[DEBUG] Debug image settings

[DEBUG] Increase critical temperature trip point to 115C
For testing purposes.
2026-07-22 17:23:00 +02:00 · 2024-04-19 14:18:11 +02:00 · 2024-04-19 14:13:25 +02:00 · 2024-04-19 14:13:25 +02:00
108 changed files with 453 additions and 2513 deletions
@@ -9,23 +9,29 @@ on:
 jobs:
  build:
    name: Build Infix ${{ matrix.platform }}
-    runs-on: [ self-hosted, latest ]
+    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform: [aarch64, x86_64]
      fail-fast: false
    steps:
+      - name: Maintenance
+        run: |
+          docker image prune -af
+          docker volume prune -f
+          docker container prune -f
      - uses: actions/checkout@v4
-        with:
-          submodules: 'true'
-
      - name: Set Build Variables
        id: vars
        run: |
          target=${{ matrix.platform }}
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-
+          if [ "$target" = x86_64 ]; then
+              echo "out=$PWD/output"      >> $GITHUB_OUTPUT
+          else
+              echo "out=/mnt/x-$target"   >> $GITHUB_OUTPUT
+          fi
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
@@ -33,7 +39,6 @@ jobs:
          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
            dl-
-
      - name: Restore Cache of .ccache/
        uses: actions/cache@v4
        with:
@@ -42,35 +47,35 @@ jobs:
          restore-keys: |
            ccache-${{ matrix.platform }}-
            ccache-
-
      - name: Configure & Build
        run: |
          target=${{ matrix.platform }}_defconfig
          echo "Building $target ..."
+          sudo mkdir ${{ steps.vars.outputs.out }}
+          sudo chown $(id -un):$(id -gn) ${{ steps.vars.outputs.out }}
+          export O=${{ steps.vars.outputs.out }}
          make $target
          make
-
      - name: Prepare Artifact
        run: |
-          cd output/
+          cd ${{ steps.vars.outputs.out }}
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
-
      - name: Test
        if: matrix.platform == 'x86_64'
        run: |
-          make test
+          export O=${{ steps.vars.outputs.out }}
+          make test-qeneth
      - uses: actions/upload-artifact@v4
        with:
-          path: output/${{ steps.vars.outputs.tgz }}
+          path: ${{ steps.vars.outputs.out }}/${{ steps.vars.outputs.tgz }}
          name: artifact-${{ matrix.platform }}
-
  release:
    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
    name: Upload Latest Build
    needs: build
-    runs-on: [ self-hosted, latest ]
+    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
@@ -78,7 +83,6 @@ jobs:
        with:
          pattern: "artifact-*"
          merge-multiple: true
-
      - uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
@@ -89,7 +93,6 @@ jobs:
          tag: "latest"
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "*.tar.gz"
-
      - name: Summary
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
@@ -24,7 +24,6 @@ jobs:
               --post-data "token=$TOKEN&project=${PROJECT_NAME}&md5=1" \
               -O coverity-latest.tar.gz.md5
          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT
-
      - uses: actions/cache@v4
        id: cache
        with:
@@ -34,7 +33,6 @@ jobs:
            ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
            ${{ runner.os }}-coverity-
            ${{ runner.os }}-coverity
-
      - name: Download Coverity Scan
        env:
          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
@@ -49,14 +47,12 @@ jobs:
          fi
          mkdir coverity
          tar xzf coverity-latest.tar.gz --strip 1 -C coverity
-
      - name: Install dependencies
        run: |
          sudo apt-get -y update
          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                       libaugeas-dev libglib2.0-dev libpcre2-dev      \
                       libuev-dev libite-dev
-
      - name: Build dependencies
        run: |
          git clone https://github.com/CESNET/libyang.git
@@ -66,12 +62,10 @@ jobs:
          mkdir sysrepo/build
          (cd sysrepo/build && cmake .. && make all && sudo make install)
          make dep
-
      - name: Check applications
        run: |
          export PATH=`pwd`/coverity/bin:$PATH
          cov-build --dir cov-int make check
-
      - name: Submit results to Coverity Scan
        env:
          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
@@ -84,7 +78,6 @@ jobs:
            --form version=$(git rev-parse HEAD) \
            --form description="${PROJECT_NAME} $(git rev-parse HEAD)" \
            https://scan.coverity.com/builds?project=${PROJECT_NAME}
-
      - name: Upload build.log
        uses: actions/upload-artifact@v4
        with:
@@ -16,24 +16,21 @@ concurrency:
 jobs:
  build:
    name: Regression Testing
-    runs-on: [ self-hosted, regression ]
+    runs-on: self-hosted
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: 'true'
-
      - name: Clean up cruft ...
        run: |
          ./test/env -c
-
      - name: Set Build Variables
        id: vars
        run: |
          target=x86_64
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
@@ -42,7 +39,6 @@ jobs:
          restore-keys: |
            dl-netconf-
            dl-
-
      - name: Restore Cache of .ccache/
        uses: actions/cache@v4
        with:
@@ -51,22 +47,19 @@ jobs:
          restore-keys: |
            ccache-x86_64-
            ccache-
-
      - name: Configure NETCONF
        run: |
          make x86_64_defconfig

      - name: Unit Test
-        run: |
-          make test-unit
+        run: make test-unit

      - name: Build
        run: |
          make
-
      - name: Prepare Artifact
        run: |
-          cd output/
+          cd output
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
@@ -76,8 +69,7 @@ jobs:
          path: output/${{ steps.vars.outputs.tgz }}

      - name: Regression Test
-        run: |
-          make test
+        run: make test-qeneth

      - name: Publish Test Result
        # Ensure this runs even if Regression Test fails
@@ -21,16 +21,18 @@ jobs:
  build:
    if: github.repository == 'kernelkit/infix' && startsWith(github.ref, 'refs/tags/')
    name: Build Infix ${{ github.ref_name }} [${{ matrix.platform }}]
-    runs-on: [ self-hosted, release ]
+    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform: [aarch64, x86_64]
      fail-fast: false
    steps:
+      - name: Maintenance
+        run: |
+          docker image prune -af
+          docker volume prune -f
+          docker container prune -f
      - uses: actions/checkout@v4
-        with:
-          submodules: 'true'
-
      - name: Set Release Variables
        id: vars
        run: |
@@ -44,7 +46,7 @@ jobs:
          target=${{ matrix.platform }}-${fver}
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-
+          echo "out=/mnt/x-$target"       >> $GITHUB_OUTPUT
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
@@ -52,7 +54,6 @@ jobs:
          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
            dl-
-
      - name: Restore Cache of .ccache/
        uses: actions/cache@v4
        with:
@@ -61,46 +62,41 @@ jobs:
          restore-keys: |
            ccache-${{ matrix.platform }}-
            ccache-
-
      - name: Configure & Build
        env:
          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
        run: |
          target=${{ matrix.platform }}_defconfig
          echo "Building $target ..."
+          sudo mkdir ${{ steps.vars.outputs.out }}
+          sudo chown $(id -un):$(id -gn) ${{ steps.vars.outputs.out }}
+          export O=${{ steps.vars.outputs.out }}
          make $target
          make
-
      - name: Generate SBOM from Build
        run: |
          make legal-info
-
      - name: Prepare Artifacts
        run: |
-          cd output/
+          cd ${{ steps.vars.outputs.out }}
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

          mv legal-info legal-info-$target
          tar chfz legal-info-$target.tar.gz legal-info-$target
-
      - uses: actions/upload-artifact@v4
        with:
          name: artifact-${{ matrix.platform }}
-          path: output/*.tar.gz
-
+          path: ${{ steps.vars.outputs.out }}/*.tar.gz
  release:
    name: Release Infix ${{ github.ref_name }}
    needs: build
-    runs-on: [ self-hosted, release ]
+    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
-        with:
-          submodules: 'true'
-
      - name: Set Release Variables
        id: rel
        run: |
@@ -122,24 +118,20 @@ jobs:
          fi
          echo "pre=${{ steps.rel.outputs.pre }}"
          echo "latest=${{ steps.rel.outputs.latest }}"
-
      - uses: actions/download-artifact@v4
        with:
          pattern: "artifact-*"
          merge-multiple: true
-
      - name: Create checksums ...
        run: |
          for file in *.tar.gz; do
              sha256sum $file > $file.sha256
          done
-
      - name: Extract ChangeLog entry ...
        run: |
          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
              |head -n -1 > release.md
          cat release.md
-
      - uses: ncipollo/release-action@v1
        with:
          name: Infix ${{ github.ref_name }}
@@ -147,7 +139,6 @@ jobs:
          makeLatest: ${{ steps.rel.outputs.latest }}
          bodyFile:  release.md
          artifacts: "*.tar.gz*"
-
      - name: Summary
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
@@ -14,6 +14,10 @@

 #include "alder-mpp.h"

+&ap_crit {
+	temperature = <115000>;
+};
+
 / {
 	model = "Alder";
 	compatible = "alder,alder",
@@ -354,7 +358,6 @@
 #define XSWP(_n, _label, _mac_offs, _phy) \
 			port@_n { \
 				SWP_COMMON(_n, _label, _mac_offs, "usxgmii", _phy); \
-				managed = "in-band-status"; \
 			}

 #define GSWP(_n, _label, _mac_offs, _phy) \
@@ -18,27 +18,7 @@ endchoice
 config SIGN_KEY
 	string "Signing key"
 	depends on SIGN_ENABLED
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development"  if SIGN_SRC_DIR
-
-menuconfig TRUSTED_KEYS
-	bool "Trusted keys for image"
-	depends on SIGN_ENABLED
-	help
-	 Keys that will be accepted for this image
-
-
-config TRUSTED_KEYS_DEVELOPMENT
-	bool "Development key"
-	depends on TRUSTED_KEYS
-
-config TRUSTED_KEYS_DEVELOPMENT_PATH
-	string
-	depends on TRUSTED_KEYS_DEVELOPMENT
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
-
-config TRUSTED_KEYS_EXTRA_PATH
-	string "Path to extra keys to include in image"
-	depends on TRUSTED_KEYS
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/dev-key" if SIGN_SRC_DIR

 menuconfig DISK_IMAGE
 	bool "Disk image"
@@ -160,3 +140,4 @@ config FIT_ARCH
 config FIT_KERNEL_LOAD_ADDR
 	string "Kernel load address"
 	depends on FIT_IMAGE
+
@@ -1,13 +1,11 @@
 ifeq ($(SIGN_ENABLED),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk

-TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)
 define RAUC_POST_BUILD_INSTALL_CERT
 	@$(call IXMSG,"Installing signing cert for RAUC")
 	mkdir -p $(TARGET_DIR)/etc/rauc/keys
-	$(foreach crt,$(shell ls $(TRUSTED_KEYS)), \
+	$(foreach crt,$(shell ls $(SIGN_KEY)/*.crt), \
 		cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)
-
 endef
 RAUC_POST_BUILD_HOOKS += RAUC_POST_BUILD_INSTALL_CERT
 endif
@@ -44,19 +44,16 @@ image @DISKIMG@ {
 	partition aux {
 		offset = @AUXOFFS@
 		image = "aux.ext4"
-		partition-uuid = @AUXUUID@
 	}

 	partition primary {
 		image = "rootfs.squashfs"
 		size = @IMGSIZE@
-		partition-uuid = @PRIMARYUUID@
 	}

 	partition secondary {
 		image = "rootfs.squashfs"
 		size = @IMGSIZE@
-		partition-uuid = @SECONDARYUUID@
 	}

 	partition cfg {
@@ -1,7 +1,6 @@
 #!/bin/sh
-set -e

-. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
+set -e

 K=10
 M=20
@@ -158,9 +157,6 @@ genboot
 # Use awk over sed because replacement text may contain newlines,
 # which sed does not approve of.
 awk \
-   	  -vauxuuid=$AUX_UUID \
-	  -vprimaryuuid=$PRIMARY_UUID \
-          -vsecondaryuuid=$SECONDARY_UUID \
 	  -vtotal=$total \
 	  -vauxsize=$auxsize -vauxoffs=$auxoffs \
 	  -vimgsize=$imgsize \
@@ -178,10 +174,6 @@ awk \
 		sub(/@DISKIMG@/, diskimg);
 		sub(/@BOOTIMG@/, bootimg);
 		sub(/@BOOTPART@/, bootpart);
-		sub(/@AUXUUID@/, auxuuid);
-		sub(/@PRIMARYUUID@/, primaryuuid);
-		sub(/@SECONDARYUUID@/, secondaryuuid);
-
 	  }1' \
 	      < $common/genimage.cfg.in >$root/genimage.cfg

@@ -54,10 +54,11 @@ choice

 config QEMU_CONSOLE_VIRTIO
     bool "Virtio (hvc0)"
+     depends on QEMU_LOADER_KERNEL

 config QEMU_CONSOLE_SERIAL
     bool "Serial (ttyS0/ttyAMA0)"
-     depends on !QEMU_LOADER_OVMF
+
 endchoice

 config QEMU_MACHINE
@@ -117,7 +117,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
+	echo -n "-drive file=$CONFIG_QEMU_ROOTFS,if=virtio,format=raw,bus=0,unit=0 "
    fi
 }

@@ -148,20 +148,14 @@ usb_args()
 	dd if=/dev/zero of=${USBSTICK} bs=8M count=1 >/dev/null 2>&1
 	mkfs.vfat $USBSTICK >/dev/null 2>&1
    fi
-    echo -n "-drive if=none,id=usbstick,format=raw,file=$USBSTICK "
+    echo -n "-drive if=none,id=usbstick,format=raw,file=${USBSTICK} "
    echo -n "-usb "
    echo -n "-device usb-ehci,id=ehci "
    echo -n "-device usb-storage,bus=ehci.0,drive=usbstick "
 }
 rw_args()
 {
-    [ "$CONFIG_QEMU_RW" ] ||  return
-
-    if ! [ -f "aux.ext4" ]; then
-	dd if=/dev/zero of="aux.ext4" bs=1M count=1 >/dev/null 2>&1
-	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
-    fi
-    echo -n "-drive file=aux.ext4,if=virtio,format=raw,bus=0,unit=3 "
+    [ "$CONFIG_QEMU_RW" ] || return

    if ! [ -f "$CONFIG_QEMU_RW" ]; then
 	dd if=/dev/zero of="$CONFIG_QEMU_RW" bs=16M count=1 >/dev/null 2>&1
@@ -204,10 +198,10 @@ net_args()
    echo -n "-fw_cfg name=opt/mactab,file=$mactab "

    if [ "$CONFIG_QEMU_NET_BRIDGE" = "y" ]; then
-	echo -n "-netdev bridge,id=e1,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
-	net_dev_args 1
+	echo -n "-netdev bridge,id=e0,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
+	net_dev_args 0
    elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
-	for i in $(seq 1 $(($CONFIG_QEMU_NET_TAP_N))); do
+	for i in $(seq 0 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
 	    echo -n "-netdev tap,id=e$i,ifname=qtap$i "
 	    net_dev_args $i
 	done
@@ -215,8 +209,8 @@ net_args()
 	local useropts=
 	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"

-	echo -n "-netdev user,id=e1${useropts} "
-	net_dev_args 1
+	echo -n "-netdev user,id=e0${useropts} "
+	net_dev_args 0
    else
 	echo -n "-nic none"
    fi
@@ -257,9 +251,6 @@ wdt_args()

 run_qemu()
 {
-    if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	 qemu-img create -f qcow2 -o backing_file=$CONFIG_QEMU_ROOTFS -F raw $CONFIG_QEMU_ROOTFS.qcow2 > /dev/null
-    fi
    local qemu
    read qemu <<EOF
 	$CONFIG_QEMU_MACHINE -m $CONFIG_QEMU_MACHINE_RAM \
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+sleep 30
+
+stress-ng --cpu 8 --io 4 --vm 2 --vm-bytes 128M --fork 4 -t 0
@@ -0,0 +1,76 @@
+#!/bin/sh
+
+tstamp()
+{
+	if [ "$1" = "head" ]; then
+		printf '%9s' time
+	else
+		printf '%9s' $(date +%T)
+	fi
+}
+
+thermal()
+{
+	for th in /sys/class/thermal/thermal_zone*; do
+		if [ "$1" = "head" ]; then
+			printf '%5s' $(cat $th/type | \
+				sed -e 's/-thermal//' -e 's/ap-cpu/cpu/' -e 's/-ic//')
+		else
+			printf '%5d' \
+				$((($(cat $th/temp) + 500) / 1000))
+		fi
+	done
+}
+
+
+hwmon()
+{
+	for hw in /sys/class/hwmon/*; do
+		[ -f $hw/temp1_input ] || continue
+
+		if [ "$1" = "head" ]; then
+			printf '%5s' \
+				$(cat $hw/name | sed -e 's/cp0configspacef2000000mdio12a200switch0mdio0/p/' -e 's/f212a600mdiomii0/xp/')
+		else
+			printf '%5d' \
+				$((($(cat $hw/temp1_input) + 500) / 1000))
+		fi
+	done
+}
+
+xphys()
+{
+	for xphy in 4 5; do
+		mdio f212a6* $xphy:31 0xf08a 0x4d00
+
+		if [ "$1" = "head" ]; then
+			printf '%5s' \
+				p$((xphy + 5))
+		else
+			printf '%5d' \
+				$(($(mdio f212a6* $xphy:31 0xf08a) & 0xff - 75))
+		fi
+	done
+}
+
+if [ "$1" != "-H" ]; then
+#	tstamp head
+	thermal head
+	hwmon head
+#	xphys head
+	echo
+fi
+
+while :; do
+#	tstamp
+	thermal
+	hwmon
+#	xphys
+	echo
+
+	if [ "$1" == "-n" ]; then
+		sleep ${2:-10}
+	else
+		break
+	fi
+done
@@ -0,0 +1,3 @@
+service [2345789] log:/var/log/temp.log /bin/temp.sh -n 10 -- Temperature monitor
+service [2345789] log:/var/log/load.log /bin/load.sh -- CPU load generator
+service [2345789] log:/var/log/memtester.log /usr/bin/memtester 1G -- Memory load generator
@@ -0,0 +1 @@
+../available/temp.conf
@@ -19,4 +19,4 @@ LABEL=aux	/mnt/aux	auto		noatime,nodiratime,noauto	0	0
 LABEL=var	/mnt/var	auto		noatime,nodiratime,noauto	0	0
 LABEL=cfg	/mnt/cfg	auto		noatime,nodiratime,noauto	0	0
 hostfs		/mnt/host	9p		cache=none,msize=16384,noauto	0	0
-/libexec/infix/mnt# /cfg	helper		none				0	0
+/libexec/infix/mnt# /cfg		helper		none				0	0
@@ -1,25 +0,0 @@
-root:x:0:
-daemon:x:1:
-bin:x:2:
-sys:x:3:
-adm:x:4:
-tty:x:5:
-disk:x:6:
-lp:x:7:
-mail:x:8:
-kmem:x:9:
-wheel:x:10:root
-cdrom:x:11:
-dialout:x:18:
-floppy:x:19:
-video:x:28:
-audio:x:29:
-tape:x:32:
-www-data:x:33:
-backup:x:34:
-utmp:x:43:
-plugdev:x:46:
-lock:x:54:
-netdev:x:82:
-users:x:100:
-nobody:x:65534:
@@ -1 +0,0 @@
-configure ports dsa0 lldp status disabled
@@ -1,3 +0,0 @@
-AUX_UUID="78460f84-de84-4fe7-89bd-4c1f433b2230"
-PRIMARY_UUID="107ae911-a97b-4380-975c-7ce1a2dde1e0"
-SECONDARY_UUID="352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02"
@@ -1,9 +0,0 @@
-root:x:0:0:root:/root:/bin/sh
-daemon:x:1:1:daemon:/usr/sbin:/bin/false
-bin:x:2:2:bin:/bin:/bin/false
-sys:x:3:3:sys:/dev:/bin/false
-sync:x:4:100:sync:/bin:/bin/sync
-mail:x:8:8:mail:/var/spool/mail:/bin/false
-www-data:x:33:33:www-data:/var/www:/bin/false
-backup:x:34:34:backup:/var/backups:/bin/false
-nobody:x:65534:65534:nobody:/home:/bin/false
@@ -1,9 +0,0 @@
-root::::::::
-daemon:*:::::::
-bin:*:::::::
-sys:*:::::::
-sync:*:::::::
-mail:*:::::::
-www-data:*:::::::
-backup:*:::::::
-nobody:*:::::::
@@ -3,13 +3,12 @@
 import importlib.machinery
 import json
 import os
-import shutil
 import struct
 import subprocess
 import sys

 onieprom = importlib.machinery.SourceFileLoader("onieprom","/bin/onieprom").load_module()
-SYSTEM_JSON   = "/run/system.json"
+
 KKIT_IANA_PEM = 61046

 class DTSystem:
@@ -234,36 +233,8 @@ def vpd_inject(out, vpds):
            out["factory-password-hash"] = pwhash
            break

