - Vital Product Data (VPD) from device EEPROMs ([ONIE][] structure)
+   - [infix-hardware][]: Deviations and augments
+ - [ietf-system][]:
+   - **augments:**
+     - Message of the Day (MotD) banner, shown after SSH or console login.
+	   Please note: the legacy `motd` has been replaced with `motd-banner` os
+	   of v24.02.  Use CLI `text-editor` to modify the latter
+	 - User login shell, default: `/bin/false` (no SSH or console login)
+	 - State information for remotely querying firmware version information
+   - **deviations:**
+     - timezone-name, using IANA timezones instead of plain string
+	 - UTC offset, only support per-hour offsets with [tzdata][]
+	 - Usernames, clarifying Linux restrictions
+     - Unsupported features marked as deviations, e.g. RADIUS
+   - [infix-system-software][]: firmware upgrade with `install-bundle` RPC
+ - [ietf-interfaces][]:
+   - deviation to allow read-write `if:phys-address` for custom MAC address
+   - [ietf-ip][]: augments
+     - IPv4LL similar to standardized IPv6LL
+   - [ietf-ip][]: deviations (`not-supported`) added for IPv4 and IPv6:
+     - `/if:interfaces/if:interface/ip:ipv4/ip:address/ip:subnet/ip:netmask`
+	 - `/if:interfaces/if:interface/ip:ipv6/ip:address/ip:status`
+	 - `/if:interfaces/if:interface/ip:ipv4/ip:neighbor`
+     - `/if:interfaces/if:interface/ip:ipv6/ip:neighbor`
+   - [ietf-routing][]: Base model for routing
+   - [ietf-ipv4-unicast-routing][]: Static unicast routing, incl. operational
+     data, i.e., setting static IPv4 routes and reading IPv4 routing table
+   - [ietf-ipv6-unicast-routing][]: Static unicast routing, incl. operational
+     data, i.e., setting static IPv6 routes and reading IPv6 routing table
+   - [ietf-ospf][]: Limited support for OSPFv2, with additional support for
+     injecting default route, and route redistribution.  Underlying routing
+     engine in use is Frr.  Includes operational status + data (routes).
+	 See [infix-routing][] model for detailed list of deviations
+   - [infix-ethernet-interface][]: deviations for ieee802-ethernet-interface
+   - [infix-routing][]: Limit ietf-routing to one instance `default` per
+     routing protocol, also details unsupported features (deviations) to both
+     ietf-routing and ietf-ospf models, as well as augments made to support
+     injecting default route in OSPFv2
+   - [infix-if-bridge][]: Linux bridge interfaces with native VLAN support
+   - [infix-if-type][]: deviation for interface types, limiting number to
+     supported types only.  New identities are derived from default IANA
+     interface types, ensuring compatibility with other standard models, e.g.,
+     `ieee802-ethernet-interface.yang`
+   - [infix-if-veth][]: Linux VETH pairs
+   - [infix-if-vlan][]: Linux VLAN interfaces, e.g. `eth0.10`
+ - [infix-containers][]: Support for Docker containers, incl. operational data
+   to query status and remotely stop/start containers
+ - [infix-dhcp-client][]: DHCPv4 client, including supported options
+ - **Configurable services:**
+   - [ieee802-dot1ab-lldp][]: stripped down to an `enabled` setting
+   - [infix-services][]: support for enabling mDNS service/device discovery
+
+[tzdata]:          https://www.iana.org/time-zones
+[ietf-system]:     https://www.rfc-editor.org/rfc/rfc7317.html
+[ietf-interfaces]: https://www.rfc-editor.org/rfc/rfc7223.html
+[ietf-ip]:         https://www.rfc-editor.org/rfc/rfc8344.html
+[ietf-if-vlan-encapsulation]: https://www.ietf.org/id/draft-ietf-netmod-sub-intf-vlan-model-08.html
+[ietf-routing]:     https://www.rfc-editor.org/rfc/rfc8349
+[ietf-ipv4-unicast-routing]: https://www.rfc-editor.org/rfc/rfc8349#page-29
+[ietf-ipv6-unicast-routing]: https://www.rfc-editor.org/rfc/rfc8349#page-37
+[ietf-hardware]:    https://www.rfc-editor.org/rfc/rfc8348
+[ietf-ospf]:        https://www.rfc-editor.org/rfc/rfc9129
+[ieee802-dot1ab-lldp]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/ieee802-dot1ab-lldp%402022-03-15.yang
+[ieee802-ethernet-interface]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/ieee802-ethernet-interface%402019-06-21.yang
+[infix-ethernet-interface]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-ethernet-interface%402024-02-27.yang
+[infix-containers]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-containers%402024-02-01.yang
+[infix-dhcp-client]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-dhcp-client%402024-01-30.yang
+[infix-hardware]:  https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-hardware%402024-01-18.yang
+[infix-if-bridge]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-if-bridge%402024-02-19.yang
+[infix-if-type]:   https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-if-type%402024-01-29.yang
+[infix-if-veth]:   https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-if-veth%402023-06-05.yang
+[infix-if-vlan]:   https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-if-vlan%402023-10-25.yang
+[infix-ip]:        https://github.com/kernelkit/infix/tree/f0c23ca/src/confd/yang/infix-ip%402023-09-14.yang
+[infix-routing]:   https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-routing%402024-01-09.yang
+[infix-services]:  https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-services%402023-10-16.yang
+[infix-system-software]: https://github.com/kernelkit/infix/tree/f0c23ca/src/confd/yang/infix-system-software%402023-06-27.yang
+[ONIE]: https://opencomputeproject.github.io/onie/design-spec/hw_requirements.html
+
+### Changes
+
+- New hardware support: NanoPi R2S from FriendlyELEC, a simple two-port router
+- Static routing support, now also for IPv6
+- Dynamic routing support with OSPFv2, limited (see `infix-routing.yang` for
+  deviations), but still usable in most relevant use-cases.  If you are using
+  this and are interested in more features, please let us know!
+  - Multiple area support, including different area types
+  - Route redistribution
+  - Default route injection
+  - Full integration with Bidirectional Forward Detection (BFD)
+  - Operational status, including but not limited to:
+    * OSPF Router ID
+    * Neighbor status
+    * OSPF routing table
+	* Interface type, incl. passive status
+  - For more information, see `doc/networking.md`
+- Support for disabling USB ports in `startup-config` (no auto-mount yet!)
+- Initial support for Docker containers, see documentation for details:
+  - Custom Infix model, see `infix-containers.yang` for details
+  - Add image URL/location and volumes/mounts/interfaces to configuration,
+    the system ensures the image is downloaded and container created in the
+	background before launching it.  If now networking is available the job
+	is queued and retried every time a new network route is learned
+  - Status and actions (stop/start/restart) available in operational datastore
+  - Possible to move physical switch ports inside container, see docs
+  - Possible to bundle OCI archives in Infix image, as well as storing any
+    file content in `factory-config` to override container image defaults
+- IEEE Ethernet interface:
+  - Support for setting port speed/duplex or auto-negotiating
+  - New per-port counters, augments to IEEE model added in infix-ethernet.yang:
+    `in-good-octets`, `out-good-octets`
+- Many updates to DHCPv4 client YANG model:
+  - new options, see `infix-dhcp-client.yang` for details:
+    - Default options: subnet, router, dns+domain, hostname, broadcast, ntpsrv
+    - Set NTP servers, require NTP client in ietf-system to be enabled, will
+	  be treated as non-preferred sources, configured `prefer` servers wins
+    - Learn DNS servers, statically configured servers always takes precedence
+    - Install routes, not only from option 3, but also options 121 and 249
+  - Support for ARP:ing for client lease (default enabled)
+  - Configurable route metrics, by default metric 100 to allow static routes
+    to win over DHCP routes, useful for backup DHCP connections
+- IETF Hardware data: added YANG model for vital product data representation,
+  and augments for initial USB support (enable/disable)
+- IETF System:
+  - the `motd` augment in `infix-system.yang` for *Message of the Day* has
+    been marked as obsolete and replaced with `motd-banner`.  The new setting
+    is of type *binary* and allows control codes and multi-line content to be
+    stored.  The legacy `motd` will remain for the foreseeable future and
+    takes precedence over the new `motd-banner` setting
+  - new `text-editor` augment in `infix-system.yang` to select the backend for
+    the new `text-editor` command: `emacs`, `nano`, or `vi`
+- Many updates to the test system, *Infamy*, incl. new Quick Start Guide in
+  updated `doc/testing.md` to help new developers get started
+- Add `htop` to default builds, useful for observing and attaching (strace)
+- Change the default shell of the `admin` user from `clish` to `bash`.  Change
+  required for factory production and provisioning reasons.  Only affects the
+  built-in default, customer specific `factory-config`'s are not affected!
+- CLI: the `set` command on a boolean can now be used without an argument,
+  `set boolean` sets the boolean option to true
+- CLI: new command `change`, for use with ietf-system user passwords, starts
+  an interactive password dialog, including confirmation entry.  The resulting
+  password is by default salted and hashed using sha512crypt
+- CLI: new command `text-editor`, for use with binary fields, e.g., `content`
+  for file mounts in containers, or the new `motd-banner`:
+
+        admin@infix-c0-ff-ee:/config/system/> text-editor motd-banner
+        ... exit with Ctrl-x Ctrl-c ...
+        admin@infix-c0-ff-ee:/config/system/> show
+        motd-banner VGhpcyByZWxlYXNlIHdhcyBzcG9uc29yZWQgYnkgQWRkaXZhIEVsZWt0cm9uaWsK;
+
+- CLI: new admin-exec command `show ntp [sources]`
+- CLI: new admin-exec command `show dns` to display DNS client status
+- CLI: new admin-exec command `show ospf [subcommand]`
+- CLI: new admin-exec command `show container [subcommand]`
+- CLI: new admin-exec command `show hardware` only USB port status for now
+- CLI: updates to the `show interfaces` command to better list bridge VLANs
+
+### Fixes
+
+- Fix #177: ensure bridge is not bridge port to itself
+- Fix #259: failure to `copy factory-config startup-config` in CLI
+- Fix #278: allow DHCP client to set system hostname (be careful)
+- Fix #283: hostname in DHCP request adds quotation marks
+- Fix #294: drop stray `v` from version suffix in release artifacts
+- Fix #298: drop privileges properly before launching user `shell` in CLI
+- Fix #312: race condition in `ipv4_autoconf.py`, causes test to block forever
+- Backport upstream fix to netopeer2-server for fetching YANG models that
+  refer to submodules over NETCONF
+- CLI: drop developer debug in `set` command
+- Fix out-of-place `[OK]` messages at shutdown/reboot
+- Fix garbled syslog messages due to unicode in Infix tagline, drop unicode
+
+
+[v23.11.0][] - 2023-11-30
+-------------------------
+
+> **Note:** this is the first release where the `root` account is disabled in
+> default builds.  Only the `admin` user, generated from `factory-config`, can
+> log in to the system.  This can be changed only in developer builds: `make
+> menuconfig` -> System configuration -> `[*]Enable root login with password`
+
+### YANG Status
+
+ - [ieee802-ethernet-interface][]: Currently supported (read-only) features:
+   - Status of auto-negotiation, and if enabled.
+   - Current speed and duplex
+   - Frame counters:
+
+    | **YANG**                    | **Linux / Ethtool**               |
+    |-----------------------------|-----------------------------------|
+    | `out-frames`                | `FramesTransmittedOK`             |
+    | `out-multicast-frames`      | `MulticastFramesXmittedOK`        |
+    | `out-broadcast-frames`      | `BroadcastFramesXmittedOK`        |
+    | `in-total-octets`           | `FramesReceivedOK`                |
+    |                             | + `FrameCheckSequenceErrors`      |
+    |                             | + `FramesLostDueToIntMACRcvError` |
+    |                             | + `AlignmentErrors`               |
+    |                             | + `etherStatsOversizePkts`        |
+    |                             | + `etherStatsJabbers`             |
+    | `in-frames`                 | `FramesReceivedOK`                |
+    | `in-multicast-frames`       | `MulticastFramesReceivedOK`       |
+    | `in-broadcast-frames`       | `BroadcastFramesReceivedOK`       |
+    | `in-error-undersize-frames` | `undersize_pkts`                  |
+    | `in-error-fcs-frames`       | `FrameCheckSequenceErrors`        |
+
+ - [ietf-system][]:
+   - **augments:**
+     - MotD (Message of the Day)
+	 - User login shell, default: `/bin/false` (no SSH or console login)
+	 - State information for remotely querying firmware version information
+   - **deviations:**
+     - timezone-name, using IANA timezones instead of plain string
+	 - UTC offset, only support per-hour offsets with [tzdata][]
+	 - Usernames, clarifying Linux restrictions
+     - Unsupported features marked as deviations, e.g. RADIUS
+   - [infix-system-software][]: firmware upgrade with `install-bundle` RPC
+ - [ietf-interfaces][]:
+   - deviation to allow read-write `if:phys-address` for custom MAC address
+   - [ietf-ip][]: augments
+     - IPv4LL similar to standardized IPv6LL
+   - [ietf-ip][]: deviations (`not-supported`) added for IPv4 and IPv6:
