Merge pull request #986 from kernelkit/mvpp2-tcam-fix

Fix `mvpp2` TCAM memory corruption

.github/SECURITY.md

@@ -1,26 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-If you discover a security vulnerability in Infix, please use GitHub's built-in
-[Report a Vulnerability](https://github.com/kernelkit/infix/security/advisories/new)
-feature for a private and secure disclosure.
-
-When reporting, include:
-
-- A clear description of the vulnerability.
-- Steps to reproduce the issue.
-- Potential impact of the vulnerability.
-
-## Supported Versions
-
-We provide security updates only for the main branch.
-
-Individual support contracts are provided by _Wires_. See
-[Support](https://github.com/kernelkit/infix/blob/main/.github/SUPPORT.md)
-for more information.
-
-## Acknowledgments
-
-We appreciate the efforts of the security community to help improve the security
-of Infix. Thank you for your responsible disclosure.

.github/SUPPORT.md

@@ -6,7 +6,7 @@ project on GitHub, and Discord, see <https://github.com/kernelkit>:
 
 Support contracts, development of new features, fast-tracking of reviews
 and contributions, customer branding of Infix, and even customer specific
-features for dedicated products is provided by _Wires_.
+features for dedicated products is provided by Addiva Elektronik.
 
-&nbsp;&nbsp; :globe_with_meridians: <https://www.wires.se>  
-&nbsp;&nbsp; :e-mail: <mailto:infix@wires.se>
+&nbsp;&nbsp; :globe_with_meridians: <https://www.addiva.se/electronics/>  
+&nbsp;&nbsp; :e-mail: <mailto:ael@addiva.se>

.github/workflows/build.yml

@@ -1,54 +1,27 @@
-name: Build
+name: Bob the Builder
 
 on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches:
+      - main
   workflow_dispatch:
     inputs:
-      flavor:
-        description: 'Optional build flavor (e.g. _minimal)'
-        required: false
-        default: ''
-        type: string
-      parallel:
-        description: 'Massive parallel build of each image'
+      minimal:
+        description: 'Build minimal defconfigs'
         required: false
         default: true
         type: boolean
-      infix_repo:
-        description: 'Repo to checkout (for spin overrides)'
-        required: false
-        default: kernelkit/infix
-        type: string
-
-
-  workflow_call:
-    inputs:
-      target:
-        required: true
-        type: string
-      name:
-        required: true
-        type: string
-      flavor:
-        required: false
-        type: string
-        default: ''
-      infix_repo:
-        required: false
-        type: string
-        default: kernelkit/infix
-
-env:
-  FLV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.flavor || inputs.flavor }}
-  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
 
 jobs:
   build:
-    name: Build ${{ inputs.name }} ${{ inputs.target }}
+    name: Build Infix ${{ matrix.target }}
     runs-on: [ self-hosted, latest ]
     strategy:
+      matrix:
+        target: [aarch64, x86_64]
       fail-fast: false
-    outputs:
-      build_id: ${{ steps.vars.outputs.INFIX_BUILD_ID }}
     steps:
       - name: Cleanup Build Folder
         run: |
@@ -57,36 +30,34 @@ jobs:
           rm -rf ./.??* || true
           ls -la ./
 
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
         with:
-          repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
           clean: true
-          fetch-depth: 0
           submodules: recursive
 
       - name: Set Build Variables
         id: vars
         run: |
-          if [ -n "${{ github.event.pull_request.head.sha }}" ]; then
-              # Since PRs are built from an internally generated merge
-              # commit, reverse lookups of PRs and/or commits from
-              # image version information are cumbersome.  Therefore:
-              # explicitly set a build id that references both the PR
-              # and the commit.
-              printf "INFIX_BUILD_ID=pr%d.%.7s\n" \
-                  "${{ github.event.number }}" "${{ github.event.pull_request.head.sha }}" \
-                  | tee -a $GITHUB_OUTPUT $GITHUB_ENV
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+              if [ "${{ github.event.inputs.minimal }}" == "true" ]; then
+                  flavor="_minimal"
+              fi
+          else
+              # Ensure 'release' job get the proper image when building main
+              if [ "$GITHUB_REF_NAME" != "main" ]; then
+                  flavor="_minimal"
+              else
+                  flavor=""
+              fi
+              if ${{ contains(github.event.pull_request.labels.*.name, 'ci:main') }}; then
+                  flavor=""
+              fi
           fi
-
-          target=${{ inputs.target }}
-          name=${{ inputs.name }}
-          echo "dir=${name}-${target}"        >> $GITHUB_OUTPUT
-          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
-          echo "flv=$FLV"              >> $GITHUB_OUTPUT
-          echo "Building target ${target}${FLV}_defconfig"
-
+          target=${{ matrix.target }}
+          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+          echo "flv=$flavor"              >> $GITHUB_OUTPUT
+          echo "Building target ${target}${flavor}_defconfig"
       - name: Restore Cache of dl/
         uses: actions/cache@v4
         with:
@@ -99,37 +70,23 @@ jobs:
         uses: actions/cache@v4
         with:
           path: .ccache/
-          key: ccache-${{ inputs.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
           restore-keys: |
-            ccache-${{ inputs.target }}-
+            ccache-${{ matrix.target }}-
             ccache-
 
-      - name: Configure ${{ inputs.target }}${{ steps.vars.outputs.flv }}
+      - name: Configure ${{ matrix.target }}${{ steps.vars.outputs.flv }}
         run: |
-          make ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig
+          make ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig
 
-      - name: Unit Test ${{ inputs.target }}
+      - name: Unit Test ${{ matrix.target }}
         run: |
           make test-unit
 
-      - name: Prepare parallel build
-        id: parallel
+      - name: Build ${{ matrix.target }}${{ steps.vars.outputs.flv }}
         run: |
-
-          if [ "${{ ((github.event.inputs.parallel == 'true' && github.event_name == 'workflow_dispatch') || (github.ref_name != 'main' && github.event_name != 'workflow_dispatch')) }}" == "true" ]; then
-             echo "BR2_PER_PACKAGE_DIRECTORIES=y" >> output/.config
-             MAKE="make -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
-             echo "Building in parallel with -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
-          else
-             echo "Disabling parallel build"
-             MAKE="make"
-          fi
-          echo "MAKE=$MAKE" >> $GITHUB_OUTPUT
-
-      - name: Build ${{ inputs.target }}${{ steps.vars.outputs.flv }}
-        run: |
-          echo "Building ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
-          eval "${{ steps.parallel.outputs.MAKE }}"
+          echo "Building ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
+          make
 
       - name:  Check SBOM from Build
         run: |
@@ -150,14 +107,100 @@ jobs:
           printf "Size of output/images/: "
           ls -l output/images/
 
-      - name: Prepare ${{ inputs.target }} Artifact
+      - name: Prepare ${{ matrix.target }} Artifact
         run: |
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
       - uses: actions/upload-artifact@v4
         with:
           path: output/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ inputs.target }}
+          name: artifact-${{ matrix.target }}
+
+  test:
+    name: Regression Test of Infix x86_64
+    needs: build
+    runs-on: [ self-hosted, regression ]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          clean: true
+          submodules: recursive
+
+      - name: Set Build Variables
+        id: vars
+        run: |
+          if [ "$GITHUB_REF_NAME" != "main" ]; then
+              flavor="_minimal"
+          else
+              flavor=""
+          fi
+          echo "flv=$flavor"              >> $GITHUB_OUTPUT
+
+      - name: Configure x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          make x86_64${{ steps.vars.outputs.flv }}_defconfig
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
+        run: |
+          ls -l
+          mkdir -p output
+          mv infix-x86_64.tar.gz output/
+          cd output/
+          tar xf infix-x86_64.tar.gz
+          ln -s infix-x86_64 images
+
+      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          make test
+
+      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: cat test/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+
+  release:
+    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
+    name: Upload Latest Build
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          omitName: true
+          omitBody: true
+          omitBodyDuringUpdate: true
+          prerelease: true
+          tag: "latest"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          artifacts: "*.tar.gz*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Latest Build Complete! :rocket:
+
+          For the public download links of these build artifacts, please see:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+          EOF

.github/workflows/coverity.yml

@@ -55,7 +55,7 @@ jobs:
           sudo apt-get -y update
           sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                        libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev
+                       libuev-dev libite-dev
 
       - name: Build dependencies
         run: |
@@ -65,8 +65,6 @@ jobs:
           git clone https://github.com/sysrepo/sysrepo.git
           mkdir sysrepo/build
           (cd sysrepo/build && cmake .. && make all && sudo make install)
-          git clone https://github.com/troglobit/libite.git
-          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
           make dep
 
       - name: Check applications

.github/workflows/publish.yml

@@ -1,43 +0,0 @@
-name: Publish latest Infix
-
-on:
-  workflow_dispatch:
-  workflow_call:
-
-jobs:
-  publish:
-    name: Upload Latest Build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
-      - uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Latest Build Complete! :rocket:
-
-          For the public download links of these build artifacts, please see:
-           <https://github.com/kernelkit/infix/releases/tag/latest>
-          EOF

.github/workflows/release.yml

@@ -85,21 +85,16 @@ jobs:
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
           mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+          tar chfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
 
       - uses: actions/upload-artifact@v4
         with:
           name: artifact-${{ matrix.target }}
           path: output/*.tar.gz
 
-      - uses: actions/upload-artifact@v4
-        with:
-          name: artifact-disk-image-${{ matrix.target }}
-          path: output/images/*.qcow2
-
   release:
     name: Release Infix ${{ github.ref_name }}
     needs: build
@@ -146,11 +141,6 @@ jobs:
           for file in *.tar.gz; do
               sha256sum $file > $file.sha256
           done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi
 
       - name: Extract ChangeLog entry ...
         run: |
@@ -165,7 +155,7 @@ jobs:
           makeLatest: ${{ steps.rel.outputs.latest }}
           discussionCategory: ${{ steps.rel.outputs.cat }}
           bodyFile:  release.md
-          artifacts: "*.tar.gz*,*.qcow2*"
+          artifacts: "*.tar.gz*"
 
       - name: Summary
         run: |

.github/workflows/test.yml

@@ -1,116 +0,0 @@
-name: Test Infix
-
-on:
-  workflow_dispatch:
-    inputs:
-      infix_repo:
-        description: 'Repo to checkout (for spin overrides)'
-        required: false
-        default: kernelkit/infix
-        type: string
-
-  workflow_call:
-    inputs:
-      target:
-        required: true
-        type: string
-      name:
-        required: true
-        type: string
-      flavor:
-        required: false
-        type: string
-        default: ''
-      infix_repo:
-        required: false
-        type: string
-        default: kernelkit/infix
-      ninepm-conf:
-        required: false
-        type: string
-        default: ''
-      test-path:
-        required: false
-        type: string
-        default: 'test'
-
-env:
-  FLV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.flavor || inputs.flavor }}
-  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
-  NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
-  TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}
-
-jobs:
-  test:
-    name: Regression Test ${{ inputs.name }} ${{ inputs.target }}
-    runs-on: [ self-hosted, regression ]
-    steps:
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
-        with:
-          repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
-          clean: true
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
-              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
-                   >>$GITHUB_ENV
-          fi
-
-          echo "flv=$FLV" >> $GITHUB_OUTPUT
-
-      - name: Configure ${{ inputs.target }}${{ steps.vars.outputs.flv }}
-        run: |
-          make ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig
-
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
-        run: |
-          target=${{ inputs.target }}
-          name=${{ inputs.name }}
-
-          ls -l
-          mkdir -p output
-          mv ${name}-${target}.tar.gz output/
-          cd output/
-          tar xf ${name}-${target}.tar.gz
-          ln -s ${name}-${target} images
-
-      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          if [ -n "$NINEPM_CONF" ]; then
-            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
-            echo "DEBUG: NINEPM_PROJ_CONFIG is '$NINEPM_PROJ_CONFIG'"
-          fi
-          make test
-
-      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: |
-          asciidoctor-pdf \
-          --theme $TEST_PATH/9pm/report/theme.yml \
-          -a pdf-fontsdir=$TEST_PATH/9pm/report/fonts \
-          $TEST_PATH/.log/last/report.adoc \
-          -o $TEST_PATH/.log/last/report.pdf
-
-      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-report
-          path: ${{ env.TEST_PATH }}/.log/last/report.pdf
-

.github/workflows/trigger.yml

@@ -1,37 +0,0 @@
-name: Self Trigger
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches:
-      - main
-      - ci-workflow-redesign
-  workflow_dispatch:
-
-jobs:
-  build-x86_64:
-    uses: ./.github/workflows/build.yml
-    with:
-      target: "x86_64"
-      name: "infix"
-      flavor: "_minimal"
-
-  build-aarch64:
-    uses: ./.github/workflows/build.yml
-    with:
-      target: "aarch64"
-      name: "infix"
-      flavor: "_minimal"
-
-  test-run-x86_64:
-    needs: build-x86_64
-    uses: ./.github/workflows/test.yml
-    with:
-      target: "x86_64"
-      name: "infix"
-
-  test-publish-x86_64:
-    needs: test-run-x86_64
-    uses: ./.github/workflows/publish.yml
-

Config.in

@@ -65,7 +65,7 @@ config INFIX_COMPATIBLE
 
 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix OS — Immutable.Friendly.Secure"
+	default "Infix -- a Network Operating System"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.

README.md

@@ -2,11 +2,11 @@
 
 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 
-Infix is a free, Linux-based, immutable operating system built around
-[Buildroot][1] and [sysrepo][2].  A powerful mix that ease porting to
-different platforms, simplify long-term maintenance, and provide
-made-easy management using NETCONF, RESTCONF[^2], or the built-in
-command line interface (CLI) from a console or SSH login.
+Infix is a free, Linux based, immutable Network Operating System (NOS)
+built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
+porting to different platforms, simplify long-term maintenance, and
+provide made-easy management using NETCONF, RESTCONF[^2], or the
+built-in command line interface (CLI) from a console or SSH login.
 
 > Click the **▶ Example CLI Session** foldout below for an example, or
 > head on over to the [Infix Documentation](doc/README.md) for more
@@ -27,15 +27,13 @@ it maintenance-free.  Configuration and data, e.g, containers, is stored
 on separate partitions to ensure complete separation from system files
 and allow for seamless backup, restore, and provisioning.
 
-In itself, Infix is perfectly suited for dedicated networking tasks,
-such as routing, switching, and monitoring.  This is how it started, as
-a network focused operating system.  Now, with native support for Docker
-containers, it provides a versatile platform that can easily be adapted
-to any customer need.  Be it legacy applications, network protocols,
-process monitoring, or edge data analysis, it can run close to end
-equipment.  Either directly connected on dedicated Ethernet ports or
-indirectly using virtual network cables to exist on the same LAN as
-other connected equipment.
+In itself, Infix is perfectly suited for dedicated networking tasks, and
+with native support for Docker containers, the operating system provides
+a versatile platform that can easily be adapted to any customer need.
+Be it legacy applications, network protocols, process monitoring, or
+edge data analysis, it can run close to end equipment.  Either directly
+connected on dedicated Ethernet ports or indirectly using virtual
+network cables to exist on the same LAN as other connected equipment.
 
 The simple design of Infix provides complete control over both system
 and data, minimal cognitive burden, and makes it incredibly easy to get
@@ -95,14 +93,12 @@ The [following boards](board/aarch64/README.md) are fully supported:
  - Marvell CN9130 CRB
  - Marvell EspressoBIN
  - Microchip SparX-5i PCB135 (eMMC)
- - Raspberry Pi 4B
+ - StarFive VisionFive2
  - NanoPi R2S
 
-Additionally, StarFive VisionFive2, a RISC-V based two-port router, and
-an x86_64 build is also available.  The latter is primarily intended for
-development and testing, but can also be used for evaluation and demo
-purposes.  For more information, see: [Infix in Virtual
-Environments](doc/virtual.md).
+An x86_64 build is also available, primarily intended for development
+and testing, but can also be used for evaluation and demo purposes.  For
+more information, see: [Infix in Virtual Environments](doc/virtual.md).
 
 > See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
 > page for our pre-built images.  The *[Latest Build][]* has bleeding
@@ -110,16 +106,6 @@ Environments](doc/virtual.md).
 >
 > For *customer specific builds* of Infix, see your product repository.
 
-
-----
-
-<div align="center">
-  <a href="https://github.com/wires-se"><img src="https://raw.githubusercontent.com/wires-se/.github/main/profile/logo.png" width=300></a>
-  <br />Infix development is sponsored by <a href="https://wires.se">Wires<a>
-</div>
-
-----
-
 [^1]: An immutable operating system is one with read-only file systems,
     atomic updates, rollbacks, declarative configuration, and workload
     isolation.  All to improve reliability, scalability, and security.

board/aarch64/cn9130-crb/README.md

@@ -128,9 +128,5 @@ SD-card partition.
 > If possible, serve `infix-aarch64.pkg` over HTTP instead, as
 > libcurl's TFTP implementation is quite slow.
 
-## Console Port
-
-The console port runs at 115200 baud, 8N1.
-
 [release]: https://github.com/kernelkit/infix/releases
 [mvebu64boot]: https://github.com/addiva-elektronik/mvebu64boot

board/aarch64/dts/marvell/cn9130-crb-A.dts

@@ -3,7 +3,7 @@
  * Copyright (C) 2020 Marvell International Ltd.
  */
 
-#include "arm64/marvell/cn9130-crb.dtsi"
+#include "cn9130-crb.dtsi"
 
 / {
 	model = "Marvell Armada CN9130-CRB-A";

board/aarch64/dts/marvell/cn9130-patched.dtsi

@@ -1,4 +1,4 @@
-#include <arm64/marvell/cn9130.dtsi>
+#include "cn9130.dtsi"
 
 &cp0_syscon0 {
 	cp0_pinctrl: pinctrl {

board/aarch64/dts/microchip/sparx5_pcb135_emmc_no_psci.dts

@@ -5,7 +5,7 @@
  */
 
 /dts-v1/;
-#include <arm64/microchip/sparx5_pcb135_emmc.dts>
+#include "sparx5_pcb135_emmc.dts"
 
 &cpu0 {
 	enable-method = "spin-table";

board/aarch64/linux_defconfig

@@ -34,10 +34,6 @@ CONFIG_PROFILING=y
 CONFIG_ARCH_SPARX5=y
 CONFIG_ARCH_MVEBU=y
 CONFIG_ARCH_VEXPRESS=y
-CONFIG_ARM64_ERRATUM_2441007=y
-CONFIG_ARM64_ERRATUM_1286807=y
-CONFIG_ARM64_ERRATUM_1542419=y
-CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
 CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
@@ -61,7 +57,6 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CMA=y
-CONFIG_CMA_AREAS=7
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_XDP_SOCKETS=y
@@ -170,6 +165,7 @@ CONFIG_BRIDGE_EBT_REDIRECT=m
 CONFIG_BRIDGE_EBT_SNAT=m
 CONFIG_BRIDGE_EBT_LOG=m
 CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BPFILTER=y
 CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_BRIDGE_MRP=y
@@ -231,7 +227,6 @@ CONFIG_SCSI_SAS_ATA=y
 CONFIG_SCSI_VIRTIO=y
 CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
-CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
 CONFIG_AHCI_MVEBU=y
 CONFIG_PATA_OF_PLATFORM=y
@@ -287,7 +282,6 @@ CONFIG_NET_DSA_MV88E6XXX_PTP=y
 CONFIG_MVNETA=m
 CONFIG_MVPP2=m
 # CONFIG_NET_VENDOR_MELLANOX is not set
-# CONFIG_NET_VENDOR_META is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 CONFIG_SPARX5_SWITCH=y
 # CONFIG_NET_VENDOR_MICROSEMI is not set
@@ -359,14 +353,13 @@ CONFIG_SERIAL_XILINX_PS_UART=y
 CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
 CONFIG_SERIAL_MVEBU_UART=y
 CONFIG_VIRTIO_CONSOLE=y
-CONFIG_HW_RANDOM_CN10K=m
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_GPIO=y
 CONFIG_I2C_MUX_PCA954x=y
 CONFIG_I2C_MUX_PINCTRL=y
-CONFIG_I2C_DESIGNWARE_CORE=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_MV64XXX=y
 CONFIG_I2C_SLAVE=y
 CONFIG_SPI=y
@@ -502,7 +495,6 @@ CONFIG_EXTCON_USB_GPIO=y
 CONFIG_IIO=y
 CONFIG_TI_ADC081C=y
 CONFIG_PWM=y
-CONFIG_RESET_GPIO=y
 CONFIG_PHY_MVEBU_CP110_COMPHY=y
 CONFIG_PHY_MVEBU_CP110_UTMI=y
 CONFIG_PHY_SAMSUNG_USB2=y
@@ -531,13 +523,13 @@ CONFIG_9P_FS=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_SECURITY=y
-CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
 CONFIG_CRYPTO_SHA1_ARM64_CE=y
 CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0

board/aarch64/r2s/README.md

@@ -101,13 +101,6 @@ Worth noting, unlike many other boards, the Rockchip family of chipsets
 runs the UART at 1500000 bps (1.5 Mbps) 8N1.
 