-def qemu_base_mac():
-    """Find MAC address of first non-loopback interface, subtract with 1"""
-    base_path = '/sys/class/net'
-    interfaces = []
-
-    for iface in os.listdir(base_path):
-        if iface == 'lo':
-            continue
-        try:
-            # pylint: disable=invalid-name
-            with open(os.path.join(base_path, iface, 'address'), 'r', encoding='ascii') as f:
-                mac = f.read().strip()
-            interfaces.append((mac, iface))
-        except FileNotFoundError:
-            continue
-
-    if interfaces:
-        interfaces.sort()
-        mac  = interfaces[0][0]
-        mac  = int(mac.replace(':', ''), 16)
-        mac -= 1
-        mac %= 1 << 48
-        mac  = ':'.join(f"{(mac >> 8 * i) & 0xff:02x}" for i in range(5, -1, -1))
-        return mac
-
-    return None
-
 def probe_qemusystem(out):
-    """Probe Qemu based test systems and 'make run'"""
-    admin_hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"
+    ADMINHASH = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"

    qsys = QEMUSystem()
    vpds = qsys.vpds()
@@ -273,7 +244,6 @@ def probe_qemusystem(out):
    for (attr, default) in (
            ("vendor", "QEMU"),
            ("product-name", "VM"),
-            ("mac-address", qemu_base_mac()),
    ):
        if not out[attr]:
            out[attr] = default
@@ -282,14 +252,13 @@ def probe_qemusystem(out):
       not out["vpd"]["product"]["available"]:
        # Virtual instance without VPD emulation, fallback to
        # admin/admin
-        out["factory-password-hash"] = admin_hash
+        out["factory-password-hash"] = ADMINHASH

    # Let others react to the fact that we are running in QEMU
-    subprocess.run("initctl -nbq cond set qemu".split(), check=False)
+    subprocess.run("initctl -nbq cond set qemu".split())
    return 0

 def probe_dtsystem(out):
-    """Probe DTS based system, expects a VPD in ONIE PROM format."""
    dtsys = DTSystem()
    vpds = dtsys.infix_vpds()
    dtsys.infix_usb_devices(out)
@@ -327,15 +296,11 @@ def main():
        return err

    if not out["factory-password-hash"]:
-        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +
-                         "NO FACTORY PASSWORD FOUND\033[0m\n\n")
+        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\nNO FACTORY PASSWORD FOUND\033[0m\n\n")
        err = 1

-    os.umask(0o337)
-    # pylint: disable=invalid-name
-    with open(SYSTEM_JSON, "w", encoding="ascii") as f:
-        json.dump(out, f)
-    shutil.chown(SYSTEM_JSON, user="root", group="wheel")
+    json.dump(out, open("/run/system.json", "w"))
+    os.chmod("/run/system.json", 0o444)
    return err

 if __name__ == "__main__":
@@ -1,7 +1,6 @@
 #!/bin/sh
-set -e

-. /etc/partion-uuid
+set -e

 disk=$1
 bootoffs=$2
@@ -30,9 +29,9 @@ fi
 sgdisk \
    -o \
    -n1:${bootoffs}:+${bootsize} -t1:8301 -c1:boot \
-    -n2::+${auxsize} -t2:8301 -c2:aux -u2:${AUX_UUID}\
-    -n3::+${imgsize} -t3:8300 -c3:primary -u3:${PRIMARY_UUID} \
-    -n4::+${imgsize} -t4:8300 -c4:secondary -u4:${SECONDARY_UUID}\
+    -n2::+${auxsize} -t2:8301 -c2:aux \
+    -n3::+${imgsize} -t3:8300 -c3:primary \
+    -n4::+${imgsize} -t4:8300 -c4:secondary \
    -n5::+${cfgsize} -t5:8302 -c5:cfg \
    -n6::            -t6:8310 -c6:var \
    -p \
@@ -1,27 +1,26 @@
-define uboot-add-pubkey
-	$(call IXMSG,"Installing trusted key $1")
-	$(HOST_DIR)/bin/fdt_add_pubkey \
-		-a sha256,rsa$(shell \
-			openssl x509 -text -noout -in $1 | \
-			grep 'Public-Key: ' | \
-			sed -e 's/.*(\(.*\) bit)/\1/') \
-		-k $(dir $1) \
-		-n $(notdir $(basename $1)) \
-		-r image \
-		$2
-endef
-
-# U-Boot has its own public key format which has to be stored in its
-# control DT. So we collect all of the trusted keys, convert them to
-# the required format, and write the result to infix-key.dtb in the
-# U-Boot build tree. This will then be built in to the final U-Boot
-# image's control DT via the CONFIG_DEVICE_TREE_INCLUDES option (see
-# extras.config).
+# This is a bit awkward. If you know about a more straight forward way
+# of doing this, please simplify.
+#
+# U-Boot needs the public part of the signing key to be preprocessed
+# and then inserted into its control DT. mkimage(1) can perform this
+# conversion, but only as a side-effect of building/signing an FIT
+# image. Since we might not always be doing that, e.g. when only
+# building a hardware specific bootloader, we build a dummy FIT just
+# to get the key information into a DTB, which we then convert back to
+# a .dtsi and install in the U-Boot build tree. This will then be
+# built in to the final U-Boot image's control DT via the
+# CONFIG_DEVICE_TREE_INCLUDES option (see extras.config).
 define UBOOT_PRE_BUILD_INSTALL_KEY
+	@$(call IXMSG,"Installing Infix signing key ($(SIGN_KEY))")
 	$(HOST_DIR)/bin/dtc <(echo '/dts-v1/; / { signature {}; };') >$(@D)/infix-key.dtb
-	$(foreach key, \
-		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
-		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
+	$(HOST_DIR)/bin/mkimage \
+		-k $(SIGN_KEY) \
+		-f $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/key-dummy.its \
+		-K $(@D)/infix-key.dtb \
+		$(if $(SIGN_SRC_PKCS11),-N pkcs11) \
+		-r \
+		$(@D)/key-dummy.itb
+	rm $(@D)/key-dummy.itb
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
 	| sed -e 's:/dts-v[0-9]\+/;::' >$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi
@@ -3,9 +3,7 @@ INFIX_TESTS ?= $(test-dir)/case/all.yaml

 test-env = $(test-dir)/env \
 	-f $(BINARIES_DIR)/infix-x86_64.img \
-	-f $(BINARIES_DIR)/infix-x86_64-disk.img \
-	-f $(BINARIES_DIR)/OVMF.fd \
-        -p $(BINARIES_DIR)/infix-x86_64.pkg \
+	-p $(BINARIES_DIR)/infix-x86_64.pkg \
 	$(1) $(2)

 test-env-qeneth = $(call test-env,-q $(test-dir)/virt/quad,$(1))
@@ -1,6 +1 @@
-search -l aux --set=aux
-search -l primary --set=primary
-search -l secondary --set=secondary
-
-set prefix=($aux)/grub
-configfile ($aux)/grub/grub.cfg
+set prefix=(hd0,gpt2)/grub
@@ -33,24 +33,17 @@ else
    set log="loglevel=4"
 fi

-# From board/common/rootfs/etc/partition-uuid
-search -p 107ae911-a97b-4380-975c-7ce1a2dde1e0 --set primary
-search -p 352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02 --set secondary
-
-export primary
-export secondary
-
 submenu "primary" "$log" {
    set slot="$1"
-    set append="console=ttyS0 console=hvc0 root=PARTLABEL=$slot $2"
-    set root="($primary)"
+    set append="console=ttyS0 root=PARTLABEL=$slot $2"
+    set root=(hd0,gpt3)
    source /boot/grub/grub.cfg
 }

 submenu "secondary" "$log"  {
    set slot="$1"
-    set append="console=ttyS0 console=hvc0 root=PARTLABEL=$slot $2"
-    set root="($secondary)"
+    set append="console=ttyS0 root=PARTLABEL=$slot $2"
+    set root=(hd0,gpt4)
    source /boot/grub/grub.cfg
 }

@@ -63,7 +56,7 @@ submenu "net" "$log"  {
 	set root=(initrd)

 	set slot="$1"
-	set append="console=ttyS0 console=hvc0 qroot=/dev/ram0 ramdisk_size=65536 $2"
+	set append="console=ttyS0 root=/dev/ram0 ramdisk_size=65536 $2"
 	source /boot/grub/grub.cfg
    else
 	if [ -z "$net_efinet0_dhcp_next_server" ]; then
@@ -13,9 +13,7 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
-BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
@@ -47,6 +45,7 @@ BR2_PACKAGE_EUDEV_RULES_GEN=y
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_MEMTESTER=y
 BR2_PACKAGE_RNG_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
@@ -155,5 +154,3 @@ BR2_PACKAGE_LIBINPUT=y
 DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
@@ -112,7 +112,7 @@ BR2_TARGET_ROOTFS_SQUASHFS=y
 BR2_TARGET_EDK2=y
 BR2_TARGET_GRUB2=y
 BR2_TARGET_GRUB2_X86_64_EFI=y
-BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback cat search"
+BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback"
 BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
 BR2_TARGET_GRUB2_INSTALL_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
@@ -156,5 +156,3 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
@@ -4,38 +4,23 @@ Change Log
 All notable changes to the project are documented in this file.


-[v24.04.0][] - 2024-04-30
+[v24.03.0][UNRELEASED]
 -------------------------

-**News:** this release marks the first major upgrade of the underlying
-Buildroot to the latest LTS release, v2024.02.  This caused a few small
-regressions in the release cycle, all known issues have been addressed.
-
-Also worth highlighting, as of this release the Infix Classic variant
-has been dropped.  It was the legacy Infix with manual configuration of
-the system using a persistent `/etc`.  May be resurrected later as a
+Please note, as of this release the Infix Classic variant has been
+dropped.  This was the legacy, pre-NETCONF, Infix with manual config of
+the system using a persistent `/etc`.  It may be resurrected later as a
 separate project.  Going forward Infix' focus is entirely on NETCONF.

-Finally, the YANG Status section has been dropped for this release, the
-idea is to generate supported features from the models and include in
-future releases.
+> Development in progress, for daily updates see the team board:
+> <https://github.com/orgs/kernelkit/projects/3/views/2>

 ### Changes
- Bump the base Buildroot version to v2024.02 LTS
- Bump the base Linux kernel version to 6.6 LTS
+- Bump the base Linux kernel version to 6.6
 - Drop Classic variant to reduce overhead, simplify build & release
  processes, and focus on NETCONF for Arm64 and Amd64 platforms
 - Add hostname restrictions to ietf-system, and infix-dhcp-client
  models.  Max 64 characters on Linux systems
- Add mDNS CNAME (alias) advertisement, e.g., infix.local in addition to
-  the default infix-c0-ff-ee.local.  Note: this is build-specific and
-  does not change if system hostname is changed
- Add mDNS browser web application, https://network.local that shows all
-  mDNS devices on the LAN.  The network.local mDNS name is also a CNAME,
-  so with multiple Infix devices, only one will act as the mDNS browser
- Add temporary landing page to web server for https://infix.local
- Add web console using ttyd, https://infix.local:7681
- Add support for disabling web services using CLI
 - The bridge model now has built-in validation of port memberships,
  i.e., a port must be a bridge member to be used in VLAN filtering
 - The bridge model only permits the bridge itself to be a tagged
@@ -43,49 +28,8 @@ future releases.
  such bridges is to use a VLAN interface on top
 - A VLAN filtering bridge now validates that no IP address has been
  set.  Use a VLAN interface on top for that (see above)
- Restructure documentation, let first page in doc/ be table of contents
- Scripting Infix, new document on how to script Infix from remote,
-  e.g., for production or from a container
- Introduction, update documentation now that the `admin` user's default
-  login shell is `/bin/bash`
- System documentation, first outline of how to change hostname, add
-  users, add system administrator users, changing login banner, change
-  the system default editor, and more
- Network documentation, add section on VETH pairs
- Container documentation:
-  - CLI prompts have been updated to match the examples used in other
-    parts of the User Guide
-  - Default route example for static container interfaces
-  - How to upgrade a container image
- As a follow-up to port speed/duplex/autoneg support added in v24.02,
-  this release ensures flow-control is always disabled on all Ethernet
-  ports, as described in the IEEE Ethernet interfaces YANG model
- Add support for core dumps, saving them in `/var/crash`, max one dump
-  per process, for use with future support tarballs
- Add support for multicast snooping, both IPv4 (IGMP) and IPv6 (MLD) in
-  bridge setups, including offloading to switchdev
- Add support for acting as passive (proxy) or active IGMP querier
- Add support for static multicast filters, MAC, IPv4 and IPv6 groups
-  are supported -- multicast snooping must be enabled
- Include Buildroot `legal-info` in releases, i.e., licenses, sources
-  with patches, as well as csv files for packages and toolchain
- Drop `shell` command from CLI to allow confining users
- The CLI `copy` command now allows absolute paths
- Local resolver, `dnsmasq`, had port 53 visible from external `nmap`
-  scans, even though it dropped non-local requests, it now only binds to
-  the loopback interface reduce number of externally visible ports
- Kernel log messages, of severity error or higher, now log directly to
-  the console.  This may cause some annoyance but has been enabled to
-  ease debugging, in particular issues where the system crashes before
-  the syslog daemon has flushed logs to disk.  (Logs are still saved to
-  log files as well.)
- Issue #325: Add support for multiple administrator users by opening
-  up basic NETCONF ACM support.  See documentation for details
-  - Any user can be added to the `admin` NACM group
-  - Any user *not* in the `admin` group is not allowed to have a login
-    shell other than the CLI (or disabled).  POSIX shell, e.g., Bash is
-	reserved for system administrators
- Issue #327: Remove IPv6LL from bridge port interfaces
+- Container documentation: CLI prompts have been updated to match the
+  examples used in other parts of the User Guide
 - Issue #358: translate YANG model's LOWER-LAYER-DOWN -> LINK-DOWN in
  CLI `show interfaces` command
 - Issue #360: document factory-config, startup-config, and the various
@@ -97,12 +41,20 @@ future releases.
  users to avoid enabling privileged mode
 - Issue #367: setting date/time over NETCONF now saves system time also
  to the RTC, which otherwise is only saved on reboot or power-down
+- Add support for static multicast filters, MAC, IPv4 and IPv6 groups
+  are supported.
+- Include Buildroot `legal-info` in releases, i.e., licenses, sources
+  with patches, as well as csv files for packages and toolchain
 - Issue #369: Remove limitation that the routing instance must be
  named 'default'

 ### Fixes
- confd: Fix memory leak when operating on candidate configuration
- probe: Fix crash on systems without USB
+- Issue #391 Creating VLAN interface in the CLI with "edit interface vlanN"
+  does not set VLAN id to N.
+- confd: Fix memory leak when operating on candidate configuration.
+- CLI: fix VLAN inference for interfaces named `eth0.1`, i.e., VID 1 on
+  lower-layer-if `eth0`.  Only affects automatic inference in the CLI,
+  entering the values manually (CLI/NETCONF) not affected by this bug
 - Reduced syslog errors for accesses no non-existing xpaths
 - Fix bogus warning about not properly updating `/etc/motd` in new
  `motd-banner` setting, introduced in v24.02.0
@@ -111,16 +63,8 @@ future releases.
 - Fix #328: when setting up a VLAN filtering bridge, the PVID for bridge
  ports defaulted to 1, making it impossible to set up "tagged-only"
  ports which drop ingressing untagged traffic
- Fix #329: VLAN inference for interfaces named `eth0.1`, i.e., VID 1 on
-  lower-layer-if `eth0`.  Only affects automatic inference in the CLI,
-  entering the values manually (CLI/NETCONF) not affected by this bug
- Fix #331: inconsistent naming of 'enabled' in infix-routing.yang
- Fix #349: minor changes to `bridge-port` settings, like setting `pvid`
-  when you forget it, did not take without a reboot
- Fix #353: impossible to remove bridge port with `no bridge-port`
 - Fix #358: MAC address no longer shown for bridge interfaces in CLI
  `show interfaces` command
- Fix #365: not possible to run `ping` from container
 - Fix #366: static routes from container host interfaces do not work.
  Documentation updated with an example
 - Fix #368: upgrading `oci-archive:/` images fail because system thinks
@@ -130,25 +74,8 @@ future releases.
  declare `network` settings, Infix v23.02 had a late regression that
  reverted back to the podman default: network behind a CNI bridge
  (firewalled and NAT:ed, hidden from the rest of the network)
- Fix #375: k8s-logger, used for containers, does not exit properly and
-  causes 100% CPU load when container stop or are restarted.  Also in
-  this issue: handle ip/route additions to container networks at runtime
- Fix #384: segfault in helper function when disabling the DHCP client
+- Fix #385: segfault in helper function when disabling the DHCP client
  using `no dhcp-client` from the CLI
- Fix #391 Creating VLAN interface in the CLI with "edit interface vlanN"
-  does not set VLAN id to N.
- Fix #404: `lldpd` should be disabled on internal interface `dsa0`
- Fix #406: an overly restrictive `when` expression in the bridge YANG
-  model prevented users from adding VLAN interfaces as bridge ports.
-  E.g., creating interface `eth0.10` and adding that to `br0`
- Fix #412: after starting up with DHCP client enabled on any interface
-  `set dhcp-client enabled false` does not bite at runtime
- Fix #414: spelling error in `infix-hardware.yang`, leaf node `coutry`
- Fix #415: `startup-config` owned by `root` user and group instead of
-  `admin`.  The file ownership is now adjusted on every boot
- Fix #416: `admin` user cannot perform a factory reset with RPC using
-  `sysrepocfg` tool over SSH
- Fix bogus syslog warning about not updating `/etc/motd` properly


