confd: fix audit logs using proper facility

The LOG_SECURITY facility was set wrong (1 << 13) instead of (13 << 3), see https://github.com/kernelkit/sysklogd/blob/0fc6656/src/syslog.h#L120 for details. This caused all audit log messages to be logged in LOG_USER. Also, rename LOG_SECURITY -> LOG_AUDIT and log macro SECURITY() -> AUDIT() to match RFC5424 terminology. Similar fix to sysrepo, LOG_AUDIT facility instead of daemon + WARNING. Additionally, drop the leading [severity] prefix to sysrepo logs. Only needed when logging to stdout. Follow-up to issue #521 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
confd,statd: fix invalid option to openlog()
2026-07-26 18:53:01 +02:00 · 2024-08-30 15:29:11 +02:00 · 2024-08-30 15:29:11 +02:00 · 2024-08-30 15:29:11 +02:00 · 2024-08-30 15:29:11 +02:00 · 2024-08-30 15:29:11 +02:00
245 changed files with 9451 additions and 851 deletions
@@ -16,6 +16,13 @@ jobs:
        target: [aarch64, x86_64]
      fail-fast: false
    steps:
+      - name: Cleanup Build Folder
+        run: |
+          ls -la ./
+          rm -rf ./* || true
+          rm -rf ./.??* || true
+          ls -la ./
+
      - uses: actions/checkout@v4
        with:
          clean: true
@@ -58,6 +65,10 @@ jobs:
          echo "Building ${{ matrix.target }}_defconfig ..."
          make

+      - name:  Check SBOM from Build
+        run: |
+          make legal-info
+
      - name: Prepare ${{ matrix.target }} Artifact
        run: |
          cd output/
@@ -2,7 +2,7 @@ name: Coverity Scan

 on:
  schedule:
-    - cron: '5 0 * * *'
+    - cron: '5 0 * * 6'
  workflow_dispatch:

 env:
@@ -1,4 +1,4 @@
-export BR2_EXTERNAL := $(CURDIR)
+export BR2_EXTERNAL ?= $(CURDIR)
 export PATH         := $(CURDIR)/bin:$(PATH)

 ARCH ?= $(shell uname -m)
@@ -5,8 +5,8 @@
 Infix is a free, Linux based, immutable Network Operating System (NOS)
 built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
 porting to different platforms, simplify long-term maintenance, and
-provide made-easy management using NETCONF[^1] or the built-in command
-line interface (CLI) from a console or SSH login.
+provide made-easy management using NETCONF, RESTCONF[^2], or the
+built-in command line interface (CLI) from a console or SSH login.

 > Click the **▶ Example CLI Session** foldout below for an example, or
 > head on over to the [Infix Documentation](doc/README.md) for more
@@ -22,7 +22,7 @@ may be appealing for other use-cases as well:
 - Atomic upgrades to secondary partition
 - Highly security focused

-An immutable[^2] operating system enhances security and inherently makes
+An immutable[^1] operating system enhances security and inherently makes
 it maintenance-free.  Configuration and data, e.g, containers, is stored
 on separate partitions to ensure complete separation from system files
 and allow for seamless backup, restore, and provisioning.
@@ -93,6 +93,7 @@ The [following boards](board/aarch64/README.md) are fully supported:
 - Marvell CN9130 CRB
 - Marvell EspressoBIN
 - Microchip SparX-5i PCB135 (eMMC)
+ - StarFive VisionFive2
 - NanoPi R2S

 An x86_64 build is also available, primarily intended for development
@@ -105,14 +106,15 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
 >
 > For *customer specific builds* of Infix, see your product repository.

-[^1]: NETCONF or RESTCONF, <https://datatracker.ietf.org/doc/html/rfc8040>
-
-[^2]: An immutable operating system is one with read-only file systems,
+[^1]: An immutable operating system is one with read-only file systems,
    atomic updates, rollbacks, declarative configuration, and workload
    isolation.  All to improve reliability, scalability, and security.
    For more information, see <https://ceur-ws.org/Vol-3386/paper9.pdf>
    and <https://www.zdnet.com/article/what-is-immutable-linux-heres-why-youd-run-an-immutable-linux-distro/>.

