.github: adjust release tag variables

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
.github: set 'latest' flag for non-pre-release builds
2026-07-22 09:13:01 +02:00 · 2024-03-01 18:38:22 +01:00 · 2024-03-01 16:03:26 +01:00 · 2024-03-01 14:17:20 +01:00 · 2024-03-01 14:14:33 +01:00 · 2024-03-01 14:13:43 +01:00
320 changed files with 25117 additions and 2802 deletions
@@ -0,0 +1,37 @@
+<!--- **Summarize** your changes in the title above -->
+
+## Description
+
+<!--
+  -- A description of changes, detailing *why* changes are made.
+  -- Remember: assign a reviewer, or use @mentions if org. member.
+  -->
+
+
+## Other information
+
+<!-- Other relevant info, e.g., before/after screenshots -->
+
+
+## Checklist
+
+Tick relevant boxes, this PR is-a or has-a:
+
+- [ ] Bugfix
+  - [ ] Regression tests
+  - [ ] ChangeLog updates (for next release)
+- [ ] Feature
+  - [ ] YANG model change => revision updated?
+  - [ ] Regression tests added?
+  - [ ] ChangeLog updates (for next release)
+  - [ ] Documentation added?
+- [ ] Code style update (formatting, renaming)
+- [ ] Refactoring (please detail in commit messages)
+- [ ] Build related changes
+- [ ] Documentation content changes
+- [ ] Other (please describe):
+
+
+## References
+
+<!-- Please list references to related issue(s) -->
@@ -16,7 +16,12 @@ jobs:
        variant: [netconf, classic]
      fail-fast: false
    steps:
-      - uses: actions/checkout@v3
+      - name: Maintenance
+        run: |
+          docker image prune -af
+          docker volume prune -f
+          docker container prune -f
+      - uses: actions/checkout@v4
      - name: Set Build Variables
        id: vars
        run: |
@@ -27,22 +32,25 @@ jobs:
          fi
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+          if [ "$target" = x86_64 ]; then
+              echo "out=$PWD/output"      >> $GITHUB_OUTPUT
+          else
+              echo "out=/mnt/x-$target"   >> $GITHUB_OUTPUT
+          fi
      - name: Restore Cache of dl/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: dl/
-          key: dl-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          key: dl-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
-            dl-${{ matrix.platform }}-${{ matrix.variant }}-
-            dl-${{ matrix.platform }}-
+            dl-${{ matrix.variant }}-
            dl-
      - name: Restore Cache of .ccache/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: .ccache/
-          key: ccache-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ matrix.platform }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
          restore-keys: |
-            ccache-${{ matrix.platform }}-${{ matrix.variant }}-
            ccache-${{ matrix.platform }}-
            ccache-
      - name: Configure & Build
@@ -52,22 +60,27 @@ jobs:
          else
              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
          fi
-          echo "Buildring $target ..."
+          echo "Building $target ..."
+          sudo mkdir ${{ steps.vars.outputs.out }}
+          sudo chown $(id -un):$(id -gn) ${{ steps.vars.outputs.out }}
+          export O=${{ steps.vars.outputs.out }}
          make $target
          make
      - name: Prepare Artifact
        run: |
-          cd output
+          cd ${{ steps.vars.outputs.out }}
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
      - name: Test
        if: matrix.platform == 'x86_64' && matrix.variant == 'netconf'
        run: |
+          export O=${{ steps.vars.outputs.out }}
          make test-qeneth
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
        with:
-          path: output/${{ steps.vars.outputs.tgz }}
+          path: ${{ steps.vars.outputs.out }}/${{ steps.vars.outputs.tgz }}
+          name: artifact-${{ matrix.variant }}-${{ matrix.platform }}
  release:
    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
    name: Upload Latest Build
@@ -76,7 +89,10 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
      - uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
@@ -86,7 +102,7 @@ jobs:
          prerelease: true
          tag: "latest"
          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "artifact/*"
+          artifacts: "*.tar.gz"
      - name: Summary
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
@@ -1,6 +1,8 @@
 name: Coverity Scan

 on:
+  schedule:
+    - cron: '5 0 * * *'
  workflow_dispatch:

 env:
@@ -9,6 +11,7 @@ env:

 jobs:
  coverity:
+    if: ${{github.repository_owner == 'kernelkit'}}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
@@ -21,7 +24,7 @@ jobs:
               --post-data "token=$TOKEN&project=${PROJECT_NAME}&md5=1" \
               -O coverity-latest.tar.gz.md5
          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
        id: cache
        with:
          path: coverity-latest.tar.gz
@@ -47,8 +50,9 @@ jobs:
      - name: Install dependencies
        run: |
          sudo apt-get -y update
-          sudo apt-get -y install pkg-config libjansson-dev libev-dev libite-dev \
-                                  libaugeas-dev libglib2.0-dev libpcre2-dev
+          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
+                       libaugeas-dev libglib2.0-dev libpcre2-dev      \
+                       libuev-dev libite-dev
      - name: Build dependencies
        run: |
          git clone https://github.com/CESNET/libyang.git
@@ -75,7 +79,7 @@ jobs:
            --form description="${PROJECT_NAME} $(git rev-parse HEAD)" \
            https://scan.coverity.com/builds?project=${PROJECT_NAME}
      - name: Upload build.log
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: coverity-build.log
          path: cov-int/build-log.txt
@@ -0,0 +1,100 @@
+name: Manny the Manager
+
+on:
+  workflow_dispatch:
+    inputs:
+      checkout:
+        required: true
+        type: boolean
+      cleanup:
+        required: true
+        type: boolean
+      peek:
+        required: true
+        type: boolean
+
+jobs:
+  inventory:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Disk usage ...
+        run: |
+          cd
+          du -hs .[^.]*
+      - name: Disk inventory (1/2) ...
+        run: |
+          echo "df -h ========================================================================="
+          df -h
+          echo "mounts ========================================================================"
+          mount
+      - name: File inventory (1/2) ...
+        run: |
+          echo "Current directory: $(pwd)"
+          echo "Files in $HOME ================================================================"
+          ls $HOME
+          echo "Find $HOME ===================================================================="
+          find $HOME
+      - name: Container inventory ...
+        run: |
+          echo "Available container images: ==================================================="
+          docker images
+          echo "Available containers: ========================================================="
+          docker ps -a
+
+  checkout:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Restore Cache of dl/
+        uses: actions/cache@v4
+        with:
+          path: dl/
+          key: dl-netconf-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-netconf-
+            dl-
+      - name: Restore Cache of .ccache/
+        uses: actions/cache@v4
+        with:
+          path: .ccache/
+          key: ccache-x86_64-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-x86_64-
+            ccache-
+      - name: Disk inventory (2/2) ...
+        run: |
+          echo "df -h ========================================================================="
+          df -h
+          echo "mounts ========================================================================"
+          mount
+      - name: File inventory (2/2) ...
+        run: |
+          echo "Current directory: $(pwd)"
+          echo "Files in $HOME ================================================================"
+          ls $HOME
+          echo "Find $HOME ===================================================================="
+          find $HOME
+
+  peeky:
+    if: ${{ inputs.peek }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Peek & Poke ...
+        run: |
+          whoami
+          ls -l /mnt/
+          cat /mnt/DATALOSS_WARNING_README.txt
+          sudo mkdir /mnt/x-aarch64
+          sudo chown $(id -un):$(id -gn) /mnt/x-aarch64
+          ls -l /mnt/
+
+  cleanup:
+    if: ${{ inputs.cleanup }}
+    needs: [inventory, peeky]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Cleaning up cruft ...
+        run: |
+          docker image prune -af
+          docker volume prune -f
+          docker container prune -f
@@ -17,8 +17,9 @@ jobs:
  build:
    name: Regression Testing
    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
        with:
          submodules: 'true'
      - name: Set Build Variables
@@ -28,26 +29,28 @@ jobs:
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
      - name: Restore Cache of dl/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: dl/
-          key: dl-x86_64-netconf-${{ hashFiles('.git/modules/buildroot/refs/heads/master', 'package/*/*.hash') }}
+          key: dl-netconf-${{ hashFiles('.git/modules/buildroot/refs/heads/master', 'package/*/*.hash') }}
          restore-keys: |
-            dl-x86_64-netconf-
-            dl-x86_64-
+            dl-netconf-
            dl-
      - name: Restore Cache of .ccache/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: .ccache/
-          key: ccache-x86_64-netconf-${{ hashFiles('.git/modules/buildroot/refs/head/master', 'package/*/*.hash') }}
+          key: ccache-x86_64-${{ hashFiles('.git/modules/buildroot/refs/head/master', 'package/*/*.hash') }}
          restore-keys: |
-            ccache-x86_64-netconf-
            ccache-x86_64-
            ccache-
      - name: Configure NETCONF
        run: |
          make x86_64_defconfig
+
+      - name: Unit Test
+        run: make test-unit
+
      - name: Build
        run: |
          make
@@ -58,7 +61,7 @@ jobs:
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          path: output/${{ steps.vars.outputs.tgz }}

@@ -28,9 +28,14 @@ jobs:
        variant: [netconf, classic]
      fail-fast: false
    steps:
-      - uses: actions/checkout@v3
+      - name: Maintenance
+        run: |
+          docker image prune -af
+          docker volume prune -f
+          docker container prune -f
+      - uses: actions/checkout@v4
      - name: Set Release Variables
-        id: build
+        id: vars
        run: |
          if [ -n "${{ inputs.version }}" ]; then
              ver=${{ inputs.version }}
@@ -38,11 +43,6 @@ jobs:
              ver=${GITHUB_REF#refs/tags/}
          fi
          echo "ver=${ver}" >> $GITHUB_OUTPUT
-          if echo $ver | grep -qE 'v[0-9\.]+(-alpha|-beta|-rc)[0-9]*'; then
-            echo "pre=true"  >> $GITHUB_OUTPUT
-          else
-            echo "pre=false" >> $GITHUB_OUTPUT
-          fi
          fver=${ver#v}
          if [ "${{ matrix.variant }}" = "netconf" ]; then
              target=${{ matrix.platform }}-${fver}
@@ -51,52 +51,86 @@ jobs:
          fi
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+          echo "out=/mnt/x-$target"       >> $GITHUB_OUTPUT
      - name: Restore Cache of dl/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: dl/
-          key: dl-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          key: dl-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
-            dl-${{ matrix.platform }}-${{ matrix.variant }}-
-            dl-${{ matrix.platform }}-
+            dl-${{ matrix.variant }}-
            dl-
      - name: Restore Cache of .ccache/
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: .ccache/
-          key: ccache-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ matrix.platform }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
          restore-keys: |
-            ccache-${{ matrix.platform }}-${{ matrix.variant }}-
            ccache-${{ matrix.platform }}-
            ccache-
      - name: Configure & Build
        env:
-          INFIX_RELEASE: ${{ steps.build.outputs.ver }}
+          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
        run: |
          if [ "${{ matrix.variant }}" = "netconf" ]; then
              target=${{ matrix.platform }}_defconfig
          else
              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
          fi
-          echo "Buildring $target ..."
+          echo "Building $target ..."
+          sudo mkdir ${{ steps.vars.outputs.out }}
+          sudo chown $(id -un):$(id -gn) ${{ steps.vars.outputs.out }}
+          export O=${{ steps.vars.outputs.out }}
          make $target
          make
      - name: Prepare Artifact
        run: |
-          cd output
-          mv images ${{ steps.build.outputs.dir }}
-          ln -s ${{ steps.build.outputs.dir }} images
-          tar chfz ${{ steps.build.outputs.tgz }} ${{ steps.build.outputs.dir }}
-      - uses: actions/upload-artifact@v3
+          cd ${{ steps.vars.outputs.out }}
+          mv images ${{ steps.vars.outputs.dir }}
+          ln -s ${{ steps.vars.outputs.dir }} images
+          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+      - uses: actions/upload-artifact@v4
        with:
-          path: output/${{ steps.build.outputs.tgz }}
+          path: ${{ steps.vars.outputs.out }}/${{ steps.vars.outputs.tgz }}
+          name: artifact-${{ matrix.variant }}-${{ matrix.platform }}
  release:
    name: Release Infix ${{ github.ref_name }}
    needs: build
    runs-on: ubuntu-latest
+    permissions:
+      contents: write
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/download-artifact@v3
+      - uses: actions/checkout@v4
+      - name: Set Release Variables
+        id: rel
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+              ver=${{ inputs.version }}
+          else
+              ver=${GITHUB_REF#refs/tags/}
+          fi
+          echo "ver=${ver}"     >> $GITHUB_OUTPUT
+          if echo $ver | grep -qE 'v[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
+            echo "pre=true"     >> $GITHUB_OUTPUT
+            echo "latest=false" >> $GITHUB_OUTPUT
+          elif echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
+            echo "pre=false"    >> $GITHUB_OUTPUT
+            echo "latest=true"  >> $GITHUB_OUTPUT
+          else
+            echo "pre=false"    >> $GITHUB_OUTPUT
+            echo "latest=false" >> $GITHUB_OUTPUT
+          fi
+          echo "pre=${{ steps.rel.outputs.pre }}"
+          echo "latest=${{ steps.rel.outputs.latest }}"
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
      - name: Extract ChangeLog entry ...
        run: |
          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
@@ -105,9 +139,10 @@ jobs:
      - uses: ncipollo/release-action@v1
        with:
          name: Infix ${{ github.ref_name }}
-          prerelease: ${{ needs.build.outputs.pre }}
+          prerelease: ${{ steps.rel.outputs.pre }}
+          makeLatest: ${{ steps.rel.outputs.latest }}
          bodyFile:  release.md
-          artifacts: artifact/*
+          artifacts: "*.tar.gz*"
      - name: Summary
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
@@ -2,8 +2,8 @@
 	path = buildroot
 	url = ../buildroot.git
 [submodule "9pm"]
-	path = 9pm
+	path = test/9pm
 	url = ../9pm
 [submodule "qeneth"]
-	path = qeneth
+	path = test/qeneth
 	url = ../qeneth.git
@@ -54,7 +54,7 @@ config INFIX_IMAGE_ID

 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix — a Network Operating System"
+	default "Infix -- a Network Operating System"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.
@@ -22,12 +22,14 @@ $(config):
 	@echo "'make <board>_defconfig' before building an image."
 	@exit 1

-
 %: | buildroot/Makefile
 	@+$(call bmake,$@)

+# Workaround, see board/x86_64/board.mk
+test:
+	@+$(call bmake,$@)
+
 buildroot/Makefile:
 	@git submodule update --init

-.PHONY: all check
-
+.PHONY: all check test
@@ -1,4 +1,5 @@
-[![License Badge][]][License] [![Coverity Status][]][Coverity Scan]
+[![License Badge][]][License] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
+
 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 <details><summary><b>Documentation</b></summary>

@@ -17,11 +18,39 @@

 </details>

-Infix is a Linux Network Operating System (NOS) based on [Buildroot][1],
-and [sysrepo][2].  A powerful mix that ease porting to different
-platforms, simplify long-term maintenance, and provide made-easy
-management using NETCONF[^1] (remote) or the built-in [command
-line interface (CLI)][3] (click the foldout for an example).
+Infix is a free, Linux based, immutable Network Operating System (NOS)
+built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
+porting to different platforms, simplify long-term maintenance, and
+provide made-easy management using NETCONF[^1] or the built-in [command
+line interface (CLI)][3] from a console or SSH login.  *Click the
+foldout (▶ Example CLI Session) below for an example.*
+
+Although primarily focused on switches and routers, the core values
+may be appealing for other use-cases as well:
+
+- Runs from a squashfs image on a read-only partition
+- Single configuration file on a separate partition
+- Built around YANG with standard IETF models
+- Linux switchdev provides open switch APIs
+- Atomic upgrades to secondary partition
+- Highly security focused
+
+An immutable[^2] operating system enhances security and inherently makes
+it maintenance-free.  Configuration and data, e.g, containers, is stored
+on separate partitions to ensure complete separation from system files
+and allow for seamless backup, restore, and provisioning.
+
+In itself Infix is perfectly suited for dedicated networking tasks and
+native support for Docker containers provides a versatile platform that
+can easily be adapted to any customer need.  Be it legacy applications,
+network protocols, process monitoring, or edge data analysis, it can run
+close to end equipment.  Either directly connected on dedicated Ethernet
+ports or indirectly using virtual network cables to exist on the same
+LAN as other connected equipment.
+
+The simple design of Infix provides complete control over both system
+and data, minimal cognitive burden, and makes it incredibly easy to get
+started.

 <details><summary><b>Example CLI Session</b></summary>

@@ -77,6 +106,7 @@ The [following boards](board/aarch64/README.md) are fully supported:
 - Marvell CN9130 CRB
 - Marvell EspressoBIN
 - Microchip SparX-5i PCB135 (eMMC)
+ - NanoPi R2S

 An x86_64 build is also available, primarily intended for development
 and testing, but can also be used for evaluation and demo purposes.  For
@@ -91,6 +121,12 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
 [^1]: NETCONF or RESTCONF, <https://datatracker.ietf.org/doc/html/rfc8040>,
    for more information, see [Infix Variants](doc/variant.md).

+[^2]: An immutable operating system is one with read-only file systems,
+    atomic updates, rollbacks, declarative configuration, and workload
+    isolation.  All to improve reliability, scalability, and security.
+    For more information, see <https://ceur-ws.org/Vol-3386/paper9.pdf>
+    and <https://www.zdnet.com/article/what-is-immutable-linux-heres-why-youd-run-an-immutable-linux-distro/>.
+
 [1]: https://buildroot.org/
 [2]: https://www.sysrepo.org/
 [3]: doc/cli/introduction.md
@@ -98,3 +134,5 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
 [Coverity Scan]:   https://scan.coverity.com/projects/29393
 [Coverity Status]: https://scan.coverity.com/projects/29393/badge.svg
+[discord-badge]:   https://img.shields.io/discord/1182652155618918411.svg?logo=discord
+[discord-url]:     https://discord.gg/6bHJWQNVxN
@@ -6,6 +6,7 @@
 * Device tree for Alder board
 */

+#include <dt-bindings/input/input.h>
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/leds/common.h>

@@ -24,6 +25,8 @@

 		infix {
 			vpds = <&vpd_cpu &vpd_product &vpd_power>;
+			usb-ports = <&cp0_usb3_1>;
+			usb-port-names = "USB";
 		};
 	};

@@ -195,53 +198,6 @@
 };


-/* CP SDHCI (Micro-SD) */
-
-/ {
-	cp0_reg_sd_vccq: cp0_sd_vccq@0 {
-		compatible = "regulator-gpio";
-		regulator-name = "cp0_sd_vccq";
-		regulator-min-microvolt = <1800000>;
-		regulator-max-microvolt = <3300000>;
-		/* gpios = <&CP_SD_HST_18_EN>; */
-		states = <1800000 0x1
-			  3300000 0x0>;
-	};
-
-	cp0_reg_sd_vcc: cp0_sd_vcc@0 {
-		compatible = "regulator-fixed";
-		regulator-name = "cp0_sd_vcc";
-		regulator-min-microvolt = <3300000>;
-		regulator-max-microvolt = <3300000>;
-		/* gpio = <&CP_SD_CRD_PWR_OFF>; */
-		enable-active-high;
-		regulator-always-on;
-	};
-};
-
-&cp0_pinctrl {
-	cp0_sdhci_pins: cp0-sdhi-pins-0 {
-		marvell,pins = \
-			CP_SD_CRD_PWR_OFF(MPP_ID), CP_SD_HST_18_EN(MPP_ID),	\
-			CP_SD_CRD_DT(MPP_ID), CP_SD_LED(MPP_ID),		\
-			CP_SD_CLK(MPP_ID), CP_SD_CMD(MPP_ID),			\
-			CP_SD_D0(MPP_ID), CP_SD_D1(MPP_ID), 			\
-			CP_SD_D2(MPP_ID), CP_SD_D3(MPP_ID);
-		marvell,function = "sdio";
-	};
-};
-
-&cp0_sdhci0 {
-	status = "disabled";
-	pinctrl-names = "default";
-	pinctrl-0 = <&cp0_sdhci_pins>;
-	bus-width = <4>;
-	/* cd-gpios = <&CP_SD_CRD_DT>; */
-	vqmmc-supply = <&cp0_reg_sd_vccq>;
-	vmmc-supply = <&cp0_reg_sd_vcc>;
-};
-
-
 /* SPI1 (Boot FLASH) */

 &cp0_pinctrl {
@@ -314,7 +270,7 @@
 };

 &cp0_usb3_1 {
-	status = "disabled";
+	status = "okay";
 	usb-phy = <&cp0_usb3_0_phy1>;
 	phys = <&cp0_utmi1>, <&cp0_comphy3 1>;
 	phy-names = "usb", "usb3";
@@ -647,9 +603,19 @@
 	};
 };

+/* Reset button */
+/ {
+	gpio-keys {
+		compatible = "gpio-keys";
+		up {
+			label = "factory-reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&GPIO_RESET_BUTTON>;
+		};
+	};
+};