+     - `/if:interfaces/if:interface/ip:ipv4/ip:address/ip:subnet/ip:netmask`
+	 - `/if:interfaces/if:interface/ip:ipv6/ip:address/ip:status`
+	 - `/if:interfaces/if:interface/ip:ipv4/ip:neighbor`
+     - `/if:interfaces/if:interface/ip:ipv6/ip:neighbor`
+   - [ietf-routing][]: Base model for routing
+   - [ietf-ipv4-unicast-routing][]: Static unicast routing, incl. operational
+     data, i.e., setting static IPv4 routes and reading IPv4 routing table
+   - [infix-ethernet-interface][]: deviations for ieee802-ethernet-interface
+   - [infix-routing][]: Limit ietf-routing to one instance `default` per
+     routing protocol, also details unsupported features (deviations)
+   - [infix-if-bridge][]: Linux bridge interfaces with native VLAN support
+   - [infix-if-type][]: deviation for interface types, limiting number
+     to supported types only.  New identities are derived from default
+     IANA interface types, ensuring compatibility with other standard
+     models, e.g., `ieee802-ethernet-interface.yang`
+   - [infix-if-veth][]: Linux VETH pairs
+   - [infix-if-vlan][]: Linux VLAN interfaces, e.g. `eth0.10`
+ - **Configurable services:**
+   - [ieee802-dot1ab-lldp][]: stripped down to an `enabled` setting
+   - [infix-services][]: support for enabling mDNS service/device discovery
+
+[tzdata]:          https://www.iana.org/time-zones
+[ietf-system]:     https://www.rfc-editor.org/rfc/rfc7317.html
+[ietf-interfaces]: https://www.rfc-editor.org/rfc/rfc7223.html
+[ietf-ip]:         https://www.rfc-editor.org/rfc/rfc8344.html
+[ietf-if-vlan-encapsulation]: https://www.ietf.org/id/draft-ietf-netmod-sub-intf-vlan-model-08.html
+[ietf-routing]:     https://www.rfc-editor.org/rfc/rfc8349
+[ietf-ipv4-unicast-routing]: https://www.rfc-editor.org/rfc/rfc8349#page-29
+[ieee802-dot1ab-lldp]: https://github.com/kernelkit/infix/blob/985c2fd/src/confd/yang/ieee802-dot1ab-lldp%402022-03-15.yang
+[ieee802-ethernet-interface]: https://github.com/kernelkit/infix/blob/985c2fd/src/confd/yang/ieee802-ethernet-interface%402019-06-21.yang
+[infix-ethernet-interface]: https://github.com/kernelkit/infix/blob/985c2fd/src/confd/yang/infix-ethernet-interface%402023-11-22.yang
+[infix-if-bridge]: https://github.com/kernelkit/infix/blob/985c2fd/src/confd/yang/infix-if-bridge%402023-11-08.yang
+[infix-if-type]:   https://github.com/kernelkit/infix/blob/985c2fd/src/confd/yang/infix-if-type%402023-08-21.yang
+[infix-if-veth]:   https://github.com/kernelkit/infix/blob/985c2fd/src/confd/yang/infix-if-veth%402023-06-05.yang
+[infix-if-vlan]:   https://github.com/kernelkit/infix/blob/985c2fd/src/confd/yang/infix-if-vlan%402023-10-25.yang
+[infix-ip]:        https://github.com/kernelkit/infix/tree/985c2fd/src/confd/yang/infix-ip%402023-09-14.yang
+[infix-routing]:   https://github.com/kernelkit/infix/blob/985c2fd/src/confd/yang/infix-routing%402023-11-23.yang
+[infix-services]:  https://github.com/kernelkit/infix/blob/985c2fd/src/confd/yang/infix-services%402023-10-16.yang
+[infix-system-software]: https://github.com/kernelkit/infix/tree/985c2fd/src/confd/yang/infix-system-software%402023-06-27.yang
+
+### Changes
+
+- The CLI built-in command `password generate` has been changed to use the
+  secure mode of the `pwgen` tool, and 13 chars for increased entropy
+- The `qemu.sh -c` command, available in developer builds and the release zip,
+  can now be used to modify the RAM size and enable VPD emulation
+- Add support for overriding generated factory defaults in derivatives
+  using a `/etc/confdrc.lcocal` file -- incl. updated branding docs.
+- Add support for detecting factory reset condition from a bootloader
+- Ensure `/var` is also cleared (properly) during factory reset
+- Add support for port auto-negotiation status in operational datastore
+- Add CLI support for showing veth pairs in `show interfaces`
+- Speedups to CLI detailed view of a single interface
+- Updated documentation of VLAN interfaces and VLAN filtering bridge
+- Updated documentation for how to customize services in *Hybrid Mode*
+- In RMA mode (runlevel 9), the system no longer has any login services
+- Disable `root` login in all NETCONF builds, only `admin` available
+- Add support for VPD data in ONIE EEPROM format
+- Add `iito`, the intelligent input/output daemon for LED control
+- Add port autoneg and speed/duplex status to operational data
+- Upgrade Linux to v6.5.11, with kkit extensions
+- Add support for static IPv4 routing using `ietf-routing@2018-03-13.yang` and
+  `ietf-ipv4-unicast-routing@2018-03-13.yang`, one `default` instance only
+- Add support for partitioning and self-provisioning of new devices
+- Add support for reading `admin` user's default password from VPD.  Devices
+  that do not have a VPD can set a password hash in the device tree
+- Add support for upgrading software bundles (images) from the CLI.
+  Supported remote servers: ftp, tftp, and http/https.
+- Traversing the CLI configure context has been simplified by collapsing all
+  YANG containers that only contain a single list element.  Example:
+  `edit interfaces interface eth0` becomes `edit interface eth0`
+- Add CLI support for creating configuration backups and transferring files
+  to/from remote servers: tftp, ftp, http/https (download only). Issue #155
+- Add `_netconf-ssh._tcp` record to mDNS-SD
+
+### Fixes
+
+- Fix #111: fix auto-inference of dynamic interface types (bridge, veth)
+- Fix #125: improved feedback on invalid input in configure context
+- Fix #198: drop bridge default PVID setting, for VLAN filtering bridge.
+  All bridge ports must have explicit VLAN assignment (security)
+- Fix #215: impossible to enable NTP client, regression from v23.06.0
+- Fix regression in CLI `show factory-config` command
+- Fix missing version in `/etc/os-release` variable `PRETTY_NAME`
+- Fix failure to start `podman` in GNS3 (missing Ext4 filesystem feature)
+- Fix initial terminal size probing in CLI when logging in from console port
+- Fix CLI `show running-config`, use proper JSON format like other files
+- Fix caching of libyang module references in confd.  Loading other plugins to
+  sysrepo-plugind modifies these references, which may can cause corruption
+- Fix missing `v` in `VERSION`, `VERSION_ID`, and `IMAGE_VERSION` in
+  `/etc/os-release` and other generated files for release builds.
+
+
+[v23.10.0][] - 2023-10-31
+-------------------------
+
+> **Note:** upcoming releases will lock the `root` user for system-only
+> services.  Instead an `admin` user will be the only default user with
+> the CLI as its login shell.  This user is already available, so please
+> consider updating any guidelines or documentation you may have.
+
+### YANG Status
+
+ - [ietf-system][]:
+   - **augments:**
+     - MotD (Message of the Day)
+	 - User login shell, default: `/bin/false`
+	 - State information for remotely querying firmware version information
+   - **deviations:**
+     - timezone-name, using IANA timezones instead of plain string
+	 - UTC offset, only support per-hour offsets with [tzdata][]
+	 - Usernames, clarifying Linux restrictions
+     - Unsupported features marked as deviations, e.g. RADIUS
+   - [infix-system-software][]: firmware upgrade with `install-bundle` RPC
+ - [ietf-interfaces][]:
+   - deviation to allow read-write `if:phys-address` for custom MAC address
+   - [ietf-ip][]: augments
+     - IPv4LL similar to standardized IPv6LL
+   - [ietf-ip][]: deviations (`not-supported`) added for IPv4 and IPv6:
+     - `/if:interfaces/if:interface/ip:ipv4/ip:address/ip:subnet/ip:netmask`
+	 - `/if:interfaces/if:interface/ip:ipv6/ip:address/ip:status`
+	 - `/if:interfaces/if:interface/ip:ipv4/ip:neighbor`
+     - `/if:interfaces/if:interface/ip:ipv6/ip:neighbor`
+   - ~~[ietf-if-vlan-encapsulation][]:~~ Removed in favor of a native model.
+   - [infix-if-bridge][]: Linux bridge interfaces with native VLAN support
+   - [infix-if-type][]: deviation for interface types, limiting number
+     to supported types only.  New identities are derived from default
+     IANA interface types, ensuring compatibility with other standard
+     models, e.g., `ieee802-ethernet-interface.yang`
+   - [infix-if-veth][]: Linux VETH pairs
+   - [infix-if-vlan][]: Linux VLAN interfaces, e.g. `eth0.10` (New model!)
+ - **Configurable services:**
+   - [ieee802-dot1ab-lldp][]: stripped down to an `enabled` setting
+   - [infix-services][]: support for enabling mDNS service/device discovery
+
+[tzdata]:          https://www.iana.org/time-zones
+[ieee802-dot1ab-lldp]: https://github.com/kernelkit/infix/tree/50a550b/src/confd/yang/ieee802-dot1ab-lldp%402022-03-15.yang
+[ietf-system]:     https://www.rfc-editor.org/rfc/rfc7317.html
+[ietf-interfaces]: https://www.rfc-editor.org/rfc/rfc7223.html
+[ietf-ip]:         https://www.rfc-editor.org/rfc/rfc8344.html
+[ietf-if-vlan-encapsulation]: https://www.ietf.org/id/draft-ietf-netmod-sub-intf-vlan-model-08.html
+[infix-if-bridge]: https://github.com/kernelkit/infix/blob/fc5310b/src/confd/yang/infix-if-bridge%402023-08-21.yang
+[infix-if-type]:   https://github.com/kernelkit/infix/tree/fc5310b/src/confd/yang/infix-if-type%402023-08-21.yang
+[infix-if-veth]:   https://github.com/kernelkit/infix/tree/fc5310b/src/confd/yang/infix-if-veth%402023-06-05.yang
+[infix-if-vlan]:   https://github.com/kernelkit/infix/blob/fc5310b/src/confd/yang/infix-if-vlan%402023-10-25.yang
+
+[infix-ip]:        https://github.com/kernelkit/infix/tree/fc5310b/src/confd/yang/infix-ip%402023-09-14.yang
+[infix-services]:  https://github.com/kernelkit/infix/blob/fc5310b/src/confd/yang/infix-services%402023-10-16.yang
+[infix-system-software]: https://github.com/kernelkit/infix/tree/fc5310b/src/confd/yang/infix-system-software%402023-06-27.yang
+
+### Changes
+
+- Add support for setting/querying IPv4/IPv6 MTU, see #152 for details.
+- Add support for *Fail Secure Mode*: if loading `startup-config` fails,
+  e.g. YANG model validation failure after upgrade, the system now falls back
+  to load `failure-config` instead of just crashing.  This config, along with
+  `factory-config`, is generated on every boot to match the active image's
+  YANG models.  In case neither config can be loaded, or even bootstrapping
+  YANG models fail, the system will go into an RMA state -- Return to
+  Manufacturer, clearly signaled on the console and, on devices that support
+  it, angry LED signaling.  See #154 for more.
+- Add support for generating GNS3 appliance file for NETCONF Aarch64.
+- Add support for UTC offset (+/- HH:00) in `ietf-system`, PR #174
+- Add support for `ietf-factory-default` RPC, PR #175
+- Add support for performing factory reset (using #175 RPC) from CLI
+- Replace `ietf-if-vlan-encapsulation` YANG model with the native
+  `infix-if-vlan` model.  This fits better with Linux VLAN interfaces and
+  simplifies the syntax greatly.  For details, see PR #179
+  
+        admin@example:/config/interfaces/interface/eth0.10/> set vlan id 10 lower-layer-if eth0
+
+- The following new NETCONF interface operational counters have been added:
+  
+| **YANG**                    | **Linux / Ethtool**               |
+|-----------------------------|-----------------------------------|
+| `out-frames`                | `FramesTransmittedOK`             |
+| `out-multicast-frames`      | `MulticastFramesXmittedOK`        |
+| `out-broadcast-frames`      | `BroadcastFramesXmittedOK`        |
+| `in-total-frames`           | `FramesReceivedOK`                |
+|                             | + `FrameCheckSequenceErrors`      |
+|                             | + `FramesLostDueToIntMACRcvError` |
+|                             | + `AlignmentErrors`               |
+|                             | + `etherStatsOversizePkts`        |
+|                             | + `etherStatsJabbers`             |
+| `in-frames`                 | `FramesReceivedOK`                |
+| `in-multicast-frames`       | `MulticastFramesReceivedOK`       |
+| `in-broadcast-frames`       | `BroadcastFramesReceivedOK`       |
+| `in-error-undersize-frames` | `undersize_pkts`                  |
+| `in-error-fcs-frames`       | `FrameCheckSequenceErrors`        |
+
+- Greatly improved branding support using `make menuconfig`.  All the
+  identifying strings, including firmware image, is in `/etc/os-release`, will
+  be used in CLI `show system-information`, the WebUI About dialog, and any
+  prominent areas when booting up (on console), logging in to CLI and WebUI.
+- IGMP/MLD snooping is now disabled by default on new bridges.  Support
+  for multicast filtering bridges expected no later than v24.01.
+- The SSDP responder, device discovery in Windows, has been removed in favor
+  of Windows 10 (build 1709) native support for mDNS-SD.  Details in #166
+- A GreenPAK programmer has been added, not enabled by default.  This is a
+  popular programmable little chip from Renesas.  Worth a look!
+- The `confd` script `gen-interfaces` can now generate bridges and stand-alone
+  interfaces with IPv6 (SLAAC) for `factory-config` et al.
+- Drop `x86_64_minimal_defconfig`, previously used for regression tests only
+- Documentation updates of how IPv4/IPv6 addresses are shown in NETCONF
+  operational data, as well as the built-in CLI, see #163 for details.
+
+### Fixes
+
+- Fix #106: confd: drop deviation `ietf-system:timezone-utc-offset`
+- Fix #151: Operational status broken in v23.09
+- Fix #159: Hacky generation of `/etc/resolv.conf` at boot 
+- Fix #162: VLAN interface without encapsulation is accepted by YANG model
+
+
 [v23.09.0][] - 2023-10-02
 -------------------------