 [v24.02.0][] - 2024-03-01
@@ -843,8 +770,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.04.0...HEAD
-[v24.04.0]:   https://github.com/kernelkit/infix/compare/v24.02.0...v24.04.0
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.02.0...HEAD
 [v24.02.0]:   https://github.com/kernelkit/infix/compare/v23.11.0...v24.02.0
 [v23.11.0]:   https://github.com/kernelkit/infix/compare/v23.10.0...v23.11.0
 [v23.10.0]:   https://github.com/kernelkit/infix/compare/v23.09.0...v23.10.0
@@ -66,8 +66,7 @@ The instructions here are for Debian/Ubuntu based systems (YMMV):
 $ sudo apt install bc binutils build-essential bzip2 cpio \
                   diffutils file findutils git gzip      \
                   libncurses-dev libssl-dev perl patch   \
-                   python3 rsync sed tar unzip wget       \
-                   autopoint
+                   python rsync sed tar unzip wget
 ```

 For testing, a few more tools and services are required on your system:
@@ -114,169 +114,6 @@ admin@example:/config/interface/br0/> set bridge vlans vlan 20 tagged br0
 > on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
 > below for more on this topic.

-#### Multicast Filtering and Snooping
-
-Multicast filtering in the bridge is handled by the bridge itself.  It
-can filter both IP multicast and MAC multicast.  For IP multicast it
-also supports "snooping", i.e., IGMP and MLD, to automatically reduce
-the broadcast effects of multicast.  See the next section for a summary
-of the [terminology used](#terminology--abbreviations).
-
-> **Note:** currently there is no way to just enable multicast filtering
-> without also enabling snooping.  This may change in the future, in
-> which case a `filtering` enabled setting will be made available along
-> with the existing `snooping` setting.
-
-When creating your bridge you must decide if you need a VLAN filtering
-bridge or a plain bridge (see previous section).  Multicast filtering is
-supported for either, but take note that it must be enabled and set up
-per VLAN when VLAN filtering is enabled -- there are no global multicast
-settings in this operating mode.
-
-In the following example we have a regular 8-port bridge without VLAN
-filtering.  We focus on the multicast specific settings:
-
-```
-admin@example:/> configure
-admin@example:/config/> edit interface br0
-admin@example:/config/interface/br0/> set bridge multicast snooping
-admin@example:/config/interface/br0/> set ipv4 address 192.168.2.1 prefix-length 24
-admin@example:/config/interface/br0/> leave
-admin@example:/> copy running-config startup-config
-```
-
-Here we enable snooping and set a static IPv4 address so that the switch
-can take part in IGMP querier elections.  (MLD querier election
-currently not supported.)  We can inspect the current state:
-
-```
-admin@example:/> show ip multicast
-Multicast Overview
-Query Interval (default): 125 sec
-Router Timeout          : 255
-Fast Leave Ports        :
-Router Ports            :
-Flood Ports             : e0, e1, e2, e3, e4, e5, e6, e7
-
-Interface       VID  Querier                     State  Interval  Timeout  Ver
-br0                  192.168.2.1                    Up       125     None    3
-
-Bridge          VID  Multicast Group       Ports
-br0                  224.1.1.1             e3, e2
-br0                  ff02::6a              br0
-```
-
-It is a small LAN, so our bridge has already become the elected IGMP
-querier.  We see it is ours because the timeout is `None`, and we
-recognize our IP address.  We can also see two ports that have joined
-the same IPv4 multicast group, 224.1.1.1, and one join from Infix itself
-for the IPv6 group ff02::6a.
-
-Now, let's see what happens when we add another bridge, with VLAN
-filtering enabled.  We skip the boring parts about how to move ports
-e4-e7 to `br1` and assign them to VLANs, and again, focus on the
-multicast bits only:
-
-```
-admin@example:/> configure
-admin@example:/config/> edit interface br1
-admin@example:/config/interface/br1/> set bridge vlans vlan 1 multicast snooping
-admin@example:/config/interface/br1/> set bridge vlans vlan 2 multicast snooping
-admin@example:/config/interface/br1/> leave
-admin@example:/> copy running-config startup-config
-```
-
-Let's see what we get:
-
-```
-admin@example:/> show ip multicast
-Multicast Overview
-Query Interval (default): 125 sec
-Router Timeout          : 255
-Fast Leave Ports        : e5
-Router Ports            : e1, e2, e5, e6, e7
-Flood Ports             : e1, e2, e3, e4, e5, e6, e7, e8
-
-Interface       VID  Querier                     State  Interval  Timeout  Ver
-br0                  192.168.2.1                    Up       125     None    3
-br1               1  0.0.0.0                        Up       125     None    3
-br1               2  0.0.0.0                        Up       125     None    3
-
-Bridge          VID  Multicast Group       Ports
-br0                  224.1.1.1             e2
-br0                  ff02::fb              br0
-br0                  ff02::6a              br0
-br0                  ff02::1:ff00:0        br0
-br1               1  224.1.1.1             e5
-br1               2  224.1.1.1             e7
-br1               1  ff02::fb              br1
-br1               1  ff02::1:ff00:0        br1
-```
-
-In this setup we have a lot more going on.  Multiple multicast router
-ports have been detected, and behind the scenes someone has also added
-an IGMP/MLD fast-leave port.
-
-##### Terminology & Abbreviations
-
- - **IGMP**: Internet Group Membership Protocol, multicast subscription
-   for IPv4, for details see [RFC3376][]
- - **MLD**: Multicast Listener Discovery (Protocol), multicast
-   subscription for IPv6, for details see [RFC3810][]
- - **Unknown/Unregistered multicast**: multicast groups that are *not*
-   in the multicast forwarding database (MDB)
- - **Known/Registered multicast**: multicast groups that *are* in the
-   multicast forwarding database (MDB)
- - **MDB**: the multicast forwarding database, consists of filters for
-   multicast groups, directing where multicast is allowed to egress.  A
-   filter entry consists of a group and a port list.  The bridge filters
-   with a unique database per VLAN, in the same was as the unicast FDB
- - **Join/Leave**: the terminology used in earlier versions of the two
-   protocols to subscribe and unsubscribe to a multicast group.  For
-   more information, see *Membership Report*
- - **Membership Report** A membership report is sent by end-devices and
-   forwarded by switches to the elected querier on the LAN.  They
-   consist of multiple "join" and "leave" operations on groups.  They
-   can also, per group, list which senders to allow or block.  Switches
-   usually only support the group subscription, and even more common
-   also only support filtering on the MAC level[^3]
- - **Querier election**: the process of determining who is the elected
-   IGMP/MLD querier on a LAN.  Lowest numerical IP address wins, the
-   special address 0.0.0.0 (proxy querier) never wins
- - **Proxy querier**: when no better querier exists on a LAN, one or
-   more devices can send proxy queries with source address 0.0.0.0 (or
-   :: for IPv6).  See **Query Interval**, below, why this is a good
-   thing
- - **Query interval**: the time in seconds between two queries from an
-   IGMP/MLD querier.  It is not uncommon that end-devices do not send
-   their membership reports unless they first hear a query
- - **Fast Leave**: set on a bridge port to ensure multicast is pruned as
-   quickly as possible when a "leave" membership report is received.  In
-   effect, this option marks the port as directly connected to an
-   end-device.  When not set (default), a query with timeout is first
-   sent to ensure no unintentional loss of multicast is incurred
- - **Router port**: can be both configured statically and detected at
-   runtime based on connected devices, usually multicast routers.  On
-   a router port *all* multicast is forwarded, both known and unknown
- - **Flood port**: set on a bridge port (default: enabled) to ensure
-   all *unknown* multicast is forwarded
- - **Router timeout**: the time in seconds until a querier is deemed to
-   have been lost and another device (switch/router) takes over.  In the
-   tables shown above, a *None* timeout is declared when the current
-   device is the active querier
-
-> **Note:** the reason why multicast flooding is enabled by default is
-> to ensure safe co-existence with MAC multicast, which is very common
-> in industrial networks.  It also allows end devices that do not know
-> of IGMP/MLD to communicate over multicast as long as the group they
-> have chosen is not used by other IGMP/MLD aware devices on the LAN.
->
-> As soon as an IGMP/MLD membership report to "join" a group is received
-> the group is added to the MDB and forwarding to other ports stop.  The
-> only exception to this rule is multicast router ports.
-
-[RFC3376]: https://www.rfc-editor.org/rfc/rfc3376.html
-[RFC3810]: https://www.rfc-editor.org/rfc/rfc3810.html

 ### VLAN Interfaces

@@ -797,7 +634,3 @@ currently supported, namely `ipv4` and `ipv6`.
 [^2]: Link-local IPv6 addresses are implicitly enabled when enabling
    IPv6.  IPv6 can be enabled/disabled per interface in the
    [ietf-ip][2] YANG model.
-[^3]: For example, IPv4 groups are mapped to MAC multicast addresses by
-    mapping the low-order 23-bits of the IP address in the low-order 23
-    bits of the Ethernet address 01:00:5E:00:00:00.  Meaning, more than
-	one IP multicast group maps to the same MAC multicast group.
@@ -168,9 +168,9 @@ There are two ways to do it:
 1. Change the configuration without saving it to `startup-config`
 2. Change the operational state

-The first involves sending a NETCONF command/config in XML. The second
-we will cover here. We start by querying available interfaces (ports) on
-the remote system:
+The first involves sending a NETCONF command/config in XML, the second
+we will cover here.  We start by querying available interfaces (ports)
+on the remote system:

 ```
 ~$ ssh admin@infix.local%qtap0 ip -br a
@@ -331,364 +331,6 @@ admin@infix.local%eth0's password: *****
 ~$ 
 ```

-
-## Examples using SSH and sysrepocfg
-
-
-[sysrepocfg][4] can be used to interact with the YANG models when logged
-in to infix. Thus, *set config*, *read config*, *read status* and
-*RPC* can be conducted using sysrepocfg for supported YANG models. 
-It is possible to make configuration changes by operating on the
-*startup* database.
-
-See [sysrepocfg][4] for information. Examples below will utilize 
-
-
-
- `sysrepocfg -I FILE -fjson -d DATABASE` to import/write a JSON
-  formatted configuration file to the specificed database.
- `sysrepocfg -E FILE -fjson -d DATABASE` to edit/merge JSON formatted
-  configuration in FILE with the specificed database.
-  `sysrepocfg -R FILE -fjson` to execute remote procdure call (RPC) defined in
-   FILE (JSON formatted). 
- `sysrepocfg -X -fjson -d DATABASE -x xpath` to read configuration or
-  status from specified database.
-  
-For importing (-I) and editing (-E), `-d running` is typically used in
-examples below. Specify `-d startup` to apply changes to startup
-configuration. Exporting (-X) could operate on configuration (e.g.,
-`-d running`) or status (`-d operational`).
-
-Some commands require a file as input. In examples below we assume 
-it been transfered to Infix in advance, e.g. using `scp` as shown below.
-
-```
-~$ cat file.json 
-{
-   "ietf-factory-default:factory-reset": {
-   }
-}
-~$ scp file.json admin@example.local:/tmp/file.json
-~$
-```
-
-### Factory Reset Using sysrepocfg
-
-
-```
-~$ cat file.json 
-{
-   "ietf-factory-default:factory-reset": {
-   }
-}
-~$ scp file.json admin@example.local:/tmp/file.json
-~$ ssh admin@example.local 'sysrepocfg -fjson -R /tmp/file.json'
-^C
-~$ 
-```
-See [Factory Reset](#factory-reset) for another (simpler) alternative.
-
-If you only wish to copy factory config to running config the
-following RPC is available
-
-```
-~$ cat file.json 
-{
-   "infix-factory-default:factory-default": {
-   }
-}
-~$ scp file.json admin@example.local:/tmp/file.json
-~$ ssh admin@example.local 'sysrepocfg -fjson -R /tmp/file.json'
-^C
-~$ 
-```
-
-
-### System Reboot Using sysrepocfg
-
-
-```
-~$ cat /tmp/file.json 
-{
-   "ietf-system:system-restart": {
-   }
-}
-~$ scp file.json admin@example.local:/tmp/file.json
-~$ ssh admin@example.local 'sysrepocfg -fjson -R /tmp/file.json'
-~$
-```
-See [System Reboot](#system-reboot) for another (simpler) alternative.
-
-
-
-### Set Date and Time Using sysrepocfg
-
-
-```
-~$ ssh admin@example.local 'date'
-Sun Nov 20 10:20:23 UTC 2005
-~$ cat file.json
-{
-   "ietf-system:set-current-datetime": {
-	"current-datetime": "2024-04-17T13:48:02-01:00"
-   }
-}
-~$ scp file.json admin@example.local:/tmp/file.json
-~$ ssh admin@example.local 'sysrepocfg -fjson -R /tmp/file.json'
-~$ ssh admin@example.local 'date'
-Wed Apr 17 14:48:12 UTC 2024
-~$ 
-```
-See [Set Date and Time](#set-date-and-time) for another (simpler) alternative.
-
-### Remote Control of Ethernet Ports Using sysrepocfg
-
-
-Reading administrative status of interface *e0* of running configuration.
-
-```
-~$ ssh admin@example.local 'sysrepocfg -X -fjson -d running -e report-all -x \"/ietf-interfaces:interfaces/interface[name='e0']/enabled\"'
-{
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "e0",
-        "enabled": true
-      }
-    ]
-  }
-}
-~$
-```
-> Note: Without `-e report-all` argument the line `"enabled: true`
-> would not be shown as `true` is default.
-
-```
-~$ ssh admin@example.local "sysrepocfg -X -fjson -d running -x \"/ietf-interfaces:interfaces/interface[name='e0']/enabled\""
-{
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "e0"
-      }
-    ]
-  }
-}
-~$
-```
-
-
-Setting the administrative status of interface *e0* of running configuration.
-
-```
-$ cat file.json
-{
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "e0",
-        "enabled": false
-      }
-    ]
-  }
-}
-~$ scp file.json admin@example.local:/tmp/file.json
-~$ ssh admin@example.local 'sysrepocfg -E /tmp/file.json -fjson -d running' 
-~$
-```
-
-### Enable/Disable DHCPv4 client
-
-
-Enabling DHCPv4 client on interface *e0*, with current default options.
-
-```
-~$ cat /tmp/file.json 
-{
-  "infix-dhcp-client:dhcp-client": {
-    "enabled": true,
-    "client-if": [
-      {
-        "if-name": "e0"
-      }
-    ]
-  }
-}
-~$ scp file.json admin@example.local:/tmp/file.json
-~$ ssh admin@example.local 'sysrepocfg -E /tmp/file.json -fjson -d running' 
-~$
-```
-
-Disabling DHCPv4 client. 
-
-```
-~$ cat /tmp/file.json 
-{
-  "infix-dhcp-client:dhcp-client": {
-    "enabled": false
-  }
-}
-~$ scp file.json admin@example.local:/tmp/file.json
-~$ ssh admin@example.local 'sysrepocfg -E /tmp/file.json -fjson -d running' 
-~$
-```
-
-Configuration for client interface *e0* remains, but does not apply as
-DHCPv4 is disabled. 
-
-```
-admin@example:~$ sysrepocfg -X -fjson -d running -x "/infix-dhcp-client:dhcp-client" 
-{
-  "infix-dhcp-client:dhcp-client": {
-    "enabled": false,
-    "client-if": [
-      {
-        "if-name": "e0"
-      }
-    ]
-  }
-}
-admin@example:~$ 
-```
-
-To fully remove the DHCPv4 client configuration or a specific
-*client-if* with sysrepocfg, one would need to read out the full
-configuration, remove relevant parts and read back.
-
-
-### Enable/Disable IPv6
-
-IPv6 is typically enabled on all interfaces by default. The example
-below shows IPv4 and IPv6 addresses assigned on *e0*.
-
-```
-~$ ssh admin@example.local 'ip addr show dev e0'
-2: e0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
-    link/ether 02:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
-    inet 10.0.2.15/24 scope global proto dhcp e0
-       valid_lft forever preferred_lft forever
-    inet6 fec0::ff:fe00:0/64 scope site dynamic mngtmpaddr proto kernel_ra 
-       valid_lft 86380sec preferred_lft 14380sec
-    inet6 fe80::ff:fe00:0/64 scope link proto kernel_ll 
-       valid_lft forever preferred_lft forever
-~$
-```
-
-IPv6 is enabled/disabled per interface. The example below disables IPv6
-on interface *e0*.
-
-```
-~$ cat /tmp/file.json 
-{
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "e0",
-        "ietf-ip:ipv6": {
-          "enabled": false
-        }
-      }
-    ]
-  }
-}
-~$ scp file.json admin@example.local:/tmp/file.json
-~$ ssh admin@example.local 'sysrepocfg -E /tmp/file.json -fjson -d running' 
-~$ ssh admin@example.local 'ip addr show dev e0'
-2: e0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
-    link/ether 02:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
-    inet 10.0.2.15/24 scope global proto dhcp e0
-       valid_lft forever preferred_lft forever
-~$ 
-```
-
-### Backup Configuration Using sysrepocfg And scp
-
-Displaying running or startup configuration is possible with
-`sysrepocfg -X`, as shown below.
-
-```
-~$ ssh admin@example.local 'sysrepocfg -X -fjson -d running'
-{
-  "ieee802-dot1ab-lldp:lldp": {
-    "infix-lldp:enabled": true
-...
-~$
-```
-
-An example for backing up startup configuration from remote PC.
-
-```
-~$ ssh admin@example.local 'sysrepocfg -X -fjson -d startup > /tmp/backup.json'
-~$ scp admin@example.local:/tmp/backup.json .
-~$
-```
-
-Or possibly skip intermediate storage of file 
-```
-~$ ssh admin@example.local 'sysrepocfg -X -fjson -d startup' > backup.json
-~$
-```
-
-A final example is to only use `scp`. This is simpler, but only works to backup the
-startup configuration (not running).
-
-```
-~$ scp admin@example.local:/cfg/startup-config.cfg backup.json
-~$
-```
-
-### Restore Configuration Using sysrepocfg and ssh/scp
-
-
-To restore a backup configuration to startup, the simplest way is to
-use `scp` and reboot as shown below
-
-```
-~$ scp admin@example.local:/cfg/startup-config.cfg backup.json
-~$ ssh admin@example.local 'reboot'
-Connection to switch.local closed by remote host.
-~$ 
-```
-
-An alternative method to restore a backup configuration is to use the
-`sysrepocfg -I FILE` (import) command.
-
-The example below imports the backup configuration to startup, and
-reboots the unit.
-
-```
-~$ scp backup.json admin@example.local:/tmp/ 
-~$ ssh admin@example.local 'sudo sysrepocfg -I /tmp/backup.json -fjson -d startup'
-~$ ssh admin@example.local 'reboot'
-Connection to switch.local closed by remote host.
-~$ 
-```
-
-> Note: admin login credentials (hash) are stored as part of the
-> configuration file. When replacing a switch and applying the backed 
-> up configuration from the former switch, the password on the
-> replacement unit will also change.
-
-### Copy Running to Startup Using sysrepocfg
-
-The following command reads out the running config via `sysrepocfg -X`
-and writes the result to the startup configuration.
-
-```
-~$ ssh admin@example.local 'sysrepocfg -X -fjson -d running > /cfg/startup-config.cfg'
-~$
-```
-
-An alternative is to write it to a temporary file, and use `sysrepocfg
-I` to import it to startup.
-
-```
-~$ ssh admin@example.local 'sysrepocfg -X -fjson -d running > /tmp/running.json'
-~$ ssh admin@example.local 'sysrepocfg -I /tmp/running.json -fjson -d startup'
-~$
-```
-
 [1]: discovery.md
 [2]: https://rauc.io/
 [3]: boot.md#system-upgrade
-[4]: https://netopeer.liberouter.org/doc/sysrepo/libyang1/html/sysrepocfg.html
@@ -70,72 +70,6 @@ admin@host:/config/system/authentication/user/admin/authorized-key/example@host/
 > does the job.


-## Multiple Users
-
-The system supports multiple users and multiple user levels, or groups,
-that a user can be a member of.  Access control is entirely handled by
-the NETCONF ["NACM"][3] YANG model, which provides granular access to
-configuration, data, and RPC commands over NETCONF.
-
-By default the system ships with a single group, `admin`, which the
-default user `admin` is a member of.  The broad permissions granted by
-the `admin` group is what gives its users full system administrator
-privileges.  There are no restrictions on the number of users with
-administrator privileges, nor is the `admin` user reserved or protected
-in any way -- it is completely possible to remove the default `admin`
-user from the configuration.  However, it is recommended to keep at
-least one user with administrator privileges in the system, otherwise
-the only way to regain full access is to perform a *factory reset*.
-
-### Adding a User
-
-Similar to how to change password, adding a new user is done using the
-same set of commands:
-
-```
-admin@host:/config/> edit system authentication user jacky
-admin@host:/config/system/authentication/user/jacky/> change password
-New password:
-Retype password:
-admin@host:/config/system/authentication/user/jacky/> leave
-```
-
-An authorized SSH key is added the same way as presented previously.
-
-### Adding a User to the Admin Group
-
-The following commands add user `jacky` to the `admin` group.
-
-```
-admin@host:/config/> edit nacm group admin
-admin@host:/config/nacm/group/admin/> set user-name jacky
-admin@host:/config/nacm/group/admin/> leave
-```
-
-### Security Aspects
-
-The NACM user levels apply primarily to NETCONF, with exception of the
-`admin` group which is granted full system administrator privileges to
-the underlying UNIX system with the following ACL rules:
-
-```json
-   ...
-   "module-name": "*",
-   "access-operations": "*",
-   "action": "permit",
-   ...
-```
-
-A user in the `admin` group is allowed to also use a POSIX login shell
-and use the `sudo` command to perform system administrative commands.
-This makes it possible to use all the underlying UNIX tooling, which
-to many can be very useful, in particular when debugging a system, but
-please remember to use with care -- the system is not built to require
-managing from the shell.  The tools available in the CLI and automated
-services, started from the system's configuration, are the recommended
-way of using the system, in addition to NETCONF tooling.
-
-
 ## Changing Hostname

 Notice how the hostname in the prompt does not change until the change
@@ -203,4 +137,3 @@ admin@host:/>

 [1]: https://www.rfc-editor.org/rfc/rfc7317
 [2]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-system%402024-02-29.yang
-[3]: https://www.rfc-editor.org/rfc/rfc8341
@@ -10,11 +10,10 @@ run name:error :1 log:console norestart if:<run/bootstrap/failure> \
 service name:confd log <run/bootstrap/success> \
 	[S12345] sysrepo-plugind -f -p /run/confd.pid -n -- Configuration daemon

-# Bootstrap system with startup-config, ensure correct ownership
+# Bootstrap system with startup-config
 run name:startup log:prio:user.notice norestart <pid/confd> \
 	[S] /usr/libexec/confd/load startup-config \
 	-- Loading startup-config
-task [S] <pid/confd> chown admin:wheel /cfg/startup-config.cfg --

 # Run if loading startup-config fails for some reason
 run name:failure log:prio:user.critical norestart <pid/confd> if:<run/startup/failure> \
@@ -11,7 +11,7 @@ CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
 CONFD_LICENSE = BSD-3-Clause
 CONFD_LICENSE_FILES = LICENSE
 CONFD_REDISTRIBUTE = NO
-CONFD_DEPENDENCIES = augeas jansson libite sysrepo libsrx libglib2
+CONFD_DEPENDENCIES = augeas jansson libite sysrepo libsrx
 CONFD_AUTORECONF = YES
 define CONFD_CONF_ENV
 CFLAGS="$(INFIX_CFLAGS)"
@@ -22,7 +22,7 @@ EXECD_CONF_OPTS = --prefix= --disable-silent-rules
 define EXECD_INSTALL_EXTRA
 	cp $(EXECD_PKGDIR)/execd.conf  $(FINIT_D)/available/
 	ln -sf ../available/execd.conf $(FINIT_D)/enabled/execd.conf
-	cp $(EXECD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/lib/tmpfiles.d/execd.conf
+	cp $(EXECD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/etc/tmpfiles.d/execd.conf
 endef
 EXECD_TARGET_FINALIZE_HOOKS += EXECD_INSTALL_EXTRA

@@ -1,117 +0,0 @@
-From 6a89e60fc84b90e5f09f61d37892f3b17bd14631 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Wed, 24 Apr 2024 11:33:35 +0200
-Subject: [PATCH 10/11] Fix #405: parsing >1 active consoles in tty @console
- setups
-Organization: Addiva Elektronik
-
-Systems that have the following tty setup and multiple consoles listed
-in /sys/class/tty/console/active misbehave:
-
-    tty [12345789] @console 0 xterm noclear passenv
-
-Only the first listed console is started properly, the remaining ones
-were registered using the wrong :ID and no arguments to getty.
-
-This patch fixes the parsing and re-use of the base paramenters for
-all consoles listed in the active file.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- src/service.c | 45 +++++++++++++++++++++++----------------------
- 1 file changed, 23 insertions(+), 22 deletions(-)
-
-diff --git a/src/service.c b/src/service.c
-index eca9ed0..95a04b8 100644
--- a/src/service.c
-+++ b/src/service.c
-@@ -1633,10 +1633,16 @@ int service_register(int type, char *cfg, struct rlimit rlimit[], char *file)
- 
- 	if (type == SVC_TYPE_TTY) {
- 		size_t i, len = 0;
-+		char *ptr;
- 
- 		if (tty_parse_args(&tty, cmd, &args))
- 			return errno;
- 
-+		if (tty_isatcon(tty.dev))
-+			dev = tty_atcon();
-+		else
-+			dev = tty.dev;
-+	next:
- 		if (tty.cmd)
- 			len += strlen(tty.cmd);
- 		else
-@@ -1659,14 +1665,22 @@ int service_register(int type, char *cfg, struct rlimit rlimit[], char *file)
- 		if (!cmd)
- 			return errno;
- 
-		if (tty_isatcon(tty.dev))
-			dev = tty_atcon();
-		else
-			dev = tty.dev;
-
- 		/* tty's always respawn, never incr. restart_cnt */
- 		respawn = 1;
-	next:
-+
-+		/* Create name:id tuple for identity, e.g., tty:S0 */
-+		ptr = strrchr(dev, '/');
-+		if (ptr)
-+			ptr++;
-+		else
-+			ptr = dev;
-+		if (!strncmp(ptr, "tty", 3))
-+			ptr += 3;
-+
-+		name = "tty";
-+		if (!id || id[0] == 0)
-+			id = ptr;
-+
- 		svc = svc_find_by_tty(dev);
- 	} else
- 		svc = svc_find(name, id);
-@@ -1722,8 +1736,6 @@ int service_register(int type, char *cfg, struct rlimit rlimit[], char *file)
- 	conf_parse_cond(svc, cond);
- 
- 	if (type == SVC_TYPE_TTY) {
-		char *ptr;
-
- 		if (dev)
- 			strlcpy(svc->dev, dev, sizeof(svc->dev));
- 		if (tty.baud)
-@@ -1738,19 +1750,6 @@ int service_register(int type, char *cfg, struct rlimit rlimit[], char *file)
- 
- 		/* TTYs cannot be redirected */
- 		log = NULL;
-
-		/* Create name:id tuple for identity, e.g., tty:S0 */
-		ptr = strrchr(svc->dev, '/');
-		if (ptr)
-			ptr++;
-		else
-			ptr = svc->dev;
-		if (!strncmp(ptr, "tty", 3))
-			ptr += 3;
-		if (!id || id[0] == 0)
-			id = ptr;
-		strlcpy(svc->name, "tty", sizeof(svc->name));
-		strlcpy(svc->id, id, sizeof(svc->id));
- 	}
- 
- 	parse_cmdline_args(svc, cmd, &args);
-@@ -1870,8 +1869,10 @@ int service_register(int type, char *cfg, struct rlimit rlimit[], char *file)
- 	/* continue expanding any 'tty @console ...' */
- 	if (tty_isatcon(tty.dev)) {
- 		dev = tty_atcon();
-		if (dev)
-+		if (dev) {
-+			id = NULL; /* reset for next tty:ID */
- 			goto next;
-+		}
- 	}
- 
- 	return 0;
-- 
-2.34.1
-
@@ -1,89 +0,0 @@
-From 340cae4afd0d11979322a6c2f4d40a12ea59817b Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Wed, 24 Apr 2024 12:46:59 +0200
-Subject: [PATCH 11/11] Change default behavior, allow kernel logs to console
-Organization: Addiva Elektronik
-
-A Linux system booted with the kernel command line option 'quiet' only
-logs error (and above) severity messages to the console.  For embedded
-systems, which is the primary target for Finit, this is what you want
-to see.
-
-Hence, and after careful consideration, this patch changes the default