 /* System LEDs */
-
 / {
 	power-a {
 		compatible = "gpio-charger";
@@ -21,7 +21,6 @@ CONFIG_CFS_BANDWIDTH=y
 CONFIG_RT_GROUP_SCHED=y
 CONFIG_CGROUP_PIDS=y
 CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_HUGETLB=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
@@ -32,7 +31,6 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
-CONFIG_SMP=y
 CONFIG_ARCH_SPARX5=y
 CONFIG_ARCH_MVEBU=y
 CONFIG_ARCH_VEXPRESS=y
@@ -49,12 +47,6 @@ CONFIG_CPUFREQ_DT=y
 CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_ARMADA_8K_CPUFREQ=y
 CONFIG_ACPI=y
-CONFIG_ARM64_CRYPTO=y
-CONFIG_CRYPTO_SHA1_ARM64_CE=y
-CONFIG_CRYPTO_SHA2_ARM64_CE=y
-CONFIG_CRYPTO_GHASH_ARM64_CE=y
-CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
-CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_KPROBES=y
 CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
@@ -67,10 +59,8 @@ CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CMA=y
 CONFIG_NET=y
 CONFIG_PACKET=y
-CONFIG_UNIX=y
 CONFIG_XDP_SOCKETS=y
 CONFIG_XDP_SOCKETS_DIAG=y
-CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
 CONFIG_IP_MULTIPLE_TABLES=y
@@ -112,7 +102,6 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
-CONFIG_NFT_OBJREF=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
@@ -186,9 +175,7 @@ CONFIG_VLAN_8021Q=y
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
 CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBQ=y
 CONFIG_NET_CLS_BASIC=y
-CONFIG_NET_CLS_TCINDEX=y
 CONFIG_NET_CLS_BPF=y
 CONFIG_NET_CLS_FLOWER=y
 CONFIG_NETLINK_DIAG=y
@@ -236,7 +223,6 @@ CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_AHCI_PLATFORM=y
 CONFIG_AHCI_MVEBU=y
-CONFIG_PATA_PLATFORM=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
@@ -325,6 +311,7 @@ CONFIG_8139CP=y
 # CONFIG_NET_VENDOR_WIZNET is not set
 # CONFIG_NET_VENDOR_XILINX is not set
 CONFIG_SFP=y
+CONFIG_AX88796B_PHY=y
 CONFIG_MARVELL_PHY=y
 CONFIG_MARVELL_10G_PHY=m
 CONFIG_MICREL_PHY=y
@@ -332,12 +319,12 @@ CONFIG_MICROCHIP_PHY=y
 CONFIG_MICROCHIP_T1_PHY=y
 CONFIG_MICROSEMI_PHY=m
 CONFIG_MDIO_BITBANG=y
-CONFIG_MDIO_MVUSB=y
+CONFIG_MDIO_MVUSB=m
 CONFIG_MDIO_MSCC_MIIM=y
 CONFIG_MDIO_BUS_MUX_MMIOREG=y
-CONFIG_USB_RTL8152=y
-CONFIG_USB_USBNET=y
-CONFIG_USB_NET_CDC_EEM=y
+CONFIG_USB_RTL8152=m
+CONFIG_USB_USBNET=m
+CONFIG_USB_NET_CDC_EEM=m
 # CONFIG_USB_NET_CDC_NCM is not set
 # CONFIG_USB_NET_NET1080 is not set
 # CONFIG_USB_NET_CDC_SUBSET is not set
@@ -371,7 +358,6 @@ CONFIG_I2C_MV64XXX=y
 CONFIG_I2C_SLAVE=y
 CONFIG_SPI=y
 CONFIG_SPI_ARMADA_3700=y
-CONFIG_SPI_NXP_FLEXSPI=y
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
 CONFIG_SPI_MUX=y
@@ -427,30 +413,31 @@ CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
-CONFIG_USB=y
+CONFIG_USB_ULPI_BUS=y
+CONFIG_USB=m
 CONFIG_USB_OTG=y
-CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_XHCI_MVEBU=y
-CONFIG_USB_EHCI_HCD=y
-CONFIG_USB_EHCI_HCD_PLATFORM=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_OHCI_HCD_PLATFORM=y
-CONFIG_USB_STORAGE=y
+CONFIG_USB_XHCI_HCD=m
+CONFIG_USB_XHCI_MVEBU=m
+CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_EHCI_HCD_PLATFORM=m
+CONFIG_USB_OHCI_HCD=m
+CONFIG_USB_OHCI_HCD_PLATFORM=m
+CONFIG_USB_STORAGE=m
 CONFIG_USB_DWC3=y
 CONFIG_USB_DWC2=y
-CONFIG_USB_CHIPIDEA=y
+CONFIG_USB_CHIPIDEA=m
 CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
-CONFIG_USB_HSIC_USB3503=y
+CONFIG_USB_HSIC_USB3503=m
 CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_SNP_UDC_PLAT=y
 CONFIG_TYPEC=y
-CONFIG_TYPEC_TCPM=y
-CONFIG_TYPEC_TCPCI=y
-CONFIG_TYPEC_RT1711H=y
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_RT1711H=m
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_ARMMMCI=y
@@ -462,7 +449,6 @@ CONFIG_MMC_SPI=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_EXYNOS=y
 CONFIG_MMC_DW_K3=y
-CONFIG_MMC_CQHCI=y
 CONFIG_MMC_SDHCI_XENON=y
 CONFIG_SCSI_UFSHCD=y
 CONFIG_SCSI_UFSHCD_PLATFORM=y
@@ -503,7 +489,6 @@ CONFIG_EXTCON_USB_GPIO=y
 CONFIG_IIO=y
 CONFIG_TI_ADC081C=y
 CONFIG_PWM=y
-CONFIG_PHY_XGENE=y
 CONFIG_PHY_MVEBU_CP110_COMPHY=y
 CONFIG_PHY_MVEBU_CP110_UTMI=y
 CONFIG_PHY_SAMSUNG_USB2=y
@@ -512,13 +497,11 @@ CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
-CONFIG_EXT4_FS=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FANOTIFY=y
 CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA=y
-CONFIG_AUTOFS4_FS=y
 CONFIG_FUSE_FS=y
 CONFIG_VIRTIO_FS=y
 CONFIG_OVERLAY_FS=y
@@ -536,17 +519,21 @@ CONFIG_SECURITY=y
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_IRQ_POLL=y
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_KERNEL=y
-CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_DETECT_HUNG_TASK=y
 # CONFIG_SCHED_DEBUG is not set
-# CONFIG_DEBUG_PREEMPT is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
 # CONFIG_STRICT_DEVMEM is not set
@@ -0,0 +1,4 @@
+label Infix on NanoPi R2S
+  kernel /boot/Image
+  devicetree /boot/rk3328-nanopi-r2s.dtb
+  append root=/dev/mmcblk0p1 rw rootwait bonding.max_bonds=0 dummy.numdummies=0 fb_tunnels=none quiet
@@ -0,0 +1,38 @@
+image cfg.ext4 {
+	ext4 {
+		label = "cfg"
+	}
+	empty = true
+	size = 16M
+}
+
+image sdcard.img {
+	hdimage {
+	}
+
+	partition u-boot-tpl-spl-dtb {
+		in-partition-table = "no"
+		image = "idbloader.img"
+		offset = 32K
+	}
+
+	partition u-boot-dtb {
+		in-partition-table = "no"
+		image = "u-boot.itb"
+		offset = 8M
+	}
+
+	partition rootfs {
+		partition-type = 0x83
+		offset = 16M
+		image = "rootfs.ext4"
+	}
+
+	partition cfg {
+		partition-type = 0x83
+		image = "cfg.ext4"
+	}
+}
+
+# Silence genimage warnings
+config {}
@@ -0,0 +1,654 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_NUMA_BALANCING=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EXPERT=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_KEXEC_FILE=y
+CONFIG_CRASH_DUMP=y
+CONFIG_ARCH_ACTIONS=y
+CONFIG_ARCH_ROCKCHIP=y
+CONFIG_ARCH_VEXPRESS=y
+CONFIG_ARM64_VA_BITS_48=y
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_SMT=y
+CONFIG_NUMA=y
+CONFIG_COMPAT=y
+CONFIG_RANDOMIZE_BASE=y
+CONFIG_HIBERNATION=y
+CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
+CONFIG_ENERGY_MODEL=y
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+CONFIG_CPUFREQ_DT=y
+CONFIG_ACPI_CPPC_CPUFREQ=m
+CONFIG_ARM_SCMI_CPUFREQ=y
+CONFIG_ACPI=y
+CONFIG_ACPI_APEI=y
+CONFIG_ACPI_APEI_GHES=y
+CONFIG_ACPI_APEI_MEMORY_FAILURE=y
+CONFIG_ACPI_APEI_EINJ=y
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=y
+CONFIG_JUMP_LABEL=y
+# CONFIG_GCC_PLUGINS is not set
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_KSM=y
+CONFIG_MEMORY_FAILURE=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CMA=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_NET_IPIP=y
+CONFIG_NET_IPGRE_DEMUX=y
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_IPV6=m
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_NET_DSA=m
+CONFIG_NET_DSA_TAG_OCELOT=m
+CONFIG_NET_DSA_TAG_OCELOT_8021Q=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBS=m
+CONFIG_NET_SCH_ETF=m
+CONFIG_NET_SCH_TAPRIO=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_FLOWER=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_GACT=m
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_GATE=m
+CONFIG_BT=m
+CONFIG_BT_HIDP=m
+# CONFIG_BT_LE is not set
+CONFIG_BT_LEDS=y
+# CONFIG_BT_DEBUGFS is not set
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_LL=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIUART_QCA=y
+CONFIG_CFG80211=y
+CONFIG_MAC80211=y
+CONFIG_MAC80211_LEDS=y
+CONFIG_RFKILL=y
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_PASID=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_ACPI=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_ROCKCHIP_HOST=m
+CONFIG_PCIE_ROCKCHIP_DW_HOST=y
+CONFIG_PCI_ENDPOINT=y
+CONFIG_PCI_ENDPOINT_CONFIGFS=y
+CONFIG_PCI_EPF_TEST=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_ARM_SCMI_PROTOCOL=y
+CONFIG_ARM_SCPI_PROTOCOL=y
+CONFIG_EFI_CAPSULE_LOADER=y
+CONFIG_MTD=y
+CONFIG_MTD_BLOCK=y
+CONFIG_MTD_CFI=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_INTELEXT=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_PHYSMAP_OF=y
+CONFIG_MTD_DATAFLASH=y
+CONFIG_MTD_SST25L=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_NAND_DENALI_DT=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_OF_OVERLAY=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=m
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_NVME=m
+CONFIG_SRAM=y
+CONFIG_PCI_ENDPOINT_TEST=m
+CONFIG_EEPROM_AT24=m
+CONFIG_EEPROM_AT25=m
+CONFIG_UACCE=m
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_HISI_SAS=y
+CONFIG_SCSI_HISI_SAS_PCI=y
+CONFIG_MEGARAID_SAS=y
+CONFIG_SCSI_MPT3SAS=m
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_CEVA=y
+CONFIG_SATA_SIL24=y
+CONFIG_PATA_OF_PLATFORM=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_MD=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_ZERO=m
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=y
+CONFIG_WIREGUARD=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_VXLAN=y
+CONFIG_GENEVE=m
+CONFIG_BAREUDP=m
+CONFIG_TUN=y
+CONFIG_VETH=m
+CONFIG_VIRTIO_NET=m
+# CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_NET_VENDOR_ACTIONS is not set
+# CONFIG_NET_VENDOR_ADAPTEC is not set
+# CONFIG_NET_VENDOR_AGERE is not set
+# CONFIG_NET_VENDOR_ALACRITECH is not set
+# CONFIG_NET_VENDOR_ALTEON is not set
+# CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AMD is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
+# CONFIG_NET_VENDOR_ARC is not set
+# CONFIG_NET_VENDOR_ASIX is not set
+CONFIG_ATL2=m
+CONFIG_ALX=m
+# CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_VENDOR_CADENCE is not set
+# CONFIG_NET_VENDOR_CAVIUM is not set
+# CONFIG_NET_VENDOR_CHELSIO is not set
+# CONFIG_NET_VENDOR_CISCO is not set
+# CONFIG_NET_VENDOR_CORTINA is not set
+# CONFIG_NET_VENDOR_DEC is not set
+# CONFIG_NET_VENDOR_DLINK is not set
+# CONFIG_NET_VENDOR_EMULEX is not set
+# CONFIG_NET_VENDOR_EZCHIP is not set
+# CONFIG_NET_VENDOR_GOOGLE is not set
+# CONFIG_NET_VENDOR_HISILICON is not set
+# CONFIG_NET_VENDOR_HUAWEI is not set
+# CONFIG_NET_VENDOR_INTEL is not set
+# CONFIG_NET_VENDOR_LITEX is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+# CONFIG_NET_VENDOR_MELLANOX is not set
+# CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROCHIP is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
+# CONFIG_NET_VENDOR_MICROSOFT is not set
+# CONFIG_NET_VENDOR_MYRI is not set
+# CONFIG_NET_VENDOR_NI is not set
+# CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETERION is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
+# CONFIG_NET_VENDOR_NVIDIA is not set
+# CONFIG_NET_VENDOR_OKI is not set
+# CONFIG_NET_VENDOR_PACKET_ENGINES is not set
+# CONFIG_NET_VENDOR_PENSANDO is not set
+# CONFIG_NET_VENDOR_QLOGIC is not set
+# CONFIG_NET_VENDOR_BROCADE is not set
+# CONFIG_NET_VENDOR_QUALCOMM is not set
+# CONFIG_NET_VENDOR_RDC is not set
+CONFIG_8139CP=m
+CONFIG_8139TOO=m
+# CONFIG_8139TOO_PIO is not set
+CONFIG_R8169=m
+# CONFIG_NET_VENDOR_RENESAS is not set
+# CONFIG_NET_VENDOR_ROCKER is not set
+# CONFIG_NET_VENDOR_SAMSUNG is not set
+# CONFIG_NET_VENDOR_SEEQ is not set
+# CONFIG_NET_VENDOR_SILAN is not set
+# CONFIG_NET_VENDOR_SIS is not set
+# CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_SOCIONEXT is not set
+CONFIG_STMMAC_ETH=y
+# CONFIG_DWMAC_GENERIC is not set
+# CONFIG_NET_VENDOR_SUN is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
+# CONFIG_NET_VENDOR_TEHUTI is not set
+# CONFIG_NET_VENDOR_TI is not set
+# CONFIG_NET_VENDOR_VIA is not set
+# CONFIG_NET_VENDOR_WIZNET is not set
+# CONFIG_NET_VENDOR_XILINX is not set
+CONFIG_AX88796B_PHY=y
+CONFIG_MICREL_PHY=y
+CONFIG_MICROSEMI_PHY=y
+CONFIG_AT803X_PHY=m
+CONFIG_REALTEK_PHY=y
+CONFIG_ROCKCHIP_PHY=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BCM_UNIMAC=m
+CONFIG_MDIO_THUNDER=y
+CONFIG_MDIO_BUS_MUX_MULTIPLEXER=y
+CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=m
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_ATH10K=m
+CONFIG_ATH10K_PCI=m
+CONFIG_WCN36XX=m
+# CONFIG_WLAN_VENDOR_ATMEL is not set
+# CONFIG_WLAN_VENDOR_BROADCOM is not set
+# CONFIG_WLAN_VENDOR_CISCO is not set
+# CONFIG_WLAN_VENDOR_INTEL is not set
+# CONFIG_WLAN_VENDOR_INTERSIL is not set
+# CONFIG_WLAN_VENDOR_MARVELL is not set
+# CONFIG_WLAN_VENDOR_MEDIATEK is not set
+CONFIG_RTL8180=m
+CONFIG_RTL8187=m
+CONFIG_RTL_CARDS=m
+CONFIG_RTL8192CE=m
+CONFIG_RTL8192SE=m
+CONFIG_RTL8192DE=m
+CONFIG_RTL8723AE=m
+CONFIG_RTL8723BE=m
+CONFIG_RTL8188EE=m
+CONFIG_RTL8192EE=m
+CONFIG_RTL8821AE=m
+CONFIG_RTL8192CU=m
+CONFIG_RTL8XXXU=m
+CONFIG_RTL8XXXU_UNTESTED=y
+CONFIG_RTW88=m
+CONFIG_RTW88_8822BE=m
+CONFIG_RTW88_8822BS=m
+CONFIG_RTW88_8822BU=m
+CONFIG_RTW88_8822CE=m
+CONFIG_RTW88_8822CS=m
+CONFIG_RTW88_8822CU=m
+CONFIG_RTW88_8723DE=m
+CONFIG_RTW88_8723DS=m
+CONFIG_RTW88_8723DU=m
+CONFIG_RTW88_8821CE=m
+CONFIG_RTW88_8821CS=m
+CONFIG_RTW88_8821CU=m
+CONFIG_RTW88_DEBUG=y
+CONFIG_RTW89=m
+CONFIG_RTW89_8851BE=m
+CONFIG_RTW89_8852AE=m
+CONFIG_RTW89_8852BE=m
+CONFIG_RTW89_8852CE=m
+CONFIG_RTW89_DEBUGMSG=y
+# CONFIG_WLAN_VENDOR_RSI is not set
+# CONFIG_WLAN_VENDOR_TI is not set
+# CONFIG_WLAN_VENDOR_ZYDAS is not set
+# CONFIG_WLAN_VENDOR_QUANTENNA is not set
+CONFIG_NET_FAILOVER=y
+CONFIG_INPUT_FF_MEMLESS=y
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_RK805_PWRKEY=y
+# CONFIG_SERIO_SERPORT is not set
+CONFIG_SERIO_AMBAKMI=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_LEGACY_PTY_COUNT=16
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_RT288X=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL010=y
+CONFIG_SERIAL_AMBA_PL010_CONSOLE=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_HW_RANDOM_VIRTIO=m
+CONFIG_TCG_TPM=y
+CONFIG_TCG_TIS_I2C_INFINEON=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_RK3X=y
+CONFIG_I2C_SLAVE=y
+CONFIG_SPI=y
+CONFIG_SPI_BITBANG=m
+CONFIG_SPI_CADENCE_QUADSPI=y
+CONFIG_SPI_DESIGNWARE=m
+CONFIG_SPI_DW_DMA=y
+CONFIG_SPI_DW_MMIO=m
+CONFIG_SPI_PL022=y
+CONFIG_SPI_ROCKCHIP=y
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPMI=y
+CONFIG_PPS=y
+# CONFIG_PTP_1588_CLOCK is not set
+CONFIG_DEBUG_PINCTRL=y
+CONFIG_PINCTRL_RK805=y
+CONFIG_PINCTRL_SINGLE=y
+CONFIG_GPIO_ALTERA=m
+CONFIG_GPIO_DWAPB=y
+CONFIG_GPIO_MB86S7X=y
+CONFIG_GPIO_PL061=y
+CONFIG_GPIO_XGENE=y
+CONFIG_GPIO_MAX732X=y
+CONFIG_GPIO_PCA953X=y
+CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_POWER_RESET_XGENE=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_SYSCON_REBOOT_MODE=y
+CONFIG_BATTERY_SBS=m
+CONFIG_BATTERY_BQ27XXX=y
+CONFIG_BATTERY_MAX17042=m
+CONFIG_CHARGER_BQ25890=m
+CONFIG_CHARGER_BQ25980=m
+CONFIG_SENSORS_ARM_SCMI=y
+CONFIG_SENSORS_ARM_SCPI=y
+CONFIG_SENSORS_LM90=m
+CONFIG_SENSORS_PWM_FAN=m
+CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
+CONFIG_CPU_THERMAL=y
+CONFIG_THERMAL_EMULATION=y
+CONFIG_ROCKCHIP_THERMAL=m
+CONFIG_WATCHDOG=y
+CONFIG_ARM_SP805_WATCHDOG=y
+CONFIG_ARM_SBSA_WATCHDOG=y
+CONFIG_DW_WATCHDOG=y
+CONFIG_ARM_SMC_WATCHDOG=y
+CONFIG_MFD_RK8XX_I2C=y
+CONFIG_MFD_RK8XX_SPI=y
+CONFIG_MFD_STMFX=y
+CONFIG_REGULATOR_DEBUG=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_REGULATOR_PWM=y
+CONFIG_REGULATOR_RK808=y
+CONFIG_REGULATOR_VCTRL=y
+CONFIG_REGULATOR_VEXPRESS=m
+# CONFIG_HID_GENERIC is not set
+# CONFIG_USB_HID is not set
+CONFIG_USB_CONN_GPIO=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_DYNAMIC_MINORS=y
+CONFIG_USB_OTG=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_ACM=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_MUSB_HDRC=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC2=y
+CONFIG_USB_CHIPIDEA=y
+CONFIG_USB_CHIPIDEA_UDC=y
+CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_ISP1760=y
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_SIMPLE=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_HSIC_USB3503=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_USB_ULPI=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_SNP_UDC_PLAT=y
+CONFIG_USB_BDC_UDC=y
+CONFIG_USB_CONFIGFS=m
+CONFIG_USB_CONFIGFS_SERIAL=y
+CONFIG_USB_CONFIGFS_ACM=y
+CONFIG_USB_CONFIGFS_OBEX=y
+CONFIG_USB_CONFIGFS_NCM=y
+CONFIG_USB_CONFIGFS_ECM=y
+CONFIG_USB_CONFIGFS_ECM_SUBSET=y
+CONFIG_USB_CONFIGFS_RNDIS=y
+CONFIG_USB_CONFIGFS_EEM=y
+CONFIG_USB_CONFIGFS_MASS_STORAGE=y
+CONFIG_USB_CONFIGFS_F_FS=y
+CONFIG_TYPEC=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TPS6598X=m
+CONFIG_TYPEC_HD3SS3220=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_ACPI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_OF_ARASAN=y
+CONFIG_MMC_SDHCI_CADENCE=y
+CONFIG_MMC_SDHCI_F_SDH30=y
+CONFIG_MMC_SPI=y
+CONFIG_MMC_DW=y
+CONFIG_MMC_DW_EXYNOS=y
+CONFIG_MMC_DW_HI3798CV200=y
+CONFIG_MMC_DW_K3=y
+CONFIG_MMC_DW_ROCKCHIP=y
+CONFIG_MMC_MTK=y
+CONFIG_MMC_SDHCI_XENON=y
+CONFIG_MMC_SDHCI_AM654=y
+CONFIG_SCSI_UFSHCD=y
+CONFIG_SCSI_UFSHCD_PLATFORM=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_CLASS_FLASH=y
+CONFIG_LEDS_CLASS_MULTICOLOR=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_SYSCON=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_DISK=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_RK808=y
+CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_PL030=y
+CONFIG_RTC_DRV_PL031=y
+CONFIG_DMADEVICES=y
+CONFIG_PL330_DMA=y
+CONFIG_SYNC_FILE=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_INPUT=y
+CONFIG_VIRTIO_MMIO=y
+# CONFIG_VHOST_MENU is not set
+CONFIG_STAGING=y
+CONFIG_PRISM2_USB=m
+CONFIG_RTLLIB=m
+CONFIG_RTL8192E=m
+CONFIG_RTL8723BS=m
+CONFIG_R8712U=m
+CONFIG_RTS5208=m
+# CONFIG_SURFACE_PLATFORMS is not set
+CONFIG_COMMON_CLK_SCMI=y
+CONFIG_COMMON_CLK_SCPI=y
+CONFIG_COMMON_CLK_PWM=y
+CONFIG_HWSPINLOCK=y
+# CONFIG_FSL_ERRATUM_A008585 is not set
+# CONFIG_HISILICON_ERRATUM_161010101 is not set
+# CONFIG_ARM64_ERRATUM_858921 is not set
+CONFIG_ARM_MHU=y
+CONFIG_PLATFORM_MHU=y
+CONFIG_IOMMU_IO_PGTABLE_ARMV7S=y
+CONFIG_ROCKCHIP_IOMMU=y
+CONFIG_ARM_SMMU=y
+CONFIG_ARM_SMMU_V3=y
+CONFIG_ROCKCHIP_IODOMAIN=y
+CONFIG_ROCKCHIP_DTPM=m
+CONFIG_ROCKCHIP_PM_DOMAINS=y
+CONFIG_DEVFREQ_GOV_USERSPACE=m
+CONFIG_EXTCON_PTN5150=m
+CONFIG_EXTCON_USB_GPIO=y
+CONFIG_MEMORY=y
+CONFIG_IIO=y
+CONFIG_MAX9611=m
+CONFIG_ROCKCHIP_SARADC=m
+CONFIG_IIO_ST_LSM6DSX=m
+CONFIG_SENSORS_ISL29018=m
+CONFIG_VCNL4000=m
+CONFIG_IIO_ST_MAGN_3AXIS=m
+CONFIG_MPL3115=m
+CONFIG_PWM=y
+CONFIG_PWM_ROCKCHIP=y
+CONFIG_PHY_ROCKCHIP_DPHY_RX0=m
+CONFIG_PHY_ROCKCHIP_EMMC=y
+CONFIG_PHY_ROCKCHIP_INNO_HDMI=m
+CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_PHY_ROCKCHIP_INNO_CSIDPHY=m
+CONFIG_PHY_ROCKCHIP_INNO_DSIDPHY=m
+CONFIG_PHY_ROCKCHIP_PCIE=m
+CONFIG_PHY_ROCKCHIP_TYPEC=y
+CONFIG_PHY_ROCKCHIP_USB=m
+CONFIG_POWERCAP=y
+CONFIG_ARM_SCMI_POWERCAP=y
+CONFIG_DTPM=y
+CONFIG_DTPM_CPU=y
+CONFIG_DTPM_DEVFREQ=y
+CONFIG_ARM_SMMU_V3_PMU=m
+CONFIG_NVMEM_RMEM=m
+CONFIG_NVMEM_ROCKCHIP_EFUSE=m
+CONFIG_NVMEM_ROCKCHIP_OTP=m
+CONFIG_TEE=y
+CONFIG_OPTEE=y
+CONFIG_MUX_MMIO=y
+CONFIG_INTERCONNECT=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_OVERLAY_FS=m
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_HUGETLBFS=y
+CONFIG_EFIVAR_FS=y
+CONFIG_SQUASHFS=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_V4_1=y
+CONFIG_NFS_V4_2=y
+CONFIG_ROOT_NFS=y
+CONFIG_9P_FS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_SECURITY=y
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_CURVE25519=m
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_BLAKE2B=m
+CONFIG_CRYPTO_XXHASH=m
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_USER_API_RNG=m
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA512_ARM64_CE=m
+CONFIG_CRYPTO_SHA3_ARM64=m
+CONFIG_CRYPTO_SM3_ARM64_CE=m
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_BS=m
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=m
+CONFIG_CRYPTO_DEV_ROCKCHIP=y
+CONFIG_CRYPTO_DEV_CCREE=m
+CONFIG_INDIRECT_PIO=y
+CONFIG_CRC_CCITT=m
+CONFIG_CRC8=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=32
+CONFIG_PRINTK_TIME=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_FS=y
+# CONFIG_SCHED_DEBUG is not set
+# CONFIG_FTRACE is not set
+CONFIG_MEMTEST=y
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+BOARD_DIR="$(dirname $0)"
+
+install -m 0644 -D $BOARD_DIR/extlinux.conf $TARGET_DIR/boot/extlinux/extlinux.conf
@@ -0,0 +1,14 @@
+--- a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts	2023-11-08 14:09:07.000000000 +0100
+++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts	2024-01-22 07:31:14.949550828 +0100
+@@ -20,6 +20,11 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial2:1500000n8";
+
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+ 	};
+ 
+ 	gmac_clk: gmac-clock {
@@ -6,3 +6,8 @@ if [ -L "$TARGET_DIR/etc/dropbear" ]; then
 	rm    "$TARGET_DIR/etc/dropbear"
 	mkdir "$TARGET_DIR/etc/dropbear"
 fi
+
+# Classic builds don't have D-Bus
+if [ -f "$TARGET_DIR/etc/dnsmasq.conf" ]; then
+    sed -i '/enable-dbus/d' "$TARGET_DIR/etc/dnsmasq.conf"
+fi
@@ -1 +1 @@
-run [S] /lib/infix/swup --
+run [S] /libexec/infix/swup --
@@ -47,18 +47,18 @@ ram([0-9]*)        root:disk 660 >rd/%1
 loop([0-9]+)       root:disk 660 >loop/%1
 sr[0-9]*           root:cdrom 660 @ln -sf $MDEV cdrom
 fd[0-9]*           root:floppy 660
-#SUBSYSTEM=block;.* root:disk 660 */lib/infix/storage-device
+#SUBSYSTEM=block;.* root:disk 660 */libexec/infix/storage-device

 # Run settle-nics every time new NIC appear.
 # If you don't want to auto-populate /etc/mactab with NICs,
 # run 'settle-nis' without '--write-mactab' param.
-#-SUBSYSTEM=net;DEVPATH=.*/net/.*;.*     root:root 600 @/lib/infix/settle-nics --write-mactab
+#-SUBSYSTEM=net;DEVPATH=.*/net/.*;.*     root:root 600 @/libexec/infix/settle-nics --write-mactab

 net/tun[0-9]*   root:netdev 660
 net/tap[0-9]*   root:root 600

 # alsa sound devices and audio stuff
-#SUBSYSTEM=sound;.*  root:audio 660 @/lib/infix/sound-control
+#SUBSYSTEM=sound;.*  root:audio 660 @/libexec/infix/sound-control

 adsp        root:audio 660 >sound/
 audio       root:audio 660 >sound/
@@ -106,7 +106,7 @@ cpu([0-9]+)     root:root 600 =cpu/%1/cpuid
 msr([0-9]+)     root:root 600 =cpu/%1/msr

 # Populate /dev/bus/usb.
-#SUBSYSTEM=usb;DEVTYPE=usb_device;.* root:root 660 */lib/infix/dev-bus-usb
+#SUBSYSTEM=usb;DEVTYPE=usb_device;.* root:root 660 */libexec/infix/dev-bus-usb

 # Catch-all other devices, Right now useful only for debuging.
-#.* root:root 660 */lib/infix/catch-all
+#.* root:root 660 */libexec/infix/catch-all
@@ -0,0 +1,6 @@
+#!/bin/sh
+# Probe for various types of harware features
+
+if dmesg |grep -q QEMU || test -d /sys/module/qemu_fw_cfg; then
+    initctl -nbq cond set qemu
+fi
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.36.0
-# Tue Oct  3 18:00:40 2023
+# Thu Feb  8 08:22:32 2024
 #
 CONFIG_HAVE_DOT_CONFIG=y

@@ -1132,9 +1132,9 @@ CONFIG_SV_DEFAULT_SERVICE_DIR=""
 CONFIG_SH_IS_ASH=y
 # CONFIG_SH_IS_HUSH is not set
 # CONFIG_SH_IS_NONE is not set
-CONFIG_BASH_IS_ASH=y
+# CONFIG_BASH_IS_ASH is not set
 # CONFIG_BASH_IS_HUSH is not set
-# CONFIG_BASH_IS_NONE is not set
+CONFIG_BASH_IS_NONE=y
 CONFIG_SHELL_ASH=y
 CONFIG_ASH=y
 CONFIG_ASH_OPTIMIZE_FOR_SIZE=y
@@ -1,3 +1,4 @@
+ifeq ($(SIGN_ENABLED),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk

 define RAUC_POST_BUILD_INSTALL_CERT
@@ -7,3 +8,4 @@ define RAUC_POST_BUILD_INSTALL_CERT
 		cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)
 endef
 RAUC_POST_BUILD_HOOKS += RAUC_POST_BUILD_INSTALL_CERT
+endif
@@ -22,7 +22,7 @@ diskimg=disk.img
 ver()
 {
    if [ -n "$INFIX_RELEASE" ]; then
-	printf -- "-%s" "$INFIX_RELEASE"
+	printf -- "-%s" "${INFIX_RELEASE#v}"
 	return
    fi
 }
@@ -42,7 +42,7 @@ fi
 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
    ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk.img"
+    diskimg="${NAME}-disk$(ver).img"
    bootcfg=
    if [ "$DISK_IMAGE_BOOT_DATA" ]; then
 	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
@@ -75,9 +75,9 @@ config QEMU_MACHINE

 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
-	default "256M"
+	default "384M"
 	help
-	  The default, 255 MiB, works for most configurations, even less for
+	  The default, 384 MiB, works for most configurations, even less for
 	  the Infix Classic builds.  However, if you get kernel panic with:
 	  "System is deadlocked on memory", try increasing this one.

