Merge pull request #1395 from kernelkit/run-fix

Fix extration of rootfs.squashfs in release tarball

.github/workflows/build-image.yml

@@ -12,10 +12,6 @@ on:
           - bananapi-bpi-r3
           - friendlyarm-nanopi-r2s
         default: 'raspberrypi-rpi64'
-      use_latest_release:
-        description: 'Use latest release artifacts instead of workflow artifacts'
-        type: boolean
-        default: false
 
 jobs:
   create-image:
@@ -54,19 +50,19 @@ jobs:
         run: |
           case "${{ inputs.board }}" in
             raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
             bananapi-bpi-r3)
-              echo "BOOTLOADER_SD=bpi_r3_sd_boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi_r3_emmc_boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER_SD=bpi-r3-sd-boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi-r3-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=true" >> $GITHUB_ENV
               ;;
             friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
             *)
@@ -74,7 +70,7 @@ jobs:
               exit 1
               ;;
           esac
-          echo "Target: $TARGET for board: ${{ inputs.board }}"
+          echo "Arch: $ARCH for board: ${{ inputs.board }}"
           if [ "$BUILD_EMMC" = "true" ]; then
             echo "Building both SD and eMMC images"
             echo "SD Bootloader: $BOOTLOADER_SD"
@@ -85,16 +81,12 @@ jobs:
           fi
 
       - name: Download bootloader artifacts
-        if: ${{ !inputs.use_latest_release }}
         run: |
-          # Download from latest bootloader build workflow on main branch
-          gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
-          BOOT_RUN_ID=$(cat latest_boot_run_id)
-
+          # Download bootloader from latest-boot release tag
           if [ "$BUILD_EMMC" = "true" ]; then
             # Download both SD and eMMC bootloaders for boards that support both
             echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
-            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_SD} --dir temp_bootloader_sd/
+            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
             mkdir -p output_sd/images
             cd temp_bootloader_sd/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -102,7 +94,7 @@ jobs:
             rm -rf temp_bootloader_sd/
 
             echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
-            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_EMMC} --dir temp_bootloader_emmc/
+            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
             mkdir -p output_emmc/images
             cd temp_bootloader_emmc/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
@@ -115,7 +107,7 @@ jobs:
             ls -la output_emmc/images/
           else
             # Single bootloader for boards that only support SD
-            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
+            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
 
             # Extract bootloader directly to output/images
             cd temp_bootloader/
@@ -130,7 +122,6 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download Infix artifacts
-        if: ${{ !inputs.use_latest_release }}
         run: |
           # Download from latest Kernelkit Trigger workflow for main branch
           gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
@@ -138,7 +129,7 @@ jobs:
 
           if [ "$BUILD_EMMC" = "true" ]; then
             # Copy Infix artifacts to both SD and eMMC output directories
-            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
 
             cd temp_infix/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -152,7 +143,7 @@ jobs:
             ls -la output_emmc/images/
           else
             # Single output directory for SD-only boards
-            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
 
             # Extract Infix directly to output/images
             cd temp_infix/
@@ -166,58 +157,6 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Download from latest releases
-        if: ${{ inputs.use_latest_release }}
-        run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            # Download both SD and eMMC bootloaders
-            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
-            mkdir -p output_sd/images
-            cd temp_bootloader_sd/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-            cd ../
-            rm -rf temp_bootloader_sd/
-
-            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
-            mkdir -p output_emmc/images
-            cd temp_bootloader_emmc/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-            cd ../
-            rm -rf temp_bootloader_emmc/
-
-            # Download Infix once and extract to both directories
-            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
-            cd temp_infix/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-            cd ../
-            rm -rf temp_infix/
-
-            echo "SD files extracted to output_sd/images:"
-            ls -la output_sd/images/
-            echo "eMMC files extracted to output_emmc/images:"
-            ls -la output_emmc/images/
-          else
-            # Download latest bootloader release
-            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
-            cd temp_bootloader/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-            cd ../
-            rm -rf temp_bootloader/
-
-            # Download latest Infix release
-            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
-            cd temp_infix/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-            cd ../
-            rm -rf temp_infix/
-
-            echo "All files extracted to output/images:"
-            ls -la output/images/
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Verify extracted files
         run: |
           if [ "$BUILD_EMMC" = "true" ]; then
@@ -249,7 +188,7 @@ jobs:
             export BR2_EXTERNAL_INFIX_PATH=$PWD
             export RELEASE=""
             export INFIX_ID="infix"
-            ./utils/mkimage.sh ${{ inputs.board }}
+            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
           fi
 
       - name: Create eMMC image
@@ -347,10 +286,11 @@ jobs:
           # SD Card & eMMC Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
-          **Target:** ${{ env.TARGET }}
+          **Arch:** ${{ env.ARCH }}
           **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
           **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
-          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
+          **Bootloader Source:** latest-boot release
+          **Infix Source:** Latest workflow run on main
 
           ## Created Images
           $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
@@ -363,9 +303,10 @@ jobs:
           # SD Card Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
-          **Target:** ${{ env.TARGET }}
+          **Arch:** ${{ env.ARCH }}
           **Bootloader:** ${{ env.BOOTLOADER }}
-          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
+          **Bootloader Source:** latest-boot release
+          **Infix Source:** Latest workflow run on main
 
           ## Created Images
           $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")

.github/workflows/check-kernel-release.yml

@@ -1,4 +1,4 @@
-name: Check Kernel 6.12 Release
+name: Check Kernel 6.18 Release
 
 on:
   schedule:
@@ -17,12 +17,12 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
 
-      - name: Fetch kernel.org and check for 6.12 release
+      - name: Fetch kernel.org and check for 6.18 release
         id: check
         run: |
           set -e -o pipefail
-          # Fetch the kernel.org frontpage and extract 6.12 version
-          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)
+          # Fetch the kernel.org frontpage and extract 6.18 version
+          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.18\.\d+' | head -n1)
 
           if [ -z "$CURRENT_VERSION" ]; then
             echo "Failed to fetch kernel version"
@@ -30,7 +30,7 @@ jobs:
           fi
 
           echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          echo "Current 6.12 kernel version: $CURRENT_VERSION"
+          echo "Current 6.18 kernel version: $CURRENT_VERSION"
 
           # Get the version from infix defconfig
           INFIX_VERSION=$(grep 'BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=' configs/aarch64_defconfig | cut -d'"' -f2)
@@ -47,7 +47,7 @@ jobs:
               echo "PR already exists for kernel $CURRENT_VERSION, skipping"
             else
               echo "new_release=true" >> $GITHUB_OUTPUT
-              echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
+              echo "🎉 New 6.18 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
             fi
           else
             echo "new_release=false" >> $GITHUB_OUTPUT
@@ -99,7 +99,7 @@ jobs:
           BRANCH_NAME: ${{ steps.branch.outputs.name }}
         run: |
           set -e -o pipefail
-          ./utils/kernel-upgrade.sh linux "$BRANCH_NAME"
+          ./utils/kernel-upgrade.sh linux 6.18 "$BRANCH_NAME"
 
       - name: Create pull request
         if: steps.check.outputs.new_release == 'true'

.github/workflows/release.yml

@@ -104,11 +104,7 @@ jobs:
 
       - name: Extract ChangeLog entry ...
         run: |
-          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
-              |head -n -1 > release.md
-          echo "" >> release.md
-          echo "> [!TIP]" >> release.md
-          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
+          cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
           cat release.md
 
       - uses: ncipollo/release-action@v1

.gitignore

@@ -1,6 +1,7 @@
 *~
 .claude
 .gdb_history
+.claude
 /.backup
 /.ccache
 /dl
@@ -10,3 +11,4 @@
 /test/.log
 /local.mk
 /test/spec/Readme.adoc
+

README.md

@@ -16,10 +16,12 @@ if something goes wrong.  Deploy once, trust forever.
 
 **🤝 Friendly**  
 Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit `?` or TAB for
-context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
-[comprehensive documentation][4] mean you're never stuck.  Whether
-you're learning networking or managing enterprise infrastructure.
+with built-in help for every command — just hit <kbd>?</kbd> or
+<kbd>TAB</kbd> for context-aware assistance.
+
+Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
+mean you're never stuck.  Whether you're learning networking or managing
+enterprise infrastructure.
 
 **🛡️ Secure**  
 Built with security as a foundation, not an afterthought.  Minimal
@@ -53,27 +55,24 @@ your device, your rules.
    Consistent tooling from development to production deployment.  
    How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
 
-## See It In Action
+## Quick Example
 
 Configure an interface in seconds - the CLI guides you with built-in help:
 
-<details><summary><b>Click Here for an example CLI Session</b></summary>
-
-```bash
-admin@infix-12-34-56:/> configure
-admin@infix-12-34-56:/config/> edit interface eth0
-admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
-      address     autoconf bind-ni-name      enabled
-      forwarding  mtu      neighbor
-admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
-admin@infix-12-34-56:/config/interface/eth0/> show
+<pre><code>admin@infix-12-34-56:/> <b>configure</b>
+admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
+admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4</b> <kbd>TAB</kbd>
+      address     autoconf      bind-ni-name     dhcp 
+      enabled     forwarding    mtu              neighbor
+admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4 address 192.168.2.200 prefix-length 24</b>
+admin@infix-12-34-56:/config/interface/eth0/> <b>show</b>
 type ethernet;
 ipv4 {
   address 192.168.2.200 {
     prefix-length 24;
   }
 }
-admin@infix-12-34-56:/config/interface/eth0/> diff
+admin@infix-12-34-56:/config/interface/eth0/> <b>diff</b>
 interfaces {
   interface eth0 {
 +    ipv4 {
@@ -83,25 +82,23 @@ interfaces {
 +    }
   }
 }
-admin@infix-12-34-56:/config/interface/eth0/> leave
-admin@infix-12-34-56:/> show interfaces
-INTERFACE       PROTOCOL   STATE       DATA
+admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
+admin@infix-12-34-56:/> <b>show interfaces</b>
+<u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
 eth0            ethernet   UP          52:54:00:12:34:56
                 ipv4                   192.168.2.200/24 (static)
                 ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                 ipv4                   127.0.0.1/8 (static)
                 ipv6                   ::1/128 (static)
-admin@infix-12-34-56:/> copy running-config startup-config
-```
+admin@infix-12-34-56:/> <b>copy running startup</b>
+</code></pre>
 
-Notice how TAB completion shows available options, `show` displays
-current config, and `diff` shows exactly what changed before you
-commit your changes with the `leave` command.
+Notice how <kbd>TAB</kbd> completion shows available options, `show`
+displays current config, and `diff` shows exactly what changed before
+you commit your changes with the `leave` command.
 
-</details>
-
-> [Full CLI documentation →][3]
+For more information, see [CLI documentation][3].
 
 ## Get Started
 
@@ -111,7 +108,7 @@ containers for any custom functionality you need.
 
 ### Supported Platforms
 
-- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
+- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
 - **Banana Pi-R3** - Your next home router and gateway
 - **NanoPi R2S** - Compact dual-port router in a tiny package
 - **x86_64** - Run in VMs or on mini PCs for development and testing

board/Config.in

@@ -1,6 +1,6 @@
 menu "Board Support"
 
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/arm/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"

board/README.md

@@ -0,0 +1,18 @@
+Board Support
+=============
+
+The board support for an architecture always starts with Qemu support,
+this is what each `linux_defconfig` at the very least sets up.  Then
+each `$BR2_ARCH` has additional BSPs, e.g., Banana Pi BPI-R3.
+
+The `board/` directory is matched with the `configs/*_defconfigs` and
+the only execption is `board/common/`, which holds all shared files for
+Infix builds.
+
+Each `board/$BR2_ARCH/` can then have vendor/product sub-directories
+for the BSPs which may contain "fixups" to the base kernel config and
+any additional device tree files that should be included as well.
+
+To rebuild a board-specific package, e.g. NanoPi R2S:
+
+    make friendlyarm-nanopi-r2s-rebuild all

board/aarch32/Config.in

@@ -1,5 +0,0 @@
-if BR2_arm
-
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/raspberrypi-rpi2/Config.in"
-
-endif

board/aarch32/board.mk

@@ -1 +0,0 @@
-

board/aarch64/bananapi-bpi-r3/README.md

@@ -34,6 +34,10 @@ Infix comes preconfigured with:
 
 The easiest way to get started is using an SD card:
 
+> [!NOTE]
+> SD card boot works but we have observed stability issues. For production
+> use or long-term reliability, we recommend installing to eMMC (see below).
+
 1. **Download the SD card image:** [infix-bpi-r3-sdcard.img][2]
 2. **Flash the image to an SD card:** see [this guide][0]
 3. **Set boot switches:**
@@ -53,8 +57,8 @@ The BPI-R3 has a 4-position DIP switch that controls boot media:
 
 | Position | Mode        | Description                           |
 |----------|-------------|---------------------------------------|
-| 0000     | SD card     | Boot from microSD card (recommended)  |
-| 0110     | eMMC        | Boot from internal eMMC storage       |
+| 0000     | SD card     | Boot from microSD card                |
+| 0110     | eMMC        | Boot from internal eMMC (recommended) |
 | 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |
 
 > [!NOTE]
@@ -67,10 +71,16 @@ For production deployments or better performance, you can install Infix
 to the internal eMMC storage. This is more complex but provides faster
 boot times and eliminates the external SD card.
 
+> [!IMPORTANT]
+> While Infix boots on both SD card and eMMC, we have observed stability
+> issues with SD cards on this platform. **eMMC is recommended** for
+> reliable operation.
+
 ### Why Use eMMC?
 
 **Advantages:**
 
+- More reliable than SD card (stability issues observed with SD cards)
 - Faster boot and better performance
 - No external SD card to manage
 - More robust for industrial/embedded deployments

board/aarch64/bananapi-bpi-r3/bananapi-bpi-r3.mk

@@ -6,7 +6,7 @@ define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_GPIO,y)
 	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg

@@ -17,7 +17,25 @@
         "state": {
           "admin-state": "unlocked"
         }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+	  "band": "2.4GHz",
+	  "channel": "auto"
+	 }
+     },
+     {
+	"name": "radio1",
+	"class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+          "band": "5GHz",
+          "channel": "auto"
       }
+    }
     ]
   },
   "ietf-interfaces:interfaces": {
@@ -150,12 +168,36 @@
         }
       },
       {
-        "name": "wifi0",
-        "type": "infix-if-type:wifi"
+        "name": "wifi0-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+	"infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
       },
       {
-        "name": "wifi1",
-        "type": "infix-if-type:wifi"
+        "name": "wifi1-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio1",
+          "access-point": {
+            "ssid": "Infix5Ghz",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+       "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
       }
     ]
   },
@@ -171,10 +213,22 @@
           "certificates": {}
         }
       ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
     }
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -182,6 +236,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -201,6 +263,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -208,11 +301,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/product/interface-quirks.json

@@ -0,0 +1,11 @@
+{
+    "sfp1": {
+	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
+	"broken-autoneg": true
+    },
+    "sfp2": {
+	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
+	"broken-autoneg": true
+    }
+
+}

board/aarch64/friendlyarm-nanopi-r2s/Config.in

@@ -4,6 +4,7 @@ config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
 	select SDCARD_AUX
 	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
+	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	help
 	  FriendlyElec NanoPi R2S is a compact router board based on
 	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.

board/aarch64/friendlyarm-nanopi-r2s/friendlyarm-nanopi-r2s.mk

@@ -4,6 +4,9 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
+	# TODO: for some reason this just locks up the device
+	#       so we'll have to rely on the softdog :-(
+	# $(call KCONFIG_ENABLE_OPT,CONFIG_DW_WATCHDOG)
 
 	# PHY drivers
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
@@ -51,6 +54,10 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)
 
+	# Input layer
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MISC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
+
 	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg

@@ -126,6 +126,9 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -133,6 +136,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -152,6 +163,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -159,11 +201,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }

board/aarch64/linux_defconfig

@@ -39,7 +39,6 @@ CONFIG_ARM64_ERRATUM_1286807=y
 CONFIG_ARM64_ERRATUM_1542419=y
 CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
-CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
 CONFIG_COMPAT=y
 # CONFIG_SUSPEND is not set
@@ -52,7 +51,6 @@ CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_ARMADA_8K_CPUFREQ=y
 CONFIG_ACPI=y
 CONFIG_KPROBES=y
-CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -79,7 +77,6 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -95,12 +92,31 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -109,15 +125,23 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
+CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -134,29 +158,69 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_IPMAC=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -244,6 +308,7 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
+CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -411,7 +476,6 @@ CONFIG_ARM_SBSA_WATCHDOG=y
 CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_MAX77620=y
-CONFIG_MFD_SEC_CORE=y
 CONFIG_MFD_ROHM_BD718XX=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -420,7 +484,6 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_MAX77620=y
 CONFIG_REGULATOR_PCA9450=y
 CONFIG_REGULATOR_QCOM_SPMI=y
-CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_A4TECH is not set
 # CONFIG_HID_APPLE is not set
@@ -430,11 +493,11 @@ CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_CYPRESS is not set
 # CONFIG_HID_EZKEY is not set
 # CONFIG_HID_KENSINGTON is not set
-# CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
 CONFIG_USB_ULPI_BUS=y
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
@@ -452,7 +515,6 @@ CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
 CONFIG_USB_HSIC_USB3503=m
-CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_SNP_UDC_PLAT=y
@@ -486,7 +548,6 @@ CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
 CONFIG_RTC_DRV_PCF8523=y
-CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
 CONFIG_RTC_DRV_PL031=y
@@ -501,7 +562,6 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 # CONFIG_SURFACE_PLATFORMS is not set
 CONFIG_COMMON_CLK_CS2000_CP=y
-CONFIG_COMMON_CLK_S2MPS11=y
 CONFIG_COMMON_CLK_XGENE=y
 CONFIG_COMMON_CLK_BD718XX=y
 CONFIG_MAILBOX=y
@@ -518,7 +578,8 @@ CONFIG_PHY_SAMSUNG_USB2=y
 CONFIG_NVMEM_LAYOUT_ONIE_TLV=y
 CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -537,16 +598,17 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
-CONFIG_CRYPTO_SHA1_ARM64_CE=y
-CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
@@ -560,13 +622,11 @@ CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
 CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY=y
 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 CONFIG_WQ_WATCHDOG=y
 CONFIG_WQ_CPU_INTENSIVE_REPORT=y
 CONFIG_TEST_LOCKUP=m
-# CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
 # CONFIG_STRICT_DEVMEM is not set

board/aarch64/raspberrypi-rpi64/Config.in

@@ -5,7 +5,7 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
-
+	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
 	  of single-board computers (SBC), RPi 3B and later, including the

board/aarch64/raspberrypi-rpi64/README.md

@@ -107,8 +107,10 @@ To configure WiFi as a client, first store your WiFi password in the keystore:
 ```
 admin@infix:/> configure
 admin@infix:/config/> edit keystore symmetric-key mywifi
-admin@infix:/config/keystore/…/mywifi/> set key-format wifi-preshared-key-format
-admin@infix:/config/keystore/…/mywifi/> set cleartext-symmetric-key YourWiFiPassword
+admin@infix:/config/keystore/…/mywifi/> set key-format passphrase-key-format
+admin@infix:/config/keystore/…/mywifi/> change cleartext-symmetric-key
+Passphrase: ************
+Retype passphrase: ************
 admin@infix:/config/keystore/…/mywifi/> leave
 ```
 

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-compute-module/etc/product/init.d/S01-trigger-udev.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Workaround for: https://github.com/kernelkit/infix/issues/1357
+udevadm control --reload-rules
+udevadm trigger --subsystem-match=net --action=add

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg

@@ -10,6 +10,13 @@
         "state": {
           "admin-state": "unlocked"
         }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "00"
+        }
       }
     ]
   },
@@ -38,6 +45,7 @@
       {
         "name": "eth0",
         "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
@@ -72,7 +80,10 @@
       },
       {
         "name": "wifi0",
-        "type": "infix-if-type:wifi"
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0"
+        }
       }
     ]
   },
@@ -92,6 +103,9 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -99,6 +113,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -118,6 +140,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -125,11 +178,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/product/init.d/S01-trigger-udev.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Workaround for: https://github.com/kernelkit/infix/issues/1357
+udevadm control --reload-rules
+udevadm trigger --subsystem-match=net --action=add

board/aarch64/raspberrypi-rpi64/uboot/rpi-env.dtso

@@ -12,6 +12,15 @@
 			boot_targets = "mmc0";
 			ethprime = "eth0";
 
+			/* Memory layout for kernel boot:
+			 *   0x00200000: Kernel relocation address
+			 *   0x04000000: FDT (64MB, gives enough space for kernels up to ~60MB)
+			 *   0x10000000: Ramdisk (Memsize - 256MB)
+			 */
+			kernel_addr_r = "0x00200000";
+			fdt_addr_r = "0x04000000";
+			ramdisk_addr_r = "0x10000000";
+
 			stdout = "serial";
 			stderr = "serial";
 			stdin = "serial";

board/aarch64/rootfs/usr/sbin/wan-monitor.sh

@@ -20,6 +20,7 @@ cleanup()
 {
     rm -f "$LED_FILE"
     rm -f "$PID_FILE"
+    kill %% 2>/dev/null
     exit 0
 }
 
@@ -31,11 +32,13 @@ remaining_time=$((1800 - $(awk '{print int($1)}' /proc/uptime)))
 
 while [ "$remaining_time" -gt 0 ]; do
     check_wan
-    sleep 1
+    sleep 1 &
+    wait $!
     remaining_time=$((remaining_time - 1))
 done
 
 while :; do
     check_wan
-    sleep 5
+    sleep 5 &
+    wait $!
 done

board/arm/Config.in

@@ -0,0 +1,5 @@
+if BR2_arm
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/arm/raspberrypi-rpi2/Config.in"
+
+endif

board/arm/README.md

@@ -1,5 +1,5 @@
-aarch32
-=======
+Arm 32-bit
+==========
 
 Board Specific Documentation
 ----------------------------

board/arm/board.mk

@@ -0,0 +1 @@
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/arm/*/*.mk))

board/arm/linux_defconfig

@@ -31,14 +31,11 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
-CONFIG_KEXEC=y
 CONFIG_ARCH_MULTI_V6=y
-CONFIG_ARCH_MULTI_V7=y
 CONFIG_ARCH_VIRT=y
 CONFIG_ARCH_BCM=y
 CONFIG_ARCH_BCM2835=y
 CONFIG_SMP=y
-CONFIG_NR_CPUS=4
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
@@ -47,7 +44,6 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPUFREQ_DT=y
 CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
-CONFIG_AEABI=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -78,7 +74,6 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -94,12 +89,31 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -108,15 +122,22 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -133,29 +154,58 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_IPMAC=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_MATCH_SRH=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_RAW=m
-CONFIG_IP6_NF_NAT=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -194,16 +244,16 @@ CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_PKTGEN=y
-# CONFIG_WIRELESS is not set
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
-CONFIG_PCI_AARDVARK=y
 CONFIG_PCI_HOST_GENERIC=y
-CONFIG_PCIE_ARMADA_8K=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -221,7 +271,6 @@ CONFIG_BLK_DEV_NVME=y
 CONFIG_SRAM=y
 CONFIG_EEPROM_AT24=y
 # CONFIG_SCSI_PROC_FS is not set
-CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_SAS_LIBSAS=y
 CONFIG_SCSI_SAS_ATA=y
@@ -230,7 +279,6 @@ CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
-CONFIG_AHCI_MVEBU=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
@@ -258,8 +306,6 @@ CONFIG_SMSC911X=y
 CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
 CONFIG_USB_NET_SMSC95XX=y
-CONFIG_BRCMFMAC=m
-CONFIG_ZD1211RW=m
 CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
 CONFIG_INPUT_TOUCHSCREEN=y
@@ -273,22 +319,19 @@ CONFIG_SERIAL_8250_BCM2835AUX=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
-CONFIG_TTY_PRINTK=y
-CONFIG_HVC_DRIVER=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
 CONFIG_SPI_BCM2835=y
 CONFIG_SPI_BCM2835AUX=y
-CONFIG_GPIO_SYSFS=y
 CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
 CONFIG_BCM2711_THERMAL=y
 CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
-CONFIG_BCM2835_WDT=y
 CONFIG_I6300ESB_WDT=y
+CONFIG_BCM2835_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -296,12 +339,12 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
 CONFIG_DRM=y
 CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_SIMPLEDRM=y
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_TOSHIBA_TC358762=m
 CONFIG_DRM_V3D=m
 CONFIG_DRM_VC4=m
 CONFIG_DRM_VC4_HDMI_CEC=y
-CONFIG_DRM_SIMPLEDRM=y
 CONFIG_FB=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_SOUND=y
@@ -310,6 +353,7 @@ CONFIG_SND_SOC=y
 CONFIG_SND_BCM2835_SOC_I2S=y
 CONFIG_HID_GENERIC=m
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC2=y
@@ -343,7 +387,6 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_STAGING=y
 CONFIG_SND_BCM2835=m
-CONFIG_VIDEO_BCM2835=m
 CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
@@ -352,7 +395,8 @@ CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -371,13 +415,13 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
 CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_CCM=y
 CONFIG_CRYPTO_GCM=y
-# CONFIG_XZ_DEC_ARM is not set
-# CONFIG_XZ_DEC_ARMTHUMB is not set
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
@@ -389,14 +433,11 @@ CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
 CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY=y
 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 CONFIG_WQ_WATCHDOG=y
 CONFIG_WQ_CPU_INTENSIVE_REPORT=y
 CONFIG_TEST_LOCKUP=m
-# CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
-# CONFIG_STRICT_DEVMEM is not set
 CONFIG_MEMTEST=y

board/arm/raspberrypi-rpi2/Config.in

@@ -5,11 +5,10 @@ config BR2_PACKAGE_RASPBERRYPI_RPI2
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
-
 	help
 	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
 	  (SBC) with BCM2836 quad-core Cortex-A7 processor.
 