 
-Console Port
-------------
-
-Unlike many other boards, the NanoPi R2S console, and in fact all
-Rockchip family chipsets, runs at 1500000 bps (1.5 Mbps) 8N1. 
-
-
 Secure Boot
 -----------
 

board/aarch64/r2s/linux_defconfig

@@ -230,6 +230,7 @@ CONFIG_MAC80211_LEDS=y
 CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
+# CONFIG_ETHTOOL_NETLINK is not set
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
@@ -480,6 +481,7 @@ CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_GPIO=m
 CONFIG_I2C_RK3X=y
 CONFIG_I2C_SLAVE=y

board/aarch64/rpi/bcm2711-rpi-4-b-dts.patch

@@ -1,14 +0,0 @@
---- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts	2025-04-28 00:13:06.880003668 +0200
-+++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts	2025-04-28 00:14:17.708941263 +0200
-@@ -14,6 +14,11 @@
- 	chosen {
- 		/* 8250 auxiliary UART instead of pl011 */
- 		stdout-path = "serial1:115200n8";
-+
-+		infix {
-+			/* Default admin user password: 'admin' */
-+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
-+		};
- 	};
- 
- 	cam1_reg: regulator-cam1 {

board/aarch64/rpi/cmdline.txt

@@ -1 +0,0 @@
-root=/dev/mmcblk0p2 rootwait console=tty1 console=ttyAMA0,115200

board/aarch64/rpi/config.txt

@@ -1,41 +0,0 @@
-# Please note that this is only a sample, we recommend you to change it to fit
-# your needs.
-# You should override this file using BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE.
-# See http://buildroot.org/manual.html#rootfs-custom
-# and http://elinux.org/RPiconfig for a description of config.txt syntax
-
-start_file=start4.elf
-fixup_file=fixup4.dat
-
-kernel=u-boot.bin
-
-device_tree=bcm2711-rpi-4-b.dtb
-dtoverlay=rpi-env
-dtoverlay=infix-key
-
-# To use an external initramfs file
-#initramfs rootfs.cpio.gz
-
-# Disable overscan assuming the display supports displaying the full resolution
-# If the text shown on the screen disappears off the edge, comment this out
-disable_overscan=1
-
-# How much memory in MB to assign to the GPU on Pi models having
-# 256, 512 or 1024 MB total memory
-gpu_mem_256=100
-gpu_mem_512=100
-gpu_mem_1024=100
-
-# Enable UART0 for serial console on ttyAMA0
-enable_uart=1
-force_turbo=1
-#dtoverlay=miniuart-bt
-
-# Run as fast as firmware / board allows
-arm_boost=1
-
-# enable 64bits support
-arm_64bit=1
-
-# Enable early debugging info
-uart_2ndstage=1

board/aarch64/rpi/genimage.cfg.in

@@ -1,71 +0,0 @@
-image boot.vfat {
-	vfat {
-		files = {
-#BOOT_FILES#
-		}
-	}
-
-	size = 32M
-}
-
-image cfg.ext4 {
-	empty = true
-	temporary = true
-	size = 16M
-
-	ext4 {
-		label = "cfg"
-	}
-}
-
-image var.ext4 {
-	empty = true
-	temporary = true
-	size = 512M
-
-	ext4 {
-		label = "var"
-		use-mke2fs = true
-	}
-}
-
-image sdcard.img {
-	hdimage {
-		partition-table-type = "gpt"
-	}
-
-	partition boot {
-		partition-type-uuid = EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
-		bootable = "true"
-		image = "boot.vfat"
-	}
-
-	partition aux {
-		partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
-		image = "aux.ext4"
-	}
-
-	partition primary {
-		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
-		bootable = true
-		size = 200M
-		image = "rootfs.squashfs"
-	}
-
-	partition secondary {
-		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
-		bootable = true
-		size = 200M
-		image = "rootfs.squashfs"
-	}
-
-	partition cfg {
-		partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
-		image = "cfg.ext4"
-	}
-
-	partition var {
-		partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
-		image = "var.ext4"
-	}
-}

board/aarch64/rpi/post-build.sh

@@ -1,7 +0,0 @@
-#!/bin/sh
-
-# Armbian firmware installs to /lib/firmware but driver wants the
-# file(s) in /lib/firmware/brcm/
-if [ -f "${TARGET_DIR}/lib/firmware/BCM4345C0.hcd" ]; then
-    mv "${TARGET_DIR}/lib/firmware/BCM4345C0.hcd" "${TARGET_DIR}/lib/firmware/brcm/"
-fi

board/aarch64/rpi/post-image.sh

@@ -1,43 +0,0 @@
-#!/bin/sh
-set -e
-
-BOARD_DIR=$(dirname "$0")
-GENIMAGE_CFG="${BUILD_DIR}/genimage.cfg"
-GENIMAGE_TMP="${BUILD_DIR}/genimage.tmp"
-
-# Device trees are installed for distro boot (syslinux.conf), but on RPi
-# we need them for the SPL, which feeds the TPL (U-Boot) for use instead
-# of the (built-in) control DT other platforms use.
-find "${TARGET_DIR}/boot" -type f -name '*.dtb' -exec cp '{}' "${BINARIES_DIR}/" \;
-
-# We've asked U-Boot previously to build overlays for us: Infix signing
-# key and our ixboot scripts.  Make sure here they are installed in the
-# proper directory so genimage can create the DOS partition the SPL
-# reads config.txt from.
-find "${BINARIES_DIR}" -type f -name '*.dtbo' -exec mv '{}' "${BINARIES_DIR}/rpi-firmware/overlays/" \;
-
-# Create FILES array for the genimage.cfg generation
-FILES=""
-for f in "${BINARIES_DIR}"/*.dtb "${BINARIES_DIR}"/rpi-firmware/*; do
-    case "$f" in
-        *~|*.bak) continue ;;
-    esac
-    FILES="${FILES}\t\t\t\"${f#"${BINARIES_DIR}/"}\",\n"
-done
-
-KERNEL=$(sed -n 's/^kernel=//p' "${BINARIES_DIR}/rpi-firmware/config.txt")
-FILES="${FILES}\t\t\t\"${KERNEL}\""
-
-sed "s|#BOOT_FILES#|${FILES}|" "${BOARD_DIR}/genimage.cfg.in" > "${GENIMAGE_CFG}"
-
-ROOTPATH_TMP=$(mktemp -d)
-trap 'rm -rf \"$ROOTPATH_TMP\"' EXIT
-
-rm -rf "${GENIMAGE_TMP}"
-
-genimage					\
-    --rootpath   "${ROOTPATH_TMP}"		\
-    --tmppath    "${GENIMAGE_TMP}"		\
-    --inputpath  "${BINARIES_DIR}"		\
-    --outputpath "${BINARIES_DIR}"		\
-    --config     "${GENIMAGE_CFG}"

board/aarch64/rpi/rootfs/boot/syslinux/syslinux.conf

@@ -1,16 +0,0 @@
-default rpi4b
-menu title Boot Menu
-prompt 1
-timeout 30
-
-label rpi4b
-        menu label Infix on Raspberry Pi 4B
-	kernel /boot/Image
-	devicetree /boot/broadcom/bcm2711-rpi-4-b.dtb
-	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}
-
-label rpi400
-	menu label Infix on Raspberry Pi 400
-	kernel /boot/Image
-	devicetree /boot/broadcom/bcm2711-rpi-400.dtb
-	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}

board/aarch64/rpi/rootfs/etc/factory-config.cfg

@@ -1,193 +0,0 @@
-{
-  "ieee802-dot1ab-lldp:lldp": {
-    "infix-lldp:enabled": true
-  },
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "lo",
-        "type": "infix-if-type:loopback",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "127.0.0.1",
-              "prefix-length": 8
-            }
-          ]
-        },
-        "ietf-ip:ipv6": {
-          "address": [
-            {
-              "ip": "::1",
-              "prefix-length": 128
-            }
-          ]
-        }
-      },
-      {
-        "name": "eth0",
-        "type": "infix-if-type:ethernet"
-      }
-    ]
-  },
-  "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
-        }
-      ]
-    }
-  },
-  "ietf-netconf-acm:nacm": {
-    "enable-nacm": true,
-    "groups": {
-      "group": [
-        {
-          "name": "admin",
-          "user-name": [
-            "admin"
-          ]
-        }
-      ]
-    },
-    "rule-list": [
-      {
-        "name": "admin-acl",
-        "group": [
-          "admin"
-        ],
-        "rule": [
-          {
-            "name": "permit-all",
-            "module-name": "*",
-            "access-operations": "*",
-            "action": "permit",
-            "comment": "Allow 'admin' group complete access to all operations and data."
-          }
-        ]
-      },
-      {
-        "name": "default-deny-all",
-        "group": [
-          "*"
-        ],
-        "rule": [
-          {
-            "name":  "deny-password-read",
-            "module-name": "ietf-system",
-            "path": "/ietf-system:system/authentication/user/password",
-            "access-operations": "*",
-            "action": "deny"
-          }
-        ]
-      }
-    ]
-  },
-  "ietf-netconf-server:netconf-server": {
-    "listen": {
-      "endpoints": {
-        "endpoint": [
-          {
-            "name": "default-ssh",
-            "ssh": {
-              "tcp-server-parameters": {
-                "local-address": "::"
-              },
-              "ssh-server-parameters": {
-                "server-identity": {
-                  "host-key": [
-                    {
-                      "name": "default-key",
-                      "public-key": {
-                        "central-keystore-reference": "genkey"
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        ]
-      }
-    }
-  },
-  "ietf-system:system": {
-    "hostname": "rpi4",
-    "ntp": {
-      "enabled": true,
-      "server": [
-        {
-          "name": "ntp.org",
-          "udp": {
-            "address": "pool.ntp.org"
-          },
-	  "iburst": true
-        }
-      ]
-    },
-    "authentication": {
-      "user": [
-        {
-          "name": "admin",
-          "password": "$factory$",
-          "infix-system:shell": "bash"
-        }
-      ]
-    },
-    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo="
-  },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
-      {
-        "if-name": "eth0",
-        "option": [
-          {
-            "id": "netmask"
-          },
-          {
-            "id": "broadcast"
-          },
-          {
-            "id": "router"
-          },
-          {
-            "id": "domain"
-          },
-          {
-            "id": "hostname"
-          },
-          {
-            "id": "dns-server"
-          },
-          {
-            "id": "ntp-server"
-          }
-        ]
-      }
-    ]
-  },
-  "infix-meta:meta": {
-    "infix-meta:version": "1.2"
-  },
-  "infix-services:mdns": {
-    "enabled": true
-  },
-  "infix-services:web": {
-    "enabled": true,
-    "console": {
-      "enabled": true
-    },
-    "netbrowse": {
-      "enabled": true
-    },
-    "restconf": {
-      "enabled": true
-    }
-  }
-}

board/aarch64/rpi/rootfs/etc/product/interface-quirks.json

@@ -1,5 +0,0 @@
-{
-    "eth0": {
-	"phy-detached-when-down": true
-    }
-}

board/aarch64/rpi/rootfs/etc/watchdogd.conf

@@ -1,6 +0,0 @@
-# Broadcom BCM2835 Watchdog timer
-device /dev/watchdog0 {
-    timeout    = 60
-    interval   = 5
-    safe-exit  = true
-}

board/aarch64/rpi/uboot/extras.config

@@ -1,3 +0,0 @@
-# CONFIG_MMC_PCI is not set
-CONFIG_OF_OVERLAY_LIST="rpi-env infix-key"
-# CONFIG_ENV_IS_IN_FAT is not set

board/aarch64/rpi/uboot/rpi-env.dtso

@@ -1,27 +0,0 @@
-/dts-v1/;
-/plugin/;
-
-&{/} {
-	config {
-		environment {
-			vendor = "infix";
-			preboot = "run ixpreboot";
-			ixbootdelay = "0.5";
-			bootdelay = "-2";
-			bootmenu_delay = "10";
-			boot_targets = "mmc1";
-			ethprime = "eth0";
-			bootcmd = "run ixboot";
-
-			ixpreboot     = /incbin/("scripts/ixpreboot.sh");
-			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
-			ixbtn-factory = "echo \"No button available, use bootmenu\"";
-			ixfactory     = /incbin/("scripts/ixfactory.sh");
-
-			ixboot      = /incbin/("scripts/ixboot.sh");
-			ixbootslot  = /incbin/("scripts/ixbootslot.sh");
-			ixprepblk   = /incbin/("scripts/ixprepblk.sh");
-			ixprepdhcp  = /incbin/("scripts/ixprepdhcp.sh");
-		};
-	};
-};

board/common/README.txt

@@ -45,11 +45,11 @@ The default credentials for the demo builds is
     login: admin
     password: admin
 
-    Infix OS — Immutable.Friendly.Secure v24.09.0-rc1 (hvc0)
+    Infix -- a Network Operating System v24.09.0-rc1 (hvc0)
     infix-00-00-00 login: admin
     Password: 
     .-------.
-    |  . .  | Infix OS — Immutable.Friendly.Secure
+    |  . .  | Infix -- a Network Operating System
     |-. v .-| https://kernelkit.org
     '-'---'-'
 
@@ -122,9 +122,9 @@ There's a lot of tutorials and guides online, start here:
 About
 -----
 
-Infix is a free, Linux-based, immutable operating system built around
-Buildroot, and sysrepo.  A powerful mix that ease porting to different
-platforms, simplify long-term maintenance, and provide easy management
-using NETCONF, RESTCONF, or the built-in command line interface (CLI)
-from a console or SSH login.
+Infix is a free, Linux based, immutable Network Operating System (NOS)
+built on Buildroot, and sysrepo.  A powerful mix that ease porting to
+different platforms, simplify long-term maintenance, and provide easy
+management using NETCONF, RESTCONF, or the built-in command line
+interface (CLI) from a console or SSH login.
 

board/common/busybox_defconfig

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.36.1
-# Sun Feb  9 12:25:37 2025
+# Tue Oct 22 13:12:02 2024
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -17,7 +17,7 @@ CONFIG_SHOW_USAGE=y
 CONFIG_FEATURE_VERBOSE_USAGE=y
 # CONFIG_FEATURE_COMPRESS_USAGE is not set
 CONFIG_LFS=y
-CONFIG_PAM=y
+# CONFIG_PAM is not set
 CONFIG_FEATURE_DEVPTS=y
 CONFIG_FEATURE_UTMP=y
 CONFIG_FEATURE_WTMP=y
@@ -325,7 +325,7 @@ CONFIG_FEATURE_STAT_FILESYSTEM=y
 CONFIG_STTY=y
 CONFIG_SUM=y
 CONFIG_SYNC=y
-CONFIG_FEATURE_SYNC_FANCY=y
+# CONFIG_FEATURE_SYNC_FANCY is not set
 CONFIG_FSYNC=y
 # CONFIG_TAC is not set
 CONFIG_TAIL=y
@@ -336,7 +336,7 @@ CONFIG_TEST=y
 CONFIG_TEST1=y
 CONFIG_TEST2=y
 CONFIG_FEATURE_TEST_64=y
-CONFIG_TIMEOUT=y
+# CONFIG_TIMEOUT is not set
 CONFIG_TOUCH=y
 CONFIG_FEATURE_TOUCH_SUSV3=y
 CONFIG_TR=y
@@ -357,7 +357,7 @@ CONFIG_BASE32=y
 CONFIG_BASE64=y
 CONFIG_UUENCODE=y
 CONFIG_WC=y
-CONFIG_FEATURE_WC_LARGE=y
+# CONFIG_FEATURE_WC_LARGE is not set
 CONFIG_WHO=y
 CONFIG_W=y
 CONFIG_USERS=y

board/common/mkdisk.sh

@@ -127,7 +127,7 @@ bootdata=
 diskimg=disk.img
 bootimg=
 bootpart=
-tmpimage=$(mktemp)
+
 while getopts "a:b:B:n:s:" opt; do
     case ${opt} in
 	a)
@@ -166,7 +166,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vdiskimg=$tmpimage \
+	  -vdiskimg=$diskimg \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -211,7 +211,5 @@ genimage \
     --rootpath "$root" \
     --tmppath  "$tmp" \
     --inputpath "$BINARIES_DIR" \
+    --outputpath "$BINARIES_DIR" \
     --config "$root/genimage.cfg"
-
-qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
-rm "$tmpimage"

board/common/mkrauc.sh

@@ -2,6 +2,8 @@
 
 set -e
 
+GIT_VERSION=$(git -C "$BR2_EXTERNAL_INFIX_PATH" describe --always --dirty --tags)
+
 name=$1
 compat=$2
 sign=$3
@@ -24,7 +26,7 @@ cp -f "$BINARIES_DIR/rootfs.itbh"     "$work/rootfs.itbh"
 cat >"$work/manifest.raucm" <<EOF
 [update]
 compatible=${compat}
-version=${INFIX_VERSION}
+version=${GIT_VERSION}
 
 [bundle]
 format=verity

board/common/post-build.sh

@@ -39,6 +39,22 @@ if [ -n "${ID_LIKE}" ]; then
     ID="${ID} ${ID_LIKE}"
 fi
 
+if [ -z "$GIT_VERSION" ]; then
+    infix_path="$BR2_EXTERNAL_INFIX_PATH"
+    if [ -n "$INFIX_OEM_PATH" ]; then
+	# Use version from br2-external OEM:ing Infix
+	infix_path="$INFIX_OEM_PATH"
+    fi
+    GIT_VERSION=$(git -C "$infix_path" describe --always --dirty --tags)
+fi
+
+# Override VERSION in /etc/os-release and filenames for release builds
+if [ -n "$INFIX_RELEASE" ]; then
+    VERSION="$INFIX_RELEASE"
+else
+    VERSION=$GIT_VERSION
+fi
+
 if [ -n "$INFIX_IMAGE_ID" ]; then
     NAME="$INFIX_IMAGE_ID"
 else
@@ -55,12 +71,12 @@ rm -f "$TARGET_DIR/etc/os-release"
 {
     echo "NAME=\"$INFIX_NAME\""
     echo "ID=$INFIX_ID"
-    echo "PRETTY_NAME=\"$INFIX_TAGLINE $INFIX_VERSION\""
+    echo "PRETTY_NAME=\"$INFIX_TAGLINE $VERSION\""
     echo "ID_LIKE=\"${ID}\""
     echo "DEFAULT_HOSTNAME=$BR2_TARGET_GENERIC_HOSTNAME"
-    echo "VERSION=\"${INFIX_VERSION}\""
-    echo "VERSION_ID=${INFIX_VERSION}"
-    echo "BUILD_ID=\"${INFIX_BUILD_ID}\""
+    echo "VERSION=\"${VERSION}\""
+    echo "VERSION_ID=${VERSION}"
+    echo "BUILD_ID=\"${GIT_VERSION}\""
     if [ -n "$INFIX_IMAGE_ID" ]; then
 	echo "IMAGE_ID=\"$INFIX_IMAGE_ID\""
     fi
@@ -86,7 +102,7 @@ rm -f "$TARGET_DIR/etc/os-release"
     fi
 } > "$TARGET_DIR/etc/os-release"
 
-echo "$INFIX_TAGLINE $INFIX_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
+echo "$INFIX_TAGLINE $VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
 
 # In case of ambguities, this is what the image was built from
 cp "$BR2_CONFIG" "$TARGET_DIR/usr/share/infix/config"

board/common/post-image.sh

@@ -23,7 +23,7 @@ if [ -n "$IMAGE_ID" ]; then
 else
     NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
 fi
-diskimg=disk.qcow2
+diskimg=disk.img
 
 ver()
 {
@@ -48,7 +48,7 @@ fi
 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
     ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk$(ver).qcow2"
+    diskimg="${NAME}-disk$(ver).img"
     bootcfg=
     if [ "$DISK_IMAGE_BOOT_DATA" ]; then
 	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
@@ -90,7 +90,7 @@ if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
     rel=$(ver)
     ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
     if [ -n "$rel" ]; then
-	ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
+	ln -sf "$BINARIES_DIR/${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
     fi
 fi
 

board/common/qemu/Config.in.in

@@ -66,7 +66,7 @@ endchoice
 
 config QEMU_MACHINE
 	string "Select emulated machine"
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max" if QEMU_aarch64
 	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
@@ -78,7 +78,7 @@ config QEMU_MACHINE
 
 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
-	default "448M"
+	default "384M"
 	help
 	  The default, 384 MiB, works for most configurations.  However,
 	  if you get kernel panic with: "System is deadlocked on memory",

board/common/qemu/qemu.sh

@@ -120,7 +120,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
     elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=qemu.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
+	echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
     fi
 }
 