+[^2]: Partial RESTCONF support, features like HTTP PATCH, OPTIONS, HEAD,
+    and copying between datastores are still missing.
+
 [1]: https://buildroot.org/
 [2]: https://www.sysrepo.org/
 [3]: doc/cli/introduction.md
@@ -3,5 +3,7 @@ aarch64

 Board Specific Documentation
 ----------------------------
+
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
+- [NanoPi R2S](r2s/)
@@ -118,8 +118,8 @@ the device is reasonably correct, and run the provisioning script:

    admin@infix:~$ sudo -i
    root@infix:~$ udhcpc -i e28
-	root@infix:~$ date -us YYYY-MM-DD
-	root@infix:~$ /libexec/infix/prod/provision tftp://<PC-IP>/infix-aarch64.pkg /dev/mmcblk0
+    root@infix:~$ date -us YYYY-MM-DD
+    root@infix:~$ /usr/libexec/infix/prod/provision tftp://<PC-IP>/infix-aarch64.pkg /dev/mmcblk0

 After successful completion, the device is fully provisioned. On the
 next boot, the device will boot of its own accord from the primary
@@ -92,7 +92,7 @@
 		compatible = "atmel,24c256";
                reg = <0x50>;

-		infix,board = "cpu";
+		infix,board = "product";
 		infix,trusted;