-	  This was the only Raspberry Pi model with the BCM2836 and the 2B
-	  actually got a BCM2837 (Cortex-A53) underclocked an w/o wifi in
-	  the v1.2 board revision.
+	  This was the only Raspberry Pi model with the BCM2836 and the rare
+	  RPi 2B board revision v1.2 actually got an underclocked BCM2837,
+	  which is the saem Cortex-A53 as the RPi3, but w/o wifi.

board/arm/raspberrypi-rpi2/README.md

@@ -21,9 +21,8 @@ The board features:
 How to Build
 ------------
 
-Since there are no pre-built images for ARM32, you need to build both Infix
-and the bootloader from source.
-
+Since there are no pre-built images for ARM 32-bit, you need to build both
+Infix and the bootloader from source.
 
 1. Clone the repository
 
@@ -37,12 +36,12 @@ and the bootloader from source.
 
 3. Build Infix (in another tree)
 
-        make O=x-arm32 aarch32_defconfig
-        make O=x-arm32
+        make O=x-arm arm_defconfig
+        make O=x-arm
 
 4. Create the SD card image
 
-        ./utils/mkimage.sh -b x-boot -r x-arm32 raspberrypi-rpi2
+        ./utils/mkimage.sh -b x-boot -r x-arm raspberrypi-rpi2
 
 The resulting image can be found in `x-boot/images/infix-arm-sdcard.img`
 

board/arm/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg

@@ -88,6 +88,9 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -95,6 +98,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -114,6 +125,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -121,11 +163,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }

board/common/busybox_defconfig

@@ -1016,12 +1016,7 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
-CONFIG_UDHCPC6_DEFAULT_SCRIPT="/usr/share/udhcpc/default6.script"
-CONFIG_UDHCPC6=y
-CONFIG_FEATURE_UDHCPC6_RFC3646=y
-CONFIG_FEATURE_UDHCPC6_RFC4704=y
-CONFIG_FEATURE_UDHCPC6_RFC4833=y
-CONFIG_FEATURE_UDHCPC6_RFC5970=y
+# CONFIG_UDHCPC6 is not set
 
 #
 # Common options for DHCP applets

board/common/qemu/Config.in.in

@@ -231,7 +231,7 @@ config QEMU_NET_MODEL
 	  if you want to play with low-level stuff like ethtool, you
 	  might want to test the Intel 82545EM driver, e1000.
 
-	  Note: ARM32 uses virtio-net-device (MMIO) by default.
+	  Note: ARM 32-bit uses virtio-net-device (MMIO) by default.
 
 config QEMU_NET_BRIDGE_DEV
 	string "Bridge device"

board/common/qemu/run.sh

@@ -19,6 +19,9 @@
 #
 # shellcheck disable=SC3037
 
+# Add /sbin to PATH for mkfs.ext4 and such (not default in debian)
+export PATH="/sbin:/usr/sbin:$PATH"
+
 qdir=$(dirname "$(readlink -f "$0")")
 imgdir=$(readlink -f "${qdir}/..")
 prognm=$(basename "$0")
@@ -80,7 +83,7 @@ loader_args()
 
 append_args()
 {
-    # ARM32 doesn't support virtio console properly, always use serial
+    # ARM 32-bit doesn't support virtio console properly, always use serial
     if [ "$CONFIG_QEMU_arm" ]; then
 	echo -n "console=ttyAMA0 "
     elif [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
@@ -119,7 +122,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
     elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	# ARM32 virt machine uses MMIO virtio devices, not PCI
+	# ARM 32-bit virt machine uses MMIO virtio devices, not PCI
 	if [ "$CONFIG_QEMU_arm" ]; then
 	    echo -n "-drive file=qemu.qcow2,if=none,format=qcow2,id=rootfs "
 	    echo -n "-device virtio-blk-device,drive=rootfs "
@@ -174,6 +177,8 @@ rw_args()
 {
     [ "$CONFIG_QEMU_RW" ] ||  return
 
+    command -v mkfs.ext4 >/dev/null || die "$prognm: cannot find mkfs.ext4"
+
     if ! [ -f "aux.ext4" ]; then
 	dd if=/dev/zero of="aux.ext4" bs=1M count=1 >/dev/null 2>&1
 	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
@@ -184,7 +189,7 @@ rw_args()
 	mkfs.ext4 -L cfg "$CONFIG_QEMU_RW" >/dev/null 2>&1
     fi
 
-    # ARM32 virt machine uses MMIO virtio devices, not PCI
+    # ARM 32-bit virt machine uses MMIO virtio devices, not PCI
     if [ "$CONFIG_QEMU_arm" ]; then
 	echo -n "-drive file=aux.ext4,if=none,format=raw,id=aux "
 	echo -n "-device virtio-blk-device,drive=aux "
@@ -353,13 +358,12 @@ extract_squashfs()
 run_qemu()
 {
     # Auto-extract rootfs.squashfs from rootfs.itb if needed for initrd mode
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
-	if [ "$CONFIG_QEMU_ROOTFS" = "rootfs.squashfs" ] && [ ! -f "rootfs.squashfs" ]; then
-	    if [ -f "rootfs.itb" ]; then
-		extract_squashfs "rootfs.itb" "rootfs.squashfs"
-	    else
-		die "Missing rootfs.squashfs and cannot find rootfs.itb to extract it from"
-	    fi
+    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ] && [ ! -f "$CONFIG_QEMU_ROOTFS" ]; then
+	itb="${CONFIG_QEMU_ROOTFS%.squashfs}.itb"
+	if [ -f "$itb" ]; then
+	    extract_squashfs "$itb" "$CONFIG_QEMU_ROOTFS"
+	else
+	    die "Missing $CONFIG_QEMU_ROOTFS and cannot find $itb to extract it from"
 	fi
     fi
 

board/common/rootfs/etc/bash.bashrc

@@ -40,11 +40,12 @@ log()
     less +G -r "$fn"
 }
 
-follow()
+follow ()
 {
     local fn="/var/log/syslog"
     [ -n "$1" ] && fn="/var/log/$1"
-    less +F -r "$fn"
+
+    tail -F -n +1 "$fn"
 }
 
 _logfile_completions()

board/common/rootfs/etc/default/zebra

@@ -1,2 +1,2 @@
 # --log-level debug
-ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog "
+ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog --log-level err"

board/common/rootfs/etc/finit.d/available/container@.conf

@@ -5,4 +5,5 @@
 # 'podman load', must not have a timeout.
 sysv    log:prio:local1,tag:%i kill:30 pid:!/run/container:%i.pid \
 	pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container   \
+	cgroup.system,delegate					  \
 	[2345] <!> :%i container -n %i -- container %i

board/common/rootfs/etc/finit.d/available/hostapd@.conf

@@ -0,0 +1,3 @@
+service <!> name:hostapd :%i \
+	[2345] hostapd -P/var/run/hostapd-%i.pid  /etc/hostapd-%i.conf \
+	-- Wi-Fi Access Point @%i

board/common/rootfs/etc/finit.d/available/restconf.conf

@@ -1,3 +1,3 @@
-service name:rousette notify:none log <pid/confd> env:/etc/default/confd \
+service name:rousette notify:none log:null <pid/confd> env:/etc/default/confd \
 	[12345] rousette --syslog -t $CONFD_TIMEOUT \
 	-- RESTCONF server

board/common/rootfs/etc/finit.d/available/wifi@.conf

@@ -1,5 +1,3 @@
 service name:wpa_supplicant :%i \
-			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
-			       -- WPA supplicant @%i
-
-task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i
+	[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+	-- Wi-Fi Station @%i

board/common/rootfs/etc/fstab

@@ -1,23 +1,15 @@
 # Virtual filesystems
-devtmpfs	/dev		devtmpfs	defaults		0	0
-mkdir#-p	/dev/pts	helper		none			0	0
-devpts		/dev/pts	devpts		mode=620,ptmxmode=0666	0	0
-mkdir#-p	/dev/shm	helper		none			0	0
-tmpfs		/dev/shm	tmpfs		mode=0777		0	0
-proc		/proc		proc		defaults		0	0
-tmpfs		/tmp		tmpfs		mode=1777,nosuid,nodev	0	0
-tmpfs		/run		tmpfs		mode=0755,nosuid,nodev	0	0
-tmpfs		/media		tmpfs		mode=1755,nosuid,nodev	0	0
-sysfs		/sys		sysfs		defaults		0	0
-debugfs	/sys/kernel/debug	debugfs		nofail			0	0
-cfgfs		/config		configfs	nofail,noauto		0	0
+tmpfs		/run		  tmpfs		mode=0755,nosuid,nodev	0	0
+tmpfs		/media		  tmpfs		mode=1755,nosuid,nodev	0	0
+debugfs		/sys/kernel/debug debugfs	nofail			0	0
+cfgfs		/config		  configfs	nofail,noauto		0	0
 
 # The chosen backing storage for the overlays placed on /cfg, /etc,
 # /home, /root, and /var, are determined dynamically by /usr/libexec/infix/mnt
 # depending on the available devices.
 mnttmp		/mnt/tmp	tmpfs	defaults					0	0
-LABEL=aux	/mnt/aux	auto	noatime,nodiratime,noauto,errors=remount-ro	0	0
-LABEL=var	/mnt/var	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
-LABEL=cfg	/mnt/cfg	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
+LABEL=aux	/mnt/aux	auto	noatime,nodiratime,noauto			0	0
+LABEL=var	/mnt/var	ext4	noatime,nodiratime,noauto			0	0
+LABEL=cfg	/mnt/cfg	ext4	noatime,nodiratime,noauto			0	0
 hostfs		/mnt/host	9p	cache=none,msize=16384,noauto			0	0
 /usr/libexec/infix/mnt#	/cfg	helper	none						0	0

board/common/rootfs/etc/nginx/nginx.conf

@@ -19,6 +19,14 @@ http {
 
     include /etc/nginx/enabled/*.conf;
 
-    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=info;
-    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 info;
+    # Skip 2xx and 3xx
+    # Skip 400 (e.g., rrousette syntax errors)
+    map $status $loggable {
+    	~^[23]  0;
+	400 	0;
+	default 1;
+    }
+
+    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=warn combined if=$loggable;
+    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 warn;
 }

board/common/rootfs/etc/profile.d/convenience.sh

@@ -4,14 +4,14 @@ alias ll='ls -alF'
 alias ls='ls --color=auto'
 
 export LANG=C.UTF-8
-export EDITOR=/usr/bin/edit
-export VISUAL=/usr/bin/edit
+export EDITOR=/usr/bin/editor
+export VISUAL=/usr/bin/editor
 export LESS="-P %f (press h for help or q to quit)"
 export LESSOPEN="|/usr/bin/lesspipe.sh %s"
 alias vim='vi'
 alias view='vi -R'
 alias emacs='mg'
-alias sensible-editor=edit
+alias sensible-editor=editor
 alias sensible-pager=pager
 alias hd="hexdump -C"
 

board/common/rootfs/etc/udev/rules.d/60-rename-wifi-phy.rules

@@ -0,0 +1,3 @@
+# Rename WiFi PHY devices from phy0 to radio0 to avoid name clashes
+SUBSYSTEM=="ieee80211", ACTION=="add", KERNEL=="phy*", \
+  RUN+="/bin/sh -c '/usr/sbin/iw phy %k set name radio%n'"

board/common/rootfs/etc/udev/rules.d/70-remove-virtual-wifi-interfaces.rules

@@ -0,0 +1,7 @@
+# Remove kernel-created WiFi interfaces
+# All WiFi interfaces are now virtual interfaces created by confd
+SUBSYSTEM=="net", ACTION=="add", KERNEL=="wlan*", \
+  TEST=="/sys/class/net/$name/phy80211/name", \
+  PROGRAM="/bin/cat /sys/class/net/%k/phy80211/name", \
+  TEST!="/run/wifi-cleaned-%c", \
+  RUN+="/bin/sh -c '/usr/sbin/iw dev %k del && touch /run/wifi-cleaned-%c'"

board/common/rootfs/etc/udev/rules.d/70-rename-wifi.rules

@@ -1 +0,0 @@
-SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"

board/common/rootfs/usr/bin/askpass

@@ -1,23 +1,49 @@
 #!/bin/sh
+# Prompt for a secret with confirmation, then encode and output it.
+#
+# Default mode: hash with mkpasswd (for system passwords)
+#    askpass [OUTPUT]
+#
+# Base64 mode (-b): base64-encode (for keystore passphrases)
+#    askpass -b [OUTPUT]
+#
+# If OUTPUT is given, result is written to the file.
+# If omitted, result is written to stdout.
 # shellcheck disable=SC3045
 
+LABEL="New password"
+MODE=hash
+if [ "$1" = "-b" ]; then
+    LABEL="Passphrase"
+    MODE=base64
+    shift
+fi
 OUTPUT=$1
 
-read -r -s -p "New password: " password
+read -r -s -p "$LABEL: " secret
 >&2 echo
-read -r -s -p "Retype password: " password_again
+read -r -s -p "Retype $LABEL: " secret_again
 >&2 echo
 
-if [ "$password" != "$password_again" ]; then
-    echo "Passwords do not match, try again."
+if [ "$secret" != "$secret_again" ]; then
+    echo "${LABEL}s do not match, try again."
     exit 1
 fi
 
-if [ -z "$OUTPUT" ]; then
-    echo "$password"
-    exit 0
+if [ -z "$secret" ]; then
+    echo "Empty $LABEL, try again."
+    exit 1
+fi
+
+if [ "$MODE" = "base64" ]; then
+    encoded=$(printf '%s' "$secret" | base64 -w 0)
+else
+    encoded=$(printf '%s\n' "$secret" | mkpasswd -s)
 fi
 
 umask 0177
-echo "$password" | mkpasswd -s > "$OUTPUT"
-exit 0
+if [ -z "$OUTPUT" ]; then
+    echo "$encoded"
+else
+    printf '%s' "$encoded" > "$OUTPUT"
+fi

board/common/rootfs/usr/bin/cfg

@@ -1,58 +0,0 @@
-#!/bin/sh
-# User-friendly wrapper for sysrepocfg
-# TODO: add import/export, copy, ...
-
-# Edit YANG binary types using sysrepo, base64, and duct tape.
-edit()
-{
-    xpath=$1
-    if [ -z "$xpath" ]; then
-	echo "Usage: cfg edit \"/full/xpath/to/binary/leaf\""
-	exit 1
-    fi
-
-    if tmp=$(sysrepocfg -G "$xpath"); then
-	file=$(mktemp)
-
-	echo "$tmp" | base64 -d > "$file"
-	if /usr/bin/editor "$file"; then
-	    tmp=$(base64 -w0 < "$file")
-	    sysrepocfg -S "$xpath" -u "$tmp"
-	fi
-
-	rm -f "$file"
-    else
-	echo "Failed to retrieve value for $xpath"
-	exit 1
-    fi
-}
-
-usage()
-{
-    echo "Usage:"
-    echo "    cfg CMD [ARG]"
-    echo
-    echo "Command:"
-    echo "    edit XPATH   Edit YANG binary type"
-    echo "    help         This help text"
-    echo
-    echo "As a backwards compatible fallback, this script forwards"
-    echo "all other commands as options to sysrepocfg."
-    echo
-
-    exit 0
-}
-
-cmd=$1; shift
-case $cmd in
-    edit)
-	edit "$1"
-	;;
-    help)
-	usage
-	;;
-    *)
-	set -- "$cmd" "$@"
-	exec sysrepocfg -f json "$@"
-	;;
-esac

board/common/rootfs/usr/bin/edit

@@ -1 +0,0 @@
-/etc/alternatives/editor

board/common/rootfs/usr/bin/show-legacy

@@ -91,7 +91,7 @@ EOF
 
 is_dhcp_running()
 {
-    sysrepocfg -X -f json -m infix-dhcp-server | jq -r '
+    copy operational -x /infix-dhcp-server:dhcp-server | jq -r '
         ."infix-dhcp-server:dhcp-server".enabled as $global |
         if ."infix-dhcp-server:dhcp-server".subnet? then
                 (."infix-dhcp-server:dhcp-server".subnet[] |
@@ -110,15 +110,15 @@ dhcp()
 
     case $1 in
 	detail)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
+	    copy operational -x /infix-dhcp-server:dhcp-server | \
 		jq -C .
 	    ;;
 	stat*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
+	    copy operational -x /infix-dhcp-server:dhcp-server | \
 		/usr/libexec/statd/cli-pretty "show-dhcp-server" -s
 	    ;;
 	*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
+	    copy operational -x /infix-dhcp-server:dhcp-server | \
 		/usr/libexec/statd/cli-pretty "show-dhcp-server"
 	    ;;
     esac
@@ -182,13 +182,13 @@ ifaces()
     else
 	if [ $# -gt 0 ]; then
 	    for iface in $*; do
-		sysrepocfg -f json -X -d operational -x \
+		copy operational -x \
 			   "/ietf-interfaces:interfaces/interface[name='$iface']" | \
 		    /usr/libexec/statd/cli-pretty "show-interfaces" -n "$iface"
 	    done
 	    return
 	fi
-        sysrepocfg -f json -X -d operational -m ietf-interfaces | \
+        copy operational -x /ietf-interfaces:interfaces | \
           /usr/libexec/statd/cli-pretty "show-interfaces"
     fi
 }
@@ -227,7 +227,7 @@ rstp()
 
 stp()
 {
-    sysrepocfg -f json -X -d operational -m ietf-interfaces | \
+    copy operational -x /ietf-interfaces:interfaces | \
         /usr/libexec/statd/cli-pretty "show-bridge-stp"
 }
 
@@ -248,7 +248,7 @@ routes()
     else
 	arg="-i ipv4"
     fi
-    sysrepocfg -f json -X -d operational -x "/ietf-routing:routing/ribs" | \
+    copy operational -x /ietf-routing:routing/ribs | \
 	/usr/libexec/statd/cli-pretty "show-routing-table" $arg
 }
 