@@ -216,7 +696,10 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v23.08.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.02.0...HEAD
+[v24.02.0]:   https://github.com/kernelkit/infix/compare/v23.11.0...v24.02.0
+[v23.11.0]:   https://github.com/kernelkit/infix/compare/v23.10.0...v23.11.0
+[v23.10.0]:   https://github.com/kernelkit/infix/compare/v23.09.0...v23.10.0
 [v23.09.0]:   https://github.com/kernelkit/infix/compare/v23.08.0...v23.09.0
 [v23.08.0]:   https://github.com/kernelkit/infix/compare/v23.06.0...v23.08.0
 [v23.06.0]:   https://github.com/kernelkit/infix/compare/BASE...v23.06.0
@@ -62,7 +62,7 @@ To mitigate the risk of a malicious user being able to circumvent the
 bootloader's validation procedure, user configuration is kept to a
 minimum.  Two settings are available:

- **Boot order**: Since Infix maintains two copies of its firmware,
+- **Boot order**: Since Infix maintains two copies of its software image,
  and as some bootloaders support netbooting, the order in which boot
  sources are considered can be configured. To select the active
  source, use [RAUC][]:
@@ -106,7 +106,7 @@ boot Infix over the network.  DHCP is used to configure the network
 and TFTP to transfer the image to the system's RAM.

 Access to U-Boot's shell is disabled to prevent side-loading of
-malicious firmware.  To configure the active boot partition, refer to
+malicious software.  To configure the active boot partition, refer to
 the [Bootloader Interface](#bootloader-interface) section.


@@ -128,11 +128,11 @@ Interface](#bootloader-interface).
 System Upgrade
 ==============

-Much of the minutiae of firmware upgrades is delegated to [RAUC][],
+Much of the minutiae of software upgrades is delegated to [RAUC][],
 which offers lots of benefits out-of-the-box:

 - Upgrade Bundles are always signed, such that their authenticity can
-  be verified by the running firmware, before the new one is
+  be verified by the running operating system, before the new one is
  installed.

 - The bureaucracy of interfacing with different bootloaders, manage
@@ -41,6 +41,62 @@ Verify the result after a build by inspecting:
    printed on a label on the device.


+Factory Defaults
+----------------
+
+The Infix default configuration, factory-config, is part static files
+and part per-device generated files, e.g., SSH hostkey and hostname.
+The latter is constructed from the file `/etc/hostname`, appended with
+the last three octets of the system's base MAC address.  To override the
+base hostname, set `BR2_TARGET_GENERIC_HOSTNAME` in your defconfig.
+
+The static files are installed by Infix `confd` in `/usr/share/confd/`
+at build time.  It contains two subdirectories:
+
+    /usr/share/confd/
+     |- factory.d/
+     |  |- 10-foo.json
+     |  |- 10-bar.json
+     |  `- 10-qux.json
+     `- failure.d/
+        |- 10-xyzzy.json
+        `- 10-garply.json
+
+To override, or extend, these files in you br2-external, set up a rootfs
+overlay and add it last in `BR2_ROOTFS_OVERLAY`.  Your overlay can look
+something like this:
+
+    ./board/common/rootfs/
+      |- etc/
+      |  |- confdrc             # See below
+      |  `- confdrc.local
+      `- usr/
+         `- share/
+            `- confd/
+               |- 10-foo.json   # Override Infix foo
+               |- 30-bar.json   # Extend, probably 10-bar.json
+               `- 30-fred.json  # Extend, your own defaults
+
+Using the same filename in your overlay, here `10-foo.json`, completely
+replaces the contents of the same file provided by Infix.  If you just
+want to extend, or replace parts of an Infix default, use `30-....json`.
+Here the file `30-bar.json` is just a helpful hit to maintainers of your
+br2-external that it probably extends Infix' `10-bar.json`.
+
+The reason for the jump in numbers is that 20 is reserved for files
+generated by Infix' `gen-function` scripts.  Your br2-external can
+provide a few custom ones that the `bootstrap` knows about, e.g.,
+`gen-ifs-custom` that overrides `20-interfaces.json`.  See the
+bootstrap script for more help, and up-to-date information.
+
+> **Note:** you may not need to provide your own `/etc/confdrc`.  The
+> one installed by `confd` is usually enough.  However, if you want to
+> adjust the behavior of `bootstrap` you may want to override it.  There
+> is also `confdrc.local`, which usually is enough to change arguments
+> to scripts like `gen-interfaces`, e.g., to create a bridge by default,
+> you may want to look into `GEN_IFACE_OPTS`.
+
+
 Integration
 -----------