-behavior of Finit to allow kernel logs to the console.  A build-time
-configure flags, --disable-kernel-logging, has been added to restore
-legacy behavior.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- configure.ac |  9 +++++++++
- src/finit.c  | 14 +++++++++++---
- 2 files changed, 20 insertions(+), 3 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index a4470d0..31f4cff 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -71,6 +71,10 @@ AC_ARG_ENABLE(redirect,
-         AS_HELP_STRING([--disable-redirect], [Disable redirection of service output to /dev/null]),,[
- 	enable_redirect=yes])
- 
-+AC_ARG_ENABLE(kernel_logging,
-+        AS_HELP_STRING([--disable-kernel-logging], [Disable kernel logging to console (use 'quiet' instead!]),,[
-+	enable_kernel_logging=yes])
-+
- AC_ARG_ENABLE(logrotate,
-         AS_HELP_STRING([--disable-logrotate], [Disable built-in rotation of /var/log/wtmp]),,[
- 	enable_logrotate=yes])
-@@ -181,6 +185,9 @@ AS_IF([test "x$enable_auto_reload" = "xyes"], [
- AS_IF([test "x$enable_kernel_cmdline" = "xyes"], [
-         AC_DEFINE(KERNEL_CMDLINE, 1, [Dumpster diving after init args from /proc/cmdline])])
- 
-+AS_IF([test "x$enable_kernel_logging" = "xyes"], [
-+        AC_DEFINE(KERNEL_LOGGING, 1, [Keep kernel warn/err logs to console])])
-+
- AS_IF([test "x$enable_fastboot" = "xyes"], [
- 	AC_DEFINE(FAST_BOOT, 1, [Skip fsck check on filesystems listed in /etc/fstab])])
- 
-@@ -382,6 +389,8 @@ Optional features:
-   Built-in sulogin......: $with_sulogin $sulogin
-   Built-in watchdogd....: $with_watchdog $watchdog
-   Built-in logrotate....: $enable_logrotate
-+  Parse kernel cmdline..: $enable_kernel_cmdline
-+  Keep kernel logging...: $enable_kernel_logging
-   Skip fsck check.......: $enable_fastboot
-   Run fsck fix mode.....: $enable_fsckfix
-   Redirect output.......: $enable_redirect
-diff --git a/src/finit.c b/src/finit.c
-index 27b81e9..38b1278 100644
--- a/src/finit.c
-+++ b/src/finit.c
-@@ -87,14 +87,22 @@ svc_t *wdog     = NULL;		/* No watchdog by default */
-  */
- static void banner(void)
- {
-+#ifndef KERNEL_LOGGING
- 	/*
- 	 * Silence kernel logs, assuming users have sysklogd or
-	 * similar enabled to start emptying /dev/kmsg, but for
-	 * our progress we want to own the console.
-+	 * similar enabled to start emptying /dev/kmsg.
-+	 *
-+	 * Instead of using `configure --disable-kernel-logging`, we
-+	 * recommend adjusting the kernel log level in the kernel's
-+	 * menuconfig, or using sysctl kernel.printk, or setting the
-+	 * desired log level, on the kernel cmdline, e.g. 'quiet'.
-+	 *
-+	 * By default KERNEL_LOGGING is enabled so you can see any
-+	 * warnings/errors or higher on your system console.
- 	 */
- 	if (!debug && !kerndebug)
- 		klogctl(6, NULL, 0);
-
-+#endif
- 	/*
- 	 * First level hooks, if you want to run here, you're
- 	 * pretty much on your own.  Nothing's up yet ...
-- 
-2.34.1
-
@@ -51,17 +51,6 @@ config BR2_PACKAGE_FINIT_INITCTL_GROUP
 	  to their shared UNIX group, usually "wheel", to allow
 	  them to start/stop services and reboot the system.

-config BR2_PACKAGE_FINIT_SILENCE_KERNEL
-	bool "Silence kernel logs to console"
-	default n
-	help
-	  By default, Finit >= 4.8 no longer disable kernel logging
-	  to console.  This option can be used to re-enable legacy
-	  klogctl() code to silence the kernel output.
-
-	  Please note, sysklogd has a similar command line option to
-	  keep kernel logging, which needs to be disabled as well.
-
 config BR2_PACKAGE_FINIT_KEVENTD
 	bool "finit-keventd"
 	default n
@@ -42,12 +42,6 @@ FINIT_CONF_OPTS += --without-fstab
 endif
 endif

-ifeq ($(BR2_PACKAGE_FINIT_SILENCE_KERNEL),y)
-FINIT_CONF_OPTS += --disable-kernel-logging
-else
-FINIT_CONF_OPTS += --enable-kernel-logging
-endif
-
 ifeq ($(BR2_PACKAGE_FINIT_KEVENTD),y)
 FINIT_CONF_OPTS += --with-keventd
 else
@@ -11,7 +11,7 @@ LIBSRX_LICENSE = BSD-3-Clause
 LIBSRX_LICENSE_FILES = LICENSE
 LIBSRX_INSTALL_STAGING = YES
 LIBSRX_REDISTRIBUTE = NO
-LIBSRX_DEPENDENCIES = sysrepo libite
+LIBSRX_DEPENDENCIES = sysrepo
 LIBSRX_AUTORECONF = YES
 define LIBSRX_CONF_ENV
 CFLAGS="$(INFIX_CFLAGS)"
@@ -1,2 +1,2 @@
-sha256  dcd639c77689c432e84e63267202c00958fb1032e066ae355e3cbc68d9fcd063  mcd-2.3.tar.gz
-sha256  99a0480db163445c5a1a5bf7f85bc37cbb5be8c40e9e441291ad78e8d4252d0b  LICENSE
+sha256 818c003ff153d914a829cd169a7cddb06643f423ebbf8b9e3932aad34c5ed60d  mcd-2.1.tar.gz
+sha256 99a0480db163445c5a1a5bf7f85bc37cbb5be8c40e9e441291ad78e8d4252d0b  LICENSE
@@ -4,11 +4,10 @@
 #
 ################################################################################

-MCD_VERSION = 2.3
+MCD_VERSION = 2.1
 MCD_SITE    = https://github.com/kernelkit/mcd/releases/download/v$(MCD_VERSION)
 MCD_LICENSE = BSD-3-Clause
 MCD_LICENSE_FILES = LICENSE
-MCD_CONF_OPTS = --disable-silent-rules --with-group=wheel

 define MCD_INSTALL_CONFIG
 	$(INSTALL) -D -m 0644 $(@D)/mcd.conf $(TARGET_DIR)/etc/mcd.conf
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_PYTHON_STATD
 	bool "python-statd"
 	select BR2_PACKAGE_HOST_PYTHON3
+	select BR2_PACKAGE_STATD
 	help
         Python helpers for statd.
@@ -1 +1 @@
-sha256  360336cbf0f228b12b7ca0996b33e442d97f496edcf2ec31b655e63631e7f96f  LICENSE
+sha256  755d3a387cd124ff34e2b73cc58e7cec4d8d85ae6c295e30ffeb8d36eacecb1d  LICENSE
@@ -1,8 +1,8 @@
 PYTHON_STATD_VERSION = 1.0
 PYTHON_STATD_SITE_METHOD = local
 PYTHON_STATD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/statd/python
-PYTHON_STATD_LICENSE = BSD-3-Clause
-PYTHON_STATD_LICENSE_FILES = LICENSE
+STATD_LICENSE = BSD-3-Clause
+STATD_LICENSE_FILES = LICENSE
 PYTHON_STATD_DEPENDENCIES = host-python3 python3 host-python-poetry-core
 PYTHON_STATD_SETUP_TYPE = pep517 # poetry

@@ -1,5 +1,5 @@
-# -l      :: Keep kernel looging to console
 # -m0     :: Disable periodic syslog MARK entries
 # -s      :: Enable secure mode, don't listen to remote logs
 # -r 1M:5 :: Log rotation every 1 MiB and keep 5 rotated ones
-SYSLOGD_ARGS="-l -m0 -s -r 1M:10"
+SYSLOGD_ARGS="-m0 -s -r 1M:5"
+
@@ -1 +1 @@
-sha256  360336cbf0f228b12b7ca0996b33e442d97f496edcf2ec31b655e63631e7f96f  LICENSE
+sha256  755d3a387cd124ff34e2b73cc58e7cec4d8d85ae6c295e30ffeb8d36eacecb1d  LICENSE
@@ -10,7 +10,7 @@ STATD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/statd
 STATD_LICENSE = BSD-3-Clause
 STATD_LICENSE_FILES = LICENSE
 STATD_REDISTRIBUTE = NO
-STATD_DEPENDENCIES = sysrepo libev libsrx jansson python-statd libyang
+STATD_DEPENDENCIES = sysrepo libev libsrx jansson python-statd
 STATD_AUTORECONF = YES

 define STATD_CONF_ENV
@@ -1,205 +0,0 @@
-commit 06dda0cf4e5ed8705c474c8ecec4e56d25169033
-Author: Mattias Walström <lazzer@gmail.com>
-Date:   Sat Apr 20 17:01:59 2024 +0200
-
-    This adds the feature to search for GPT partitions by
-    partition UUID.
-
-diff --git a/grub-core/Makefile.core.am b/grub-core/Makefile.core.am
-index 20efe61..f33e199 100644
--- a/grub-core/Makefile.core.am
-+++ b/grub-core/Makefile.core.am
-@@ -8610,6 +8610,26 @@ CLEANFILES += search_fs_file.marker
- search_fs_file.marker: $(search_fs_file_module_SOURCES) $(nodist_search_fs_file_module_SOURCES)
- 	$(TARGET_CPP) -DGRUB_LST_GENERATOR $(CPPFLAGS_MARKER) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(search_fs_file_module_CPPFLAGS) $(CPPFLAGS) $^ > $@.new || (rm -f $@; exit 1)
- 	grep 'MARKER' $@.new | grep -v '^#' > $@; rm -f $@.new
-+platform_PROGRAMS += search_partuuid.module
-+MODULE_FILES += search_partuuid.module$(EXEEXT)
-+search_partuuid_module_SOURCES  = commands/search_partuuid.c  ## platform sources
-+nodist_search_partuuid_module_SOURCES  =  ## platform nodist sources
-+search_partuuid_module_LDADD  =
-+search_partuuid_module_CFLAGS  = $(AM_CFLAGS) $(CFLAGS_MODULE)
-+search_partuuid_module_LDFLAGS  = $(AM_LDFLAGS) $(LDFLAGS_MODULE)
-+search_partuuid_module_CPPFLAGS  = $(AM_CPPFLAGS) $(CPPFLAGS_MODULE)
-+search_partuuid_module_CCASFLAGS  = $(AM_CCASFLAGS) $(CCASFLAGS_MODULE)
-+search_partuuid_module_DEPENDENCIES  = $(TARGET_OBJ2ELF)
-+dist_noinst_DATA +=
-+BUILT_SOURCES += $(nodist_search_partuuid_module_SOURCES)
-+CLEANFILES += $(nodist_search_partuuid_module_SOURCES)
-+MOD_FILES += search_partuuid.mod
-+MARKER_FILES += search_partuuid.marker
-+CLEANFILES += search_partuuid.marker
-+
-+search_partuuid.marker: $(search_partuuid_module_SOURCES) $(nodist_search_partuuid_module_SOURCES)
-+	$(TARGET_CPP) -DGRUB_LST_GENERATOR $(CPPFLAGS_MARKER) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(search_partuuid_module_CPPFLAGS) $(CPPFLAGS) $^ > $@.new || (rm -f $@; exit 1)
-+	grep 'MARKER' $@.new | grep -v '^#' > $@; rm -f $@.new
- platform_PROGRAMS += search_fs_uuid.module
- MODULE_FILES += search_fs_uuid.module$(EXEEXT)
- search_fs_uuid_module_SOURCES  = commands/search_uuid.c  ## platform sources
-diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index 1571421..b8ca02d 100644
--- a/grub-core/Makefile.core.def
-+++ b/grub-core/Makefile.core.def
-@@ -1087,6 +1087,11 @@ module = {
-   extra_dist = commands/search.c;
- };
-
-+module = {
-+  name = search_partuuid;
-+  common = commands/search_partuuid.c;
-+};
-+
- module = {
-   name = search_fs_file;
-   common = commands/search_file.c;
-diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
-index 263f150..135b27b 100644
--- a/grub-core/commands/search.c
-+++ b/grub-core/commands/search.c
-@@ -30,6 +30,7 @@
- #include <grub/i18n.h>
- #include <grub/disk.h>
- #include <grub/partition.h>
-+#include <grub/gpt_partition.h>
-
- GRUB_MOD_LICENSE ("GPLv3+");
-
-@@ -92,7 +93,55 @@ iterate_device (const char *name, void *data)
- #define compare_fn grub_strcmp
- #endif
-
-#ifdef DO_SEARCH_FILE
-+#if defined (DO_SEARCH_PARTUUID)
-+    {
-+      grub_device_t dev;
-+      char val[37] = "none";
-+
-+      dev = grub_device_open (name);
-+      if (!dev)
-+      {
-+        return grub_errno;
-+      }
-+      if (dev->disk && dev->disk->partition)
-+      {
-+        struct grub_partition *p = dev->disk->partition;
-+        grub_disk_t disk = grub_disk_open(dev->disk->name);
-+
-+        if (!disk)
-+        {
-+          grub_device_close (dev);
-+          return grub_errno;
-+        }
-+
-+        if (grub_strcmp(dev->disk->partition->partmap->name, "gpt") == 0)
-+        {
-+          struct grub_gpt_partentry entry;
-+          grub_guid_t *guid;
-+
-+          if (grub_disk_read(disk, p->offset, p->index, sizeof(entry), &entry))
-+          {
-+            grub_error_push ();
-+            grub_disk_close (disk);
-+            grub_device_close (dev);
-+            grub_error_pop ();
-+            return grub_errno;
-+          }
-+          guid = &entry.guid;
-+          guid->data1 = grub_le_to_cpu32 (guid->data1);
-+          guid->data2 = grub_le_to_cpu16 (guid->data2);
-+          guid->data3 = grub_le_to_cpu16 (guid->data3);
-+          grub_snprintf (val, sizeof(val), "%pG", guid);
-+
-+          if (grub_strcmp(val, ctx->key) == 0)
-+            found = 1;
-+        }
-+        if (disk)
-+          grub_disk_close (disk);
-+      }
-+      grub_device_close (dev);
-+    }
-+#elif defined (DO_SEARCH_FILE)
-     {
-       char *buf;
-       grub_file_t file;
-@@ -333,6 +382,8 @@ static grub_command_t cmd;
-
- #ifdef DO_SEARCH_FILE
- GRUB_MOD_INIT(search_fs_file)
-+#elif defined (DO_SEARCH_PARTUUID)
-+GRUB_MOD_INIT(search_partuuid)
- #elif defined (DO_SEARCH_FS_UUID)
- GRUB_MOD_INIT(search_fs_uuid)
- #else
-@@ -347,6 +398,8 @@ GRUB_MOD_INIT(search_label)
-
- #ifdef DO_SEARCH_FILE
- GRUB_MOD_FINI(search_fs_file)
-+#elif defined (DO_SEARCH_PARTUUID)
-+GRUB_MOD_FINI(search_partuuid)
- #elif defined (DO_SEARCH_FS_UUID)
- GRUB_MOD_FINI(search_fs_uuid)
- #else
-diff --git a/grub-core/commands/search_partuuid.c b/grub-core/commands/search_partuuid.c
-new file mode 100644
-index 0000000..e4aa20b
--- /dev/null
-+++ b/grub-core/commands/search_partuuid.c
-@@ -0,0 +1,5 @@
-+#define DO_SEARCH_PARTUUID 1
-+#define FUNC_NAME grub_search_partuuid
-+#define COMMAND_NAME "search.partuuid"
-+#define HELP_MESSAGE N_("Search devices by PARTUUID. If VARIABLE is specified, the first device found is set to a variable.")
-+#include "search.c"
-diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c
-index 318581f..4a61093 100644
--- a/grub-core/commands/search_wrap.c
-+++ b/grub-core/commands/search_wrap.c
-@@ -36,6 +36,8 @@ static const struct grub_arg_option options[] =
-      0, 0},
-     {"fs-uuid",		'u', 0, N_("Search devices by a filesystem UUID."),
-      0, 0},
-+    {"partuuid",       'p', 0, N_("Search devices by a PARTUUID."),
-+     0, 0},
-     {"set",		's', GRUB_ARG_OPTION_OPTIONAL,
-      N_("Set a variable to the first device found."), N_("VARNAME"),
-      ARG_TYPE_STRING},
-@@ -72,6 +74,7 @@ enum options
-     SEARCH_FILE,
-     SEARCH_LABEL,
-     SEARCH_FS_UUID,
-+    SEARCH_PARTUUID,
-     SEARCH_SET,
-     SEARCH_NO_FLOPPY,
-     SEARCH_EFIDISK_ONLY,
-@@ -193,6 +196,9 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args)
-     grub_search_label (id, var, flags, hints, nhints);
-   else if (state[SEARCH_FS_UUID].set)
-     grub_search_fs_uuid (id, var, flags, hints, nhints);
-+  else if (state[SEARCH_PARTUUID].set)
-+    grub_search_partuuid (id, var, state[SEARCH_NO_FLOPPY].set,
-+                        hints, nhints);
-   else if (state[SEARCH_FILE].set)
-     grub_search_fs_file (id, var, flags, hints, nhints);
-   else
-@@ -213,7 +219,7 @@ GRUB_MOD_INIT(search)
- 			  N_("[-f|-l|-u|-s|-n] [--hint HINT [--hint HINT] ...]"
- 			     " NAME"),
- 			  N_("Search devices by file, filesystem label"
-			     " or filesystem UUID."
-+			     " PARTUUID or filesystem UUID."
- 			     " If --set is specified, the first device found is"
- 			     " set to a variable. If no variable name is"
- 			     " specified, `root' is used."),
-diff --git a/include/grub/search.h b/include/grub/search.h
-index ffd2411..06468a8 100644
--- a/include/grub/search.h
-+++ b/include/grub/search.h
-@@ -35,5 +35,7 @@ void grub_search_fs_uuid (const char *key, const char *var,
- void grub_search_label (const char *key, const char *var,
- 			enum search_flags flags,
- 			char **hints, unsigned nhints);
-
-+void grub_search_partuuid (const char *key, const char *var,
-+			enum search_flags flags,
-+			char **hints, unsigned nhints);
- #endif
@@ -1,7 +1,7 @@
 From 79abf7872e35080ca5b519bb4ad2acc1fbd96e8c Mon Sep 17 00:00:00 2001
 From: Christian Marangi <ansuelsmth@gmail.com>
 Date: Thu, 25 Jan 2024 21:36:59 +0100
-Subject: [PATCH 01/28] net: phy: add support for PHY LEDs polarity modes
+Subject: [PATCH 01/24] net: phy: add support for PHY LEDs polarity modes
 Organization: Addiva Elektronik

 Add support for PHY LEDs polarity modes. Some PHY require LED to be set
@@ -22,7 +22,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 Reviewed-by: Andrew Lunn <andrew@lunn.ch>
 Link: https://lore.kernel.org/r/20240125203702.4552-4-ansuelsmth@gmail.com
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/phy_device.c | 16 ++++++++++++++++
 include/linux/phy.h          | 22 ++++++++++++++++++++++
@@ -1,7 +1,7 @@
 From 424ddb5d5d8ce06c578cc08cbedf519c42dd8b69 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 4 Dec 2023 11:08:11 +0100
-Subject: [PATCH 02/28] net: mvmdio: Support setting the MDC frequency on XSMI
+Subject: [PATCH 02/24] net: mvmdio: Support setting the MDC frequency on XSMI
 controllers
 Organization: Addiva Elektronik

@@ -14,7 +14,6 @@ Reviewed-by: Andrew Lunn <andrew@lunn.ch>
 Tested-by: Andrew Lunn <andrew@lunn.ch>
 Link: https://lore.kernel.org/r/20231204100811.2708884-4-tobias@waldekranz.com
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
 drivers/net/ethernet/marvell/mvmdio.c | 44 +++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
@@ -1,7 +1,7 @@
 From 337cf21833cef6ab456a8562338de88ab1a84ead Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:23 +0100
-Subject: [PATCH 03/28] net: dsa: mv88e6xxx: Create API to read a single stat
+Subject: [PATCH 03/24] net: dsa: mv88e6xxx: Create API to read a single stat
 counter
 Organization: Addiva Elektronik

@@ -16,7 +16,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
 Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
 Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 162 ++++++++++++++++++-------------
 drivers/net/dsa/mv88e6xxx/chip.h |  27 +++---
@@ -1,7 +1,7 @@
 From dbdbfd57998b4f8224146ac94cd5d0a577326087 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:25 +0100
-Subject: [PATCH 04/28] net: dsa: mv88e6xxx: Give each hw stat an ID
+Subject: [PATCH 04/24] net: dsa: mv88e6xxx: Give each hw stat an ID
 Organization: Addiva Elektronik

 With the upcoming standard counter group support, we are no longer
@@ -16,7 +16,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
 Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
 Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 138 +++++++++++++++++--------------
 1 file changed, 75 insertions(+), 63 deletions(-)
@@ -1,7 +1,7 @@
 From 26815572016d9851ec6362f23746035fb933acf3 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:26 +0100
-Subject: [PATCH 05/28] net: dsa: mv88e6xxx: Add "eth-mac" counter group
+Subject: [PATCH 05/24] net: dsa: mv88e6xxx: Add "eth-mac" counter group
 support
 Organization: Addiva Elektronik

@@ -12,7 +12,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
 Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
 Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 39 ++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
@@ -1,7 +1,7 @@