board/common/rootfs/usr/libexec/infix/iw.py

@@ -0,0 +1,600 @@
+#!/usr/bin/env python3
+"""
+iw command wrapper that returns structured JSON data
+
+Usage:
+    iw.py list                  - List all PHY devices
+    iw.py dev                   - List all interfaces grouped by PHY
+    iw.py info <device>         - Get PHY or interface information
+    iw.py survey <interface>    - Get channel survey data
+"""
+
+import sys
+import json
+import subprocess
+import re
+def decode_iw_ssid(ssid):
+    """Decode iw escaped SSID (\\xHH) to UTF-8, stripping non-printable chars."""
+    try:
+        ssid = ssid.encode().decode('unicode_escape').encode('latin-1').decode('utf-8')
+    except (UnicodeDecodeError, UnicodeEncodeError):
+        return ssid
+    return ''.join(c for c in ssid if c.isprintable())
+
+
+def run_iw(*args):
+    """Run iw command and return output"""
+    try:
+        result = subprocess.run(
+            ['iw'] + list(args),
+            capture_output=True,
+            text=True,
+            timeout=5
+        )
+        if result.returncode == 0:
+            return result.stdout
+        return None
+    except Exception:
+        return None
+
+
+def normalize_phy_name(name):
+    """
+    Convert radioN to phyN or vice versa based on what exists in sysfs.
+    Returns the actual phy name that exists.
+    """
+    import os
+
+    # Try the name as-is first
+    if os.path.exists(f'/sys/class/ieee80211/{name}'):
+        return name
+
+    # Try converting radioN <-> phyN
+    if name.startswith('radio'):
+        phy_name = 'phy' + name[5:]
+        if os.path.exists(f'/sys/class/ieee80211/{phy_name}'):
+            return phy_name
+    elif name.startswith('phy'):
+        radio_name = 'radio' + name[3:]
+        if os.path.exists(f'/sys/class/ieee80211/{radio_name}'):
+            return radio_name
+
+    # Return original if nothing found
+    return name
+
+
+def parse_phy_info(phy_name):
+    """
+    Parse 'iw phy <name> info' output or 'iw <name> info' output
+    Returns: {bands, driver, manufacturer, max_txpower, num_virtual_interfaces, interface_combinations}
+    """
+    # Normalize the phy name
+    actual_phy = normalize_phy_name(phy_name)
+
+    # Try 'iw phy <name> info' first
+    output = run_iw('phy', actual_phy, 'info')
+
+    # If that fails, try 'iw <name> info' (some systems support this)
+    if not output:
+        output = run_iw(actual_phy, 'info')
+
+    if not output:
+        return {}
+
+    result = {
+        'name': phy_name,
+        'bands': [],
+        'driver': None,
+        'manufacturer': None,
+        'max_txpower': None,
+        'num_virtual_interfaces': 0,
+        'interface_combinations': []
+    }
+
+    current_band = None
+    band_num = 0
+    in_combinations = False
+    max_power = None
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # Detect band sections
+        if stripped.startswith('Band '):
+            if current_band and current_band.get('frequencies'):
+                result['bands'].append(current_band)
+            band_num += 1
+            current_band = {
+                'band': band_num,
+                'frequencies': [],
+                'name': None,
+                'ht_capable': False,
+                'vht_capable': False,
+                'he_capable': False
+            }
+            in_combinations = False
+
+        # Parse frequencies (handle both "2412 MHz" and "2412.0 MHz" formats)
+        elif current_band and not in_combinations:
+            freq_match = re.match(r'\* ([0-9.]+) MHz.*?\(([0-9.]+) dBm\)', stripped)
+            if freq_match:
+                freq = int(float(freq_match.group(1)))  # Convert "2412.0" to 2412
+                power = float(freq_match.group(2))
+
+                current_band['frequencies'].append(freq)
+
+                # Track max power
+                if max_power is None or power > max_power:
+                    max_power = power
+
+            # Check capabilities
+            if 'HT ' in stripped or 'High Throughput' in stripped:
+                current_band['ht_capable'] = True
+            if 'VHT' in stripped or 'Very High Throughput' in stripped:
+                current_band['vht_capable'] = True
+            if 'HE ' in stripped or 'High Efficiency' in stripped:
+                current_band['he_capable'] = True
+
+        # Detect interface combinations section
+        if 'valid interface combinations:' in stripped.lower():
+            in_combinations = True
+            continue
+
+        # Parse interface combinations
+        if in_combinations:
+            if stripped.startswith('*'):
+                # Parse combination line
+                comb_info = {'limits': []}
+
+                # Parse limits: #{ type } <= max
+                limit_matches = re.findall(r'#\{\s*([^}]+)\s*\}\s*<=\s*(\d+)', stripped)
+                for types_str, max_val in limit_matches:
+                    types = [t.strip() for t in types_str.split(',')]
+                    comb_info['limits'].append({
+                        'max': int(max_val),
+                        'types': types
+                    })
+
+                # Parse total
+                total_match = re.search(r'total\s*<=\s*(\d+)', stripped)
+                if total_match:
+                    comb_info['max_total'] = int(total_match.group(1))
+
+                # Parse channels
+                channels_match = re.search(r'#channels\s*<=\s*(\d+)', stripped)
+                if channels_match:
+                    comb_info['num_channels'] = int(channels_match.group(1))
+
+                if comb_info.get('limits') or comb_info.get('max_total'):
+                    result['interface_combinations'].append(comb_info)
+
+            elif not stripped.startswith('#') and ':' in stripped and not stripped.startswith('*'):
+                # End of combinations section
+                in_combinations = False
+
+    # Add last band
+    if current_band and current_band.get('frequencies'):
+        result['bands'].append(current_band)
+
+    # Determine band names and assign band numbers
+    for band in result['bands']:
+        if band['frequencies']:
+            freq = band['frequencies'][0]
+            if 2400 <= freq <= 2500:
+                band['name'] = '2.4GHz'
+                band['band'] = 1
+            elif 5150 <= freq <= 5900:
+                band['name'] = '5GHz'
+                band['band'] = 2
+            elif 5955 <= freq <= 7115:
+                band['name'] = '6GHz'
+                band['band'] = 3
+
+    # Set max TX power
+    if max_power is not None:
+        result['max_txpower'] = int(max_power)
+
+    # Get driver and manufacturer from sysfs
+    try:
+        driver_link = subprocess.run(
+            ['readlink', '-f', f'/sys/class/ieee80211/{actual_phy}/device/driver'],
+            capture_output=True, text=True, timeout=1
+        ).stdout.strip()
+
+        if driver_link:
+            driver_name = driver_link.split('/')[-1]
+            result['driver'] = driver_name
+
+            # Map driver to manufacturer
+            driver_lower = driver_name.lower()
+            if 'mt' in driver_lower or 'mediatek' in driver_lower:
+                result['manufacturer'] = 'MediaTek Inc.'
+            elif 'rtw' in driver_lower or 'realtek' in driver_lower:
+                result['manufacturer'] = 'Realtek Semiconductor Corp.'
+            elif 'ath' in driver_lower or 'qca' in driver_lower:
+                result['manufacturer'] = 'Qualcomm Atheros'
+            elif 'iwl' in driver_lower or 'intel' in driver_lower:
+                result['manufacturer'] = 'Intel Corporation'
+            elif 'brcm' in driver_lower or 'broadcom' in driver_lower:
+                result['manufacturer'] = 'Broadcom Inc.'
+    except Exception:
+        pass
+
+    # Count virtual interfaces
+    dev_output = run_iw('dev')
+    if dev_output:
+        # Extract phy number from actual phy name
+        phy_num = None
+        if actual_phy.startswith('radio'):
+            phy_num = actual_phy[5:]
+        elif actual_phy.startswith('phy'):
+            phy_num = actual_phy[3:]
+
+        if phy_num:
+            count = 0
+            current_phy = None
+            for line in dev_output.splitlines():
+                if line.startswith('phy#'):
+                    current_phy = line.replace('phy#', '').strip()
+                elif current_phy == phy_num and 'Interface' in line:
+                    count += 1
+            result['num_virtual_interfaces'] = count
+
+    return result
+
+
+def parse_interface_info(ifname):
+    """
+    Parse 'iw dev <name> info' output
+    Returns: {ifname, iftype, mac, ssid, frequency, channel, txpower, channel_width}
+    """
+    output = run_iw('dev', ifname, 'info')
+    if not output:
+        return {}
+
+    result = {'ifname': ifname}
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # Interface type
+        if stripped.startswith('type '):
+            result['iftype'] = stripped.split()[1]
+
+        # MAC address
+        elif stripped.startswith('addr '):
+            result['mac'] = stripped.split()[1]
+
+        # SSID
+        elif stripped.startswith('ssid '):
+            result['ssid'] = decode_iw_ssid(' '.join(stripped.split()[1:]))
+
+        # Channel/frequency
+        elif stripped.startswith('channel '):
+            parts = stripped.split()
+            if len(parts) >= 2:
+                result['channel'] = int(parts[1])
+            if 'MHz' in stripped:
+                freq_match = re.search(r'\((\d+) MHz', stripped)
+                if freq_match:
+                    result['frequency'] = int(freq_match.group(1))
+            # Channel width
+            if 'width:' in stripped:
+                width_match = re.search(r'width:\s*(\d+)\s*MHz', stripped)
+                if width_match:
+                    result['channel_width'] = f"{width_match.group(1)} MHz"
+
+        # TX power
+        elif stripped.startswith('txpower '):
+            power_match = re.search(r'([0-9.]+) dBm', stripped)
+            if power_match:
+                result['txpower'] = float(power_match.group(1))
+
+    return result
+
+
+def parse_stations(ifname):
+    """
+    Parse 'iw dev <name> station dump' output
+    Returns: list of connected stations with stats
+    """
+    output = run_iw('dev', ifname, 'station', 'dump')
+    if not output:
+        return []
+
+    stations = []
+    current = None
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # New station entry: "Station aa:bb:cc:dd:ee:ff (on wifiX)"
+        if stripped.startswith('Station '):
+            if current:
+                stations.append(current)
+            parts = stripped.split()
+            if len(parts) >= 2:
+                current = {'mac-address': parts[1].lower()}
+            else:
+                current = None
+            continue
+
+        if not current or ':' not in stripped:
+            continue
+
+        key, _, value = stripped.partition(':')
+        key = key.strip()
+        value = value.strip()
+
+        try:
+            if key == 'signal':
+                # Format: "-42 dBm" or "-42 [-44, -45] dBm"
+                current['signal-strength'] = int(value.split()[0])
+            elif key == 'connected time':
+                # Format: "123 seconds"
+                current['connected-time'] = int(value.split()[0])
+            elif key == 'rx bytes':
+                current['rx-bytes'] = value  # counter64: string-encoded
+            elif key == 'tx bytes':
+                current['tx-bytes'] = value  # counter64: string-encoded
+            elif key == 'rx packets':
+                current['rx-packets'] = value  # counter64: string-encoded
+            elif key == 'tx packets':
+                current['tx-packets'] = value  # counter64: string-encoded
+            elif key == 'tx bitrate':
+                # Format: "866.7 MBit/s ..." - convert to 100kbit/s units
+                speed_mbps = float(value.split()[0])
+                current['tx-speed'] = int(speed_mbps * 10)
+            elif key == 'rx bitrate':
+                speed_mbps = float(value.split()[0])
+                current['rx-speed'] = int(speed_mbps * 10)
+            elif key == 'inactive time':
+                # Format: "1234 ms"
+                current['inactive-time'] = int(value.split()[0])
+        except (ValueError, IndexError):
+            continue
+
+    if current:
+        stations.append(current)
+
+    return stations
+
+
+def parse_survey(ifname):
+    """
+    Parse 'iw dev <name> survey dump' output
+    Returns: list of {frequency, in_use, noise, active_time, busy_time, receive_time, transmit_time}
+    """
+    output = run_iw('dev', ifname, 'survey', 'dump')
+    if not output:
+        return []
+
+    channels = []
+    current_channel = None
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # New survey entry
+        if stripped.startswith('Survey data from'):
+            if current_channel:
+                channels.append(current_channel)
+            current_channel = None
+
+        # Frequency
+        elif stripped.startswith('frequency:'):
+            parts = stripped.split()
+            if len(parts) >= 2:
+                freq = int(parts[1])
+                in_use = '[in use]' in stripped
+                current_channel = {
+                    'frequency': freq,
+                    'in_use': in_use
+                }
+
+        # Channel metrics
+        elif current_channel:
+            if stripped.startswith('noise:'):
+                noise_match = re.search(r'(-?\d+) dBm', stripped)
+                if noise_match:
+                    current_channel['noise'] = int(noise_match.group(1))
+
+            elif stripped.startswith('channel active time:'):
+                time_match = re.search(r'(\d+) ms', stripped)
+                if time_match:
+                    current_channel['active_time'] = int(time_match.group(1))
+
+            elif stripped.startswith('channel busy time:'):
+                time_match = re.search(r'(\d+) ms', stripped)
+                if time_match:
+                    current_channel['busy_time'] = int(time_match.group(1))
+
+            elif stripped.startswith('channel receive time:'):
+                time_match = re.search(r'(\d+) ms', stripped)
+                if time_match:
+                    current_channel['receive_time'] = int(time_match.group(1))
+
+            elif stripped.startswith('channel transmit time:'):
+                time_match = re.search(r'(\d+) ms', stripped)
+                if time_match:
+                    current_channel['transmit_time'] = int(time_match.group(1))
+
+    # Add last channel
+    if current_channel:
+        channels.append(current_channel)
+
+    return channels
+
+
+def parse_list():
+    """
+    Parse 'iw list' output
+    Returns: list of PHY names
+    """
+    output = run_iw('list')
+    if not output:
+        return []
+
+    phys = []
+    for line in output.splitlines():
+        match = re.match(r'Wiphy (phy\d+|radio\d+)', line)
+        if match:
+            phys.append(match.group(1))
+
+    return phys
+
+
+def parse_dev():
+    """
+    Parse 'iw dev' output
+    Returns: dict mapping PHY numbers to list of interfaces
+    """
+    output = run_iw('dev')
+    if not output:
+        return {}
+
+    result = {}
+    current_phy = None
+
+    for line in output.splitlines():
+        # PHY line: "phy#0" or "phy#1"
+        if line.startswith('phy#'):
+            current_phy = line.replace('phy#', '').strip()
+            if current_phy not in result:
+                result[current_phy] = []
+        # Interface line: "    Interface wlan0"
+        elif current_phy and 'Interface' in line:
+            ifname = line.split('Interface')[1].strip()
+            result[current_phy].append(ifname)
+
+    return result
+
+
+def parse_link(ifname):
+    """
+    Parse 'iw dev <name> link' output for station mode
+    Returns: {connected, bssid, ssid, frequency, signal, tx_bitrate, rx_bitrate}
+    """
+    output = run_iw('dev', ifname, 'link')
+    if not output:
+        return {'connected': False}
+
+    if 'Not connected' in output:
+        return {'connected': False}
+
+    result = {'connected': True}
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # Connected to aa:bb:cc:dd:ee:ff
+        if stripped.startswith('Connected to '):
+            parts = stripped.split()
+            if len(parts) >= 3:
+                result['bssid'] = parts[2].lower()
+
+        # SSID: NetworkName
+        elif stripped.startswith('SSID: '):
+            result['ssid'] = decode_iw_ssid(stripped[6:])
+
+        # freq: 5180
+        elif stripped.startswith('freq: '):
+            try:
+                result['frequency'] = int(stripped[6:])
+            except ValueError:
+                pass
+
+        # signal: -42 dBm
+        elif stripped.startswith('signal: '):
+            try:
+                result['signal-strength'] = int(stripped.split()[1])
+            except (ValueError, IndexError):
+                pass
+
+        # tx bitrate: 866.7 MBit/s ...
+        elif stripped.startswith('tx bitrate: '):
+            try:
+                speed = float(stripped.split()[2])
+                result['tx-speed'] = int(speed * 10)  # 100kbit/s units
+            except (ValueError, IndexError):
+                pass
+
+        # rx bitrate: 780.0 MBit/s ...
+        elif stripped.startswith('rx bitrate: '):
+            try:
+                speed = float(stripped.split()[2])
+                result['rx-speed'] = int(speed * 10)
+            except (ValueError, IndexError):
+                pass
+
+    return result
+
+
+def main():
+    if len(sys.argv) < 2:
+        print(json.dumps({
+            'error': 'Usage: iw.py <command> [device]',
+            'commands': {
+                'list': 'List all PHY devices',
+                'dev': 'List all interfaces grouped by PHY',
+                'info': 'Get PHY or interface information (requires device)',
+                'survey': 'Get channel survey data (requires interface)',
+                'station': 'Get connected stations in AP mode (requires interface)',
+                'link': 'Get link info in station mode (requires interface)'
+            },
+            'examples': [
+                'iw.py list',
+                'iw.py dev',
+                'iw.py info radio0',
+                'iw.py info wlan0',
+                'iw.py station wifi0',
+                'iw.py link wlan0',
+                'iw.py survey wlan0'
+            ]
+        }, indent=2))
+        sys.exit(1)
+
+    command = sys.argv[1]
+
+    try:
+        if command == 'list':
+            data = parse_list()
+        elif command == 'dev':
+            data = parse_dev()
+        elif command == 'info':
+            if len(sys.argv) < 3:
+                data = {'error': 'info command requires device argument'}
+            else:
+                device = sys.argv[2]
+                # Auto-detect if device is a PHY (phy*/radio*) or interface
+                if device.startswith('phy') or device.startswith('radio'):
+                    data = parse_phy_info(device)
+                else:
+                    data = parse_interface_info(device)
+        elif command == 'station':
+            if len(sys.argv) < 3:
+                data = {'error': 'station command requires interface argument'}
+            else:
+                data = parse_stations(sys.argv[2])
+        elif command == 'link':
+            if len(sys.argv) < 3:
+                data = {'error': 'link command requires interface argument'}
+            else:
+                data = parse_link(sys.argv[2])
+        elif command == 'survey':
+            if len(sys.argv) < 3:
+                data = {'error': 'survey command requires interface argument'}
+            else:
+                data = parse_survey(sys.argv[2])
+        else:
+            data = {'error': f'Unknown command: {command}'}
+
+        print(json.dumps(data, indent=2, ensure_ascii=False))
+
+    except Exception as e:
+        print(json.dumps({'error': str(e)}))
+        sys.exit(1)
+
+
+if __name__ == '__main__':
+    main()