@@ -316,13 +316,13 @@ gdb_args()
 run_qemu()
 {
     if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	if ! qemu-img check "qemu.qcow2"; then
-	    rm -f "qemu.qcow2"
+	if ! qemu-img check "${CONFIG_QEMU_ROOTFS}.qcow2"; then
+	    rm -f "${CONFIG_QEMU_ROOTFS}.qcow2"
 	fi
-	if [ ! -f "qemu.qcow2" ]; then
+	if [ ! -f "${CONFIG_QEMU_ROOTFS}.qcow2" ]; then
 	    echo "Creating qcow2 disk image for Qemu ..."
 	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
-		     -F qcow2 "qemu.qcow2" > /dev/null
+		     -F raw "${CONFIG_QEMU_ROOTFS}.qcow2" > /dev/null
 	fi
     fi
 

board/common/rootfs/etc/avahi/avahi-autoipd.action

@@ -9,20 +9,46 @@
 #   $3 IP adddress
 
 PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
+NAME="/etc/frr/static.d/$2-zeroconf.conf"
+NEXT="${NAME}+"
 
 log()
 {
     logger -I $$ -t zeroconf -p user.notice "$*"
 }
 
+# Reduce changes needed by comparing with previous route(s)
+act()
+{
+    case $1 in
+	add)
+	    echo "! Generated by avahi-autoipd"  > "$NEXT"
+	    echo "ip route 0.0.0.0/0 $2 254"    >> "$NEXT"
+	    cmp -s "$NAME" "$NEXT" && return
+	    mv "$NEXT" "$NAME"
+	    ;;
+	del)
+	    [ -f "$NAME" ] || return
+	    rm "$NAME"
+	    ;;
+	*)
+	    return
+	    ;;
+    esac
+
+    initctl -nbq restart staticd
+}
+
 case "$1" in
     BIND)
         ip addr flush dev "$2" proto random
         ip addr add "$3"/16 brd 169.254.255.255 scope link dev "$2" proto random
+	act add "$2"
 	log "set ipv4ll $3 on iface $2"
         ;;
 
     CONFLICT|UNBIND|STOP)
+	act del "$2"
         ip addr flush dev "$2" proto random
 	log "clr ipv4ll on iface $2"
         ;;

board/common/rootfs/etc/dnsmasq.conf

@@ -3,19 +3,16 @@
 # and similar events feed servers and configuration to dnsmasq.
 domain-needed
 
-# Allow configuration and cache clear over D-Bus
-enable-dbus
+# Only listen to loopback (local system)
+interface=lo
+bind-dynamic
+#listen-address=127.0.0.1,::1
 
-# Disable the following dnsmasq default DHCP options
-#dhcp-option=option:netmask
-#dhcp-option=28			# option:broadcast
-#dhcp-option=option:domain-name
-dhcp-option=option:router
-dhcp-option=option:dns-server
-dhcp-option=12			# option:hostname
+enable-dbus
 
 # Generated by openresolv
 resolv-file=/var/lib/misc/resolv.conf
 
 # Include all files in a directory which end in .conf
 conf-dir=/etc/dnsmasq.d/,*.conf
+

board/common/rootfs/etc/finit.d/available/container@.conf

@@ -1,7 +1,4 @@
-# Start a container instance (%i) and redirect logs to /log/container
-# Give podman enough time to properly shut down the container.  Every
-# time we start a container we run the setup stage, disable the Finit
-# timeout to allow the setup stage to run to completion.
-sysv    log:prio:local1,tag:%i kill:10 pid:!/run/container:%i.pid \
-	pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container   \
-	[2345] <!> :%i container -n %i -- container %i
+task    name:container-%i :setup \
+	[2345] container -n %i setup -- Setup container %i
+sysv    <!usr/container:%i> :%i pid:!/run/container:%i.pid log:prio:local1,tag:%i kill:10 \
+	[2345] container -n %i -- container %i

board/common/rootfs/etc/finit.d/available/mstpd.conf

@@ -1,9 +0,0 @@
-# A single mstpd instance can manage multiple bridges, which are
-# dynamically added/removed by the kernel via the /sbin/bridge-stp
-# usermode helper. We use a manual service so that confd can
-# enable/disable it without an initctl barrier, since it needs to
-# already be running when a bridge interface with spanning tree
-# enabled is created.
-
-service env:-/etc/default/mstpd manual:yes \
-	 [S0123456789] mstpd $MSTPD_ARGS -- Spanning Tree daemon

board/common/rootfs/etc/finit.d/available/ttyd.conf

@@ -1 +1 @@
-service [2345] <!> ttyd -i lo -W -p 8001 login -- Web terminal daemon (ttyd)
+service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)

board/common/rootfs/etc/finit.d/available/wifi@.conf

@@ -1,5 +0,0 @@
-service name:wpa_supplicant :%i \
-			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
-			       -- WPA supplicant @%i
-
-task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i

board/common/rootfs/etc/finit.d/enabled/mstpd.conf

@@ -1 +0,0 @@
-../available/mstpd.conf

board/common/rootfs/etc/motd

@@ -1,4 +1,4 @@
 .-------.
-|  . .  | Infix OS — Immutable.Friendly.Secure
+|  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.org
 '-'---'-'

board/common/rootfs/etc/nginx/restconf.app

@@ -1,11 +1,5 @@
 # /telemetry/optics is for streaming (not used atm)
-# Proxy buffer settings for large files
-proxy_buffering off;                 # Disable buffering for streaming
-proxy_request_buffering off;         # Stream request body immediately
-proxy_max_temp_file_size 0;         # No temp files
 location ~ ^/(restconf|yang|.well-known)/ {
-    client_max_body_size 200M;
-    client_body_buffer_size 1M;
     grpc_pass grpc://[::1]:10080;
     grpc_set_header Host $host;
     grpc_set_header X-Real-IP $remote_addr;

board/common/rootfs/etc/ssh/sshd_config.d/var-keys.conf

@@ -0,0 +1,3 @@
+HostKey /var/lib/ssh/ssh_host_rsa_key
+HostKey /var/lib/ssh/ssh_host_ecdsa_key
+HostKey /var/lib/ssh/ssh_host_ed25519_key

board/common/rootfs/etc/sysctl.d/forwarding.conf

@@ -0,0 +1,3 @@
+net.ipv4.ip_forward=1
+net.ipv4.ip_forward_update_priority=0
+net.ipv6.conf.all.forwarding=1

board/common/rootfs/etc/sysctl.d/ipv4.conf

@@ -1,32 +1 @@
-# Router defaults
-net.ipv4.conf.default.rp_filter=0
-net.ipv4.conf.all.rp_filter=0
-
-net.ipv4.conf.lo.rp_filter=0
-
-net.ipv4.icmp_errors_use_inbound_ifaddr=1
-net.ipv4.conf.all.ignore_routes_with_linkdown=1
-
-# Use neigh information on selection of nexthop for multipath hops
-net.ipv4.fib_multipath_use_neigh=1
-
-# Sane ARP defaults for a switch/router
-net.ipv4.conf.default.arp_announce=2
-net.ipv4.conf.all.arp_announce=2
-
-net.ipv4.conf.default.arp_notify=1
-net.ipv4.conf.all.arp_notify=1
-
-net.ipv4.conf.default.arp_ignore=1
-net.ipv4.conf.all.arp_ignore=1
-
-# IP Routing
-net.ipv4.ip_forward=1
-net.ipv4.ip_forward_update_priority=0
-
 net.ipv4.conf.all.forwarding=0
-net.ipv4.conf.default.forwarding=0
-
-# Multicast group subscriptions
-net.ipv4.igmp_max_memberships=1000
-net.ipv4.neigh.default.mcast_solicit=10

board/common/rootfs/etc/sysctl.d/ipv6.conf

@@ -1,23 +1,5 @@
-# Router defaults
-net.ipv6.route.max_size=131072
-net.ipv6.conf.all.ignore_routes_with_linkdown=1
-
-# IP Routing is disabled by default, enabled globally, and per
-# interface, for each interface in confd.  See also accept_ra.
-net.ipv6.conf.all.forwarding=0
+net.ipv6.conf.all.forwarding=1
 net.ipv6.conf.default.forwarding=0
-
-# Accept router advertisements even when forwarding is enabled
-net.ipv6.conf.all.accept_ra=2
-net.ipv6.conf.default.accept_ra=2
-
-# IPv6 SLAAC
 net.ipv6.conf.all.autoconf=0
 net.ipv6.conf.default.autoconf=0
-
-# Keep permanent addresses on an admin down
-net.ipv6.conf.all.keep_addr_on_down=1
 net.ipv6.conf.default.keep_addr_on_down=1
-
-# Multicast group subscriptions
-net.ipv6.mld_max_msf=512

board/common/rootfs/etc/sysctl.d/readme.txt

@@ -1,145 +0,0 @@
-Many of the defaults here are are taken from the Frr recommendations [1].
-Below are relevant excerpts from the kernel documentation.
-
-
-accept_ra, accept Router Advertisements; autoconfigure using them, also
-           determines whether or not to transmit Router Solicitations.
-           If and only if the functional setting is to accept Router
-           Advertisements, Router Solicitations will be transmitted.
-
-  0 - Do not accept Router Advertisements.
-
-  1 - Accept Router Advertisements if forwarding is disabled.
-
-  2 - Overrule forwarding behaviour. Accept Router Advertisements even
-      if forwarding is enabled.
-
-  Default:
-    - enabled if local forwarding is disabled
-    - disabled if local forwarding is enabled
-
-
-accept_ra_pinfo, learn Prefix Information in Router Advertisement.
-
-   Default:
-    - enabled if accept_ra is enabled
-    - disabled if accept_ra is disabled
-
-
-autoconf, autoconfigure IPv6 addresses using Prefix Information in
-          Router Advertisements.
-
-   Default:
-    - enabled if accept_ra_pinfo is enabled
-    - disabled if accept_ra_pinfo is disabled
-
-
-arp_announce, define restriction level for announcing the local source
-              address from IP packets in ARP requests sent on interface:
-
-  0 - (default) Use any local address, configured on any interface
-
-  1 - Try to avoid local addresses that are not in the target’s subnet
-      for this interface.  Useful when target hosts reachable via this
-      interface require the source IP address in ARP requests to be part
-      of their logical network configured on the receiving interface.
-      When we generate the request we will check all our subnets that
-      include the target IP and will preserve the source address if it
-      is from such subnet. If there is no such subnet we select source
-      address according to the rules for level 2.
-
-  2 - Always use the best local address for this target. In this mode we
-      ignore the source address in the IP packet and try to select local
-      address that we prefer for talks with the target host. Such local
-      address is selected by looking for primary IP addresses on all our
-      subnets on the outgoing interface that include the target address.
-      If no suitable local address is found we select the first local
-      address we have on the outgoing interface or on all other
-      interfaces, with the hope we will receive reply for our request
-      and even sometimes no matter the source IP address we announce.
-
-
-arp_notify, define mode for notification of address and device changes.
-
-  0 - (default): do nothing
-  1 - generate gratuitous arp requests when device is brought up or
-      hardware address changes.
-
-
-arp_ignore, define different modes for sending replies in response to
-            received ARP requests that resolve local target addresses:
-
-  0 - (default): reply for any local target IP address, configured on
-      any interface
-
-  1 - reply only if the target IP address is a local address configured
-      on the incoming interface
-
-  2 - reply only if the target IP address is local address configured on
-      the incoming interface and both with the sender’s IP address are part
-      from same subnet on this interface
-
-  3 - do not reply for local addresses configured with scope host, only
-      resolutions for global and link addresses are replied
-
-  4-7 - reserved
-
-  8 - do not reply for all local addresses
-
-
-arp_accept, define behavior for accepting gratuitous ARP (garp) frames
-      from devices that are not already present in the ARP table:
-
-  0 - don’t create new entries in the ARP table
-
-  1 - create new entries in the ARP table
-
-  2 - create new entries only if the source IP address is in the same
-      subnet as an address configured on the interface that received
-      the garp message.
-
-  Both replies and requests type gratuitous arp will trigger the ARP
-  table to be updated, if this setting is on.  If the ARP table already
-  contains the IP address of the gratuitous arp frame, the arp table
-  will be updated regardless if this setting is on or off.
-
-
-icmp_errors_use_inbound_ifaddr
-
-  0 - (default): icmp error messages are sent with the primary address
-      of the exiting interface.
-
-  1 - the message will be sent with the primary address of the interface
-      that received the packet that caused the icmp error. This is the
-      behaviour many network administrators will expect from a router.
-      And it can make debugging complicated network layouts much easier.
-
-  Note, if no primary address exists for the interface selected, then
-  the primary address of the first non-loopback interface that has one
-  will be used regardless of this setting.
-
-
-rp_filter, reverse path source filtering:
-
-  0 - (default): no source validation.
-
-  1 - Strict mode as defined in RFC3704, 'Strict Reverse Path'.  Each
-      incoming packet is tested against the FIB and if the interface is
-      not the best reverse path the packet check will fail.  By default
-      failed packets are discarded.
-
-  2 - Loose mode as defined in RFC3704, 'Loose Reverse Path'.  Each
-      incoming packet’s source address is also tested against the FIB
-      and if the source address is not reachable via any interface the
-      packet check will fail.
-
-  Current recommended practice in RFC3704 is to enable strict mode to
-  prevent IP spoofing from DDos attacks. If using asymmetric routing or
-  other complicated routing, then loose mode is recommended.
-
-  The max value from conf/{all,interface}/rp_filter is used when doing
-  source validation on the {interface}.
-
-
-
-[1]: https://github.com/FRRouting/frr/blob/master/doc/user/Useful_Sysctl_Settings.md

board/common/rootfs/etc/udev/rules.d/70-rename-wifi.rules

@@ -1 +0,0 @@
-SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"

board/common/rootfs/usr/bin/dir

@@ -21,11 +21,7 @@ dir()
 if [ -d "$1" ]; then
     dir "$1"
 else
-    if [ "$USER" = "root" ]; then
-	dir "$HOME"
-    else
-	dir "/home/$USER"
-    fi
+    dir "$HOME"
     dir "/cfg"
     dir "/log"
 fi

board/common/rootfs/usr/bin/show

@@ -70,14 +70,12 @@ options:
   -p            Show plain output, no bells or whistles
 
 commands:
-  dhcp          Show DHCP server
   port PORT     Show port configuration and link information
   ports         Show ports available for bridging
   vlans         Show port groups in bridge
   ifaces        Show interfaces and their addresses
   fdb           Show forwarding database (unicast)
   mdb           Show multicast forwarding database
-  stp           Show spanning tree status
   ip   addr     Show IPv4 addresses
        route    Show routing table
   ipv6 addr     Show IPv6 addresses
@@ -89,41 +87,6 @@ commands:
 EOF
 }
 
-is_dhcp_running()
-{
-    sysrepocfg -X -f json -m infix-dhcp-server | jq -r '
-        ."infix-dhcp-server:dhcp-server".enabled as $global |
-        if ."infix-dhcp-server:dhcp-server".subnet? then
-                (."infix-dhcp-server:dhcp-server".subnet[] |
-                select(.enabled != false)) |
-                if $global != false and . then "true" else "false" end
-        else "false" end
-    ' 2>/dev/null | grep -q true
-}
-
-dhcp()
-{
-    if ! is_dhcp_running; then
-	echo "DHCP server not enabled."
-	exit 0
-    fi
-
-    case $1 in
-	detail)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
-		jq -C .
-	    ;;
-	stat*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
-		/usr/libexec/statd/cli-pretty "show-dhcp-server" -s
-	    ;;
-	*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
-		/usr/libexec/statd/cli-pretty "show-dhcp-server"
-	    ;;
-    esac
-}
-
 # Usage 1: show port eth0
 # Usage 2: show port
 # Usage 3: show ports
@@ -225,12 +188,6 @@ rstp()
     mstpctl showport br0
 }
 
-stp()
-{
-    sysrepocfg -f json -X -d operational -m ietf-interfaces | \
-        /usr/libexec/statd/cli-pretty "show-bridge-stp"
-}
-
 fdb()
 {
     bridge $bopt fdb show
@@ -331,9 +288,6 @@ case $cmd in
     help)
 	usage
 	;;
-    dhcp | dhcp-server)
-	dhcp $*
-	;;
     port*)
 	ports $*
 	;;
@@ -399,9 +353,6 @@ case $cmd in
     span*)
 	rstp
 	;;
-    stp*)
-	stp
-	;;
     sys*)
 	system
 	;;

board/common/rootfs/usr/libexec/infix/has-quirk

@@ -1,12 +0,0 @@
-#!/bin/sh
-if [ $# -lt 2 ]; then
-        echo "usage: $0 <quirk-name> <ifname>"
-        exit 1
-fi
-quirk=$1
-ifname=$2
-if [ -f "/etc/product/interface-quirks.json" ]; then
-        echo "$(jq -r --arg iface "$ifname" --arg quirk "$quirk" '.[$iface][$quirk] // "false"' /etc/product/interface-quirks.json)"
-else
-        echo "false"
-fi

board/common/rootfs/usr/libexec/infix/init.d/05-product

@@ -39,10 +39,8 @@ fi
 # init scripts to prevent select services from starting.
 initctl -nbq cond set led
 
-if [ -d "$PRODUCT_INIT" ]; then
-    note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
-    /usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
-fi
+note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
+/usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
 
 # Product specific init done.
 initctl -nbq cond set product

board/common/rootfs/usr/libexec/infix/init.d/25-mqprio

@@ -43,7 +43,6 @@ while [ "$1" ]; do
     txqs="$2"
     shift 2
 
-    [ $(/usr/libexec/infix/has-quirk "broken-mqprio" "$iface") = "true" ] && echo "Skipping $iface, does not support mqprio" && continue
     [ $txqs -lt 2 ] && continue
     [ $txqs -gt 8 ] && txqs=8
 

board/common/rootfs/usr/libexec/infix/init.d/25-qemu

@@ -1,8 +0,0 @@
-#!/bin/sh
-# Initialize speed/duplex of virtio interfaces
-# For virtual test systems (lacp tests)
-
-ifaces=$(ip -d -json link show | jq -r '.[] | select(.parentbus == "virtio") | .ifname')
-for iface in $ifaces; do
-    ethtool -s "$iface" speed 1000 duplex full
-done

board/common/rootfs/usr/libexec/infix/init.d/30-cfg-migrate

@@ -4,14 +4,10 @@
 # the migrate tool inserts old version in name before .cfg extension.
 CONFIG_FILE="/cfg/startup-config.cfg"
 BACKUP_FILE="/cfg/backup/startup-config.cfg"
-BACKUP_DIR="$(dirname "$BACKUP_FILE")"
-
-mkdir -p         "$BACKUP_DIR"
-chown root:wheel "$BACKUP_DIR"
-chmod 0770       "$BACKUP_DIR"
+mkdir -p "$(dirname "$BACKUP_FILE")"
 
 if [ ! -f "$CONFIG_FILE" ]; then
-    logger -I $$ -k -p user.notice -t $(basename "$0")  "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
+    note "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
     exit 0
 elif migrate -cq "$CONFIG_FILE"; then
     exit 0

board/common/rootfs/usr/libexec/infix/mksshkey

@@ -1,24 +0,0 @@
-#!/bin/bash
-# Store and convert RSA PUBLIC/PRIVATE KEYs to be able to use them in
-# OpenSSHd.
-set -e
-
-NAME="$1"
-DIR="$2"
-PUBLIC="$3"
-PRIVATE="$4"
-TMP="$(mktemp)"
-
-echo -e '-----BEGIN RSA PRIVATE KEY-----' > "$DIR/$NAME"
-echo "$PRIVATE" >> "$DIR/$NAME"
-echo -e '-----END RSA PRIVATE KEY-----' >> "$DIR/$NAME"
-
-echo -e "-----BEGIN RSA PUBLIC KEY-----" > "$TMP"
-echo -e "$PUBLIC" >> "$TMP"
-echo -e "-----END RSA PUBLIC KEY-----" >> "$TMP"
-
-ssh-keygen -i -m PKCS8 -f "$TMP" > "$DIR/$NAME.pub"
-chmod 0600 "$DIR/$NAME.pub"
-chmod 0600 "$DIR/$NAME"
-chown sshd:sshd "$DIR/$NAME.pub"
-chown sshd:sshd "$DIR/$NAME"

board/common/rootfs/usr/libexec/infix/wifi-scanner

@@ -1,16 +0,0 @@
-#!/bin/sh
-
-if [ $# -ne 1 ]; then
-	echo "usage: $0 <ifname>"
-	exit 1
-fi
-ifname=$1
-
-TIMEOUT=300
-status=$(wpa_cli -i $ifname scan)
-while [ "$status" != "OK" ]; do
-	status=$(wpa_cli -i $ifname scan)
-	TIMEOUT=$((TIMEOUT-1))
-	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
-	sleep 0.5
-done

board/common/rootfs/usr/sbin/container

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 # This script can be used to start, stop, create, and delete containers.
 # It is what confd use, with the Finit container@.conf template, to set
 # up, run, and delete containers.
@@ -9,7 +9,6 @@
 DOWNLOADS=/var/lib/containers/oci
 BUILTIN=/lib/oci
 TMPDIR=/var/tmp
-container=$0
 checksum=""
 extracted=
 timeout=30
@@ -39,11 +38,6 @@ err()
     [ "$rc" -eq 0 ] || exit "$rc"
 }
 
-pidfn()
-{
-    echo "/run/containers/${1}.pid"
-}
-
 check()
 {
     file=$1
@@ -115,34 +109,33 @@ EOF
 # If there are more index files, this function does not handle them.
 unpack_archive()
 {
-    uri=$1
-    tag=$2
-    img=$(basename "$uri")
+    image=$1
+    name=$2
 