@@ -103,7 +159,31 @@ Releases
 --------

 A release build requires the global variable `INFIX_RELEASE` to be set.
-It can be derived from GIT, if the source tree is kept in GIT VCS.
+It can be derived from GIT, if the source tree is kept in GIT VCS.  First,
+let us talk about versioning in general.
+
+### Versioning
+
+Two popular scheme for versioning a product derived from Infix:
+
+ 1. Track Infix major.minor, e.g. *Foobar v23.08.z*, where `z` is
+    your patch level.  I.e., Foobar v23.08.0 could be based on Infix
+    v23.08.0, or v23.08.12, it is up to you.  Maybe you based it on
+    v23.08.12 and then back ported changes from v23.10.0, but it was
+    the first release you made to your customer(s).
+ 2. Start from v1.0.0 and step the major number every time you sync
+    with a new Infix release, or every time Infix bumps to the next
+    Buildroot LTS.
+
+The important thing is to be consistent, not only for your own sake,
+but also for your end customers.  The *major.minor.patch* style is
+the most common and often recommended style, which usually maps well
+to other systems, e.g. PROFINET GSDML files require this (*VX.Y.Z*).
+But you can of course use only two numbers, *major.minor*, as well.
+
+> What could be confusing, however, is if you use the name *Infix*
+> with your own versioning scheme.
+

 ### `INFIX_RELEASE`

@@ -122,3 +202,4 @@ Infix tree and can be changed by setting the menuconfig branding
 variable `INFIX_OEM_PATH` to that of the br2-external.  It is also
 possible to set the `GIT_VERSION` variable in your `post-build.sh`
 script to change how the VCS version is extracted.
+
@@ -35,7 +35,7 @@ The system has several datastores (or files):
 To save configuration changes made to the `running-config` so the system
 will use them consecutive reboots, use the `copy` command:

-    admin@infix-12-34-56:/> copy running-config startup-config
+    admin@host-12-34-56:/> copy running-config startup-config

 In *configure context* the following commands are available:

@@ -44,6 +44,8 @@ In *configure context* the following commands are available:
 | `set foo bar val` | Set `bar` leaf node in `foo` subcontext to `val`       |
 | `no foo bar`      | Clear/delete configuration made to `bar` in `foo`      |
 | `edit foo baz`    | Enter `baz` sub-sub-context in `foo` subcontext        |
+| `change password` | Start password dialogue to change a user's password    |
+| `text-editor foo` | Open a text editor to edit binary setting `foo`        |
 | `abort`           | Abort changes in configuration, return to admin-exec   |
 | `exit`            | Exit one level sub-context, or abort from top-level    |
 | `leave`           | Save changes to `running-config`, return to admin-exec |
@@ -64,17 +66,17 @@ We inspect the system status to ensure the change took effect.  Then we
 save the changes for the next reboot.

 ```
-admin@infix-12-34-56:/> configure
-admin@infix-12-34-56:/config/> edit interfaces interface eth0
-admin@infix-12-34-56:/config/interfaces/interface/eth0/> set ipv4 <TAB>
+admin@host-12-34-56:/> configure
+admin@host-12-34-56:/config/> edit interface eth0
+admin@host-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
      address     autoconf bind-ni-name      enabled
 	  forwarding  mtu      neighbor
-admin@infix-12-34-56:/config/interfaces/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
-admin@infix-12-34-56:/config/interfaces/interface/eth0/> show
+admin@host-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
+admin@host-12-34-56:/config/interface/eth0/> show
 type ethernetCsmacd;
 ipv4 address 192.168.2.200 prefix-length 24;
 ipv6 enabled true;
-admin@infix-12-34-56:/config/interfaces/interface/eth0/> diff
+admin@host-12-34-56:/config/interface/eth0/> diff
 interfaces {
  interface eth0 {
 +    ipv4 {
@@ -84,14 +86,14 @@ interfaces {
 +    }
  }
 }
-admin@infix-12-34-56:/config/interfaces/interface/eth0/> leave
-admin@infix-12-34-56:/> show interfaces brief
+admin@host-12-34-56:/config/interface/eth0/> leave
+admin@host-12-34-56:/> show interfaces brief
 lo               UNKNOWN        00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP>
 eth0             UP             52:54:00:12:34:56 <BROADCAST,MULTICAST,UP,LOWER_UP>
-admin@infix-12-34-56:/> show ip brief
+admin@host-12-34-56:/> show ip brief
 lo               UNKNOWN        127.0.0.1/8 ::1/128
 eth0             UP             192.168.2.200/24 fe80::5054:ff:fe12:3456/64
-admin@infix-12-34-56:/> copy running-config startup-config
+admin@host-12-34-56:/> copy running-config startup-config
 ```

 One of the ideas behind a separate running and startup configuration is
@@ -99,7 +101,7 @@ to be able to verify a configuration change.  In case of an inadvertent
 change that, e.g., breaks networking, it is trivial to revert back by:

 ```
-admin@infix-12-34-56:/> copy startup-config running-config
+admin@host-12-34-56:/> copy startup-config running-config
 ```

 Or restarting the device.
@@ -21,5 +21,9 @@ keybindings are really useful to learn!
 | `help introduction` | An introduction to the CLI                 |
 | `help keybindings`  | Lists keybindings and other helpful tricks |
 | `help tutorial`     | The CLI User Guide                         |
+| `help text-editor`  | Help with the built-in text-editor command |

+> In `configure` context the `help setting` command shows the YANG
+> description text for each node and container.  To reach the admin
+> exec help from configure context, e.g., `do help text-editor`

@@ -0,0 +1,70 @@
+# Text Editor
+
+The CLI built-in `text-editor` command can be used to edit type `binary`
+settings in configure context.
+
+The default editor is a Micro Emacs clone.  Users not familiar with
+terminal based editors may benefit from this introduction.
+
+
+## Escape Meta/Alt Control Shift
+
+When starting up, the editor status field at the bottom shows the
+following shorthand:
+
+```
+C-h q  quick help | C-h t  tutorial | C-h b  key bindings | C = Ctrl | M = Alt
+```
+
+Key combinations with a `-` (dash) mean holding down the modifier key.
+Combinations without a `-` (dash) mean without any modifier key.
+
+### Quick help `C-h q`
+
+  - hold down the `Ctrl` key on
+  - tap the `h` key
+  - release `Ctrl`
+  - tap the `q` key
+
+The bottom part of the terminal now shows a "buffer" called `*quick*`:
+
+```
+FILE              BUFFER           WINDOW            MARK/KILL        MISC
+C-x C-c exit      C-x b   switch   C-x 0 only other  C-space mark     C-_ undo
+C-x C-f find      C-x k   close    C-x 1 only this   C-w     kill-rg  C-s search
+C-x C-s save      C-x C-b list     C-x 2 split two   C-k     kill-ln  C-r r-search
+C-x s   save-all  C-x h   mark     C-x ^ enlarge     C-y     yank     M-% replace
+C-x i   insert    C-x g   goto-ln  C-x o other win   C-x C-x swap     M-q reformat
+```
+
+### Save & Exit `C-x C-c`
+
+  - Hold down the Ctrl key
+  - tap `X`
+  - tap `c`
+  - release `Ctrl`
+
+> The status field at the bottom asks if you are really sure, and/or if
+> you want to add a final Enter/newline to the file.  For binary content
+> that final newline may be important.
+
+
+## Changing the Editor
+
+The system has three different built-in editors: 
+
+ - `emacs` (Micro Emacs)
+ - `nano` (GNU Nano)
+ - `vi` (Visual Editor)
+
+Changing editor is done in configure context, in the system container:
+
+```
+admin@host:/> configure
+admin@host:/config/> edit system
+admin@host:/config/system/> set text-editor <TAB>
+emacs	nano	vi
+admin@host:/config/system/> set text-editor nano
+admin@host:/config/system/> leave
+admin@example:/> 
+```
@@ -1,12 +1,11 @@
 User Guide
 ==========

-The command line interface (CLI, see-el-i) is built on the open source
-component [klish][1], which implements a CISCO like, or Juniper Networks
-JunOS-like CLI on a UNIX system.
+The command line interface (CLI, see-ell-aye) implements a CISCO-like,
+or Juniper Networks JunOS-like, CLI for UNIX systems.

 New users always get the CLI as the default "shell" when logging in, but
-the default `admin` user logs in to the Bash.  To access the CLI, type:
+the default `admin` user logs in to `bash`.  To access the CLI, type:

    cli

@@ -18,11 +17,11 @@ Key commands available in any context are:
 For each command it also possible to press the `?` key and `TAB` to get
 more help and suggestions for completion.

-> **Note:** for the sake of brevity, the hostname in the following
-> examples has been shortened to `host`.  The default name is composed
-> from a product specific string followed by the last three octets of
-> the system base MAC address, e.g., `infix-12-34-56`.  An example of
-> how to change the hostname is included below.
+> **Note:** for the sake of brevity, the hostname in the following examples
+> has been shortened to `host`.  The default name is composed from a product
+> specific string followed by the last three octets of the system base MAC
+> address, e.g., `switch-12-34-56`.  An example of how to change the hostname
+> is included below.