board/common/rootfs/usr/libexec/infix/wifi-channel-map.py

@@ -0,0 +1,724 @@
+#!/usr/bin/env python3
+"""
+WiFi Channel Visualization Tool
+Shows graphical representation of WiFi channel overlap and utilization
+"""
+
+import sys
+import json
+import argparse
+
+
+class Colors:
+    """ANSI color codes for terminal output"""
+    RESET = '\033[0m'
+    BOLD = '\033[1m'
+    RED = '\033[91m'
+    GREEN = '\033[92m'
+    YELLOW = '\033[93m'
+    BLUE = '\033[94m'
+    MAGENTA = '\033[95m'
+    CYAN = '\033[96m'
+    GRAY = '\033[90m'
+    BG_RED = '\033[101m'
+    BG_GREEN = '\033[102m'
+    BG_YELLOW = '\033[103m'
+    BG_BLUE = '\033[104m'
+    BG_GRAY = '\033[100m'
+
+
+def freq_to_channel(freq):
+    """Convert frequency (MHz) to WiFi channel number"""
+    # 2.4 GHz band
+    if 2412 <= freq <= 2484:
+        if freq == 2484:
+            return 14
+        return (freq - 2412) // 5 + 1
+    # 5 GHz band
+    elif 5170 <= freq <= 5825:
+        return (freq - 5000) // 5
+    # 6 GHz band
+    elif 5955 <= freq <= 7115:
+        return (freq - 5950) // 5
+    return None
+
+
+def get_channel_frequency(channel, band='2.4'):
+    """Get center frequency for a channel"""
+    if band == '2.4':
+        if channel == 14:
+            return 2484
+        return 2412 + (channel - 1) * 5
+    elif band == '5':
+        return 5000 + channel * 5
+    return None
+
+
+def get_busy_percentage(channel_data):
+    """Calculate channel busy percentage"""
+    active = channel_data.get('active-time', 0)
+    busy = channel_data.get('busy-time', 0)
+    if active > 0:
+        return (busy / active) * 100
+    return 0
+
+
+def get_utilization_color(busy_pct):
+    """Get color based on channel utilization"""
+    if busy_pct >= 50:
+        return Colors.RED
+    elif busy_pct >= 25:
+        return Colors.YELLOW
+    elif busy_pct >= 10:
+        return Colors.CYAN
+    else:
+        return Colors.GREEN
+
+
+def draw_channel_graph_2_4ghz(survey_data):
+    """Draw channel overlap graph for 2.4 GHz band"""
+    # Parse survey data
+    channels = {}
+    in_use_channel = None
+
+    for ch_data in survey_data:
+        freq = ch_data.get('frequency')
+        ch_num = freq_to_channel(freq)
+        if ch_num and 1 <= ch_num <= 14:
+            busy_pct = get_busy_percentage(ch_data)
+            channels[ch_num] = {
+                'freq': freq,
+                'noise': ch_data.get('noise', -100),
+                'busy': busy_pct,
+                'in_use': ch_data.get('in-use', False),
+                'active_time': ch_data.get('active-time', 0),
+                'busy_time': ch_data.get('busy-time', 0)
+            }
+            if ch_data.get('in-use'):
+                in_use_channel = ch_num
+
+    if not channels:
+        print("No 2.4 GHz channel data available")
+        return
+
+    print(f"\n{Colors.BOLD}2.4 GHz WiFi Channel Overlap Visualization{Colors.RESET}")
+    print("=" * 80)
+    print(f"Channel width: 20 MHz | Channel spacing: 5 MHz")
+    print(f"Non-overlapping channels: 1, 6, 11 (shown in {Colors.GREEN}green{Colors.RESET})")
+    print()
+
+    # Draw frequency scale
+    print("Frequency (MHz):")
+    print("2400        2420        2440        2460        2480")
+    print("|-----------|-----------|-----------|-----------|")
+
+    # Draw each channel as a bar showing its 20 MHz width
+    # Each channel occupies ~4 adjacent channels worth of space
+    for ch in range(1, 14):
+        if ch not in channels:
+            continue
+
+        data = channels[ch]
+        busy_pct = data['busy']
+        is_in_use = data['in_use']
+        noise = data['noise']
+
+        # Determine color based on status
+        if is_in_use:
+            color = Colors.BG_BLUE
+            marker = '█'
+        elif busy_pct >= 50:
+            color = Colors.RED
+            marker = '▓'
+        elif busy_pct >= 25:
+            color = Colors.YELLOW
+            marker = '▒'
+        elif busy_pct > 0:
+            color = Colors.CYAN
+            marker = '░'
+        else:
+            color = Colors.GRAY
+            marker = '·'
+
+        # Non-overlapping channels get green color
+        if ch in [1, 6, 11] and not is_in_use and busy_pct < 10:
+            color = Colors.GREEN
+
+        # Calculate position (each channel is offset by 5 MHz = 1 position)
+        # Channel 1 is at 2412 MHz, base is 2400
+        offset = ((data['freq'] - 2400) // 5)
+
+        # Draw channel bar (20 MHz = 4 positions wide)
+        line = ' ' * 80
+        line_arr = list(line)
+
+        # Mark the channel span (20 MHz width)
+        for i in range(4):
+            pos = offset + i - 2  # Center the 20 MHz around channel
+            if 0 <= pos < len(line_arr):
+                line_arr[pos] = marker
+
+        # Add channel label
+        label_pos = offset
+        if 0 <= label_pos < len(line_arr) - 5:
+            # Clear space for label
+            for i in range(5):
+                if label_pos + i < len(line_arr):
+                    line_arr[label_pos + i] = ' '
+
+        line = ''.join(line_arr)
+
+        # Status indicators
+        status = ""
+        if is_in_use:
+            status = f" {Colors.BOLD}[IN USE]{Colors.RESET}"
+
+        busy_color = get_utilization_color(busy_pct)
+
+        print(f"{color}Ch{ch:2d}{Colors.RESET} {color}{line}{Colors.RESET} "
+              f"{busy_color}{busy_pct:5.1f}%{Colors.RESET} "
+              f"{noise:4d}dBm{status}")
+
+    print("\n" + "=" * 80)
+    print(f"\n{Colors.BOLD}Legend:{Colors.RESET}")
+    print(f"  {Colors.BG_BLUE}██{Colors.RESET} In use (your network)")
+    print(f"  {Colors.RED}▓▓{Colors.RESET} High usage (>50%)")
+    print(f"  {Colors.YELLOW}▒▒{Colors.RESET} Medium usage (25-50%)")
+    print(f"  {Colors.CYAN}░░{Colors.RESET} Low usage (1-25%)")
+    print(f"  {Colors.GRAY}··{Colors.RESET} Idle (<1%)")
+    print()
+
+
+def draw_channel_list(survey_data):
+    """Draw a simple channel list with utilization bars"""
+    print(f"\n{Colors.BOLD}Channel Utilization{Colors.RESET}")
+    print("=" * 80)
+    print(f"{'Ch':<4} {'Freq':<6} {'Noise':<8} {'Busy%':<8} {'Utilization Bar':<40}")
+    print("-" * 80)
+
+    for ch_data in sorted(survey_data, key=lambda x: x.get('frequency', 0)):
+        freq = ch_data.get('frequency')
+        ch_num = freq_to_channel(freq)
+        if not ch_num:
+            continue
+
+        noise = ch_data.get('noise', -100)
+        busy_pct = get_busy_percentage(ch_data)
+        is_in_use = ch_data.get('in-use', False)
+
+        # Create utilization bar (40 chars wide = 100%)
+        bar_length = int(busy_pct * 40 / 100)
+        bar_color = get_utilization_color(busy_pct)
+
+        if is_in_use:
+            bar = f"{Colors.BG_BLUE}{'█' * bar_length}{Colors.RESET}"
+            marker = f" {Colors.BOLD}◀ IN USE{Colors.RESET}"
+        else:
+            bar = f"{bar_color}{'█' * bar_length}{Colors.RESET}"
+            marker = ""
+
+        empty = '░' * (40 - bar_length)
+
+        print(f"{ch_num:<4} {freq:<6} {noise:<8} {busy_pct:5.1f}%  {bar}{Colors.GRAY}{empty}{Colors.RESET}{marker}")
+
+    print()
+
+
+def draw_overlap_pie(survey_data):
+    """Draw a pie-style visualization of channel group utilization"""
+    # Parse channel data into 3 non-overlapping groups
+    # Group 1: channels 1-5 (centered on ch 1)
+    # Group 2: channels 4-8 (centered on ch 6)
+    # Group 3: channels 9-13 (centered on ch 11)
+
+    channels = {}
+    in_use_channel = None
+
+    for ch_data in survey_data:
+        freq = ch_data.get('frequency')
+        ch_num = freq_to_channel(freq)
+        if ch_num and 1 <= ch_num <= 13:
+            busy_pct = get_busy_percentage(ch_data)
+            channels[ch_num] = {
+                'busy': busy_pct,
+                'noise': ch_data.get('noise', -100),
+                'in_use': ch_data.get('in-use', False)
+            }
+            if ch_data.get('in-use'):
+                in_use_channel = ch_num
+
+    if not channels:
+        return
+
+    # Calculate group utilization (average of channels in each group)
+    groups = [
+        {'name': 'Ch 1', 'channels': [1, 2, 3, 4, 5], 'center': 1},
+        {'name': 'Ch 6', 'channels': [4, 5, 6, 7, 8], 'center': 6},
+        {'name': 'Ch 11', 'channels': [9, 10, 11, 12, 13], 'center': 11},
+    ]
+
+    for group in groups:
+        busy_values = [channels.get(ch, {}).get('busy', 0) for ch in group['channels'] if ch in channels]
+        group['avg_busy'] = sum(busy_values) / len(busy_values) if busy_values else 0
+        group['center_busy'] = channels.get(group['center'], {}).get('busy', 0)
+        group['in_use'] = in_use_channel in group['channels'] if in_use_channel else False
+
+    total_busy = sum(g['avg_busy'] for g in groups)
+
+    print(f"\n{Colors.BOLD}Channel Group Utilization (2.4 GHz){Colors.RESET}")
+    print("=" * 60)
+    print("Non-overlapping channel groups with their overlap zones:\n")
+
+    # Draw ASCII donut/pie
+    pie_width = 50
+
+    # Calculate proportions
+    if total_busy > 0:
+        for group in groups:
+            group['proportion'] = group['avg_busy'] / total_busy
+            group['width'] = max(1, int(group['proportion'] * pie_width))
+    else:
+        for group in groups:
+            group['proportion'] = 1/3
+            group['width'] = pie_width // 3
+
+    # Adjust to exactly fill pie_width
+    total_width = sum(g['width'] for g in groups)
+    if total_width < pie_width:
+        groups[0]['width'] += pie_width - total_width
+
+    # Draw the pie bar
+    pie_chars = ['█', '▓', '░']
+    colors = [Colors.GREEN, Colors.YELLOW, Colors.CYAN]
+
+    pie_line = ""
+    for i, group in enumerate(groups):
+        if group['in_use']:
+            color = Colors.BG_BLUE
+        elif group['avg_busy'] >= 50:
+            color = Colors.RED
+        elif group['avg_busy'] >= 25:
+            color = Colors.YELLOW
+        else:
+            color = Colors.GREEN
+
+        char = pie_chars[i % len(pie_chars)]
+        pie_line += f"{color}{char * group['width']}{Colors.RESET}"
+
+    # Draw centered pie
+    print(f"    ┌{'─' * pie_width}┐")
+    print(f"    │{pie_line}│")
+    print(f"    └{'─' * pie_width}┘")
+
+    # Legend with percentages
+    print()
+    for i, group in enumerate(groups):
+        char = pie_chars[i % len(pie_chars)]
+
+        if group['in_use']:
+            color = Colors.BG_BLUE
+            marker = " ◀ IN USE"
+        elif group['avg_busy'] >= 50:
+            color = Colors.RED
+            marker = ""
+        elif group['avg_busy'] >= 25:
+            color = Colors.YELLOW
+            marker = ""
+        else:
+            color = Colors.GREEN
+            marker = ""
+
+        pct_of_total = group['proportion'] * 100
+        print(f"    {color}{char * 3}{Colors.RESET} {group['name']:>5}: "
+              f"{group['center_busy']:5.1f}% busy (center), "
+              f"{group['avg_busy']:5.1f}% avg in overlap zone, "
+              f"{pct_of_total:4.1f}% of total{marker}")
+
+    # Draw overlap diagram
+    print(f"\n{Colors.BOLD}Channel Overlap Diagram:{Colors.RESET}")
+    print("    Ch:  1   2   3   4   5   6   7   8   9  10  11  12  13")
+    print("        ╔═══════════════════╗")
+    print("    G1: ║ 1 ─ 2 ─ 3 ─ 4 ─ 5 ║         (centered on ch 1)")
+    print("        ╚═══════╦═══════════╝")
+    print("                ╔═══════════════════╗")
+    print("    G2:         ║ 4 ─ 5 ─ 6 ─ 7 ─ 8 ║ (centered on ch 6)")
+    print("                ╚═══════════╦═══════╝")
+    print("                        ╔═══════════════════════╗")
+    print("    G3:                 ║ 9 ─10 ─11 ─12 ─13 ║   (centered on ch 11)")
+    print("                        ╚═══════════════════════╝")
+    print()
+
+
+def generate_svg(survey_data, output_file=None):
+    """Generate SVG image(s) showing channel overlap and utilization for both bands"""
+    # Separate channels by band
+    channels_2_4 = {}
+    channels_5 = {}
+    in_use_2_4 = None
+    in_use_5 = None
+
+    for ch_data in survey_data:
+        freq = ch_data.get('frequency')
+        ch_num = freq_to_channel(freq)
+        if not ch_num:
+            continue
+
+        busy_pct = get_busy_percentage(ch_data)
+        ch_info = {
+            'freq': freq,
+            'busy': busy_pct,
+            'noise': ch_data.get('noise', -100),
+            'in_use': ch_data.get('in-use', False)
+        }
+
+        if 2400 <= freq <= 2500:
+            channels_2_4[ch_num] = ch_info
+            if ch_info['in_use']:
+                in_use_2_4 = ch_num
+        elif 5100 <= freq <= 5900:
+            channels_5[ch_num] = ch_info
+            if ch_info['in_use']:
+                in_use_5 = ch_num
+
+    def busy_to_color(busy_pct, is_in_use=False):
+        if is_in_use:
+            return "#3b82f6"  # Blue
+        elif busy_pct >= 50:
+            return "#ef4444"  # Red
+        elif busy_pct >= 25:
+            return "#f59e0b"  # Yellow/Orange
+        elif busy_pct >= 10:
+            return "#06b6d4"  # Cyan
+        else:
+            return "#22c55e"  # Green
+
+    def generate_band_svg(channels, band, freq_min, freq_max, title, non_overlap_channels=None):
+        if not channels:
+            return None
+
+        width = 900
+        height = 400
+        margin_left = 60
+        margin_right = 40
+        margin_top = 60
+        margin_bottom = 80
+        chart_width = width - margin_left - margin_right
+        chart_height = height - margin_top - margin_bottom
+
+        def freq_to_x(freq):
+            return margin_left + (freq - freq_min) / (freq_max - freq_min) * chart_width
+
+        def busy_to_height(busy_pct):
+            return (busy_pct / 100) * chart_height
+
+        svg_parts = []
+
+        # SVG header
+        svg_parts.append(f'''<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 {width} {height}">
+  <defs>
+    <style>
+      .title {{ font: bold 18px sans-serif; fill: #333; }}
+      .label {{ font: 12px sans-serif; fill: #666; }}
+      .axis {{ font: 10px sans-serif; fill: #333; }}
+      .channel-label {{ font: bold 10px sans-serif; fill: #333; }}
+      .legend {{ font: 12px sans-serif; fill: #333; }}
+    </style>
+  </defs>
+
+  <!-- Background -->
+  <rect width="{width}" height="{height}" fill="#fafafa"/>
+
+  <!-- Title -->
+  <text x="{width/2}" y="30" text-anchor="middle" class="title">{title}</text>
+
+  <!-- Chart area -->
+  <rect x="{margin_left}" y="{margin_top}" width="{chart_width}" height="{chart_height}" fill="#fff" stroke="#ddd"/>
+''')
+
+        # Draw grid lines
+        for pct in [25, 50, 75, 100]:
+            y = margin_top + chart_height - busy_to_height(pct)
+            svg_parts.append(f'  <line x1="{margin_left}" y1="{y}" x2="{margin_left + chart_width}" y2="{y}" stroke="#eee" stroke-dasharray="4,4"/>')
+            svg_parts.append(f'  <text x="{margin_left - 5}" y="{y + 4}" text-anchor="end" class="axis">{pct}%</text>')
+
+        # Y-axis label
+        svg_parts.append(f'  <text x="15" y="{margin_top + chart_height/2}" text-anchor="middle" transform="rotate(-90, 15, {margin_top + chart_height/2})" class="label">Channel Busy %</text>')
+
+        # Draw channels as bars
+        for ch_num, data in sorted(channels.items()):
+            center_freq = data['freq']
+            busy_pct = data['busy']
+            is_in_use = data['in_use']
+
+            # 20 MHz width: ±10 MHz from center
+            x1 = freq_to_x(center_freq - 10)
+            x2 = freq_to_x(center_freq + 10)
+            bar_width = x2 - x1
+            bar_height = busy_to_height(busy_pct)
+            bar_y = margin_top + chart_height - bar_height
+
+            color = busy_to_color(busy_pct, is_in_use)
+            opacity = 0.6 if not is_in_use else 0.8
+
+            # Draw the channel bar
+            svg_parts.append(f'  <rect x="{x1}" y="{bar_y}" width="{bar_width}" height="{bar_height}" fill="{color}" opacity="{opacity}" stroke="{color}" stroke-width="1"/>')
+
+            # Channel label at bottom
+            label_x = freq_to_x(center_freq)
+            svg_parts.append(f'  <text x="{label_x}" y="{margin_top + chart_height + 15}" text-anchor="middle" class="channel-label">{ch_num}</text>')
+
+            # Frequency label (only for some channels to avoid clutter)
+            if band == '2.4' or ch_num in [36, 52, 100, 149, 165]:
+                svg_parts.append(f'  <text x="{label_x}" y="{margin_top + chart_height + 28}" text-anchor="middle" class="axis">{center_freq}</text>')
+
+            # Busy percentage on top of bar (if tall enough)
+            if bar_height > 20:
+                svg_parts.append(f'  <text x="{label_x}" y="{bar_y + 15}" text-anchor="middle" class="channel-label" fill="white">{busy_pct:.0f}%</text>')
+
+        # X-axis labels
+        svg_parts.append(f'  <text x="{margin_left + chart_width/2}" y="{height - 15}" text-anchor="middle" class="label">Channel (Center Frequency MHz)</text>')
+
+        # Legend
+        legend_y = margin_top + 10
+        legend_x = margin_left + chart_width - 150
+        legend_items = [
+            ("#3b82f6", "In Use"),
+            ("#ef4444", "High (>50%)"),
+            ("#f59e0b", "Medium (25-50%)"),
+            ("#06b6d4", "Low (10-25%)"),
+            ("#22c55e", "Idle (<10%)"),
+        ]
+
+        svg_parts.append(f'  <rect x="{legend_x - 10}" y="{legend_y - 5}" width="160" height="{len(legend_items) * 18 + 10}" fill="white" stroke="#ddd" rx="4"/>')
+
+        for i, (color, label) in enumerate(legend_items):
+            y = legend_y + 10 + i * 18
+            svg_parts.append(f'  <rect x="{legend_x}" y="{y - 8}" width="12" height="12" fill="{color}" opacity="0.7"/>')
+            svg_parts.append(f'  <text x="{legend_x + 18}" y="{y + 2}" class="legend">{label}</text>')
+
+        # Non-overlapping channels note (for 2.4 GHz)
+        if non_overlap_channels:
+            svg_parts.append(f'  <text x="{margin_left + 5}" y="{margin_top + chart_height + 50}" class="label">Non-overlapping: Ch {", ".join(map(str, non_overlap_channels))}</text>')
+            for ch in non_overlap_channels:
+                if ch in channels:
+                    center_freq = channels[ch]['freq']
+                    x = freq_to_x(center_freq)
+                    svg_parts.append(f'  <circle cx="{x}" cy="{margin_top + chart_height + 40}" r="8" fill="none" stroke="#22c55e" stroke-width="2"/>')
+                    svg_parts.append(f'  <text x="{x}" y="{margin_top + chart_height + 44}" text-anchor="middle" class="channel-label" fill="#22c55e">{ch}</text>')
+        else:
+            svg_parts.append(f'  <text x="{margin_left + 5}" y="{margin_top + chart_height + 50}" class="label">All channels non-overlapping (20 MHz spacing)</text>')
+
+        svg_parts.append('</svg>')
+        return '\n'.join(svg_parts)
+
+    # Generate SVGs for each band
+    svg_2_4 = generate_band_svg(channels_2_4, '2.4', 2400, 2485,
+                                 "2.4 GHz WiFi Channel Overlap &amp; Utilization",
+                                 [1, 6, 11])
+    svg_5 = generate_band_svg(channels_5, '5', 5150, 5850,
+                               "5 GHz WiFi Channel Utilization",
+                               None)
+
+    # Combine or output separately
+    if svg_2_4 and svg_5:
+        # Combine into one SVG with both bands stacked
+        combined = f'''<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 820">
+  <g transform="translate(0, 0)">
+{svg_2_4.replace('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 400">', '').replace('</svg>', '')}
+  </g>
+  <g transform="translate(0, 410)">
+{svg_5.replace('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 400">', '').replace('</svg>', '')}
+  </g>
+</svg>'''
+        svg_content = combined
+    elif svg_2_4:
+        svg_content = svg_2_4
+    elif svg_5:
+        svg_content = svg_5
+    else:
+        return None
+
+    if output_file:
+        with open(output_file, 'w') as f:
+            f.write(svg_content)
+        print(f"SVG written to: {output_file}")
+    else:
+        print(svg_content)
+
+    return svg_content
+
+
+def draw_recommendations(survey_data, json_output=False):
+    """Analyze channels and provide recommendations"""
+    # Parse channel data
+    channels = {}
+    in_use_channel = None
+
+    for ch_data in survey_data:
+        freq = ch_data.get('frequency')
+        ch_num = freq_to_channel(freq)
+        if ch_num:
+            busy_pct = get_busy_percentage(ch_data)
+            channels[ch_num] = {
+                'busy': busy_pct,
+                'noise': ch_data.get('noise', -100),
+                'in_use': ch_data.get('in-use', False)
+            }
+            if ch_data.get('in-use'):
+                in_use_channel = ch_num
+
+    # Find least congested non-overlapping channels
+    best_channels = []
+    for ch in [1, 6, 11]:
+        if ch in channels:
+            best_channels.append((ch, channels[ch]['busy']))
+
+    best_channels.sort(key=lambda x: x[1])
+
+    # JSON output
+    if json_output:
+        output = {
+            "recommended_channels": [
+                {"channel": ch, "busy_percent": round(busy, 1)}
+                for ch, busy in best_channels
+            ]
+        }
+        if in_use_channel:
+            output["current_channel"] = in_use_channel
+            output["current_busy_percent"] = round(channels.get(in_use_channel, {}).get('busy', 0), 1)
+
+        print(json.dumps(output, indent=2))
+        return
+
+    # Text output
+    print(f"\n{Colors.BOLD}Channel Recommendations{Colors.RESET}")
+    print("=" * 80)
+
+    if in_use_channel:
+        print(f"Current channel: {Colors.BOLD}{in_use_channel}{Colors.RESET}")
+        current_busy = channels.get(in_use_channel, {}).get('busy', 0)
+        if current_busy > 50:
+            print(f"  {Colors.RED}⚠{Colors.RESET}  High congestion detected ({current_busy:.1f}% busy)")
+        elif current_busy > 25:
+            print(f"  {Colors.YELLOW}⚠{Colors.RESET}  Moderate congestion ({current_busy:.1f}% busy)")
+        else:
+            print(f"  {Colors.GREEN}✓{Colors.RESET}  Good channel utilization ({current_busy:.1f}% busy)")
+
+    print(f"\nRecommended non-overlapping channels (2.4 GHz):")
+    for i, (ch, busy) in enumerate(best_channels[:3], 1):
+        color = get_utilization_color(busy)
+        marker = "★" if i == 1 else " "
+        print(f"  {marker} Channel {ch:2d}: {color}{busy:5.1f}% busy{Colors.RESET}")
+
+    print()
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description='Visualize WiFi channel overlap and utilization',
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog='''
+Examples:
+  # Read from yanger output (show all sections)
+  yanger -x "ixll -A ssh host sudo" ietf-hardware | %(prog)s
+
+  # Read from file
+  %(prog)s survey_data.json
+
+  # Show only list view
+  %(prog)s --list survey_data.json
+
+  # Show only specific sections
+  %(prog)s --overlap survey_data.json
+  %(prog)s --pie survey_data.json
+  %(prog)s --utilization survey_data.json
+  %(prog)s --recommendations survey_data.json
+  %(prog)s --overlap --pie survey_data.json
+
+  # Output recommendations as JSON
+  %(prog)s --recommendations --json survey_data.json
+
+  # Generate SVG image
+  %(prog)s --svg /tmp/wifi-channels.svg survey_data.json
+  %(prog)s --svg - survey_data.json > output.svg
+        '''
+    )
+    parser.add_argument('file', nargs='?', help='JSON file with hardware data (default: stdin)')
+    parser.add_argument('--list', action='store_true', help='Show simple list view instead of overlap graph')
+    parser.add_argument('--no-color', action='store_true', help='Disable colors')
+    parser.add_argument('--json', action='store_true', help='Output recommendations in JSON format')
+    parser.add_argument('--svg', metavar='FILE', help='Generate SVG image to FILE (use - for stdout)')
+
+    # Section filters
+    parser.add_argument('--overlap', action='store_true', help='Show only channel overlap visualization (2.4 GHz)')
+    parser.add_argument('--pie', action='store_true', help='Show only channel group pie chart (2.4 GHz)')
+    parser.add_argument('--utilization', action='store_true', help='Show only channel utilization list')
+    parser.add_argument('--recommendations', action='store_true', help='Show only channel recommendations')
+
+    args = parser.parse_args()
+
+    # Disable colors if requested
+    if args.no_color:
+        for attr in dir(Colors):
+            if not attr.startswith('_'):
+                setattr(Colors, attr, '')
+
+    # Read input
+    if args.file:
+        with open(args.file, 'r') as f:
+            data = json.load(f)
+    else:
+        data = json.load(sys.stdin)
+
+    # Extract survey data from hardware components
+    survey_data = []
+    hardware = data.get('ietf-hardware:hardware', {})
+    components = hardware.get('component', [])
+
+    for component in components:
+        if component.get('class') == 'infix-hardware:wifi':
+            wifi_radio = component.get('infix-hardware:wifi-radio', {})
+            survey = wifi_radio.get('survey', {})
+            channels = survey.get('channel', [])
+            if channels:
+                survey_data.extend(channels)
+
+    if not survey_data:
+        print("No WiFi survey data found in input", file=sys.stderr)
+        print("Expected format: yanger ietf-hardware output with wifi-radio survey data", file=sys.stderr)
+        sys.exit(1)
+
+    # Generate SVG if requested (exclusive mode)
+    if args.svg:
+        output_file = None if args.svg == '-' else args.svg
+        generate_svg(survey_data, output_file)
+        return
+
+    # Determine which sections to show
+    # If no section flags are set, show all sections
+    show_all = not (args.overlap or args.pie or args.utilization or args.recommendations)
+
+    show_overlap = show_all or args.overlap
+    show_pie = show_all or args.pie
+    show_utilization = show_all or args.utilization
+    show_recommendations_section = show_all or args.recommendations
+
+    # Draw visualization
+    freqs = [ch.get('frequency', 0) for ch in survey_data]
+    has_2_4ghz = any(2400 <= f <= 2500 for f in freqs)
+
+    if show_overlap and has_2_4ghz and not args.list:
+        draw_channel_graph_2_4ghz(survey_data)
+
+    if show_pie and has_2_4ghz:
+        draw_overlap_pie(survey_data)
+
+    if show_utilization:
+        draw_channel_list(survey_data)
+
+    if show_recommendations_section:
+        draw_recommendations(survey_data, json_output=args.json)
+
+
+if __name__ == '__main__':
+    main()

board/common/rootfs/usr/libexec/infix/wifi-scanner

@@ -1,16 +0,0 @@
-#!/bin/sh
-
-if [ $# -ne 1 ]; then
-	echo "usage: $0 <ifname>"
-	exit 1
-fi
-ifname=$1
-
-TIMEOUT=300
-status=$(wpa_cli -i $ifname scan)
-while [ "$status" != "OK" ]; do
-	status=$(wpa_cli -i $ifname scan)
-	TIMEOUT=$((TIMEOUT-1))
-	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
-	sleep 0.5
-done

board/common/rootfs/usr/libexec/odhcp6c.sh

@@ -0,0 +1,242 @@
+#!/bin/sh
+# DHCPv6 client state update script for odhcp6c
+# This script expects a system with resolvconf (openresolv) and iproute2
+
+[ -z "$1" ] && echo "Error: should be called from odhcp6c" && exit 1
+
+interface="$1"
+state="$2"
+RESOLV_CONF="/run/resolvconf/interfaces/${interface}-ipv6.conf"
+NTPFILE="/run/chrony/dhcp-sources.d/${interface}-ipv6.sources"
+
+[ -n "$metric" ] || metric=5
+
+log()
+{
+	logger -I $$ -t odhcp6c -p user.notice "${interface}: $*"
+}
+
+dbg()
+{
+	logger -I $$ -t odhcp6c -p user.debug "${interface}: $*"
+}
+
+err()
+{
+	logger -I $$ -t odhcp6c -p user.err "${interface}: $*"
+}
+
+teardown_interface()
+{
+	ip -6 route flush dev "$interface"
+	ip -6 address flush dev "$interface" scope global
+}
+
+setup_interface()
+{
+	# Merge RA addresses with DHCP addresses
+	for entry in $RA_ADDRESSES; do
+		duplicate=0
+		addr="${entry%%/*}"
+		for dentry in $ADDRESSES; do
+			daddr="${dentry%%/*}"
+			[ "$addr" = "$daddr" ] && duplicate=1
+		done
+		[ "$duplicate" = "0" ] && ADDRESSES="$ADDRESSES $entry"
+	done
+
+	# Add addresses
+	for entry in $ADDRESSES; do
+		addr="${entry%%,*}"
+		entry="${entry#*,}"
+		preferred="${entry%%,*}"
+		entry="${entry#*,}"
+		valid="${entry%%,*}"
+
+		ip -6 address add "$addr" dev "$interface" preferred_lft "$preferred" valid_lft "$valid" proto dhcp
+		log "assigned address $addr (preferred=$preferred, valid=$valid)"
+	done
+
+	# Add routes from RA
+	for entry in $RA_ROUTES; do
+		addr="${entry%%,*}"
+		entry="${entry#*,}"
+		gw="${entry%%,*}"
+		entry="${entry#*,}"
+		valid="${entry%%,*}"
+		entry="${entry#*,}"
+		metric="${entry%%,*}"
+
+		if [ -n "$gw" ]; then
+			ip -6 route add "$addr" via "$gw" metric "$metric" dev "$interface" from "::/128"
+		else
+			ip -6 route add "$addr" metric "$metric" dev "$interface"
+		fi
+
+		# Add routes for delegated prefixes
+		for prefix in $PREFIXES; do
+			paddr="${prefix%%,*}"
+			[ -n "$gw" ] && ip -6 route add "$addr" via "$gw" metric "$metric" dev "$interface" from "$paddr"
+		done
+	done
+}
+
+handle_prefixes()
+{
+	# $PREFIXES format: "prefix/len,preferred,valid[,class=N][,excluded=...] ..."
+	for entry in $PREFIXES; do
+		addr="${entry%%,*}"
+		entry="${entry#*,}"
+		preferred="${entry%%,*}"
+		entry="${entry#*,}"
+		valid="${entry%%,*}"
+
+		log "received delegated prefix $addr (preferred=$preferred, valid=$valid)"
+
+		# Add unreachable route to prevent routing loops
+		ip -6 route add unreachable "$addr" 2>/dev/null
+
+		# Future: Distribute to downstream interfaces
+	done
+}
+
+handle_dns()
+{
+	truncate -s 0 "$RESOLV_CONF"
+
+	# Combine DHCPv6 DNS ($RDNSS) and RA DNS ($RA_DNS), deduplicating
+	all_dns=""
+	for server in $RDNSS $RA_DNS; do
+		# Simple deduplication: only add if not already in list
+		case " $all_dns " in
+			*" $server "*) ;;
+			*) all_dns="$all_dns $server" ;;
+		esac
+	done
+
+	# Domain search list (DHCPv6 option 24)
+	if [ -n "$DOMAINS" ]; then
+		dbg "adding search domains: $DOMAINS"
+		echo "search $DOMAINS # $interface" >> "$RESOLV_CONF"
+	fi
+
+	# DNS servers
+	for server in $all_dns; do
+		[ -z "$server" ] && continue
+		dbg "adding dns $server"
+		echo "nameserver $server # $interface" >> "$RESOLV_CONF"
+	done
+
+	if [ -n "$all_dns" ]; then
+		resolvconf -u
+	fi
+}
+
+handle_ntp()
+{
+	# DHCPv6 option 56 (NTP server) is provided as $OPTION_56 in hex format
+	# Format: sub-option-code (2 bytes) + length (2 bytes) + data
+	# Sub-option 1 = NTP server address (16 bytes IPv6)
+	#
+	# This is complex to parse in shell. For now, we attempt basic parsing
+	# and fall back to logging a warning if the format is unexpected.
+
+	if [ -n "$OPTION_56" ]; then
+		# Remove all non-hex characters (spaces, colons, etc.) and convert to lowercase
+		hex=$(echo "$OPTION_56" | tr -d '[:space:]:-' | tr '[:upper:]' '[:lower:]')
+
+		truncate -s 0 "$NTPFILE"
+		ntp_found=0
+
+		# Parse option 56: iterate through sub-options
+		# Each sub-option: 2 bytes code + 2 bytes length + data
+		pos=0
+		while [ $pos -lt ${#hex} ]; do
+			# Need at least 4 hex chars (2 bytes) for sub-option code
+			[ $((${#hex} - pos)) -lt 4 ] && break
+
+			# Extract sub-option code (2 bytes = 4 hex chars)
+			subopt_code=$(echo "$hex" | cut -c $((pos+1))-$((pos+4)))
+			pos=$((pos + 4))
+
+			# Need 4 more hex chars for length
+			[ $((${#hex} - pos)) -lt 4 ] && break
+
+			# Extract length (2 bytes = 4 hex chars)
+			subopt_len_hex=$(echo "$hex" | cut -c $((pos+1))-$((pos+4)))
+			subopt_len=$(printf "%d" "0x$subopt_len_hex")
+			pos=$((pos + 4))
+
+			# Sub-option 1 = NTP server address (should be 16 bytes for IPv6)
+			if [ "$subopt_code" = "0001" ] && [ "$subopt_len" -eq 16 ]; then
+				# Extract 16 bytes (32 hex chars) for IPv6 address
+				addr_hex=$(echo "$hex" | cut -c $((pos+1))-$((pos+32)))
+
+				# Convert hex to IPv6 address format
+				# Format: 0123456789abcdef0123456789abcdef -> 0123:4567:89ab:cdef:0123:4567:89ab:cdef
+				ipv6=$(echo "$addr_hex" | sed 's/\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)/\1:\2:\3:\4:\5:\6:\7:\8/')
+
+				dbg "got NTP server $ipv6"
+				echo "server $ipv6 iburst" >> "$NTPFILE"
+				ntp_found=1
+			fi
+
+			# Skip this sub-option's data
+			pos=$((pos + subopt_len * 2))
+		done
+
+		if [ "$ntp_found" -eq 1 ]; then
+			chronyc reload sources >/dev/null 2>&1
+		else
+			dbg "option 56 received but no NTP server addresses found (consider using option 31/SNTP)"
+		fi
+	fi
+}
+
+log "state: $state"
+
+(
+	flock 9
+	case "$state" in
+		started)
+			# Initial state - clean up any stale config
+			teardown_interface
+			;;
+
+		bound)
+			# Fresh lease - tear down and set up from scratch
+			teardown_interface
+			setup_interface
+			handle_prefixes
+			handle_dns
+			handle_ntp
+			;;
+
+		informed|updated|rebound|ra-updated)
+			# Update existing configuration
+			setup_interface
+			[ -n "$PREFIXES" ] && handle_prefixes
+			handle_dns
+			handle_ntp
+			;;
+
+		unbound|stopped)
+			# Lost server or client stopped
+			teardown_interface
+			rm -f "$RESOLV_CONF"
+			rm -f "$NTPFILE"
+			resolvconf -u
+			chronyc reload sources >/dev/null 2>&1
+			;;
+	esac
+) 9>/tmp/odhcp6c.lock.${interface}
+rm -f /tmp/odhcp6c.lock.${interface}
+
+# Run hooks
+HOOK_DIR="/usr/libexec/odhcp6c.d"
+for hook in "${HOOK_DIR}/"*; do
+	[ -f "${hook}" -a -x "${hook}" ] || continue
+	"${hook}" "$interface" "$state"
+done
+
+exit 0

board/common/rootfs/usr/sbin/container

@@ -63,6 +63,21 @@ calc_sha()
     sha256sum "$1" 2>/dev/null | awk '{print $1}'
 }
 