     # Supported transports for load and create
-    case "$uri" in
+    case "$image" in
 	oci:*)			# Unpacked OCI image
-	    file=${uri#oci:}
+	    file=${image#oci:}
 	    ;;
 	oci-archive:*)		# Packed OCI image, .tar or .tar.gz format
-	    file=${uri#oci-archive:}
+	    file=${image#oci-archive:}
 	    ;;
 	ftp://* | http://* | https://*)
-            if ! file=$(fetch "$uri"); then
+            if ! file=$(fetch "$image"); then
 		return 1
 	    fi
             ;;
 	*)			# docker://*, docker-archive:*, or URL
-	    if podman image exists "$img"; then
-		echo "$img"
+	    if podman image exists "$image"; then
+		echo "$image"
 		return 0
 	    fi
 	    # XXX: use --retry=0 with Podman 5.0 or later.
-	    if ! id=$(podman pull --quiet "$uri"); then
-		log "Failed pulling $uri"
+	    if ! id=$(podman pull --quiet "$image"); then
+		log "Failed pulling $image"
 		return 1
 	    fi
-	    # Echo image tag to caller
+	    # Echo image name to caller
 	    podman images --filter id="$id" --format "{{.Repository}}:{{.Tag}}"
 	    return 0
 	    ;;
@@ -154,7 +147,7 @@ unpack_archive()
 	elif [ -e "$BUILTIN/$file" ]; then
 	    file="$BUILTIN/$file"
 	else
-	    err 1 "cannot find OCI archive $file in URI $uri"
+	    err 1 "cannot find OCI archive $file in search path."
 	fi
     fi
 
@@ -178,8 +171,8 @@ unpack_archive()
 
     dir=$(dirname "$index")
     if echo "$dir" | grep -q ":"; then
-        if [ -z "$tag" ]; then
-            tag="$dir"
+        if [ -z "$name" ]; then
+            name="$dir"
         fi
         sanitized_dir=$(echo "$dir" | cut -d':' -f1)
         mv "$dir" "$sanitized_dir" || err 1 "failed renaming $dir to $sanitized_dir"
@@ -195,21 +188,21 @@ unpack_archive()
 	rm -rf "$dir"
     fi
 
-    # Retag image from podman default $dir:latest
-    if [ -n "$tag" ]; then
-	podman tag "$dir" "$tag" >/dev/null
-	podman rmi "$dir"        >/dev/null
+    # Rename image from podman default $dir:latest
+    if [ -n "$name" ]; then
+	podman tag "$dir" "$name" >/dev/null
+	podman rmi "$dir"         >/dev/null
     else
-	tag=$dir
+	name=$dir
     fi
 
-    echo "$tag"
+    echo "$name"
 }
 
 running()
 {
-    status=$(podman inspect -f '{{.State.Status}}' "$1" 2>/dev/null)
-    [ "$status" = "running" ] && return 0
+    run=$(podman inspect "$1" 2>/dev/null |jq .[].State.Running)
+    [ "$run" = "true" ] && return 0
     return 1
 }
 
@@ -233,14 +226,14 @@ create()
     fi
 
     if [ -z "$logging" ]; then
-	logging="--log-driver syslog"
+	logging="--log-driver none"
     fi
 
     # When we get here we've already fetched, or pulled, the image
     args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
     args="$args --restart=$restart --systemd=false --tz=local $privileged"
     args="$args $vol $mount $hostname $entrypoint $env $port $logging"
-    pidfile=/run/container:${name}.pid
+    pidfn=/run/container:${name}.pid
 
     [ -n "$quiet" ] || log "---------------------------------------"
     [ -n "$quiet" ] || log "Got name: $name image: $image"
@@ -263,8 +256,8 @@ create()
     fi
 
     # shellcheck disable=SC2048
-    log "podman create --name $name --conmon-pidfile=$pidfile $args $image $*"
-    if podman create --name "$name" --conmon-pidfile="$pidfile" $args "$image" $*; then
+    log "podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
+    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
 	[ -n "$quiet"  ] || log "Successfully created container $name from $image"
 	[ -n "$manual" ] || start "$name"
 
@@ -279,6 +272,7 @@ create()
 delete()
 {
     name=$1
+    image=$2
 
     if [ -z "$name" ]; then
 	echo "Usage:"
@@ -287,11 +281,9 @@ delete()
     fi
 
     # Should already be stopped, but if not ...
-    log "$name: should already be stopped, double checking ..."
-    container stop "$name" >/dev/null
+    container stop "$name"
 
     while running "$name"; do
-	log "$name: still running, waiting for it to stop ..."
 	_=$((timeout -= 1))
 	if [ $timeout -le 0 ]; then
 	    err 1 "timed out waiting for container $1 to stop before deleting it."
@@ -299,7 +291,6 @@ delete()
 	sleep 1
     done
 
-    log "$name: calling podman rm -vif ..."
     podman rm -vif "$name" >/dev/null 2>&1
     [ -n "$quiet" ] || log "Container $name has been removed."
 }
@@ -324,7 +315,7 @@ start()
 	return
     fi
 
-    initctl start container:$name
+    initctl -bq cond set "container:$name"
     # Real work is done by wrap() courtesy of finit sysv emulation
 }
 
@@ -337,7 +328,7 @@ stop()
 	return
     fi
 
-    initctl stop container:$name
+    initctl -bq cond clr "container:$name"
     # Real work is done by wrap() courtesy of finit sysv emulation
 }
 
@@ -345,27 +336,8 @@ wrap()
 {
     name=$1
     cmd=$2
-    pidfile=$(pidfn "$name")
 
-    # Containers have three phases: setup, running, and teardown.
-
-    # The setup phase may run forever in the background trying to fetch
-    # the image.  It saves its PID in /run/containers/${name}.pid
-    if [ "$cmd" = "stop" ] && [ -f "$pidfile" ]; then
-        pid=$(cat "$pidfile")
-
-	# Check if setup is still running ...
-	if kill -0 "$pid" 2>/dev/null; then
-            kill "$pid"
-            wait "$pid" 2>/dev/null
-        fi
-
-        rm -f "$pidfile"
-        return 0
-    fi
-
-    # Skip "echo $name" from podman start in log
-    podman "$cmd" "$name" >/dev/null
+    podman "$cmd" "$name"
 }
 
 # Removes network $1 from all containers
@@ -398,14 +370,7 @@ netrestart()
 
 cleanup()
 {
-    pidfile=$(pidfn "$name")
-
     log "Received signal, exiting."
-    if [ -n "$name" ] && [ -f "$pidfile" ]; then
-	log "$name: in setup phase, removing $pidfile ..."
-	rm -f "$pidfile"
-    fi
-
     exit 1
 }
 
@@ -461,12 +426,11 @@ commands:
   run      NAME [CMD]      Run a container interactively, with an optional command
   save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
   setup    NAME            Create and set up container as a Finit task
-  shell   [CMD]            Start a shell, or run CMD, inside a container
+  shell                    Start a shell inside a container
   show    [image | volume] Show containers, images, or volumes
   stat                     Show continuous stats about containers (Ctrl-C aborts)
   start   [NAME]           Start a container, see -n
   stop    [NAME]           Stop a container, see -n
-  upgrade  NAME            Upgrade a running container (stop, pull, restart)
   volume  [prune]          Prune unused volumes
 EOF
 }
@@ -550,7 +514,7 @@ while [ "$1" != "" ]; do
 	    ;;
 	-m | --mount)
 	    shift
-	    mount="$mount --mount=$1"
+	    mount="--mount=$1"
 	    ;;
 	--manual)
 	    manual=true
@@ -604,7 +568,7 @@ if [ -n "$cmd" ]; then
     shift
 fi
 
-trap cleanup INT HUP TERM
+trap cleanup INT TERM
 
 case $cmd in
     # Does not work atm., cannot attach to TTY because
@@ -618,24 +582,19 @@ case $cmd in
 	;;
     delete)
 	cmd=$1
-	[ -n "$name" ] || name=$2
+	name=$2
 	if [ "$cmd" = "network" ] && [ -n "$name" ]; then
 	    netwrm "$name"
 	else
-	    [ -n "$name" ] || name=$1
-	    delete "$name"
+	    delete "$@"
 	fi
 	;;
     exec)
-	if [ -z "$name" ]; then
-	    name="$1"
-	    shift
-	fi
-	podman exec -i "$name" "$@"
+	podman exec -it "$@"
 	;;
     flush)
 	echo "Cleaning up any lingering containers";
-	podman rm -av $force
+	podman rm -av
 	;;
     find)
 	cmd=$1
@@ -696,7 +655,7 @@ case $cmd in
 	    oci)
 		find $BUILTIN $DOWNLOADS -type f 2>/dev/null
 		;;
-	    *)
+	    *)		
 		podman ps $all --format "{{.Names}}"
 		;;
 	esac
@@ -740,34 +699,18 @@ case $cmd in
 	[ -n "$name" ] || err 1 "setup: missing container name."
 	script=/run/containers/${name}.sh
 	[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."
-
-	# Save our PID in case we get stuck here and someone wants to
-	# stop us, e.g., due to reconfiguration or reboot.
-	pidfile=$(pidfn "${name}")
-	echo $$ > "$pidfile"
-
 	while ! "$script"; do
-            log "${name}: setup failed, waiting for network changes ..."
-	    read -t 60 _ < <(ip monitor address route)
+	    # Wait for address/route changes, or retry every 60 secods
+	    # shellcheck disable=2162,3045
+	    ip monitor address route | while read -t 60 _; do break; done
 
 	    # On IP address/route changes, wait a few seconds more to ensure
 	    # the system has ample time to react and set things up for us.
-	    log "${name}: retrying ..."
 	    sleep 2
 	done
-
-	rm -f "$pidfile"
 	;;
     shell)
-	if [ -z "$name" ]; then
-	    name="$1"
-	    shift
-	fi
-	if [ $# -gt 0 ]; then
-	    podman exec -i "$name" sh -c "$*"
-	else
-	    podman exec -it "$name" sh -l
-	fi
+	podman exec -it "$1" sh -l
 	;;
     show)
 	cmd=$1
@@ -860,15 +803,15 @@ case $cmd in
 
 	# Likely an OCI archive, or local directory, assume user has updated image.
 	if echo "$img" | grep -Eq '^localhost/'; then
-	    file=$(awk '/^# meta-image:/ {print $3}' "$script")
-	    echo ">> Upgrading container $1 using $file ..."
+	    file=$(awk '{s=$NF} END{print s}' "$script")
+	    echo "Upgrading container ${1} with local archive: $file ..."
 	else
 	    printf ">> Stopping ... "
 	    podman stop "$1"
 	    printf ">> "
 	    podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
-	    echo ">> Starting $1 ..."
 	fi
+	echo ">> Starting $1 ..."
 	if ! "$script"; then
 	    echo ">> Failed recreating container $1"
 	    exit 1
@@ -888,22 +831,6 @@ case $cmd in
 	esac
 	;;
     *)
-	if [ -n "$SERVICE_SCRIPT_TYPE" ] && [ -n "$SERVICE_ID" ]; then
-	    case "$SERVICE_SCRIPT_TYPE" in
-		pre)
-		    # Called as pre-script from Finit service
-		    exec $container -q -n "$SERVICE_ID" setup
-		    ;;
-		cleanup)
-		    # Called as cleanup-script from Finit service
-		    log "Calling $container -n $SERVICE_ID delete"
-		    exec $container -q -n "$SERVICE_ID" delete
-		    ;;
-		*)
-		    false
-		    ;;
-	    esac
-	fi
 	usage
 	exit 1
 	;;

board/common/uboot/uboot.mk

@@ -17,23 +17,14 @@ endef
 # U-Boot build tree. This will then be built in to the final U-Boot
 # image's control DT via the CONFIG_DEVICE_TREE_INCLUDES option (see
 # extras.config).
-#
-# Some platforms, most notably Raspberry Pi, load the device tree
-# from the SPL, effectively overriding the built-in control DT.
-# For that we bundle an overlay that can be included instead.
 define UBOOT_PRE_BUILD_INSTALL_KEY
-	$(HOST_DIR)/bin/dtc -a 1024 <(echo '/dts-v1/; / { signature {}; };') \
-		>$(@D)/infix-key.dtb
+	$(HOST_DIR)/bin/dtc <(echo '/dts-v1/; / { signature {}; };') >$(@D)/infix-key.dtb
 	$(foreach key, \
 		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
 		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
-		| sed -e 's:/dts-v[0-9]\+/;::' \
-		| tee $(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi \
-		| sed -e '1i\/dts-v1/;\n/plugin/;\n' -e '/^$$/d' -e 's:/ {:\&{/} {:' \
-		>$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtso
-
+	| sed -e 's:/dts-v[0-9]\+/;::' >$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi
 	rm $(@D)/infix-key.dtb
 endef
 UBOOT_PRE_BUILD_HOOKS += UBOOT_PRE_BUILD_INSTALL_KEY

board/x86_64/linux_defconfig

@@ -145,6 +145,7 @@ CONFIG_BRIDGE_EBT_REDIRECT=m
 CONFIG_BRIDGE_EBT_SNAT=m
 CONFIG_BRIDGE_EBT_LOG=m
 CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BPFILTER=y
 CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_BRIDGE_MRP=y

configs/aarch64_defconfig

@@ -13,8 +13,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -27,14 +27,17 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/dcp-sc-28p-a styx/dcp-sc-28p-b marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
+BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -56,8 +59,8 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
-BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -77,7 +80,6 @@ BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
@@ -107,7 +109,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -120,27 +121,21 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_ALDER_ALDER=y
-BR2_PACKAGE_MARVELL_CN9130_CRB=y
-BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
-BR2_PACKAGE_STYX_DCP_SC_28P=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -164,14 +159,10 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_PACKAGE_FEATURE_WIFI=y
-BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
+DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10

configs/aarch64_minimal_defconfig

@@ -27,14 +27,17 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/dcp-sc-28p-a styx/dcp-sc-28p-b marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
+BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -72,7 +75,6 @@ BR2_PACKAGE_FRR=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
@@ -90,7 +92,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -108,19 +109,14 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_ALDER_ALDER=y
-BR2_PACKAGE_MARVELL_CN9130_CRB=y
-BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
-BR2_PACKAGE_STYX_DCP_SC_28P=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -138,9 +134,6 @@ BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
 DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

configs/r2s_defconfig

@@ -8,6 +8,7 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -29,7 +30,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.10.3"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
@@ -41,7 +42,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
@@ -74,6 +74,7 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
@@ -127,7 +128,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -170,14 +170,13 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-r2s"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -201,10 +200,7 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set

configs/riscv64_defconfig

@@ -39,7 +39,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
@@ -89,7 +88,6 @@ BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
@@ -119,7 +117,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -162,7 +159,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -170,7 +167,6 @@ BR2_PACKAGE_CONFD=y
 # BR2_PACKAGE_CONFD_TEST_MODE is not set
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -195,9 +191,6 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set

configs/rpi4_defconfig

@@ -1,201 +0,0 @@
-BR2_aarch64=y
-BR2_cortex_a72=y
-BR2_ARM_FPU_VFPV4=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
-BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
-BR2_GLOBAL_PATCH_DIR="board/raspberrypi/patches ${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_TARGET_GENERIC_HOSTNAME="infix"
-BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
-BR2_INIT_FINIT=y
-BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
-BR2_SYSTEM_BIN_SH_BASH=y
-BR2_TARGET_GENERIC_GETTY_PORT="@console"
-BR2_TARGET_GENERIC_GETTY_TERM="xterm"
-BR2_SYSTEM_DHCP="eth0"
-BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
-BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
-BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
-BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-image.sh"
-BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
-BR2_LINUX_KERNEL_PATCH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711-rpi-4-b-dts.patch"
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711_defconfig"
-BR2_LINUX_KERNEL_DTS_SUPPORT=y
-BR2_LINUX_KERNEL_INTREE_DTS_NAME="broadcom/bcm2711-rpi-4-b broadcom/bcm2711-rpi-400"
-BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
-BR2_LINUX_KERNEL_INSTALL_TARGET=y
-BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
-BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
-BR2_PACKAGE_XZ=y
-BR2_PACKAGE_STRACE=y
-BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_JQ=y
-BR2_PACKAGE_E2FSPROGS=y
-BR2_PACKAGE_ARMBIAN_FIRMWARE=y
-BR2_PACKAGE_ARMBIAN_FIRMWARE_AP6255=y
-BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI=y
-BR2_PACKAGE_LINUX_FIRMWARE=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XXX=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366B1=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366C0=y
-BR2_PACKAGE_RPI_FIRMWARE=y
-BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4=y
-BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4_X=y
-BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/config.txt"
-BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/cmdline.txt"
-BR2_PACKAGE_DBUS_CXX=y
-BR2_PACKAGE_DBUS_GLIB=y
-BR2_PACKAGE_DBUS_TRIGGERD=y
-BR2_PACKAGE_EUDEV_RULES_GEN=y
-# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_EVEMU=y
-BR2_PACKAGE_EVTEST=y
-BR2_PACKAGE_GPTFDISK=y
-BR2_PACKAGE_GPTFDISK_SGDISK=y
-BR2_PACKAGE_INPUT_EVENT_DAEMON=y
-BR2_PACKAGE_MDIO_TOOLS=y
-BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
-BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
-BR2_PACKAGE_LIBSSH_OPENSSL=y
-BR2_PACKAGE_LIBSSH2=y
-BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBOPENSSL_BIN=y
-BR2_PACKAGE_LIBINPUT=y
-BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_NETOPEER2_CLI=y
-BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_LINUX_PAM=y
-BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
-BR2_PACKAGE_ONIGURUMA=y
-BR2_PACKAGE_AVAHI_DAEMON=y
-BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
-BR2_PACKAGE_CHRONY=y
-BR2_PACKAGE_CONNTRACK_TOOLS=y
-BR2_PACKAGE_DNSMASQ=y
-BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FRR=y
-BR2_PACKAGE_HOSTAPD=y
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPROUTE2=y
-BR2_PACKAGE_IPTABLES_NFTABLES=y
-BR2_PACKAGE_IPUTILS=y
-BR2_PACKAGE_IW=y
-BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
-BR2_PACKAGE_NETCALC=y
-BR2_PACKAGE_NETCAT_OPENBSD=y
-BR2_PACKAGE_NETSNMP=y
-BR2_PACKAGE_NFTABLES=y
-BR2_PACKAGE_NGINX=y
-BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_NMAP=y
-BR2_PACKAGE_NMAP_NCAT=y
-BR2_PACKAGE_NMAP_NMAP=y
-BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_OPENRESOLV=y
-BR2_PACKAGE_OPENSSH=y
-BR2_PACKAGE_SOCAT=y
-BR2_PACKAGE_TCPDUMP=y
-BR2_PACKAGE_TRACEROUTE=y
-BR2_PACKAGE_ULOGD=y
-BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIRELESS_REGDB=y
-BR2_PACKAGE_WIRELESS_TOOLS=y
-BR2_PACKAGE_WPA_SUPPLICANT=y
-BR2_PACKAGE_BASH_COMPLETION=y
-BR2_PACKAGE_SUDO=y
-BR2_PACKAGE_TTYD=y
-BR2_PACKAGE_GETENT=y
-BR2_PACKAGE_HTOP=y
-BR2_PACKAGE_IRQBALANCE=y
-BR2_PACKAGE_KMOD_TOOLS=y
-BR2_PACKAGE_PWGEN=y
-BR2_PACKAGE_RAUC=y
-BR2_PACKAGE_RAUC_DBUS=y
-BR2_PACKAGE_RAUC_GPT=y
-BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
-BR2_PACKAGE_SYSKLOGD=y
-BR2_PACKAGE_SYSKLOGD_LOGGER=y
-BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_LESS=y
-BR2_PACKAGE_MG=y
-BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_arm64"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/extras.config"
-BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
-BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
-BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/rpi-env.dtso"
-BR2_PACKAGE_HOST_DOSFSTOOLS=y
-BR2_PACKAGE_HOST_E2FSPROGS=y
-BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
-BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_KMOD_XZ=y
-BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_IMAGE_ID="${INFIX_ID}-rpi4"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_CONFD=y
-BR2_PACKAGE_GENCERT=y
-BR2_PACKAGE_STATD=y
-BR2_PACKAGE_FACTORY=y
-BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
-BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
-BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
-BR2_PACKAGE_FINIT_PLUGIN_RTC=y
-BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
-BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
-BR2_PACKAGE_FINIT_PLUGIN_TTY=y
-BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_IITO=y
-BR2_PACKAGE_KEYACK=y
-BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
-BR2_PACKAGE_LOWDOWN=y
-BR2_PACKAGE_MCD=y
-BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_NETBROWSE=y
-BR2_PACKAGE_PODMAN=y
-BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
-BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
-BR2_PACKAGE_PODMAN_DRIVER_VFS=y
-BR2_PACKAGE_SHOW=y
-BR2_PACKAGE_TETRIS=y
-BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
-SDCARD_AUX=y

configs/x86_64_defconfig

@@ -12,8 +12,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,7 +34,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -55,8 +54,10 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_LINUX_PAM=y
@@ -75,7 +76,6 @@ BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
@@ -105,7 +105,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -125,14 +124,13 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -142,7 +140,6 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -166,12 +163,7 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_PACKAGE_FEATURE_WIFI=y
-BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 GNS3_APPLIANCE_RAM=512

configs/x86_64_minimal_defconfig

@@ -7,14 +7,13 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -27,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -35,7 +34,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -52,7 +50,10 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_LIBMNL=y
@@ -70,7 +71,6 @@ BR2_PACKAGE_FRR=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
@@ -82,14 +82,12 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
-BR2_PACKAGE_GETENT=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -115,7 +113,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -138,9 +136,7 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 GNS3_APPLIANCE_RAM=512

doc/ChangeLog.md

@@ -3,190 +3,12 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
-[v25.06.0][] - 2025-07-01
+[v24.11.2][] - 2025-03-19
 -------------------------
 