@@ -24,11 +24,22 @@ prognm=$(basename "$0")

 usage()
 {
-    echo "usage: $prognm [opts]"
+    echo "Usage:"
+    echo " $prognm [opts] [ARGS]"
    echo
-    echo " -c    Run menuconfig to change Qemu settings"
-    echo " -h    This help text"
+    echo "Options:"
+    echo "  -c     Run menuconfig to change Qemu settings"
+    echo "  -h     This help text"
    echo
+    echo "Arguments:"
+    echo "  ARGS1  Args before the '--' separator are for kernel space"
+    echo "  --     Separator"
+    echo "  ARGS2  Args after the '--' separator are for the init process"
+    echo "         Also, qemu.cfg has QEMU_APPEND which can affect this."
+    echo
+    echo "Example:"
+    echo "  qemu.sh -- finit.debug"
+    echo "___________________________________________________________________"
    echo "Note: 'kconfig-frontends' package (Debian/Ubuntu) must be installed"
    echo "      for -c to work: sudo apt install kconfig-frontents"

@@ -130,6 +141,18 @@ serial_args()
    echo -n "-device virtconsole,nr=1,name=gdbserver,chardev=gdbserver "
 }

+usb_args()
+{
+    USBSTICK="usb.vfat"
+    if ! [ -f $USBSTICK ]; then
+	dd if=/dev/zero of=${USBSTICK} bs=8M count=1 >/dev/null 2>&1
+	mkfs.vfat $USBSTICK >/dev/null 2>&1
+    fi
+    echo -n "-drive if=none,id=usbstick,format=raw,file=${USBSTICK} "
+    echo -n "-usb "
+    echo -n "-device usb-ehci,id=ehci "
+    echo -n "-device usb-storage,bus=ehci.0,drive=usbstick "
+}
 rw_args()
 {
    [ "$CONFIG_QEMU_RW" ] || return
@@ -208,7 +231,7 @@ vpd_args()

 	cat <<EOF | "$onieprom" -e >"$vpd_file"
 {
-  "manufacture-date": "$(date +"%d/%m/%Y %H:%M:%S")",
+  "manufacture-date": "$(date +"%m/%d/%Y %H:%M:%S")",
  "vendor-extension": [
    [
      61046,
@@ -235,6 +258,7 @@ run_qemu()
 	  $(rootfs_args) \
 	  $(serial_args) \
 	  $(rw_args) \
+	  $(usb_args) \
 	  $(host_args) \
 	  $(net_args) \
 	  $(wdt_args) \
@@ -346,6 +370,10 @@ else
    load_qemucfg qemu.cfg
 fi

+if [ -z "$QEMU_EXTRA_APPEND" ]; then
+    QEMU_EXTRA_APPEND="$*"
+fi
+
 generate_dot

 echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
@@ -353,4 +381,3 @@ line=$(stty -g)
 stty raw
 run_qemu $(dtb_args)
 stty "$line"
-
@@ -0,0 +1 @@
+/usr/bin/mg
@@ -0,0 +1,27 @@
+# This file defines default behavior and a skeleton for including config
+# snippets from both confd, i.e., ietf-system.yang, and DHCP clients.
+# Default values taken from Debian /etc/chrony/chrony.conf
+
+# *.conf when acting as an NTP server
+confdir /etc/chrony/conf.d
+
+# *.sources from DHCP clients, e.g., /run/chrony-dhcp/$ifname.sources:
+#                                    server 192.0.2.1 iburst
+sourcedir /run/chrony/dhcp-sources.d
+
+# *.sources for NTP servers generated by confd:ietf-system.c
+sourcedir /etc/chrony/sources.d
+
+# Where to store the system clock rate information across reboots.
+driftfile /var/lib/chrony/chrony.drift
+
+# Stop bad estimates upsetting machine clock.
+maxupdateskew 100.0
+
+# Enables kernel synchronisation (every 11 minutes) of the real-time
+# clock. Note that it can’t be used along with the 'rtcfile' directive.
+rtcsync
+
+# Step the system clock instead of slewing it if the adjustment is
+# larger than one second, but only in the first three clock updates.
+makestep 1 3
@@ -0,0 +1 @@
+CHRONY_ARGS="-f /etc/chrony/chrony.conf"
@@ -1,3 +1,3 @@
-run [S] log:console   /lib/infix/probe -- Probing system information
-run [S] <pid/syslogd> /lib/infix/sysctl-sync-ip-conf --
-run [S] <pid/syslogd> /lib/infix/nameif -- Probing network interfaces
+run [S] log:console   /libexec/infix/probe -- Probing system information
+run [S] <pid/syslogd> /libexec/infix/sysctl-sync-ip-conf --
+run [S] <pid/syslogd> /libexec/infix/nameif -- Probing network interfaces
@@ -0,0 +1,4 @@
+service :%i pid:!/run/k8s-logger-%i.pid <usr/container:%i> \
+	[2345] k8s-logger -cni %i -f local1 /run/containers/%i.fifo -- Logger for container %i
+sysv    :%i pid:!/run/container:%i.pid <pid/k8s-logger:%i> kill:10 \
+	[2345] container -n %i -- container %i
@@ -12,11 +12,11 @@ debugfs	/sys/kernel/debug	debugfs		nofail			0	0
 cfgfs		/config		configfs	nofail,noauto		0	0

 # The chosen backing storage for the overlays placed on /cfg, /etc,
-# /home, /root, and /var, are determined dynamically by /lib/infix/mnt
+# /home, /root, and /var, are determined dynamically by /libexec/infix/mnt
 # depending on the available devices.
 mnttmp		/mnt/tmp	tmpfs		defaults			0	0
 LABEL=aux	/mnt/aux	auto		noatime,nodiratime,noauto	0	0
 LABEL=var	/mnt/var	auto		noatime,nodiratime,noauto	0	0
 LABEL=cfg	/mnt/cfg	auto		noatime,nodiratime,noauto	0	0
 hostfs		/mnt/host	9p		cache=none,msize=16384,noauto	0	0
-/lib/infix/mnt# /cfg		helper		none				0	0
+/libexec/infix/mnt# /cfg		helper		none				0	0
@@ -0,0 +1,3 @@
+# Do not authorize usb ports before they have been checked in in the device-tree
+options usbcore authorized_default=0
+ 
@@ -0,0 +1,4 @@
+.-------.
+|  . .  | Infix -- a Network Operating System
+|-. v .-| https://kernelkit.github.io
+'-'---'-'
@@ -0,0 +1 @@
+%wheel ALL=(ALL:ALL) NOPASSWD: ALL
@@ -0,0 +1 @@
+local1.*                -/var/log/container
@@ -1 +1,3 @@
-d  /var/lib/chrony	0755 chrony chrony
+d  /var/lib/chrony		0750 chrony chrony
+d  /run/chrony			0750 chrony chrony
+d  /run/chrony/dhcp-sources.d	0755 chrony chrony
@@ -33,11 +33,11 @@ check_factory()
    fi

    # Add to your br2-external to extend factory-reset check
-    if [ ! -x /lib/infix/check-factory ]; then
+    if [ ! -x /libexec/infix/check-factory ]; then
 	return 1;
    fi

-    /lib/infix/check-factory
+    /libexec/infix/check-factory
 }

 factory_reset()
@@ -7,7 +7,7 @@ inform()
    local level="$1"
    shift

-    logger -p "daemon.$level" -t dagger -c $LOGGER_STDOUT "$@"
+    logger -p "daemon.$level" -I $PPID -t dagger -c $LOGGER_STDOUT "$@"
 }

 abort()
@@ -1 +1 @@
-mg
+/etc/alternatives/editor
@@ -1 +1 @@
-mg
+/etc/alternatives/editor
@@ -0,0 +1,19 @@
+#!/bin/sh
+# Helper script to chronyc, checks if daemon is running
+
+if ! chronyc serverstats >/dev/null; then
+   echo "NTP client not enabled."
+   exit 1
+fi
+
+case $1 in
+    tracking)
+	chronyc tracking
+	;;
+    sources)
+	chronyc sources -v
+	;;
+    *)
+	echo "Unknown NTP command."
+	;;
+esac
@@ -0,0 +1,590 @@
+#!/bin/sh
+
+all=""
+env=""
+port=""
+force=
+
+log()
+{
+    logger -I $PPID -t container -p local1.notice -- "$*"
+}
+
+# Unpacks a given oci-archive.tar[.gz] in the current directory.  Sanity
+# checks, at least one index.json in the top-level dir of the archive.
+# If there are more index files, this function does not handle them.
+unpack_archive()
+{
+    image=$1
+    name=$2
+
+    # Supported transports for load and create
+    case "$image" in
+	oci:*)			# Unpacked OCI image
+	    file=${image#oci:}
+	    ;;
+	oci-archive:*)		# Packed OCI image, .tar or .tar.gz format
+	    file=${image#oci-archive:}
+	    ;;
+	*)			# docker://*, docker-archive:*, or URL
+	    echo "$image"
+	    return 0
+	    ;;
+    esac
+
+    if [ ! -e "$file" ]; then
+	if [ -e "/var/lib/conatainers/oci/$file" ]; then
+	    file="/var/lib/conatainers/oci/$file"
+	elif [ -e "/lib/oci/$file" ]; then
+	    file="/lib/oci/$file"
+	else
+	    log "Error: cannot find OCI archive $file in search path."
+	    exit 1
+	fi
+    fi
+
+    if [ -d "$file" ]; then
+	index=$(find "$file" -name index.json)
+	if [ -z "$index" ]; then
+	    log "Error: cannot find index.json in OCI image $file"
+	    exit 1
+	fi
+    else
+	index=$(tar tf "$file" |grep index.json)
+	if [ -z "$index" ]; then
+	    log "Error: invalid OCI archive, cannot find index.json in $file"
+	    exit 1
+	fi
+
+	[ -n "$quiet" ] || log "Extracting OCI archive $file ..."
+        tar xf "$file" || (log "Error: failed unpacking $file in $(pwd)"; exit 1)
+    fi
+
+    dir=$(dirname "$index")
+    [ -n "$quiet" ] || log "Loading OCI image $dir ..."
+    podman load -qi "$dir"        >/dev/null
+
+    # Rename image from podman default $dir:latest
+    if [ -n "$name" ]; then
+	podman tag "$dir" "$name" >/dev/null
+	podman rmi "$dir"         >/dev/null
+    else
+	name=$dir
+    fi
+
+    echo "$name"
+}
+
+running()
+{
+    run=$(podman inspect "$1" 2>/dev/null |jq .[].State.Running)
+    [ "$run" = "true" ] && return 0
+    return 1
+}
+
+# shellcheck disable=SC2086
+create()
+{
+    name=$1
+    image=$2
+    shift 2
+
+    if [ -z "$name" ] || [ -z "$image" ]; then
+	echo "Usage:"
+	echo "  container create NAME IMAGE"
+	exit 1
+    fi
+
+    # Unpack and load docker-archive/oci/oci-archive, returning image
+    # name, or return docker:// URL for download.
+    image=$(unpack_archive "$image")
+
+    if [ -z "$logging" ]; then
+	logging="--log-driver k8s-file --log-opt path=/run/containers/$name.fifo"
+    fi
+
+    args="$args --cgroup-parent=containers"
+    args="$args --restart=$restart --systemd=false --tz=local $privileged --replace --quiet"
+    args="$args $ro $vol $mount $hostname $entrypoint $env $port $logging"
+    pidfn=/run/container:${name}.pid
+
+    [ -n "$quiet" ] || log "---------------------------------------"
+    [ -n "$quiet" ] || log "Got name: $name image: $image"
+    [ -n "$quiet" ] || log "Got networks: $network"
+
+    if [ -n "$network" ]; then
+	for net in $network; do
+	    args="$args --net=$net"
+	done
+
+	for srv in $dns; do
+	    args="$args --dns=$srv"
+	done
+
+	for domain in $search; do
+	    args="$args --dns-search=$domain"
+	done
+    else
+	network="--net none"
+    fi
+
+    # shellcheck disable=SC2048
+    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
+	[ -n "$quiet" ] || log "Successfully created container $name from $image"
+	rm -f "/run/containers/env/${name}.env"
+	[ -n "$manual" ] || start "$name"
+	exit 0
+    fi
+
+    log "Error: failed creating container $name, please check the configuration."
+    exit 1
+}
+
+delete()
+{
+    name=$1
+    image=$2
+
+    if [ -z "$name" ]; then
+	echo "Usage:"
+	echo "  container delete NAME"
+	exit 1
+    fi
+
+    podman rm -vif "$name" >/dev/null 2>&1
+    [ -n "$quiet" ] || log "Container $name has been removed."
+}
+
+waitfor()
+{
+    timeout=$2
+    while [ ! -f "$1" ]; do
+	_=$((timeout -= 1))
+	if [ $timeout -le 0 ]; then
+	    log "Timeout waiting for $1, aborting!"
+	    exit 1
+	fi
+	sleep 1;
+    done
+}
+
+start()
+{
+    name=$1
+
+    if running "$name"; then
+	[ -n "$quiet" ] || echo "$name: already running."
+	return
+    fi
+
+    initctl -bq cond set "container:$name"
+    # Real work is done by wrap() courtesy of finit sysv emulation
+}
+
+stop()
+{
+    name=$1
+
+    if ! running "$name"; then
+	[ -n "$quiet" ] || echo "$name: not running."
+	return
+    fi
+
+    initctl -bq cond clr "container:$name"
+    # Real work is done by wrap() courtesy of finit sysv emulation
+}
+
+wrap()
+{
+    name=$1
+    cmd=$2
+
+    podman "$cmd" "$name"
+}
+
+# Removes network $1 from all containers
+netwrm()
+{
+    net=$1
+
+    for c in $(podman ps $all --format "{{.Names}}"); do
+	for n in $(podman inspect "$c" |jq -r '.[].NetworkSettings.Networks | keys[]'); do
+	    if [ "$n" = "$net" ]; then
+		podman network disconnect $force "$n" "$c" >/dev/null
+	    fi
+	done
+    done
+}
+
+usage()
+{
+	cat <<EOF
+usage:
+  container [opt] cmd [arg]
+
+options:
+  -a, --all                Show all, of something
+      --dns NAMESERVER     Set nameserver(s) when creating a container
+      --dns-search LIST    Set host lookup search list when creating container
+  -c, --creds USR[:PWD]    Credentials to pass to curl -u for remote ops
+  -d, --detach             Detach a container started with 'run IMG [CMD]'
+  -e, --env FILE           Environment variables when creating container
+      --entrypoint         Disable container image's ENTRYPOINT, run cmd + arg
+  -f, --force              Force operation, e.g. remove
+  -h, --help               Show this help text
+      --hostname NAME      Set hostname when creating container
+      --net NETWORK        Network interface(s) when creating or finding container
+  -l, --log-driver DRV     Log driver to use
+      --log-opt OPT        Logging options to log driver
+      --log-path PATH      Path for k8s-file log pipe
+  -m, --mount HOST:DEST    Bind mount a read-only file inside a container
+      --manual             Do not start container automatically after creation
+  -n, --name NAME          Alternative way of supplying name to start/stop/restart
+      --privileged         Give container extended privileges
+  -p, --publish PORT       Publish ports when creating container
+                           Syntax: [[ip:][hostPort]:]containerPort[/protocol]
+  -q, --quiet              Quiet operation, called from confd
+  -r, --restart POLICY     One of "no", "always", or "on-failure:NUM"
+      --read-only          Do not create a writable layer
+  -s, --simple             Show output in simplified format
+  -v, --volume NAME:PATH   Create named volume mounted inside container on PATH
+
+commands:
+  create   NAME IMAGE NET  Create container NAME using IMAGE with networks NET
+  delete  [network] NAME   Remove container NAME or network NAME from all containers
+  exec     NAME CMD        Run a command inside a container
+  find    [ifname PID]     Find PID of container where '--net IFNAME' currently lives
+                           or, find the name of our IFNAME inside the container @PID
+  help                     Show this help text
+  list    [image | oci]    List names (only) of containers, images, or OCI archives
+  load    [NAME | URL] NM  Load OCI tarball fileNAME or URL to image NM
+  remove   IMAGE           Remove an (unused) container image
+  restart [NAME]           Restart a crashed container
+  run      NAME [CMD]      Run a container interactively, with an optional command
+  save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
+  shell                    Start a shell inside a container
+  show    [image | volume] Show containers, images, or volumes
+  stat                     Show continuous stats about containers (Ctrl-C aborts)
+  start   [NAME]           Start a container, see -n
+  stop    [NAME]           Stop a container, see -n
+  volume  [prune]          Prune unused volumes
+EOF
+}
+
+while [ "$1" != "" ]; do
+    case $1 in
+	-a | --all)
+	    all="-a"
+	    ;;
+	-c | --creds)
+	    shift
+	    creds="-u $1"
+	    ;;
+	-d | --detach)
+	    detach="-d"
+	    ;;
+	--dns)
+	    shift
+	    dns="$dns $1"
+	    ;;
+	--dns-search)
+	    shift
+	    search="$search $1"
+	    ;;
+	-e | --env)
+	    shift
+	    env="$env --env-file=$1"
+	    ;;
+	--entrypoint)
+	    entrypoint="--entrypoint=\"\""
+	    ;;
+	-f | --force)
+	    force="-f"
+	    ;;
+	-h | --help)
+	    usage
+	    exit 0
+	    ;;
+	--hostname)
+	    shift
+	    hostname="--hostname $1"
+	    ;;
+	-l | --log-driver)
+	    shift
+	    logging=" --log-driver=$1"
+	    ;;
+	--log-opt)
+	    shift
+	    logging="$logging --log-opt $1"
+	    ;;
+	--log-path)
+	    shift
+	    logging="$logging --log-opt path=$1"
+	    log_path="$1"
+	    ;;
+	-m | --mount)
+	    shift
+	    mount="--mount=$1"
+	    ;;
+	--manual)
+	    manual=true
+	    ;;
+	-n | --name)
+	    shift
+	    name="$1"
+	    ;;
+	--net)
+	    shift
+	    if [ -n "$network" ]; then
+		network="$network $1"
+	    else
+		network=$1
+	    fi
+	    ;;
+	--privileged)
+	    privileged="--privileged=true"
+	    ;;
+	-p | --publish)
+	    shift
+	    port="$port -p $1"
+	    ;;
+	-q | --quiet)
+	    quiet="-q"
+	    ;;
+	-r | --restart)
+	    shift
+	    restart=$1
+	    ;;
+	--read-only)
+	    ro="--read-only=true"
+	    ;;
+	-s | --simple)
+	    simple=true
+	    ;;
+	-v | --volume)
+	    shift
+	    vol="$vol -v $1"
+	    ;;
+	*)
+	    break
+	    ;;
+    esac
+    shift
+done
+
+cmd=$1
+if [ -n "$cmd" ]; then
+    shift
+fi
+
+case $cmd in
+    # Does not work atm., cannot attach to TTY because
+    # we monitor 'podman start -ai foo' with Finit.
+    # attach)
+    # 	podman attach "$1"
+    # 	;;
+    create)
+	[ -n "$quiet" ] || log "Got create args: $*"
+	create "$@"
+	;;
+    delete)
+	cmd=$1
+	name=$2
+	if [ "$cmd" = "network" ] && [ -n "$name" ]; then
+	    netwrm "$name"
+	else
+	    delete "$@"
+	fi
+	;;
+    exec)
+	podman exec -it "$@"
+	;;
+    find)
+	cmd=$1
+	pid=$2
+	if [ "$cmd" = "ifname" ] && [ -n "$pid" ]; then
+	    nsenter -t "$pid" -n ip -d -j link | \
+		jq --arg ifname "$network" -r '.[] | select(.ifalias==$ifname) | .ifname'
+	else
+	    containers=$(podman ps $all --format "{{.Names}}")
+	    for c in $containers; do
+		json=$(podman inspect "$c")
+		nets=$(echo "$json" |jq -r '.[].NetworkSettings.Networks | keys[]' 2>/dev/null)
+		for n in $nets; do
+		    if [ "$network" = "$n" ]; then
+			pid=$(echo "$json" | jq .[].State.Pid)
+			echo "$pid"
+			exit 0
+		    fi
+		done
+	    done
+	fi
+	;;
+    help)
+	usage
+	;;
+    load)
+	url=$1
+	name=$2
+	# shellcheck disable=SC2086
+	if echo "$url" | grep -q "://"; then
+	    file=$(basename "$url")
+            curl -k $creds -Lo "$file" "$url"
+	else
+            file="$url"
+	fi
+
+	# shellcheck disable=SC2086
+	name=$(unpack_archive "$file" $name)
+
+	# Show resulting image(s) matching $name
+	if [ -n "$name" ]; then
+	    podman images -n "$name"
+	else
+	    exit 1
+	fi
+	;;
+    ls | list)
+	cmd=$1
+	[ -n "$cmd" ] && shift
+	case $cmd in
+	    image*)
+		podman images $all --format "{{.Repository}}:{{.Tag}}"
+		;;
+	    oci)
+		find /lib/oci /var/lib/containers/oci -type f 2>/dev/null
+		;;
+	    *)		
+		podman ps $all --format "{{.Names}}"
+		;;
+	esac
+	;;
+    pull)
+	podman pull "$@"
+	;;
+    remove)
+	podman rmi $all $force -i "$1"
+	;;
+    run)
+	img=$1
+	cmd=$2
+	[ -n "$port" ] || port="-P"
+	if [ -n "$cmd" ]; then
+	    shift 2
+	    [ -n "$detach" ] || echo "Starting $img ENTRYPOINT $cmd :: use Ctrl-p Ctrl-q to detach"
+	    podman run -it --rm $detach $port --entrypoint="$cmd" "$img" "$@"
+	else
+	    [ -n "$detach" ] || echo "Starting $img :: use Ctrl-p Ctrl-q to detach"
+	    podman run -it --rm $detach $port "$img"
+	fi
+	;;
+    save)
+	name=$1
+	file=$2
+	if echo "$file" | grep -q ".gz"; then
+	    file=${file%%.gz}
+	    gzip=true
+	fi
+	if ! echo "$file" | grep -q ".tar"; then
+	    file=${file}.tar
+	    gzip=true
+	fi
+	podman save -o "$file" "$name"
+	if [ -s "$file" ] && [ -n "$gzip" ]; then
+	    gzip "$file"
+	fi
+	;;
+    shell)
+	podman exec -it "$1" sh -l
+	;;
+    show)
+	cmd=$1
+	[ -n "$cmd" ] && shift
+	case $cmd in
+	    image*)
+		if [ -n "$simple" ]; then
+		    podman images $all --format "{{.Names}} {{.Size}}" \
+			| sed 's/\[\(.*\)\] /\1 /g' \
+			| awk '{ printf "%-60s %s %s\n", $1, $2, $3}'
+		else
+		    podman images $all
+		fi
+		;;
+	    volume*)
+		printf "%-20s  CONTAINER\n" "VOLUME"
+		for v in $(podman volume ls --format "{{.Name}}"); do
+		    printf "%-20s" "$v"
+		    podman ps -a --filter volume="$v"  --format '{{.Names}}' | sed 's/^/  /'
+		done
+		;;
+	    *)
+		if [ -n "$simple" ]; then
+		    podman ps $all --format "{{.ID}}  {{.Names}}  {{.Image}}" \
+			| awk '{ printf "%s  %-30s %s\n", $1, $2, $3}'
+		else
+		    podman ps $all
+		fi
+		;;
+	esac
+	;;
+    start)
+	if [ -n "$name" ]; then
+	    wrap "$name" start
+	elif [ -n "$1" ]; then
+	    start "$1"
+	else
+	    usage
+	    exit 1
+	fi
+	;;
+    restart)
+	if [ -n "$name" ]; then
+	    wrap "$name" restart
+	elif [ -n "$1" ]; then
+	    stop  "$1"
+	    start "$1"
+	else
+	    usage
+	    exit 1
+	fi
+	;;
+    stop)
+	if [ -n "$name" ]; then
+	    wrap "$name" stop
+	elif [ -n "$1" ]; then
+	    stop "$1"
+	else
+	    usage
+	    exit 1
+	fi
+	;;
+    stat*)
+	podman stats -i 2
+	;;
+    upgrade)
+	img=$(podman inspect "$1" | jq -r .[].ImageName)
+	if [ -z "$img" ]; then
+	    echo "No such container ($1), or invalid ImageName.  Cannot upgrade."
+	    exit 1;
+	fi
+	podman stop "$1"
+	podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
+	"/var/lib/containers/active/${1}.sh" || (echo "Failed recreating container $1"; exit 1)
+	;;
+    volume)
+	cmd=$1
+	[ -n "$cmd" ] && shift
+	case $cmd in
+	    prune)
+		podman volume $force prune
+		;;
+	    *)
+		false
+		;;
+	esac
+	;;
+    *)
+	usage
+	exit 1
+	;;
+esac
@@ -1,14 +1,16 @@
 #!/bin/sh
-
-# udhcpc script edited by Tim Riker <Tim@Rikers.org>
+# This script expect a system with resolvconf (openresolv) and iproute2