 Admin Exec
@@ -36,14 +35,75 @@ Available commands can be seen by pressing `?` at the prompt:

 ```
 admin@host:/>
-  configure  Create new candidate-config based on running-config
-  copy       Copy
-  exit       Exit
-  logout     Alias for exit
-  shell      Enter system shell
-  show       Show
+  configure      Create new candidate-config based on running-config
+  copy           Copy configuration, e.g., copy running-config startup-config
+  exit           Exit from CLI (log out)
+  factory-reset  Restore the system to factory default state
+  follow         Monitor a log file, use Ctrl-C to abort
+  help           Help system (also try '?' key)
+  logout         Alias to exit
+  netcalc        IP subnet calculator
+  password       Password tools
+  ping           Ping a network host or multicast group
+  poweroff       Poweroff system (system policy may yield reboot)
+  reboot         Reboot system
+  set            Set operations, e.g., current date/time
+  shell          Enter system shell
+  show           Show system status and configuration files
+  tcpdump        Capture network traffic
+  upgrade        Install a software update bundle
 ```

+To get more help for a given command, type the command, a space, and
+then tap `?` again.  You can also tap the `Tab` key to see available
+argument completions.
+
+### Upgrading the Software
+
+The admin-exec command `upgrade` can be used to install software images, or
+bundles.  A bundle is a signed and self-contained package that carries all the
+information necessary to determine if it holds a bootloader, a Linux image, or
+even both.
+
+To install a new software image to the currently *inactive* partition[^1], we
+use the `upgrade` command and a URI to a ftp/tftp/sftp or http/https server
+that hosts the file:
+
+```
+admin@host:/> upgrade tftp://192.168.122.1/firmware-x86_64-v23.11.pkg
+installing
+  0% Installing
+  0% Determining slot states
+ 20% Determining slot states done.
+ 20% Checking bundle
+ 20% Verifying signature
+ 40% Verifying signature done.
+ 40% Checking bundle done.
+ 40% Checking manifest contents
+ 60% Checking manifest contents done.
+ 60% Determining target install group
+ 80% Determining target install group done.
+ 80% Updating slots
+ 80% Checking slot rootfs.1
+ 90% Checking slot rootfs.1 done.
+ 90% Copying image to rootfs.1
+ 99% Copying image to rootfs.1 done.
+ 99% Updating slots done.
+100% Installing done.
+Installing `tftp://192.168.122.1/firmware-x86_64-v23.11.pkg` succeeded
+admin@host:/>
+```
+
+The secondary partition (`rootfs.1`) has now been upgraded and will be used as
+the *active* partition on the next boot.  Leaving the primary partition, with
+the version we are currently running, intact in case of trouble.
+
+[^1]: It is not possible to upgrade the partition we booted from.  Thankfully
+    the underlying "rauc" subsystem keeps track of this.  Hence, to upgrade
+    both partitions you must reboot to the new version (to verify it works)
+    and then repeat the same command.
+
+
 Configure Context
 -----------------

@@ -53,35 +113,38 @@ followed by Enter.  Available commands, press `?` at the prompt:
 ```
 admin@host:/> configure
 admin@host:/config/>
-  abort     Abandon candidate
-  check     Validate candidate
-  commit    Commit current candidate to running-config
-  delete    Delete configuration setting(s)
-  diff      Summarize uncommitted changes
-  do        Execute operational mode command
-  edit      Descend to the specified configuration node
-  exit      Ascend to the parent configuration node, or abort (from top)
-  leave     Finalize candidate and apply to running-config
-  no        Alias for delete
-  rollback  Restore candidate to running-config
-  set       Set configuration setting
-  show      Show configuration
-  top       Ascend to the configuration root
-  up        Ascend to the parent configuration node
+  abort        Abandon candidate
+  change       Interactively change setting, e.g. password
+  check        Validate candidate
+  commit       Commit current candidate to running-config
+  delete       Delete configuration setting(s)
+  diff         Summarize uncommitted changes
+  do           Execute operational mode command
+  edit         Descend to the specified configuration node
+  end          Alias to up, leave this subsection/node
+  exit         Ascend to the parent configuration node, or abort (from top)
+  leave        Finalize candidate and apply to running-config
+  no           Alias for delete
+  rollback     Restore candidate to running-config
+  set          Set configuration setting
+  show         Show configuration
+  text-editor  Modify binary content in a text editor
+  top          Ascend to the configuration root
+  up           Ascend to the parent configuration node
 ```

 The `edit` command lets you change to a sub-configure context, e.g.:

 ```
-admin@host:/config/> edit interfaces interface eth0
-admin@host:/config/interfaces/interface/eth0/>
+admin@host:/config/> edit interface eth0
+admin@host:/config/interface/eth0/>
 ```

 Use `up` to go up one level.

 ```
-admin@host:/config/interfaces/interface/eth0/> up
-admin@host:/config/interfaces/>
+admin@host:/config/interface/eth0/> up
+admin@host:/config/>
 ```

 > **Note:** the tree structure in the configure context is automatically
@@ -94,16 +157,16 @@ admin@host:/config/interfaces/>
 ### Set IP Address on an Interface

 ```
-admin@host:/config/> edit interfaces interface eth0
-admin@host:/config/interfaces/interface/eth0/>
-admin@host:/config/interfaces/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
+admin@host:/config/> edit interface eth0
+admin@host:/config/interface/eth0/>
+admin@host:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
 ```

 From anywhere in configure context you can see the changes you have
 made by typing `diff`:

 ```
-admin@host:/config/interfaces/interface/eth0/> diff
+admin@host:/config/interface/eth0/> diff
 interfaces {
  interface eth0 {
 +    ipv4 {
@@ -121,7 +184,7 @@ interfaces {
 Apply the changes (from candidate to `running-config`):

 ```
-admin@host:/config/interfaces/> leave
+admin@host:/config/interface/eth0/> leave
 admin@host:/> show running-config
 ...
 interfaces {
@@ -175,23 +238,52 @@ is committed.
 User management, including passwords, is also a part of `ietf-system`.

 ```
-admin@host:/config/> edit system authentication
-admin@host:/config/system/authentication/> do password encrypt
-Password: ******
-$1$oVHGR0AP$6Pad1Pm8jPwPsan5WHULS1
-admin@host:/config/system/authentication/> set user admin password $1$oVHGR0AP$6Pad1Pm8jPwPsan5WHULS1
-admin@host:/config/system/> leave
+admin@host:/config/> edit system authentication user admin
+admin@host:/config/system/authentication/user/admin/> change password
+New password: 
+Retype password: 
+admin@host:/config/system/authentication/user/admin/> leave
 ```

-The call to `do password encrypt` brings up the helpful admin-exec
-command to hash, and optionally salt, your password.  This encrypted
-string is what goes into the system configuration.
+The `change password` command starts an interactive dialogue that asks
+for the new password, with a confirmation, and then salts and encrypts
+the password with sha512crypt. 
+
+It is also possible to use the `set password ...` command.  This allows
+setting an already hashed password.  To manually hash a password, use
+the `do password encrypt` command.  This launches the admin-exec command
+to hash, and optionally salt, your password.  This encrypted string can
+then be used with `set password ...`.

 > **Tip:** if you are having trouble thinking of a password, there is
 > also `do password generate`, which generates random but readable
 > strings using the UNIX command `pwgen`.


+### SSH Authorized Key
+
+Logging in remotely with SSH is possible by adding a *public key* to a
+user.  Here we add the authorized key to the admin user, multiple keys
+are supported.
+
+With SSH keys in place it is possible to disable password login, just
+remember to verify SSH login and network connectivity before doing so.
+
+```
+admin@host:/config/> edit system authentication user admin 
+admin@host:/config/system/authentication/user/admin/> edit authorized-key example@host
+admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> set algorithm ssh-rsa
+admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> set key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTTH8SKvAE4g8Rr97KOz/8PFtOObBrE9G21K7d6UBuPqmd0RUF2CkXXN/eN2PBSHJ50YprRFt/z/304bsBYkDdflKlPDjuSmZ/+OMp4pTsq0R0eNFlX9wcwxEzooIb7VPEdvWE7AYoBRUdf41u3KBHuvjGd1M6QYJtbFLQMMTiVe5IUfyVSZ1RCxEyAB9fR9CBhtVheTVsY3iG0fZc9eCEo89ErDgtGUTJK4Hxt5yCNwI88YaVmkE85cNtw8YwubWQL3/tGZHfbbQ0fynfB4kWNloyRHFr7E1kDxuX5+pbv26EqRdcOVGucNn7hnGU6C1+ejLWdBD7vgsoilFrEaBWF41elJEPKDzpszEijQ9gTrrWeYOQ+x++lvmOdssDu4KvGmj2K/MQTL2jJYrMJ7GDzsUu3XikChRL7zNfS2jYYQLzovboUCgqfPUsVba9hqeX3U67GsJo+hy5MG9RSry4+ucHs=
+admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> show
+algorithm ssh-rsa;
+key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTTH8SKvAE4g8Rr97KOz/8PFtOObBrE9G21K7d6UBuPqmd0RUF2CkXXN/eN2PBSHJ50YprRFt/z/304bsBYkDdflKlPDjuSmZ/+OMp4pTsq0R0eNFlX9wcwxEzooIb7VPEdvWE7AYoBRUdf41u3KBHuvjGd1M6QYJtbFLQMMTiVe5IUfyVSZ1RCxEyAB9fR9CBhtVheTVsY3iG0fZc9eCEo89ErDgtGUTJK4Hxt5yCNwI88YaVmkE85cNtw8YwubWQL3/tGZHfbbQ0fynfB4kWNloyRHFr7E1kDxuX5+pbv26EqRdcOVGucNn7hnGU6C1+ejLWdBD7vgsoilFrEaBWF41elJEPKDzpszEijQ9gTrrWeYOQ+x++lvmOdssDu4KvGmj2K/MQTL2jJYrMJ7GDzsUu3XikChRL7zNfS2jYYQLzovboUCgqfPUsVba9hqeX3U67GsJo+hy5MG9RSry4+ucHs=;
+admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> leave
+```
+
+> **Note:** the `ssh-keygen` program already base64 encodes the public
+> key data, so there is no need to use the `text-editor` command, `set`
+> does the job.
+
 ### Creating a VETH Pair

 The following example creates a `veth0a <--> veth0b` virtual Ethernet
@@ -199,11 +291,11 @@ pair which is useful for connecting, e.g., a container to the physical
 world.  Here we also add an IPv4 address to one end of the pair.

 ```
-admin@host:/config/> edit interfaces interface veth0a
-admin@host:/config/interfaces/interface/veth0a/> set veth peer veth0b
-admin@host:/config/interfaces/interface/veth0a/> set ipv4 address 192.168.0.1 prefix-length 24
-admin@host:/config/interfaces/interface/veth0a/> up
-admin@host:/config/interfaces/> diff
+admin@host:/config/> edit interface veth0a
+admin@host:/config/interface/veth0a/> set veth peer veth0b
+admin@host:/config/interface/veth0a/> set ipv4 address 192.168.0.1 prefix-length 24
+admin@host:/config/interface/veth0a/> up
+admin@host:/config/> diff
 interfaces {
 +  interface veth0a {
 +    type veth;
@@ -223,7 +315,7 @@ interfaces {
 +    }
 +  }
 }
-admin@host:/config/interfaces/> leave
+admin@host:/config/> leave
 ```