-### Changes
-- Upgrade Buildroot to 2025.02.4 (LTS)
-- Upgrade Linux kernel to 6.12.35 (LTS)
-- Upgrade curiOS built-in containers to v25.06.0
-- Add support for setting mode of a container content mount, issue #1070
-- Add Wi-Fi client support and add support for some USB-Wi-Fi cards
-- New slogan: Infix OS — Immutable.Friendly.Secure
-
-### Fixes
-- cli: fix by-word movement, detect word barrier using non-alphanum chars
-- cli: fix delete word left/right, make sure to save word in kill buffer
-
-
-[v25.05.1][] - 2025-06-12
--------------------------
-
-### Changes
-- Upgrade Linux kernel to 6.12.32 (LTS)
-
-### Fixes
-- Fix #1060: Restore of missing CLI commands, regression in Infix v25.05.0
-
-[v25.05.0][] - 2025-05-27
--------------------------
-
-### Changes
-- Upgrade Buildroot to 2025.02.3 (LTS)
-- Upgrade Linux kernel to 6.12.30 (LTS)
-- Upgrade libyang to 3.12.2
-- Upgrade sysrepo to 3.6.11
-- Upgrade netopeer2 (NETCONF) to 2.4.1
-- New hardware support: Raspberry Pi 4B (aarch64)
-- Add documentation on Infix upgrading and downgrading, issue #1009
-- Add HDMI and USB support for iMX8MP-evk
-- Enforced strict format for LLDP destination MAC address:
-  - Only accepts colon-separated format: `01:80:C2:00:00:0E`
-- Add `show lldp` command to show discovered neighbors per interface.
-- Add configuration support for per-interface LLDP administrative status
-
-### Fixes
-- Fix containers with multiple mounts
-- Correct description for LAG LACP modes
-- Fix #1040: Add `mount` constraint for container config
-
-
-[v25.04.0][] - 2025-04-30
--------------------------
-
-### Changes
- - Upgrade Linux kernel to 6.12.25 (LTS)
- - Upgrade Buildroot to 2025.02.1 (LTS)
- - Format for disk image (for QEMU) has changed to `qcow2`
-
-### Fixes
- - Fix #1002: Broken symlink in release package
- - Fix #1006: NanoPi R2S corrupt startup, regression in Infix v25.02.0
-   - Bump R2S kernel, now same as tier one boards
- - Fix #1015: Not possible to save custom SSH settings in startup-config
- - Fix group owner and permissions of `/cfg/backup` directory
- - Fix extraction of old version for `/cfg/backup/` files
- - Fix configuration migration issues when upgrading
-
-[v25.03.0][] - 2025-03-31
--------------------------
-
-> [!IMPORTANT]
-> This release is the first with the new Buildroot 2025.02 (LTS)
-
-### Changes
- - Upgrade Linux kernel to 6.12.21 (LTS)
- - Upgrade Buildroot to 2025.02.0 (LTS)
-
-### Fixes
- - Fix #964: YANG schema warning in syslog: missing 'monitor' node for lag
- - Fix #980: the system fails to reboot when a container is (stuck), for
-   whatever reason, in its 'setup' state
- - Fix #990: web console, ttyd service, stopped working after upgrade to
-   Buildroot 2025.02, caused by new (missing) option `--writable`
- - Fix TCAM memory corruption in `mvpp2` Ethernet controller
- - Fix annoying (but harmless) usage message from the logger tool when
-   `startup-config` fails to load and the system reverts to failure mode
- - Fix harmless log warning for product specific init when no product
-   specific init scripts are found
- - Backport fixes for sysklogd, affecting hostname filtering and periods
-   in TAG names, pending official backport in Buildroot
-
-
-[v25.02.0][] - 2025-03-04
--------------------------
-
-### Changes
- - Upgrade Linux kernel to 6.12.18 (LTS)
- - Upgrade Buildroot to 2024.02.11 (LTS)
- - Add support for link aggregation (lag), static (balance-xor) and LACP
- - Add support for the [i.MX 8M Plus EVK][EVK]
- - YANG type change for SSH private/public keys, from ietf-crypto-types
-   to infix-crypto-types
- - Disable global IPv6 forwarding by default, enable by per-interface
-   setting.  Note, route advertisements are always accepted.  Issue #785
- - Drop automatic default route (interface route) for IPv4 autoconf, not
-   necessary and causes more confusion than good.  Issue #923
- - Update scripting with new RESTCONF examples
-
-### Fixes
- - Fix #896: `/etc/resolv.conf` not properly generated when system runs
-   in fail secure mode (failing to load `startup-config`)
- - Fix #902: containers "linger" in the system (state 'exited') after
-   having removed them from the configuration
- - Fix #930: container configuration changes does not apply at runtime
-   only when saved to `startup-config` and system is rebooted
- - Fix #936: DHCP server reconfiguration does not always take effect.
- - Fix #956: CLI `copy` command complains it cannot change owner when
-   copying `factory-config` to `running-config`.  Bogus error, the
-   latter is not really a file
- - Fix #977: "Operation not permitted" when saving `running-config` to
-   `startup-config` (harmless warning but annoying and concerning)
-
-[EVK]: https://www.nxp.com/design/design-center/development-boards-and-designs/8MPLUSLPD4-EVK
-
-
-[v25.01.0][] - 2025-01-31
--------------------------
-
-> [!NOTE]
-> This release contains breaking changes in the configuration file
-> syntax for DHCP clients.  Specifically DHCP options *with value*,
-> i.e., the syntax for sending a hexadecimal value now require `hex`
-> prefix before a string of colon-separated pairs of hex values.
-
-### Changes
-
- - Upgrade Linux kernel to 6.12.11 (LTS)
- - Upgrade Buildroot to 2024.02.10 (LTS)
- - Upgrade FRR from 9.1.2 to 9.1.3
- - Add support for configuring SSH server, issue #441.  As a result,
-   both SSH and NETCONF now use the same host key in `factory-config`
- - Add operational support for reading DNS resolver info, issue #510
- - Add operational support for NTP client, issue #510
- - Add support for more mDNS settings: allow/deny interfaces, acting
-   as "reflector" and filtering of reflected services.  Issue #678
- - Add DHCPv4 server support, multiple subnets with static hosts and
-   DHCP options on global, subnet, or host level, issue #703.
-   Contributed by [MINEx Networks](https://minexn.com/)
-   - DHCP client options aligned with DHCP server, `startup-config`
-     files with old syntax are automatically migrated
- - Breaking change in DHCP client options *with value*.  Hexadecimal
-   values must now be formatted as `{ "hex": "c0:ff:ee" }` (JSON)
- - Add documentation on management via SSH, Web (RESTCONF, Web
-   Console), and Console Port, issue #787
- - Add documentation of DNS client use and configuration, issue #798
- - Add support for changing boot order for the system with an RPC,
-   including support for reading boot order from operational datastore
- - Add support for GRE/GRETAP tunnels
- - Add support for STP/RSTP on bridges
- - Add support for VXLAN tunnels
- - Add support for configuring global LLDP `message-tx-interval`
-
 ### Fixes
 
- - Fix #777: Authorized SSH key not applied to `startup-config`
- - Fix #829: Avahi (mDNS responder) not starting properly on switches
-   with *many* ports (>10).  This led to a review of `sysctl`:
-   - New for IPv4:
-	 - Adjust IGMP max memberships: 20 -> 1000
-	 - Use neighbor information on nexthop selection
-	 - Use inbound interface address on ICMP errors
-	 - Ignore routes with link down
-	 - Disable `rp_filter`
-     - ARP settings have been changed to better fit routers, i.e.,
-       systems with multiple interfaces:
-	   - Always use best local address when sending ARP
-	   - Only reply to ARP if target IP is on the inbound interface
-	   - Generate ARP requests when device is brought up or HW address changes
-   - New for IPv6:
-	 - Keep static global addresses on link down
-	 - Ignore routes with link down
- - Fix #861: Fix error when running 251+ reconfigurations in test-mode
- - Fix #869: Setup of bridges is now more robust
- - Fix #899: DHCP client with client-id does not work
- - Minor cleanup of Networking Guide
- - Fix memory leaks in `confd`
+- Fix TCAM memory corruption in `mvpp2` Ethernet controller
 
 
 [v24.11.1][] - 2024-11-29
@@ -406,7 +228,7 @@ renamed to ease maintenance, more info below.
   with `custom-phys-address` to allow for constructing more free-form
   MAC addresses based on the chassis MAC (a.k.a., base MAC) address.
   For more information, see the YANG model, a few examples are listed in
-  the updated documentation.
+  the updated documentation.  
   The syntax will be automatically updated in the `startup-config` and
   `factory-config` -- make sure to verify the changes and update any
   static `factory-config` used for your products
@@ -1594,13 +1416,8 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
  - N/A
 
 [buildroot]:  https://buildroot.org/
-[v25.06.0]:   https://github.com/kernelkit/infix/compare/v25.05.1...v26.06.0
-[v25.05.1]:   https://github.com/kernelkit/infix/compare/v25.05.0...v25.05.1
-[v25.05.0]:   https://github.com/kernelkit/infix/compare/v25.04.0...v25.05.0
-[v25.04.0]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
-[v25.03.0]:   https://github.com/kernelkit/infix/compare/v25.02.0...v25.03.0
-[v25.02.0]:   https://github.com/kernelkit/infix/compare/v25.01.0...v25.02.0
-[v25.01.0]:   https://github.com/kernelkit/infix/compare/v24.11.0...v25.01.0
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.11.0...HEAD
+[v24.11.2]:   https://github.com/kernelkit/infix/compare/v24.11.1...v24.11.2
 [v24.11.1]:   https://github.com/kernelkit/infix/compare/v24.11.0...v24.11.1
 [v24.11.0]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.11.0
 [v24.10.2]:   https://github.com/kernelkit/infix/compare/v24.10.1...v24.10.2

doc/README.md

@@ -1,16 +1,13 @@
-<img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 
-Welcome to Infix, your immutable, friendly, and secure operating system!
-On these pages you can find both user and developer documentation.
+Welcome to Infix, your friendly Network Operating System!  On these
+pages you can find both user and developer documentation.
 
-Most topics on configuring the system include CLI examples, but every
-setting, as well as status read-back from the operational datastore, is
-also possible to perform using NETCONF or RESTCONF.  In fact, the Infix
-regression test system solely relies on NETCONF and RESTCONF.
+> Topics on configuring the system include CLI examples, every setting
+> is also possible to perform using NETCONF.  In fact, the Infix test
+> system solely relies on NETCONF for configuring network topologies.
 
-> [!TIP]
-> The CLI documentation is also available from inside the CLI itself
-> using the `help` command in admin-exec mode.
+The CLI documentation is also available from inside the CLI itself using
+the `help` command.
 
 - **CLI Topics**
    - [Introduction to the CLI](cli/introduction.md)
@@ -21,7 +18,6 @@ regression test system solely relies on NETCONF and RESTCONF.
    - [Introduction](introduction.md)
    - [System Configuration](system.md)
    - [Network Configuration](networking.md)
-   - [DHCP Server](dhcp.md)
    - [Syslog Support](syslog.md)
  - **Infix In-Depth**
    - [Boot Procedure](boot.md)

doc/boot.md

@@ -63,7 +63,7 @@ bootloader's validation procedure, user configuration is kept to a
 minimum.  Two settings are available:
 
 - **Boot order**: Since Infix maintains two copies of its software image,
-  and as some bootloaders support [netbooting][2], the order in which boot
+  and as some bootloaders support netbooting, the order in which boot
   sources are considered can be configured. To select the active
   source, use [RAUC][]:
 
@@ -349,8 +349,5 @@ can funtion reasonably well without a persistent `/var`, loosing
 If `var` is not available, Infix will still persist `/var/lib` using
 `cfg` as the backing storage.
 
-[^1]: See [Upgrading procedures and boot
-    order](system.md#upgrade-procedures-and-boot-order) for
-    information on upgrading via CLI.
-
-[2]: netboot.md
+[^1]: See [CLI Upgrade](cli/upgrade.md) for information on upgrading
+    via CLI.

doc/branding.md

@@ -60,14 +60,14 @@ rootfs overlay -- with a [VPD](vpd.md) you can even support several!
 ### Variables & Format Specifiers
 
 Parts of the configuration you likely always want to generated, like the
-SSH hostkey used by SSH server and NETCONF, a unique hostname, or the `admin` user's
+SSH hostkey used by NETCONF, a unique hostname, or the `admin` user's
 unique (per-device with a VPD) password hash.  This section lists the
 available keywords, see the next section for examples of how to use
 them:
 
  - **Default password hash:** `$factory$` (from VPD, .dtb, or built-in)  
    XPath: `/ietf-system:system/authentication/user/password`
- - **Default SSH and NETCONF hostkey:** `genkey` (regenerated at factory reset)
+ - **Default NETCONF hostkey:** `genkey` (regenerated at factory reset)  
    XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
  - **Hostname format specifiers:**  
    XPath: `/ietf-system:system/hostname`
@@ -214,15 +214,15 @@ text file without line breaks (`-w0`):
 ```bash
 $ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" |base64 -d
 .-------.
-|  . .  | Infix OS — Immutable.Friendly.Secure
+|  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.github.io
 '-'---'-'
 ```
 
 **IETF Keystore**
 
-Notice how both the public and private keys are left empty here, this
-cause them to be always automatically regenerated after each factory reset.
+Notice how both the public and private keys are left empty here.  The
+`genkey` is always automatically regenerated after each factory reset.
 Keeping the `factory-config` snippet like this means we can use the same
 file on multiple devices, without risking them sharing the same host
 keys.  Sometimes you may want the same host keys, but that is the easy
@@ -245,6 +245,8 @@ use-case and not documented here.
   },
 ```
 
+The `genkey` is currently only used by the NETCONF SSH backend.
+
 **IETF NETCONF Server**
 