 		nvmem-layout {
@@ -512,6 +512,7 @@ CONFIG_FUSE_FS=y
 CONFIG_VIRTIO_FS=y
 CONFIG_OVERLAY_FS=y
 CONFIG_VFAT_FS=y
+CONFIG_EXFAT_FS=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_SQUASHFS=y
@@ -0,0 +1,165 @@
+FriendlyELC NanoPi R2S
+======================
+
+The [NanoPi R2S][1] is a very low-cost 64-bit ARM min router, powered by
+the Rockchip RK3328, quad-core Cortex-A53.
+
+The R2S does not have any onboard eMMC, so the only way to boot Infix on
+it is using and SD card.
+
+
+LEDs
+----
+
+The front system LEDs work as follows in Infix:
+
+| **Stage**      | **SYS** | **LAN** | **WAN** |
+|----------------|---------|---------|---------|
+| Power-on       | dimmed  | off     | off     |
+| Factory reset  | on      | on      | on      |
+| Linux loading  | on      | off     | off     |
+| System loading | 1 Hz    | off     | off     |
+| System up      | off     | on      | off     |
+| WAN address    | off     | on      | on      |
+| Locate         | 1 Hz    | 1 Hz    | 1 Hz    |
+| Fail safe      | 5 Hz    | off     | off     |
+| Panic          | 5 Hz    | 5 Hz    | 5 Hz    |
+
+Powering on the device the SYS LED is turned on faintly (dimmed).  It
+remains dimmed while U-Boot loads the kernel, and turns bright red when
+the kernel starts.  It remains steady on until the system has started
+the LED daemon, `iitod`, which sets it blinking at 1 Hz while the rest
+of the system starts up.  When the system has come up successfully, the
+SYS LED is turned off and the green LAN LED turns on.  The WAN LED will
+turn on (green) when the WAN interface is up and has an IP address.
+
+> Compared to the `x86_64` Qemu target, it takes a while to parse all
+> YANG models and load `startup-config`, but the whole process should
+> not take more than 60 seconds, and usually a lot less.
+
+If a "find my device" function exists, it will blink all LEDs at 1 Hz.
+
+If `startup-config` fails to load Ínfix reverts to `failure-config`,
+putting the device in fail safe (or fail secure) mode.  Indicated by
+the SYS LED blinking at 5 Hz instead of turning off.
+
+If Infix for some reason also fails to load `failure-config`, then all
+LEDs will blink at 5 Hz to clearly indicate something is very wrong.
+
+In all error cases the console shows the problem.
+
+
+Factory Reset
+-------------
+
+The reset button on the side can be used not only to safely reboot the
+device, but can also be used to trigger a factory reset at power on.
+
+At power-on, keep the reset button pressed for 10 seconds.  The system
+LEDs (SYS, WAN, LAN) will all blink at 1 Hz, to help you count down the
+seconds.  When the 10 seconds have passed all LEDs are turned off before
+loading Linux.
+
+When Linux boots up it confirms the factory reset by lighting up the
+LEDs again, no blinking this time.  The LEDs stay on until all files and
+directories on read/writable partitions (`/cfg` and `/var`) have been
+safely erased.
+
+The system then continues loading, turning off all LEDs except SYS,
+which blinks calmly at 1 Hz as usual until the system has completed
+loading, this time with a `startup-config` freshly restored from the
+device's `factory-config`.
+
+
+How to Build
+------------
+
+```
+$ make r2s_defconfig
+$ make
+```
+
+Once the build has finished you will have `output/images/sdcard.img`
+which you can flash to an SD card.
+
+```
+$ sudo dd if=output/images/sdcard.img of=/dev/mmcblk0 bs=1M status=progress oflag=direct
+```
+
+> **WARNING:** ensure `/dev/mmcblk0` really is the correct device for
+> your SD card, and not used by the system!
+
+
+Booting the Board
+-----------------
+
+ 1. Connect a TTL cable to three UART pins, GND is closest to the edge
+ 2. Insert the flashed SD card
+ 3. Power-up the board using an USB-C cable (ensure good power source!)
+
+Worth noting, unlike many other boards, the Rockchip family of chipsets
+runs the UART at 1500000 bps (1.5 Mbps) 8N1.
+
+
+Secure Boot
+-----------
+
+Like other Infix builds, the R2S enjoys secure boot.  Please note,
+however that the default signing keys are the public!
+
+Also, default builds allow modifying and saving the U-Boot environment
+(see below), which you may want to disable to secure the device.  The
+device also runs in *developer mode*, allowing full U-Boot shell access,
+which you may also want to disable in a full production setting.
+
+
+Caveat
+------
+
+Most (all?) of these boards do not have any Vital Product Data (VPD)
+EEPROM mounted.  This means they do not come with unique MAC addresses
+allocated to the two Ethernet ports.
+
+The bootloader (U-Boot) default environment for the board is usually
+what provides a default, the same default MAC addresses to Linux:
+
+ - 4a:dc:d8:20:0d:84
+ - 4a:dc:d8:20:0d:85
+
+This is important in case you want to run multiple R2S devices on the
+same LAN.  Meaning you either have to change the MAC address in the
+U-Boot environment (below), or modify your `phys-address` setting in
+Infix for the interface(s).
+
+Break into U-Boot using Ctrl-C at power-on, preferably when the text
+`Press Ctrl-C NOW to enter boot menu` is displayed.  Exit the menu to
+get to the prompt:
+
+```
+(r2s) printenv
+...
+eth1addr=4a:dc:d8:20:0d:84
+ethact=ethernet@ff540000
+ethaddr=4a:dc:d8:20:0d:85
+ethprime=eth0
+...
+```
+
+Here we change both addresses, using the *Locally Administered* bit:
+
+```
+(r2s) setenv eth1addr 02:00:c0:ff:ee:01
+(r2s) setenv ethaddr 02:00:c0:ff:ee:00
+(r2s) saveenv
+```
+
+Boot the system, log into Linux, and inspect the MAC addresses:
+
+```
+admin@infix-00-00-00:~$ ip -br l
+lo      UP     00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP>
+eth0    UP     02:00:c0:ff:ee:00 <BROADCAST,MULTICAST,UP,LOWER_UP>
+eth1    UP     02:00:c0:ff:ee:01 <BROADCAST,MULTICAST,UP,LOWER_UP>
+```
+
+[1]: https://wiki.friendlyelec.com/wiki/index.php/NanoPi_R2S
@@ -1,4 +0,0 @@
-label Infix on NanoPi R2S
-  kernel /boot/Image
-  devicetree /boot/rk3328-nanopi-r2s.dtb
-  append root=/dev/mmcblk0p1 rw rootwait bonding.max_bonds=0 dummy.numdummies=0 fb_tunnels=none quiet
@@ -1,37 +1,70 @@
 image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
 	ext4 {
 		label = "cfg"
 	}
+}
+
+image var.ext4 {
 	empty = true
-	size = 16M
+	temporary = true
+	size = 512M
+
+	ext4 {
+		label = "var"
+		use-mke2fs = true
+	}
 }

 image sdcard.img {
 	hdimage {
+		partition-table-type = "gpt"
 	}

 	partition u-boot-tpl-spl-dtb {
 		in-partition-table = "no"
-		image = "idbloader.img"
 		offset = 32K
+		image = "idbloader.img"
 	}

 	partition u-boot-dtb {
 		in-partition-table = "no"
-		image = "u-boot.itb"
 		offset = 8M
+		image = "u-boot.itb"
 	}