 From cc5badac76e76692eb516a5c086fcf54a5a93080 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:27 +0100
-Subject: [PATCH 06/28] net: dsa: mv88e6xxx: Limit histogram counters to
+Subject: [PATCH 06/24] net: dsa: mv88e6xxx: Limit histogram counters to
 ingress traffic
 Organization: Addiva Elektronik

@@ -27,7 +27,6 @@ Reviewed-by: Andrew Lunn <andrew@lunn.ch>
 Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
 Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c    | 6 +++---
 drivers/net/dsa/mv88e6xxx/global1.c | 7 +++----
@@ -1,7 +1,7 @@
 From 35ecc84237bfccbe5b93c0aef6c07cc506d43070 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:28 +0100
-Subject: [PATCH 07/28] net: dsa: mv88e6xxx: Add "rmon" counter group support
+Subject: [PATCH 07/24] net: dsa: mv88e6xxx: Add "rmon" counter group support
 Organization: Addiva Elektronik

 Report the applicable subset of an mv88e6xxx port's counters using
@@ -11,7 +11,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
 Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
 Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 42 ++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
@@ -1,13 +1,13 @@
 From 7750d0a5bfae46ab783e8e7087b70175860f808c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 19:44:32 +0100
-Subject: [PATCH 09/28] net: dsa: mv88e6xxx: Add LED infrastructure
+Subject: [PATCH 09/24] net: dsa: mv88e6xxx: Add LED infrastructure
 Organization: Addiva Elektronik

 Parse DT for LEDs and register them for devices that support it,
 though no actual implementations exist yet.

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/Makefile |   1 +
 drivers/net/dsa/mv88e6xxx/chip.c   |   5 +-
@@ -1,7 +1,7 @@
 From 63fcd626fdb108d2ac07cb0aa16b91fc43894bff Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 21:59:35 +0100
-Subject: [PATCH 10/28] net: dsa: mv88e6xxx: Add LED support for 6393X
+Subject: [PATCH 10/24] net: dsa: mv88e6xxx: Add LED support for 6393X
 Organization: Addiva Elektronik

 Trigger support:
@@ -9,7 +9,7 @@ Trigger support:
 - "timer"
 - "netdev"

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c |   1 +
 drivers/net/dsa/mv88e6xxx/leds.c | 226 +++++++++++++++++++++++++++++++
@@ -1,7 +1,7 @@
 From 0bc6f19d18d7c0e374c824bcc86433b04210a378 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
-Subject: [PATCH 11/28] net: dsa: mv88e6xxx: Fix timeout on waiting for PPU on
+Subject: [PATCH 11/24] net: dsa: mv88e6xxx: Fix timeout on waiting for PPU on
 6393X
 Organization: Addiva Elektronik

@@ -9,7 +9,7 @@ In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,
 register 0, bit 15). Therefore, increase the timeout threshold to 1s.

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
@@ -1,7 +1,7 @@
 From fe60e3ad1e3b43a924c311658b15a1106e813661 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
-Subject: [PATCH 12/28] net: dsa: Support MDB memberships whose L2 addresses
+Subject: [PATCH 12/24] net: dsa: Support MDB memberships whose L2 addresses
 overlap
 Organization: Addiva Elektronik

@@ -30,7 +30,7 @@ needed to do this is already in place, since it is also needed on CPU
 and DSA ports. Thus, "implement" this by simply removing the guards
 which previously skipped reference countung on user ports.

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 net/dsa/switch.c | 16 ----------------
 1 file changed, 16 deletions(-)
@@ -1,7 +1,7 @@
 From 5f5bf4a50e98c5aff05fe85994a981253ae85987 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
-Subject: [PATCH 13/28] net: phy: marvell10g: Support firmware loading on
+Subject: [PATCH 13/24] net: phy: marvell10g: Support firmware loading on
 88X3310
 Organization: Addiva Elektronik

@@ -12,7 +12,7 @@ We have no choice but to bail out of the probe if firmware is not
 available, as the device does not have any built-in image on which to
 fall back.

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 161 +++++++++++++++++++++++++++++++++++
 1 file changed, 161 insertions(+)
@@ -1,7 +1,7 @@
 From 27d5241d3ddf70d65af5f4dd029f99f0fea866a5 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
-Subject: [PATCH 14/28] net: phy: marvell10g: Fix power-up when strapped to
+Subject: [PATCH 14/24] net: phy: marvell10g: Fix power-up when strapped to
 start powered down
 Organization: Addiva Elektronik

@@ -9,7 +9,7 @@ On devices which are hardware strapped to start powered down (PDSTATE
 == 1), make sure that we clear the power-down bit on all units
 affected by this setting.

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)
@@ -1,7 +1,7 @@
 From e389ee690ce56ef20863aeabdf389bed842d7f42 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
-Subject: [PATCH 15/28] net: phy: marvell10g: Add LED support for 88X3310
+Subject: [PATCH 15/24] net: phy: marvell10g: Add LED support for 88X3310
 Organization: Addiva Elektronik

 Pickup the LEDs from the state in which the hardware reset or
@@ -18,7 +18,7 @@ Trigger support:
 - "netdev": Offload link or duplex information to the solid behavior;
  	    tx and/or rx activity to blink behavior.

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 422 +++++++++++++++++++++++++++++++++++
 1 file changed, 422 insertions(+)
@@ -1,7 +1,7 @@
 From 3113b64290b5b7b20c294535c12ea4c732a02f51 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
-Subject: [PATCH 16/28] net: phy: marvell10g: Support LEDs tied to a single
+Subject: [PATCH 16/24] net: phy: marvell10g: Support LEDs tied to a single
 media side
 Organization: Addiva Elektronik

@@ -15,7 +15,7 @@ the offloading of the "netdev" trigger, such that LEDs attached to the
 RJ45 jack only lights up when a copper link is established, and vice
 versa for the SFP cage.

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)
@@ -1,7 +1,7 @@
 From 2570c2350d3d614a31e14dd87d0e99e8fcb5096b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
-Subject: [PATCH 17/28] nvmem: layouts: onie-tlv: Let device probe even when
+Subject: [PATCH 17/24] nvmem: layouts: onie-tlv: Let device probe even when
 TLV is invalid
 Organization: Addiva Elektronik

@@ -14,7 +14,7 @@ be successfully probed.
 Therefore, settle for reporting data corruption issues in the log, and
 simply refrain from registering any cells in those cases.

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/nvmem/layouts/onie-tlv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
@@ -1,7 +1,7 @@
 From 681ce95c15bff94ac83eb26db3c718594f8dfa16 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
-Subject: [PATCH 18/28] net: bridge: avoid classifying unknown multicast as
+Subject: [PATCH 18/24] net: bridge: avoid classifying unknown multicast as
 mrouters_only
 Organization: Addiva Elektronik

@@ -16,6 +16,7 @@ Because a multicast router should always receive both known and unknown
 multicast.

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 include/uapi/linux/if_bridge.h |  1 +
 net/bridge/br.c                |  5 +++++
@@ -1,7 +1,7 @@
 From 2482848726a5b8185a04d90891693a1713f894b5 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
-Subject: [PATCH 19/28] net: bridge: Ignore router ports when forwarding L2
+Subject: [PATCH 19/24] net: bridge: Ignore router ports when forwarding L2
 multicast
 Organization: Addiva Elektronik

@@ -1,10 +1,10 @@
 From 25efcdb13ae720ee662f4b6091b270e48ac4d375 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
-Subject: [PATCH 20/28] net: dsa: Support EtherType based priority overrides
+Subject: [PATCH 20/24] net: dsa: Support EtherType based priority overrides
 Organization: Addiva Elektronik

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 include/net/dsa.h |  4 ++++
 net/dsa/slave.c   | 56 +++++++++++++++++++++++++++++++++++++++++++++--
@@ -1,11 +1,11 @@
 From 213e9a1d9145723897fbba40fc4afc5b5f70c1de Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
-Subject: [PATCH 21/28] net: dsa: mv88e6xxx: Support EtherType based priority
+Subject: [PATCH 21/24] net: dsa: mv88e6xxx: Support EtherType based priority
 overrides
 Organization: Addiva Elektronik

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c    | 64 +++++++++++++++++++++++++++++
 drivers/net/dsa/mv88e6xxx/chip.h    | 21 ++++++++++
@@ -1,7 +1,7 @@
 From 1c1c81864c9803831c2d5b7df0d7da28e566f3b2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
-Subject: [PATCH 22/28] net: phy: Do not resume PHY when attaching
+Subject: [PATCH 22/24] net: phy: Do not resume PHY when attaching
 Organization: Addiva Elektronik

 The PHY should not start negotiating with its link-partner until
@@ -16,7 +16,7 @@ probing (e.g. DSA) would end up with a physical link being
 established, even though the corresponding interface was still
 administratively down.

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/phy_device.c | 1 -
 1 file changed, 1 deletion(-)
@@ -1,7 +1,7 @@
 From b53e5007cd5be42eb5d9a510d63f89c7c6edd9b6 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
-Subject: [PATCH 23/28] net: dsa: mv88e6xxx: Improve indirect register access
+Subject: [PATCH 23/24] net: dsa: mv88e6xxx: Improve indirect register access
 perf on 6393
 Organization: Addiva Elektronik

@@ -14,7 +14,7 @@ Therefore, add a new set of SMI operations which remaps accesses to
 such registers to the corresponding directly addressable register. All
 other accesses use the regular indirect interface.

-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c    |  7 +++
 drivers/net/dsa/mv88e6xxx/global1.h |  3 ++
@@ -1,7 +1,7 @@
 From f53652205b1c044fa00f896d6422c82ac808f16a Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
-Subject: [PATCH 24/28] net: bridge: drop delay for applying strict multicast
+Subject: [PATCH 24/24] net: bridge: drop delay for applying strict multicast
 filtering
 Organization: Addiva Elektronik

@@ -1,48 +0,0 @@
-From 56208d4cba23496c09f69961a32b1b9662f06aef Mon Sep 17 00:00:00 2001
-From: Tobias Waldekranz <tobias@waldekranz.com>
-Date: Mon, 22 Apr 2024 23:18:01 +0200
-Subject: [PATCH 25/28] net: dsa: mv88e6xxx: Honor ports being managed via
- in-band-status
-Organization: Addiva Elektronik
-
-Keep all link parameters in their unforced states when the port is
-declared as being managed via in-band-status, and let the MAC
-configure itself, via whatever method is being used (e.g. SGMII or
-USXGMII autoneg)
-
-This state is the default set up by mv88e6xxx_port_setup_mac(), so all
-we have to do is to make the phylink MAC callbacks no-ops in cases
-when in-band-status is being used.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- drivers/net/dsa/mv88e6xxx/chip.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 76bb8b492ca9..29691280cff4 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
-+++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -885,6 +885,9 @@ static void mv88e6xxx_mac_link_down(struct dsa_switch *ds, int port,
- 	const struct mv88e6xxx_ops *ops;
- 	int err = 0;
- 
-+	if (mode == MLO_AN_INBAND)
-+		return;
-+
- 	ops = chip->info->ops;
- 
- 	mv88e6xxx_reg_lock(chip);
-@@ -915,6 +918,9 @@ static void mv88e6xxx_mac_link_up(struct dsa_switch *ds, int port,
- 	const struct mv88e6xxx_ops *ops;
- 	int err = 0;
- 
-+	if (mode == MLO_AN_INBAND)
-+		return;
-+
- 	ops = chip->info->ops;
- 
- 	mv88e6xxx_reg_lock(chip);
-- 
-2.34.1
-
@@ -1,45 +0,0 @@
-From 04023a449a6894c0ec46e246c52e94566b3be4b3 Mon Sep 17 00:00:00 2001
-From: Tobias Waldekranz <tobias@waldekranz.com>
-Date: Wed, 24 Apr 2024 21:35:26 +0200
-Subject: [PATCH 26/28] net: dsa: mv88e6xxx: Fix port policy config on 6393X
-Organization: Addiva Elektronik
-
-mv88e6393x_port_policy_{read,write} expect the `pointer` argument to
-be "pre-shifted" 8 bits.
-
-Therefore, make sure mv88e6393x_port_set_policy adheres to this
-requirement.
-
-Before this change, no policy actions from offset 1 could be
-configured. In particular, this meant that VTU policy trapping was
-never enabled on DSA ports, which broke standalone port isolation in
-multichip switch trees made up of 6393X decices.
-
-Fixes: 6584b26020fc ("net: dsa: mv88e6xxx: implement .port_set_policy for Amethyst")
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- drivers/net/dsa/mv88e6xxx/port.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
-index aba78838171b..3f5759992baf 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
-+++ b/drivers/net/dsa/mv88e6xxx/port.c
-@@ -1793,12 +1793,12 @@ int mv88e6393x_port_set_policy(struct mv88e6xxx_chip *chip, int port,
- 	shift %= 8;
- 	mask >>= ptr * 8;
- 
-	err = mv88e6393x_port_policy_read(chip, port, ptr, &reg);
-+	err = mv88e6393x_port_policy_read(chip, port, ptr << 8, &reg);
- 	if (err)
- 		return err;
- 
- 	reg &= ~mask;
- 	reg |= (val << shift) & mask;
- 
-	return mv88e6393x_port_policy_write(chip, port, ptr, reg);
-+	return mv88e6393x_port_policy_write(chip, port, ptr << 8, reg);
- }
-- 
-2.34.1
-
@@ -1,103 +0,0 @@
-From 7529102af1693138349032b7d1339d91d2b6a578 Mon Sep 17 00:00:00 2001
-From: Tobias Waldekranz <tobias@waldekranz.com>
-Date: Wed, 24 Apr 2024 22:41:04 +0200
-Subject: [PATCH 27/28] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
- ports on 6393X
-Organization: Addiva Elektronik
-
-For packets with a DA in the IEEE reserved L2 group range, originating
-from a CPU, forward it as normal, rather than classifying it as
-management.
-
-Example use-case:
-
-     bridge (group_fwd_mask 0x4000)
-     / |  \
- swp1 swp2 tap0
-   \   /
-(mv88e6xxx)
-
-We've created a bridge with a non-zero group_fwd_mask (allowing LLDP
-in this example) containing a set of ports managed by mv88e6xxx and
-some foreign interface (e.g. an L2 VPN tunnel).
-
-Since an LLDP packet coming in to the bridge from the other side of
-tap0 is eligable for tx forward offloading, a FORWARD frame destined
-for swp1 and swp2 would be send to the conduit interface.
-
-Before this change, due to rsvd2cpu being enabled on the CPU port, the
-switch would try to trap it back to the CPU. Given that the CPU is
-trusted, instead assume that it indeed meant for the packet to be
-forwarded like any other.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- drivers/net/dsa/mv88e6xxx/port.c | 31 +++++++++++++++++++++++++------
- 1 file changed, 25 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
-index 3f5759992baf..3dfe0f7805a0 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
-+++ b/drivers/net/dsa/mv88e6xxx/port.c
-@@ -1432,6 +1432,23 @@ static int mv88e6393x_port_policy_write_all(struct mv88e6xxx_chip *chip,
- 	return 0;
- }
- 
-+static int mv88e6393x_port_policy_write_user(struct mv88e6xxx_chip *chip,
-+					     u16 pointer, u8 data)
-+{
-+	int err, port;
-+
-+	for (port = 0; port < mv88e6xxx_num_ports(chip); port++) {
-+		if (!dsa_is_user_port(chip->ds, port))
-+			continue;
-+
-+		err = mv88e6393x_port_policy_write(chip, port, pointer, data);
-+		if (err)
-+			return err;
-+	}
-+
-+	return 0;
-+}
-+
- int mv88e6393x_set_egress_port(struct mv88e6xxx_chip *chip,
- 			       enum mv88e6xxx_egress_direction direction,
- 			       int port)
-@@ -1473,26 +1490,28 @@ int mv88e6393x_port_mgmt_rsvd2cpu(struct mv88e6xxx_chip *chip)
- 	int err;
- 
- 	/* Consider the frames with reserved multicast destination
-	 * addresses matching 01:80:c2:00:00:00 and
-	 * 01:80:c2:00:00:02 as MGMT.
-+	 * addresses matching 01:80:c2:00:00:00 and 01:80:c2:00:00:02
-+	 * as MGMT when received on user ports. Forward as normal on
-+	 * CPU/DSA ports, to support bridges with non-zero
-+	 * group_fwd_masks.
- 	 */
- 	ptr = MV88E6393X_PORT_POLICY_MGMT_CTL_PTR_01C280000000XLO;
-	err = mv88e6393x_port_policy_write_all(chip, ptr, 0xff);
-+	err = mv88e6393x_port_policy_write_user(chip, ptr, 0xff);
- 	if (err)
- 		return err;
- 
- 	ptr = MV88E6393X_PORT_POLICY_MGMT_CTL_PTR_01C280000000XHI;
-	err = mv88e6393x_port_policy_write_all(chip, ptr, 0xff);
-+	err = mv88e6393x_port_policy_write_user(chip, ptr, 0xff);
- 	if (err)
- 		return err;
- 
- 	ptr = MV88E6393X_PORT_POLICY_MGMT_CTL_PTR_01C280000002XLO;
-	err = mv88e6393x_port_policy_write_all(chip, ptr, 0xff);
-+	err = mv88e6393x_port_policy_write_user(chip, ptr, 0xff);
- 	if (err)
- 		return err;
- 
- 	ptr = MV88E6393X_PORT_POLICY_MGMT_CTL_PTR_01C280000002XHI;
-	err = mv88e6393x_port_policy_write_all(chip, ptr, 0xff);
-+	err = mv88e6393x_port_policy_write_user(chip, ptr, 0xff);
- 	if (err)
- 		return err;
- 
-- 
-2.34.1
-
@@ -1,49 +0,0 @@
-From c446111df33d9d6064395e37235bbbeee422358e Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Mon, 29 Apr 2024 15:14:51 +0200
-Subject: [PATCH 28/28] usb: core: adjust log level for unauthorized devices
-Organization: Addiva Elektronik
-
-The fact that a USB device currently is not authorized is not an error,
-so let's adjust the log level so these messages slip below radar for the
-commonly used 'quiet' log level.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- drivers/usb/core/driver.c  | 4 ++--
- drivers/usb/core/generic.c | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
-index f58a0299fb3b..46450d806373 100644
--- a/drivers/usb/core/driver.c
-+++ b/drivers/usb/core/driver.c
-@@ -332,10 +332,10 @@ static int usb_probe_interface(struct device *dev)
- 		return error;
- 
- 	if (udev->authorized == 0) {
-		dev_err(&intf->dev, "Device is not authorized for usage\n");
-+		dev_warn(&intf->dev, "Device is not authorized for usage\n");
- 		return error;
- 	} else if (intf->authorized == 0) {
-		dev_err(&intf->dev, "Interface %d is not authorized for usage\n",
-+		dev_warn(&intf->dev, "Interface %d is not authorized for usage\n",
- 				intf->altsetting->desc.bInterfaceNumber);