 [ -z "$1" ] && echo "Error: should be called from udhcpc" && exit 1

 ACTION="$1"
-RESOLV_CONF="/etc/resolv.conf"
-[ -e $RESOLV_CONF ] || touch $RESOLV_CONF
+IP_CACHE="/var/lib/misc/${interface}.cache"
+RESOLV_CONF="/run/resolvconf/interfaces/${interface}.conf"
+NTPFILE="/run/chrony/dhcp-sources.d/${interface}.sources"
 [ -n "$broadcast" ] && BROADCAST="broadcast $broadcast"
-[ -n "$subnet" ] && NETMASK="$subnet"
+[ -n "$subnet" ] || subnet=32
+[ -n "$metric" ] || metric=100
+
 # Handle stateful DHCPv6 like DHCPv4
 [ -n "$ipv6" ] && ip="$ipv6/128"

@@ -16,113 +18,139 @@ if [ -z "${IF_WAIT_DELAY}" ]; then
 	IF_WAIT_DELAY=10
 fi

-wait_for_ipv6_default_route() {
-	printf "Waiting for IPv6 default route to appear"
-	while [ $IF_WAIT_DELAY -gt 0 ]; do
-		if ip -6 route list | grep -q default; then
-			printf "\n"
-			return
-		fi
-		sleep 1
-		printf "."
-		: $((IF_WAIT_DELAY -= 1))
-	done
-	printf " timeout!\n"
+log()
+{
+    logger -I $$ -t udhcpc -p user.notice "$*"
 }

-flush_dhcp_addresses() {
-	addrs=$(ip -j addr show dev $interface | jq -c \
-		'.[0].addr_info[] | select(.family == "inet") | select(.protocol == "dhcp")')
-
-	for addr in $addrs; do
-		ip="$(echo "$addr" | jq -r '."local"')"
-		prefix="$(echo "$addr" | jq -r '."prefixlen"')"
-		ip addr del "$ip/$prefix" dev "$interface"
-	done
+wwait_for_ipv6_default_route()
+{
+    log "waiting for IPv6 default route to be installed."
+    while [ $IF_WAIT_DELAY -gt 0 ]; do
+	if ip -6 route list proto dhcp dev $interface | grep -q default; then
+	    return
+	fi
+	sleep 1
+	printf "."
+	: $((IF_WAIT_DELAY -= 1))
+    done
+    log "Timed out witing for IPv6 default route!"
 }

+# RFC3442: If the DHCP server returns both a Classless
+# Static Routes option and a Router option, the DHCP
+# client MUST ignore the Router option.
+set_dhcp_routes()
+{
+    if [ -n "$staticroutes" ]; then
+	# format: dest1/mask gw1 ... destn/mask gwn
+	set -- $staticroutes
+	while [ -n "$1" -a -n "$2" ]; do
+	    log "adding route $1 via $2 dev $interface proto dhcp"
+	    ip route add "$1" via "$2" dev $interface metric $metric proto dhcp
+	    shift 2
+	done
+    elif [ -n "$router" ] ; then
+	for i in $router ; do
+	    ip route add default via $i dev $interface metric $((metric++)) proto dhcp
+	done
+    fi
+}
+
+clr_dhcp_routes()
+{
+    log "deleting DHCP routes from $interface"
+    ip route show proto dhcp dev $interface | while read rt via nh dev dev; do
+	log "removing $rt nh $nh on $dev"
+	ip route del $rt via $nh dev $dev proto dhcp
+    done
+}
+
+clr_dhcp_addresses()
+{
+    addrs=$(ip -j addr show dev $interface \
+		| jq -c '.[0].addr_info[] | select(.family == "inet") | select(.protocol == "dhcp")')
+
+    for addr in $addrs; do
+	ip="$(echo "$addr" | jq -r '."local"')"
+	prefix="$(echo "$addr" | jq -r '."prefixlen"')"
+	log "removing $ip/$prefix from $interface"
+	ip addr del "$ip/$prefix" dev "$interface"
+    done
+}
+
+log "action $ACTION"
 case "$ACTION" in
-	deconfig)
-		flush_dhcp_addresses
+    deconfig)
+	clr_dhcp_addresses
+	clr_dhcp_routes
+	/bin/ip link set dev $interface up

-		/bin/ip link set dev $interface up
+	# drop info from this interface
+	rm -f "$RESOLV_CONF"
+	rm -f "$NTPFILE"
+	if [ -x /usr/sbin/avahi-autoipd ]; then
+	    /usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
+	fi
+	;;

-		# drop info from this interface
-		# resolv.conf may be a symlink to /tmp/, so take care
-		TMPFILE=$(mktemp)
-		grep -vE "# $interface\$" $RESOLV_CONF > $TMPFILE
-		cat $TMPFILE > $RESOLV_CONF
-		rm -f $TMPFILE
+    leasefail|nak)
+	if [ -x /usr/sbin/avahi-autoipd ]; then
+	    /usr/sbin/avahi-autoipd -c $interface || /usr/sbin/avahi-autoipd -wD $interface --no-chroot
+	fi
+	;;

-		if [ -x /usr/sbin/avahi-autoipd ]; then
-			/usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
-		fi
-		;;
+    renew|bound)
+	if [ -x /usr/sbin/avahi-autoipd ]; then
+	    /usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
+	fi

-	leasefail|nak)
-		if [ -x /usr/sbin/avahi-autoipd ]; then
-			/usr/sbin/avahi-autoipd -c $interface || /usr/sbin/avahi-autoipd -wD $interface --no-chroot
-		fi
-		;;
+	if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto 5; then
+	    echo "$ip" > "$IP_CACHE"
+	fi
+	if [ -n "$ipv6" ] ; then
+	    wait_for_ipv6_default_route
+	fi

-	renew|bound)
-		if [ -x /usr/sbin/avahi-autoipd ]; then
-			/usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
-		fi
-		/bin/ip addr add dev $interface $ip/$NETMASK $BROADCAST proto 5
-		if [ -n "$ipv6" ] ; then
-			wait_for_ipv6_default_route
-		fi
+	clr_dhcp_routes
+	set_dhcp_routes

-		# RFC3442: If the DHCP server returns both a Classless
-		# Static Routes option and a Router option, the DHCP
-		# client MUST ignore the Router option.
-		if [ -n "$staticroutes" ]; then
-			echo "deleting routers"
-			route -n | while read dest gw mask flags metric ref use iface; do
-				[ "$iface" != "$interface" -o "$gw" = "0.0.0.0" ] || \
-					route del -net "$dest" netmask "$mask" gw "$gw" dev "$interface"
-			done
+	# set hostname if given
+	if [ -n "$hostname" ]; then
+	    log "setting new hostname: $hostname"
+	    hostname "$hostname"
+	    augtool -s "set /files/etc/hosts/*[ipaddr='127.0.1.1']/canonical $hostname"
+	fi

-			# format: dest1/mask gw1 ... destn/mask gwn
-			set -- $staticroutes
-			while [ -n "$1" -a -n "$2" ]; do
-				ip route add -net "$1" via "$2" dev "$interface" proto 16
-				shift 2
-			done
-		elif [ -n "$router" ] ; then
-			echo "deleting routers"
-			while route del default gw 0.0.0.0 dev $interface 2> /dev/null; do
-				:
-			done
+	# drop info from this interface
+	truncate -s 0 "$RESOLV_CONF"

-			for i in $router ; do
-				ip route add default via $i dev $interface proto 16
-			done
-		fi
+	# prefer rfc3397 domain search list (option 119) if available
+	if [ -n "$search" ]; then
+	    search_list=$search
+	elif [ -n "$domain" ]; then
+	    search_list=$domain
+	fi

-		# drop info from this interface
-		# resolv.conf may be a symlink to /tmp/, so take care
-		TMPFILE=$(mktemp)
-		grep -vE "# $interface\$" $RESOLV_CONF > $TMPFILE
-		cat $TMPFILE > $RESOLV_CONF
-		rm -f $TMPFILE
+	if [ -n "$search_list" ]; then
+	    log "adding search $search_list"
+	    echo "search $search_list # $interface" >> $RESOLV_CONF
+	fi

-		# prefer rfc3397 domain search list (option 119) if available
-		if [ -n "$search" ]; then
-			search_list=$search
-		elif [ -n "$domain" ]; then
-			search_list=$domain
-		fi
+	for i in $dns ; do
+	    log "adding dns $i"
+	    echo "nameserver $i # $interface" >> $RESOLV_CONF
+	    resolvconf -u
+	done

-		[ -n "$search_list" ] &&
-			echo "search $search_list # $interface" >> $RESOLV_CONF
-
-		for i in $dns ; do
-			echo adding dns $i
-			echo "nameserver $i # $interface" >> $RESOLV_CONF
-		done
-		;;
+	if [ -n "$ntpsrv" ]; then
+	    truncate -s 0 "$NTPFILE"
+	    for srv in $ntpsrv; do
+		log "got NTP server $srv"
+		echo "server $srv iburst" >> "$NTPFILE"
+	    done
+	    chronyc reload sources >/dev/null
+	fi
 esac

 HOOK_DIR="$0.d"
@@ -0,0 +1,23 @@
+#!/bin/sh
+# shellcheck disable=SC3045
+
+OUTPUT=$1
+
+read -r -s -p "New password: " password
+>&2 echo
+read -r -s -p "Retype password: " password_again
+>&2 echo
+
+if [ "$password" != "$password_again" ]; then
+    echo "Passwords do not match, try again."
+    exit 1
+fi
+
+if [ -z "$OUTPUT" ]; then
+    echo "$password"
+    exit 0
+fi
+
+umask 0177
+echo "$password" | mkpasswd > "$OUTPUT"
+exit 0
@@ -1,3 +1,3 @@
-#!/bin/bash -li
+#!/bin/sh
 # Source settings, aliases, and probe terminal size, then hand over to klish
-exec /usr/bin/klish
+exec env CLISH=yes bash -ilc /usr/bin/klish
@@ -1 +1,2 @@
 alias cli='clish'
+alias cfg='sysrepocfg -f json'
@@ -0,0 +1,7 @@
+if [ -z "$CLISH" ]; then
+    cat <<EOF
+
+Run the command 'cli' for interactive OAM
+
+EOF
+fi
@@ -1,4 +1,5 @@
-net.ipv6.conf.all.forwarding=0
+net.ipv6.conf.all.forwarding=1
+net.ipv6.conf.default.forwarding=0
 net.ipv6.conf.all.autoconf=0
 net.ipv6.conf.default.autoconf=0
 net.ipv6.conf.default.keep_addr_on_down=1
@@ -1,36 +0,0 @@
-#!/usr/bin/env python3
-
-import subprocess
-import sys
-import json
-
-def get_ethtool_output(interface):
-    try:
-        output = subprocess.check_output(['ethtool', interface], stderr=subprocess.DEVNULL, text=True)
-        return output.splitlines()
-    except subprocess.CalledProcessError:
-        print("Error: Failed to run ethtool on interface", interface)
-        sys.exit(1)
-
-def parse_ethtool_output(lines, keys):
-    result = {}
-    for line in lines:
-        line = line.strip()
-        key = line.split(':', 1)[0].strip()
-        if key in keys:
-            key, value = line.split(':', 1)
-            result[key.strip()] = value.strip()
-    return result
-
-if __name__ == "__main__":
-    if len(sys.argv) != 2:
-        print(f"Usage: {sys.argv[0]} INTERFACE")
-        sys.exit(1)
-
-    interface = sys.argv[1]
-    keys = ["Duplex", "Auto-negotiation"]
-
-    lines = get_ethtool_output(interface)
-    parsed_data = parse_ethtool_output(lines, keys)
-
-    print(json.dumps(parsed_data, indent=4))
@@ -1,405 +0,0 @@
-#!/usr/bin/env python3
-
-import subprocess
-import json
-import sys # (built-in module)
-
-def json_get_yang_type(iface_in):
-    if iface_in['link_type'] == "loopback":
-        return "infix-if-type:loopback"
-
-    if iface_in['link_type'] != "ether":
-        return "infix-if-type:other";
-
-    if not 'linkinfo' in iface_in:
-        return "infix-if-type:ethernet"
-
-    if not 'info_kind' in iface_in['linkinfo']:
-        return "infix-if-type:ethernet";
-
-    if iface_in['linkinfo']['info_kind'] == "veth":
-        return "infix-if-type:veth";
-
-    if iface_in['linkinfo']['info_kind'] == "vlan":
-        return "infix-if-type:vlan";
-
-    if iface_in['linkinfo']['info_kind'] == "bridge":
-        return "infix-if-type:bridge";
-
-    if iface_in['linkinfo']['info_kind'] == "dsa":
-        return "infix-if-type:ethernet";
-
-    # Fallback
-    return "infix-if-type:ethernet";
-
-def json_get_yang_origin(addr):
-    map = {
-        "kernel_ll":        "link-layer",
-        "kernel_ra":        "link-layer",
-        "static":           "static",
-        "dhcp":             "dhcp",
-        "random":           "random",
-    }
-    proto = addr['protocol']
-
-    if proto == "kernel_ll" or proto == "kernel_ra":
-        if "stable-privacy" in addr:
-            return "random"
-
-    return map.get(proto, "other")
-
-def get_proc_value(procfile):
-    try:
-        with open(procfile, 'r') as file:
-            data = file.read().strip()
-            return data
-    except FileNotFoundError:
-        # This is considered OK
-        return None
-    except IOError:
-        print(f"Error: reading from {procfile}", file=sys.stderr)
-
-# This function returns a value from a nested json dict
-def lookup(json, *keys):
-    curr = json
-    for key in keys:
-        if isinstance(curr, dict) and key in curr:
-            curr = curr[key]
-        else:
-            return None
-    return curr
-
-# This function inserts a value into a nested json dict
-def insert(json, *path_and_value):
-    if len(path_and_value) < 2:
-        raise ValueError("Error: insert() takes at least two args")
-
-    *path, value = path_and_value
-
-    curr = json
-    for key in path[:-1]:
-        if key not in curr or not isinstance(curr[key], dict):
-            curr[key] = {}
-        curr = curr[key]
-
-    curr[path[-1]] = value
-
-def run_cmd(cmd):
-    try:
-        output = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True)
-        return output.splitlines()
-    except subprocess.CalledProcessError:
-        print(f"Error: command returned error", file=sys.stderr)
-        sys.exit(1)
-
-def run_json_cmd(cmd):
-    try:
-        result = subprocess.run(cmd, check=True, stdout=subprocess.PIPE,
-                                stderr=subprocess.PIPE, text=True)
-        output = result.stdout
-        data = json.loads(output)
-    except subprocess.CalledProcessError as e:
-        print(f"Error: unable to get data:", file=sys.stderr)
-        print(f"{e.stderr}", file=sys.stderr)
-        sys.exit(1)
-    except json.JSONDecodeError as e:
-        print(f"Error: parsing JSON output: {e.msg}", file=sys.stderr)
-        sys.exit(1)
-    return data
-
-def iface_is_dsa(iface_in):
-    if not "linkinfo" in iface_in:
-        return False
-    if not "info_kind" in iface_in['linkinfo']:
-        return False
-    if iface_in['linkinfo']['info_kind'] != "dsa":
-        return False
-    return True
-
-def add_ipv4_route(routes):
-    cmd = ['ip', '-4', '-s', '-d', '-j', 'route']
-    data = run_json_cmd(cmd)
-    out={}
-    out["route"] = []
-
-    for d in data:
-        new = {}
-        next_hop = {}
-        if(d['dst'] == "default"):
-            d['dst'] = "0.0.0.0/0"
-        if(d['dst'].find('/') == -1):
-            d['dst'] = d['dst']+"/32"
-        new['ietf-ipv4-unicast-routing:destination-prefix'] = d['dst']
-        new['source-protocol'] = "infix-routing:"+d['protocol']
-        if d.get("metric"):
-            new['route-preference'] = d['metric']
-        else:
-            new['route-preference'] = 0
-
-        if d['type'] == "blackhole":
-            next_hop['special-next-hop'] = "blackhole"
-        if d['type'] == "unreachable":
-            next_hop['special-next-hop'] = "unreachable"
-
-        if d['type'] == "unicast":
-            if(d.get("gateway")):
-                next_hop['ietf-ipv4-unicast-routing:next-hop-address'] = d['gateway']
-            elif(d.get("dev")):
-                next_hop['outgoing-interface'] = d['dev']
-
-        new['next-hop'] = next_hop
-
-        out['route'].append(new)
-    insert(routes, 'routes', out)
-
-def add_ip_link(ifname, iface_out):
-    cmd = ['ip', '-s', '-d', '-j', 'link', 'show', 'dev', ifname]
-
-    data = run_json_cmd(cmd)
-    if len(data) != 1:
-        print(f"Error: expected ip link output to be array with length 1", file=sys.stderr)
-        sys,exit(1)
-
-    iface_in = data[0]
-
-    if 'ifname' in iface_in:
-        iface_out['name'] = iface_in['ifname']
-
-    if 'ifindex' in iface_in:
-        iface_out['if-index'] = iface_in['ifindex']
-
-    if 'address' in iface_in:
-        iface_out['phys-address'] = iface_in['address']
-
-    if 'master' in iface_in:
-        insert(iface_out, "infix-interfaces:bridge-port", "bridge", iface_in['master'])
-
-    if 'link' in iface_in and not iface_is_dsa(iface_in):
-        insert(iface_out, "infix-interfaces:vlan", "lower-layer-if", iface_in['link'])
-
-    if 'operstate' in iface_in:
-        map = {
-                "DOWN":                "down",
-                "UP":                  "up",
-                "DORMANT":             "dormant",
-                "TESTING":             "testing",
-                "LOWERLAYERDOWN":      "lower-layer-down",
-                "NOTPRESENT":          "not-present"
-                }
-        val = map.get(iface_in['operstate'], "unknown")
-        iface_out['oper-status'] =  val
-
-    if 'link_type' in iface_in:
-        val = json_get_yang_type(iface_in)
-        iface_out['type'] = val
-
-    val = lookup(iface_in, "stats64", "rx", "bytes")
-    if val is not None:
-        insert(iface_out, "statistics", "out-octets", str(val))
-
-    val = lookup(iface_in, "stats64", "tx", "bytes")
-    if val is not None:
-        insert(iface_out, "statistics", "in-octets", str(val))
-
-def add_ip_addr(ifname, iface_out):
-    cmd = ['ip', '-j', 'addr', 'show', 'dev', ifname]
-
-    data = run_json_cmd(cmd)
-    if len(data) != 1:
-        print(f"Error: expected ip addr output to be array with length 1", file=sys.stderr)
-        sys,exit(1)
-
-    iface_in = data[0]
-
-    if 'mtu' in iface_in and ifname != "lo":
-        insert(iface_out, "ietf-ip:ipv4", "mtu", iface_in['mtu'])
-
-    # We avoid importing os to check if the file exists (for performance)
-    val = get_proc_value(f"/proc/sys/net/ipv6/conf/{ifname}/mtu")
-    if val is not None:
-        insert(iface_out, "ietf-ip:ipv6", "mtu", int(val))
-
-    if 'addr_info' in iface_in:
-        inet = []
-        inet6 = []
-
-        for addr in iface_in['addr_info']:
-            new = {}
-
-            if not 'family' in addr:
-                print(f"Error: 'family' missing from 'addr_info'", file=sys.stderr)
-                continue
-
-            if 'local' in addr:
-                new['ip'] = addr['local']
-            if 'prefixlen' in addr:
-                new['prefix-length'] = addr['prefixlen']
-            if 'protocol' in addr:
-                new['origin'] = json_get_yang_origin(addr)
-
-            if addr['family'] == "inet":
-                inet.append(new)
-            elif addr['family'] == "inet6":
-                inet6.append(new)
-            else:
-                print(f"Error: invalid 'family' in 'addr_info'", file=sys.stderr)
-                sys.exit(1)
-
-        insert(iface_out, "ietf-ip:ipv4", "address", inet)
-        insert(iface_out, "ietf-ip:ipv6", "address", inet6)
-
-def add_ethtool_groups(ifname, iface_out):
-    cmd = ['ethtool', '--json', '-S', ifname, '--all-groups']
-
-    data = run_json_cmd(cmd)
-    if len(data) != 1:
-        print(f"Error: expected ethtool groups output to be array with length 1", file=sys.stderr)
-        sys,exit(1)
-
-    iface_in = data[0]
-
-    # TODO: room for improvement here, the "frame" creation could be more dynamic.
-    if "eth-mac" in iface_in or "rmon" in iface_in:
-        insert(iface_out, "ieee802-ethernet-interface:ethernet", "statistics", "frame", {})
-        frame = iface_out['ieee802-ethernet-interface:ethernet']['statistics']['frame']
-
-    if "eth-mac" in iface_in:
-        mac_in = iface_in['eth-mac']
-
-        if "FramesTransmittedOK" in mac_in:
-            frame['out-frames'] = str(mac_in['FramesTransmittedOK'])
-        if "MulticastFramesXmittedOK" in mac_in:
-            frame['out-multicast-frames'] = str(mac_in['MulticastFramesXmittedOK'])
-        if "BroadcastFramesXmittedOK" in mac_in:
-            frame['out-broadcast-frames'] = str(mac_in['BroadcastFramesXmittedOK'])
-        if "FramesReceivedOK" in mac_in:
-            frame['in-frames'] = str(mac_in['FramesReceivedOK'])
-        if "MulticastFramesReceivedOK" in mac_in:
-            frame['in-multicast-frames'] = str(mac_in['MulticastFramesReceivedOK'])
-        if "BroadcastFramesReceivedOK" in mac_in:
-            frame['in-broadcast-frames'] = str(mac_in['BroadcastFramesReceivedOK'])
-        if "FrameCheckSequenceErrors" in mac_in:
-            frame['in-error-fcs-frames'] = str(mac_in['FrameCheckSequenceErrors'])
-        if "FramesLostDueToIntMACRcvError" in mac_in:
-            frame['in-error-mac-internal-frames'] = str(mac_in['FramesLostDueToIntMACRcvError'])
-
-        tot = 0
-        found = False
-        if "FramesReceivedOK" in mac_in:
-            tot += mac_in['FramesReceivedOK']
-            found = True
-        if "FrameCheckSequenceErrors" in mac_in:
-            tot += mac_in['FrameCheckSequenceErrors']
-            found = True
-        if "FramesLostDueToIntMACRcvError" in mac_in:
-            tot += mac_in['FramesLostDueToIntMACRcvError']
-            found = True
-        if "AlignmentErrors" in mac_in:
-            tot += mac_in['AlignmentErrors']
-            found = True
-        if "etherStatsOversizePkts" in mac_in:
-            tot += mac_in['etherStatsOversizePkts']
-            found = True
-        if "etherStatsJabbers" in mac_in:
-            tot += mac_in['etherStatsJabbers']
-            found = True
-        if found:
-            frame['in-total-frames'] = str(tot)
-
-    if "rmon" in iface_in:
-        rmon_in = iface_in['rmon']
-
-        if "undersize_pkts" in rmon_in:
-            frame['in-error-undersize-frames'] = str(rmon_in['undersize_pkts'])
-
-        tot = 0
-        found = False
-        if "etherStatsJabbers" in rmon_in:
-            tot += rmon_in['etherStatsJabbers']
-            found = True
-        if "etherStatsOversizePkts" in rmon_in:
-            tot += rmon_in['etherStatsOversizePkts']
-            found = True
-        if found:
-            frame['in-error-oversize-frames'] = str(tot)
-
-def add_ethtool_std(ifname, iface_out):
-    cmd = ['ethtool', ifname]
-    keys = ['Speed', 'Duplex', 'Auto-negotiation']
-    result = {}
-
-    lines = run_cmd(cmd)
-    for line in lines:
-        line = line.strip()
-        key = line.split(':', 1)[0].strip()
-        if key in keys:
-            key, value = line.split(':', 1)
-            result[key.strip()] = value.strip()
-
-    if "Auto-negotiation" in result:
-        if result['Auto-negotiation'] == "on":
-            insert(iface_out, "ieee802-ethernet-interface:ethernet", "auto-negotiation", "enable", True)
-        else:
-            insert(iface_out, "ieee802-ethernet-interface:ethernet", "auto-negotiation", "enable", False)
-
-    if "Duplex" in result:
-        if result['Duplex'] == "Half":
-            insert(iface_out, "ieee802-ethernet-interface:ethernet", "duplex", "half")
-        elif result['Duplex'] == "Full":
-            insert(iface_out, "ieee802-ethernet-interface:ethernet", "duplex", "full")
-        else:
-            insert(iface_out, "ieee802-ethernet-interface:ethernet", "duplex", "unknown")
-
-    if "Speed" in result and result['Speed'] != "Unknown!":
-        # Avoid importing re (performance)
-        num = ''.join(filter(str.isdigit, result['Speed']))
-        if num:
-            num = round((int(num) / 1000), 3)
-            insert(iface_out, "ieee802-ethernet-interface:ethernet", "speed", str(num))
-
-if __name__ == "__main__":
-    if len(sys.argv) < 2:
-        print(f"usage: yanger <model> [params]", file=sys.stderr)
-        sys.exit(1)
-
-    model = sys.argv[1]
-    if(model == 'ietf-interfaces'):
-        # For now, we handle each interface separately, as this is how it's
-        # currently implemented in sysrepo. I.e sysrepo will subscribe to
-        # each individual interface and query it for YANG data.
-
-        if len(sys.argv) != 3:
-            print(f"usage: yanger ietf-interfaces IFNAME", file=sys.stderr)
-            sys.exit(1)
-
-        yang_data = {
-            "ietf-interfaces:interfaces": {
-                "interface": [{}]
-            }
-        }
-
-        ifname = sys.argv[2]
-        iface_out = yang_data['ietf-interfaces:interfaces']['interface'][0]
-
-        add_ip_link(ifname, iface_out)
-        add_ip_addr(ifname, iface_out)
-        add_ethtool_groups(ifname, iface_out)
-        add_ethtool_std(ifname, iface_out)
-    elif(model == 'ietf-routing'):
-        yang_data = {
-            "ietf-routing:routing": {
-                "ribs":  {
-                    "rib": [{
-                        "name": "ipv4",
-                        "address-family": "ipv4",
-                    }]
-                }
-            }
-        }
-
-        ipv4routes = yang_data['ietf-routing:routing']['ribs']['rib'][0]
-        add_ipv4_route(ipv4routes);
-    else:
-        print(f"Unsupported model {model}", file=sys.stderr)
-        sys.exit(1)
-    print(json.dumps(yang_data, indent=2))
@@ -40,10 +40,13 @@ class DTSystem:
                continue

            ph, = struct.unpack(">L", open(phandle, "rb").read())
-            sys[ph] = root
+            if ph not in sys:
+                sys[ph] = []
+            sys[ph].append(root)

        phs = set(list(dt.keys()) + list(sys.keys()))
-        self.devs = { ph: Device(ph, dt.get(ph), sys.get(ph)) for ph in phs }
+
+        self.devs = { ph: [Device(ph, dt.get(ph), s if s is not None else "") for s in (sys.get(ph) or []) if ph is not None]  for ph in phs }
        self.base = Device(0, None, DTSystem.BASE)
        self.infix = Device(0, None, DTSystem.INFIX)