+# Calculate a combined SHA256 over the container script and its
+# optional env file.  Environment variables are stored separately
+# from the script, so both must be included in the checksum to
+# detect configuration changes such as added/changed env vars.
+calc_config_sha()
+{
+    _envfile="/run/containers/args/${name}.env"
+
+    if [ -f "$_envfile" ]; then
+	cat "$1" "$_envfile" | sha256sum | awk '{print $1}'
+    else
+	calc_sha "$1"
+    fi
+}
+
 # Check image transport, return 0 if remote, 1 if local
 is_remote()
 {
@@ -124,7 +139,7 @@ is_uptodate()
 		    # If SHA matches, check container instance
 		    if [ "$stored_sha" = "$current_sha" ]; then
 			if podman container exists "$name"; then
-			    config_sha=$(calc_sha "$script")
+			    config_sha=$(calc_config_sha "$script")
 			    container_sha=$(podman inspect "$name" --format '{{index .Config.Labels "config-sha256"}}' 2>/dev/null)
 			    container_img_sha=$(podman inspect "$name" --format '{{index .Config.Labels "meta-image-sha256"}}' 2>/dev/null)
 
@@ -143,7 +158,7 @@ is_uptodate()
     else
 	# Remote image optimization: check config-sha256 only
 	if podman container exists "$name"; then
-	    config_sha=$(calc_sha "$script")
+	    config_sha=$(calc_config_sha "$script")
 	    container_sha=$(podman inspect "$name" --format '{{index .Config.Labels "config-sha256"}}' 2>/dev/null)
 
 	    if [ "$container_sha" = "$config_sha" ]; then
@@ -411,10 +426,20 @@ create()
 	logging="--log-driver syslog"
     fi
 
+    # Build resource limit arguments
+    resource=""
+    if [ -n "$memory" ]; then
+	resource="$resource --memory=$memory"
+    fi
+    if [ -n "$cpu_limit" ]; then
+	resource="$resource --cpu-quota=$cpu_limit"
+    fi
+
     # When we get here we've already fetched, or pulled, the image
-    args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
+    args="$args --read-only --replace --quiet $caps"
+    args="$args --cgroups=enabled --cgroupns=host --cgroup-parent=system/container@$name"
     args="$args --restart=$restart --systemd=false --tz=local $privileged"
-    args="$args $vol $mount $hostname $entrypoint $env $port $logging"
+    args="$args $vol $mount $hostname $entrypoint $env $port $logging $resource"
     pidfile=/run/container:${name}.pid
 
     [ -n "$quiet" ] || log "---------------------------------------"
@@ -449,7 +474,7 @@ create()
 	fi
 
 	# Add config checksum label
-	args="$args --label config-sha256=$(calc_sha "$script")"
+	args="$args --label config-sha256=$(calc_config_sha "$script")"
     fi
 
     # shellcheck disable=SC2048
@@ -716,6 +741,8 @@ options:
       --log-path PATH      Path for k8s-file log pipe
   -m, --mount HOST:DEST    Bind mount a read-only file inside a container
       --manual             Do not start container automatically after creation
+      --memory BYTES       Memory limit in bytes (supports K/M/G suffix)
+      --cpu-limit LIMIT    CPU limit in millicores (1000m = 100% of 1 core)
   -n, --name NAME          Alternative way of supplying name to start/stop/restart
       --privileged         Give container extended privileges
   -p, --publish PORT       Publish ports when creating container
@@ -836,6 +863,14 @@ while [ "$1" != "" ]; do
 	--manual)
 	    manual=true
 	    ;;
+	--memory)
+	    shift
+	    memory="$1"
+	    ;;
+	--cpu-limit)
+	    shift
+	    cpu_limit="$1"
+	    ;;
 	-n | --name)
 	    shift
 	    name="$1"

board/common/rootfs/usr/share/udhcpc/default6.script

@@ -1,111 +0,0 @@
-#!/bin/sh
-# This script expects a system with resolvconf (openresolv) and iproute2
-
-[ -z "$1" ] && echo "Error: should be called from udhcpc6" && exit 1
-
-ACTION="$1"
-RESOLV_CONF="/run/resolvconf/interfaces/${interface}-ipv6.conf"
-NTPFILE="/run/chrony/dhcp-sources.d/${interface}-ipv6.sources"
-
-[ -n "$metric" ] || metric=5
-
-if [ -z "${IF_WAIT_DELAY}" ]; then
-	IF_WAIT_DELAY=10
-fi
-
-log()
-{
-    logger -I $$ -t udhcpc6 -p user.notice "${interface}: $*"
-}
-
-dbg()
-{
-    logger -I $$ -t udhcpc6 -p user.debug "${interface}: $*"
-}
-
-err()
-{
-    logger -I $$ -t udhcpc6 -p user.err "${interface}: $*"
-}
-
-clr_dhcpv6_addresses()
-{
-    addrs=$(ip -j addr show dev $interface \
-		| jq -c '.[0].addr_info[] | select(.family == "inet6") | select(.protocol == "dhcp")')
-
-    for addr in $addrs; do
-	ip="$(echo "$addr" | jq -r '."local"')"
-	prefix="$(echo "$addr" | jq -r '."prefixlen"')"
-	log "removing $ip/$prefix"
-	ip addr del "$ip/$prefix" dev "$interface"
-    done
-}
-
-log "action $ACTION"
-case "$ACTION" in
-    deconfig)
-	clr_dhcpv6_addresses
-
-	# drop info from this interface
-	rm -f "$RESOLV_CONF"
-	rm -f "$NTPFILE"
-	;;
-
-    leasefail|nak)
-	# DHCPv6 lease failed - log it
-	err "DHCPv6 lease failed"
-	;;
-
-    renew|bound)
-	# Add IPv6 address if provided (stateful DHCPv6)
-	if [ -n "$ipv6" ]; then
-	    if /bin/ip addr add dev $interface $ipv6 proto dhcp; then
-		log "assigned address $ipv6"
-	    fi
-	fi
-
-	# Handle delegated prefix (prefix delegation)
-	if [ -n "$ipv6prefix" ]; then
-	    log "received delegated prefix $ipv6prefix"
-	    # Prefix delegation handling could be added here
-	    # For now, just log it - actual routing/distribution
-	    # would need additional configuration
-	fi
-
-	# drop info from this interface
-	truncate -s 0 "$RESOLV_CONF"
-
-	# DHCPv6 domain search list (option 24)
-	if [ -n "$search" ]; then
-	    dbg "adding search $search"
-	    echo "search $search # $interface" >> $RESOLV_CONF
-	fi
-
-	# DHCPv6 DNS servers (option 23)
-	if [ -n "$dns" ]; then
-	    for i in $dns ; do
-		dbg "adding dns $i"
-		echo "nameserver $i # $interface" >> $RESOLV_CONF
-	    done
-	    resolvconf -u
-	fi
-
-	# NTP servers (option 56)
-	if [ -n "$ntpsrv" ]; then
-	    truncate -s 0 "$NTPFILE"
-	    for srv in $ntpsrv; do
-		dbg "got NTP server $srv"
-		echo "server $srv iburst" >> "$NTPFILE"
-	    done
-	    chronyc reload sources >/dev/null
-	fi
-	;;
-esac
-
-HOOK_DIR="$0.d"
-for hook in "${HOOK_DIR}/"*; do
-    [ -f "${hook}" -a -x "${hook}" ] || continue
-    "${hook}" "$ACTION"
-done
-
-exit 0

board/riscv64/linux_defconfig

@@ -358,6 +358,7 @@ CONFIG_SND_SOC_JH7110_TDM=y
 CONFIG_SND_SOC_WM8960=y
 CONFIG_SND_SIMPLE_CARD=y
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
@@ -414,6 +415,7 @@ CONFIG_PHY_STARFIVE_JH7110_DPHY_RX=y
 CONFIG_PHY_STARFIVE_JH7110_PCIE=y
 CONFIG_PHY_STARFIVE_JH7110_USB=y
 CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
@@ -451,6 +453,7 @@ CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_LSM=""
 CONFIG_CRYPTO_CCM=m

board/x86_64/linux_defconfig

@@ -53,7 +53,6 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -69,12 +68,31 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -83,15 +101,23 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
+CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -108,29 +134,69 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_IPMAC=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -191,6 +257,7 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
+CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -220,6 +287,7 @@ CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_EHCI_HCD=m
 CONFIG_USB_UHCI_HCD=m
@@ -238,7 +306,10 @@ CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FUSE_FS=y
@@ -253,8 +324,11 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_AES=y
 CONFIG_CRYPTO_GCM=y
 CONFIG_DEBUG_KERNEL=y

configs/aarch64_defconfig

@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.62"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -37,8 +37,6 @@ BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
-BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -53,7 +51,6 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
@@ -63,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -74,7 +71,6 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPERF3=y
@@ -87,7 +83,6 @@ BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
-BR2_PACKAGE_NFTABLES=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
@@ -95,6 +90,7 @@ BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -102,6 +98,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
@@ -124,7 +121,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -136,11 +133,7 @@ BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
@@ -148,7 +141,13 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
+INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
@@ -164,6 +163,7 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -177,7 +177,6 @@ BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y

configs/aarch64_minimal_defconfig

@@ -8,13 +8,14 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -26,19 +27,16 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.62"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
-BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -53,15 +51,13 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
-BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -69,7 +65,6 @@ BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
@@ -80,13 +75,16 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_GETENT=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
@@ -102,7 +100,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -113,11 +111,7 @@ BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
@@ -125,11 +119,15 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
+INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -139,6 +137,7 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -146,11 +145,8 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
-BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
 IMAGE_ITB_AUX=y
 IMAGE_ITB_QCOW=y
 IMAGE_ITB_RAUC=y

configs/arm_defconfig

@@ -3,13 +3,13 @@ BR2_cortex_a7=y
 BR2_ARM_FPU_NEON_VFPV4=y
 BR2_TOOLCHAIN_EXTERNAL=y
 BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
 BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -24,14 +24,13 @@ BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/rootfs"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/arm/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.58"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
@@ -49,42 +48,63 @@ BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
+BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
 BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FPING=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
+BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NETCAT_OPENBSD=y
+BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_NMAP=y
+BR2_PACKAGE_NMAP_NCAT=y
+BR2_PACKAGE_NMAP_NMAP=y
+BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_TRACEROUTE=y
+BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_GETENT=y
+BR2_PACKAGE_HTOP=y
+BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
@@ -100,7 +120,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -112,12 +132,17 @@ BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
@@ -135,13 +160,16 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_ONIEPROM=y
-BR2_PACKAGE_SHOW=y
+BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 IMAGE_ITB_AUX=y
 IMAGE_ITB_QCOW=y
 IMAGE_ITB_RAUC=y

configs/arm_minimal_defconfig

@@ -3,13 +3,13 @@ BR2_cortex_a7=y
 BR2_ARM_FPU_NEON_VFPV4=y
 BR2_TOOLCHAIN_EXTERNAL=y
 BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
 BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -24,14 +24,13 @@ BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/rootfs"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/arm/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.58"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
@@ -49,6 +48,7 @@ BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
@@ -59,7 +59,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -77,11 +77,13 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_GETENT=y
@@ -100,7 +102,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -112,6 +114,9 @@ BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
@@ -139,7 +144,6 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 IMAGE_ITB_AUX=y

configs/bpi_r3_emmc_boot_defconfig

@@ -37,5 +37,6 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

configs/bpi_r3_sd_boot_defconfig

@@ -37,5 +37,6 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

configs/cn9130_crb_boot_defconfig

@@ -37,5 +37,6 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

configs/nanopi_r2s_boot_defconfig

@@ -43,6 +43,7 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_BOOTLOADER_SPLASHSCREEN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

configs/riscv64_defconfig

@@ -1,5 +1,6 @@
 BR2_riscv=y
 BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
@@ -17,7 +18,6 @@ BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
-BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
@@ -36,20 +36,17 @@ BR2_LINUX_KERNEL_INTREE_DTS_NAME="starfive/jh7110-starfive-visionfive-2-v1.3b"
 BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
-BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
+BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
-BR2_PACKAGE_LINUX_FIRMWARE=y
 BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT61=y
 BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT73=y
 BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT2XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_81XX=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
@@ -60,12 +57,10 @@ BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
@@ -75,7 +70,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -86,7 +81,6 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPERF3=y
@@ -99,7 +93,6 @@ BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
-BR2_PACKAGE_NFTABLES=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
@@ -107,6 +100,7 @@ BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -114,6 +108,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
@@ -136,7 +131,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -172,11 +167,15 @@ BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visio
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
@@ -189,6 +188,7 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -202,7 +202,6 @@ BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y

configs/rpi2_boot_defconfig

@@ -17,16 +17,16 @@ BR2_SYSTEM_BIN_SH_NONE=y
 BR2_PACKAGE_RPI_FIRMWARE=y
 BR2_PACKAGE_RPI_FIRMWARE_BOOTCODE_BIN=y
 BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI=y
-BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/config.txt"
-BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/cmdline.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/config.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/cmdline.txt"
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_BAREBOX=y
 BR2_TARGET_BAREBOX_CUSTOM_VERSION=y
 BR2_TARGET_BAREBOX_CUSTOM_VERSION_VALUE="2025.06.0"
 BR2_TARGET_BAREBOX_BOARD_DEFCONFIG="rpi"
-BR2_TARGET_BAREBOX_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/barebox/extras.config"
-BR2_TARGET_BAREBOX_CUSTOM_EMBEDDED_ENV_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/barebox/env"
+BR2_TARGET_BAREBOX_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/barebox/extras.config"
+BR2_TARGET_BAREBOX_CUSTOM_EMBEDDED_ENV_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/barebox/env"
 BR2_TARGET_BAREBOX_IMAGE_FILE="images/barebox-raspberry-pi-2.img"
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_GENIMAGE=y

configs/rpi64_boot_defconfig

@@ -38,6 +38,7 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_BOOTLOADER_SPLASHSCREEN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

configs/x86_64_defconfig

@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.62"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -50,16 +50,16 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -70,7 +70,6 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPERF3=y
@@ -83,7 +82,6 @@ BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
-BR2_PACKAGE_NFTABLES=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
@@ -91,6 +89,7 @@ BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -98,6 +97,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
@@ -120,7 +120,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -139,13 +139,15 @@ BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_WIFI=y
-BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
+BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
@@ -161,6 +163,7 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -174,7 +177,6 @@ BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y

configs/x86_64_minimal_defconfig

@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.62"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,9 +34,9 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -50,13 +50,13 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -64,7 +64,6 @@ BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
@@ -75,11 +74,13 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_GETENT=y
@@ -116,6 +117,7 @@ BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
@@ -134,6 +136,7 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -141,7 +144,6 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 IMAGE_ITB_AUX=y

doc/ChangeLog.md

@@ -3,28 +3,92 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
-[v26.01.0][UNRELEASED]
+[v26.01.0][] - 2026-02-03
 -------------------------
 
+> [!IMPORTANT]
+> This release includes **breaking changes** to WiFi configuration that will
+> result in existing configuration being disabled:
+>
+> - WiFi station/client configuration has been restructured. The `wifi` container
+>   now requires a `radio` reference, and station configuration has moved under a
+>   `wifi/station` container. Existing WiFi configurations must be manually updated
+> - WiFi radios are now configured via `ietf-hardware` instead of the interfaces module
+>
+> Also, **Raspberry Pi users must upgrade the bootloader** before upgrading to
+> this release.  We recommend backing up your `startup-config.cfg` and reflash
+> the SD card with a new [sd card image][].
+
 ### Changes
 
-- Upgrade Linux kernel to 6.12.62 (LTS)
+Noteworthy changes and additions in this release are marked below in bold text.
+
+- **Upgrade Linux kernel from 6.12.65 to 6.18.8 (LTS)**
+- Upgrade Buildroot to 2025.02.10 (LTS)
 - Upgrade libyang to 4.2.2
 - Upgrade sysrepo to 4.2.10
 - Upgrade netopeer2 (NETCONF) to 2.7.0
-- Add RIPv2 routing support, issue #582
+- Add **RIPv2 routing support**, issue #582
+- Add **NTP server support**, issue #904
+- Migrate DHCPv6 client to odhcp6c for improved Router Advertisement
+  integration.  Adds support for hybrid RA+DHCPv6 deployments where SLAAC
+  assigns addresses and DHCPv6 provides DNS (common ISP scenario)
 - Add support for configurable OSPF debug logging, issue #1281. Debug options
   can now be enabled per category (bfd, packet, ism, nsm, default-information,
   nssa). All debug options are disabled by default to prevent log flooding in
   production environments. See the documentation for usage examples
+- Add support for configurable container resource limits, memory and CPU.
+  Resource usage is available through the operational datastore, where the
+  currently active resource limits in the container runtime are also available
 - Add support for "routing interfaces", issue #647.  Lists interfaces with IP
   forwarding.  Inspect from CLI using `show interface`, look for `⇅` flag
 - Add operational data journal to statd with hierarchical time-based retention
   policy, keeping snapshots from every 5 minutes (recent) to yearly (historical)
+- Add support data collection script, useful when troubleshooting issues on
+  deployed systems. Gathers system information, logs, and more.  Issue #1287
+- Add **WiFi Access Point (AP) mode with multi-SSID support and WPA2/WPA3**
+  security.  **BREAKING:** WiFi architecture refactored with radios configured
+  via `ietf-hardware` and interfaces requiring `radio` reference. Station
+  config moved to `wifi/station` container.  Existing Wi-Fi interfaces will be
+  removed during upgrade (for the rest of the configuration to apply) and you
+  need to reconfigure them again.  See the [WiFi][] documentation for details
+- Add support for **WireGuard VPN tunnels**.
+- Updated CLI change command to support `cleartext-symmetric-key` (type binary).
+  Used by both WireGuard and WiFi, with application-specific `key-format` for
+  keys and passphrases
+- New default NACM privilege levels (user levels) in `factory-config`:
+  `operator` (network & container manager) and `guest` (read-only).  For
+  details, see the updated system configuration documentation, as well as a
+  new dedicated NACM configuration guide
+- New `show nacm` admin-exec command to inspect access control rules
+- CLI now supports Ctrl-@ and Ctrl-w/Meta-w to mark and copy test regions
+- CLI now uses `copy` and `rpc` tools instead of deprecated `sysrepocfg`.  The
+  latter now also require the use of `sudo` for `admin` level users
+- Enhanced `copy` command with XPath filtering support
+- Kernel now announces details of new USB devices
 
 ### Fixes
 
-N/A
+- Fix #515: add per-interface IPv6 forwarding control using the Linux 6.17+
+  `force_forwarding` sysctl.  This provides true per-interface IPv6 forwarding
+  similar to IPv4, correctly mapping to the ietf-ip.yang model semantics
+- Fix #1082: Wi-Fi interfaces always scanned, introduce a `scan-mode` to the
+  Wi-Fi concept in Infix
+- Fix #1313: Container is not restarted if environment variable is changed
+- Fix #1314: Raspberry Pi 4B with 1 or 8 GiB RAM does not boot.  This was due
+  newer EEPROM firmware in newer boards require a newer rpi-firmware package
+- Fix #1345: firewall not updating when interfaces become bridge/lag ports
+- Fix #1346: firewall complains in syslog, missing `/etc/firewalld/firewalld.conf`
+- Fix Raspberry Pi 2B build, among other things, the `aarch32_defconfig` did
+  not include a dtb.  Please note, the platform has now been renamed to `arm`
+- Fix default password hash in `do password encrypt` command.  New hash is the
+  same as the more commonly used `change password` command, *yescrypt*
+- Prevent MOTD from showing on non-shell user login attempts
+- Fix mDNS reflector.
+
+[wifi]: https://kernelkit.org/infix/latest/wifi/
+[sd card image]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
+
 