 ```json
@@ -278,28 +280,6 @@ use-case and not documented here.
   },
 ```
 
-**Infix Services**
-```json
-  "infix-services:ssh": {
-    "enabled": true,
-    "hostkey": [
-      "genkey"
-    ],
-    "listen": [
-      {
-        "name": "ipv4",
-        "address": "0.0.0.0",
-        "port": 22
-      },
-      {
-        "name": "ipv6",
-        "address": "::1",
-        "port": 22
-      }
-    ]
-  }
-```
-
 
 
 Integration
@@ -390,30 +370,22 @@ But you can of course use only two numbers, *major.minor*, as well.
 > with your own versioning scheme.
 
 
-### Specifying Versioning Information
+### `INFIX_RELEASE`
 
-Two optional environment variables control the version information
-recorded in images. Both of these **must be** a lower-case string (no
-spaces or other characters outside of 0–9, a–z, '.', '_' and '-')
-identifying the operating system version, excluding any OS name
-information or release code name, and suitable for processing by
-scripts or usage in generated filenames.
-
-#### `INFIX_BUILD_ID`
-
-Used for `BUILD_ID` in `/etc/os-release`.
-
-**Default:** `$(git describe --always --dirty --tags)`, from the _top
-directory_. By default, the top directory refers to the root of the
-Infix source tree, but this can be changed by setting the branding
-variable `INFIX_OEM_PATH`, e.g. in a `defconfig` file or via `make
-menuconfig`, to the path of an enclosing br2-external.
-
-#### `INFIX_RELEASE`
+This global variable **must be** a lower-case string (no spaces or
+other characters outside of 0–9, a–z, '.', '_' and '-') identifying
+the operating system version, excluding any OS name information or
+release code name, and suitable for processing by scripts or usage
+in generated filenames.
 
 Used for `VERSION` and `VERSION_ID` in `/etc/os-release` and
 generated file names like disk images, etc.
 
-**Default:** `${INFIX_BUILD_ID}`
+**Default:** generated using `git describe --always --dirty --tags`,
+with an additional `-C $infix_path`.  This variable defaults to the
+Infix tree and can be changed by setting the menuconfig branding
+variable `INFIX_OEM_PATH` to that of the br2-external.  It is also
+possible to set the `GIT_VERSION` variable in your `post-build.sh`
+script to change how the VCS version is extracted.
 
 [NanoPi R2S]: https://github.com/kernelkit/infix/blob/main/board/aarch64/r2s/rootfs/etc/factory-config.cfg

doc/cli/upgrade.md

@@ -39,12 +39,7 @@ The secondary partition (`rootfs.1`) has now been upgraded and will be used as
 the *active* partition on the next boot.  Leaving the primary partition, with
 the version we are currently running, intact in case of trouble.
 
-See [upgrading procedures and boot order][2] for more information on
-    upgrading.
-
 [^1]: It is not possible to upgrade the partition we booted from.  Thankfully
     the underlying "rauc" subsystem keeps track of this.  Hence, to upgrade
     both partitions you must reboot to the new version (to verify it works)
     and then repeat the same command.
-
-[2]: ../system.md#upgrade-procedures-and-boot-order

doc/container.md

@@ -31,9 +31,9 @@ Infix comes with native support for Docker containers using [podman][].
 The [YANG model][1] describes the current level of support, complete
 enough to run both system and application containers.
 
-Key design features of Infix, like using Linux switchdev, allow users to
-assign switch ports directly to containers, not just bridged VETH pairs.
-This is a rare and in many cases *unique* feature of Infix.
+Key design features, like using Linux switchdev, allow users to assign
+switch ports directly to containers, not just bridged VETH pairs, this
+is a rare and in many cases *unique* feature of Infix.
 
 All network specific settings are done using the IETF interfaces YANG
 model, with augments for containers to ensure smooth integration with
@@ -43,7 +43,7 @@ container networking in podman.
 > Even though the `podman` command can be used directly from a shell
 > prompt, we strongly recommend using the CLI commands instead.  They
 > employ the services of a wrapper `container` script which handles the
-> integration of Docker containers in the system.
+> integration of containers in the system.
 
 
 Caution
@@ -83,20 +83,18 @@ In the CLI, containers can be run in one of two ways:
  1. `container run IMAGE [COMMAND]`, or
  2. enter `configure` context, then `edit container NAME`
 
-The first is useful mostly for testing, or running single commands in
-an image.  It is a wrapper for `podman run -it --rm ...`.
+The former is useful mostly for testing, or running single commands in
+an image.  It is a wrapper for `podman run -it --rm ...`, while the
+latter is a wrapper and adaptation of `podman create ...`.
 
-The second creates a read-only container that by default automatically
-start at every boot.   It basically wraps `podman create ...`.
+The second creates a read-only container that is automatically started
+at every boot.  When non-volatile storage is needed, data stored in a
+volume is persisted until explicitly removed from the configuration,
+i.e., across host and container reboots and upgrades.
 
-When non-volatile storage is needed two complementary options exist:
-
- - **Volumes:** data stored in a volume is persisted until explicitly
-   removed from the configuration, i.e., across host reboots and
-   container upgrades
- - **[Content Mounts](#content-mounts):** where the content of a file
-  mounted into the container is kept along with the container
-  configuration in the device's `startup-config`
+Another option is [Content Mounts](#content-mounts), where the content
+of a file mounted into the container is kept along with the container
+configuration in the device's `startup-config`.
 
 Podman ensures (using tmpfs) all containers have writable directories
 for certain critical file system paths: `/dev`, `/dev/shm`, `/run`,
@@ -129,30 +127,24 @@ Classic Hello World:
     Hello from Docker!
     This message shows that your installation appears to be working correctly.
 
-A web server with [nginx][], using standard docker bridge.  Podman will
-automatically create a VETH pair for us, connecting the container to the
-`docker0` bridge:
+Persistent web server using nginx, sharing the host's network:
 
     admin@example:/> configure
-    admin@example:/config/> edit interface docker0
-    admin@example:/config/interface/docker0/> set container-network
-    admin@example:/config/interface/docker0/> end
-    admin@example:/config/> edit container web
-    admin@example:/config/container/web/> set image docker://nginx:alpine
-    admin@example:/config/container/web/> set network publish 8080:80
-    admin@example:/config/container/web/> set network interface docker0
-    admin@example:/config/container/web/> set volume cache target /var/cache
-    admin@example:/config/container/web/> leave
+    admin@example:/config> edit container web
+    admin@example:/config/container/web> set image docker://nginx:alpine
+    admin@example:/config/container/web> set publish 80:80
+    admin@example:/config/container/web> set network host
+    admin@example:/config/container/web> leave
     admin@example:/> show container
 
 Exit to the shell and verify the service with curl, or try to attach
 to your device's IP address using your browser:
 
-    admin@example:~$ curl http://localhost:8080
+    admin@example:~$ curl http://localhost
 
-or connect to port 8080 of your running Infix system with a browser.
-See the following sections for how to add more interfaces and manage
-your container at runtime.
+or connect to port 80 of your running Infix system with a browser.  See
+the following sections for how to add more interfaces and manage your
+container at runtime.
 
 
 Container Images
@@ -464,11 +456,11 @@ in a `bridge`.  Below an example of a system container calls `set
 network interface docker0`, here we show how to set options for that
 network:
 
-    admin@example:/config/container/ntpd/> edit network interface docker0
-    admin@example:/config/container/ntpd/network/interface/docker0/>
-    admin@example:/config/container/ntpd/network/interface/docker0/> set option
+    admin@example:/config/container/ntpd/> edit network docker0 
+    admin@example:/config/container/ntpd/network/docker0/> 
+    admin@example:/config/container/ntpd/network/docker0/> set option 
     <string>  Options for masquerading container bridges.
-    admin@example:/config/container/ntpd/network/interface/docker0/> help option
+    admin@example:/config/container/ntpd/network/docker0/> help option 
     NAME
             option <string>
     
@@ -479,9 +471,9 @@ network:
                      mac=00:01:02:c0:ff:ee -- set fixed MAC address in container
                      interface_name=foo0   -- set interface name inside container
     
-    admin@example:/config/container/ntpd/network/interface/docker0/> set option ip=172.17.0.2
-    admin@example:/config/container/ntpd/network/interface/docker0/> set option interface_name=wan
-    admin@example:/config/container/ntpd/network/interface/docker0/> leave
+    admin@example:/config/container/ntpd/network/docker0/> set option ip=172.17.0.2
+    admin@example:/config/container/ntpd/network/docker0/> set option interface_name=wan
+    admin@example:/config/container/ntpd/network/docker0/> leave
 
 
 ### Container Host Interface
@@ -911,5 +903,4 @@ Container Image](#upgrading-a-container-image) (above).
 [14]:     https://github.com/kernelkit/curiOS/
 [15]:     https://github.com/kernelkit/curiOS/blob/2e4748f65e356b2c117f586cd9420d7ba66f79d5/board/system/rootfs/etc/inittab
 [tini]:   https://github.com/krallin/tini
-[nginx]:  https://hub.docker.com/_/nginx
 [podman]: https://podman.io

doc/developers-guide.md

@@ -131,8 +131,6 @@ This rebuilds (and installs) `foo` and `bar`, the `all` target calls
 on Buildroot to finalize the target filesystem and generate the images.
 The final `run` argument is explained below.
 
-
-
 ### `confd`
 
 The Infix `src/confd/` is the engine of the system.  Currently it is a
@@ -166,239 +164,17 @@ Now you can rebuild `confd`, just as described above, and restart Infix:
     make confd-rebuild all run
 
 
-### `statd`
-
-The Infix status daemon, `src/statd`, is responsible for populating the
-sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions,
-but unlike `confd`, it relies entirely on `yanger`, a Python script that
-gathers data from local linux services and feeds it into sysrepo.
-
-To apply changes, rebuild the image:
-
-    make python-statd-rebuild statd-rebuild all
-
-Rebuilding the image and testing on target for every change during
-development process can be tedious. Instead, `yanger` allows remote
-execution, running the script directly on the host system (test
-container):
-
-    infamy0:test # ../src/statd/python/yanger/yanger -x "../utils/ixll -A ssh d3a" ieee802-dot1ab-lldp
-
-`ixll` is a utility script that lets you run network commands using an
-**interface name** instead of a hostname. It makes operations like
-`ssh`, `scp`, and network discovery easier.
-
-Normally, `yanger` runs commands **locally** to retrieve data
-(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when
-executed with `-x "../utils/ixll -A ssh d3a"` it redirects these
-commands to a remote system connected to the local `d3a` interface via
-SSH. This setup is used for running `yanger` in an
-[interactive test environment](testing.md#interactive-usage). The yanger
-script runs on the `host` system, but key commands are executed on the
-`target` system.
-
-For debugging or testing, you can capture system command output and
-replay it later without needing a live system.
-
-To capture:
-
-    infamy0:test # ../src/statd/python/yanger/yanger -c /tmp/capture ieee802-dot1ab-lldp
-
-To replay:
-
-    infamy0:test # ../src/statd/python/yanger/yanger -r /tmp/capture ieee802-dot1ab-lldp
-
-This is especially useful when working in isolated environments or debugging
-issues without direct access to the DUT.
-
-### Upgrading Packages
-
-#### Buildroot
-
-Kernelkit maintains an internal [fork of
-Buildroot](https://github.com/kernelkit/buildroot), with branches
-following the naming scheme `YYYY.MM.patch-kkit`
-e.g. `2025.02.1-kkit`, which means a new branch should be created
-whenever Buildroot is updated. These branches should contain **only**
-changes to existing packages (but no new patches), modifications to
-Buildroot itself or upstream backports.
-
-KernelKit track the latest Buildroot LTS (Long-Term Support) release
-and updates. The upgrade of LTS minor releases is expected to have low
-impact and should be done as soon there is a patch release of
-Buildroot LTS is available.
-
-> **Depending on your setup, follow the appropriate steps below.**
-
-🔁 If you **already have** the Buildroot repo locally
-
-1. Navigate to the Buildroot directory
-   ```bash
-    $ cd buildroot
-   ```
-2. Pull the latest changes from KernelKit
-   ```bash
-   $ git pull
-   ```
-3. Fetch the latest tags from upstream
-   ```bash
-   $ git fetch upstream --tags
-   ```
-
-
-🆕 If you don't have the repo locally
-
-1. Clone the Kernelkit Buildroot repository
-   ```bash
-   $ git clone git@github.com:kernelkit/buildroot.git
-   ```
-
-2. Add the upstream remote
-   ```bash
-   $ git remote add upstream https://gitlab.com/buildroot.org/buildroot.git
-   ```
-3. Checkout old KernelKit branch
-   ```bash
-   $ git checkout 2025.02.1-kkit
-   ```
-
-
-🛠  Continue from here (applies to both cases):
-
-4. Create a new branch based on the **previous** KernelKit Buildroot
-   release (e.g.  `2025.02.1-kkit`) and name it according to the naming scheme (e.g. `2025.02.2-kkit`)
-   ```bash
-   $ git checkout -b 2025.02.2-kkit
-   ```
-5. Rebase the new branch onto the corresponding upstream release
-   ```bash
-   $ git rebase 2025.02.2
-   ```
-> [!NOTE] It is **not** allowed to rebase the branch when bumped in Infix.
-
-6. Push the new branch and tags
-   ```bash
-   $ git push origin 2025.02.2-kkit --tags
-   ```
-7. In Infix, checkout new branch of Buildroot
-   ```bash
-   $ cd buildroot
-   $ git fetch
-   $ git checkout 2025.02.2-kkit
-   ```
-8. Push changes
-Commit and push the changes. Don’t forget to update the changelog.
-
-9. Create a pull request.
-
-> [!NOTE] Remember to set the pull request label to `ci:main` to ensure full CI coverage.
-
-
-#### Linux kernel
-
-KernelKit maintains an internal [fork of Linux
-kernel](https://github.com/kernelkit/linux), with branches following
-the naming scheme `kkit-linux-[version].y`, e.g. `kkit-6.12.y`, which
-means a new branch should be created whenever the major kernel version
-is updated. This branch should contain *all* kernel patches used by
-Infix.
-
-KernelKit track the latest Linux kernel LTS (Long-Term Support)
-release and updates. The upgrade of LTS minor releases is expected to
-have low impact and should be done as soon as a patch release of the
-LTS Linux kernel is available.
-
-
-🔁 If you **already have** the Linux kernel repo locally
-
-1. Navigate to the Linux kernel directory
-   ```bash
-   $ cd linux
-   ```
-2. Get latest changes from KernelKit
-   ```bash
-   $ git pull
-   ```
-3. Fetch the latest tags from upstream
-   ```bash
-   $ git fetch upstream --tags
-   ```
-
-🆕 If you don't have the repo locally
-
-1. Clone the KernelKit Linux kernel repository
-   ```bash
-   $ git clone git@github.com:kernelkit/linux.git
-	```
-2. Add the upstream remote
-   ```bash
-   $ git remote add upstream git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
-   ```
-
-3. Checkout correct kernel branch
-   ```bash
-   $ git checkout kkit-linux-6.12.y
-   ```
-
-🛠  Continue from here (applies to both cases)
-
-
-4. Rebase on the upstream release
-   ```bash
-   $ git rebase v6.12.29
-   ```
-
-6. Push changes and the tags
-   ```bash
-
-   $ git push -f origin kkit-linux-6.12.y --tags
-   ```
-
-**Move to your infix directory**
-
-7. Generate patches
-   ```bash
-   $ make x86_64_defconfig
-   $ cd output
-   $ ../utils/kernel-refresh.sh -k /path/to/linux -o 6.12.28 -t v6.12.29
-   ```
-   > [!NOTE] See help of `kernel-refresh.sh` script for more information
-
-
-8. Push changes
-   Commit and push the changes. Don’t forget to update the s:changelog:doc/ChangeLog.md.
-
-9. Create a pull request.
-   > [!NOTE] Remember to set the pull request label to `ci:main` to ensure full CI coverage.
-
-
-### Agree on YANG Model
-
-When making changes to the `confd` and `statd` services, you will often need to update
-the YANG models. If you are adding a new YANG module, it's best to follow the
-structure of an existing one. However, before making any changes, **always discuss
-them with the Infix core team**. This helps avoid issues later in development and
-makes pull request reviews smoother.
-
-
 Testing
 -------
 
 Manual testing can be done using Qemu by calling <kbd>make run</kbd>,
-see also [Infix in Virtual Environments](virtual.md), or on a physical
-device by upgrading to the latest build or "[netbooting](netboot.md)"
-and running the image from RAM.  The latter is how most board porting
-work is done -- **much quicker** change-load-test cycles.
+see also [Infix in Virtual Environments](virtual.md).
 
 The Infix automated test suite is built around Qemu and [Qeneth][2], see:
 
  * [Testing](testing.md)
  * [Docker Image](../test/docker/README.md)
 
-With any new feature added to Infix, it is essential to include relevant
-test case(s).  See the [Test Development](testing.md#test-development)
-section for guidance on adding test cases.
-
 
 Reviewing
 ---------

doc/dhcp.md

@@ -1,171 +0,0 @@
-DHCP Server
-===========
-
-The DHCPv4 server provides automatic IP address assignment and network
-configuration for clients.  It supports address pools, static host
-assignments, and customizable DHCP options.  It also serves as a DNS
-proxy for local subnets and can even forward queries to upstream DNS
-servers[^1].
-
-> [!NOTE]
-> When using the CLI, the system automatically enables essential options
-> like DNS servers and default gateway based on the system's network
-> configuration.  These options can be disabled, changed or overridden,
-> at any level: global, subnet, or per-host.
-
-
-## Basic Configuration
-
-The following example configures a DHCP server for subnet 192.168.2.0/24
-with an address pool:
-
-```
-admin@example:/> configure
-admin@example:/config/> edit dhcp-server
-admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> leave
-```
-
-When setting up the server from the CLI, the system automatically adds a
-few default DHCP options that will be sent to clients: both DNS server
-and default gateway will use the system address on the matching
-interface.
-
-```
-admin@example:/> show running-config
-  "infix-dhcp-server:dhcp-server": {
-    "subnet": [
-      {
-        "subnet": "192.168.2.0/24",
-        "option": [
-          {
-            "id": "dns-server",
-            "address": "auto"
-          },
-          {
-            "id": "router",
-            "address": "auto"
-          }
-        ],
-        "pool": {
-          "start-address": "192.168.2.100",
-          "end-address": "192.168.2.200"
-        }
-      }
-    ]
-  }
-```
-
-> [!IMPORTANT]
-> Remember to set up an interface in this subnet, avoid using addresses
-> in the DHCP pool, or reserved for static hosts.  In Class C networks
-> the router usually has address `.1`.  Depending on the use-case, you
-> may also want to set up routing.
-
-
-## Static Host Assignment
-
-To reserve specific IP addresses for clients based on their MAC address,
-hostname, or client ID:
-
-```
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit host 192.168.2.10
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> set match mac-address 00:11:22:33:44:55
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> set hostname printer
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> leave
-```
-
-Match hosts using a client identifier instead of MAC address:
-
-```
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> edit host 192.168.1.50
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> edit match
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/match/> set client-id hex c0:ff:ee
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/match/> leave
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> set lease-time infinite
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> leave
-```
-
-The `hex` prefix here ensures matching of client ID is done using the
-hexadecimal octets `c0:ff:ee`, three bytes.  Without the prefix the
-ASCII string "c0:ff:ee", eight bytes, is used.
-
-> [!NOTE]
-> The DHCP server is fully RFC conformant, in the case of option 61 this
-> means that using the `hex` prefix will require the client to set the
-> `htype` field of the option to `00`.  See RFC 2132 for details.
-
-
-## Custom DHCP Options
-
-Configure additional DHCP options globally, per subnet, or per host:
-
-```
-admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit option dns-server
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/dns-server/> set address 8.8.8.8
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/dns-server/> leave
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit option ntp-server
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/ntp-server/> set address 192.168.2.1
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/ntp-server/> leave
-```
-
-When configuring, e.g., `dns-server`, or `router` options with the value
-`auto`, the system uses the IP address from the interface matching the
-subnet.  For example:
-
-```
-admin@example:/> show interfaces brief
-Interface    Status  Address
-eth0         UP      192.168.1.1/24
-eth1         UP      192.168.2.1/24
-
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> edit option dns-server
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/option/dns-server/> set address auto
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/option/dns-server/> leave
-```
-
-In this case, clients in subnet 192.168.1.0/24 will receive 192.168.1.1
-as their DNS server address.
-
-
-## Multiple Subnets
-
-Configure DHCP for multiple networks:
-
-```
-admin@example:/> configure
-admin@example:/config/> edit dhcp-server
-admin@example:/config/dhcp-server/> edit subnet 192.168.1.0/24
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> set pool start-address 192.168.1.100 end-address 192.168.1.200
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> leave
-admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> leave
-```
-
-
-## Monitoring
-
-View active leases and server statistics:
-
-```
-admin@example:/> show dhcp-server
-IP ADDRESS       MAC                HOSTNAME            CLIENT ID             EXPIRES
-192.168.2.22     00:a0:85:00:02:05                      00:c0:ff:ee           3591s
-192.168.1.11     00:a0:85:00:04:06  foo                 01:00:a0:85:00:04:06  3591s
-
-admin@example:/> show dhcp-server statistics
-DHCP offers sent                : 6
-DHCP ACK messages sent          : 5
-DHCP NAK messages sent          : 0
-DHCP decline messages received  : 0
-DHCP discover messages received : 6
-DHCP request messages received  : 5
-DHCP release messages received  : 6
-DHCP inform messages received   : 6
-```
-
-
-[^1]: This requires the system DNS resolver to be configured.

doc/discovery.md

@@ -1,21 +1,21 @@
-# Discover Devices
-
-Infix advertises itself via the [mDNS-SD](#mdns-sd) and [LLDP](#lldp)
-discovery protocols.  mDNS-SD has good client support in Windows, macOS
-and on Linux systems.  More on these protocols later.
-
-An even simpler method is available when directly attached to an Infix
-device:
+Discover Infix Units
+====================
 
 ```
-       .----.      Ethernet       .-------.
-       | PC +---------------------+ Infix |
-       '----' if1              e1 '-------'
+ .----.      Ethernet       .-------.
+ | PC +---------------------+ Infix |
+ '----' if1            eth0 '-------'
 ```
+Figure 1: PC directly connected over Ethernet to Infix unit (here eth0).
 
-With IPv6 you can *ping the all-hosts* address (ff02::1), the device's
-link-local IPv6 address is then seen in the response.  In the following
-example, the PC here uses *tap0* as *if1*, Infix responds with address
+
+When you wish to discover the IP address of an Infix switch, the simplest
+way is probably to *ping the IPv6 all-hosts* address (ff02::1) over a
+directly connected Ethernet cable. The unit's link-local IPv6 address is
+seen in the response.
+
+In the example below, the PC is connected to Infix via interface *tap0*
+(*tap0* is *if1* in Figure 1) and Infix responds with address
 *fe80::ff:fec0:ffed*.
 
 ```
@@ -31,11 +31,7 @@ rtt min/avg/max/mdev = 0.389/0.455/0.558/0.073 ms
 linux-pc:# 
 ```
 
-> [!TIP]
-> The `-L` option ignores local responses from the PC.
-
-This address can then be used to connect to the device, e.g., using SSH.
-Notice the syntax `username@address%interface`:
+The PC could connect then connect to Infix, e.g., using SSH.
 
 ```
 linux-pc:# ssh admin@fe80::ff:fec0:ffed%tap0
@@ -43,13 +39,17 @@ admin@fe80::ff:fec0:ffed%tap0's password: admin
 admin@infix-c0-ff-ee:~$ 
 ```
 
+## Discovery mechanisms available in Infix
 
-## LLDP
+Infix advertises its presence via the [mDNS](#mdns) and [LLDP](#lldp)
+discovery protocols.
 
-Infix supports LLDP (IEEE 802.1AB). For a device with factory default
-settings, the link-local IPv6 address can be read from the Management
-Address TLV using *tcpdump* or other sniffing tools[^1]:
 
+### LLDP
+
+Infix supports LLDP (IEEE 802.1AB). For a unit with factory default
+settings, the PC can readout the link-local IPv6 address from the
+Management Address TLV using *tcpdump* or other sniffing tools[^1].
 ```
 linux-pc:# tcpdump -i tap0 -Qin -v ether proto 0x88cc
 tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
@@ -83,12 +83,11 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
 linux-pc:# 
 ```
 
-If the device has an IPv4 address assigned, it is shown in an additional
+If the unit has an IPv4 address assigned, it is shown in an additional
 Management Address TLV.
 
-> [!NOTE]
-> The Management Addresses shown by LLDP are not necessarily associated
-> with the port transmitting the LLDP message.
+> **Note** The Management Addresses shown by LLDP are not
+> necessarily associated with the port transmitting the LLDP message. 
 
 In the example below, the IPv4 address (10.0.1.1) happens to be
 assigned to *eth0*, while the IPv6 address (2001:db8::1) is not.
@@ -131,9 +130,9 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
 linux-pc:#
 ```
 
-The following capabilities are available via NETCONF/RESTCONF or the Infix CLI.
-
-### LLDP Enable/Disable
+[^1]: [lldpd: implementation of IEEE 802.1ab
+    (LLDP)](https://github.com/lldp/lldpd) includes *lldpcli*, which
+    is handy to sniff and display LLDP packets.
 
 The LLDP service can be disabled using the following commands.
 
@@ -144,91 +143,13 @@ admin@infix-c0-ff-ee:/config/> leave
 admin@infix-c0-ff-ee:/> 
 ```
 
-To reenable it from the CLI config mode:
+### mDNS
 
-```
-admin@test-00-01-00:/config/> set lldp enabled 
-admin@test-00-01-00:/config/> leave
-```
-
-### LLDP Message Transmission Interval
-
-By default, LLDP uses a `message-tx-interval` of 30 seconds, as defined
-by the IEEE standard. Infix allows this value to be customized.
-To change it using the CLI:
-
-```
-admin@test-00-01-00:/config/> set lldp message-tx-interval 1
-admin@test-00-01-00:/config/> leave
-```
-
-### LLDP Administrative Status per Interface
-
-Infix supports configuring the LLDP administrative status on a per-port
-basis. The default mode is `tx-and-rx`, but the following options are 
-also supported:
-
-- `rx-only` – Receive LLDP packets only
-- `tx-only` – Transmit LLDP packets only
-- `disabled` – Disable LLDP on the interface
-
-Example configuration:
-
-```
-admin@test-00-01-00:/config/> set lldp port e8 dest-mac-address 01:80:C2:00:00:0E admin-status disabled
-admin@test-00-01-00:/config/> set lldp port e5 dest-mac-address 01:80:C2:00:00:0E admin-status rx-only 
-admin@test-00-01-00:/config/> set lldp port e6 dest-mac-address 01:80:C2:00:00:0E admin-status tx-only
-admin@test-00-01-00:/config/> leave
-```
-
-> [!NOTE]
-> The destination MAC address must be the standard LLDP multicast 
-> address: `01:80:C2:00:00:0E`.
-
-###  Displaying LLDP Neighbor Information
-
-In CLI mode, Infix also provides a convenient `show lldp` command to
-list LLDP neighbors detected on each interface:
-
-```
-admin@test-00-01-00:/> show lldp 
-INTERFACE       REM-IDX   TIME        CHASSIS-ID          PORT-ID             
-e5              1         902         00:a0:85:00:04:01   00:a0:85:00:04:07   
-e6              3         897         00:a0:85:00:03:01   00:a0:85:00:03:07   
-e8              2         901         00:a0:85:00:02:01   00:a0:85:00:02:05
-```
-
-## mDNS-SD
-
-DNS-SD/mDNS-SD can be used to discover Infix devices and services.  By
-default, Infix use the `.local` domain for advertising services.  Some
-networks use `.lan` instead, so this configurable:
-
-```
-admin@infix-c0-ff-ee:/> configure
-admin@infix-c0-ff-ee:/config/> edit mdns
-admin@infix-c0-ff-ee:/config/mdns/> set domain lan
-```
-
-Other available settings include limiting the interfaces mDNS responder
-acts on:
-
-```
-admin@infix-c0-ff-ee:/config/> set interfaces allow e1
-```
-
-or
-
-```
-admin@infix-c0-ff-ee:/config/> set interfaces deny wan
-```
-
-The `allow` and `deny` settings are complementary, `deny` always wins.
-
-----
-
-In Linux, tools such as *avahi-browse* or *mdns-scan*[^2] can be used to
-search for devices advertising their services via mDNS.
+DNS-SD/mDNS can be used to discover Infix units and services. Infix
+units present their IP addresses, services and hostname within the
+.local domain. This method has good client support in Apple and Linux
+systems. On Linux, tools such as *avahi-browse* or *mdns-scan*[^2] can
+be used to search for devices advertising their services via mDNS.
 