@@ -56,7 +59,7 @@ class DTSystem:
        elems = len(data) // struct.calcsize(">L")
        return struct.unpack(">" + elems * "L", data)

-    def device_from_ph(self, ph):
+    def devices_from_ph(self, ph):
        return self.devs.get(ph)

    def into_vpd(self, dev):
@@ -79,12 +82,23 @@ class DTSystem:
            "data": parse(),
        }

+    def infix_usb_devices(self, out):
+        names=self.infix.str_array("usb-port-names")
+        phs=self.__get_phandle_array("usb-ports")
+        data=dict(zip(names,phs))
+        if data != {}:
+            out["usb-ports"] = []
+        for name,ph in data.items():
+            [out["usb-ports"].extend([{"name": name, "path": dev.attrpath("authorized")}, {"name": name, "path": dev.attrpath("authorized_default")}]) for dev in self.devices_from_ph(ph)]
+
+
    def infix_devices(self, kind):
        phs = self.__get_phandle_array(kind)
-        return [self.device_from_ph(ph) for ph in phs]
+        return [[d for d in self.devices_from_ph(ph)] for ph in phs]

    def infix_vpds(self):
-        return [self.into_vpd(dev) for dev in self.infix_devices("vpds")]
+        flat_devices = [device for sublist in self.infix_devices("vpds") for device in sublist]
+        return [self.into_vpd(device) for device in flat_devices]

 class QEMUSystem:
    BASE = "/sys/firmware/qemu_fw_cfg"
@@ -109,6 +123,28 @@ class QEMUSystem:
    def vpds(self):
        return [self.product_vpd()]

+    def usb_ports(self):
+        ports = [
+            {
+            "name": "USB",
+            "path": "/sys/bus/usb/devices/usb1/authorized"
+
+        },
+        {
+            "name": "USB",
+            "path": "/sys/bus/usb/devices/usb1/authorized_default"
+
+        },
+        {
+            "name": "USB2",
+            "path": "/sys/bus/usb/devices/usb2/authorized"
+        },
+        {
+            "name": "USB2",
+            "path": "/sys/bus/usb/devices/usb2/authorized_default"
+
+        }]
+        return ports
 class Device:
    def __init__(self, ph, dtpath, syspath):
        self.ph, self.dtpath, self.syspath = ph, dtpath, syspath
@@ -143,6 +179,9 @@ class Device:
        val = self.attr(attr)
        return val.decode("utf-8").strip("\0") if val else default

+    def str_array(self, attr, default=None):
+        val = self.attr(attr)
+        return val.decode("utf-8").strip("\0").split("\0") if val else default

    def dtattrpath(self, attr):
        return os.path.join(self.dtpath, attr)
@@ -199,8 +238,9 @@ def probe_qemusystem(out):

    qsys = QEMUSystem()
    vpds = qsys.vpds()
+    usb_ports = qsys.usb_ports()
    vpd_inject(out, vpds)
-
+    out["usb-ports"] = usb_ports
    for (attr, default) in (
            ("vendor", "QEMU"),
            ("product-name", "VM"),
@@ -221,7 +261,7 @@ def probe_qemusystem(out):
 def probe_dtsystem(out):
    dtsys = DTSystem()
    vpds = dtsys.infix_vpds()
-
+    dtsys.infix_usb_devices(out)
    model = dtsys.base.str("model")
    if model:
        out["product-name"] = model
@@ -63,7 +63,7 @@ ok

 step "Formatting $blk"
 [ -b $blk ] || { echo "$blk is not a block device" >&2; err; }
-/lib/infix/prod/fdisk $blk || err
+/libexec/infix/prod/fdisk $blk || err
 sleep 1
 ok

@@ -1,27 +1,28 @@
 test-dir := $(BR2_EXTERNAL_INFIX_PATH)/test
-INFIX_TESTS ?= $(test-dir)/case/all-repo.yaml $(test-dir)/case/all-unit.yaml \
-	$(test-dir)/case/all.yaml
+UNIT_TESTS ?= $(test-dir)/case/all-repo.yaml $(test-dir)/case/all-unit.yaml
+INFIX_TESTS ?= $(test-dir)/case/all.yaml

 test-env = $(test-dir)/env \
 	-f $(BINARIES_DIR)/infix-x86_64.img \
 	-p $(BINARIES_DIR)/infix-x86_64.pkg \
 	$(1) $(2)

-test-env-qeneth = $(call test-env,-q $(test-dir)/virt/dual,$(1))
+test-env-qeneth = $(call test-env,-q $(test-dir)/virt/quad,$(1))
 test-env-run    = $(call test-env,-C -t $(BINARIES_DIR)/qemu.dot,$(1))

-.PHONY: test-%
+test-unit:
+	$(test-dir)/env $(test-dir)/9pm/9pm.py $(UNIT_TESTS)

-test-qeneth:
+test test-qeneth:
 	$(call test-env-qeneth,\
-		$(BR2_EXTERNAL_INFIX_PATH)/9pm/9pm.py \
+		$(BR2_EXTERNAL_INFIX_PATH)/test/9pm/9pm.py \
 			$(INFIX_TESTS))
-test-qeneth-sh:
-	$(call test-env-qeneth,/bin/sh)
+test-sh test-qeneth-sh:
+	$(call test-env-qeneth,-i /bin/sh)

 test-run: | ~/.infix-test-venv
 	$(call test-env-run,\
-		$(BR2_EXTERNAL_INFIX_PATH)/9pm/9pm.py \
+		$(BR2_EXTERNAL_INFIX_PATH)/test/9pm/9pm.py \
 			$(INFIX_TESTS))
 test-run-sh: | ~/.infix-test-venv
 	$(call test-env-run,/bin/sh)
@@ -31,3 +32,5 @@ test-run-play: | ~/.infix-test-venv

 ~/.infix-test-venv:
 	$(test-dir)/docker/init-venv.sh $(test-dir)/docker/pip-requirements.txt
+
+.PHONY: test-unit test test-sh test-qeneth test-qeneth-sh test-run test-run-sh test-run-play
@@ -38,10 +38,8 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_NET=y
 CONFIG_PACKET=y
-CONFIG_UNIX=y
 CONFIG_XDP_SOCKETS=y
 CONFIG_XDP_SOCKETS_DIAG=y
-CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
 CONFIG_IP_MULTIPLE_TABLES=y
@@ -83,7 +81,6 @@ CONFIG_NFT_MASQ=m
 CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
-CONFIG_NFT_OBJREF=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
@@ -156,9 +153,7 @@ CONFIG_VLAN_8021Q=y
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
 CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBQ=y
 CONFIG_NET_CLS_BASIC=y
-CONFIG_NET_CLS_TCINDEX=y
 CONFIG_NET_CLS_BPF=y
 CONFIG_NET_CLS_FLOWER=y
 CONFIG_NETLINK_DIAG=y
@@ -224,11 +219,11 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
-CONFIG_USB=y
-CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_EHCI_HCD=y
-CONFIG_USB_UHCI_HCD=y
-CONFIG_USB_STORAGE=y
+CONFIG_USB=m
+CONFIG_USB_XHCI_HCD=m
+CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_UHCI_HCD=m
+CONFIG_USB_STORAGE=m
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_TRIGGERS=y
@@ -246,7 +241,6 @@ CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
 CONFIG_EXT4_FS=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
-CONFIG_AUTOFS4_FS=y
 CONFIG_FUSE_FS=y
 CONFIG_VIRTIO_FS=y
 CONFIG_OVERLAY_FS=y
@@ -260,8 +254,8 @@ CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_AES=y
+CONFIG_CRYPTO_GCM=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
@@ -6,6 +6,7 @@ BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
@@ -41,6 +42,7 @@ BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_CA_CERTIFICATES=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -77,6 +79,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_DIALOG=y
 BR2_PACKAGE_PDMENU=y
+BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
@@ -14,6 +14,7 @@ BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
@@ -33,7 +34,6 @@ BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dt
 BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -53,7 +53,9 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
@@ -70,7 +72,6 @@ BR2_PACKAGE_FPING=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
-BR2_PACKAGE_IPTABLES=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
@@ -88,8 +89,9 @@ BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
-BR2_PACKAGE_BASH=y
 BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
@@ -119,6 +121,8 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CURIOS_HTTPD=y
+BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
@@ -128,10 +132,17 @@ BR2_PACKAGE_FINIT_PLUGIN_RTC=y
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
+BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_PODMAN=y
+BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
+BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
+BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_QUERIERD=y
+BR2_PACKAGE_LIBINPUT=y
 DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
@@ -0,0 +1,176 @@
+BR2_aarch64=y
+BR2_cortex_a53=y
+BR2_ARM_FPU_VFPV4=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_TARGET_GENERIC_HOSTNAME="infix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_TERM="xterm"
+BR2_SYSTEM_DHCP="eth0"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
+BR2_GENERATE_LOCALE="en_US en_CA"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh support/scripts/genimage.sh"
+BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
+BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/linux_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="rockchip/rk3328-nanopi-r2s"
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
+BR2_PACKAGE_STRACE=y
+BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_LINUX_FIRMWARE=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT61=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT73=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT2XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_81XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X=y
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_CONNTRACK_TOOLS=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FRR=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPTABLES=y
+BR2_PACKAGE_IPTABLES_NFTABLES=y
+BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NETCAT_OPENBSD=y
+BR2_PACKAGE_NETSNMP=y
+BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NMAP=y
+BR2_PACKAGE_NMAP_NCAT=y
+BR2_PACKAGE_NMAP_NMAP=y
+BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_TRACEROUTE=y
+BR2_PACKAGE_ULOGD=y
+BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_HTOP=y
+BR2_PACKAGE_IRQBALANCE=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_DBUS=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_LESS=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_EXT2=y
+BR2_TARGET_ROOTFS_EXT2_4=y
+BR2_TARGET_ROOTFS_EXT2_SIZE="256M"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="v2.5"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="rk3328"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES=""
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_NEEDS_ARM32_TOOLCHAIN=y
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2021.10"
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="nanopi-r2s-rk3328"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
+BR2_TARGET_UBOOT_NEEDS_OPENSSL=y
+BR2_TARGET_UBOOT_NEEDS_ATF_BL31=y
+BR2_TARGET_UBOOT_NEEDS_ATF_BL31_ELF=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
+BR2_TARGET_UBOOT_SPL=y
+BR2_TARGET_UBOOT_SPL_NAME="idbloader.img"
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+INFIX_VENDOR_HOME="https://github.com/kernelkit"
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_EXECD=y
+BR2_PACKAGE_STATD=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
+BR2_PACKAGE_KEYACK=y
+BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_PODMAN=y
+BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
+BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
+BR2_PACKAGE_PODMAN_DRIVER_VFS=y
+BR2_PACKAGE_TETRIS=y
+BR2_PACKAGE_QUERIERD=y
+BR2_PACKAGE_LIBINPUT=y
+# SIGN_ENABLED is not set
+# GNS3_APPLIANCE is not set
@@ -5,6 +5,7 @@ BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
@@ -34,6 +35,7 @@ BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_CA_CERTIFICATES=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -69,6 +71,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_DIALOG=y
 BR2_PACKAGE_PDMENU=y
+BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
@@ -86,7 +89,7 @@ BR2_TARGET_ROOTFS_SQUASHFS=y
 BR2_TARGET_EDK2=y
 BR2_TARGET_GRUB2=y
 BR2_TARGET_GRUB2_X86_64_EFI=y
-BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 fat squash4 part_gpt normal efi_gop configfile loadenv test terminfo terminal echo"
+BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback"
 BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
 BR2_TARGET_GRUB2_INSTALL_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
@@ -13,6 +13,7 @@ BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
@@ -29,7 +30,6 @@ BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/lin
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -48,7 +48,9 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
@@ -65,7 +67,6 @@ BR2_PACKAGE_FPING=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
-BR2_PACKAGE_IPTABLES=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
@@ -83,8 +84,9 @@ BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
-BR2_PACKAGE_BASH=y
 BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
@@ -122,6 +124,8 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CURIOS_HTTPD=y
+BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
@@ -131,8 +135,14 @@ BR2_PACKAGE_FINIT_PLUGIN_RTC=y
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
+BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_PODMAN=y
+BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
+BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
+BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_QUERIERD=y
 GNS3_APPLIANCE_RAM=512
@@ -4,6 +4,224 @@ Change Log
 All notable changes to the project are documented in this file.


+[v24.02.0][] - 2024-03-01
+-------------------------
+
+> **Note:** the `root` account is disabled in official builds.  Only the
+> `admin` user can log in to the system.  This can be changed, but only
+> in developer builds: `make menuconfig` -> System configuration ->
+> `[*]Enable root login with password`
+
+### YANG Status
+
+Infix devices support downloading all YANG models over NETCONF, including
+models with submodules.  As a rule, standard models are used as long as
+they map to underlying Linux concepts and services.  All exceptions are
+listed in Infix specific models, detailing deviations and augmentations.
+
+Currently supported models:
+
+ - [ieee802-ethernet-interface][]:
+   - Toggle port speed & duplex auto-negotiation on/off
+   - Set port speed and duplex when auto-negotiation is off
+   - Query port speed/duplex and auto-negotiation status (operational)
+   - **Frame counters:**
+
+    | **YANG**                    | **Linux / Ethtool**               |
+    |-----------------------------|-----------------------------------|
+    | `out-frames`                | `FramesTransmittedOK`             |
+    | `out-multicast-frames`      | `MulticastFramesXmittedOK`        |
+    | `out-broadcast-frames`      | `BroadcastFramesXmittedOK`        |
+    | `in-total-octets`           | `FramesReceivedOK`                |
+    |                             | + `FrameCheckSequenceErrors`      |
+    |                             | + `FramesLostDueToIntMACRcvError` |
+    |                             | + `AlignmentErrors`               |
+    |                             | + `etherStatsOversizePkts`        |
+    |                             | + `etherStatsJabbers`             |
+    | `in-frames`                 | `FramesReceivedOK`                |
+    | `in-multicast-frames`       | `MulticastFramesReceivedOK`       |
+    | `in-broadcast-frames`       | `BroadcastFramesReceivedOK`       |
+    | `in-error-undersize-frames` | `undersize_pkts`                  |
+    | `in-error-fcs-frames`       | `FrameCheckSequenceErrors`        |
+    | `in-good-octets`            | `OctetsReceivedOK`                |
+    | `out-good-octets`           | `OctetsTransmittedOK`             |
+
+ - [ietf-hardware][]:
+   - Populates standard hardware model from corresponding data in device EEPROMs
+   - **augments:**
+     - Initial support for USB ports
+     - Vital Product Data (VPD) from device EEPROMs ([ONIE][] structure)
+   - [infix-hardware][]: Deviations and augments
+ - [ietf-system][]:
+   - **augments:**
+     - Message of the Day (MotD) banner, shown after SSH or console login.
+	   Please note: the legacy `motd` has been replaced with `motd-banner` os
+	   of v24.02.  Use CLI `text-editor` to modify the latter
+	 - User login shell, default: `/bin/false` (no SSH or console login)
+	 - State information for remotely querying firmware version information
+   - **deviations:**
+     - timezone-name, using IANA timezones instead of plain string
+	 - UTC offset, only support per-hour offsets with [tzdata][]
+	 - Usernames, clarifying Linux restrictions
+     - Unsupported features marked as deviations, e.g. RADIUS
+   - [infix-system-software][]: firmware upgrade with `install-bundle` RPC
+ - [ietf-interfaces][]:
+   - deviation to allow read-write `if:phys-address` for custom MAC address
+   - [ietf-ip][]: augments
+     - IPv4LL similar to standardized IPv6LL
+   - [ietf-ip][]: deviations (`not-supported`) added for IPv4 and IPv6:
+     - `/if:interfaces/if:interface/ip:ipv4/ip:address/ip:subnet/ip:netmask`
+	 - `/if:interfaces/if:interface/ip:ipv6/ip:address/ip:status`
+	 - `/if:interfaces/if:interface/ip:ipv4/ip:neighbor`
+     - `/if:interfaces/if:interface/ip:ipv6/ip:neighbor`
+   - [ietf-routing][]: Base model for routing
+   - [ietf-ipv4-unicast-routing][]: Static unicast routing, incl. operational
+     data, i.e., setting static IPv4 routes and reading IPv4 routing table
+   - [ietf-ipv6-unicast-routing][]: Static unicast routing, incl. operational
+     data, i.e., setting static IPv6 routes and reading IPv6 routing table
+   - [ietf-ospf][]: Limited support for OSPFv2, with additional support for
+     injecting default route, and route redistribution.  Underlying routing
+     engine in use is Frr.  Includes operational status + data (routes).
+	 See [infix-routing][] model for detailed list of deviations
+   - [infix-ethernet-interface][]: deviations for ieee802-ethernet-interface
+   - [infix-routing][]: Limit ietf-routing to one instance `default` per
+     routing protocol, also details unsupported features (deviations) to both
+     ietf-routing and ietf-ospf models, as well as augments made to support
+     injecting default route in OSPFv2
+   - [infix-if-bridge][]: Linux bridge interfaces with native VLAN support
+   - [infix-if-type][]: deviation for interface types, limiting number to
+     supported types only.  New identities are derived from default IANA
+     interface types, ensuring compatibility with other standard models, e.g.,
+     `ieee802-ethernet-interface.yang`
+   - [infix-if-veth][]: Linux VETH pairs
+   - [infix-if-vlan][]: Linux VLAN interfaces, e.g. `eth0.10`
+ - [infix-containers][]: Support for Docker containers, incl. operational data
+   to query status and remotely stop/start containers
+ - [infix-dhcp-client][]: DHCPv4 client, including supported options
+ - **Configurable services:**
+   - [ieee802-dot1ab-lldp][]: stripped down to an `enabled` setting
+   - [infix-services][]: support for enabling mDNS service/device discovery
+
+[tzdata]:          https://www.iana.org/time-zones
+[ietf-system]:     https://www.rfc-editor.org/rfc/rfc7317.html
+[ietf-interfaces]: https://www.rfc-editor.org/rfc/rfc7223.html
+[ietf-ip]:         https://www.rfc-editor.org/rfc/rfc8344.html
+[ietf-if-vlan-encapsulation]: https://www.ietf.org/id/draft-ietf-netmod-sub-intf-vlan-model-08.html
+[ietf-routing]:     https://www.rfc-editor.org/rfc/rfc8349
+[ietf-ipv4-unicast-routing]: https://www.rfc-editor.org/rfc/rfc8349#page-29
+[ietf-ipv6-unicast-routing]: https://www.rfc-editor.org/rfc/rfc8349#page-37
+[ietf-hardware]:    https://www.rfc-editor.org/rfc/rfc8348
+[ietf-ospf]:        https://www.rfc-editor.org/rfc/rfc9129
+[ieee802-dot1ab-lldp]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/ieee802-dot1ab-lldp%402022-03-15.yang
+[ieee802-ethernet-interface]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/ieee802-ethernet-interface%402019-06-21.yang
+[infix-ethernet-interface]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-ethernet-interface%402024-02-27.yang
+[infix-containers]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-containers%402024-02-01.yang
+[infix-dhcp-client]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-dhcp-client%402024-01-30.yang
+[infix-hardware]:  https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-hardware%402024-01-18.yang
+[infix-if-bridge]: https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-if-bridge%402024-02-19.yang
+[infix-if-type]:   https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-if-type%402024-01-29.yang
+[infix-if-veth]:   https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-if-veth%402023-06-05.yang
+[infix-if-vlan]:   https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-if-vlan%402023-10-25.yang
+[infix-ip]:        https://github.com/kernelkit/infix/tree/f0c23ca/src/confd/yang/infix-ip%402023-09-14.yang
+[infix-routing]:   https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-routing%402024-01-09.yang
+[infix-services]:  https://github.com/kernelkit/infix/blob/f0c23ca/src/confd/yang/infix-services%402023-10-16.yang
+[infix-system-software]: https://github.com/kernelkit/infix/tree/f0c23ca/src/confd/yang/infix-system-software%402023-06-27.yang
+[ONIE]: https://opencomputeproject.github.io/onie/design-spec/hw_requirements.html
+
+### Changes
+
+- New hardware support: NanoPi R2S from FriendlyELEC, a simple two-port router
+- Static routing support, now also for IPv6
+- Dynamic routing support with OSPFv2, limited (see `infix-routing.yang` for
+  deviations), but still usable in most relevant use-cases.  If you are using
+  this and are interested in more features, please let us know!
+  - Multiple area support, including different area types
+  - Route redistribution
+  - Default route injection
+  - Full integration with Bidirectional Forward Detection (BFD)
+  - Operational status, including but not limited to:
+    * OSPF Router ID
+    * Neighbor status
+    * OSPF routing table
+	* Interface type, incl. passive status
+  - For more information, see `doc/networking.md`
+- Support for disabling USB ports in `startup-config` (no auto-mount yet!)
+- Initial support for Docker containers, see documentation for details:
+  - Custom Infix model, see `infix-containers.yang` for details
+  - Add image URL/location and volumes/mounts/interfaces to configuration,
+    the system ensures the image is downloaded and container created in the
+	background before launching it.  If now networking is available the job
+	is queued and retried every time a new network route is learned
+  - Status and actions (stop/start/restart) available in operational datastore
+  - Possible to move physical switch ports inside container, see docs
+  - Possible to bundle OCI archives in Infix image, as well as storing any
+    file content in `factory-config` to override container image defaults
+- IEEE Ethernet interface:
+  - Support for setting port speed/duplex or auto-negotiating
+  - New per-port counters, augments to IEEE model added in infix-ethernet.yang:
+    `in-good-octets`, `out-good-octets`
+- Many updates to DHCPv4 client YANG model:
+  - new options, see `infix-dhcp-client.yang` for details:
+    - Default options: subnet, router, dns+domain, hostname, broadcast, ntpsrv
+    - Set NTP servers, require NTP client in ietf-system to be enabled, will
+	  be treated as non-preferred sources, configured `prefer` servers wins
+    - Learn DNS servers, statically configured servers always takes precedence
+    - Install routes, not only from option 3, but also options 121 and 249
+  - Support for ARP:ing for client lease (default enabled)
+  - Configurable route metrics, by default metric 100 to allow static routes
+    to win over DHCP routes, useful for backup DHCP connections
+- IETF Hardware data: added YANG model for vital product data representation,
+  and augments for initial USB support (enable/disable)
+- IETF System:
+  - the `motd` augment in `infix-system.yang` for *Message of the Day* has
+    been marked as obsolete and replaced with `motd-banner`.  The new setting
+    is of type *binary* and allows control codes and multi-line content to be
+    stored.  The legacy `motd` will remain for the foreseeable future and
+    takes precedence over the new `motd-banner` setting
+  - new `text-editor` augment in `infix-system.yang` to select the backend for
+    the new `text-editor` command: `emacs`, `nano`, or `vi`
+- Many updates to the test system, *Infamy*, incl. new Quick Start Guide in
+  updated `doc/testing.md` to help new developers get started
+- Add `htop` to default builds, useful for observing and attaching (strace)
+- Change the default shell of the `admin` user from `clish` to `bash`.  Change
+  required for factory production and provisioning reasons.  Only affects the
+  built-in default, customer specific `factory-config`'s are not affected!
+- CLI: the `set` command on a boolean can now be used without an argument,
+  `set boolean` sets the boolean option to true
+- CLI: new command `change`, for use with ietf-system user passwords, starts
+  an interactive password dialog, including confirmation entry.  The resulting
+  password is by default salted and hashed using sha512crypt
+- CLI: new command `text-editor`, for use with binary fields, e.g., `content`
+  for file mounts in containers, or the new `motd-banner`:
+
+        admin@infix-c0-ff-ee:/config/system/> text-editor motd-banner
+        ... exit with Ctrl-x Ctrl-c ...
+        admin@infix-c0-ff-ee:/config/system/> show
+        motd-banner VGhpcyByZWxlYXNlIHdhcyBzcG9uc29yZWQgYnkgQWRkaXZhIEVsZWt0cm9uaWsK;
+
+- CLI: new admin-exec command `show ntp [sources]`
+- CLI: new admin-exec command `show dns` to display DNS client status
+- CLI: new admin-exec command `show ospf [subcommand]`
+- CLI: new admin-exec command `show container [subcommand]`
+- CLI: new admin-exec command `show hardware` only USB port status for now
+- CLI: updates to the `show interfaces` command to better list bridge VLANs
+
+### Fixes
+
+- Fix #177: ensure bridge is not bridge port to itself
+- Fix #259: failure to `copy factory-config startup-config` in CLI
+- Fix #278: allow DHCP client to set system hostname (be careful)
+- Fix #283: hostname in DHCP request adds quotation marks
+- Fix #294: drop stray `v` from version suffix in release artifacts
+- Fix #298: drop privileges properly before launching user `shell` in CLI
+- Fix #312: race condition in `ipv4_autoconf.py`, causes test to block forever
+- Backport upstream fix to netopeer2-server for fetching YANG models that
+  refer to submodules over NETCONF
+- CLI: drop developer debug in `set` command
+- Fix out-of-place `[OK]` messages at shutdown/reboot
+- Fix garbled syslog messages due to unicode in Infix tagline, drop unicode
+
+
 [v23.11.0][] - 2023-11-30
 -------------------------

@@ -478,7 +696,9 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v23.10.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.02.0...HEAD
+[v24.02.0]:   https://github.com/kernelkit/infix/compare/v23.11.0...v24.02.0
+[v23.11.0]:   https://github.com/kernelkit/infix/compare/v23.10.0...v23.11.0
 [v23.10.0]:   https://github.com/kernelkit/infix/compare/v23.09.0...v23.10.0
 [v23.09.0]:   https://github.com/kernelkit/infix/compare/v23.08.0...v23.09.0
 [v23.08.0]:   https://github.com/kernelkit/infix/compare/v23.06.0...v23.08.0
@@ -44,6 +44,8 @@ In *configure context* the following commands are available:
 | `set foo bar val` | Set `bar` leaf node in `foo` subcontext to `val`       |
 | `no foo bar`      | Clear/delete configuration made to `bar` in `foo`      |
 | `edit foo baz`    | Enter `baz` sub-sub-context in `foo` subcontext        |
+| `change password` | Start password dialogue to change a user's password    |
+| `text-editor foo` | Open a text editor to edit binary setting `foo`        |
 | `abort`           | Abort changes in configuration, return to admin-exec   |
 | `exit`            | Exit one level sub-context, or abort from top-level    |
 | `leave`           | Save changes to `running-config`, return to admin-exec |
@@ -21,5 +21,9 @@ keybindings are really useful to learn!
 | `help introduction` | An introduction to the CLI                 |
 | `help keybindings`  | Lists keybindings and other helpful tricks |
 | `help tutorial`     | The CLI User Guide                         |
+| `help text-editor`  | Help with the built-in text-editor command |

+> In `configure` context the `help setting` command shows the YANG
+> description text for each node and container.  To reach the admin
+> exec help from configure context, e.g., `do help text-editor`

@@ -0,0 +1,70 @@
+# Text Editor
+
+The CLI built-in `text-editor` command can be used to edit type `binary`
+settings in configure context.
+
+The default editor is a Micro Emacs clone.  Users not familiar with
+terminal based editors may benefit from this introduction.
+
+
+## Escape Meta/Alt Control Shift
+
+When starting up, the editor status field at the bottom shows the
+following shorthand:
+
+```
+C-h q  quick help | C-h t  tutorial | C-h b  key bindings | C = Ctrl | M = Alt
+```
+
+Key combinations with a `-` (dash) mean holding down the modifier key.
+Combinations without a `-` (dash) mean without any modifier key.
+
+### Quick help `C-h q`
+
+  - hold down the `Ctrl` key on
+  - tap the `h` key
+  - release `Ctrl`
+  - tap the `q` key
+
+The bottom part of the terminal now shows a "buffer" called `*quick*`:
+
+```
+FILE              BUFFER           WINDOW            MARK/KILL        MISC
+C-x C-c exit      C-x b   switch   C-x 0 only other  C-space mark     C-_ undo
+C-x C-f find      C-x k   close    C-x 1 only this   C-w     kill-rg  C-s search
+C-x C-s save      C-x C-b list     C-x 2 split two   C-k     kill-ln  C-r r-search
+C-x s   save-all  C-x h   mark     C-x ^ enlarge     C-y     yank     M-% replace
+C-x i   insert    C-x g   goto-ln  C-x o other win   C-x C-x swap     M-q reformat
+```
+
+### Save & Exit `C-x C-c`
+
+  - Hold down the Ctrl key
+  - tap `X`
+  - tap `c`
+  - release `Ctrl`
+
+> The status field at the bottom asks if you are really sure, and/or if
+> you want to add a final Enter/newline to the file.  For binary content
+> that final newline may be important.
+
+
+## Changing the Editor
+
+The system has three different built-in editors: 
+
+ - `emacs` (Micro Emacs)
+ - `nano` (GNU Nano)
+ - `vi` (Visual Editor)
+
+Changing editor is done in configure context, in the system container:
+
+```
+admin@host:/> configure
+admin@host:/config/> edit system
+admin@host:/config/system/> set text-editor <TAB>
+emacs	nano	vi
+admin@host:/config/system/> set text-editor nano
+admin@host:/config/system/> leave
+admin@example:/> 
+```
@@ -1,12 +1,11 @@
 User Guide
 ==========

-The command line interface (CLI, see-ell-aye) is built on the open source
-component [klish][1], which implements a CISCO-like, or Juniper Networks
-JunOS-like, CLI for UNIX systems.
+The command line interface (CLI, see-ell-aye) implements a CISCO-like,
+or Juniper Networks JunOS-like, CLI for UNIX systems.