 [v25.11.0][] - 2025-12-02
 -------------------------

doc/bridging.md

@@ -0,0 +1,284 @@
+# Bridging
+
+This is the most central part of the system.  A bridge is a switch, and
+a switch is a bridge.  In Linux, setting up a bridge with ports
+connected to physical switch fabric, means you manage the actual switch
+fabric!
+
+## MAC Bridge
+
+In Infix ports are by default not switch ports, unless the customer
+specific factory config sets it up this way.  To enable switching, with
+offloading if you have a switch chipset, between ports you create a
+bridge and then add ports to that bridge.  Like this:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface br0</b>
+admin@example:/config/interface/br0/> <b>up</b>
+admin@example:/config/> <b>set interface eth0 bridge-port bridge br0</b>
+admin@example:/config/> <b>set interface eth1 bridge-port bridge br0</b>
+admin@example:/config/> <b>leave</b>
+</code></pre>
+
+Here we add two ports to bridge `br0`: `eth0` and `eth1`.
+
+> [!TIP]
+> The CLI has several built-in helpers governed by convention.  E.g.,
+> naming bridges `brN`, where `N` is a number, the type is *inferred*
+> automatically and unlocks all bridge features.  Other conventions are
+> `vethNA`, where `N` is a number and `A` is a letter ('a' for access
+> port and 'b' for bridge side is common), and `ethN.M` for VLAN M on
+> top of `ethN`, or `dockerN` for a IP masquerading container bridge.
+>
+> Note, this inference only works with the CLI, configuring networking
+> over NETCONF or RESTCONF requires setting the type explicitly.
+
+![A MAC bridge with two ports](img/mac-bridge.svg)
+
+It is possible to create multiple MAC bridges, however, it is
+currently[^1] _not recommended_ to use more than one MAC bridge on
+products with Marvell LinkStreet switching ASICs. A VLAN filtering
+bridge should be used instead.
+
+## VLAN Filtering Bridge
+
+By default bridges in Linux do not filter based on VLAN tags.  This can
+be enabled when creating a bridge by adding a port to a VLAN as a tagged
+or untagged member.  Use the port default VID (PVID) setting to control
+VLAN association for traffic ingressing a port untagged (default PVID:
+1).
+
+<pre class="cli"><code>admin@example:/config/> <b>edit interface br0</b>
+admin@example:/config/interface/br0/> <b>up</b>
+admin@example:/config/> <b>set interface eth0 bridge-port bridge br0</b>
+admin@example:/config/> <b>set interface eth0 bridge-port pvid 10</b>
+admin@example:/config/> <b>set interface eth1 bridge-port bridge br0</b>
+admin@example:/config/> <b>set interface eth1 bridge-port pvid 20</b>
+admin@example:/config/> <b>edit interface br0</b>
+admin@example:/config/interface/br0/> <b>set bridge vlans vlan 10 untagged eth0</b>
+admin@example:/config/interface/br0/> <b>set bridge vlans vlan 20 untagged eth1</b>
+</code></pre>
+
+This sets `eth0` as an untagged member of VLAN 10 and `eth1` as an
+untagged member of VLAN 20.  Switching between these ports is thus
+prohibited.
+
+![A VLAN bridge with two VLANs](img/vlan-bridge.svg)
+
+To terminate a VLAN in the switch itself, either for switch management
+or for routing, the bridge must become a (tagged) member of the VLAN.
+
+<pre class="cli"><code>admin@example:/config/interface/br0/> <b>set bridge vlans vlan 10 tagged br0</b>
+admin@example:/config/interface/br0/> <b>set bridge vlans vlan 20 tagged br0</b>
+</code></pre>
+
+To route or to manage via a VLAN, a VLAN interface needs to be created
+on top of the bridge, see section [VLAN Interfaces](ethernet.md#vlan-interfaces)
+for more on this topic.
+
+> [!NOTE]
+> In some use-cases only a single management VLAN on the bridge is used.
+> For the example above, if the bridge itself is an untagged member only
+> in VLAN 10, IP addresses can be set directly on the bridge without the
+> need for dedicated VLAN interfaces on top of the bridge.
+
+
+## Multicast Filtering and Snooping
+
+Multicast filtering in the bridge is handled by the bridge itself.  It
+can filter both IP multicast and MAC multicast.  For IP multicast it
+also supports "snooping", i.e., IGMP and MLD, to automatically reduce
+the broadcast effects of multicast.  See the next section for a summary
+of the [terminology used](#terminology-abbreviations).
+
+> [!IMPORTANT]
+> Currently there is no way to just enable multicast filtering without
+> also enabling snooping.  This may change in the future, in which case
+> a `filtering` enabled setting will be made available along with the
+> existing `snooping` setting.
+
+When creating your bridge you must decide if you need a VLAN filtering
+bridge or a plain bridge (see previous section).  Multicast filtering is
+supported for either, but take note that it must be enabled and set up
+per VLAN when VLAN filtering is enabled -- there are no global multicast
+settings in this operating mode.
+
+In the following example we have a regular 8-port bridge without VLAN
+filtering.  We focus on the multicast specific settings:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface br0</b>
+admin@example:/config/interface/br0/> <b>set bridge multicast snooping</b>
+admin@example:/config/interface/br0/> <b>set ipv4 address 192.168.2.1 prefix-length 24</b>
+admin@example:/config/interface/br0/> <b>leave</b>
+admin@example:/> <b>copy running-config startup-config</b>
+</code></pre>
+
+Here we enable snooping and set a static IPv4 address so that the switch
+can take part in IGMP querier elections.  (MLD querier election
+currently not supported.)  We can inspect the current state:
+
+<pre class="cli"><code>admin@example:/> <b>show ip multicast</b>
+Multicast Overview
+Query Interval (default): 125 sec
+Router Timeout          : 255
+Fast Leave Ports        :
+Router Ports            :
+Flood Ports             : e0, e1, e2, e3, e4, e5, e6, e7
+
+<span class="header">Interface       VID  Querier                     State  Interval  Timeout  Ver</span>
+br0                  192.168.2.1                    Up       125     None    3
+
+<span class="header">Bridge          VID  Multicast Group       Ports                              </span>
+br0                  224.1.1.1             e3, e2
+br0                  ff02::6a              br0
+</code></pre>
+
+This is a rather small LAN, so our bridge has already become the elected
+IGMP querier.  We see it is ours because the timeout is `None`, and we
+recognize the IP address the system has detected, as ours.  We can also
+see two ports that have joined the same IPv4 multicast group, 224.1.1.1,
+and one join from the system itself for the IPv6 group ff02::6a.
+
+Now, let us see what happens when we add another bridge, this time with
+VLAN filtering enabled.  We skip the boring parts about how to move
+ports e4-e7 to `br1` and assign them to VLANs, and again, focus on the
+multicast bits only:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface br1</b>
+admin@example:/config/interface/br1/> <b>set bridge vlans vlan 1 multicast snooping</b>
+admin@example:/config/interface/br1/> <b>set bridge vlans vlan 2 multicast snooping</b>
+admin@example:/config/interface/br1/> <b>leave</b>
+admin@example:/> <b>copy running-config startup-config</b>
+</code></pre>
+
+Let us see what we get:
+
+<pre class="cli"><code>admin@example:/> <b>show ip multicast</b>
+Multicast Overview
+Query Interval (default): 125 sec
+Router Timeout          : 255
+Fast Leave Ports        : e5
+Router Ports            : e1, e2, e5, e6, e7
+Flood Ports             : e1, e2, e3, e4, e5, e6, e7, e8
+
+<span class="header">Interface       VID  Querier                     State  Interval  Timeout  Ver</span>
+br0                  192.168.2.1                    Up       125     None    3
+br1               1  0.0.0.0                        Up       125     None    3
+br1               2  0.0.0.0                        Up       125     None    3
+
+<span class="header">Bridge          VID  Multicast Group       Ports                              </span>
+br0                  224.1.1.1             e2
+br0                  ff02::fb              br0
+br0                  ff02::6a              br0
+br0                  ff02::1:ff00:0        br0
+br1               1  224.1.1.1             e5
+br1               2  224.1.1.1             e7
+br1               1  ff02::fb              br1
+br1               1  ff02::1:ff00:0        br1
+</code></pre>
+
+In this setup we have a lot more going on.  Multiple multicast router
+ports have been detected, and behind the scenes someone has also added
+an IGMP/MLD fast-leave port.
+
+### Terminology & Abbreviations
+
+ - **IGMP**: Internet Group Membership Protocol, multicast subscription
+   for IPv4, for details see [RFC3376][]
+ - **MLD**: Multicast Listener Discovery (Protocol), multicast
+   subscription for IPv6, for details see [RFC3810][]
+ - **Unknown/Unregistered multicast**: multicast groups that are *not*
+   in the multicast forwarding database (MDB)
+ - **Known/Registered multicast**: multicast groups that *are* in the
+   multicast forwarding database (MDB)
+ - **MDB**: the multicast forwarding database, consists of filters for
+   multicast groups, directing where multicast is allowed to egress.  A
+   filter entry consists of a group and a port list.  The bridge filters
+   with a unique database per VLAN, in the same was as the unicast FDB
+ - **Join/Leave**: the terminology used in earlier versions of the two
+   protocols to subscribe and unsubscribe to a multicast group.  For
+   more information, see *Membership Report*
+ - **Membership Report** A membership report is sent by end-devices and
+   forwarded by switches to the elected querier on the LAN.  They
+   consist of multiple "join" and "leave" operations on groups.  They
+   can also, per group, list which senders to allow or block.  Switches
+   usually only support the group subscription, and even more common
+   also only support filtering on the MAC level[^2]
+ - **Querier election**: the process of determining who is the elected
+   IGMP/MLD querier on a LAN.  Lowest numerical IP address wins, the
+   special address 0.0.0.0 (proxy querier) never wins
+ - **Proxy querier**: when no better querier exists on a LAN, one or
+   more devices can send proxy queries with source address 0.0.0.0 (or
+   :: for IPv6).  See **Query Interval**, below, why this is a good
+   thing
+ - **Query interval**: the time in seconds between two queries from an
+   IGMP/MLD querier.  It is not uncommon that end-devices do not send
+   their membership reports unless they first hear a query
+ - **Fast Leave**: set on a bridge port to ensure multicast is pruned as
+   quickly as possible when a "leave" membership report is received.  In
+   effect, this option marks the port as directly connected to an
+   end-device.  When not set (default), a query with timeout is first
+   sent to ensure no unintentional loss of multicast is incurred
+ - **Router port**: can be both configured statically and detected at
+   runtime based on connected devices, usually multicast routers.  On
+   a router port *all* multicast is forwarded, both known and unknown
+ - **Flood port**: set on a bridge port (default: enabled) to ensure
+   all *unknown* multicast is forwarded
+ - **Router timeout**: the time in seconds until a querier is deemed to
+   have been lost and another device (switch/router) takes over.  In the
+   tables shown above, a *None* timeout is declared when the current
+   device is the active querier
+
+> [!TIP]
+> The reason why multicast flooding is enabled by default is to ensure
+> safe co-existence with MAC multicast, which is common in industrial
+> networks.  It also allows end devices that do not know of IGMP/MLD to
+> communicate over multicast as long as the group they have chosen is
+> not used by other IGMP/MLD aware devices on the LAN.
+>
+> As soon as an IGMP/MLD membership report to "join" a group is received
+> the group is added to the kernel MDB and forwarding to other ports
+> stop.  The only exception to this rule is multicast router ports.
+>
+> If your MAC multicast forwarding is not working properly, it may be
+> because an IP multicast group maps to the same MAC address.  Please
+> see [RFC 1112][RFC1112] for details.  Use static multicast router
+> ports, or static multicast MAC filters, to mitigate.
+
+[RFC1112]: https://www.rfc-editor.org/rfc/rfc1112.html
+[RFC3376]: https://www.rfc-editor.org/rfc/rfc3376.html
+[RFC3810]: https://www.rfc-editor.org/rfc/rfc3810.html
+
+## Forwarding of IEEE Reserved Group Addresses
+
+Addresses in the range `01:80:C2:00:00:0X` are used by various bridge
+signaling protocols, and are not forwarded by default.  Still, it is
+sometimes useful to let the bridge forward such packets, this can be
+done by specifying protocol names or the last address *nibble* as
+decimal value `0..15`:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit interface br0 bridge</b>
+admin@example:/config/interface/br0/bridge/> <b>set ieee-group-forward</b>     # Tap the ? key for alternatives
+  [0..15]  List of IEEE link-local protocols to forward, e.g., STP, LLDP
+  dot1x    802.1X Port-Based Network Access Control.
+  lacp     802.3 Slow Protocols, e.g., LACP.
+  lldp     802.1AB Link Layer Discovery Protocol (LLDP).
+  stp      Spanning Tree (STP/RSPT/MSTP).
+admin@example:/config/interface/br0/bridge/> <b>set ieee-group-forward</b>
+</code></pre>
+
+The following example configures bridge *br0* to forward LLDP packets.
+
+<pre class="cli"><code>admin@example:/config/interface/br0/bridge/> <b>set ieee-group-forward lldp</b>
+admin@example:/config/interface/br0/bridge/>
+</code></pre>
+
+[^1]: MAC bridges on Marvell Linkstreet devices are currently limited to
+    a single MAC database, this may be a problem if the same MAC address
+    appears in different MAC bridges.
+[^2]: For example, IPv4 groups are mapped to MAC multicast addresses by
+    mapping the low-order 23-bits of the IP address in the low-order 23
+    bits of the Ethernet address 01:00:5E:00:00:00.  Meaning, more than
+    one IP multicast group maps to the same MAC multicast group.

doc/cli/keybindings.md

@@ -16,16 +16,22 @@ CLI has several keybindings, most significant first:
 | Meta-b  | Ctrl-Left      | Move cursor back one word                        |
 | Ctrl-e  | End            | Move cursor to end of line                       |
 | Ctrl-a  | Home           | Move cursor to beginning of line                 |
+| Ctrl-@  | Ctrl-Space     | Mark current position for region operations      |
+| Meta w  |                | Copy region to kill buffer without deleting      |
 | Ctrl-k  |                | Kill (cut) text from cursor to end of line       |
 | Ctrl-u  |                | Delete (cut) entire line                         |
 | Ctrl-y  |                | Yank (paste) from kill buffer to cursor          |
 | Meta-.  |                | Yank (paste) last argument from previous line    |
-| Ctrl-w  | Meta-Backspace | Delete (cut) word to the left                    |
+| Ctrl-w  |                | Kill region if mark set, else kill word backward |
+|         | Meta-Backspace | Delete (cut) word to the left                    |
 |         | Meta-Delete    | Delete (cut) word to the right                   |
 | Ctrl-l  |                | Clear screen and refresh current line            |
 | Ctrl-p  | Up arrow       | History, previous command                        |
 | Ctrl-n  | Down arrow     | History, next command                            |
+| Ctrl-q  | Ctrl-v         | Insert next character literally                  |
 | Ctrl-r  |                | History, reversed interactive search (i-search)  |
+| Ctrl-t  |                | Transpose/Swap characters before and at cursor   |
+| Meta-#  | Alt-Shift-3    | Prepend # to current line and submit to history  |
 
 ## What is Meta?
 

doc/container.md

@@ -92,17 +92,18 @@ your container image and application to run.
 
 Classic Hello World:
 
-    admin@example:/> container run docker://hello-world
-    Starting docker://hello-world :: use Ctrl-p Ctrl-q to detach
-    Trying to pull docker.io/library/hello-world:latest...
-    Getting image source signatures
-    Copying blob c1ec31eb5944 done
-    Copying config d2c94e258d done
-    Writing manifest to image destination
-    Storing signatures
+<pre class="cli"><code>admin@example:/> <b>container run docker://hello-world</b>
+Starting docker://hello-world :: use Ctrl-p Ctrl-q to detach
+Trying to pull docker.io/library/hello-world:latest...
+Getting image source signatures
+Copying blob c1ec31eb5944 done
+Copying config d2c94e258d done
+Writing manifest to image destination
+Storing signatures
 
-    Hello from Docker!
-    This message shows that your installation appears to be working correctly.
+Hello from Docker!
+This message shows that your installation appears to be working correctly.
+</code></pre>
 
 ### Example: Web Server
 
@@ -110,22 +111,24 @@ A web server with [nginx][], using standard docker bridge.  Podman will
 automatically create a VETH pair for us, connecting the container to the
 `docker0` bridge:
 
-    admin@example:/> configure
-    admin@example:/config/> edit interface docker0
-    admin@example:/config/interface/docker0/> set container-network
-    admin@example:/config/interface/docker0/> end
-    admin@example:/config/> edit container web
-    admin@example:/config/container/web/> set image docker://nginx:alpine
-    admin@example:/config/container/web/> set network publish 8080:80
-    admin@example:/config/container/web/> set network interface docker0
-    admin@example:/config/container/web/> set volume cache target /var/cache
-    admin@example:/config/container/web/> leave
-    admin@example:/> show container
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface docker0</b>
+admin@example:/config/interface/docker0/> <b>set container-network</b>
+admin@example:/config/interface/docker0/> <b>end</b>
+admin@example:/config/> <b>edit container web</b>
+admin@example:/config/container/web/> <b>set image docker://nginx:alpine</b>
+admin@example:/config/container/web/> <b>set network publish 8080:80</b>
+admin@example:/config/container/web/> <b>set network interface docker0</b>
+admin@example:/config/container/web/> <b>set volume cache target /var/cache</b>
+admin@example:/config/container/web/> <b>leave</b>
+admin@example:/> <b>show container</b>
+</code></pre>
 
 Exit to the shell and verify the service with curl, or try to attach
 to your device's IP address using your browser:
 
-    admin@example:~$ curl http://localhost:8080
+<pre class="cli"><code>admin@example:~$ <b>curl http://localhost:8080</b>
+</code></pre>
 
 or connect to port 8080 of your running Infix system with a browser.
 See the following sections for how to add more interfaces and manage
@@ -142,31 +145,32 @@ how to upgrade to a newer base image.
 
 The CLI help shows:
 
-    admin@example:/config/container/system/> help image
-    NAME
-        image <string>
+<pre class="cli"><code>admin@example:/config/container/system/> <b>help image</b>
+<b>NAME</b>
+    image &lt;string&gt;
 
-    DESCRIPTION
-        Docker image for the container: [transport]name[:tag|@digest]
+<b>DESCRIPTION</b>
+    Docker image for the container: [transport]name[:tag|@digest]
 
-        quay.io/username/myimage     -- Pull myimage:latest
-        docker://busybox             -- Pull busybox:latest from Docker Hub
-        docker://ghcr.io/usr/img     -- Pull img:latest from GitHub packages
-        dir:/media/usb/myimage:1.1   -- Use myimage v1.1 from USB media
-        docker-archive:/tmp/archive  -- Use archive:latest from tarball
-        oci-archive:/lib/oci/archive -- Use archive:latest from OCI archive
-                                        May be in .tar or .tar.gz format
+    quay.io/username/myimage     -- Pull myimage:latest
+    docker://busybox             -- Pull busybox:latest from Docker Hub
+    docker://ghcr.io/usr/img     -- Pull img:latest from GitHub packages
+    dir:/media/usb/myimage:1.1   -- Use myimage v1.1 from USB media
+    docker-archive:/tmp/archive  -- Use archive:latest from tarball
+    oci-archive:/lib/oci/archive -- Use archive:latest from OCI archive
+                                    May be in .tar or .tar.gz format
 
-        Additionally, the following URIs are also supported for setups
-        that do not use a HUB or similar.  Recommend using 'checksum'!
+    Additionally, the following URIs are also supported for setups
+    that do not use a HUB or similar.  Recommend using 'checksum'!
 
-        ftp://addr/path/to/archive   -- Downloaded using wget
-        http://addr/path/to/archive  -- Downloaded using curl
-        https://addr/path/to/archive -- Downloaded using curl
+    ftp://addr/path/to/archive   -- Downloaded using wget
+    http://addr/path/to/archive  -- Downloaded using curl
+    https://addr/path/to/archive -- Downloaded using curl
 
-        Note: if a remote repository cannot be reached, the creation of the
-              container will be put on a queue that retries pull every time
-              there is a route change in the host's system.
+    Note: if a remote repository cannot be reached, the creation of the
+          container will be put on a queue that retries pull every time
+          there is a route change in the host's system.
+</code></pre>
 
 > [!TIP]
 > The built-in help system in the CLI is generated from the YANG model,
@@ -198,26 +202,28 @@ mind.
 
 **Shell OCI Example:**
 
-    admin@example:~$ cd /var/tmp/
-    admin@example:/var/tmp$ sudo wget https://github.com/kernelkit/curiOS/releases/download/edge/curios-oci-amd64.tar.gz
-    Connecting to github.com (140.82.121.3:443)
-    wget: note: TLS certificate validation not implemented
-    Connecting to objects.githubusercontent.com (185.199.109.133:443)
-    saving to 'curios-oci-amd64.tar.gz'
-    curios-oci-amd64.tar 100% |*********************************| 7091k  0:00:00 ETA
-    'curios-oci-amd64.tar.gz' saved
-    admin@example:/var/tmp$ ll
-    total 7104
-    drwxr-xr-x    3 root     root          4096 Mar 27 14:22 ./
-    drwxr-xr-x   14 root     root          4096 Mar 27 11:57 ../
-    -rw-r--r--    1 root     root       7261785 Mar 27 14:22 curios-oci-amd64.tar.gz
-    drwx------    6 frr      frr           4096 Mar 27 11:57 frr/
+<pre class="cli"><code>admin@example:~$ <b>cd /var/tmp/</b>
+admin@example:/var/tmp$ <b>sudo wget https://github.com/kernelkit/curiOS/releases/download/edge/curios-oci-amd64.tar.gz</b>
+Connecting to github.com (140.82.121.3:443)
+wget: note: TLS certificate validation not implemented
+Connecting to objects.githubusercontent.com (185.199.109.133:443)
+saving to 'curios-oci-amd64.tar.gz'
+curios-oci-amd64.tar 100% |*********************************| 7091k  0:00:00 ETA
+'curios-oci-amd64.tar.gz' saved
+admin@example:/var/tmp$ <b>ll</b>
+total 7104
+drwxr-xr-x    3 root     root          4096 Mar 27 14:22 ./
+drwxr-xr-x   14 root     root          4096 Mar 27 11:57 ../
+-rw-r--r--    1 root     root       7261785 Mar 27 14:22 curios-oci-amd64.tar.gz
+drwx------    6 frr      frr           4096 Mar 27 11:57 frr/
+</code></pre>
 
 Importing the image into Podman can be done either from the CLI
 admin-exec context ...
 
-    admin@example:/var/tmp$ cli
-    admin@example:/> container load /var/tmp/curios-oci-amd64.tar.gz name curios:edge
+<pre class="cli"><code>admin@example:/var/tmp$ <b>cli</b>
+admin@example:/> <b>container load /var/tmp/curios-oci-amd64.tar.gz name curios:edge</b>
+</code></pre>
 
 > [!TIP]
 > The `name curios:edge` is the tag you give the imported (raw) archive
@@ -227,31 +233,33 @@ admin-exec context ...
 ... or by giving the container configuration the full path to the OCI
 archive, which helps greatly with container upgrades (see below):
 
-    admin@example:/config/container/system/> set image oci-archive:/var/tmp/curios-oci-amd64.tar.gz
+<pre class="cli"><code>admin@example:/config/container/system/> <b>set image oci-archive:/var/tmp/curios-oci-amd64.tar.gz</b>
+</code></pre>
 
 **Checksum Example:**
 
-    admin@example:/> configure
-    admin@example:/config/> edit container sys
-    admin@example:/config/container/sys/> set hostname sys
-    admin@example:/config/container/sys/> set image ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
-    admin@example:/config/container/sys/> set checksum
-        md5 sha256 sha512
-    admin@example:/config/container/sys/> set checksum sha256 4f01077036527498ed910f1a3e80645ae3eff629d10043cf80ebc6850c99c629
-    admin@example:/config/container/sys/> leave
-    admin@example:/> copy running-config startup-config
-    admin@example:/> show container
-    CONTAINER ID  IMAGE                                             COMMAND               CREATED         STATUS        PORTS       NAMES
-    b02e945c43c9  localhost/curios-oci-amd64-v24.05.0:latest                              5 seconds ago   Up 5 seconds              sys
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit container sys</b>
+admin@example:/config/container/sys/> <b>set hostname sys</b>
+admin@example:/config/container/sys/> <b>set image ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz</b>
+admin@example:/config/container/sys/> <b>set checksum</b>
+    md5 sha256 sha512
+admin@example:/config/container/sys/> <b>set checksum sha256 4f01077036527498ed910f1a3e80645ae3eff629d10043cf80ebc6850c99c629</b>
+admin@example:/config/container/sys/> <b>leave</b>
+admin@example:/> <b>copy running-config startup-config</b>
+admin@example:/> <b>show container</b>
+<span class="header">NAME  STATUS         NETWORK  MEMORY (KiB)  CPU%</span>
+sys   Up 5 seconds                  72/512  0.02
 
-    admin@example:/> show log
-    ...
-    Nov 20 07:24:56 example container[5040]: Fetching ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
-    Nov 20 07:24:56 example container[5040]: curios-oci-amd64-v24.05.0.tar.gz downloaded successfully.
-    Nov 20 07:24:56 example container[5040]: curios-oci-amd64-v24.05.0.tar.gz checksum verified OK.
-    Nov 20 07:24:57 example container[5040]: Cleaning up extracted curios-oci-amd64-v24.05.0
-    Nov 20 07:24:57 example container[5040]: podman create --name sys --conmon-pidfile=/run/container:sys.pid --read-only --replace --quiet --cgroup-parent=containers  --restart=always --systemd=false --tz=local --hostname sys --log-driver k8s-file --log-opt path=/run/containers/sys.fifo --network=none curios-oci-amd64-v24.05.0
-    Nov 20 07:24:57 example container[3556]: b02e945c43c9bce2c4be88e31d6f63cfdb1a3c8bdd02179376eb059a49ae05e4
+admin@example:/> <b>show log</b>
+...
+Nov 20 07:24:56 example container[5040]: Fetching ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
+Nov 20 07:24:56 example container[5040]: curios-oci-amd64-v24.05.0.tar.gz downloaded successfully.
+Nov 20 07:24:56 example container[5040]: curios-oci-amd64-v24.05.0.tar.gz checksum verified OK.
+Nov 20 07:24:57 example container[5040]: Cleaning up extracted curios-oci-amd64-v24.05.0
+Nov 20 07:24:57 example container[5040]: podman create --name sys --conmon-pidfile=/run/container:sys.pid --read-only --replace --quiet --cgroup-parent=containers  --restart=always --systemd=false --tz=local --hostname sys --log-driver k8s-file --log-opt path=/run/containers/sys.fifo --network=none curios-oci-amd64-v24.05.0
+Nov 20 07:24:57 example container[3556]: b02e945c43c9bce2c4be88e31d6f63cfdb1a3c8bdd02179376eb059a49ae05e4
+</code></pre>
 
 
 Understanding Image Tags
@@ -359,12 +367,11 @@ writable paths provided by Podman (`/dev`, `/dev/shm`, `/run`, `/tmp`,
 When using version-specific tags, you upgrade by explicitly changing the
 image reference in your configuration:
 
-```
-admin@example:/> configure
-admin@example:/config/> edit container web
-admin@example:/config/container/web/> set image docker://nginx:1.25.3
-admin@example:/config/container/web/> leave
-```
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit container web</b>
+admin@example:/config/container/web/> <b>set image docker://nginx:1.25.3</b>
+admin@example:/config/container/web/> <b>leave</b>
+</code></pre>
 
 **What happens:**
 
@@ -375,29 +382,27 @@ admin@example:/config/container/web/> leave
 
 **Example:** Upgrading from one version to another:
 
-```
-admin@example:/> configure
-admin@example:/config/> edit container system
-admin@example:/config/container/system/> show image
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit container system</b>
+admin@example:/config/container/system/> <b>show image</b>
 image ghcr.io/kernelkit/curios:v24.11.0;
-admin@example:/config/container/system/> set image ghcr.io/kernelkit/curios:v24.12.0
-admin@example:/config/container/system/> leave
-admin@example:/> show log
+admin@example:/config/container/system/> <b>set image ghcr.io/kernelkit/curios:v24.12.0</b>
+admin@example:/config/container/system/> <b>leave</b>
+admin@example:/> <b>show log</b>
 ...
 Dec 13 14:32:15 example container[1523]: Pulling ghcr.io/kernelkit/curios:v24.12.0...
 Dec 13 14:32:18 example container[1523]: Stopping old container instance...
 Dec 13 14:32:19 example container[1523]: Creating new container with updated image...
 Dec 13 14:32:20 example container[1523]: Container system started successfully
-```
+</code></pre>
 
 ### Method 2: Upgrading Mutable Tags
 
 For images using mutable tags like `:latest` or `:edge`, use the
 `container upgrade` command:
 
-```
-admin@example:/> container upgrade NAME
-```
+<pre class="cli"><code>admin@example:/> <b>container upgrade NAME</b>
+</code></pre>
 
 This command:
 
@@ -408,8 +413,7 @@ This command:
 
 **Example using registry:**
 
-```
-admin@example:/> container upgrade system
+<pre class="cli"><code>admin@example:/> <b>container upgrade system</b>
 system
 Trying to pull ghcr.io/kernelkit/curios:edge...
 Getting image source signatures
@@ -420,7 +424,7 @@ Storing signatures
 0cb6059c0f4111650ddbc7dbc4880c64ab8180d4bdbb7269c08034defc348f17
 system: not running.
 59618cc3c84bef341c1f5251a62be1592e459cc990f0b8864bc0f5be70e60719
-```
+</code></pre>
 
 **Example using local OCI archive:**
 
@@ -429,11 +433,10 @@ new archive onto the system (see Container Images section above), then,
 provided the `oci-archive:/path/to/archive` format is used in your
 configuration, call the upgrade command:
 
-```
-admin@example:/> container upgrade system
+<pre class="cli"><code>admin@example:/> <b>container upgrade system</b>
 Upgrading container system with local archive: oci-archive:/var/tmp/curios-oci-amd64.tar.gz ...
 7ab4a07ee0c6039837419b7afda4da1527a70f0c60c0f0ac21cafee05ba24b52
-```
+</code></pre>
 
 OCI archives can also be fetched from ftp/http/https URLs. In that case,
 the upgrade works the same way as a registry image — Infix downloads the
@@ -472,15 +475,16 @@ occasions where they are too restricted and users start looking for the
 
 For example, a system container from which `ping` does not work:
 
-	admin@example:/config/container/system/> edit capabilities
-	admin@example:/config/container/system/capabilities/> set add net_raw
-	admin@example:/config/container/system/capabilities/> end
-	admin@infix-00-00-00:/config/container/system/> show
-	...
-	capabilities {
-	  add net_raw;
-	}
-	...
+<pre class="cli"><code>admin@example:/config/container/system/> <b>edit capabilities</b>
+admin@example:/config/container/system/capabilities/> <b>set add net_raw</b>
+admin@example:/config/container/system/capabilities/> <b>end</b>
+admin@infix-00-00-00:/config/container/system/> <b>show</b>
+...
+capabilities {
+  add net_raw;
+}
+...
+</code></pre>
 
 Infix supports a subset of all [capabilities][6] that are relevant for
 containers.  Please note, that this is an advanced topic that require
@@ -488,6 +492,48 @@ time and analysis of your container application to figure out which
 capabilities you need.
 