 See the bridging example below for more.
@@ -241,12 +333,12 @@ between both its bridge ports: `eth0` and `vet0b`.

 ```
 admin@host:/> configure
-admin@host:/config/> edit interfaces interface br0
-admin@host:/config/interfaces/interface/br0/> set bridge ieee-group-forward lldp
-admin@host:/config/interfaces/interface/br0/> up
-admin@host:/config/interfaces/> set interface eth0 bridge-port bridge br0
-admin@host:/config/interfaces/> set interface veth0b bridge-port bridge br0
-admin@host:/config/interfaces/> diff
+admin@host:/config/> edit interface br0
+admin@host:/config/interface/br0/> set bridge ieee-group-forward lldp
+admin@host:/config/interface/br0/> up
+admin@host:/config/> set interface eth0 bridge-port bridge br0
+admin@host:/config/> set interface veth0b bridge-port bridge br0
+admin@host:/config/> diff
 interfaces {
 +  interface br0 {
 +    type bridge;
@@ -2,301 +2,422 @@ Containers in Infix
 ===================

 * [Introduction](#introduction)
-* [Docker Containers with Podman](#docker-containers-with-podman)
-  * [Multiple Networks](#multiple-networks)
-  * [Hybrid Mode](#hybrid-mode)
-* [Enabling Containers](#enabling-containers)
-* [Debugging Containers](#debugging-containers)
+* [Caution](#caution)
+* [Getting Started](#getting-started)
+  * [Examples](#examples)
+* [Networking and Containers](#networking-and-containers)
+  * [Container Bridge](#container-bridge)
+  * [Container Host Interface](#container-host-interface)
+  * [Host Networking](#host-networking)
+* [Mounts and Volumes](#mounts-and-volumes)
+  * [Content Mounts](#content-mounts)
+* [Example Containers](#example-containers)
+  * [System Container](#system-container)
+  * [Application Container: nftables](#application-container--nftables)
+  * [Application Container: ntpd](#application-container--ntpd)
+* [Upgrading a Container Image](#upgradeing-a-container-image)


 Introduction
 ------------

-Default builds of Infix do not enable any container support.  See below
-section, [Enabling Container Support](#enabling-container-support), for
-details on how to enable it using Podman.
+Infix comes with native support for Docker containers using [podman][].
+The [YANG model][1] describes the current level of support, complete
+enough to run both system and application containers.

-Networking in containers is provided by both Infix and the Container
-Network Interface ([CNI](https://www.cni.dev/)) that Podman supports.
+Key design features, like using Linux switchdev, allow users to assign
+switch ports directly to containers, not just bridged VETH pairs, this
+is a rare and in many cases *unique* feature of Infix.

-> A convenience alias `docker=podman` is available in Infix, remember,
-> not all features or syntax of docker is available in podman.
+All network specific settings are done using the IETF interfaces YANG
+model, with augments for containers to ensure smooth integration with
+container networking in podman.
+
+> **Note:** even though the `podman` command can be used directly from a
+> shell prompt, we strongly recommend using the CLI commands instead.
+> They employ the services of a wrapper `container` script which handles
+> the integration of containers in the system.


-Docker Containers with Podman
-----------------------------
+Caution
+-------

-We assume you've booted into Infix and start with a familiar example.
-This downloads the `hello-world` example container image and runs it:
+A word of warning, containers can run on your system in privileged mode,
+as `root`.  This gives them full access to devices on your system.  But
+even when though unprivileged containers are fenced from the host with
+Linux namespaces, and resource limited using Linux cgroups, which scope
+container applications from seeing and accessing the complete system,
+there is no guarantee that an application cannot ever break out of this
+confinement.

-    podman run -it --rm docker://hello-world
+ - If the system is compromised, containers can be used to easily
+   install malicious software in your system and over the network
+ - Your system is as secure as anything you run in the container
+ - If you run containers, there is no security guarantee of any kind
+ - Running 3rd party container images on your system could open a
+   security hole/attack vector/attack surface
+ - An expert with knowledge how to build exploits will be able to
+   jailbreak/elevate to root even if best practices are followed

-We can also set up a port forward to a little web server:
+This being said, a system suspected of being compromised can always be
+restored to a safe state with a factory reset.  Provided, of course,
+that it has secure boot enabled.

-    podman run -d --rm -p 80:80 docker://nginx:alpine

-In detached (`-d`) state you can check the status using `podman ps` and
-try to connect to the web server:
+Getting Started
+---------------

-    curl http://localhost
+In the CLI, containers can be run in one of two ways:
+
+ 1. `container run IMAGE [COMMAND]`, and
+ 2. enter `configure` context, then `edit container NAME`
+
+The first is useful mostly for testing, or running single commands in an
+image.  It is a wrapper for `podman run -it --rm ...`, while the latter
+is a wrapper and adaptation of `podman create ...`.
+
+The second create a container with a semi-persistent writable layer that
+survives container restarts and host system restarts.  However, if you
+change the container configuration or upgrade the image (see below), the
+container will be recreated and the writable layer is lost.  This is why
+it is recommended to set up a named volume for directories, or use file
+[Content Mounts][], in your container you want truly persistent content.
+
+In fact, in many cases the best way is to create a `read-only` container
+and use file mounts and volumes only for the critical parts.  Podman
+ensures (using tmpfs) `read-only` containers still have writable
+directories for certain critical file system paths: `/dev`, `/dev/shm`,
+`/run`, `/tmp`, and `/var/tmp`.  Meaning, what you most often need is
+writable volumes for `/var/lib` and `/etc`, or only file mounts for a
+few files in `/etc`.  The actual needs depend on the container image and
+application to run.
+
+> **Note:** when running containers from public registries, double-check
+> that they support the CPU architecture of your host system.  Remember,
+> unlike virtualization, containers reuse the host's CPU and kernel.
+
+
+### Examples
+
+Classic Hello World:
+
+    admin@example-c0-ff-ee:/> container run docker://hello-world
+
+Persistent web server using nginx, sharing the host's network:
+
+    admin@example-c0-ff-ee:/> configure
+    admin@example-c0-ff-ee:/config> edit container web
+    admin@example-c0-ff-ee:/config/container/web> set image docker://nginx:alpine
+    admin@example-c0-ff-ee:/config/container/web> set publish 80:80
+    admin@example-c0-ff-ee:/config/container/web> set network host
+    admin@example-c0-ff-ee:/config/container/web> leave
+    admin@example-c0-ff-ee:/> show container
+
+Exit to the shell and verify the service with curl, or try to attach
+to your device's IP address using your browser:
+
+    admin@example-c0-ff-ee:~$ curl http://localhost

 or connect to port 80 of your running Infix system with a browser.  See
-the following sections for how to add more interfaces and start/stop the
-container at boot/reboot.
-
-> To add your own content to web server, place the HTML files in, e.g.,
-> `/cfg/www/*.html` and add `-v /cfg/www:/usr/share/nginx/html:ro` to
-> the command line (above).  <https://hub.docker.com/_/nginx/>
+the following sections for how to add more interfaces and manage your
+container at runtime.


-### Multiple Networks
+Networking and Containers
+-------------------------

-It is also possible to start a container with multiple networks.  The
-approach shown here uses CNI profiles, which means the interfaces names
-inside the container will always be: `eth0`, `eth1`, etc.
+By default, unlike other systems, persistent[^1] containers have no
+networking enabled.  All network access has to be set up explicitly.
+Currently two types of of container networks are supported:

-A common setup is to use a VETH pair, with one end in the container and
-the other end routed, or bridged, to the rest of the world.  The Infix
-[CLI Guide](cli/introduction.md) provides examples of both.  In either case you need
-to create a matching CNI profile for one end of the VETH pair before
-starting the container, here we use two network profiles, the default
-podman bridge and the VETH profile:
+ - `cni-host`: one end of a VETH pair, or a physical Ethernet port
+ - `cni-bridge`: an IP masquerading bridge

-     cni create host net1 veth0a 192.168.0.42/24
-     podman run -d --rm --net=podman,net1 --entrypoint "/linuxrc" \
-             --privileged docker://troglobit/buildroot:latest

-The first profile (`podman`) is a the default bridged profile.  When a
-container is started with that (default behavior), podman dynamically
-creates a VETH pair which has one end attached as a bridge port in the
-`cni-podman0` bridge managed by podman, and the other end is brought up
-as `eth0` inside the container.
+### CNI Bridge

-The second profile is the one we created, it uses the `host-device`
-profile and does not create anything, it simply lifts the peer end of
-the pair into the container as `eth1`.  This CNI profile can also be
-used to hand over control of physical ports to a container.
+All interface configuration is done in configure context.  Let's start
+by creating an IP masquerading bridge, a common default for containers:

-> **Note:** here we start the container in `--privileged` mode.  This
-> allows the container guest unfiltered access to the host system and it
-> might not be what you want for a production system.  For that at least
-> SECCOMP is recommended, which is out of scope for this tutorial.
+    admin@example-c0-ff-ee:/> configure
+    admin@example-c0-ff-ee:/config> edit interface docker0
+    admin@example-c0-ff-ee:/config/interface/docker0/> set type bridge
+    admin@example-c0-ff-ee:/config/interface/docker0/> set container-network type cni-bridge
+    admin@example-c0-ff-ee:/config/interface/docker0/> leave

-### Real Example
+We have to declare the interface type, and then also declare it as a
+container network, ensuring the interface cannot be used by the system
+for any other purpose.  E.g., a `cni-host` interface is supposed to be
+used by a container, by declaring it as such we can guarantee that it
+would never accidentally be added as a bridge or lag port.  Hence, to
+move an interface currently set as a `bridge-port` it must be removed
+from the bridge before being given to a container.

-To be able to preserve state in containers between reboots we need a
-writable layer, this is done with `podman create`, after which we can
-use `podman start`.   We build on the previous example:
+The default subnet for a `cni-bridge` is 172.17.0.0/16, the bridge will
+take the `.1` address and hand out the rest of the range to containers
+in a round-robin like fashion.  A container with this `network` get an
+automatically created VETH pair connection to the bridge and a lot of
+other networking parameters (DNS, default route) are set up.

-    cni create host net1 veth0a 192.168.0.42/24
-    podman create --name system --conmon-pidfile=/run/pod:system.pid \
-           --restart=no --systemd=false --tz=local --privileged      \
-           --net=podman,net1 --entrypoint "/linuxrc" -p 222:22       \
-           docker://troglobit/buildroot:latest
+Some of the defaults of a `cni-bridge` can be changed, e.g., instead of
+`set container-network type cni-bridge`, above, do:

-Here we map the host port 222 to the SSH port of the container, but one
-can just as easily map the host's port 22 (SSH).  Just make sure to
-first disable the host's SSH service.
+    admin@example-c0-ff-ee:/config/interface/docker0/> edit container-network