 New users always get the CLI as the default "shell" when logging in, but
-the default `admin` user logs in to the Bash.  To access the CLI, type:
+the default `admin` user logs in to `bash`.  To access the CLI, type:

    cli

@@ -104,6 +103,7 @@ the version we are currently running, intact in case of trouble.
    both partitions you must reboot to the new version (to verify it works)
    and then repeat the same command.

+
 Configure Context
 -----------------

@@ -113,21 +113,24 @@ followed by Enter.  Available commands, press `?` at the prompt:
 ```
 admin@host:/> configure
 admin@host:/config/>
-  abort     Abandon candidate
-  check     Validate candidate
-  commit    Commit current candidate to running-config
-  delete    Delete configuration setting(s)
-  diff      Summarize uncommitted changes
-  do        Execute operational mode command
-  edit      Descend to the specified configuration node
-  exit      Ascend to the parent configuration node, or abort (from top)
-  leave     Finalize candidate and apply to running-config
-  no        Alias for delete
-  rollback  Restore candidate to running-config
-  set       Set configuration setting
-  show      Show configuration
-  top       Ascend to the configuration root
-  up        Ascend to the parent configuration node
+  abort        Abandon candidate
+  change       Interactively change setting, e.g. password
+  check        Validate candidate
+  commit       Commit current candidate to running-config
+  delete       Delete configuration setting(s)
+  diff         Summarize uncommitted changes
+  do           Execute operational mode command
+  edit         Descend to the specified configuration node
+  end          Alias to up, leave this subsection/node
+  exit         Ascend to the parent configuration node, or abort (from top)
+  leave        Finalize candidate and apply to running-config
+  no           Alias for delete
+  rollback     Restore candidate to running-config
+  set          Set configuration setting
+  show         Show configuration
+  text-editor  Modify binary content in a text editor
+  top          Ascend to the configuration root
+  up           Ascend to the parent configuration node
 ```

 The `edit` command lets you change to a sub-configure context, e.g.:
@@ -235,23 +238,52 @@ is committed.
 User management, including passwords, is also a part of `ietf-system`.

 ```
-admin@host:/config/> edit system authentication
-admin@host:/config/system/authentication/> do password encrypt
-Password: ******
-$1$oVHGR0AP$6Pad1Pm8jPwPsan5WHULS1
-admin@host:/config/system/authentication/> set user admin password $1$oVHGR0AP$6Pad1Pm8jPwPsan5WHULS1
-admin@host:/config/system/> leave
+admin@host:/config/> edit system authentication user admin
+admin@host:/config/system/authentication/user/admin/> change password
+New password: 
+Retype password: 
+admin@host:/config/system/authentication/user/admin/> leave
 ```

-The call to `do password encrypt` brings up the helpful admin-exec
-command to hash, and optionally salt, your password.  This encrypted
-string is what goes into the system configuration.
+The `change password` command starts an interactive dialogue that asks
+for the new password, with a confirmation, and then salts and encrypts
+the password with sha512crypt. 
+
+It is also possible to use the `set password ...` command.  This allows
+setting an already hashed password.  To manually hash a password, use
+the `do password encrypt` command.  This launches the admin-exec command
+to hash, and optionally salt, your password.  This encrypted string can
+then be used with `set password ...`.

 > **Tip:** if you are having trouble thinking of a password, there is
 > also `do password generate`, which generates random but readable
 > strings using the UNIX command `pwgen`.


+### SSH Authorized Key
+
+Logging in remotely with SSH is possible by adding a *public key* to a
+user.  Here we add the authorized key to the admin user, multiple keys
+are supported.
+
+With SSH keys in place it is possible to disable password login, just
+remember to verify SSH login and network connectivity before doing so.
+
+```
+admin@host:/config/> edit system authentication user admin 
+admin@host:/config/system/authentication/user/admin/> edit authorized-key example@host
+admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> set algorithm ssh-rsa
+admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> set key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTTH8SKvAE4g8Rr97KOz/8PFtOObBrE9G21K7d6UBuPqmd0RUF2CkXXN/eN2PBSHJ50YprRFt/z/304bsBYkDdflKlPDjuSmZ/+OMp4pTsq0R0eNFlX9wcwxEzooIb7VPEdvWE7AYoBRUdf41u3KBHuvjGd1M6QYJtbFLQMMTiVe5IUfyVSZ1RCxEyAB9fR9CBhtVheTVsY3iG0fZc9eCEo89ErDgtGUTJK4Hxt5yCNwI88YaVmkE85cNtw8YwubWQL3/tGZHfbbQ0fynfB4kWNloyRHFr7E1kDxuX5+pbv26EqRdcOVGucNn7hnGU6C1+ejLWdBD7vgsoilFrEaBWF41elJEPKDzpszEijQ9gTrrWeYOQ+x++lvmOdssDu4KvGmj2K/MQTL2jJYrMJ7GDzsUu3XikChRL7zNfS2jYYQLzovboUCgqfPUsVba9hqeX3U67GsJo+hy5MG9RSry4+ucHs=
+admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> show
+algorithm ssh-rsa;
+key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTTH8SKvAE4g8Rr97KOz/8PFtOObBrE9G21K7d6UBuPqmd0RUF2CkXXN/eN2PBSHJ50YprRFt/z/304bsBYkDdflKlPDjuSmZ/+OMp4pTsq0R0eNFlX9wcwxEzooIb7VPEdvWE7AYoBRUdf41u3KBHuvjGd1M6QYJtbFLQMMTiVe5IUfyVSZ1RCxEyAB9fR9CBhtVheTVsY3iG0fZc9eCEo89ErDgtGUTJK4Hxt5yCNwI88YaVmkE85cNtw8YwubWQL3/tGZHfbbQ0fynfB4kWNloyRHFr7E1kDxuX5+pbv26EqRdcOVGucNn7hnGU6C1+ejLWdBD7vgsoilFrEaBWF41elJEPKDzpszEijQ9gTrrWeYOQ+x++lvmOdssDu4KvGmj2K/MQTL2jJYrMJ7GDzsUu3XikChRL7zNfS2jYYQLzovboUCgqfPUsVba9hqeX3U67GsJo+hy5MG9RSry4+ucHs=;
+admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> leave
+```
+
+> **Note:** the `ssh-keygen` program already base64 encodes the public
+> key data, so there is no need to use the `text-editor` command, `set`
+> does the job.
+
 ### Creating a VETH Pair

 The following example creates a `veth0a <--> veth0b` virtual Ethernet
@@ -2,302 +2,422 @@ Containers in Infix
 ===================

 * [Introduction](#introduction)
-* [Docker Containers with Podman](#docker-containers-with-podman)
-  * [Multiple Networks](#multiple-networks)
-  * [Hybrid Mode](#hybrid-mode)
-* [Enabling Container Support](#enabling-container-support)
-* [Debugging Containers](#debugging-containers)
+* [Caution](#caution)
+* [Getting Started](#getting-started)
+  * [Examples](#examples)
+* [Networking and Containers](#networking-and-containers)
+  * [Container Bridge](#container-bridge)
+  * [Container Host Interface](#container-host-interface)
+  * [Host Networking](#host-networking)
+* [Mounts and Volumes](#mounts-and-volumes)
+  * [Content Mounts](#content-mounts)
+* [Example Containers](#example-containers)
+  * [System Container](#system-container)
+  * [Application Container: nftables](#application-container--nftables)
+  * [Application Container: ntpd](#application-container--ntpd)
+* [Upgrading a Container Image](#upgradeing-a-container-image)


 Introduction
 ------------

-Default builds of Infix do not enable any container support.  See below
-section, [Enabling Container Support](#enabling-container-support), for
-details on how to enable it using Podman.
+Infix comes with native support for Docker containers using [podman][].
+The [YANG model][1] describes the current level of support, complete
+enough to run both system and application containers.

-Networking in containers is provided by both Infix and the Container
-Network Interface ([CNI](https://www.cni.dev/)) that Podman supports.
+Key design features, like using Linux switchdev, allow users to assign
+switch ports directly to containers, not just bridged VETH pairs, this
+is a rare and in many cases *unique* feature of Infix.

-> A convenience alias `docker=podman` is available in Infix, remember,
-> not all features or syntax of docker is available in podman.
+All network specific settings are done using the IETF interfaces YANG
+model, with augments for containers to ensure smooth integration with
+container networking in podman.
+
+> **Note:** even though the `podman` command can be used directly from a
+> shell prompt, we strongly recommend using the CLI commands instead.
+> They employ the services of a wrapper `container` script which handles
+> the integration of containers in the system.


-Docker Containers with Podman
-----------------------------
+Caution
+-------

-We assume you've booted into Infix and start with a familiar example.
-This downloads the `hello-world` example container image and runs it:
+A word of warning, containers can run on your system in privileged mode,
+as `root`.  This gives them full access to devices on your system.  But
+even when though unprivileged containers are fenced from the host with
+Linux namespaces, and resource limited using Linux cgroups, which scope
+container applications from seeing and accessing the complete system,
+there is no guarantee that an application cannot ever break out of this
+confinement.

-    podman run -it --rm docker://hello-world
+ - If the system is compromised, containers can be used to easily
+   install malicious software in your system and over the network
+ - Your system is as secure as anything you run in the container
+ - If you run containers, there is no security guarantee of any kind
+ - Running 3rd party container images on your system could open a
+   security hole/attack vector/attack surface
+ - An expert with knowledge how to build exploits will be able to
+   jailbreak/elevate to root even if best practices are followed

-We can also set up a port forward to a little web server:
+This being said, a system suspected of being compromised can always be
+restored to a safe state with a factory reset.  Provided, of course,
+that it has secure boot enabled.

-    podman run -d --rm -p 80:80 docker://nginx:alpine

-In detached (`-d`) state you can check the status using `podman ps` and
-try to connect to the web server:
+Getting Started
+---------------

-    curl http://localhost
+In the CLI, containers can be run in one of two ways:
+
+ 1. `container run IMAGE [COMMAND]`, and
+ 2. enter `configure` context, then `edit container NAME`
+
+The first is useful mostly for testing, or running single commands in an
+image.  It is a wrapper for `podman run -it --rm ...`, while the latter
+is a wrapper and adaptation of `podman create ...`.
+
+The second create a container with a semi-persistent writable layer that
+survives container restarts and host system restarts.  However, if you
+change the container configuration or upgrade the image (see below), the
+container will be recreated and the writable layer is lost.  This is why
+it is recommended to set up a named volume for directories, or use file
+[Content Mounts][], in your container you want truly persistent content.
+
+In fact, in many cases the best way is to create a `read-only` container
+and use file mounts and volumes only for the critical parts.  Podman
+ensures (using tmpfs) `read-only` containers still have writable
+directories for certain critical file system paths: `/dev`, `/dev/shm`,
+`/run`, `/tmp`, and `/var/tmp`.  Meaning, what you most often need is
+writable volumes for `/var/lib` and `/etc`, or only file mounts for a
+few files in `/etc`.  The actual needs depend on the container image and
+application to run.
+
+> **Note:** when running containers from public registries, double-check
+> that they support the CPU architecture of your host system.  Remember,
+> unlike virtualization, containers reuse the host's CPU and kernel.
+
+
+### Examples
+
+Classic Hello World:
+
+    admin@example-c0-ff-ee:/> container run docker://hello-world
+
+Persistent web server using nginx, sharing the host's network:
+
+    admin@example-c0-ff-ee:/> configure
+    admin@example-c0-ff-ee:/config> edit container web
+    admin@example-c0-ff-ee:/config/container/web> set image docker://nginx:alpine
+    admin@example-c0-ff-ee:/config/container/web> set publish 80:80
+    admin@example-c0-ff-ee:/config/container/web> set network host
+    admin@example-c0-ff-ee:/config/container/web> leave
+    admin@example-c0-ff-ee:/> show container
+
+Exit to the shell and verify the service with curl, or try to attach
+to your device's IP address using your browser:
+
+    admin@example-c0-ff-ee:~$ curl http://localhost

 or connect to port 80 of your running Infix system with a browser.  See
-the following sections for how to add more interfaces and start/stop the
-container at boot/reboot.
-
-> To add your own content to web server, place the HTML files in, e.g.,
-> `/cfg/www/*.html` and add `-v /cfg/www:/usr/share/nginx/html:ro` to
-> the command line (above).  <https://hub.docker.com/_/nginx/>
+the following sections for how to add more interfaces and manage your
+container at runtime.


-### Multiple Networks
+Networking and Containers
+-------------------------

-It is also possible to start a container with multiple networks.  The
-approach shown here uses CNI profiles, which means the interfaces names
-inside the container will always be: `eth0`, `eth1`, etc.
+By default, unlike other systems, persistent[^1] containers have no
+networking enabled.  All network access has to be set up explicitly.
+Currently two types of of container networks are supported:

-A common setup is to use a VETH pair, with one end in the container and
-the other end routed, or bridged, to the rest of the world.  The Infix
-[CLI Guide](cli/introduction.md) provides examples of both.  In either
-case you need to create a matching CNI profile for one end of the VETH
-pair before starting the container, here we use two network profiles,
-the default podman bridge and the VETH profile:
+ - `cni-host`: one end of a VETH pair, or a physical Ethernet port
+ - `cni-bridge`: an IP masquerading bridge

-     cni create host net1 veth0a 192.168.0.42/24
-     podman run -d --rm --net=podman,net1 --entrypoint "/linuxrc" \
-             --privileged docker://troglobit/buildroot:latest

-The first profile (`podman`) is a the default bridged profile.  When a
-container is started with that (default behavior), podman dynamically
-creates a VETH pair which has one end attached as a bridge port in the
-`cni-podman0` bridge managed by podman, and the other end is brought up
-as `eth0` inside the container.
+### CNI Bridge

-The second profile is the one we created, it uses the `host-device`
-profile and does not create anything, it simply lifts the peer end of
-the pair into the container as `eth1`.  This CNI profile can also be
-used to hand over control of physical ports to a container.
+All interface configuration is done in configure context.  Let's start
+by creating an IP masquerading bridge, a common default for containers:

-> **Note:** here we start the container in `--privileged` mode.  This
-> allows the container guest unfiltered access to the host system and it
-> might not be what you want for a production system.  For that at least
-> SECCOMP is recommended, which is out of scope for this tutorial.
+    admin@example-c0-ff-ee:/> configure
+    admin@example-c0-ff-ee:/config> edit interface docker0
+    admin@example-c0-ff-ee:/config/interface/docker0/> set type bridge
+    admin@example-c0-ff-ee:/config/interface/docker0/> set container-network type cni-bridge
+    admin@example-c0-ff-ee:/config/interface/docker0/> leave

-### Real Example
+We have to declare the interface type, and then also declare it as a
+container network, ensuring the interface cannot be used by the system
+for any other purpose.  E.g., a `cni-host` interface is supposed to be
+used by a container, by declaring it as such we can guarantee that it
+would never accidentally be added as a bridge or lag port.  Hence, to
+move an interface currently set as a `bridge-port` it must be removed
+from the bridge before being given to a container.

-To be able to preserve state in containers between reboots we need a
-writable layer, this is done with `podman create`, after which we can
-use `podman start`.   We build on the previous example:
+The default subnet for a `cni-bridge` is 172.17.0.0/16, the bridge will
+take the `.1` address and hand out the rest of the range to containers
+in a round-robin like fashion.  A container with this `network` get an
+automatically created VETH pair connection to the bridge and a lot of
+other networking parameters (DNS, default route) are set up.

-    cni create host net1 veth0a 192.168.0.42/24
-    podman create --name system --conmon-pidfile=/run/pod:system.pid \
-           --restart=no --systemd=false --tz=local --privileged      \
-           --net=podman,net1 --entrypoint "/linuxrc" -p 222:22       \
-           docker://troglobit/buildroot:latest
+Some of the defaults of a `cni-bridge` can be changed, e.g., instead of
+`set container-network type cni-bridge`, above, do:

-Here we map the host port 222 to the SSH port of the container, but one
-can just as easily map the host's port 22 (SSH).  Just make sure to
-first disable the host's SSH service.
+    admin@example-c0-ff-ee:/config/interface/docker0/> edit container-network
+    admin@example-c0-ff-ee:/config/interface/docker0/container-network/> set type cni-bridge
+    admin@example-c0-ff-ee:/config/interface/docker0/container-network/> edit subnet 192.168.0.0/16
+    admin@example-c0-ff-ee:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> set gateway 192.168.255.254
+    admin@example-c0-ff-ee:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> end
+    admin@example-c0-ff-ee:/config/interface/docker0/container-network/> edit route 10.0.10.0/24
+	admin@example-c0-ff-ee:/config/interface/docker0/container-network/route/10.0.10.0/24/> set gateway 192.168.10.254
+	admin@example-c0-ff-ee:/config/interface/docker0/container-network/route/10.0.10.0/24/> end
+	admin@example-c0-ff-ee:/config/interface/docker0/container-network/> end
+    admin@example-c0-ff-ee:/config/interface/docker0/> leave

-> **Note:** the new options used here are required for enabling
-> monitoring and automate start/stop of containers at boot/reboot.
+Other network settings, like DNS and domain, use built-in defaults in
+CNI, but can be overridden from each container.  Other common settings
+per container is the IP address and name of the network interface inside
+the container.  The default, after each stop/start cycle, or reboot of
+the host, is to name the interfaces `eth0`, `eth1`, in the order they
+are given in the `network` list, and to give the container the next
+address in a `cni-bridge`.  Below an example of a system container calls
+`set network interface docker0`, here we show how to set options for
+that network:

-This creates the named container `system` which we can now start:
-
-    podman start system
-
-and stop:
-
-    podman stop system
-
-For this particular image[^1] we need to modify its defaults a bit,
-because it is set up to run a DHCP client on the first Ethernet
-interface, which in our case is the `podman` default CNI bridge.  In
-fact, we don't want the container to set up any networking since that is
-handled by Infix and podman.
-
-    root@infix-12-34-56:~$ podman start system
-    root@infix-12-34-56:~$ podman exec -it system sh
-    / # rm -rf /etc/network/interfaces
-    / # exit
-    root@infix-12-34-56:~$ podman stop system
-
-The change is now saved in the writable layer and the next time the
-container is started it will look like this:
-
-    root@infix-12-34-56:~$ podman start system
-    root@infix-12-34-56:~$ podman exec -it system sh
-    / # ifconfig
-    eth0      Link encap:Ethernet  HWaddr A2:32:4C:2B:5E:51
-              inet addr:10.88.0.11  Bcast:10.88.255.255  Mask:255.255.0.0
-              inet6 addr: fe80::a032:4cff:fe2b:5e51/64 Scope:Link
-              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
-              RX packets:204 errors:0 dropped:107 overruns:0 frame:0
-              TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
-              collisions:0 txqueuelen:0
-              RX bytes:48240 (47.1 KiB)  TX bytes:1102 (1.0 KiB)
+    admin@example-c0-ff-ee:/config/container/ntpd/> edit network docker0 
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> 
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> set option 
+    <string>  Options for CNI bridges.
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> help option 
+    NAME
+            option <string>
    
-    eth1      Link encap:Ethernet  HWaddr 56:B5:4E:D1:9C:E5
-              inet addr:192.168.0.42  Bcast:192.168.0.255  Mask:255.255.255.0
-              inet6 addr: fe80::54b5:4eff:fed1:9ce5/64 Scope:Link
-              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
-              RX packets:274 errors:0 dropped:213 overruns:0 frame:0
-              TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
-              collisions:0 txqueuelen:1000
-              RX bytes:60926 (59.4 KiB)  TX bytes:1377 (1.3 KiB)
-
-Automating start/stop at boot/reboot is documented in the next section.
-
-[^1]: A common task one has to do for many other standard images, e.g.,
-    Alpine Linux and BusyBox available on Docker Hub.
-
-### Hybrid Mode
-
-Since container setup and configuration is not modeled in YANG yet, we
-use the Infix *Hybrid mode*, described in [Infix Variants](variant.md).
-
-To start containers in *Hybrid Mode*, provided the images have been
-downloaded with `podman pull docker://troglobit/buildroot:latest` and
-a container created (above):
-
-```
-root@infix:/cfg/start.d$ cat <<HERE >20-enable-container.sh
-#!/bin/sh
-# Remember to create the veth0a <--> vet0b pair in the CLI first!
-cni create host net1 veth0a 192.168.0.42/24
-cat <<EOF > /etc/finit.d/available/pod:system.conf
-service name:pod :system pid:!/run/pod:system.pid podman --syslog start system -- System container
-EOF
-initctl enable pod:system
-exit 0
-HERE
-root@infix:/cfg/start.d$ chmod +x 20-enable-container.sh
-```
-
-Reboot to activate the changes.  To activate the changes without
-rebooting, run the script and call `initctl reload`.
-
-> **Note:** the `/etc` directory is a `tmpfs` ramdisk and contents will
-> be lost on reboot, so to retain custom CNI profiles after reboot you
-> need to either save them and restore in the script above, or recreate
-> them on every boot.
+    DESCRIPTION
+            Options for CNI bridges.
+            Example: ip=1.2.3.4 to request a specific IP, both IPv4 and IPv6.
+            interface_name=foo0 name to set interface name inside container.
+    
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> set option ip=172.17.0.2
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> set option interface_name=wan
+    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> leave


-Enabling Container Support
--------------------------
+### CNI Host

-Container support is not enabled by default because it is not a common
-customer feature, it also prolongs build times a lot due to bringing in
-a build-time dependency on Go.
+Another common use-case is to move a network interface into the network
+namespace of a container.  Which the CNI bridge network does behind the
+scenes with one end of the automatically created VETH pair.  This works
+with regular Ethernet interfaces as well, but here we will use a VETH
+pair as an example along with a regular bridge (where other Ethernet
+interfaces may live as well).

-However, customer specific builds may have it, and you can also roll
-your own based on any of the available `defconfigs`.  For example:
+    admin@example-c0-ff-ee:/config/> edit interface veth0
+    admin@example-c0-ff-ee:/config/interface/veth0/> set veth peer ntpd
+    admin@example-c0-ff-ee:/config/interface/veth0/> set ipv4 address 192.168.0.1 prefix-length 24
+    admin@example-c0-ff-ee:/config/interface/veth0/> end
+    admin@example-c0-ff-ee:/config/> edit interface ntpd
+    admin@example-c0-ff-ee:/config/interface/ntpd/> set ipv4 address 192.168.0.2 prefix-length 24
+    admin@example-c0-ff-ee:/config/interface/ntpd/> set container-network

-    cd infix/
-    make x86_64_defconfig
-
-Run menuconfig, search for `podman` using `/`, enable it and build:
-
-	make menuconfig
-	...
-	make
-
-Enabling [podman][] select `crun`, `conmon`, and all other dependencies.
-The build will take a while, but eventually you can:
-
-    make run
+This is a routed setup, where we reserve 192.168.0.0/24 for the network
+between the host and the `ntpd` container.  A perhaps more common case
+is to put `veth0` as a port in a bridge with other physical ports.  The
+point of the routed case is that port forwarding from the container in
+this case is limited to a single interface, not *all interfaces* as is
+the default in the CNI Bridge setup.