 ```
 linux-pc:# avahi-browse -ar
@@ -260,15 +181,9 @@ linux-pc:# avahi-browse -ar
 linux-pc:#
 ```
 
-> [!TIP]
-> The `-t` option is also very useful, it stops browsing automatically
-> when a "more or less complete list" has been printed.  However, some
-> devices on the LAN may be in deep sleep so run the command again if
-> you cannot find the device you are looking for.
-
 Additionally, *avahi-resolve-host-name* can be used to verify domain
-name mappings for IP addresses.  By default, it translates from IPv4
-addresses.  This function allows users to confirm that addresses are
+name mappings for IP addresses. By default, it translates from IPv4
+addresses. This function allows users to confirm that addresses are
 mapped correctly.
 
 ```
@@ -294,7 +209,7 @@ rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
 linux-pc:# ssh admin@infix-c0-ff-ee.local
 (admin@infix-c0-ff-ee.local) Password: 
 .-------.
-|  . .  | Infix OS — Immutable.Friendly.Secure
+|  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.org
 '-'---'-
 
@@ -304,21 +219,20 @@ linux-pc:#
 ```
 
 To disable mDNS/mDNS-SD, type the commands:
-
 ```
 admin@infix-c0-ff-ee:/> configure 
 admin@infix-c0-ff-ee:/config/> no mdns
 admin@infix-c0-ff-ee:/config/> leave
 ```
 
-### Human-Friendly Hostname Alias
+#### Human-Friendly Hostname Alias
 
-Each Infix deviuce advertise itself as *infix.local*, in addition to its
-full hostname (e.g., *infix-c0-ff-ee.local* or *foo.local*).  This alias
-works seamlessly on a network with a single Infix device, and makes it
-easy to connect when the exact hostname is not known in advance.  The
-examples below show how the alias can be used for actions such as
-pinging or establishing an SSH connection:
+Each Infix unit will advertise itself as *infix.local*, in addition to
+its full hostname (e.g., *infix-c0-ff-ee.local* or *foo.local*).  This
+alias works seamlessly on a network with a single Infix device, and
+makes it easy to connect when the exact hostname is not known in
+advance. The examples below show how the alias can be used for
+actions such as pinging or establishing an SSH connection:
 
 ```
 linux-pc:# ping infix.local -c 3
@@ -334,39 +248,36 @@ rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
 linux-pc:# ssh admin@infix.local
 (admin@infix.local) Password: 
 .-------.
-|  . .  | Infix OS — Immutable.Friendly.Secure
+|  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.org
 '-'---'-
 
 Run the command 'cli' for interactive OAM
 
-admin@infix-c0-ff-ee:~$
+linux-pc:#
 ```
 
 When multiple Infix devices are present on the LAN the alias will not
 uniquely identify a device; *infix.local* will refer to any of the
 Infix devices, likely the one that first appeared.
 
-> [!NOTE]
-> When multiple Infix devices are present on the LAN, use the full name,
-> e.g., *infix-c0-ff-ee.local* or *foo.local* rather than the alias
-> *infix.local* to deterministically connect to the device.
+> When multiple Infix units are present, use the full hostname (e.g.,
+> *infix-c0-ff-ee.local* or *foo.local*) rather than the alias
+> infix.local to deterministically connect to a unit.
 
 
-### Browse Network Using *network.local*
+#### Netbrowse service to find all your devices
 
-Another mDNS alias that all Infix devices advertise is *network.local*.
-This is a web service which basically runs `avahi-browse` and displays a
-table of other Infix devices and their services.
+Another mDNS alias that all Infix devices can advertise is
+*network.local*. This is a web service which basically runs avahi-browse
+and displays a table of other Infix devices and their services. 
 
 ![Netbrowse Service - network.local](img/network-local.png)
 
-With multiple Infix devices on the LAN, one will take the role of your
-portal to access all others, if it goes down another takes its place.
-
-To disable the netbrowse service, and the *network.local* alias, the
-following commands can be used:
+With multiple Infix devices on the LAN, one will be your portal to
+access all others, if it goes down another will take its place.
 
+To disable the netbrowse service, the following commands can be used:
 ```
 admin@infix-c0-ff-ee:/> configure 
 admin@infix-c0-ff-ee:/config/> edit web
@@ -374,8 +285,6 @@ admin@infix-c0-ff-ee:/config/web/> no netbrowse
 admin@infix-c0-ff-ee:/config/web/> leave
 ```
 
-
-[^1]: E.g., [lldpd](https://github.com/lldp/lldpd) which includes the
-    *lldpcli* too, handy to sniff and display LLDP packets.
 [^2]: [mdns-scan](http://0pointer.de/lennart/projects/mdns-scan/): a
-    tool for scanning for mDNS/DNS-SD services on the local network.
+    tool for scanning for mDNS/DNS-SD published services on the local
+    network

doc/eth-counters.md

@@ -6,7 +6,13 @@ This column contains the mapping between YANG and Linux / Ethtool counters.
 ┌─────────────────────────────────┬──────────────────────────────────┐
 │ YANG                            │ Linux / Ethtool                  │
 ├─────────────────────────────────┼──────────────────────────────────┤
-│ in-total-octets                 │ FramesReceivedOK,                │
+│ out-frames                      │ FramesTransmittedOK              │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-multicast-frames            │ MulticastFramesXmittedOK         │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-broadcast-frames            │ BroadcastFramesXmittedOK         │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-total-frames                 │ FramesReceivedOK,                │
 │                                 │ FrameCheckSequenceErrors         │
 │                                 │ FramesLostDueToIntMACRcvError    │
 │                                 │ AlignmentErrors                  │
@@ -19,23 +25,8 @@ This column contains the mapping between YANG and Linux / Ethtool counters.
 ├─────────────────────────────────┼──────────────────────────────────┤
 │ in-broadcast-frames             │ BroadcastFramesReceivedOK        │
 ├─────────────────────────────────┼──────────────────────────────────┤
-│ in-error-fcs-frames             │ FrameCheckSequenceErrors         │
-├─────────────────────────────────┼──────────────────────────────────┤
 │ in-error-undersize-frames       │ undersize_pkts                   │
 ├─────────────────────────────────┼──────────────────────────────────┤
-| in-error-oversize-frames        | etherStatsJabbers,               |
-|                                 | etherStatsOversizePkts           |
-├─────────────────────────────────┼──────────────────────────────────┤
-│ in-error-mac-internal-frames    │ FramesLostDueToIntMACRcvError    │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ out-frames                      │ FramesTransmittedOK              │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ out-multicast-frames            │ MulticastFramesXmittedOK         │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ out-broadcast-frames            │ BroadcastFramesXmittedOK         │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ infix-eth:out-good-octets       │ OctetsTransmittedOK              │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ infix-eth:in-good-octets        │ OctetsReceivedOK                 │
+│ in-error-fcs-frames             │ FrameCheckSequenceErrors         │
 └─────────────────────────────────┴──────────────────────────────────┘
 ```

doc/management.md

@@ -1,203 +0,0 @@
-# Management
-
-The system utilizes YANG models for keeping configuration and operational
-data. These databases can be managed through different interfaces such
-as NETCONF, RESTCONF, and CLI via SSH or Console.
-
-## SSH Management
-
-An SSH server (SSHv2) is provided for remote management. It can be
-enabled/disabled as shown below.
-
-```
-admin@example:/> configure
-admin@example:/config/> edit ssh
-admin@example:/config/ssh/> set enabled
-admin@example:/config/ssh/>
-```
-
-By default the SSH server accepts connections to port 22 on all its IP
-addresses, but this can be adjusted using the `listen` command. To
-make the server (only) listen for incoming connections to IP address
-_192.168.1.1_ and port _12345_ the following commands can be used.
-
-```
-admin@example:/> configure
-admin@example:/config/> edit ssh
-admin@example:/config/ssh/> show
-enabled true;
-hostkey genkey;
-listen ipv4 {
-  address 0.0.0.0;
-  port 22;
-}
-listen ipv6 {
-  address ::;
-  port 22;
-}
-admin@example:/config/ssh/> no listen ipv6
-admin@example:/config/ssh/> edit listen ipv4
-admin@example:/config/ssh/listen/ipv4/> set address 192.168.1.1
-admin@example:/config/ssh/listen/ipv4/> set port 12345
-admin@example:/config/ssh/listen/ipv4/>
-```
-
-The default SSH hostkey is generated on first boot and is used in both
-SSH and NETCONF (SSH transport). Custom keys can be added to the
-configuration in `ietf-keystore`. The only supported hostkey type is
-RSA for now, thus the private key must be
-`ietf-crypto-types:rsa-private-key-format` and the public key
-`ietf-crypto-types:ssh-public-key-format`
-
-### Use your own SSH hostkeys
-
-Hostkeys can be generated with OpenSSL:
-```bash
-openssl genpkey -quiet -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -outform PEM > mykey
-openssl rsa -RSAPublicKey_out < mykey > mykey.pub
-```
-Store the keys in `ietf-keystore` _without_ the header and footer information
-created by OpenSSL.
-
-After the key has been stored in the keystore and given the name
-_mykey_ it can be added to SSH configuration:
-
-	admin@example:/> configure
-	admin@example:/config/> edit ssh
-	admin@example:/config/ssh/> set hostkey mykey
-
-## Console Port
-
-For units with a console port, it is possible for users to login to
-shell/CLI with functionality similar to what is provided via SSH.
-
-The type and setup for your console port is product specific. For
-instance, it can be a USB-C port connected to the CPU serial port
-using a USB-to-serial converter. To connect you would need a USB-C cable
-connected to the console port of the device. The serial port is
-typically setup to run at 115200 baud, 8N1.
-
-
-```
-Infix OS — Immutable.Friendly.Secure v24.11.1 (ttyS0)
-example login: admin
-Password:
-.-------.
-|  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
-'-'---'-'
-
-Run the command 'cli' for interactive OAM
-
-admin@example:~$
-```
-
-The `resize` command can be used to update terminal settings to the
-size of your terminal window.
-
-```
-admin@example:~$ resize
-COLUMNS=115;LINES=59;export COLUMNS LINES;
-admin@example:~$
-```
-
-CLI can be entered from shell in the same way as for SSH.
-
-```
-admin@example:~$ cli
-
-See the 'help' command for an introduction to the system
-
-admin@example:/> show interfaces
-INTERFACE       PROTOCOL   STATE       DATA
-lo              ethernet   UP          00:00:00:00:00:00
-                ipv4                   127.0.0.1/8 (static)
-                ipv6                   ::1/128 (static)
-e1              ethernet   LOWER-DOWN  00:53:00:06:03:01
-e2              ethernet   LOWER-DOWN  00:53:00:06:03:02
-...
-admin@example:/>
-```
-
-## Web, Web-console and RESTCONF
-
-The system provides a set of Web services:
-
-- a rudimentary Web server, currently limited to an information page
-- a RESTCONF server with equivalent management capabilities as NETCONF
-- a Web console service, where the shell/CLI can be accessed via
-  HTTPS, similar to connecting via a console port or SSH
-
-There is also a *Netbrowse* Web service presenting information about
-the unit's neighbors, collected via mDNS (see
-[Discovery](discovery.md) for more details).
-
-```
-admin@example:/> configure
-admin@example:/config/> edit web
-admin@example:/config/web/> help
-  enabled                           Enable or disable on all web services.
-  console                           Web console interface.
-  netbrowse                         mDNS Network Browser.
-  restconf                          IETF RESTCONF Server.
-admin@example:/config/web/>
-```
-
-### Enable/disable Web Service and Server
-
-The Web service can be enabled as shown below.
-
-```
-admin@example:/> configure
-admin@example:/config/> edit web
-admin@example:/config/web/> set enabled
-admin@example:/config/web/> 
-```
-
-Enabling the Web service implies that a Web server is
-enabled. Currently this Web server provides generic Infix information,
-as well as a link to a Web console. The Web server uses HTTPS; any
-HTTP request is redirected to HTTPS.
-
-The _enabled_ setting for the Web service acts as a global
-enable/disable setting for the other Web services (Web console,
-RESTCONF and Netbrowse).
-
-### Enable/disable Web Console
-
-The Web console service provides a terminal service similar to Console
-or SSH. The Web console is secured via HTTPS on port 7861.
-
-The Web console has its own enable/disable setting, but will only be
-activated if the Web service is enabled. The example below shows how
-to disable the Web console.
-
-```
-admin@example:/config/web/> edit console
-admin@example:/config/web/console/> no enabled
-admin@example:/config/web/console/>
-```
-
-### Enable/disable RESTCONF Service
-
-Alternatively, the system can be managed remotely using
-RESTCONF. Meaning you can `curl` it instead of using a dedicated
-NETCONF client.
-
-The RESTCONF service has its own enable/disable setting, but will
-only be activated if the Web service is enabled. The example below
-shows how to disable the RESTCONF service.
-
-```
-admin@example:/config/web/> edit restconf
-admin@example:/config/web/restconf/> no enabled
-admin@example:/config/web/restconf/>
-```
-
-# System Upgrade
-
-See [upgrading procedures and boot order][1] for information on
-    upgrading.
-
-
-[1]: system.md#upgrade-procedures-and-boot-order

doc/netboot.md

@@ -1,130 +0,0 @@
-Netboot HowTo
-=============
-
-This document describes how to set up network booting U-Boot devices on
-a LAN, e.g., when working with an evaluation board or other embedded
-system.  The most secure way to do this is with a local LAN between a PC
-and the device.
-
-Instead of setting up everything in U-Boot to download the Linux Image,
-device tree, and initramfs, we will let U-Boot download a script with
-instructions to run.  When you have multiple systems (boards) this
-quickly becomes a lot easier to manage.
-
-> [!NOTE]
-> Instructions in this HowTo assume a Debian based development system,
-> e.g., Ubuntu or Linux Mint.
-
-
-## Network Interface Setup
-
-For two dedicated network interfaces, here `eth2` and `eth3` (ymmv), we
-create an old-style interfaces config[^1] with the following content:
-
-```
-# /etc/network/interfaces.d/gimli
-auto eth2
-iface eth2 inet static
-        address 192.168.0.1
-        netmask 255.255.255.0
-
-auto eth3
-iface eth3 inet manual
-```
-
-> [!TIP]
-> Use configuration file names in `.d/` directories that make sense and
-> can easily be remembered.  Here we use the hostname of the PC.
-
-
-## DHCP/TFTP Server Setup
-
-The examples given here use `dnsmasq`, which provides both DHCP and TFTP
-server support.  The same can be achieved with other implementations.
-
-Similar to `interfaces.d`, dnsmasq has an `/etc/dnsmasq.d` directory so
-we can use "snippets" instead of modifying `/etc/dnsmasq.conf` directly.
-Add a file called `/etc/dnsmasq.d/gimli`.
-
-Initial content:
-
-```
-# Remember IP address handed out to BOOTP clients
-bootp-dynamic
-# Disable check-if-ip-address-is-already-used
-no-ping
-
-# Enable TFTP server, use /srv/ftp, same as any FTP server, useful
-# when using the same images for system upgrade as for netbooting.
-enable-tftp
-tftp-root=/srv/ftp
-```
-
-> [!CAUTION]
-> First of all, make sure you DO NOT accidentally set up dnsmasq so that
-> it starts acting as a DHCP server also on your office LAN!  Follow the
-> instructions below for more details.
-
-If you have many interfaces used for lab equipment and only one office
-LAN interface, then use something like this:
-
-```
-# Disable DHCP server on loopback and office LAN (eth0)
-except-interface=lo
-except-interface=eth0
-```
-
-To further lock this down, we only run the DHCP server on each of the
-interfaces used for lab equipment, with a dedicated IP range as well:
-
-```
-# Currently I have an imx8mp-evk on eth2, so on my system I have a
-# symlink bootfile-eth2 -> netboot.scr
-interface=eth2
-dhcp-range=192.168.0.100,192.168.0.199,1h
-dhcp-boot=tag:eth2,bootfile-eth2
-```
-
-## Bootfile netboot.scr
-
-The bootfile U-Boot retrieves from the TFTP server is a script that
-looks like this, `netboot.sh`:
-
-```sh
-setenv ramdisk_addr_r 0x58000000
-setenv fdt_addr_r     0x50400000
-
-setenv autoboot off
-tftp ${fdt_addr_r}     imx8mp-evk/imx8mp-evk.dtb
-tftp ${kernel_addr_r}  imx8mp-evk/Image
-tftp ${ramdisk_addr_r} imx8mp-evk/rootfs.squashfs
-
-setenv bootargs console=ttymxc1,115200 root=/dev/ram0 brd.rd_size=500000 rauc.slot=net
-booti ${kernel_addr_r} ${ramdisk_addr_r}:${filesize} ${fdt_addr_r}
-```
-
-U-Boot cannot read script files directly, so we need to wrap it with a
-FIT format header, this is done by first converting it on the PC:
-
-```
-$ mkimage -T script -d netboot.sh netboot.scr
-```
-
-The output is `netboot.scr` which we symlink to above in the dnsmasq
-setup step.
-
-
-## U-Boot Commands
-
-U-Boot is a maze of environment variables, some with values, some wrap
-commands, and most are undocumented.  We will use a prefix for our
-variables to ensure we do not overwrite anything you may want to use
-later.
-
-```sh
-==> setenv ixboot 'dhcp && source \${fileaddr}'
-==> saveenv
-```
-
-
-[^1]: To prevent NetworkManager from automatically managing the interfaces.

doc/networking.md

@@ -43,18 +43,18 @@ it.  In this example, traffic assigned to the VLAN in question would be
 diverted to the VLAN interface before entering the bridge, while all
 other traffic would be bridged as usual.
 
-| **Type** | **Yang Model**             | **Description**                                              |
-|----------|----------------------------|--------------------------------------------------------------|
-| bridge   | infix-if-bridge            | SW implementation of an IEEE 802.1Q bridge                   |
-| ip       | ietf-ip, infix-ip          | IP address to the subordinate interface                      |
-| vlan     | infix-if-vlan              | Capture all traffic belonging to a specific 802.1Q VID       |
-| lag      | infix-if-lag               | Link aggregation, static and IEEE 802.3ad (LACP)             |
-| lo       | ietf-interfaces            | Software loopback interface                                  |
-| eth      | ieee802-ethernet-interface | Physical Ethernet device/port.                               |
-|          | infix-ethernet-interface   |                                                              |
-| veth     | infix-if-veth              | Virtual Ethernet pair, typically one end is in a container   |
-| *common* | ietf-interfaces,           | Properties common to all interface types                     |
-|          | infix-interfaces           |                                                              |
+| **Type** | **Yang Model**             | **Description**                                               |
+|----------|----------------------------|---------------------------------------------------------------|
+| bridge   | infix-if-bridge            | SW implementation of an IEEE 802.1Q bridge                    |
+| ip       | ietf-ip, infix-ip          | IP address to the subordinate interface                       |
+| vlan     | infix-if-vlan              | Capture all traffic belonging to a specific 802.1Q VID        |
+| lag[^1]  | infix-if-lag               | Bonds multiple interfaces into one, creating a link aggregate |
+| lo       | ietf-interfaces            | Software loopback interface                                   |
+| eth      | ieee802-ethernet-interface | Physical Ethernet device/port.                                |
+|          | infix-ethernet-interface   |                                                               |
+| veth     | infix-if-veth              | Virtual Ethernet pair, typically one end is in a container    |
+| *common* | ietf-interfaces,           | Properties common to all interface types                      |
+|          | infix-interfaces           |                                                               |
 
 
 ## Data Plane
@@ -154,9 +154,9 @@ fabric!
 #### MAC Bridge
 
 In Infix ports are by default not switch ports, unless the customer
-specific factory config sets it up this way.  To enable switching, with
-offloading if you have a switch chipset, between ports you create a
-bridge and then add ports to that bridge.  Like this:
+specific factory config sets it up this way.  To enable switching
+between ports you create a bridge and then add ports to that
+bridge. That's it.
 
 ```
 admin@example:/> configure
@@ -170,15 +170,13 @@ admin@example:/config/> leave
 Here we add two ports to bridge `br0`: `eth0` and `eth1`.
 
 > [!TIP]
-> The CLI has several built-in helpers governed by convention.  E.g.,
-> naming bridges `brN`, where `N` is a number, the type is *inferred*
-> automatically and unlocks all bridge features.  Other conventions are
-> `vethNA`, where `N` is a number and `A` is a letter ('a' for access
-> port and 'b' for bridge side is common), and `ethN.M` for VLAN M on
-> top of `ethN`, or `dockerN` for a IP masquerading container bridge.
->
-> Note, this inference only works with the CLI, configuring networking
-> over NETCONF or RESTCONF requires setting the type explicitly.
+> Infix has many built-in helpers controlled by convention.  Example,
+> naming your bridge `brN`, where `N` is a number, hints Infix to set
+> interface type automatically and unlocks all bridge features.  Other
+> "magic" names are `vethNA`, where `N` is a number and `A` is a letter
+> ('a' for access port and 'b' for bridge side is common), and `ethN.M`
+> for VLAN M on top of `ethN`, or `dockerN` to create an IP masquerading
+> container bridge.
 
 ![A MAC bridge with two ports](img/mac-bridge.svg)
 
@@ -189,11 +187,11 @@ bridge should be used instead.
 
 #### VLAN Filtering Bridge
 
-By default bridges in Linux do not filter based on VLAN tags.  This can
-be enabled when creating a bridge by adding a port to a VLAN as a tagged
-or untagged member.  Use the port default VID (PVID) setting to control
-VLAN association for traffic ingressing a port untagged (default PVID:
-1).
+By default bridges in Linux do not filter based on VLAN tags.  It can be
+enabled in Infix when creating a bridge by adding a port to a VLAN as a
+tagged or untagged member.  Use the port default VID (PVID) setting to
+control VLAN association for traffic ingressing a port untagged (default
+PVID: 1).
 