+    admin@example-c0-ff-ee:/config/interface/docker0/container-network/> set type cni-bridge
+    admin@example-c0-ff-ee:/config/interface/docker0/container-network/> edit subnet 192.168.0.0/16
+    admin@example-c0-ff-ee:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> set gateway 192.168.255.254
+    admin@example-c0-ff-ee:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> end
+    admin@example-c0-ff-ee:/config/interface/docker0/container-network/> edit route 10.0.10.0/24
+	admin@example-c0-ff-ee:/config/interface/docker0/container-network/route/10.0.10.0/24/> set gateway 192.168.10.254
+	admin@example-c0-ff-ee:/config/interface/docker0/container-network/route/10.0.10.0/24/> end
+	admin@example-c0-ff-ee:/config/interface/docker0/container-network/> end
+    admin@example-c0-ff-ee:/config/interface/docker0/> leave

-> **Note:** the new options used here are required for enabling
-> monitoring and automate start/stop of containers at boot/reboot.
+Other network settings, like DNS and domain, use built-in defaults in
+CNI, but can be overridden from each container.  Other common settings
+per container is the IP address and name of the network interface inside
+the container.  The default, after each stop/start cycle, or reboot of
+the host, is to name the interfaces `eth0`, `eth1`, in the order they
+are given in the `network` list, and to give the container the next
+address in a `cni-bridge`.  Below an example of a system container calls
+`set network interface docker0`, here we show how to set options for
+that network:

-This creates the named container `system` which we can now start:
-
-    podman start system
-
-and stop:
-
-    podman stop system
-
-For this particular image[^1] we need to modify its defaults a bit,
-because it is set up to run a DHCP client on the first Ethernet
-interface, which in our case is the `podman` default CNI bridge.  In
-fact, we don't want the container to set up any networking since that is
-handled by Infix and podman.
-
-    root@infix-12-34-56:~$ podman start system
-    root@infix-12-34-56:~$ podman exec -it system sh
-    / # rm -rf /etc/network/interfaces
-    / # exit
-    root@infix-12-34-56:~$ podman stop system
-
-The change is now saved in the writable layer and the next time the
-container is started it will look like this:
-
-    root@infix-12-34-56:~$ podman start system
-    root@infix-12-34-56:~$ podman exec -it system sh
-    / # ifconfig
-    eth0      Link encap:Ethernet  HWaddr A2:32:4C:2B:5E:51
-              inet addr:10.88.0.11  Bcast:10.88.255.255  Mask:255.255.0.0
-              inet6 addr: fe80::a032:4cff:fe2b:5e51/64 Scope:Link
-              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
-              RX packets:204 errors:0 dropped:107 overruns:0 frame:0
-              TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
-              collisions:0 txqueuelen:0
-              RX bytes:48240 (47.1 KiB)  TX bytes:1102 (1.0 KiB)
+    admin@example-c0-ff-ee:/config/container/ntpd/> edit network docker0 
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> 
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> set option 
+    <string>  Options for CNI bridges.
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> help option 
+    NAME
+            option <string>
    
-    eth1      Link encap:Ethernet  HWaddr 56:B5:4E:D1:9C:E5
-              inet addr:192.168.0.42  Bcast:192.168.0.255  Mask:255.255.255.0
-              inet6 addr: fe80::54b5:4eff:fed1:9ce5/64 Scope:Link
-              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
-              RX packets:274 errors:0 dropped:213 overruns:0 frame:0
-              TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
-              collisions:0 txqueuelen:1000
-              RX bytes:60926 (59.4 KiB)  TX bytes:1377 (1.3 KiB)
-
-Automating start/stop at boot/reboot is documented in the next section.
-
-[^1]: A common task one has to do for many other standard images, e.g.,
-    Alpine Linux and BusyBox available on Docker Hub.
-
-### Hybrid Mode
-
-Since container setup and configuration is not modeled in YANG yet, we
-use the Infix *Hybrid mode*, described in [Infix Variants](variant.md).
-
-To start containers in *Hybrid Mode*, provided the images have been
-downloaded with `podman pull docker://troglobit/buildroot:latest` and
-a container created (above):
-
-```
-root@infix:/cfg/start.d$ cat <<EOF >20-enable-container.sh
-#!/bin/sh
-# Remember to create the veth0a <--> vet0b pair in the CLI first!
-cni create host net1 veth0a 192.168.0.42/24
-cat <<EOF > /etc/finit.d/available/pod:system.conf
-service name:pod :system pid:!/run/pod:system.pid podman --syslog start system -- System container
-EOF
-initctl enable pod:system
-exit 0
-root@infix:/cfg/start.d$ chmod +x 20-enable-container.sh
-```
-
-Reboot to activate the changes.  To activate the changes without
-rebooting, run the script and call `initctl reload`.
-
-> **Note:** the `/etc` directory is a `tmpfs` ramdisk and contents will
-> be lost on reboot, so to retain custom CNI profiles after reboot you
-> need to either save them and restore in the script above, or recreate
-> them on every boot.
+    DESCRIPTION
+            Options for CNI bridges.
+            Example: ip=1.2.3.4 to request a specific IP, both IPv4 and IPv6.
+            interface_name=foo0 name to set interface name inside container.
+    
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> set option ip=172.17.0.2
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> set option interface_name=wan
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> leave


-Enabling Container Support
--------------------------
+### CNI Host

-Container support is not enabled by default because it is not a common
-customer feature, it also prolongs build times a lot due to bringing in
-a build-time dependency on Go.
+Another common use-case is to move a network interface into the network
+namespace of a container.  Which the CNI bridge network does behind the
+scenes with one end of the automatically created VETH pair.  This works
+with regular Ethernet interfaces as well, but here we will use a VETH
+pair as an example along with a regular bridge (where other Ethernet
+interfaces may live as well).

-However, customer specific builds may have it, and you can also roll
-your own based on any of the available `defconfigs`.  For example:
+    admin@example-c0-ff-ee:/config/> edit interface veth0
+    admin@example-c0-ff-ee:/config/interface/veth0/> set veth peer ntpd
+    admin@example-c0-ff-ee:/config/interface/veth0/> set ipv4 address 192.168.0.1 prefix-length 24
+    admin@example-c0-ff-ee:/config/interface/veth0/> end
+    admin@example-c0-ff-ee:/config/> edit interface ntpd
+    admin@example-c0-ff-ee:/config/interface/ntpd/> set ipv4 address 192.168.0.2 prefix-length 24
+    admin@example-c0-ff-ee:/config/interface/ntpd/> set container-network

-    cd infix/
-    make x86_64_defconfig
-
-Run menuconfig, search for `podman` using `/`, enable it and build:
-
-	make menuconfig
-	...
-	make
-
-Enabling [podman][] select `crun`, `conmon`, and all other dependencies.
-The build will take a while, but eventually you can:
-
-    make run
+This is a routed setup, where we reserve 192.168.0.0/24 for the network
+between the host and the `ntpd` container.  A perhaps more common case
+is to put `veth0` as a port in a bridge with other physical ports.  The
+point of the routed case is that port forwarding from the container in
+this case is limited to a single interface, not *all interfaces* as is
+the default in the CNI Bridge setup.


-Debugging Containers
--------------------
+### Host Networking

-If the host system is not powered down or rebooted properly, containers
-may not start up as they should on the following boot.  Below is a very
-common problem and solution shown.
+The third use-case is host networking, this is where a container share
+the network namespace of the host.  An example here could be a nftables
+or ntpd container -- single applications which add core functionality to
+the host operating system.

-```
-root@infix-12-34-56:~$ podman ps
-CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
-root@infix-12-34-56:~$ grep nginx /var/log/syslog
-Jun 25 10:15:48 infix-12-34-56 finit[1]: Service pod:nginx[2376] died, restarting in 5000 msec (10/10)
-Jun 25 10:15:48 infix-12-34-56 finit[1]: Starting pod:nginx[2408]
-Jun 25 10:15:53 infix-12-34-56 finit[1]: Service pod:nginx keeps crashing, not restarting.
-```
+The host networking setup cannot be combined with any other network.

-If this the system is isolated from remote network access, start by
-verifying the image is downloaded:
-
-```
-root@infix-12-34-56:/cfg/start.d$ podman images
-REPOSITORY                     TAG         IMAGE ID      CREATED      SIZE
-docker.io/library/nginx        alpine      4937520ae206  10 days ago  43.2 MB
-docker.io/troglobit/buildroot  latest      68faf6b20f1a  6 weeks ago  41.4 MB
-```
-
-OK, let's see what the `podman-service` step (above) created:
-
-```
-root@infix-12-34-56:/cfg/start.d$ initctl show pod-nginx.conf
-service name:pod :nginx podman run --name nginx --rm  -p 80:80 nginx:alpine   -- Nginx container
-```
-
-Try starting the container manually.  Remember to add the `-d` flag to
-emulate detached/background operation:
-
-```
-root@infix-12-34-56:/cfg/start.d$ podman run --name nginx --rm -d -p 8080:80 nginx:alpine
-Error: creating container storage: the container name "nginx" is already in use by 9c73bd8d505b1585d241595bfadede361b87f6c1be9a5656253b5a4d73da57e0. You have to remove that container to be able to reuse that name: that name is already in use
-```
-
-Aha, a lingering image with the same name!  Where is it?
-
-```
-root@infix-12-34-56:/cfg/start.d$ podman ps --all
-CONTAINER ID  IMAGE                                 COMMAND               CREATED            STATUS                        PORTS               NAMES
-f3386ae9517f  docker.io/troglobit/buildroot:latest                        About an hour ago  Exited (0) About an hour ago                      ecstatic_panini
-bf0c6178ea26  docker.io/troglobit/buildroot:latest                        About an hour ago  Exited (0) About an hour ago                      determined_brown
-385155f479c0  docker.io/troglobit/buildroot:latest                        About an hour ago  Exited (0) About an hour ago                      vibrant_engelbart
-99a1b3319d9e  docker.io/troglobit/buildroot:latest                        About an hour ago  Exited (0) About an hour ago                      dreamy_tesla
-9c73bd8d505b  docker.io/library/nginx:alpine        nginx -g daemon o...  11 minutes ago     Created                       0.0.0.0:80->80/tcp  nginx
-8a5290504ebc  docker.io/troglobit/buildroot:latest                        10 minutes ago     Created                                           mystifying_liskov
-```
-
-Oh, we have two lingering containers that were created but did not stop
-correctly.  Let's remove them:
-
-```
-root@infix-12-34-56:/cfg/start.d$ docker rm -f 9c73bd8d505b
-9c73bd8d505b
-root@infix-12-34-56:/cfg/start.d$ docker rm -f 8a5290504ebc
-8a5290504ebc
-```
-
-Now we can manually restart the (supervised) container:
-
-```
-root@infix-12-34-56:/cfg/start.d$ initctl restart pod:nginx
-root@infix-12-34-56:/cfg/start.d$ initctl status pod:nginx
-     Status : running
-   Identity : pod:nginx
-Description : Nginx container
-     Origin : /etc/finit.d/enabled/pod-nginx.conf
-    Command : podman run --name nginx --rm -p 80:80 nginx:alpine
-   PID file : none
-        PID : 2669
-       User : root
-      Group : root
-     Uptime : 15 sec
-   Restarts : 11 (0/10)
-  Runlevels : [---234-----]
-     Memory : 63.8M
-     CGroup : /system/pod-nginx cpu 0 [100, max] mem [0, max]
-              ├─ 2669 podman run --name nginx --rm -p 80:80 nginx:alpine
-              └─ 2816 conmon --api-version 1 -c 44d24aa7e98b67ff811596984462b902af3b09a04b4f9bef86e11d246b8cc2ff -u 44d24aa7e98b67ff8