-Debugging Containers
--------------------
+### Host Networking

-If the host system is not powered down or rebooted properly, containers
-may not start up as they should on the following boot.  Below is a very
-common problem and solution shown.
+The third use-case is host networking, this is where a container share
+the network namespace of the host.  An example here could be a nftables
+or ntpd container -- single applications which add core functionality to
+the host operating system.

-```
-root@infix-12-34-56:~$ podman ps
-CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
-root@infix-12-34-56:~$ grep nginx /var/log/syslog
-Jun 25 10:15:48 infix-12-34-56 finit[1]: Service pod:nginx[2376] died, restarting in 5000 msec (10/10)
-Jun 25 10:15:48 infix-12-34-56 finit[1]: Starting pod:nginx[2408]
-Jun 25 10:15:53 infix-12-34-56 finit[1]: Service pod:nginx keeps crashing, not restarting.
-```
+The host networking setup cannot be combined with any other network.

-If this the system is isolated from remote network access, start by
-verifying the image is downloaded:
-
-```
-root@infix-12-34-56:/cfg/start.d$ podman images
-REPOSITORY                     TAG         IMAGE ID      CREATED      SIZE
-docker.io/library/nginx        alpine      4937520ae206  10 days ago  43.2 MB
-docker.io/troglobit/buildroot  latest      68faf6b20f1a  6 weeks ago  41.4 MB
-```
-
-OK, let's see what the `podman-service` step (above) created:
-
-```
-root@infix-12-34-56:/cfg/start.d$ initctl show pod-nginx.conf
-service name:pod :nginx podman run --name nginx --rm  -p 80:80 nginx:alpine   -- Nginx container
-```
-
-Try starting the container manually.  Remember to add the `-d` flag to
-emulate detached/background operation:
-
-```
-root@infix-12-34-56:/cfg/start.d$ podman run --name nginx --rm -d -p 8080:80 nginx:alpine
-Error: creating container storage: the container name "nginx" is already in use by 9c73bd8d505b1585d241595bfadede361b87f6c1be9a5656253b5a4d73da57e0. You have to remove that container to be able to reuse that name: that name is already in use
-```
-
-Aha, a lingering image with the same name!  Where is it?
-
-```
-root@infix-12-34-56:/cfg/start.d$ podman ps --all
-CONTAINER ID  IMAGE                                 COMMAND               CREATED            STATUS                        PORTS               NAMES
-f3386ae9517f  docker.io/troglobit/buildroot:latest                        About an hour ago  Exited (0) About an hour ago                      ecstatic_panini
-bf0c6178ea26  docker.io/troglobit/buildroot:latest                        About an hour ago  Exited (0) About an hour ago                      determined_brown
-385155f479c0  docker.io/troglobit/buildroot:latest                        About an hour ago  Exited (0) About an hour ago                      vibrant_engelbart
-99a1b3319d9e  docker.io/troglobit/buildroot:latest                        About an hour ago  Exited (0) About an hour ago                      dreamy_tesla
-9c73bd8d505b  docker.io/library/nginx:alpine        nginx -g daemon o...  11 minutes ago     Created                       0.0.0.0:80->80/tcp  nginx
-8a5290504ebc  docker.io/troglobit/buildroot:latest                        10 minutes ago     Created                                           mystifying_liskov
-```
-
-Oh, we have two lingering containers that were created but did not stop
-correctly.  Let's remove them:
-
-```
-root@infix-12-34-56:/cfg/start.d$ docker rm -f 9c73bd8d505b
-9c73bd8d505b
-root@infix-12-34-56:/cfg/start.d$ docker rm -f 8a5290504ebc
-8a5290504ebc
-```
-
-Now we can manually restart the (supervised) container:
-
-```
-root@infix-12-34-56:/cfg/start.d$ initctl restart pod:nginx
-root@infix-12-34-56:/cfg/start.d$ initctl status pod:nginx
-     Status : running
-   Identity : pod:nginx
-Description : Nginx container
-     Origin : /etc/finit.d/enabled/pod-nginx.conf
-    Command : podman run --name nginx --rm -p 80:80 nginx:alpine
-   PID file : none
-        PID : 2669
-       User : root
-      Group : root
-     Uptime : 15 sec
-   Restarts : 11 (0/10)
-  Runlevels : [---234-----]
-     Memory : 63.8M
-     CGroup : /system/pod-nginx cpu 0 [100, max] mem [0, max]
-              ├─ 2669 podman run --name nginx --rm -p 80:80 nginx:alpine
-              └─ 2816 conmon --api-version 1 -c 44d24aa7e98b67ff811596984462b902af3b09a04b4f9bef86e11d246b8cc2ff -u 44d24aa7e98b67ff8
-
-Jun 25 10:15:48 infix-12-34-56 finit[1]: Service pod:nginx[2376] died, restarting in 5000 msec (10/10)
-Jun 25 10:15:48 infix-12-34-56 finit[1]: Starting pod:nginx[2408]
-Jun 25 10:15:53 infix-12-34-56 finit[1]: Service pod:nginx keeps crashing, not restarting.
-Jun 25 10:47:55 infix-12-34-56 finit[1]: Starting pod:nginx[2669]
-```
+For an example, see below.


+Mounts and Volumes
+------------------
+
+It is possible to mount files, directories, and even files matching a
+glob, into a container.  This gives precise control over the container's
+file system:
+
+    admin@example-c0-ff-ee:/config/container/system/> edit mount leds
+    admin@example-c0-ff-ee:/config/container/system/mount/leds> set source /sys/class/leds
+    admin@example-c0-ff-ee:/config/container/system/mount/leds> set target /sys/class/leds
+    admin@example-c0-ff-ee:/config/container/system/mount/leds> end
+    admin@example-c0-ff-ee:/config/container/system/>
+
+Sometimes *volumes* are a better fit.  A volume is an automatically
+created read-writable entity that follows the life of your container.
+
+    admin@example-c0-ff-ee:/config/container/ntpd/> set volume varlib target /var/lib
+
+Volumes survive reboots and upgrading of the base image, unlike the
+persistent writable layer you get by default, which does not survive
+upgrades.  The volume is created by podman when the container first
+starts up, unlike a regular bind mount it synchronizes with the contents
+of the underlying container image's path on the first start.  I.e.,
+"bind-mount, if empty: then rsync".
+
+> Infix support named volumes (only), and it is not possible to share a
+> volume between containers.  All the tricks possible with volumes may
+> be added in a later release.
+
+### Content Mounts
+
+Content mount is a special type of where the file contents for the
+container is stored alongside the container configuration.  This can be
+very useful when deploying similar systems at multiple sites.  When the
+host loads its `startup-config` (or even `factory-config`) a temporary
+file is created using the decoded base64 data from the `content` node.
+
+    admin@example-c0-ff-ee:/config/container/ntpd/> edit mount ntpd.conf
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntpd.conf> set content
+    ... interactive editor starts up ...
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntpd.conf> set target /etc/ntpd.conf
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntpd.conf> end
+    admin@example-c0-ff-ee:/config/container/ntpd/>
+
+The editor is a small [Emacs clone called Mg][2], see the built-in help
+text, or press Ctrl-x Ctrl-c to exit and save.  When the editor exits
+the contents are base64 encoded and stored in the candidate datastore.
+
+> **Note:** since these files are always recreated when the host is
+> restarted, changes made by the container are not preserved, or saved
+> back to the host's startup-config even if the read-only option is off.
+
+
+Example Containers
+------------------
+
+### System Container
+
+Let's try out what we've learned by setting up a system container, a
+container providing multiple services, using the `docker0` interface
+we created previously:
+
+    admin@example-c0-ff-ee:/> configure
+    admin@example-c0-ff-ee:/config> edit container system
+    admin@example-c0-ff-ee:/config/container/system/> set image ghcr.io/kernelkit/curios:edge
+    admin@example-c0-ff-ee:/config/container/system/> set network interface docker0
+    admin@example-c0-ff-ee:/config/container/system/> set publish 222:22
+    admin@example-c0-ff-ee:/config/container/system/> leave
+
+> **Note:** ensure you have a network connection to the registry.
+> If the image cannot be pulled, creation of the container will be
+> put in a queue and be retried every time there is a change in the
+> routing table, e.g., default route is added.
+
+Provided the image is downloaded successfully, a new `system` container
+now runs behind the docker0 interface, forwarding container port 22 to
+port 222 on all of the host's interfaces.  (See `help publish` in the
+container configuration context for the full syntax.)
+
+Available containers can be accessed from admin-exec:
+
+    admin@example-c0-ff-ee:/> show container
+    CONTAINER ID  IMAGE                          COMMAND     CREATED       STATUS       PORTS                 NAMES
+    439af2917b44  ghcr.io/kernelkit/curios:edge              41 hours ago  Up 16 hours  0.0.0.0:222->222/tcp  system
+
+This is a system container, so you can "attach" to it by starting a
+shell (or logging in with SSH):
+
+    admin@example-c0-ff-ee:/> container shell system
+    root@439af2917b44:/#
+
+Notice how the hostname inside the container changes.  By default the
+container ID (hash) is used, but this can be easily changed:
+
+    root@439af2917b44:/# exit
+    admin@infix-00-00-00:/> configure
+    admin@infix-00-00-00:/config/> edit container system
+    admin@infix-00-00-00:/config/container/system/> set hostname sys101
+    admin@infix-00-00-00:/config/container/system/> leave
+    admin@infix-00-00-00:/> container shell system
+    root@sys101:/#
+
+[^1]: this does not apply to the admin-exec command `container run`.
+    This command is intended to be used for testing and evaluating
+	container images.  Such containers are given a private network
+	behind an IP masquerading bridge.
+
+
+### Application Container: nftables
+
+Infix currently does not have a native firewall configuration, and even
+when it does it will never expose the full capabilities of `nftables`.
+For really advanced setups, the following will be the only alternative:
+
+    admin@example-c0-ff-ee:/> configure
+    admin@example-c0-ff-ee:/config> edit container nftables
+    admin@example-c0-ff-ee:/config/container/system/> set image ghcr.io/kernelkit/curios-nftables:edge
+    admin@example-c0-ff-ee:/config/container/system/> set network host
+    admin@example-c0-ff-ee:/config/container/system/> edit mount nftables.conf
+    admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> set target /etc/nftables.conf
+    admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> set content
+    ... interactive editor starts up where you can paste your rules ...
+    admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> leave
+
+
+### Application Container: ntpd
+
+The default NTP server/client in Infix is Chrony, a fully working and
+capable workhorse for most use-cases.  However, it does not support a
+feature like multicasting, for that you need ISC ntpd.
+
+As we did with `nftables`, previously, we can use host networking and
+set up a read-only config file that is bind-mounted into the container's
+file system and store in the host's `startup-config`.  However, `ntpd`
+also saves clock drift information in `/var/lib/ntpd`, so we will also
+use volumes in this example.
+
+    admin@example-c0-ff-ee:/> configure
+    admin@example-c0-ff-ee:/config> edit container ntpd
+    admin@example-c0-ff-ee:/config/container/ntpd/> set image ghcr.io/kernelkit/curios-ntpd:edge
+    admin@example-c0-ff-ee:/config/container/ntpd/> set network interface ntpd    # From veth0 above
+    admin@example-c0-ff-ee:/config/container/ntpd/> edit mount ntp.conf
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntp.conf/> set target /etc/ntp.conf
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntp.conf/> set content
+    ... interactive editor starts up where you can paste your rules ...
+    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntp.conf/> end
+    admin@example-c0-ff-ee:/config/container/ntpd/> edit volume varlib
+    admin@example-c0-ff-ee:/config/container/ntpd/volume/varlib/> set target /var/lib
+    admin@example-c0-ff-ee:/config/container/ntpd/volume/varlib/> leave
+    admin@example-c0-ff-ee:/> copy running-config startup-config
+
+The `ntp.conf` file is stored in the host's `startup-config` and any
+state data in the container's `/var/lib` is retained between reboots
+and across image upgrades.
+
+
+Upgrading a Container Image
+---------------------------
+
+All container configurations are locked to the image hash at the time of
+first download, not just ones that use an `:edge` or `:latest` tag.  An
+upgrade of containers using versioned images is more obvious -- update
+the configuration -- but the latter is a bit trickier.  Either remove
+the configuration and recreate it (leave/apply the changes between), or
+use the admin-exec level command:
+
+    admin@example-c0-ff-ee:/> container upgrade NAME
+
+Where `NAME` is the name of your container.  This command stops your
+container, does a `container pull IMAGE`, and then recreates the
+container with the new image.  Upgraded containers are not automatically
+restarted.
+
+    admin@example-c0-ff-ee:/> container start NAME
+
+> **Note:** the default writable layer is lost when upgrading the image
+> Use named volumes for directories with writable content you wish to
+> keep over an upgrade.
+
+
+[1]:      https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-containers%402023-12-14.yang
+[2]:      https://github.com/troglobit/mg
 [podman]: https://podman.io
@@ -0,0 +1,51 @@
+# Hardware information and status
+
+The hardware infomation and status is handled by the YANG model [IETF hardware][ietf-hardware].
+with deviations and augmentations in _infix-hardware_.
+
+## USB Ports
+For infix to be able to control the USB port(s), a device tree modification is needed (see _alder.dtsi_ for full example).
+```
+ chosen {
+   infix {
+     usb-ports = <&cp0_usb3_1>;
+	 usb-port-names = "USB";
+   };
+ };
+```
+Two USB ports are also exposed in QEMU for test purpose.
+
+All USB ports in the system will be disabled during boot due to the file _board/common/rootfs/etc/modprobe.d/usbcore.conf_.
+If you not want Infix to controll the USB port(s), remove the file or manually enable the USB bus, here is an example:
+
+```
+ # Enable the bus
+ echo 1 > /sys/bus/usb/devices/usb1/authorized
+```
+And then enable sub-devices (e.g. USB memory)
+```
+ # Enable a device plugged into usb1
+ echo 1 >  /sys/bus/usb/devices/usb1/1-1/authorized
+```
+
+### Current status
+```
+ admin@example:/> show hardware
+ USB PORTS
+ NAME                STATE
+ USB                 unlocked
+```
+An USB port can be in two states _unlocked_ and _locked_. When a port is locked,
+all connected devices will get power, but never authorized by Linux to use.
+
+### Configure USB port
+> **Note:** You can only configure an USB ports that exist in _show hardware_ in admin exec.
+
+```
+ root@example:/> configure
+ root@example:/config/> set hardware component USB state admin-state unlocked
+ root@example:/config/> leave
+ root@example:/>
+```
+
+[ietf-hardware]:         https://www.rfc-editor.org/rfc/rfc8348.html
@@ -122,7 +122,33 @@ Multiple address assignment methods are available:
 | link-local | infix-ip          | Auto-assignment of IPv4 address in 169.254.x.x/16 range        |
 | dhcp       | infix-dhcp-client | Assignment of IPv4 address by DHCP server, e.g., *10.0.1.1/24* |

-DHCP address method is only available for *LAN* interfaces (ethernet, virtual ethernet (veth), bridge, etc.)
+Supported DHCP (request) options, configurability (Cfg) and defaults,
+are listed below.  Configurable options can be disabled on a per client
+interface basis, some options, like `clientid` and option 81, are
+possible to set the value of as well.
+
+| **Opt** | **Name**         | **Cfg** | **Description**                                     |
+|---------|------------------|---------|-----------------------------------------------------|
+| 1       | `subnet`         | No      | Request IP address and netmask                      |
+| 3       | `router`         | Yes     | Default route(s), see also option 121 and 249       |
+| 6       | `dns`            | Yes     | DNS server(s), static ones take precedence          |
+| 12      | `hostname`       | Yes     | DHCP cannot set hostname, only for informing server |
+| 15      | `domain`         | Yes     | Default domain name, for name resolution            |
+| 28      | `broadcast`      | Yes     | Broadcast address, calculated if disabled           |
+| 42      | `ntpsrv`         | Yes     | NTP server(s), static ones take precedence          |
+| 50      | `address`        | Yes     | Request (previously cached) address                 |
+| 61      | `clientid`       | Yes     | Default MAC address (and option 12)                 |
+| 81      | `fqdn`           | Yes     | Similar to option 12, request FQDN update in DNS    |
+| 119     | `search`         | Yes     | Request domain search list                          |
+| 121     | `staticroutes`   | Yes     | Classless static routes                             |
+| 249     | `msstaticroutes` | Yes     | Microsoft static route                              |
+|         |                  |         |                                                     |
+
+**Default:** `router`, `dns`, `domain`, `broadcast`, `ntpsrv`, `search`,
+             `address`, `staticroutes`, `msstaticroutes`
+
+> **Note:** DHCP address method is only available for *LAN* interfaces
+> (Ethernet, virtual Ethernet (veth), bridge, link aggregates, etc.)

 ### IPv6 Address Assignment

@@ -327,14 +353,47 @@ possible to specify use of a random identifier ([ietf-ip][ietf-ip-yang] YANG and
 Both the link-local address (fe80::) and the global address (2001:)
 have changed type to *random*. 

+### IPv4 forwarding
+To be able to route (static or dynamic) on the interface it is
+required to enable forwarding. This setting controlls if packets
+received on this interface can be forwarded.
+   ```
+   admin@example:/config/> edit interface eth0
+   admin@example:/config/interface/eth0/> set ipv4 forwarding
+   admin@example:/config/interface/eth0/> leave
+   admin@example:/>
+   ```
+
+### IPv6 forwarding
+This flag behaves totally different than for IPv4. For IPv6 the
+ability to route between interfaces is always enabled, instead this
+flag controls if the interface will be in host/router mode.
+
+| **Feature**                               | **Forward enabled** | **Forward disabled** |
+|:------------------------------------------|:--------------------|:---------------------|
+| IsRouter set in Neighbour Advertisements. | Yes                 | No                   |
+| Transmit Router Solicitations.            | No                  | Yes                  |
+| Router Advertisements are ignored         | No                  | Yes                  |
+| Accept Redirects                          | No                  | Yes                  |
+
+   ```
+   admin@example:/config/> edit interface eth0
+   admin@example:/config/interface/eth0/> set ipv6 forwarding
+   admin@example:/config/interface/eth0/> leave
+   admin@example:/>
+   ```
 ## Routing support

-| **Yang Model**            | **Description**                                           |
-|:--------------------------|:----------------------------------------------------------|
-| ietf-routing              | Base routing model, required for all other routing models |
-| ietf-ipv4-unicast-routing | Static IPv4 unicast routing                               |
+| **Yang Model**            | **Description**                                                                       |
+|:--------------------------|:--------------------------------------------------------------------------------------|
+| ietf-routing              | Base model, used to set configuration and read operational status in the other models |
+| ietf-ipv4-unicast-routing | Static IPv4 unicast routing                                                           |
+| ietf-ipv6-unicast-routing | Static IPv6 unicast routing                                                           |
+| ietf-ospf                 | OSPF routing                                                                          |
+| infix-routing             | Infix deviations                                                                      |

-### Static routes
+### IPv4 Static routes
+Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the interfaces.

    admin@example:/> configure
    admin@example:/config/> edit routing control-plane-protocol static name default
@@ -345,15 +404,121 @@ have changed type to *random*.
 > **Note:** The only name allowed for a control-plane-protocol is currently
 > *default*.  Meaning, you can only have one instance per routing protocol.

-### View IPv4 routing table

+### IPv6 Static routes
+
+    admin@example:/> configure
+    admin@example:/config/> edit routing control-plane-protocol static name default
+    admin@example:/config/routing/control-plane-protocol/static/name/default/> set ipv6 route 2001:db8:3c4d:200::/64 next-hop next-hop-address 2001:db8:3c4d:1::1
+    admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
+    admin@example:/>
+
+> **Note:** The only name allowed for a control-plane-protocol is currently
+> *default*.  Meaning, you can only have one instance per routing protocol.
+
+### OSPFv2 Routing
+Infix supports OSPF dynamic routing for IPv4, i.e., OSPFv2.
+Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the
+interfaces you want to run OSPFv2. 
+
+    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.0 interface e0 enabled true
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
+    admin@example:/>
+
+> **Note:** The only instance name allowed for a
+> control-plane-protocol is currently *default*.  Meaning, you can
+> only have one instance per routing protocol.
+
+#### OSPF area types
+In addition to *regular* OSPF areas, area types *NSSA* and *Stub* are supported.
+
+To configure a NSSA area with summary routes:
+
+    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.1 area-type nssa-area
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.1 summary true
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
+    admin@example:/>
+
+#### Bidirectional Forwarding Detection (BFD)
+It is possible to enable BFD per interface to speed up detection of
+link loss.
+
+    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set area 0.0.0.0 interface e0 bfd enabled true
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
+    admin@example:/>
+
+#### OSPF interface settings
+
+We have already seen how to enable OSPF per interface (*enabled true*)
+and BFD for OSPF per interface (*bfd enabled true*). These and other
+OSPF interface settings are done in context of an OSFP area, e.g.,
+*area 0.0.0.0*. Available commands can be listed using the `?` mark.
+
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> edit ospf area 0.0.0.0
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/> edit interface e0 
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set ? 
+      bfd                  BFD interface configuration.
+      cost                 Interface's cost.
+      dead-interval        Interval after which a neighbor is declared down
+      enabled              Enables/disables the OSPF protocol on the interface.
+      hello-interval       Interval between Hello packets (seconds).  It must
+      interface-type       Interface type.
+      passive              Enables/disables a passive interface.  A passive
+      retransmit-interval  Interval between retransmitting unacknowledged Link
+      transmit-delay       Estimated time needed to transmit Link State Update
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set
+
+For example, setting the OSPF *interface type* to *point-to-point* for
+an Ethernet interface can be done as follows.
+
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set interface-type point-to-point 
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/>
+
+
+#### Debug OSPFv2
+Using NETCONF and the YANG model *ietf-routing* it is possible to read the OSPF routing table, neighbors
+and more, that may be useful for debugging the OSPFv2 setup. The CLI
+has various OSPF status commands such as `show ospf neighbor`, `show
+ospf interface` and `show ospf routes`.
+
+    admin@example:/> show ospf neighbor 
+
+    Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXmtL RqstL DBsmL
+    10.1.1.2          1 Full/-          3h46m59s          30.177s 10.1.1.2        e0:10.1.1.1                          0     0     0
+    10.1.1.3          1 Full/-          3h46m55s          34.665s 10.1.1.3        e1:10.1.1.1                          0     0     0
+
+    admin@example:/>
+
+
+### View routing table
 The routing table can be viewed from the operational datastore over
 NETCONF or using the CLI:

-    admin@example:/> show routes
-    PREFIX                        NEXT-HOP                      METRIC    PROTOCOL
-    192.168.1.0/24                e0                                      kernel
-    192.168.200.0/24              192.168.1.1                   20        static
+#### IPv4 routing table
+
+    admin@example:/> show routes ipv4
+    PREFIX                        NEXT-HOP                      PREF  PROTOCOL
+    192.168.1.0/24                e0                                  kernel
+    192.168.200.0/24              192.168.1.1                     20  static
+    admin@example:/>
+
+#### IPv6 routing table
+
+    admin@example:/> show routes ipv6
+    PREFIX                        NEXT-HOP                      PREF  PROTOCOL
+    2001:db8:3c4d:50::/64         eth4                           256  kernel
+    fe80::/64                     eth5                           256  kernel
+    fe80::/64                     eth3                           256  kernel
+    fe80::/64                     eth1                           256  kernel
+    fe80::/64                     eth0                           256  kernel
+    fe80::/64                     eth2                           256  kernel
+    fe80::/64                     eth4                           256  kernel
+    admin@example:/>
+
+#### Source protocol

 The source protocol describes the origin of the route.

@@ -362,6 +527,7 @@ The source protocol describes the origin of the route.
 | kernel       | Added when setting a subnet address on an interface                  |
 | static       | User created static routes                                           |
 | dhcp         | Routes retrieved from DHCP                                           |
+| ospf         | Routes retreived from OSPFv2                                         |

 The YANG model *ietf-routing* support multiple ribs but only two are
 currently supported, namely `ipv4` and `ipv6`.
@@ -11,11 +11,18 @@ traffic at various points.
 TL;DR
 -----

-    make x86_64_defconfig
-    make
-    make test-qeneth
+Build Infix and run the test suite on a set of virtual Infix nodes.

-Runs the test suite on a set of virtual Infix nodes.
+    $ make x86_64_defconfig
+    $ make
+    $ make test
+
+To run a subset of tests, e.g., only the DHCP client tests:
+
+    $ make test INFIX_TESTS=case/infix_dhcp/all.yaml
+
+> **Note:** see the below section [Quick Start Guide][] for how to
+> connect to the test system, debug and develop tests, and more.


 Tenets
@@ -121,15 +128,17 @@ against an Infix image started from `make run`. When the instance is
 running, you can open a separate terminal and run `make test-run`, to
 run the subset of the test suite that can be mapped to it.

-Both `test-qeneth` and `test-run` targets have a respective target
-with a `-sh` suffix.  These can be used to start an interactive
-session in the reproducible environment, which is usually much easier
-to work with during a debugging session.
+Both `make test` and `make test-run` targets have a respective target
+with a `-sh` suffix.  These can be used to start an interactive session
+in the reproducible environment, which is usually much easier to work
+with during a debugging session.

-Inside of the reproducible environment, a wrapper for Qeneth is
-automatically created that will run it from the running network's
-directory.  E.g., running a plain `qeneth status` inside a `make
-test-qeneth-sh` environment will show the expected status information.
+Inside the reproducible environment, a wrapper for Qeneth is created for
+the running network's directory.  E.g., calling `qeneth status` inside a
+`make test-sh` environment show the expected status information.
+
+> **Note:** for more information and help writing a test, see the below
+> [Quick Start Guide][].