 ```
 admin@example:/config/> edit interface br0
@@ -285,15 +283,15 @@ br0                  224.1.1.1             e3, e2
 br0                  ff02::6a              br0
 ```
 
-This is a rather small LAN, so our bridge has already become the elected
-IGMP querier.  We see it is ours because the timeout is `None`, and we
-recognize the IP address the system has detected, as ours.  We can also
-see two ports that have joined the same IPv4 multicast group, 224.1.1.1,
-and one join from the system itself for the IPv6 group ff02::6a.
+It is a small LAN, so our bridge has already become the elected IGMP
+querier.  We see it is ours because the timeout is `None`, and we
+recognize our IP address.  We can also see two ports that have joined
+the same IPv4 multicast group, 224.1.1.1, and one join from Infix itself
+for the IPv6 group ff02::6a.
 
-Now, let us see what happens when we add another bridge, this time with
-VLAN filtering enabled.  We skip the boring parts about how to move
-ports e4-e7 to `br1` and assign them to VLANs, and again, focus on the
+Now, let's see what happens when we add another bridge, with VLAN
+filtering enabled.  We skip the boring parts about how to move ports
+e4-e7 to `br1` and assign them to VLANs, and again, focus on the
 multicast bits only:
 
 ```
@@ -305,7 +303,7 @@ admin@example:/config/interface/br1/> leave
 admin@example:/> copy running-config startup-config
 ```
 
-Let us see what we get:
+Let's see what we get:
 
 ```
 admin@example:/> show ip multicast
@@ -406,15 +404,15 @@ an IGMP/MLD fast-leave port.
 
 #### Forwarding of IEEE Reserved Group Addresses
 
-Addresses in the range `01:80:C2:00:00:0X` are used by various bridge
-signaling protocols, and are not forwarded by default.  Still, it is
-sometimes useful to let the bridge forward such packets, this can be
-done by specifying protocol names or the last address *nibble* as
-decimal value `0..15`:
+Addresses in range `01:80:C2:00:00:0X` are used by various bridge
+signaling protocols, and are not forwarded by default. Still, it is
+sometimes useful to let the bridge forward such packets, and Infix
+supports this by specifying protocol names or the last address
+*nibble* as decimal value `0..15`.
 
 ```
 admin@example:/config/> edit interface br0 bridge
-admin@example:/config/interface/br0/bridge/> set ieee-group-forward     # Tap the ? ley for alternatives
+admin@example:/config/interface/br0/bridge/> set ieee-group-forward <?>
   [0..15]  List of IEEE link-local protocols to forward, e.g., STP, LLDP
   dot1x    802.1X Port-Based Network Access Control.
   lacp     802.3 Slow Protocols, e.g., LACP.
@@ -430,268 +428,9 @@ admin@example:/config/interface/br0/bridge/> set ieee-group-forward lldp
 admin@example:/config/interface/br0/bridge/>
 ```
 
-
-### Link Aggregation
-
-A link aggregate, or *lag*, allows multiple physical interfaces to be
-combined into a single logical interface, providing increased bandwidth
-(in some cases) and redundancy (primarily).  Two modes of qualifying lag
-member ports are available:
-
- 1. **static**: Active members selected based on link status (carrier)
- 2. **lacp:** IEEE 802.3ad Link Aggregation Control Protocol
-
-In LACP mode, LACPDUs are exchanged by the link partners to qualify each
-lag member, while in static mode only carrier is used.  This additional
-exchange in LACP ensures traffic can be forwarded in both directions.
-
-Traffic distribution, for both modes, across the active lag member ports
-is determined by the hash policy[^1].  It uses an XOR of the source,
-destination MAC addresses and the EtherType field.  This, IEEE
-802.3ad-compliant, algorithm will place all traffic to a particular
-network peer on the same link.  Meaning there is no increased bandwidth
-for communication between two specific devices.
-
-> [!TIP]
-> Similar to other interface types, naming your interface `lagN`, where
-> `N` is a number, allows the CLI to automatically infer the interface
-> type as LAG.
-
-
-#### Basic Configuration
-
-Creating a link aggregate interface and adding member ports:
-
-```
-admin@example:/> configure
-admin@example:/config/> edit interface lag0
-admin@example:/config/interface/lag0/> set lag mode static
-admin@example:/config/interface/lag0/> end
-admin@example:/config/> set interface eth7 lag-port lag lag0
-admin@example:/config/> set interface eth8 lag-port lag lag0
-admin@example:/config/> leave
-```
-
-A static lag responds only to link (carrier) changes of member ports.
-E.g., in this example egressing traffic is continuously distributed over
-the two links until link down on one link is detected, triggering all
-traffic to be steered to the sole remaining link.
-
-
-#### LACP Configuration
-
-LACP mode provides dynamic negotiation of the link aggregate.  Key
-settings include:
-
-```
-admin@example:/> configure
-admin@example:/config/> edit interface lag0
-admin@example:/config/interface/lag0/> set lag mode lacp
-admin@example:/config/interface/lag0/> set lag lacp mode passive
-admin@example:/config/interface/lag0/> set lag lacp rate fast
-admin@example:/config/interface/lag0/> set lag lacp system-priority 100
-```
-
-LACP mode supports two operational modes:
-
- - **active:** Initiates negotiation by sending LACPDUs (default)
- - **passive:** Waits for peer to initiate negotiation
-
-> [!NOTE]
-> At least one end of the link must be in active mode for negotiation to occur.
-
-The LACP rate setting controls protocol timing:
-
- - **slow:** LACPDUs sent every 30 seconds, with 90 second timeout (default)
- - **fast:** LACPDUs sent every second, with 3 second timeout
-
-
-#### Link Flapping
-
-To protect against link flapping, debounce timers can be configured to
-delay link qualification.  Usually only the `up` delay is needed:
-
-```
-admin@example:/config/interface/lag0/lag/link-monitor/> edit debounce
-admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set up 500
-admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set down 200
-```
-
-#### Operational Status, Overview
-
-Like other interfaces, link aggregates are also available in the general
-interfaces overview in the CLI admin-exec context.  Here is the above
-static mode aggregate:
-
-```
-admin@example:/> show interfaces
-INTERFACE       PROTOCOL   STATE       DATA
-lo              ethernet   UP          00:00:00:00:00:00
-                ipv4                   127.0.0.1/8 (static)
-                ipv6                   ::1/128 (static)
-.
-.
-.
-lag0            lag        UP          static: balance-xor, hash: layer2
-│               ethernet   UP          00:a0:85:00:02:00
-├ eth7          lag        ACTIVE
-└ eth8          lag        ACTIVE
-```
-
-Same aggregate, but in LACP mode:
-
-```
-admin@example:/> show interfaces
-INTERFACE       PROTOCOL   STATE       DATA
-lo              ethernet   UP          00:00:00:00:00:00
-                ipv4                   127.0.0.1/8 (static)
-                ipv6                   ::1/128 (static)
-.
-.
-.
-lag0            lag        UP          lacp: active, rate: fast (1s), hash: layer2
-│               ethernet   UP          00:a0:85:00:02:00
-├ eth7          lag        ACTIVE      active, short_timeout, aggregating, in_sync, collecting, distributing
-└ eth8          lag        ACTIVE      active, short_timeout, aggregating, in_sync, collecting, distributing
-```
-
-
-#### Operational Status, Detail
-
-In addition to basic status shown in the interface overview, detailed
-LAG status can be inspected:
-
-```
-admin@example:/> show interfaces name lag0
-name                : lag0
-index               : 25
-mtu                 : 1500
-operational status  : up
-physical address    : 00:a0:85:00:02:00
-lag mode            : static
-lag type            : balance-xor
-lag hash            : layer2
-link debounce up    : 0 msec
-link debounce down  : 0 msec
-ipv4 addresses      :
-ipv6 addresses      :
-in-octets           : 0
-out-octets          : 2142
-```
-
-Same aggregate, but in LACP mode:
-
-```
-admin@example:/> show interfaces name lag0
-name                : lag0
-index               : 24
-mtu                 : 1500
-operational status  : up
-physical address    : 00:a0:85:00:02:00
-lag mode            : lacp
-lag hash            : layer2
-lacp mode           : active
-lacp rate           : fast (1s)
-lacp aggregate id   : 1
-lacp system priority: 65535
-lacp actor key      : 9
-lacp partner key    : 9
-lacp partner mac    : 00:a0:85:00:03:00
-link debounce up    : 0 msec
-link debounce down  : 0 msec
-ipv4 addresses      :
-ipv6 addresses      :
-in-octets           : 100892
-out-octets          : 111776
-```
-
-Member ports provide additional status information:
-
- - Link failure counter: number of detected link failures
- - LACP state flags: various states of LACP negotiation:
-   - `active`: port is actively sending LACPDUs
-   - `short_timeout`: using fast rate (1s) vs. slow rate (30s)
-   - `aggregating`: port is allowed to aggregate in this LAG
-   - `in_sync`: port is synchronized with partner
-   - `collecting`: port is allowed to receive traffic
-   - `distributing`: port is allowed to send traffic
-   - `defaulted`: using default partner info (partner not responding)
-   - `expired`: partner info has expired (no LACPDUs received)
- - Aggregator ID: unique identifier for this LAG group
- - Actor state: LACP state flags for this port (local)
- - Partner state: LACP state flags from the remote port
-
-Example member port status:
-
-```
-admin@example:/> show interfaces name eth7
-name                : eth7
-index               : 8
-mtu                 : 1500
-operational status  : up
-physical address    : 00:a0:85:00:02:00
-lag member          : lag0
-lag member state    : active
-lacp aggregate id   : 1
-lacp actor state    : active, short_timeout, aggregating, in_sync, collecting, distributing
-lacp partner state  : active, short_timeout, aggregating, in_sync, collecting, distributing
-link failure count  : 0
-ipv4 addresses      :
-ipv6 addresses      :
-in-octets           : 473244
-out-octets          : 499037
-```
-
-
-#### Example: Switch Uplink with LACP
-
-LACP mode provides the most robust operation, automatically negotiating
-the link aggregate and detecting configuration mismatches.
-
-A common use case is connecting a switch to an upstream device:
-
-```
-admin@example:/> configure
-admin@example:/config/> edit interface lag0
-admin@example:/config/interface/lag0/> set lag mode lacp
-```
-
-Enable fast LACP for quicker fail-over:
-
-```
-admin@example:/config/interface/lag0/> set lag lacp rate fast
-```
-
-Add uplink ports
-
-```
-admin@example:/config/interface/lag0/> end
-admin@example:/config/> set interface eth7 lag-port lag lag0
-admin@example:/config/> set interface eth8 lag-port lag lag0
-```
-
-Enable protection against "link flapping".
-
-```
-admin@example:/config/interface/lag0/> edit lag link-monitor
-admin@example:/config/interface/lag0/lag/link-monitor/> edit debounce
-admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set up 500
-admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set down 200
-admin@example:/config/interface/lag0/lag/link-monitor/debounce/> top
-```
-
-Add to bridge for switching
-
-```
-admin@example:/config/interface/lag0/lag/link-monitor/debounce/> end
-admin@example:/config/> set interface lag0 bridge-port bridge br0
-admin@example:/config/> leave
-```
-
-
 ### VLAN Interfaces
 
-Creating a VLAN can be done in many ways.  This section assumes VLAN
+Creating a VLAN can be done in many ways. This section assumes VLAN
 interfaces created atop another Linux interface.  E.g., the VLAN
 interfaces created on top of the Ethernet interface or bridge in the
 picture below.
@@ -733,7 +472,7 @@ top of a bridge interface *br0* is named *vlan10*.
 
 > [!NOTE]
 > If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a
-> number, the CLI infers the interface type automatically.
+> number, Infix will set the interface type automatically for you.
 
 
 ### Physical Ethernet Interfaces
@@ -899,8 +638,7 @@ admin@example:/config/>
 This section details IP Addresses And Other Per-Interface IP settings.
 
 Infix support several network interface types, each can be assigned one
-or more IP addresses, both IPv4 and IPv6 are supported.  (There is no
-concept of a "primary" address.)
+or more IP addresses, both IPv4 and IPv6 are supported.
 
 ![IP on top of network interface examples](img/ip-iface-examples.svg)
 
@@ -923,31 +661,31 @@ are listed below.  Configurable options can be disabled on a per client
 interface basis, some options, like `clientid` and option 81, are
 possible to set the value of as well.
 
-| **Opt** | **Name**                    | **Cfg** | **Description**                                     |
-|---------|-----------------------------|---------|-----------------------------------------------------|
-| 1       | `netmask`                   | No      | Request IP address and netmask                      |
-| 3       | `router`                    | Yes     | Default route(s), see also option 121 and 249       |
-| 6       | `dns-server`                | Yes     | DNS server(s), static ones take precedence          |
-| 12      | `hostname`                  | Yes     | DHCP cannot set hostname, only for informing server |
-| 15      | `domain`                    | Yes     | Default domain name, for name resolution            |
-| 28      | `broadcast`                 | Yes     | Broadcast address, calculated if disabled           |
-| 42      | `ntp-server`                | Yes     | NTP server(s), static ones take precedence          |
-| 50      | `address`                   | Yes     | Request (previously cached) address                 |
-| 61      | `client-id`                 | Yes     | Default MAC address (and option 12)                 |
-| 81      | `fqdn`                      | Yes     | Similar to option 12, request FQDN update in DNS    |
-| 119     | `search`                    | Yes     | Request domain search list                          |
-| 121     | `classless-static-route`    | Yes     | Classless static routes                             |
-| 249     | `ms-classless-static-route` | Yes     | Microsoft static route, same as option 121          |
-|         |                             |         |                                                     |
+| **Opt** | **Name**         | **Cfg** | **Description**                                     |
+|---------|------------------|---------|-----------------------------------------------------|
+| 1       | `subnet`         | No      | Request IP address and netmask                      |
+| 3       | `router`         | Yes     | Default route(s), see also option 121 and 249       |
+| 6       | `dns`            | Yes     | DNS server(s), static ones take precedence          |
+| 12      | `hostname`       | Yes     | DHCP cannot set hostname, only for informing server |
+| 15      | `domain`         | Yes     | Default domain name, for name resolution            |
+| 28      | `broadcast`      | Yes     | Broadcast address, calculated if disabled           |
+| 42      | `ntpsrv`         | Yes     | NTP server(s), static ones take precedence          |
+| 50      | `address`        | Yes     | Request (previously cached) address                 |
+| 61      | `clientid`       | Yes     | Default MAC address (and option 12)                 |
+| 81      | `fqdn`           | Yes     | Similar to option 12, request FQDN update in DNS    |
+| 119     | `search`         | Yes     | Request domain search list                          |
+| 121     | `staticroutes`   | Yes     | Classless static routes                             |
+| 249     | `msstaticroutes` | Yes     | Microsoft static route                              |
+|         |                  |         |                                                     |
 
-**Default:** `router`, `dns-server`, `domain`, `broadcast`, `ntp-server`, `search`,
-             `address`, `classless-static-route`, `ms-classless-static-route`
+**Default:** `router`, `dns`, `domain`, `broadcast`, `ntpsrv`, `search`,
+             `address`, `staticroutes`, `msstaticroutes`
 
 When configuring a DHCP client, ensure that the NTP client is enabled
-for the `ntp-server` DHCP option to be processed correctly.  If the NTP
+for the `ntpsrv` DHCP option to be processed correctly. If the NTP
 client is not enabled, any NTP servers provided by the DHCP server will
-be ignored. For details on how to enable the NTP client, see the [NTP
-Client Configuration](system.md#ntp-client-configuration) section.
+be ignored. For details on how to enable the NTP client, see the 
+[NTP Client Configuration](system.md#ntp-client-configuration) section.
 
 > [!IMPORTANT]
 > Per [RFC3442][4], if the DHCP server returns both a Classless Static
@@ -1040,6 +778,7 @@ will be used, otherwise it falls back to the default algorithm.
     admin@example:/> configure
     admin@example:/config/> edit dhcp-client
     admin@example:/config/dhcp-client/> set client-if eth0
+    admin@example:/config/dhcp-client/> set enabled true
     admin@example:/config/dhcp-client/> leave
     admin@example:/> show interfaces
     INTERFACE       PROTOCOL   STATE       DATA
@@ -1059,7 +798,7 @@ The resulting address (10.1.2.100/24) is of type *dhcp*.
 The (only) way to disable IPv6 link-local addresses is by disabling IPv6
 on the interface.
 
-```
+```(disabling
 admin@example:/> configure
 admin@example:/config/> edit interface eth0 ipv6
 admin@example:/config/interface/eth0/ipv6/> set enabled false
@@ -1173,38 +912,33 @@ have changed type to *random*.
 To be able to route (static or dynamic) on the interface it is
 required to enable forwarding. This setting controls if packets
 received on this interface can be forwarded.
-
-```
-admin@example:/config/> edit interface eth0
-admin@example:/config/interface/eth0/> set ipv4 forwarding
-admin@example:/config/interface/eth0/> leave
-admin@example:/>
-```
+   ```
+   admin@example:/config/> edit interface eth0
+   admin@example:/config/interface/eth0/> set ipv4 forwarding
+   admin@example:/config/interface/eth0/> leave
+   admin@example:/>
+   ```
 
 
 ### IPv6 forwarding
 
-Due to how the Linux kernel manages IPv6 forwarding, we can not fully
-control it per interface via this setting like how IPv4 works.  Instead,
-IPv6 forwarding is globally enabled when at least one interface enable
-forwarding, otherwise it is disabled.
+This flag behaves totally different than for IPv4. For IPv6 the
+ability to route between interfaces is always enabled, instead this
+flag controls if the interface will be in host/router mode.
 
-The following table shows the system IPv6 features that the `forwarding`
-setting control when it is *Enabled* or *Disabled:
+| **Feature**                              | **Forward enabled** | **Forward disabled** |
+|:-----------------------------------------|:--------------------|:---------------------|
+| IsRouter set in Neighbour Advertisements | Yes                 | No                   |
+| Transmit Router Solicitations            | No                  | Yes                  |
+| Router Advertisements are ignored        | No                  | Yes                  |
+| Accept Redirects                         | No                  | Yes                  |
 
-| **IPv6 Feature**                         | **Enabled** | **Disabled** |
-|:-----------------------------------------|:------------|:-------------|
-| IsRouter set in Neighbour Advertisements | Yes         | No           |
-| Transmit Router Solicitations            | No          | Yes          |
-| Router Advertisements are ignored        | Yes         | Yes          |
-| Accept Redirects                         | No          | Yes          |
-
-```
-admin@example:/config/> edit interface eth0
-admin@example:/config/interface/eth0/> set ipv6 forwarding
-admin@example:/config/interface/eth0/> leave
-admin@example:/>
-```
+   ```
+   admin@example:/config/> edit interface eth0
+   admin@example:/config/interface/eth0/> set ipv6 forwarding
+   admin@example:/config/interface/eth0/> leave
+   admin@example:/>
+   ```
 
 
 ## Routing support
@@ -1492,7 +1226,7 @@ currently supported, namely `ipv4` and `ipv6`.
 [4]: https://www.rfc-editor.org/rfc/rfc3442
 [0]: https://frrouting.org/
 
-[^1]: `(source MAC XOR destination MAC XOR EtherType) MODULO num_links`
+[^1]: Please note, link aggregates are not yet supported in Infix.
 [^2]: Link-local IPv6 addresses are implicitly enabled when enabling
     IPv6.  IPv6 can be enabled/disabled per interface in the
     [ietf-ip][2] YANG model.
@@ -1503,10 +1237,11 @@ currently supported, namely `ipv4` and `ipv6`.
 [^4]: A YANG deviation was previously used to make it possible to set
     `phys-address`, but this has been replaced with the more flexible
 	`custom-phys-address`.
-[^5]: MAC bridges on Marvell Linkstreet devices are currently limited to
-    a single MAC database, this may be a problem if the same MAC address
-    appears in different MAC bridges.
-[^6]: Ethernet counters are described in *ieee802-ethernet-interface.yang*
-    and *infix-ethernet-interface.yang*.  There is a dedicated document on
-    [Ethernet Counters](eth-counters.md) that provide additional details
-    on the statistics support.
+[^5]: Infix MAC bridges on Marvell Linkstreet devices are currently
+    limited to use a single MAC database, causing issues if the same
+    MAC address appears on different MAC bridges.
+[^6]: Ethernet counters are described in
+    *ieee802-ethernet-interface.yang* and
+    *infix-ethernet-interface.yang*. [Ethernet
+    Counters](eth-counters.md) page provides additional details on
+    statistics support.