-
-Jun 25 10:15:48 infix-12-34-56 finit[1]: Service pod:nginx[2376] died, restarting in 5000 msec (10/10)
-Jun 25 10:15:48 infix-12-34-56 finit[1]: Starting pod:nginx[2408]
-Jun 25 10:15:53 infix-12-34-56 finit[1]: Service pod:nginx keeps crashing, not restarting.
-Jun 25 10:47:55 infix-12-34-56 finit[1]: Starting pod:nginx[2669]
-```
+For an example, see below.


+Mounts and Volumes
+------------------
+
+It is possible to mount files, directories, and even files matching a
+glob, into a container.  This gives precise control over the container's
+file system:
+
+    admin@example-c0-ff-ee:/config/container/system/> edit mount leds
+    admin@example-c0-ff-ee:/config/container/system/mount/leds> set source /sys/class/leds
+    admin@example-c0-ff-ee:/config/container/system/mount/leds> set target /sys/class/leds
+    admin@example-c0-ff-ee:/config/container/system/mount/leds> end
+    admin@example-c0-ff-ee:/config/container/system/>
+
+Sometimes *volumes* are a better fit.  A volume is an automatically
+created read-writable entity that follows the life of your container.
+
+    admin@example-c0-ff-ee:/config/container/ntpd/> set volume varlib target /var/lib
+
+Volumes survive reboots and upgrading of the base image, unlike the
+persistent writable layer you get by default, which does not survive
+upgrades.  The volume is created by podman when the container first
+starts up, unlike a regular bind mount it synchronizes with the contents
+of the underlying container image's path on the first start.  I.e.,
+"bind-mount, if empty: then rsync".
+
+> Infix support named volumes (only), and it is not possible to share a
+> volume between containers.  All the tricks possible with volumes may
+> be added in a later release.
+
+### Content Mounts
+
+Content mount is a special type of where the file contents for the
+container is stored alongside the container configuration.  This can be
+very useful when deploying similar systems at multiple sites.  When the
+host loads its `startup-config` (or even `factory-config`) a temporary
+file is created using the decoded base64 data from the `content` node.
+
+    admin@example-c0-ff-ee:/config/container/ntpd/> edit mount ntpd.conf
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntpd.conf> set content
+    ... interactive editor starts up ...
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntpd.conf> set target /etc/ntpd.conf
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntpd.conf> end
+    admin@example-c0-ff-ee:/config/container/ntpd/>
+
+The editor is a small [Emacs clone called Mg][2], see the built-in help
+text, or press Ctrl-x Ctrl-c to exit and save.  When the editor exits
+the contents are base64 encoded and stored in the candidate datastore.
+
+> **Note:** since these files are always recreated when the host is
+> restarted, changes made by the container are not preserved, or saved
+> back to the host's startup-config even if the read-only option is off.
+
+
+Example Containers
+------------------
+
+### System Container
+
+Let's try out what we've learned by setting up a system container, a
+container providing multiple services, using the `docker0` interface
+we created previously:
+
+    admin@example-c0-ff-ee:/> configure
+    admin@example-c0-ff-ee:/config> edit container system
+    admin@example-c0-ff-ee:/config/container/system/> set image ghcr.io/kernelkit/curios:edge
+    admin@example-c0-ff-ee:/config/container/system/> set network interface docker0
+    admin@example-c0-ff-ee:/config/container/system/> set publish 222:22
+    admin@example-c0-ff-ee:/config/container/system/> leave
+
+> **Note:** ensure you have a network connection to the registry.
+> If the image cannot be pulled, creation of the container will be
+> put in a queue and be retried every time there is a change in the
+> routing table, e.g., default route is added.
+
+Provided the image is downloaded successfully, a new `system` container
+now runs behind the docker0 interface, forwarding container port 22 to
+port 222 on all of the host's interfaces.  (See `help publish` in the
+container configuration context for the full syntax.)
+
+Available containers can be accessed from admin-exec:
+
+    admin@example-c0-ff-ee:/> show container
+    CONTAINER ID  IMAGE                          COMMAND     CREATED       STATUS       PORTS                 NAMES
+    439af2917b44  ghcr.io/kernelkit/curios:edge              41 hours ago  Up 16 hours  0.0.0.0:222->222/tcp  system
+
+This is a system container, so you can "attach" to it by starting a
+shell (or logging in with SSH):
+
+    admin@example-c0-ff-ee:/> container shell system
+    root@439af2917b44:/#
+
+Notice how the hostname inside the container changes.  By default the
+container ID (hash) is used, but this can be easily changed:
+
+    root@439af2917b44:/# exit
+    admin@infix-00-00-00:/> configure
+    admin@infix-00-00-00:/config/> edit container system
+    admin@infix-00-00-00:/config/container/system/> set hostname sys101
+    admin@infix-00-00-00:/config/container/system/> leave
+    admin@infix-00-00-00:/> container shell system
+    root@sys101:/#
+
+[^1]: this does not apply to the admin-exec command `container run`.
+    This command is intended to be used for testing and evaluating
+	container images.  Such containers are given a private network
+	behind an IP masquerading bridge.
+
+
+### Application Container: nftables
+
+Infix currently does not have a native firewall configuration, and even
+when it does it will never expose the full capabilities of `nftables`.
+For really advanced setups, the following will be the only alternative:
+
+    admin@example-c0-ff-ee:/> configure
+    admin@example-c0-ff-ee:/config> edit container nftables
+    admin@example-c0-ff-ee:/config/container/system/> set image ghcr.io/kernelkit/curios-nftables:edge
+    admin@example-c0-ff-ee:/config/container/system/> set network host
+    admin@example-c0-ff-ee:/config/container/system/> edit mount nftables.conf
+    admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> set target /etc/nftables.conf
+    admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> set content
+    ... interactive editor starts up where you can paste your rules ...
+    admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> leave
+
+
+### Application Container: ntpd
+
+The default NTP server/client in Infix is Chrony, a fully working and
+capable workhorse for most use-cases.  However, it does not support a
+feature like multicasting, for that you need ISC ntpd.
+
+As we did with `nftables`, previously, we can use host networking and
+set up a read-only config file that is bind-mounted into the container's
+file system and store in the host's `startup-config`.  However, `ntpd`
+also saves clock drift information in `/var/lib/ntpd`, so we will also
+use volumes in this example.
+
+    admin@example-c0-ff-ee:/> configure
+    admin@example-c0-ff-ee:/config> edit container ntpd
+    admin@example-c0-ff-ee:/config/container/ntpd/> set image ghcr.io/kernelkit/curios-ntpd:edge
+    admin@example-c0-ff-ee:/config/container/ntpd/> set network interface ntpd    # From veth0 above
+    admin@example-c0-ff-ee:/config/container/ntpd/> edit mount ntp.conf
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntp.conf/> set target /etc/ntp.conf
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntp.conf/> set content
+    ... interactive editor starts up where you can paste your rules ...
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntp.conf/> end
+    admin@example-c0-ff-ee:/config/container/ntpd/> edit volume varlib
+    admin@example-c0-ff-ee:/config/container/ntpd/volume/varlib/> set target /var/lib
+    admin@example-c0-ff-ee:/config/container/ntpd/volume/varlib/> leave
+    admin@example-c0-ff-ee:/> copy running-config startup-config
+
+The `ntp.conf` file is stored in the host's `startup-config` and any
+state data in the container's `/var/lib` is retained between reboots
+and across image upgrades.
+
+
+Upgrading a Container Image
+---------------------------
+
+All container configurations are locked to the image hash at the time of
+first download, not just ones that use an `:edge` or `:latest` tag.  An
+upgrade of containers using versioned images is more obvious -- update
+the configuration -- but the latter is a bit trickier.  Either remove
+the configuration and recreate it (leave/apply the changes between), or
+use the admin-exec level command:
+
+    admin@example-c0-ff-ee:/> container upgrade NAME
+
+Where `NAME` is the name of your container.  This command stops your
+container, does a `container pull IMAGE`, and then recreates the
+container with the new image.  Upgraded containers are not automatically
+restarted.
+
+    admin@example-c0-ff-ee:/> container start NAME
+
+> **Note:** the default writable layer is lost when upgrading the image
+> Use named volumes for directories with writable content you wish to
+> keep over an upgrade.
+
+
+[1]:      https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-containers%402023-12-14.yang
+[2]:      https://github.com/troglobit/mg
 [podman]: https://podman.io
@@ -1,6 +1,20 @@
 Developer's Guide
 =================

+Please note, by default the `root` account is disabled in Infix NETCONF
+builds.  Meaning, the only way to access the system is with the `admin`
+account, which is created based on credentials found in the VPD area --
+for Qemu devices this is emulated using `qemu_fw_cfg`.
+
+For developers this can be quite frustrating to be blocked from logging
+in to debug the system.  So we recommend enabling the `root` account in
+the Buildroot `make menuconfig` system.
+
+    make menuconfig
+         -> System configuration
+            -> [*]Enable root login with password
+
+
 Cloning
 -------

@@ -75,7 +89,7 @@ To see available defconfigs for supported targets, use:
 Development
 -----------

-When changing a package, locally kept sources, or when using `local.mk`,
+When changing a package, locally kept sources, or when using [`local.mk`](override-package.md),
 you only want to rebuild the parts you have modified:

    make foo-rebuild
@@ -0,0 +1,31 @@
+# YANG to Ethtool Mapping
+This column contains the mapping between YANG and Linux / Ethtool counters.
+
+```
+┌─────────────────────────────────┬──────────────────────────────────┐
+│ YANG                            │ Linux / Ethtool                  │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-frames                      │ FramesTransmittedOK              │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-multicast-frames            │ MulticastFramesXmittedOK         │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-broadcast-frames            │ BroadcastFramesXmittedOK         │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-total-frames                 │ FramesReceivedOK,                │
+│                                 │ FrameCheckSequenceErrors         │
+│                                 │ FramesLostDueToIntMACRcvError    │
+│                                 │ AlignmentErrors                  │
+│                                 │ etherStatsOversizePkts           │
+│                                 │ etherStatsJabbers                │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-frames                       │ FramesReceivedOK                 │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-multicast-frames             │ MulticastFramesReceivedOK        │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-broadcast-frames             │ BroadcastFramesReceivedOK        │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-error-undersize-frames       │ undersize_pkts                   │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-error-fcs-frames             │ FrameCheckSequenceErrors         │
+└─────────────────────────────────┴──────────────────────────────────┘
+```
--- a/Show More
+++ b/Show More