 Physical and Logical Topologies
@@ -274,6 +283,133 @@ it offline, enable STP on all DUTs, and then verify that the resulting
 spanning tree matches the expected one.


+Quick Start Guide
+-----------------
+
+When developing a test, instead of blindly coding in Python and running
+`make test` over and over, start a test shell:
+
+    $ make test-sh
+    Info: Generating topology
+    Info: Generating node YAML
+    Info: Generating executables
+    Info: Launching dut1
+    Info: Launching dut2
+    Info: Launching dut3
+    Info: Launching dut4
+    11:42:52 infamy0:test #
+
+It takes a little while to start up, but then we have a shell prompt
+inside the container running Infamy.  It's a very limited environment,
+but it has enough to easily run single tests, connect to the virtual
+devices, and *step* your code.  Let's run a test:
+
+    11:42:53 infamy0:test # ./case/infix_dhcp/dhcp_basic.py
+
+### Connecting to Infamy
+
+The test system runs in a Docker container, so to get a shell prompt in
+*another terminal* you need to connect to that container.  Infamy comes
+with a helper script for this:
+
+    $ ./test/shell
+
+By default it connect to the latest started Infamy instance.  If you for
+some reason run multiple instances of Infamy the `shell` script takes an
+optional argument "system", which is the hostname of the container you
+want to connect to:
+
+    $ ./test/shell infamy2
+
+### Connecting to a DUT
+
+All DUTs in a virtual Infamy topology are emulated in Qemu instances
+managed by qeneth.  If you want to watch what's happening on one of the
+target systems, e.g., tail a log file or run `tcpdump` during the test,
+there is another helper script in Infamy for this:
+
+    $ ./test/console 1
+    Trying 127.0.0.1...
+    Connected to 127.0.0.1.
+    
+    Infix -- a Network Operating System v23.11.0-226-g0c144da (console)
+    infix-00-00-00 login: admin
+    Password:
+    .-------.
+    |  . .  | Infix -- a Network Operating System
+    |-. v .-| https://kernelkit.github.io
+    '-'---'-'
+    
+    Run the command 'cli' for interactive OAM
+    
+    admin@infix-00-00-00:~$
+
+From here we can observe `dut1` freely while running tests.
+
+> The `console` script uses `telnet` to connect to a port forwarded to
+> `localhost` by the Docker container.  To exit Telnet, use Ctrl-] and
+> then 'q' followed by enter.  This can be customized in `~/.telnetrc`
+
+Like the `shell` script, `console` takes an optional "system" argument
+in case you run multiple instances of Infamy:
+
+    $ ./test/console 1 infamy2
+
+You can also connect to the console of a DUT from within a `shell`:
+
+    $ ./test/shell
+    11:42:54 infamy0:test # qeneth status
+    11:42:54 infamy0:test # qeneth console dut1
+    login: admin
+    password: *****
+    admin@infix-00-00-00:~$
+
+> **Note:** disconnect from the qeneth console by using bringing up the
+> old Telnet "menu" using Ctrl-], compared to standard Telnet this is
+> the BusyBox version so you press 'e' + enter instead of 'q' to quit.
+
+
+### Debug a Test
+
+First, add a Python `breakpoint()` to your test and run it from your
+`make test-sh` Infamy instance:
+
+    11:42:58 infamy0:test # ./case/infix_dhcp/dhcp_basic.py
+    # Starting (2024-02-10 11:42:59)
+    # Probing dut1 on port d1a for IPv6LL mgmt address ...
+    # Connecting to mgmt IP fe80::ff:fe00:0%d1a:830 ...
+    ok 1 - Initialize
+    > /home/jocke/src/infix/test/case/infix_dhcp/dhcp_basic.py(44)<module>()
+    (Pdb)
+
+You are now in the Python debugger, Pdb.
+
+### Debug a Test in a MacVLAN
+
+Most tests use some sort of network connection to the DUTs.  From a test
+shell you cannot see or debug that connection by default.  So you need
+to employ a little trick.
+
+Open another terminal, and start a test shell in your Infamy instance:
+
+    $ ./test/shell
+    11:43:19 infamy0:test #
+
+MacVLAN interfaces created by Infamy run in another network namespace,
+to enter it we can look for a sleeper process:
+
+    11:43:20 infamy0:test # nsenter -n U -t $(pidof sleep infinity)
+
+You are now one step further down:
+
+    infamy0:/home/jocke/src/infix/test# ip -br a
+    lo               UNKNOWN        127.0.0.1/8 ::1/128
+    iface@if7        UP             10.0.0.1/24 fe80::38d0:88ff:fe77:b7cd/64
+
+You can now freely debug the network activity of your test and the
+responses from the DUT.
+
+
 [9PM]:    https://github.com/rical/9pm
 [Qeneth]: https://github.com/wkz/qeneth
 [TAP]:    https://testanything.org/
@@ -0,0 +1,160 @@
+Vital Product Data
+==================
+
+Infix can source Vital Product Data (VPD) from EEPROMs containing an
+[ONIE TLV][oniespec]. The load bearing information from VPDs, used by
+Infix by default, is:
+
+1. Base (chassis) MAC address of the system
+2. Factory default admin password hash
+
+Additionally, every VPD is listed as a separate _component_ in the
+_ietf-hardware_ model, in which Infix exports all available attributes
+to the user. This is useful to read out exact hardware revisions of
+each board making up a system, figure out if a system belongs to a
+particular production batch, etc.
+
+
+## JSON Encoding
+
+To make EEPROM binary generation less cumbersome, Infix defines a JSON
+encoding of an ONIE TLV, and provides a tool, [onieprom], to translate
+from one encoding to another. I.e. a JSON object can be translated to
+its binary equivalent, and vice versa.
+
+A mapping between TLV attribute IDs and JSON keys is defined, using
+the Linux kernel [driver] as a reference:
+
+| TLV ID | Description      | Key                  | Type                            |
+|--------|------------------|----------------------|---------------------------------|
+| `0x21` | Product Name     | `"product-name"`     | String                          |
+| `0x22` | Part Number      | `"part-number"`      | String                          |
+| `0x23` | Serial Number    | `"serial-number"`    | String                          |
+| `0x24` | MAC #1 Base      | `"mac-address"`      | String ("c0:ff:ee:00:00:00")    |
+| `0x25` | Manufacture Date | `"manufacture-date"` | String ("MM/DD/YYYY HH:NN:SS")  |
+| `0x26` | Device Version   | `"device-version"`   | Integer (u8)                    |
+| `0x27` | Label Revision   | `"label-revision"`   | String                          |
+| `0x28` | Platform Name    | `"platform-name"`    | String                          |
+| `0x29` | ONIE Version     | `"onie-version"`     | String                          |
+| `0x2a` | Num MACs         | `"num-macs"`         | Integer (u16)                   |
+| `0x2b` | Manufacturer     | `"manufacturer"`     | String                          |
+| `0x2c` | Country Code     | `"country-code"`     | String (ISO 3166-1 2-byte code) |
+| `0x2d` | Vendor           | `"vendor"`           | String                          |
+| `0x2e` | Diag Version     | `"diag-version"`     | String                          |
+| `0x2f` | Service Tag      | `"service-tag"`      | String                          |
+| `0xfd` | Vendor Extension | `"vendor-extension"` | List of extensions (see below)  |
+
+The JSON encoding of a TLV is a single JSON object with an
+arbitrary subset of the attributes from the list above.
+
+**Example:**
+```json
+{
+	"product-name": "Wacky Widget",
+	"serial-number": "#1",
+	"manufacture-date": "02/13/2024 11:29:52"
+}
+```
+
+### Vendor Extensions
+
+As the specification explicitly mentions the option of supplying
+multiple vendor extensions, possibly multiple ones of the same type,
+the JSON chosen encoding is a list, where each element is itself a
+list of exactly two elements:
+
+| Element # | Type                                          |
+|-----------|-----------------------------------------------|
+| 1         | Integer (u32, [IANA enterprise number][pens]) |
+| 2         | String (UTF-8 encoded extension data)         |
+
+The format of the extension data is defined by the entity indicated by
+the IANA enterprise number. Restricting extension data to UTF-8
+encoded strings is a decision imposed by Infix; the ONIE specification
+allows for arbitrary binary data.
+
+**Example**:
+```json
+{
+	...
+	"vendor-extension": [
+		[ 12345, "my extension data" ]
+	]
+}
+```
+
+### Infix Specific Extensions
+
+[Kernelkit][kkit]'s IANA enterprise number is `61046`, under which any
+extensions required by Infix are stored. The **only** valid extension
+data that may be stored under this number is documented in _this
+section_. If other device specific data needs to be stored in a VPD,
+you must associate that with an enterprise number under our control.
+
+Every Kernelkit extension must be a valid JSON object containing an
+arbitrary subset of the following attributes:
+
+| Key        | Value                            | Description                          |
+|------------|----------------------------------|--------------------------------------|
+| `"pwhash"` | String (output of `mkpasswd(1)`) | Factory default password for `admin` |
+
+Since the extension is itself stored in a JSON document, it has to be
+appropriately quoted.
+
+**Example**:
+```json
+{
+	...
+	"vendor-extension": [
+		[ 61046, "{\"pwhash\":\"$6$9rufAxdqCrxrwfQR$G0l9cTVlu/vOhxgo/uMKfRDOmZRd5XWF3vKr5da6qYoxuTJBS/Pl9K.5lrabWoWFFc.71yFMaSlZz0O8FtAtl.\"}" ]
+	]
+}
+```
+
+## Creating and Parsing ONIE EEPROM Binaries
+
+```
+usage: onieprom [-h] [-e] [-d] [infile] [outfile]
+
+positional arguments:
+  infile
+  outfile
+
+options:
+  -h, --help    show this help message and exit
+  -e, --encode  Encode JSON input to binary output
+  -d, --decode  Decode binary input to JSON output
+```
+
+To convert a compatible JSON document (using the first example above)
+to its binary equivalent, we ask [onieprom] to _encode_ it for us:
+
+```sh
+~$ onieprom -e example.json >example.bin
+~$ hexdump -C example.bin
+00000000  54 6c 76 49 6e 66 6f 00  01 00 2d 25 13 30 32 2f  |TlvInfo...-%.02/|
+00000010  31 33 2f 32 30 32 34 20  31 31 3a 32 39 3a 35 32  |13/2024 11:29:52|
+00000020  21 0c 57 61 63 6b 79 20  57 69 64 67 65 74 23 02  |!.Wacky Widget#.|
+00000030  23 31 fe 04 dd 69 88 97                           |#1...i..|
+00000038
+```
+
+We can also run the process in reverse, to inspect the contents of a
+binary in its equivalent JSON representation:
+
+```sh
+~$ onieprom -d example.bin >example-again.json
+~$ jq . example-again.json
+{
+  "manufacture-date": "02/13/2024 11:29:52",
+  "product-name": "Wacky Widget",
+  "serial-number": "#1"
+}
+```
+
+
+[oniespec]: https://opencomputeproject.github.io/onie/design-spec/hw_requirements.html
+[onieprom]: ../board/common/rootfs/bin/onieprom
+[driver]: https://elixir.bootlin.com/linux/latest/source/drivers/nvmem/layouts/onie-tlv.c
+[pens]: https://www.iana.org/assignments/enterprise-numbers/
+[kkit]: https://github.com/kernelkit
@@ -3,6 +3,7 @@ IXMSG = printf "\e[37;44m>>>   $(call qstrip,$(1))\e[0m\n"
 include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/package/*/*.mk))
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/common.mk
 -include $(BR2_EXTERNAL_INFIX_PATH)/board/$(patsubst "%",%,$(BR2_ARCH))/board.mk
+include $(BR2_EXTERNAL_INFIX_PATH)/infix.mk

 .PHONY: local.mk
 local.mk:
@@ -18,6 +19,9 @@ run-menuconfig: $(BUILD_DIR)/buildroot-config/mconf
 	CONFIG_="CONFIG_" BR2_CONFIG="$(BINARIES_DIR)/.config" \
 		$(BUILD_DIR)/buildroot-config/mconf $(BINARIES_DIR)/Config.in

+#
+# Buildroot package extensions
+#
 define FRR_POST_BUILD_HOOK
 	mkdir -p $(TARGET_DIR)/etc/iproute2/
 	cp -r $(@D)/tools/etc/iproute2/rt_protos.d/ $(TARGET_DIR)/etc/iproute2/
@@ -0,0 +1 @@
+INFIX_CFLAGS:=-Wall -Werror -Wextra -Wno-unused-parameter -Wformat=2 -Wformat-overflow=2 -Winit-self -Wstrict-overflow=4 -Wno-format-truncation -Wno-format-nonliteral
@@ -1,4 +1,6 @@
 source "$BR2_EXTERNAL_INFIX_PATH/package/confd/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/curios-httpd/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/execd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/statd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/conmon/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/factory/Config.in"
@@ -6,6 +8,8 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/faux/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/finit/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/ifupdown-ng/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/iito/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/k8s-logger/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/keyack/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/klish-plugin-infix/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/klish/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/klish-plugin-sysrepo/Config.in"
@@ -8,7 +8,7 @@ run name:error :1 log:console norestart if:<run/bootstrap/failure> \
 	[S] /usr/libexec/confd/error --

 service name:confd log <run/bootstrap/success> \
-	[S12345] sysrepo-plugind -f -p /run/confd.pid -n -v3 -- Configuration daemon
+	[S12345] sysrepo-plugind -f -p /run/confd.pid -n -- Configuration daemon

 # Bootstrap system with startup-config
 run name:startup log:prio:user.notice norestart <pid/confd> \
@@ -4,6 +4,7 @@
 #
 ################################################################################

+
 CONFD_VERSION = 1.0
 CONFD_SITE_METHOD = local
 CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
@@ -12,6 +13,15 @@ CONFD_LICENSE_FILES = LICENSE
 CONFD_REDISTRIBUTE = NO
 CONFD_DEPENDENCIES = augeas jansson libite sysrepo libsrx
 CONFD_AUTORECONF = YES
+define CONFD_CONF_ENV
+CFLAGS="$(INFIX_CFLAGS)"
+endef
+
+ifeq ($(BR2_PACKAGE_PODMAN),y)
+CONFD_CONF_OPTS += --enable-containers
+else
+CONFD_CONF_OPTS += --disable-containers
+endif

 define CONFD_INSTALL_EXTRA
 	cp $(CONFD_PKGDIR)/confd.conf  $(FINIT_D)/available/
@@ -0,0 +1,7 @@
+config BR2_PACKAGE_CURIOS_HTTPD
+	bool "curiOS-httpd"
+	help
+	  Bundle an OCI archive of curiOS-httpd in /lib/oci for
+	  the given target architecture.
+
+	  https://github.com/kernelkit/curiOS
@@ -0,0 +1,18 @@
+################################################################################
+#
+# curios-httpd
+#
+################################################################################
+
+CURIOS_HTTPD_VERSION = edge
+CURIOS_HTTPD_SOURCE = curios-httpd-oci-$(GO_GOARCH).tar.gz
+CURIOS_HTTPD_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_HTTPD_VERSION)
+CURIOS_HTTPD_LICENSE = GPL
+CURIOS_HTTPD_INSTALL_TARGET = YES
+
+define CURIOS_HTTPD_INSTALL_TARGET_CMDS
+	mkdir -p $(TARGET_DIR)/lib/oci
+	(cd $(@D)/.. && $(TAR) cfz $(TARGET_DIR)/lib/oci/$(notdir $(@D)).tar.gz $(notdir $(@D)))
+endef
+
+$(eval $(generic-package))
@@ -0,0 +1,7 @@
+config BR2_PACKAGE_EXECD
+	bool "execd"
+	select BR2_PACKAGE_LIBUEV
+	select BR2_PACKAGE_LIBITE
+	help
+	  Generic job queue executor with retry on route changes.
+
@@ -0,0 +1,2 @@
+service log:prio:local1.err,tag:container \
+	[2345] execd /run/containers/queue /var/lib/containers/active -- Container job runner
@@ -0,0 +1,29 @@
+################################################################################
+#
+# execd
+#
+################################################################################
+
+EXECD_VERSION = 1.0
+EXECD_SITE_METHOD = local
+EXECD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/execd
+EXECD_LICENSE = ISC
+EXECD_LICENSE_FILES = LICENSE
+EXECD_REDISTRIBUTE = NO
+EXECD_DEPENDENCIES = libuev libite
+EXECD_AUTORECONF = YES
+
+define EXECD_CONF_ENV
+CFLAGS="$(INFIX_CFLAGS)"
+endef
+
+EXECD_CONF_OPTS = --prefix= --disable-silent-rules
+
+define EXECD_INSTALL_EXTRA
+	cp $(EXECD_PKGDIR)/execd.conf  $(FINIT_D)/available/
+	ln -sf ../available/execd.conf $(FINIT_D)/enabled/execd.conf
+	cp $(EXECD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/etc/tmpfiles.d/execd.conf
+endef
+EXECD_TARGET_FINALIZE_HOOKS += EXECD_INSTALL_EXTRA
+
+$(eval $(autotools-package))
@@ -0,0 +1,8 @@
+d  /run/containers/args		0700 - -
+d  /run/containers/files	0700 - -
+d  /var/lib/containers/active	0700 - -
+d  /var/lib/containers/oci	0755 - -
+d  /run/containers/inbox	0700 - -
+d  /run/containers/queue	0700 - -
+d  /run/cni			0755 - -
+L+ /var/lib/cni                 -    - - - /run/cni
@@ -11,6 +11,10 @@ FACTORY_SITE_METHOD = local
 FACTORY_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/factory
 FACTORY_REDISTRIBUTE = NO

+define FACTORY_CONF_ENV
+CFLAGS="$(INFIX_CFLAGS)"
+endef
+
 define FACTORY_BUILD_CMDS
 	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D) \
 		LDLIBS="$(TARGET_LDFLAGS)"
@@ -100,17 +100,17 @@ config BR2_PACKAGE_FINIT_WATCHDOG_DEV
 endif

 config BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG
-	bool "hotplug plugin (mdev/udev)"
+	bool "Start (udevd/mdev -df) at boot"
 	help
-	  By default, Finit builds and launches its hotplug plugin.
-	  It is responsible for detecting and starting the mdev tool,
-	  or udevd daemon.  The former exists in many BusyBox based
-	  systems and is called for "cold plugging".  The latter has
-	  many various incarnations and is mostly used for desktop
-	  systems.
+	  By default, Finit installs /lib/finit/system/10-hotplug.conf
+	  which detects if the system has udevd or mdev daemon.  They
+	  are both used to probe for devices, load modules and firmware
+	  to devices that request it.

 	  For lxc/docker application builds you do not need this.

+	  With this you probably do not need the modprobe plugin.
+
 config BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS
 	bool "hook scripts"
 	default n
@@ -141,6 +141,9 @@ config BR2_PACKAGE_FINIT_PLUGIN_MODPROBE

 	  For lxc/docker application builds you do not need this.

+	  You probably do not want this anymore, use udevd or mdev to
+	  probe devices, load modules and firmware instead.
+
 config BR2_PACKAGE_FINIT_PLUGIN_RTC
 	bool "RTC plugin"
 	help
@@ -1,8 +1,8 @@
 # From https://github.com/troglobit/finit/releases/
-sha256  84ce1623ee935dc5d2d615ca14ed087f4bb3c47207fda97f26b1346e4983a6b2  finit-4.6.tar.gz
+sha256  139adcb81ec8a5bb628249f92e2144b20f7e14c53aa56bb86a2fd42c5e7dca11  finit-4.7.tar.gz

 # Locally calculated
-sha256  3a2b964c1772d03ab17b73a389ecce9151e0b190a9247817a2c009b16d356422  LICENSE
+sha256  2fd62c0fe6ea6d1861669f4c87bda83a0b5ceca64f4baa4d16dd078fbd218c14  LICENSE

 # GIT Snapshot
 sha256  8c880293409cf566f6256bff193f985c50bd2eb99d2ff964dcaa9590251ed27e  finit-438d6b4e638418a2a22024a3cead2f47909d72b9.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-FINIT_VERSION = 4.6
+FINIT_VERSION = 4.7
 FINIT_SITE = https://github.com/troglobit/finit/releases/download/$(FINIT_VERSION)
 FINIT_LICENSE = MIT
 FINIT_LICENSE_FILES = LICENSE
@@ -0,0 +1,13 @@
+config BR2_PACKAGE_K8S_LOGGER
+	bool "k8s-logger"
+	depends on BR2_PACKAGE_PODMAN
+	depends on BR2_PACKAGE_SYSKLOGD
+	select BR2_PACKAGE_LIBITE
+	help
+	  Reads k8s-file style logs written to a fifo (mkfifo) by by podman
+	  and forwards them, line by assembled line, to syslog.
+
+	  Infix requires use of sysklogd to enable the syslogp() API so that
+	  k8s-logger also includes the container's main PID.
+
+	  https://github.com/kernelkit/k8s-logger
@@ -0,0 +1,3 @@
+# LICENSE hash locally calculated, .tar.gz hash from GitHub release
+sha256  01b0285cf2ed7aa2f4c4bc92db3bbe9dcfe75441eda17d93c08b3fe9e32d2111  k8s-logger-1.2.tar.gz
+sha256  c556e258d3293cb96277912daf43155d9d65194fb5651249d1fdc489265b9a69  LICENSE
@@ -0,0 +1,14 @@
+################################################################################
+#
+# k8s-logger
+#
+################################################################################
+
+K8S_LOGGER_VERSION = 1.2
+K8S_LOGGER_SITE = https://github.com/kernelkit/k8s-logger/releases/download/v$(K8S_LOGGER_VERSION)
+K8S_LOGGER_LICENSE = MIT
+K8S_LOGGER_LICENSE_FILES = LICENSE
+K8S_LOGGER_DEPENDENCIES = sysklogd libite
+K8S_LOGGER_CONF_OPTS = --with-syslogp
+
+$(eval $(autotools-package))
@@ -0,0 +1,6 @@
+config BR2_PACKAGE_KEYACK
+	bool "keyack"
+	help
+	  Blocks until a specific key is pressed and released. Useful
+	  when you want a user to confirm some action by physically
+	  pressing a button.
@@ -0,0 +1,24 @@
+################################################################################
+#
+# keyack
+#
+################################################################################
+
+KEYACK_VERSION = 1.0
+KEYACK_LICENSE = MIT
+KEYACK_LICENSE_FILES = LICENSE
+KEYACK_SITE_METHOD = local
+KEYACK_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/keyack
+KEYACK_REDISTRIBUTE = NO
+
+define KEYACK_BUILD_CMDS
+	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D) \
+		LDLIBS="$(TARGET_LDFLAGS)"
+endef
+
+define KEYACK_INSTALL_TARGET_CMDS
+	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D) \
+		DESTDIR="$(TARGET_DIR)" install
+endef
+
+$(eval $(generic-package))
@@ -6,3 +6,13 @@ config BR2_PACKAGE_KLISH_PLUGIN_INFIX
 	help
 	  A plugin to klish with an opinionated config and some
 	  command extensions, suitable for systems running Infix.
+
+if BR2_PACKAGE_KLISH_PLUGIN_INFIX
+
+config BR2_PACKAGE_KLISH_PLUGIN_INFIX_SHELL
+	bool "shell command"
+	default y
+	help
+	  Include 'shell' command exit to Bash.
+
+endif
@@ -13,6 +13,28 @@ KLISH_PLUGIN_INFIX_REDISTRIBUTE = NO
 KLISH_PLUGIN_INFIX_DEPENDENCIES = klish-plugin-sysrepo
 KLISH_PLUGIN_INFIX_AUTORECONF = YES

+define KLISH_PLUGIN_INFIX_CONF_ENV
+CFLAGS="$(INFIX_CFLAGS)"
+endef
+
+ifeq ($(BR2_PACKAGE_PODMAN),y)
+KLISH_PLUGIN_INFIX_CONF_OPTS += --enable-containers
+else
+KLISH_PLUGIN_INFIX_CONF_OPTS += --disable-containers
+endif
+
+ifeq ($(BR2_PACKAGE_KLISH_PLUGIN_INFIX_SHELL),y)
+KLISH_PLUGIN_INFIX_CONF_OPTS += --enable-shell
+else
+KLISH_PLUGIN_INFIX_CONF_OPTS += --disable-shell
+endif
+
+ifeq ($(BR2_PACKAGE_BASH),y)
+KLISH_PLUGIN_INFIX_CONF_OPTS += --with-shell=/bin/bash
+else
+KLISH_PLUGIN_INFIX_CONF_OPTS += --with-shell=/bin/sh
+endif
+
 define KLISH_PLUGIN_INFIX_INSTALL_DOC
 	$(INSTALL) -t $(TARGET_DIR)/usr/share/infix/cli -D -m 0644 \
 		$(wildcard $(BR2_EXTERNAL_INFIX_PATH)/doc/cli/*.md)
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  468b9a4da872257795964e2fff17fbfc5a592070a98a0a51e5f54464171ee73f  klish-plugin-sysrepo-fa1228a7ff2b3500b8c1bc6f6f0d28bddd2d0a91-br1.tar.gz
+sha256  c06a369147ae1071c0c309c0bd9d49d8ae0ff5dd1e804e2009b1a18f7fc12b5c  klish-plugin-sysrepo-909cbfb1253a3c3c3abfdc72de9db7aaf3a08de2-br1.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-KLISH_PLUGIN_SYSREPO_VERSION = fa1228a7ff2b3500b8c1bc6f6f0d28bddd2d0a91
+KLISH_PLUGIN_SYSREPO_VERSION = 909cbfb1253a3c3c3abfdc72de9db7aaf3a08de2
 KLISH_PLUGIN_SYSREPO_SITE = https://github.com/kernelkit/klish-plugin-sysrepo.git
 #KLISH_PLUGIN_SYSREPO_VERSION = cdd3eb51a7f7ee0ed5bd925fa636061d3b1b85fb
 #KLISH_PLUGIN_SYSREPO_SITE = https://src.libcode.org/pkun/klish-plugin-sysrepo.git
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`INFIX_CFLAGS:=-Wall -Werror -Wextra -Wno-unused-parameter -Wformat=2 -Wformat-overflow=2 -Winit-self -Wstrict-overflow=4 -Wno-format-truncation -Wno-format-nonliteral`