 
+Resource Limits
+---------------
+
+Containers can be configured with resource limits to control their memory
+and CPU usage. This helps prevent containers from consuming excessive system
+resources and ensures fair resource allocation across multiple containers.
+
+### Configuring Resource Limits
+
+Resource limits are set per container and include:
+
+ - **Memory:** Maximum memory usage in kibibytes (KiB)
+ - **CPU:** Maximum CPU usage in millicores (1000 millicores = 1 CPU core)
+
+Example configuration limiting a container to 512 MiB of memory and 1.5 CPU cores:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit container web</b>
+admin@example:/config/container/web/> <b>edit resource-limit</b>
+admin@example:/config/container/web/resource-limit/> <b>set memory 524288</b>
+admin@example:/config/container/web/resource-limit/> <b>set cpu 1500</b>
+admin@example:/config/container/web/resource-limit/> <b>leave</b>
+</code></pre>
+
+Common CPU limit examples:
+
+ - `500` = 0.5 cores (50% of one core)
+ - `1000` = 1.0 cores (one full core)
+ - `2000` = 2.0 cores (two full cores)
+
+### Monitoring Resource Usage
+
+Runtime resource usage statistics are available in the operational datastore:
+
+<pre class="cli"><code>admin@example:/> <b>show container web</b>
+...
+</code></pre>
+
+Use `show container usage` to see resource consumption across all containers,
+including memory, CPU, block I/O, network I/O, and process counts.
+
+
 Networking and Containers
 -------------------------
 
@@ -523,10 +569,11 @@ container use seem to be so simple.
 
 All interface configuration is done in configure context.
 
-    admin@example:/> configure
-    admin@example:/config> edit interface docker0
-    admin@example:/config/interface/docker0/> set container-network
-    admin@example:/config/interface/docker0/> leave
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config> <b>edit interface docker0</b>
+admin@example:/config/interface/docker0/> <b>set container-network</b>
+admin@example:/config/interface/docker0/> <b>leave</b>
+</code></pre>
 
 There is more to this story.  When using the CLI, and sticking to common
 interface nomenclature, Infix helps you with some of the boring stuff.
@@ -534,8 +581,9 @@ E.g., creating a new interface with a name like `brN` or `dockerN`
 automatically *infers* the interface types, which you would otherwise
 have to set manually:
 
-    admin@example:/config/interface/docker0/> set type bridge
-    admin@example:/config/interface/docker0/> set container-network type bridge
+<pre class="cli"><code>admin@example:/config/interface/docker0/> <b>set type bridge</b>
+admin@example:/config/interface/docker0/> <b>set container-network type bridge</b>
+</code></pre>
 
 > [!IMPORTANT]
 > When configuring the system via an API such as NETCONF or RESTCONF, no
@@ -561,16 +609,17 @@ other networking parameters (DNS, default route) are set up.
 Some of the defaults of a container `bridge` can be changed, e.g.,
 instead of `set container-network type bridge`, above, do:
 
-    admin@example:/config/interface/docker0/> edit container-network
-    admin@example:/config/interface/docker0/container-network/> set type bridge
-    admin@example:/config/interface/docker0/container-network/> edit subnet 192.168.0.0/16
-    admin@example:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> set gateway 192.168.255.254
-    admin@example:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> end
-    admin@example:/config/interface/docker0/container-network/> edit route 10.0.10.0/24
-	admin@example:/config/interface/docker0/container-network/route/10.0.10.0/24/> set gateway 192.168.10.254
-	admin@example:/config/interface/docker0/container-network/route/10.0.10.0/24/> end
-	admin@example:/config/interface/docker0/container-network/> end
-    admin@example:/config/interface/docker0/> leave
+<pre class="cli"><code>admin@example:/config/interface/docker0/> <b>edit container-network</b>
+admin@example:/config/…/container-network/> <b>set type bridge</b>
+admin@example:/config/…/container-network/> <b>edit subnet 192.168.0.0/16</b>
+admin@example:/config/…/subnet/192.168.0.0/16/> <b>set gateway 192.168.255.254</b>
+admin@example:/config/…/subnet/192.168.0.0/16/> <b>end</b>
+admin@example:/config/…/container-network/> <b>edit route 10.0.10.0/24</b>
+admin@example:/config/…/route/10.0.10.0/24/> <b>set gateway 192.168.10.254</b>
+admin@example:/config/…/route/10.0.10.0/24/> <b>end</b>
+admin@example:/config/…/container-network/> <b>end</b>
+admin@example:/config/interface/docker0/> <b>leave</b>
+</code></pre>
 
 Other network settings, like DNS and domain, use built-in defaults, but
 can be overridden from each container.  Other common settings per
@@ -582,24 +631,25 @@ in a `bridge`.  Below an example of a system container calls `set
 network interface docker0`, here we show how to set options for that
 network:
 
-    admin@example:/config/container/ntpd/> edit network interface docker0
-    admin@example:/config/container/ntpd/network/interface/docker0/>
-    admin@example:/config/container/ntpd/network/interface/docker0/> set option
-    <string>  Options for masquerading container bridges.
-    admin@example:/config/container/ntpd/network/interface/docker0/> help option
-    NAME
-            option <string>
-    
-    DESCRIPTION
-            Options for masquerading container bridges.
+<pre class="cli"><code>admin@example:/config/container/ntpd/> <b>edit network interface docker0</b>
+admin@example:/config/…/network/interface/docker0/>
+admin@example:/config/…/network/interface/docker0/> <b>set option</b>
+&lt;string&gt;  Options for masquerading container bridges.
+admin@example:/config/…/network/interface/docker0/> <b>help option</b>
+NAME
+        option &lt;string&gt;
 
-            Example: ip=1.2.3.4            -- request a specific IP (IPv4 or IPv6)
-                     mac=00:01:02:c0:ff:ee -- set fixed MAC address in container
-                     interface_name=foo0   -- set interface name inside container
-    
-    admin@example:/config/container/ntpd/network/interface/docker0/> set option ip=172.17.0.2
-    admin@example:/config/container/ntpd/network/interface/docker0/> set option interface_name=wan
-    admin@example:/config/container/ntpd/network/interface/docker0/> leave
+DESCRIPTION
+        Options for masquerading container bridges.
+
+        Example: ip=1.2.3.4            -- request a specific IP (IPv4 or IPv6)
+                 mac=00:01:02:c0:ff:ee -- set fixed MAC address in container
+                 interface_name=foo0   -- set interface name inside container
+
+admin@example:/config/…/network/interface/docker0/> <b>set option ip=172.17.0.2</b>
+admin@example:/config/…/network/interface/docker0/> <b>set option interface_name=wan</b>
+admin@example:/config/…/network/interface/docker0/> <b>leave</b>
+</code></pre>
 
 
 ### Container Host Interface
@@ -634,14 +684,15 @@ container-end of pair `ntpd`.  This is just a convenience for us when
 reading the configuration later.  The *real action* happens on the last
 line where we declare the `ntpd` end as a container network interface:
 
-    admin@example:/config/> edit interface veth0
-    admin@example:/config/interface/veth0/> set veth peer ntpd
-    admin@example:/config/interface/veth0/> set ipv4 address 192.168.0.1 prefix-length 24
-    admin@example:/config/interface/veth0/> end
-    admin@example:/config/> edit interface ntpd
-    admin@example:/config/interface/ntpd/> set ipv4 address 192.168.0.2 prefix-length 24
-    admin@example:/config/interface/ntpd/> set custom-phys-address static 00:c0:ff:ee:00:01
-    admin@example:/config/interface/ntpd/> set container-network
+<pre class="cli"><code>admin@example:/config/> <b>edit interface veth0</b>
+admin@example:/config/interface/veth0/> <b>set veth peer ntpd</b>
+admin@example:/config/interface/veth0/> <b>set ipv4 address 192.168.0.1 prefix-length 24</b>
+admin@example:/config/interface/veth0/> <b>end</b>
+admin@example:/config/> <b>edit interface ntpd</b>
+admin@example:/config/interface/ntpd/> <b>set ipv4 address 192.168.0.2 prefix-length 24</b>
+admin@example:/config/interface/ntpd/> <b>set custom-phys-address static 00:c0:ff:ee:00:01</b>
+admin@example:/config/interface/ntpd/> <b>set container-network</b>
+</code></pre>
 
 > [!TIP]
 > Notice how you can also set a custom MAC address at the same time.
@@ -650,8 +701,9 @@ Adding the interface to the container is the same as before, but since
 everything for host interfaces is set up in the interfaces context, we
 can take a bit of a shortcut.
 
-    admin@example:/config/container/ntpd/> set network interface ntpd
-    admin@example:/config/container/ntpd/> leave
+<pre class="cli"><code>admin@example:/config/container/ntpd/> <b>set network interface ntpd</b>
+admin@example:/config/container/ntpd/> <b>leave</b>
+</code></pre>
 
 > [!TIP]
 > Use the `set network interface ntpd option interface_name=foo0` to set
@@ -672,9 +724,10 @@ pair to give our container two interfaces:
 
 We start by adding the second VETH pair:
 
-    admin@example:/config/> edit interface veth1a
-    admin@example:/config/interface/veth1a/> set veth peer veth1
-    admin@example:/config/interface/veth1a/> set ipv4 address 192.168.1.2 prefix-length 24
+<pre class="cli"><code>admin@example:/config/> <b>edit interface veth1a</b>
+admin@example:/config/interface/veth1a/> <b>set veth peer veth1</b>
+admin@example:/config/interface/veth1a/> <b>set ipv4 address 192.168.1.2 prefix-length 24</b>
+</code></pre>
 
 > [!NOTE]
 > The LAN bridge (br1) in this example has IP address 192.168.1.1.
@@ -683,20 +736,21 @@ When a container has multiple host interfaces it can often be useful to
 have a default route installed.  This can be added from the host with a
 `0.0.0.0/0` route on one of the interfaces:
 
-    admin@example:/config/interface/veth1a/> set container-network route 0.0.0.0/0 gateway 192.168.1.1
-    admin@example:/config/interface/veth1a/> show
-    type veth;
-	container-network {
-	  type host;
-	  route 0.0.0.0/0 {
-		gateway 192.168.1.1;
-	  }
-	}
-	veth {
-	  peer veth1;
-	}
-    admin@example:/config/interface/veth1a/> end
-    admin@example:/config/> set interface veth1 bridge-port bridge br1
+<pre class="cli"><code>admin@example:/config/interface/veth1a/> <b>set container-network route 0.0.0.0/0 gateway 192.168.1.1</b>
+admin@example:/config/interface/veth1a/> <b>show</b>
+type veth;
+container-network {
+  type host;
+  route 0.0.0.0/0 {
+    gateway 192.168.1.1;
+  }
+}
+veth {
+  peer veth1;
+}
+admin@example:/config/interface/veth1a/> <b>end</b>
+admin@example:/config/> <b>set interface veth1 bridge-port bridge br1</b>
+</code></pre>
 
 Please note, container network routes require the base interface also
 have a static IP address set.  Setting only the route, but no address,
@@ -722,11 +776,12 @@ It is possible to mount files, directories, and even files matching a
 glob, into a container.  This gives precise control over the container's
 file system:
 
-    admin@example:/config/container/system/> edit mount leds
-    admin@example:/config/container/system/mount/leds> set source /sys/class/leds
-    admin@example:/config/container/system/mount/leds> set target /sys/class/leds
-    admin@example:/config/container/system/mount/leds> end
-    admin@example:/config/container/system/>
+<pre class="cli"><code>admin@example:/config/container/system/> <b>edit mount leds</b>
+admin@example:/config/container/system/mount/leds> <b>set source /sys/class/leds</b>
+admin@example:/config/container/system/mount/leds> <b>set target /sys/class/leds</b>
+admin@example:/config/container/system/mount/leds> <b>end</b>
+admin@example:/config/container/system/>
+</code></pre>
 
 Any type of file can be *bind mounted* into the container, just watch
 out for permissions though.  In the example above, `/sys/class/leds` is
@@ -742,7 +797,8 @@ trigger a container restart.
 Other times *volumes* are a better fit.  A volume is an automatically
 created read-writable entity that follows the life of your container.
 
-    admin@example:/config/container/ntpd/> set volume varlib target /var/lib
+<pre class="cli"><code>admin@example:/config/container/ntpd/> <b>set volume varlib target /var/lib</b>
+</code></pre>
 
 Volumes are persistent across both reboots and upgrades of the base
 image.  They are created by Podman when the container first starts up,
@@ -772,14 +828,15 @@ where:
 To clean up unused volumes and reclaim disk space, use the admin-exec
 command:
 
-    admin@example:/> container prune
-    Deleted Images
-    ...
-    Deleted Volumes
-    ntpd-varlib
-    system-data
+<pre class="cli"><code>admin@example:/> <b>container prune</b>
+Deleted Images
+...
+Deleted Volumes
+ntpd-varlib
+system-data
 
-    Total reclaimed space: 45.2MB
+Total reclaimed space: 45.2MB
+</code></pre>
 
 The `container prune` command safely removes:
 
@@ -790,14 +847,16 @@ The `container prune` command safely removes:
 > [!TIP]
 > You can monitor container resource usage with the command:
 >
->     admin@example:/> show container usage
+> <pre class="cli"><code>admin@example:/> <b>show container usage</b>
+> </code></pre>
 >
 > This displays disk space used by images, containers, and volumes,
 > helping you decide when to run the prune command.
 >
 > To see which volumes exist and which containers use them:
 >
->     admin@example:/> show container volumes
+> <pre class="cli"><code>admin@example:/> <b>show container volumes</b>
+> </code></pre>
 
 ### Content Mounts
 
@@ -807,12 +866,13 @@ when deploying similar systems at multiple sites.  When the host loads
 its `startup-config` (or even `factory-config`) a temporary file is
 created using the decoded base64 data from the `content` node.
 
-    admin@example:/config/container/ntpd/> edit mount ntpd.conf
-    admin@example:/config/container/ntpd/mount/ntpd.conf> text-editor content
-    ... interactive editor starts up ...
-    admin@example:/config/container/ntpd/mount/ntpd.conf> set target /etc/ntpd.conf
-    admin@example:/config/container/ntpd/mount/ntpd.conf> end
-    admin@example:/config/container/ntpd/>
+<pre class="cli"><code>admin@example:/config/container/ntpd/> <b>edit mount ntpd.conf</b>
+admin@example:/config/container/ntpd/mount/ntpd.conf> <b>text-editor content</b>
+... interactive editor starts up ...
+admin@example:/config/container/ntpd/mount/ntpd.conf> <b>set target /etc/ntpd.conf</b>
+admin@example:/config/container/ntpd/mount/ntpd.conf> <b>end</b>
+admin@example:/config/container/ntpd/>
+</code></pre>
 
 The editor is a small [Emacs clone called Mg][2], see the built-in help
 text, or press Ctrl-x Ctrl-c to exit and save.  When the editor exits
@@ -836,12 +896,13 @@ Let's try out what we've learned by setting up a system container, a
 container providing multiple services, using the `docker0` interface
 we created previously:
 
-    admin@example:/> configure
-    admin@example:/config> edit container system
-    admin@example:/config/container/system/> set image ghcr.io/kernelkit/curios:edge
-    admin@example:/config/container/system/> set network interface docker0
-    admin@example:/config/container/system/> set publish 222:22
-    admin@example:/config/container/system/> leave
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config> <b>edit container system</b>
+admin@example:/config/container/system/> <b>set image ghcr.io/kernelkit/curios:edge</b>
+admin@example:/config/container/system/> <b>set network interface docker0</b>
+admin@example:/config/container/system/> <b>set publish 222:22</b>
+admin@example:/config/container/system/> <b>leave</b>
+</code></pre>
 
 > [!NOTE]
 > Ensure you have a network connection to the registry.  If the image
@@ -856,26 +917,29 @@ container configuration context for the full syntax.)
 
 Available containers can be accessed from admin-exec:
 
-    admin@example:/> show container
-    CONTAINER ID  IMAGE                          COMMAND     CREATED       STATUS       PORTS                 NAMES
-    439af2917b44  ghcr.io/kernelkit/curios:edge              41 hours ago  Up 16 hours  0.0.0.0:222->222/tcp  system
+<pre class="cli"><code>admin@example:/> <b>show container</b>
+<span class="header">NAME     STATUS        NETWORK  MEMORY (KiB)  CPU%</span>
+system   Up 16 hours   docker0       136/512  0.02
+</code></pre>
 
 This is a system container, so you can "attach" to it by starting a
 shell (or logging in with SSH):
 
-    admin@example:/> container shell system
-    root@439af2917b44:/#
+<pre class="cli"><code>admin@example:/> <b>container shell system</b>
+root@439af2917b44:/#
+</code></pre>
 
 Notice how the hostname inside the container changes.  By default the
 container ID (hash) is used, but this can be easily changed:
 
-    root@439af2917b44:/# exit
-    admin@example:/> configure
-    admin@example:/config/> edit container system
-    admin@example:/config/container/system/> set hostname sys101
-    admin@example:/config/container/system/> leave
-    admin@example:/> container shell system
-    root@sys101:/#
+<pre class="cli"><code>root@439af2917b44:/# <b>exit</b>
+admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit container system</b>
+admin@example:/config/container/system/> <b>set hostname sys101</b>
+admin@example:/config/container/system/> <b>leave</b>
+admin@example:/> <b>container shell system</b>
+root@sys101:/#
+</code></pre>
 
 In fact, the container `hostname` setting supports the same format
 specifiers as the host's `hostname` setting:
@@ -900,16 +964,17 @@ Infix currently does not have a native firewall configuration, and even
 when it does it will never expose the full capabilities of `nftables`.
 For advanced setups, the following is an interesting alternative.
 
-    admin@example:/> configure
-    admin@example:/config> edit container nftables
-    admin@example:/config/container/nftables/> set image ghcr.io/kernelkit/curios-nftables:edge
-    admin@example:/config/container/nftables/> set network host
-    admin@example:/config/container/nftables/> set privileged
-    admin@example:/config/container/nftables/> edit mount nftables.conf
-    admin@example:/config/container/nftables/mount/nftables.conf/> set target /etc/nftables.conf
-    admin@example:/config/container/nftables/mount/nftables.conf/> text-editor content
-    ... interactive editor starts up where you can paste your rules ...
-    admin@example:/config/container/nftables/mount/nftables.conf/> leave
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config> <b>edit container nftables</b>
+admin@example:/config/container/nftables/> <b>set image ghcr.io/kernelkit/curios-nftables:edge</b>
+admin@example:/config/container/nftables/> <b>set network host</b>
+admin@example:/config/container/nftables/> <b>set privileged</b>
+admin@example:/config/container/nftables/> <b>edit mount nftables.conf</b>
+admin@example:/config/…/mount/nftables.conf/> <b>set target /etc/nftables.conf</b>
+admin@example:/config/…/mount/nftables.conf/> <b>text-editor content</b>
+... interactive editor starts up where you can paste your rules ...
+admin@example:/config/…/mount/nftables.conf/> <b>leave</b>
+</code></pre>
 
 Notice how we `set network host`, so the container can see and act on
 all the host's interfaces, and that we also have to run the container
@@ -928,19 +993,20 @@ file system and store in the host's `startup-config`.  However, `ntpd`
 also saves clock drift information in `/var/lib/ntpd`, so we will also
 use volumes in this example.
 
-    admin@example:/> configure
-    admin@example:/config> edit container ntpd
-    admin@example:/config/container/ntpd/> set image ghcr.io/kernelkit/curios-ntpd:edge
-    admin@example:/config/container/ntpd/> set network interface ntpd    # From veth0 above
-    admin@example:/config/container/ntpd/> edit mount ntp.conf
-    admin@example:/config/container/ntpd/mount/ntp.conf/> set target /etc/ntp.conf
-    admin@example:/config/container/ntpd/mount/ntp.conf/> text-editor content
-    ... interactive editor starts up where you can paste your rules ...
-    admin@example:/config/container/ntpd/mount/ntp.conf/> end
-    admin@example:/config/container/ntpd/> edit volume varlib
-    admin@example:/config/container/ntpd/volume/varlib/> set target /var/lib
-    admin@example:/config/container/ntpd/volume/varlib/> leave
-    admin@example:/> copy running-config startup-config
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config> <b>edit container ntpd</b>
+admin@example:/config/container/ntpd/> <b>set image ghcr.io/kernelkit/curios-ntpd:edge</b>
+admin@example:/config/container/ntpd/> <b>set network interface ntpd</b>    # From veth0 above
+admin@example:/config/container/ntpd/> <b>edit mount ntp.conf</b>
+admin@example:/config/container/ntpd/mount/ntp.conf/> <b>set target /etc/ntp.conf</b>
+admin@example:/config/container/ntpd/mount/ntp.conf/> <b>text-editor content</b>
+... interactive editor starts up where you can paste your rules ...
+admin@example:/config/container/ntpd/mount/ntp.conf/> <b>end</b>
+admin@example:/config/container/ntpd/> <b>edit volume varlib</b>
+admin@example:/config/container/ntpd/volume/varlib/> <b>set target /var/lib</b>
+admin@example:/config/container/ntpd/volume/varlib/> <b>leave</b>
+admin@example:/> <b>copy running-config startup-config</b>
+</code></pre>
 
 The `ntp.conf` file is stored in the host's `startup-config` and any
 state data in the container's `/var/lib` is retained between reboots
@@ -975,25 +1041,28 @@ First, enable *Privileged* mode, this unlocks the door and allows the
 container to manage resources on the host system.  An example is the
 `nftables` container mentioned previously.
 