- 		return error;
- 	}
-diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
-index 740342a2812a..2682bcf3e79f 100644
--- a/drivers/usb/core/generic.c
-+++ b/drivers/usb/core/generic.c
-@@ -231,7 +231,7 @@ int usb_generic_driver_probe(struct usb_device *udev)
- 	 * with the driver core and lets interface drivers bind to them.
- 	 */
- 	if (udev->authorized == 0)
-		dev_err(&udev->dev, "Device is not authorized for usage\n");
-+		dev_warn(&udev->dev, "Device is not authorized for usage\n");
- 	else {
- 		c = usb_choose_configuration(udev);
- 		if (c >= 0) {
-- 
-2.34.1
-
@@ -1,117 +0,0 @@
-From 1727f7a5ea142ab923ca07f23b2457cf8db94d1d Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Wed, 24 Apr 2024 13:19:09 +0200
-Subject: [PATCH 1/1] Fix #72: loss of raw kernel log messages to console
-Organization: Addiva Elektronik
-
-This patch adds a command line flag `-l` to keep kernel logs to console.
-A feature requested by embedded Linux users which often navigate issues
-by console output.
-
-With properly configured kernel logging, e.g., `quiet`, only error and
-above in severity is logged by the kernel directly to the console.  So
-for most users this would be a useful behavior.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- man/syslogd.8 | 18 +++++++++++++++++-
- src/syslogd.c | 10 +++++++++-
- src/syslogd.h |  4 ++--
- 3 files changed, 28 insertions(+), 4 deletions(-)
-
-diff --git a/man/syslogd.8 b/man/syslogd.8
-index dcfb564..70f1b8b 100644
--- a/man/syslogd.8
-+++ b/man/syslogd.8
-@@ -38,7 +38,7 @@
- .Nd log systems messages
- .Sh SYNOPSIS
- .Nm
-.Op Fl ?468AcdFHKknsTtv
-+.Op Fl ?468AcdFHKklnsTtv
- .Op Fl a Ar addr[/len][:port]
- .Op Fl a Ar name[:port]
- .Op Fl b Ar addr[:port]
-@@ -292,6 +292,22 @@ Usually the
- .Dq kern
- facility is reserved for messages read directly from
- .Pa /dev/kmsg .
-+.It Fl l
-+Keep kernel console logging.  By default
-+.Nm
-+call
-+.Xr klogctl 2
-+to disable the kernel's logging to console after having opened
-+.Pa /dev/kmsg .
-+With this option the kernel's log level can be adjusted using
-+.Xr sysctl 8 ,
-+or the kernel command line, to suit your logging needs to the console.
-+.Pp
-+Please note, this does not affect logging of kernel messages, see
-+.Fl K ,
-+only what the kernel logs to
-+.Pa /dev/console .
-+Also, this is only applicable to Linux.
- .It Fl m Ar interval
- Select the number of minutes between
- .Dq mark
-diff --git a/src/syslogd.c b/src/syslogd.c
-index e7b05b0..68040fe 100644
--- a/src/syslogd.c
-+++ b/src/syslogd.c
-@@ -154,6 +154,7 @@ static int	  RemoteHostname;	  /* Log remote hostname from the message */
- static int	  KernLog = 1;		  /* Track kernel logs by default */
- static int	  KeepKernFac;		  /* Keep remotely logged kernel facility */
- static int	  KeepKernTime;		  /* Keep kernel timestamp, evern after initial read */
-+static int	  KeepKernConsole;	  /* Keep kernel logging to console */
- 
- static off_t	  RotateSz = 0;		  /* Max file size (bytes) before rotating, disabled by default */
- static int	  RotateCnt = 5;	  /* Max number (count) of log files to keep, set with -c <NUM> */
-@@ -363,6 +364,9 @@ int usage(int code)
- 	       "  -H        Use hostname from message instead of address for remote messages\n"
- 	       "  -K        Disable kernel logging, useful in container use-cases\n"
- 	       "  -k        Allow logging with facility 'kernel', otherwise remapped to 'user'\n"
-+#ifdef __linux__
-+	       "  -l        Keep kernel logging to console, use sysctl to adjust kernel.printk\n"
-+#endif
- 	       "  -m MINS   Interval between MARK messages, 0 to disable, default: 20 min\n"
- 	       "  -n        Disable DNS query for every request\n"
- 	       "  -P FILE   File to store the process ID, default: %s\n"
-@@ -397,7 +401,7 @@ int main(int argc, char *argv[])
- 	char *ptr;
- 	int ch;
- 
-	while ((ch = getopt(argc, argv, "468Aa:b:C:cdHFf:Kkm:nP:p:r:sTtv?")) != EOF) {
-+	while ((ch = getopt(argc, argv, "468Aa:b:C:cdHFf:Kklm:nP:p:r:sTtv?")) != EOF) {
- 		switch ((char)ch) {
- 		case '4':
- 			family = PF_INET;
-@@ -464,6 +468,10 @@ int main(int argc, char *argv[])
- 			KeepKernFac = 1;
- 			break;
- 
-+		case 'l':
-+			KeepKernConsole = 1;
-+			break;
-+
- 		case 'm': /* mark interval */
- 			MarkInterval = atoi(optarg) * 60;
- 			break;
-diff --git a/src/syslogd.h b/src/syslogd.h
-index 68ceafb..1703df2 100644
--- a/src/syslogd.h
-+++ b/src/syslogd.h
-@@ -169,8 +169,8 @@
- #define SYSLOG_ACTION_CONSOLE_ON  7
- 
- #ifdef __linux__
-#define kern_console_off() klogctl(SYSLOG_ACTION_CONSOLE_OFF, NULL, 0)
-#define kern_console_on()  klogctl(SYSLOG_ACTION_CONSOLE_ON, NULL, 0)
-+#define kern_console_off() if (!KeepKernConsole) klogctl(SYSLOG_ACTION_CONSOLE_OFF, NULL, 0)
-+#define kern_console_on()  if (!KeepKernConsole) klogctl(SYSLOG_ACTION_CONSOLE_ON, NULL, 0)
- #else
- #define kern_console_off() do { } while (0)
- #define kern_console_on()  do { } while (0)
-- 
-2.34.1
-
@@ -214,7 +214,7 @@ sysrepoctl -s $SEARCH							\
 	   -i iana-hardware@2018-03-13.yang     -g wheel -p 0660        \
 	   -i ietf-hardware@2018-03-13.yang     -g wheel -p 0660        \
 	      -e hardware-state                                         \
-	   -i infix-hardware@2024-04-25.yang    -g wheel -p 0660        \
+	   -i infix-hardware@2024-01-18.yang    -g wheel -p 0660        \
 	   -i ieee802-dot1q-types@2022-10-29.yang -g wheel -p 0660	\
 	   -i infix-ip@2023-09-14.yang		-g wheel -p 0660	\
 	   -i infix-if-type@2024-01-29.yang	-g wheel -p 0660	\
@@ -245,10 +245,8 @@ sysrepoctl -c ietf-netconf			-g wheel -p 0660	\
 		-e url							\
 		-e xpath						\
 		-e confirmed-commit
-# Allow wheel group users (admin) to modify NACM and do factory reset
-sysrepoctl -c ietf-netconf-acm     -g wheel -p 0660
-sysrepoctl -c ietf-factory-default -g wheel -p 0660
-sysrepoctl -c sysrepo-plugind      -g wheel -p 0660
+# Allow wheel group users (admin) to modify NACM
+sysrepoctl -c ietf-netconf-acm -g wheel -p 0660

 # On first boot, install factory-config as startup-config.  Due to a
 # limitation in sysrepo we cannot initialize ietf-netconf-acm, so we
@@ -257,6 +255,7 @@ chgrp wheel /cfg
 chmod g+w   /cfg
 if [ ! -f "$STARTUP_CFG" ]; then
    sysrepocfg -f json -X"$STARTUP_CFG"
+    chown admin:wheel "$STARTUP_CFG"
 fi

 # Clear running-config so we can load startup in the next step
@@ -1,29 +1,38 @@
 #!/bin/sh
-# Generate ietf-system.yang hostname based on:
-#  1. Command line argument + MAC suffix
-#  2. Specific hostname from qemu_fw_cfg, from Qeneth
-#  3. /etc/hostname from squashfs + MAC suffix
-#
+
 set -e

-gen()
+base_mac_lowest_physical()
 {
-    base_mac=$(jq -r '.["mac-address"]' /run/system.json)
-    if [ -z "$base_mac" ] || [ "$base_mac" = "null" ]; then
-	base_mac=00:00:00:00:00:00
-    fi
+    ip -d -j link show | jq -r '
+         .[] |
+         select(.link_type == "ether") |
+         select(has("linkinfo") | not) | .address' \
+    | sort | head -n 1
+}

-    echo "$1-$(echo $base_mac | tail -c 9 | tr ':' '-')"
+source_base_mac()
+{
+    # TODO: Source the base MAC from the vital product data memory, if
+    # available.
+    # base_mac=$(base_mac_vpd)
+    # [ "$base_mac" ] && return
+
+    base_mac=$(base_mac_lowest_physical)
+    [ "$base_mac" ] && return
+
+    base_mac=00:00:00:00:00:00
 }

 if [ "$1" ]; then
-    sysname=$(gen "$1")
-elif [ -f "/sys/firmware/qemu_fw_cfg/by_name/opt/hostname/raw" ]; then
-    sysname="$(cat /sys/firmware/qemu_fw_cfg/by_name/opt/hostname/raw)"
+    sysname="$1"
 else
-    sysname=$(gen "$(cat /etc/hostname)")
+    sysname="$(cat /etc/hostname)"
 fi

+source_base_mac
+sysname="${sysname}-$(echo $base_mac | tail -c 9 | tr ':' '-')"
+
 cat <<EOF
 {
  "ietf-system:system": {
@@ -11,6 +11,43 @@
 	    ]
 	},
 	"rule-list": [
+	    {
+		"name": "guest-acl",
+		"group": [
+		    "guest"
+		],
+		"rule": [
+		    {
+			"name": "deny-ncm",
+			"module-name": "ietf-netconf-monitoring",
+			"access-operations": "*",
+			"action": "deny",
+			"comment": "Disallow guests access to any NETCONF monitoring information."
+		    }
+		]
+	    },
+	    {
+		"name": "limited-acl",
+		"group": [
+		    "limited"
+		],
+		"rule": [
+		    {
+			"name": "permit-ncm",
+			"module-name": "ietf-netconf-monitoring",
+			"access-operations": "read",
+			"action": "permit",
+			"comment": "Allow read access to the NETCONF monitoring information."
+		    },
+		    {
+			"name": "permit-exec",
+			"module-name": "*",
+			"access-operations": "exec",
+			"action": "permit",
+			"comment": "Allow invocation of the supported server operations."
+		    }
+		]
+	    },
 	    {
 		"name": "admin-acl",
 		"group": [
@@ -127,10 +127,6 @@ int dagger_should_skip_current(struct dagger *d, const char *ifname)
 	return fexistf("%s/%d/skip/%s", d->path, d->current, ifname);
 }

-int dagger_is_bootstrap(struct dagger *d)
-{
-	return d->next == 0;
-}

 int dagger_claim(struct dagger *d, const char *path)
 {
@@ -30,7 +30,6 @@ int dagger_evolve_or_abandon(struct dagger *d);
 void dagger_skip_iface(struct dagger *d, const char *ifname);
 int dagger_should_skip(struct dagger *d, const char *ifname);
 int dagger_should_skip_current(struct dagger *d, const char *ifname);
-int dagger_is_bootstrap(struct dagger *d);

 int dagger_claim(struct dagger *d, const char *path);

@@ -663,45 +663,10 @@ skip_mtu:
 	return err;
 }

-static bool iface_uses_autoneg(struct lyd_node *cif)
-{
-	struct lyd_node *aneg = lydx_get_descendant(lyd_child(cif), "ethernet",
-						    "auto-negotiation", NULL);
-
-	/* Because `ieee802-ethernet-interface` declares
-	 * `auto-negotiation` as a presence container, the `enabled`
-	 * leaf, although `true` by default, is not set if the whole
-	 * container is absent. Since auto-negotiation is the expected
-	 * default behavior for most Ethernet links, we choose to
-	 * enable it in these situations.
-	 */
-	return !aneg || lydx_get_bool(aneg, "enable");
-}
-
-/*
- * XXX: always disable flow control, for now, until we've added
- *      configurable support for flow-control/pause/direction and
- *      flow-control/force-flow-control
- */
-static int netdag_gen_ethtool_flow_control(struct dagger *net, struct lyd_node *cif)
-{
-	const char *ifname = lydx_get_cattr(cif, "name");
-	FILE *fp;
-
-	fp = dagger_fopen_next(net, "init", ifname, 10, "ethtool-aneg.sh");
-	if (!fp)
-		return -EIO;
-
-	fprintf(fp, "ethtool --pause %s autoneg %s rx off tx off\n",
-		ifname, iface_uses_autoneg(cif) ? "on" : "off");
-	fclose(fp);
-
-	return 0;
-}
-
 static int netdag_gen_ethtool_autoneg(struct dagger *net, struct lyd_node *cif)
 {
 	struct lyd_node *eth = lydx_get_child(cif, "ethernet");
+	struct lyd_node *aneg = lydx_get_child(eth, "auto-negotiation");
 	const char *ifname = lydx_get_cattr(cif, "name");
 	const char *speed, *duplex;
 	int mbps, err = 0;
@@ -713,7 +678,7 @@ static int netdag_gen_ethtool_autoneg(struct dagger *net, struct lyd_node *cif)

 	fprintf(fp, "ethtool --change %s autoneg ", ifname);

-	if (iface_uses_autoneg(cif)) {
+	if (!aneg || lydx_is_enabled(aneg, "enable")) {
 		fputs("on\n", fp);
 	} else {
 		speed = lydx_get_cattr(eth, "speed");
@@ -775,18 +740,7 @@ static int netdag_gen_ethtool(struct dagger *net, struct lyd_node *cif, struct l
 	if (strcmp(type, "infix-if-type:ethernet"))
 		return 0;

-	if (!eth)
-		return 0;
-
-	if (dagger_is_bootstrap(net) ||
-	    lydx_get_descendant(lyd_child(eth), "auto-negotiation", "enable", NULL)) {
-		err = netdag_gen_ethtool_flow_control(net, cif);
-		if (err)
-			return err;
-	}
-
-	if (dagger_is_bootstrap(net) ||
-	    lydx_get_descendant(lyd_child(eth), "auto-negotiation", "enable", NULL) ||
+	if (lydx_get_descendant(lyd_child(eth), "auto-negotiation", "enable", NULL) ||
 	    lydx_get_child(eth, "speed") ||
 	    lydx_get_child(eth, "duplex")) {
 		err = netdag_gen_ethtool_autoneg(net, cif);
@@ -1172,9 +1126,8 @@ static int vlan_mcast_settings(sr_session_ctx_t *session, FILE *br, const char *
 	snooping = lydx_is_enabled(mcast, "snooping");
 	querier = querier_mode(lydx_get_cattr(mcast, "querier"));

-	fprintf(br, "vlan global set vid %d dev %s mcast_snooping %d",
+	fprintf(br, "vlan global set vid %d dev %s mcast_snooping %d\n",
 		vid, brname, snooping);
-	fprintf(br, " mcast_igmp_version 3 mcast_mld_version 2\n");

 	interval = atoi(lydx_get_cattr(mcast, "query-interval"));
 	ifname = find_vlan_interface(session, brname, vid);
@@ -1186,7 +1139,7 @@ static int vlan_mcast_settings(sr_session_ctx_t *session, FILE *br, const char *
 	return 0;
 }

-static int bridge_mcast_settings(FILE *ip, const char *brname, struct lyd_node *cif, int vlan_mcast)
+static int bridge_mcast_settings(FILE *ip, const char *brname, struct lyd_node *cif, int vlan_filtering)
 {
 	int interval, querier, snooping;
 	struct lyd_node *mcast;
@@ -1194,21 +1147,19 @@ static int bridge_mcast_settings(FILE *ip, const char *brname, struct lyd_node *
 	mcast = lydx_get_descendant(lyd_child(cif), "bridge", "multicast", NULL);
 	if (!mcast) {
 		mcast_querier(brname, 0, 0, 0);
-		interval = snooping = querier = 0;
-	} else {
-		snooping = lydx_is_enabled(mcast, "snooping");
-		querier  = querier_mode(lydx_get_cattr(mcast, "querier"));
-		interval = atoi(lydx_get_cattr(mcast, "query-interval"));
+		return 0;
 	}

-	fprintf(ip, " mcast_vlan_snooping %d", vlan_mcast ? 1 : 0);
-	fprintf(ip, " mcast_snooping %d mcast_querier 0", vlan_mcast ? 1 : snooping);
-	if (snooping)
-		fprintf(ip, " mcast_igmp_version 3 mcast_mld_version 2");
-	if (interval)
-		fprintf(ip, " mcast_query_interval %d", interval * 100);
+	snooping = lydx_is_enabled(mcast, "snooping");
+	querier = querier_mode(lydx_get_cattr(mcast, "querier"));

-	if (!vlan_mcast)
+	fprintf(ip, " mcast_vlan_snooping %d", vlan_filtering ? snooping : 0);
+	fprintf(ip, " mcast_snooping %d mcast_querier 0", snooping);
+
+	interval = atoi(lydx_get_cattr(mcast, "query-interval"));
+	fprintf(ip, " mcast_query_interval %d", interval * 100);
+
+	if (!vlan_filtering)
 		mcast_querier(brname, 0, querier, interval);
 	else
 		mcast_querier(brname, 0, 0, 0);
@@ -16,7 +16,6 @@
 #include "base64.h"
 #include "core.h"

-#define NACM_BASE_     "/ietf-netconf-acm:nacm"
 #define XPATH_BASE_    "/ietf-system:system"
 #define XPATH_AUTH_    XPATH_BASE_"/authentication"
 #define CLOCK_PATH_    "/ietf-system:system-state/clock"
@@ -292,30 +291,7 @@ static int aug_set_dynpath(augeas *aug, const char *val, const char *fmt, ...)

 	res = aug_set(aug, path, val);
 	if (res != 0)
-		ERROR("Unable to set aug path \"%s\" to \"%s\"", path, val);
-
-	free(path);
-
-	return res;
-}
-
-static int aug_get_dynpath(augeas *aug, const char **val, const char *fmt, ...)
-{
-	va_list ap;
-	char *path;
-	int res;
-
-	va_start(ap, fmt);
-	res = vasprintf(&path, fmt, ap);
-	va_end(ap);
-	if (res == -1)
-		return res;
-
-	res = aug_get(aug, path, val);
-	if (res <= 0)
-		ERROR("Unable to get aug path \"%s\"", path);
-	else
-		res = 0;
+		ERROR("Unable to set aug path \"%s\" to \"%s\"\n", path, val);

 	free(path);

@@ -671,35 +647,6 @@ static char *sys_find_usable_shell(sr_session_ctx_t *sess, char *name)
 	return shell;
 }

-static uid_t sys_home_exists(char *user)
-{
-	char path[strlen(user) + 10];
-	struct stat st;
-
-	snprintf(path, sizeof(path), "/home/%s", user);
-	if (stat(path, &st))
-		return 0;
-
-	return st.st_uid;
-}
-
-static int sys_uid_busy(char *user, uid_t uid)
-{
-	struct passwd *pw;
-	int rc = 0;
-
-	setpwent();
-	while ((pw = getpwent())) {
-		if (pw->pw_uid != uid)
-			continue;
-		if (strcmp(pw->pw_name, user))
-			rc = -1;
-	}
-	endpwent();
-
-	return rc;
-}
-
 static int sys_del_user(char *user)
 {
 	char *args[] = {
@@ -713,46 +660,34 @@ static int sys_del_user(char *user)
 		ERROR("Error deleting user \"%s\"\n", user);
 		return SR_ERR_SYS;
 	}
-	NOTE("User \"%s\" deleted\n", user);
+	DEBUG("User \"%s\" deleted\n", user);

 	return SR_ERR_OK;
 }

+/*
+ * XXX: drop superuser/wheel exception as soon as we have clish-ng in place.
+ *      It is supposed to connect to the netopeer server via 127.0.0.1 so
+ *      that the full NACM applies to the user instead of the file system
+ *      permissions that apply to the current klish.
+ */
 static int sys_add_new_user(sr_session_ctx_t *sess, char *name)
 {
 	char *shell = sys_find_usable_shell(sess, name);
-	char uid_str[10];
-	char *eargs[] = {
-		"adduser", "-d", "-s", shell, "-u", NULL, "-H", name, NULL
+	char *sargs[] = {
+		"adduser", "-d", "-s", shell, "-S", "-G", "wheel", name, NULL
 	};
-	char *nargs[] = {
+	char *uargs[] = {
 		"adduser", "-d", "-s", shell, name, NULL
 	};
-	bool do_chown = false;
 	char **args;
-	uid_t uid;
 	int err;

-	uid = sys_home_exists(name);
-	if (uid) {
-		if (sys_uid_busy(name, uid)) {
-			/* Exists but owned by someone else. */
-			ERROR("Creating user %s, /home/%s existed but was owned by another uid (%d)",
-			      name, name, uid);
-			ERROR("Cleaning up stale /home/%s", name);
-			systemf("rm -rf /home/%s", name);
-			args = nargs;
-		} else {
-			/* Not in passwd or owned by us already */
-			do_chown = true;
-
-			NOTE("Reusing uid %d and /home/%s for new user %s", uid, name, name);
-			snprintf(uid_str, sizeof(uid_str), "%d", uid);
-			eargs[5] = uid_str;
-			args = eargs;
-		}
-	} else
-		args = nargs;
+	/* XXX: group mapping to wheel should be done using nacm ACLs instead. */
+	if (!strcmp(name, "admin"))
+		args = sargs;	/* superuser */
+	else
+		args = uargs;	/* user */

 	/**
 	 * The Busybox implementation of 'adduser -d' sets the password