-    admin@example:/config/container/system/> set privileged
+<pre class="cli"><code>admin@example:/config/container/system/> <b>set privileged</b>
+</code></pre>
 
 Second, mount the host's `/proc/1` directory to somewhere inside your
 container.  Here we pick `/1`:
 
-	admin@example:/config/container/system/> edit mount host
-	admin@example:/config/container/system/mount/host/> set source /proc/1
-	admin@example:/config/container/system/mount/host/> set target /1
-	admin@example:/config/container/system/mount/host/> leave
+<pre class="cli"><code>admin@example:/config/container/system/> <b>edit mount host</b>
+admin@example:/config/container/system/mount/host/> <b>set source /proc/1</b>
+admin@example:/config/container/system/mount/host/> <b>set target /1</b>
+admin@example:/config/container/system/mount/host/> <b>leave</b>
+</code></pre>
 
 Third, from inside the container, use the host's PID 1 namespaces with
 the `nsenter`[^2] command to slide through the container's walls.  Here
 we show two example calls to `hostname`, first the container's own name
 and then asking what the hostname is on the host:
 
-	root@sys101:/# hostname
-	sys101
-    root@sys101:/# nsenter -m/1/ns/mnt -u/1/ns/uts -i/1/ns/ipc -n/1/ns/net hostname
-	example
+<pre class="cli"><code>root@sys101:/# <b>hostname</b>
+sys101
+root@sys101:/# <b>nsenter -m/1/ns/mnt -u/1/ns/uts -i/1/ns/ipc -n/1/ns/net hostname</b>
+example
+</code></pre>
 
 One use-case for this method is when extending Infix with a management
 container that connects to other systems.  For some tips on how to

doc/dhcp.md

@@ -19,20 +19,18 @@ servers[^1].
 The following example configures a DHCP server for subnet 192.168.2.0/24
 with an address pool:
 
-```
-admin@example:/> configure
-admin@example:/config/> edit dhcp-server subnet 192.168.2.0/24
-admin@example:/config/dhcp-server/…/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
-admin@example:/config/dhcp-server/…/192.168.2.0/24/> leave
-```
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit dhcp-server subnet 192.168.2.0/24</b>
+admin@example:/config/dhcp-server/…/192.168.2.0/24/> <b>set pool start-address 192.168.2.100 end-address 192.168.2.200</b>
+admin@example:/config/dhcp-server/…/192.168.2.0/24/> <b>leave</b>
+</code></pre>
 
 When setting up the server from the CLI, the system automatically adds a
 few default DHCP options that will be sent to clients: both DNS server
 and default gateway will use the system address on the matching
 interface.
 
-```
-admin@example:/> show running-config
+<pre class="cli"><code>admin@example:/> <b>show running-config</b>
   "infix-dhcp-server:dhcp-server": {
     "subnet": [
       {
@@ -54,7 +52,7 @@ admin@example:/> show running-config
       }
     ]
   }
-```
+</code></pre>
 
 > [!IMPORTANT]
 > Remember to set up an interface in this subnet, avoid using addresses
@@ -68,23 +66,21 @@ admin@example:/> show running-config
 To reserve specific IP addresses for clients based on their MAC address,
 hostname, or client ID:
 
-```
-admin@example:/config/dhcp-server/…/192.168.2.0/24/> edit host 192.168.2.10
-admin@example:/config/dhcp-server/…/192.168.2.10/> set match mac-address 00:11:22:33:44:55
-admin@example:/config/dhcp-server/…/192.168.2.10/> set hostname printer
-admin@example:/config/dhcp-server/…/192.168.2.10/> leave
-```
+<pre class="cli"><code>admin@example:/config/dhcp-server/…/192.168.2.0/24/> <b>edit host 192.168.2.10</b>
+admin@example:/config/dhcp-server/…/192.168.2.10/> <b>set match mac-address 00:11:22:33:44:55</b>
+admin@example:/config/dhcp-server/…/192.168.2.10/> <b>set hostname printer</b>
+admin@example:/config/dhcp-server/…/192.168.2.10/> <b>leave</b>
+</code></pre>
 
 Match hosts using a client identifier instead of MAC address:
 
-```
-admin@example:/config/dhcp-server/…/192.168.1.0/24/> edit host 192.168.1.50
-admin@example:/config/dhcp-server/…/192.168.1.50/> edit match
-admin@example:/config/dhcp-server/…/match/> set client-id hex c0:ff:ee
-admin@example:/config/dhcp-server/…/match/> leave
-admin@example:/config/dhcp-server/…/192.168.1.50/> set lease-time infinite
-admin@example:/config/dhcp-server/…/192.168.1.50/> leave
-```
+<pre class="cli"><code>admin@example:/config/dhcp-server/…/192.168.1.0/24/> <b>edit host 192.168.1.50</b>
+admin@example:/config/dhcp-server/…/192.168.1.50/> <b>edit match</b>
+admin@example:/config/dhcp-server/…/match/> <b>set client-id hex c0:ff:ee</b>
+admin@example:/config/dhcp-server/…/match/> <b>leave</b>
+admin@example:/config/dhcp-server/…/192.168.1.50/> <b>set lease-time infinite</b>
+admin@example:/config/dhcp-server/…/192.168.1.50/> <b>leave</b>
+</code></pre>
 
 The `hex` prefix here ensures matching of client ID is done using the
 hexadecimal octets `c0:ff:ee`, three bytes.  Without the prefix the
@@ -100,32 +96,30 @@ ASCII string "c0:ff:ee", eight bytes, is used.
 
 Configure additional DHCP options globally, per subnet, or per host:
 
-```
-admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit option dns-server
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/dns-server/> set address 8.8.8.8
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/dns-server/> leave
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit option ntp-server
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/ntp-server/> set address 192.168.2.1
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/ntp-server/> leave
-```
+<pre class="cli"><code>admin@example:/config/dhcp-server/> <b>edit subnet 192.168.2.0/24</b>
+admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> <b>edit option dns-server</b>
+admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/dns-server/> <b>set address 8.8.8.8</b>
+admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/dns-server/> <b>leave</b>
+admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> <b>edit option ntp-server</b>
+admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/ntp-server/> <b>set address 192.168.2.1</b>
+admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/ntp-server/> <b>leave</b>
+</code></pre>
 
 When configuring, e.g., `dns-server`, or `router` options with the value
 `auto`, the system uses the IP address from the interface matching the
 subnet.  For example:
 
-```
-admin@example:/> show interfaces
-INTERFACE       PROTOCOL   STATE       DATA
+<pre class="cli"><code>admin@example:/> <b>show interfaces</b>
+<span class="header">INTERFACE       PROTOCOL   STATE       DATA                                    </span>
 eth0            ethernet   UP          02:00:00:00:00:00
                 ipv4                   192.168.1.1/24 (static)
 eth1            ethernet   UP          02:00:00:00:00:01
                 ipv4                   192.168.2.1/24 (static)
 
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> edit option dns-server
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/option/dns-server/> set address auto
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/option/dns-server/> leave
-```
+admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> <b>edit option dns-server</b>
+admin@example:/config/dhcp-server/subnet/192.168.1.0/24/option/dns-server/> <b>set address auto</b>
+admin@example:/config/dhcp-server/subnet/192.168.1.0/24/option/dns-server/> <b>leave</b>
+</code></pre>
 
 In this case, clients in subnet 192.168.1.0/24 will receive 192.168.1.1
 as their DNS server address.
@@ -135,29 +129,27 @@ as their DNS server address.
 
 Configure DHCP for multiple networks:
 
-```
-admin@example:/> configure
-admin@example:/config/> edit dhcp-server
-admin@example:/config/dhcp-server/> edit subnet 192.168.1.0/24
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> set pool start-address 192.168.1.100 end-address 192.168.1.200
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> leave
-admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> leave
-```
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit dhcp-server</b>
+admin@example:/config/dhcp-server/> <b>edit subnet 192.168.1.0/24</b>
+admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> <b>set pool start-address 192.168.1.100 end-address 192.168.1.200</b>
+admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> <b>leave</b>
+admin@example:/config/dhcp-server/> <b>edit subnet 192.168.2.0/24</b>
+admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> <b>set pool start-address 192.168.2.100 end-address 192.168.2.200</b>
+admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> <b>leave</b>
+</code></pre>
 
 
 ## Monitoring
 
 View active leases and server statistics:
 
-```
-admin@example:/> show dhcp-server
-IP ADDRESS       MAC                HOSTNAME            CLIENT ID             EXPIRES
+<pre class="cli"><code>admin@example:/> <b>show dhcp-server</b>
+<span class="header">IP ADDRESS       MAC                HOSTNAME            CLIENT ID             EXPIRES</span>
 192.168.2.22     00:a0:85:00:02:05                      00:c0:ff:ee           3591s
 192.168.1.11     00:a0:85:00:04:06  foo                 01:00:a0:85:00:04:06  3591s
 
-admin@example:/> show dhcp-server statistics
+admin@example:/> <b>show dhcp-server statistics</b>
 DHCP offers sent                : 6
 DHCP ACK messages sent          : 5
 DHCP NAK messages sent          : 0
@@ -166,7 +158,7 @@ DHCP discover messages received : 6
 DHCP request messages received  : 5
 DHCP release messages received  : 6
 DHCP inform messages received   : 6
-```
+</code></pre>
 
 
 [^1]: This requires the system DNS resolver to be configured.

doc/ethernet.md

@@ -0,0 +1,208 @@
+# Ethernet Interfaces
+
+This document covers VLAN interfaces, physical Ethernet interfaces,
+and virtual Ethernet (VETH) pairs.
+
+
+## VLAN Interfaces
+
+Creating a VLAN can be done in many ways.  This section assumes VLAN
+interfaces created atop another Linux interface.  E.g., the VLAN
+interfaces created on top of the Ethernet interface or bridge in the
+picture below.
+
+![VLAN interface on top of Ethernet or Bridge interfaces](img/interface-vlan-variants.svg)
+
+A VLAN interface is basically a filtering abstraction. When you run
+`tcpdump` on a VLAN interface you will only see the frames matching the
+VLAN ID of the interface, compared to *all* the VLAN IDs if you run
+`tcpdump` on the lower-layer interface.
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface eth0.20</b>
+admin@example:/config/interface/eth0.20/> <b>show</b>
+type vlan;
+vlan {
+  tag-type c-vlan;
+  id 20;
+  lower-layer-if eth0;
+}
+admin@example:/config/interface/eth0.20/> <b>leave</b>
+</code></pre>
+
+The example below assumes bridge br0 is already created, see [VLAN
+Filtering Bridge](bridging.md#vlan-filtering-bridge).
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface vlan10</b>
+admin@example:/config/interface/vlan10/> <b>set vlan id 10</b>
+admin@example:/config/interface/vlan10/> <b>set vlan lower-layer-if br0</b>
+admin@example:/config/interface/vlan10/> <b>leave</b>
+</code></pre>
+
+As conventions, a VLAN interface for VID 20 on top of an Ethernet
+interface *eth0* is named *eth0.20*, and a VLAN interface for VID 10 on
+top of a bridge interface *br0* is named *vlan10*.
+
+> [!NOTE]
+> If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a
+> number, the CLI infers the interface type automatically.
+
+
+## Physical Ethernet Interfaces
+
+### Ethernet Settings and Status
+
+Physical Ethernet interfaces provide low-level settings for speed/duplex as
+well as packet status and [statistics](#ethernet-statistics).
+
+By default, Ethernet interfaces defaults to auto-negotiating
+speed/duplex modes, advertising all speed and duplex modes available.
+In the example below, the switch would by default auto-negotiate speed
+1 Gbit/s on port eth1 and 100 Mbit/s on port eth4, as those are the
+highest speeds supported by H1 and H2 respectively.
+
+![4-port Gbit/s switch connected to Gbit and Fast Ethernet Hosts](img/ethernet-autoneg.svg)
+
+The speed and duplex status for the links can be listed as shown
+below, assuming the link operational status is 'up'.
+
+<pre class="cli"><code>admin@example:/> <b>show interface eth1</b>
+name                : eth1
+index               : 2
+mtu                 : 1500
+operational status  : up
+auto-negotiation    : on
+duplex              : full
+speed               : 1000
+physical address    : 00:53:00:06:11:01
+ipv4 addresses      :
+ipv6 addresses      :
+in-octets           : 75581
+out-octets          : 43130
+...
+admin@example:/> <b>show interface eth4</b>
+name                : eth4
+index               : 5
+mtu                 : 1500
+operational status  : up
+auto-negotiation    : on
+duplex              : full
+speed               : 100
+physical address    : 00:53:00:06:11:04
+ipv4 addresses      :
+ipv6 addresses      :
+in-octets           : 75439
+out-octets          : 550704
+...
+admin@example:/>
+</code></pre>
+
+### Configuring fixed speed and duplex
+
+Auto-negotiation of speed/duplex mode is desired in almost all
+use-cases, but it is possible to disable auto-negotiation and specify
+a fixed speed and duplex mode.
+
+> [!IMPORTANT]
+> When setting a fixed speed and duplex mode, ensure both sides of the
+> link have matching configuration.  If speed does not match, the link
+> will not come up.  If duplex mode does not match, the result is
+> reported collisions and/or bad throughput.
+
+The example below configures port eth3 to fixed speed 100 Mbit/s
+half-duplex mode.
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface eth3 ethernet</b>
+admin@example:/config/interface/eth3/ethernet/> <b>set speed 0.1</b>
+admin@example:/config/interface/eth3/ethernet/> <b>set duplex half</b>
+admin@example:/config/interface/eth3/ethernet/> <b>set auto-negotiation enable false</b>
+admin@example:/config/interface/eth3/ethernet/> <b>show</b>
+auto-negotiation {
+  enable false;
+}
+duplex half;
+speed 0.1;
+admin@example:/config/interface/eth3/ethernet/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+Speed metric is in Gbit/s.  Auto-negotiation needs to be disabled in
+order for fixed speed/duplex to apply. Only speeds `0.1`(100 Mbit/s)
+and `0.01` (10 Mbit/s) can be specified. 1 Gbit/s and higher speeds
+require auto-negotiation to be enabled.
+
+### Ethernet statistics
+
+Ethernet packet statistics[^1] can be listed as shown below.
+
+<pre class="cli"><code>admin@example:/> <b>show interface eth1</b>
+name                : eth1
+index               : 2
+mtu                 : 1500
+operational status  : up
+auto-negotiation    : on
+duplex              : full
+speed               : 1000
+physical address    : 00:53:00:06:11:0a
+ipv4 addresses      :
+ipv6 addresses      :
+in-octets           : 75581
+out-octets          : 43130
+
+eth-in-frames                : 434
+eth-in-multicast-frames      : 296
+eth-in-broadcast-frames      : 138
+eth-in-error-fcs-frames      : 0
+eth-in-error-oversize-frames : 0
+eth-out-frames               : 310
+eth-out-multicast-frames     : 310
+eth-out-broadcast-frames     : 0
+eth-out-good-octets          : 76821
+eth-in-good-octets           : 60598
+admin@example:/>
+</code></pre>
+
+
+## VETH Pairs
+
+A Virtual Ethernet (VETH) pair is basically a virtual Ethernet cable.  A
+cable can be "plugged in" to a bridge and the other end can be given to
+a [container](container.md), or plugged into another bridge.
+
+The latter example is useful if you have multiple bridges in the system
+with different properties (VLAN filtering, IEEE group forwarding, etc.),
+but still want some way of communicating between these domains.
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface veth0a</b>
+admin@example:/config/interface/veth0a/> <b>set veth peer veth0b</b>
+admin@example:/config/interface/veth0a/> <b>end</b>
+admin@example:/config/> <b>diff</b>
+interfaces {
++  interface veth0a {
++    type veth;
++    veth {
++      peer veth0b;
++    }
++  }
++  interface veth0b {
++    type veth;
++    veth {
++      peer veth0a;
++    }
++  }
+}
+admin@example:/config/>
+</code></pre>
+
+> [!TIP]
+> This is another example of the automatic inference of the interface
+> type from the name.  Any name can be used, but then you have to set
+> the interface type to `veth` manually.
+
+[^1]: Ethernet counters are described in *ieee802-ethernet-interface.yang*
+    and *infix-ethernet-interface.yang*.  There is a dedicated document on
+    [Ethernet Counters](eth-counters.md) that provide additional details
+    on the statistics support.

doc/extra.css

@@ -24,3 +24,14 @@
     /* Reset alignment for table cells */
     text-align: initial;
 }
+
+/* CLI terminal output styling */
+.md-typeset pre.cli .title {
+    font-weight: bold;
+}
+
+.md-typeset pre.cli .header {
+    background-color: #e0e0e0;
+    color: #1a1a1a;
+    font-weight: bold;
+}

doc/firewall.md

@@ -93,7 +93,7 @@ about this in the [example below](#end-device-protection).
 > [!IMPORTANT] Remember IP forwarding on interfaces!
 > Firewall policies only control whether traffic is allowed on input, to be
 > forwarded, or blocked (default).  For the actual routing between interfaces
-> to work, you must also enable [IP forwarding](networking.md#ipv4-forwarding)
+> to work, you must also enable [IP forwarding](ip.md#ipv4-forwarding)
 > on the relevant interfaces.
 
 ### Intra-Zone Traffic
@@ -151,15 +151,16 @@ allowed access to.
 
 See the [examples below](#enterprise-gateway) for how to set up a policy.  The
 built-in help system can also be useful:
-<code><pre>admin@example:/config/firewall/policy/lan-to-dmz/> <b>help masquerade</b>
+
+<pre class="cli"><code>admin@example:/config/firewall/policy/lan-to-dmz/> <b>help masquerade</b>
 <b>NAME</b>
         masquerade <true/false><br/>
 <b>DESCRIPTION</b>
         Enable masquerading (SNAT) for traffic matching this policy.<br/>
         Matching traffic will have their source IP address changed on egress,
-        using the IP address of the interface the traffic egresses.";<br/>
+        using the IP address of the interface the traffic egresses.<br/>
 admin@example:/config/firewall/policy/lan-to-dmz/>
-</pre></code>
+</code></pre>
 
 ### Symbolic Names
 
@@ -229,7 +230,8 @@ The firewall includes over 100 pre-defined services, such as:
 This is the default firewall setup, useful for end devices on untrusted
 networks.  It provides maximum protection while allowing essential
 connectivity.
-<code><pre>admin@example:/> <b>configure</b>
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit firewall</b>
 admin@example:/config/firewall/> <b>show</b>
 default public;
@@ -240,21 +242,21 @@ zone public {
   service ssh;
 }
 admin@example:/config/firewall/> <b>leave</b>
-</pre></code>
+</code></pre>
 
 The `reject` action differs from `drop` in that it responds to ICMP messages,
 although maybe not how you may think.  Pinging the device we may[^1] see this:
-<code><pre>
-<b>$</b> ping 192.168.122.161
+
+<pre class="cli"><code><b>$</b> ping 192.168.122.161
 From 192.168.122.161 icmp_seq=1 <u>Packet filtered</u>
-</pre></code>
+</code></pre>
 
 If we run `tcpdump` it shows us why:
-<code><pre>
-<b>$</b> tcpdump -lni eth0
+
+<pre class="cli"><code><b>$</b> tcpdump -lni eth0
 20:10:40.245707 IP 192.168.122.1 > 192.168.122.161: ICMP echo request, id 56838, seq 1, length 64
 20:10:40.245961 IP 192.168.122.161 > 192.168.122.1: ICMP <u>host 192.168.122.161 unreachable - admin prohibited filter</u>, length 92
-</pre></code>
+</code></pre>
 
 The key here is that, yes the device responds, but not with `ICMP reply` but
 `ICMP unreachable`, and a little helpful message.
@@ -285,7 +287,8 @@ Zone matrix and firewall overview from <kbd>show firewall</kbd>.
 For typical routers that need to protect internal devices while providing
 internet access.  The LAN zone trusts internal devices, while the WAN zone
 blocks external threats.
-<code><pre>admin@example:/> <b>configure</b>
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit firewall</b>
 admin@example:/config/firewall/> <b>set default wan</b>
 admin@example:/config/firewall/> <b>edit zone lan</b>
@@ -308,14 +311,15 @@ admin@example:/config/firewall/…/loc-to-wan/> <b>set egress wan</b>
 admin@example:/config/firewall/…/loc-to-wan/> <b>set action accept</b>
 admin@example:/config/firewall/…/loc-to-wan/> <b>set masquerade</b>
 admin@example:/config/firewall/…/loc-to-wan/> <b>leave</b>
-</pre></code>
+</code></pre>
 
 ### Enterprise Gateway
 
 For businesses that need to host public services while protecting internal
 resources.  We can build upon the Home/Office Router example above and add
 a DMZ zone with additional policies for controlled access.
-<code><pre>admin@example:/> <b>configure</b>
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit firewall zone dmz</b>
 admin@example:/config/firewall/…/dmz/> <b>set description "Semi-trusted public services"</b>
 admin@example:/config/firewall/…/dmz/> <b>set action drop</b>
@@ -339,7 +343,7 @@ admin@example:/config/firewall/> <b>edit zone wan port-forward 8080 tcp</b>
 admin@example:/config/firewall/…/tcp/> <b>set to addr 192.168.2.10</b>
 admin@example:/config/firewall/…/tcp/> <b>set to port 80</b>
 admin@example:/config/firewall/…/tcp/> <b>leave</b>
-</pre></code>
+</code></pre>
 
 This adds a DMZ zone for public services, updates the internet access policy
 to include DMZ traffic, allows LAN management of DMZ services, and forwards
@@ -349,12 +353,12 @@ external web traffic to the DMZ server.
 
 Different log levels are available to monitor and debug firewall behavior.
 Configure logging using the CLI:
-<code><pre>
-admin@example:/> <b>configure</b>
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit firewall</b>
 admin@example:/config/firewall/> <b>set logging all</b>
 admin@example:/config/firewall/> <b>leave</b>
-</pre></code>
+</code></pre>
 
 Firewall logs help you understand traffic patterns and security events.  The
 CLI admin-exec command <kbd>show firewall</kbd> shows the last 10 log messages in the
@@ -457,4 +461,4 @@ You can check the current lockdown state:
 }
 ```
 
-[1]: networking.md#bridging
+[1]: bridging.md

doc/hardware.md

@@ -8,7 +8,7 @@ hardware][1], with deviations and augmentations in _infix-hardware_.
 For Infix to be able to control USB port(s), a device tree modification
 is needed (see _alder.dtsi_ for full example).
 
-```
+```json
  chosen {
    infix {
      usb-ports = <&cp0_usb3_1>;
@@ -24,26 +24,38 @@ All USB ports in the system will be disabled during boot due to the file
 Infix to control USB port(s), remove the file or manually enable the USB
 bus, here is an example:
 
-```
+```bash
 # Enable the bus
 echo 1 > /sys/bus/usb/devices/usb1/authorized
 ```
 
 And then enable sub-devices (e.g. USB memory)
 
-```
+```bash
 # Enable a device plugged into usb1
 echo 1 >  /sys/bus/usb/devices/usb1/1-1/authorized
 ```
 
 ### Current status
 
-```
-admin@example:/> show hardware
- USB PORTS
- NAME                STATE
- USB                 unlocked
-```
+<pre class="cli"><code>admin@example:/> <b>show hardware</b>
+<span class="header">HARDWARE COMPONENTS                                           </span>
+──────────────────────────────────────────────────────────────
+<span class="title">Board Information                                            </span>
+Model               : FriendlyElec NanoPi R2S
+Manufacturer        : FriendlyElec
+Serial Number       : 9d1fbfdab6d171ce
+Base MAC Address    : 4a:dc:d8:20:0d:85
+──────────────────────────────────────────────────────────────
+<span class="title">USB Ports                                                    </span>
+<span class="header">NAME                                         STATE     OPER   </span>
+USB                                          unlocked  enabled
+──────────────────────────────────────────────────────────────
+<span class="title">Sensors                                                      </span>
+<span class="header">NAME                          VALUE                 STATUS    </span>
+soc                           44.1 °C               ok        
+soc                           44.5 °C               ok        
+</code></pre>
 
 An USB port can be in two states _unlocked_ and _locked_. When a port is
 locked, all connected devices will get power, but never authorized by
@@ -56,12 +68,11 @@ Linux to use.
 > command `show hardware` in admin-exec context.  (Use `do` prefix in
 > configure context.)
 
-```
-admin@example:/> configure
-admin@example:/config/> set hardware component USB state admin-state unlocked
-admin@example:/config/> leave
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>set hardware component USB state admin-state unlocked</b>
+admin@example:/config/> <b>leave</b>
 admin@example:/>
-```
+</code></pre>
 
 ### Using a USB Stick
 
@@ -81,8 +92,7 @@ The only way currently to safely "eject" a USB memory stick is to use
 `umount` command from a UNIX shell, which explicitly synchronizes any
 cached data to disk before returning the prompt:
 
-```
-admin@example:~$ sudo umount /media/log
-```
+<pre class="cli"><code>admin@example:~$ <b>sudo umount /media/log</b>
+</code></pre>
 
 [1]:  https://www.rfc-editor.org/rfc/rfc8348.html