@@ -765,10 +700,7 @@ static int sys_add_new_user(sr_session_ctx_t *sess, char *name)
 		ERROR("Failed creating new user \"%s\"\n", name);
 		return SR_ERR_SYS;
 	}
-
 	NOTE("New user \"%s\" created\n", name);
-	if (do_chown)
-		systemf("chown -R %s:%s /home/%s", name, name, name);

 	/*
 	 * OpenSSH in Infix has been set up to use /var/run/sshd/%s.keys
@@ -863,19 +795,6 @@ static sr_error_t handle_sr_passwd_update(augeas *aug, sr_session_ctx_t *, struc
 	return err;
 }

-/* Is user allowed to use a POSIX shell? */
-static void check_shell(augeas *aug, const char *user)
-{
-	const char *shell;
-
-	if (!aug_get_dynpath(aug, &shell, "/files/etc/passwd/%s/shell", user)) {
-		if (strcmp(shell, "/bin/false") && strcmp(shell, "/bin/clish")) {
-			WARN("Disabling ssh/console login for %s, only CLI shell allowed.", user);
-			aug_set_dynpath(aug, "/bin/false", "etc/passwd/%s/shell", user);
-		}
-	}
-}
-
 static sr_error_t handle_sr_shell_update(augeas *aug, sr_session_ctx_t *sess, struct sr_change *change)
 {
 	char *shell = NULL;
@@ -914,7 +833,7 @@ static sr_error_t check_sr_user_update(augeas *aug, sr_session_ctx_t *, struct s
 		ERROR("Invalid username \"%s\"", name);
 		return SR_ERR_VALIDATION_FAILED;
 	}
-	NOTE("Username \"%s\" is valid", name);
+	ERROR("Username \"%s\" is valid", name);

 	return SR_ERR_OK;
 }
@@ -935,6 +854,7 @@ static sr_error_t handle_sr_user_update(augeas *aug, sr_session_ctx_t *sess, str
 			sr_xpath_recover(&state);
 			return err;
 		}
+		NOTE("User %s created", name);
 		sr_xpath_recover(&state);
 		break;
 	case SR_OP_DELETED:
@@ -946,6 +866,7 @@ static sr_error_t handle_sr_user_update(augeas *aug, sr_session_ctx_t *sess, str
 			sr_xpath_recover(&state);
 			return err;
 		}
+		NOTE("User %s deleted", name);
 		sr_xpath_recover(&state);
 		break;
 	case SR_OP_MOVED:
@@ -1097,102 +1018,6 @@ static int change_auth(sr_session_ctx_t *session, uint32_t sub_id, const char *m
 	return SR_ERR_OK;
 }

-static int change_nacm(sr_session_ctx_t *session, uint32_t sub_id, const char *module,
-		       const char *_, sr_event_t event, unsigned request_id, void *priv)
-{
-	sr_val_t *users = NULL, *groups = NULL, *rules = NULL;
-	size_t user_count = 0, group_count = 0, rule_count = 0;
-	struct confd *confd = (struct confd *)priv;
-	int rc;
-
-	if (event != SR_EV_DONE)
-		return SR_ERR_OK;
-
-	/* Fetch all users from ietf-system */
-	rc = sr_get_items(session, XPATH_AUTH_"/user/name", 0, 0, &users, &user_count);
-	if (SR_ERR_OK != rc) {
-		ERROR("Failed fetching system users: %s", sr_strerror(rc));
-		goto cleanup;
-	}
-
-	aug_load(confd->aug);
-
-	for (size_t i = 0; i < user_count; i++) {
-		const char *user = users[i].data.string_val;
-		char xpath[256];
-		bool is_admin = false;
-		char *path = NULL;
-		char **match;
-		int num;
-
-		/* Fetch groups for each user */
-		snprintf(xpath, sizeof(xpath), NACM_BASE_"/groups/group[user-name='%s']/name", user);
-		rc = sr_get_items(session, xpath, 0, 0, &groups, &group_count);
-		if (!rc) {
-			for (size_t j = 0; j < group_count; j++) {
-				/* Fetch and check rules for each group */
-				snprintf(xpath, sizeof(xpath), NACM_BASE_"/rule-list[group='%s']/rule"
-					 "[module-name='*'][access-operations='*'][action='permit']",
-					 groups[j].data.string_val);
-				rc = sr_get_items(session, xpath, 0, 0, &rules, &rule_count);
-				if (rc)
-					continue; /* not found, this is OK */
-
-				/* At least one group grants full administrator permissions */
-				is_admin = true;
-
-				sr_free_values(rules, rule_count);
-			}
-
-			sr_free_values(groups, group_count);
-		}
-
-		/* Check if user is already in group */
-		num = aug_match(confd->aug, "/files/etc/group/wheel/user", &match);
-		if (num) {
-			for (int j = 0; j < num; j++) {
-				const char *val = NULL;
-
-				aug_get(confd->aug, match[j], &val);
-				if (val && !strcmp(val, user))
-					path = match[j];
-				else
-					free(match[j]);
-			}
-			free(match);
-		}
-
-		if (is_admin) {
-			if (path)
-				goto done; /* already admin */
-
-			if (aug_set(confd->aug, "/files/etc/group/wheel/user[last() + 1]", user))
-				ERROR("Failed giving user %s UNIX sysadmin permissions.", user);
-			else
-				NOTE("User %s added to UNIX sysadmin group.", user);
-		} else {
-			check_shell(confd->aug, user);
-			if (!path)
-				goto done; /* not member of wheel */
-
-			if (aug_rm(confd->aug, path) < 1)
-				ERROR("Failed removing user %s from UNIX sysadmin group.", user);
-			else
-				NOTE("User %s removed from UNIX sysadmin group.", user);
-		}
-	done:
-		if (path)
-			free(path);
-	}
-
-	aug_save(confd->aug);
-cleanup:
-	if (users)
-		sr_free_values(users, user_count);
-
-	return 0;
-}
-
 static int change_motd(sr_session_ctx_t *session, uint32_t sub_id, const char *module,
 		       const char *xpath, sr_event_t event, unsigned request_id, void *priv)
 {
@@ -1408,9 +1233,6 @@ int ietf_system_init(struct confd *confd)
 	}

 	REGISTER_CHANGE(confd->session, "ietf-system", XPATH_AUTH_, 0, change_auth, confd, &confd->sub);
-	REGISTER_MONITOR(confd->session, "ietf-netconf-acm", "/ietf-netconf-acm:nacm//.",
-			 0, change_nacm, confd, &confd->sub);
-
 	REGISTER_CHANGE(confd->session, "ietf-system", XPATH_BASE_"/hostname", 0, change_hostname, confd, &confd->sub);
 	REGISTER_CHANGE(confd->session, "ietf-system", XPATH_BASE_"/infix-system:motd", 0, change_motd, confd, &confd->sub);
 	REGISTER_CHANGE(confd->session, "ietf-system", XPATH_BASE_"/infix-system:motd-banner", 0, change_motd_banner, confd, &confd->sub);
@@ -312,15 +312,6 @@ static int change(sr_session_ctx_t *session, uint32_t sub_id, const char *module
 		}
 	}

-	if (!ena) {
-		LYX_LIST_FOR_EACH(cifs, cif, "client-if") {
-			const char *ifname = lydx_get_cattr(cif, "if-name");
-
-			INFO("DHCP client globally disabled, stopping client on %s ...", ifname);
-			del(ifname);
-		}
-	}
-
 	lyd_free_tree(diff);
 err_release_data:
 	sr_release_data(cfg);
@@ -87,7 +87,7 @@ static int mdns_records(const char *cmd, svc type)
 			snprintf(buf, sizeof(buf), srv->text, hostname);

 		systemf("/usr/libexec/confd/gen-service %s %s %s %s %d \"%s\" %s", cmd,
-			hostname, srv->name, srv->type, srv->port, srv->desc, buf);
+			hostname, srv->name, name[type], srv->port, srv->desc, buf);
 	}

 	return SR_ERR_OK;
@@ -165,7 +165,7 @@ static void svc_enadis(int ena, svc type, const char *svc)
 	}

 	if (type != none)
-		mdns_records(ena ? "add" : "delete", type);
+		mdns_records(ena ? "" : "delete", type);

 	systemf("initctl -nbq touch avahi");
 	systemf("initctl -nbq touch nginx");
@@ -285,7 +285,7 @@ static int web_change(sr_session_ctx_t *session, uint32_t sub_id, const char *mo
 		svc_enadis(0, netbrowse, NULL);
 	}

-	svc_enadis(ena, web, "nginx");
+	svc_enadis(ena, none, "nginx"); /* fake it, not nginx .conf */
 	mdns_cname(session);

 	return put(cfg, srv);
@@ -13,19 +13,10 @@ module infix-hardware {
    prefix yang;
  }

-  organization "KernelKit";
-  contact      "kernelkit@googlegroups.com";
-  description  "Vital Product Data augmentation of ieee-hardware and deviations.";
-
-  revision 2024-04-25 {
-    description "Spellcheck leaf: coutry-code -> country-code";
-    reference "internal";
-  }
  revision 2024-01-18 {
    description "Initial";
    reference "internal";
  }
-
  typedef country-code {
    type string {
      length 2;
@@ -123,7 +114,7 @@ module infix-hardware {
      leaf manufacturer {
 	type string;
      }
-      leaf country-code {
+      leaf coutry-code {
 	type country-code;
      }
      leaf vendor {
@@ -416,7 +416,6 @@ submodule infix-if-bridge {
    when "derived-from-or-self(if:type,'ianaift:bridge') or "+
         "derived-from-or-self(if:type,'ianaift:ethernetCsmacd') or "+
         "derived-from-or-self(if:type,'ianaift:ieee8023adLag') or "+
-         "derived-from-or-self(if:type,'ianaift:l2vlan') or "+
         "derived-from-or-self(if:type,'ianaift:ilan')" {
      description "Applies when a Bridge interface exists.";
    }
@@ -24,7 +24,6 @@ int asprintf(char **strp, const char *fmt, ...);
 #define DEBUG(fmt, ...) do { if (debug) syslog(LOG_DEBUG, fmt, ##__VA_ARGS__); } while (0)
 #define INFO(fmt, ...)  syslog(LOG_INFO, fmt, ##__VA_ARGS__)
 #define NOTE(fmt, ...)  syslog(LOG_NOTICE, fmt, ##__VA_ARGS__)
-#define WARN(fmt, ...)  syslog(LOG_WARNING, "%s: " fmt, __func__, ##__VA_ARGS__)
 #define ERROR(fmt, ...) syslog(LOG_ERR, "%s: " fmt, __func__, ##__VA_ARGS__)
 #define ERRNO(fmt, ...) syslog(LOG_ERR, "%s: " fmt ": %s", __func__, ##__VA_ARGS__, strerror(errno))

@@ -187,7 +187,7 @@ with infamy.Test() as test:
            snif = infamy.Sniffer(ns0, "ip proto 89")
            with snif:
                time.sleep(15) # default hello time 10s
-            assert(snif.packets() == "")
+            assert(snif.output().stdout == "")

    with test.step("Test connectivity"):
        _, hport0 = env.ltop.xlate("host", "data1")
@@ -1,26 +1,23 @@
 #!/usr/bin/env python3
-#           ¦                              ¦
-#           ¦       vlan10 IP:10.0.0.2     ¦        br0  IP:10.0.0.3
-#           ¦       /                      ¦       /
-#           ¦     br0  <-- VLAN filtering  ¦     e0.10
-#           ¦   u/  \t                     ¦    /
-#   PC ------- e0    e1 ---------------------- e0
-# PING -->  ¦             dut1             ¦            dut2
 #
+#                vlan10 IP:10.0.0.2
+#                /
+# PING -->     br0  <-- VLAN filtering enabled
+#             /
+#   PC ---- e0
+#
+
 import infamy

 with infamy.Test() as test:
    with test.step("Initialize"):
-        env  = infamy.Env(infamy.std_topology("2x2"))
-        dut1 = env.attach("target1", "mgmt")
-        dut2 = env.attach("target2", "mgmt")
+        env = infamy.Env(infamy.std_topology("1x2"))
+        target = env.attach("target", "mgmt")

-    with test.step("Topology setup"):
-        _, dut1_e0 = env.ltop.xlate("target1", "data")
-        _, dut1_e1 = env.ltop.xlate("target1", "target2")
-        _, dut2_e0 = env.ltop.xlate("target2", "target1")
+    with test.step("Configure single vlan-filtering bridge with vlan10 subinterface @ IP 10.0.0.2"):
+        _, tport = env.ltop.xlate("target", "data")

-        dut1.put_config_dict("ietf-interfaces", {
+        target.put_config_dict("ietf-interfaces", {
            "interfaces": {
                "interface": [
                    {
@@ -33,8 +30,8 @@ with infamy.Test() as test:
                                "vlan": [
                                    {
                                        "vid": 10,
-                                        "untagged": [ dut1_e0 ],
-                                        "tagged":   [ "br0", dut1_e1 ]
+                                        "untagged": [ tport ],
+                                        "tagged":   [ "br0" ]
                                    }
                                ]
                            }
@@ -58,63 +55,19 @@ with infamy.Test() as test:
                        }
                    },
                    {
-                        "name": dut1_e0,
+                        "name": tport,
                        "enabled": True,
                        "infix-interfaces:bridge-port": {
                            "pvid": 10,
                            "bridge": "br0"
                        }
                    },
-                    {
-                        "name": dut1_e1,
-                        "enabled": True,
-                        "infix-interfaces:bridge-port": {
-                            "pvid": 10,
-                            "bridge": "br0"
-                        }
-                    }
                ]
            }
        })

-        dut2.put_config_dict("ietf-interfaces", {
-            "interfaces": {
-                "interface": [
-                    {
-                        "name": "br0",
-                        "type": "infix-if-type:bridge",
-                        "enabled": True,
-                        "ipv4": {
-                            "address": [
-                                {
-                                    "ip": "10.0.0.3",
-                                    "prefix-length": 24,
-                                }
-                            ]
-                        }
-                    },
-                    {
-                        "name": dut2_e0,
-                        "enabled": True
-                    },
-                    {
-                        "name": "e0.10",
-                        "type": "infix-if-type:vlan",
-                        "enabled": True,
-                        "vlan": {
-                            "lower-layer-if": dut2_e0,
-                            "id": 10,
-                        },
-                        "infix-interfaces:bridge-port": {
-                            "bridge": "br0"
-                        }
-                    }
-                ]
-            }
-        })
-
-    with test.step("Connectivity check"):
-        _, hport = env.ltop.xlate("host", "data1")
+    with test.step("Ping vlan10 subinterface 10.0.0.2 from host:data with IP 10.0.0.1"):
+        _, hport = env.ltop.xlate("host", "data")

        with infamy.IsolatedMacVlan(hport) as ns:
            pingtest = ns.runsh("""
@@ -124,7 +77,6 @@ with infamy.Test() as test:
            ip addr add 10.0.0.1/24 dev iface

            ping -c1 -w5 10.0.0.2 || exit 1
-            ping -c1 -w5 10.0.0.3 || exit 1
            """)

        if pingtest.returncode:
@@ -98,16 +98,16 @@ with infamy.Test() as test:
                    time.sleep(5)
                    with snif_nojoin:
                        time.sleep(5)
-                assert(snif_receiver.packets() != "")
-                assert(snif_nojoin.packets() != "")
+                assert(snif_receiver.output().stdout != "")
+                assert(snif_nojoin.output().stdout != "")
                print("As expected, unregistered multicast is received on both ports")

                with receiver:
                    with snif_receiver,snif_nojoin:
                            time.sleep(5)
-                    assert(snif_nojoin.packets() == "")
+                    assert(snif_nojoin.output().stdout == "")
                    print("As expected, registered multicast is NOT forwarded to non-member port")
-                    assert(snif_receiver.packets() != "")
+                    assert(snif_receiver.output().stdout != "")
                    print("As expected, registered multicast is forwarded to the member port")

        test.succeed()
@@ -282,13 +282,13 @@ with infamy.Test() as test:
                # TODO: Here should we check for 224.1.1.1 in mdb, also
                # verify that 224.2.2.2 does not exist in mdb

-                assert(snif_vlan77_sender_incorrect.packets() == "")
-                assert(snif_vlan77_receiver_incorrect.packets() == "")
-                assert(snif_vlan55_receiver_incorrect.packets() == "")
-                assert(snif_vlan55_sender_incorrect.packets() == "")
+                assert(snif_vlan77_sender_incorrect.output().stdout == "")
+                assert(snif_vlan77_receiver_incorrect.output().stdout == "")
+                assert(snif_vlan55_receiver_incorrect.output().stdout == "")
+                assert(snif_vlan55_sender_incorrect.output().stdout == "")
                print("Multicast does not exist on ports/VLANs where they should not be")
-                assert(snif_vlan55_receiver_correct.packets() != "")
-                assert(snif_vlan77_receiver_correct.packets() != "")
+                assert(snif_vlan55_receiver_correct.output().stdout != "")
+                assert(snif_vlan77_receiver_correct.output().stdout != "")
                print("Multicast received on correct port and VLAN")

        test.succeed()
@@ -125,8 +125,8 @@ with infamy.Test() as test:
                    time.sleep(5)
                    with snif_nojoin:
                        time.sleep(5)
-                assert(snif_receiver.packets() != "")
-                assert(snif_nojoin.packets() != "")
+                assert(snif_receiver.output().stdout != "")
+                assert(snif_nojoin.output().stdout != "")
                print("As expected, unregistered multicast is received on both ports")

                set_static_multicast_filter(target, "224.1.1.1")
@@ -134,9 +134,9 @@ with infamy.Test() as test:
                with snif_receiver,snif_nojoin:
                    time.sleep(5)

-                assert(snif_nojoin.packets() == "")
+                assert(snif_nojoin.output().stdout == "")
                print("As expected, registered multicast is NOT forwarded to non-member port")
-                assert(snif_receiver.packets() != "")
+                assert(snif_receiver.output().stdout != "")
                print("As expected, registered multicast is forwarded to the member port")

        test.succeed()
@@ -1,3 +1,3 @@
 ---
 # Too flaky, disabled for now, needs an LLDP discovery/client function
- case: services_basic.py
+#- case: services_basic.py
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Tobias Waldekranz	1854bca98b	[DEBUG] Debug image settings	2024-04-19 14:18:11 +02:00
Tobias Waldekranz	00261fb120	[DEBUG] Increase critical temperature trip point to 115C For testing purposes.	2024-04-19 14:13:25 +02:00
Tobias Waldekranz	4a69d1564d	[DEBUG] Add temperature related load and monitoring scripts Also enable the required packages.	2024-04-19 14:13:25 +02:00