-	partition rootfs {
-		partition-type = 0x83
+	partition aux {
+		partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
 		offset = 16M
-		image = "rootfs.ext4"
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 200M
+		image = "rootfs.squashfs"
+	}
+
+	partition secondary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 200M
+		image = "rootfs.squashfs"
 	}

 	partition cfg {
-		partition-type = 0x83
+		partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
 		image = "cfg.ext4"
 	}
+
+	partition var {
+		partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+		image = "var.ext4"
+	}
 }

 # Silence genimage warnings
@@ -3,22 +3,31 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_AUDIT=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
 CONFIG_BPF_JIT=y
 CONFIG_PREEMPT=y
 CONFIG_IRQ_TIME_ACCOUNTING=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_PSI=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
-CONFIG_NUMA_BALANCING=y
+CONFIG_LOG_BUF_SHIFT=18
 CONFIG_MEMCG=y
 CONFIG_BLK_CGROUP=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_RT_GROUP_SCHED=y
 CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
 CONFIG_CGROUP_HUGETLB=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
@@ -27,19 +36,14 @@ CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
 CONFIG_KEXEC_FILE=y
-CONFIG_CRASH_DUMP=y
-CONFIG_ARCH_ACTIONS=y
 CONFIG_ARCH_ROCKCHIP=y
-CONFIG_ARCH_VEXPRESS=y
 CONFIG_ARM64_VA_BITS_48=y
 CONFIG_SCHED_MC=y
 CONFIG_SCHED_SMT=y
-CONFIG_NUMA=y
+CONFIG_NR_CPUS=8
 CONFIG_COMPAT=y
 CONFIG_RANDOMIZE_BASE=y
-CONFIG_HIBERNATION=y
-CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
-CONFIG_ENERGY_MODEL=y
+# CONFIG_SUSPEND is not set
 CONFIG_ARM_PSCI_CPUIDLE=y
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_STAT=y
@@ -48,8 +52,8 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
 CONFIG_CPUFREQ_DT=y
-CONFIG_ACPI_CPPC_CPUFREQ=m
 CONFIG_ARM_SCMI_CPUFREQ=y
+CONFIG_ACPI_CPPC_CPUFREQ=m
 CONFIG_ACPI=y
 CONFIG_ACPI_APEI=y
 CONFIG_ACPI_APEI_GHES=y
@@ -57,6 +61,7 @@ CONFIG_ACPI_APEI_MEMORY_FAILURE=y
 CONFIG_ACPI_APEI_EINJ=y
 CONFIG_VIRTUALIZATION=y
 CONFIG_KVM=y
+CONFIG_KPROBES=y
 CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
@@ -67,8 +72,11 @@ CONFIG_KSM=y
 CONFIG_MEMORY_FAILURE=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CMA=y
+CONFIG_CMA_AREAS=20
 CONFIG_NET=y
 CONFIG_PACKET=y
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
 CONFIG_IP_MULTIPLE_TABLES=y
@@ -76,24 +84,66 @@ CONFIG_IP_ROUTE_MULTIPATH=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
-CONFIG_NET_IPIP=y
-CONFIG_NET_IPGRE_DEMUX=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
 CONFIG_NET_IPGRE_BROADCAST=y
 CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_IPV6=m
+CONFIG_SYN_COOKIES=y
+CONFIG_IPV6_SIT=m
+CONFIG_IPV6_GRE=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETWORK_PHY_TIMESTAMPING=y
 CONFIG_NETFILTER=y
-CONFIG_NF_CONNTRACK=m
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_CT=m
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_REJECT_NETDEV=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CGROUP=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
@@ -101,17 +151,46 @@ CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
 CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
 CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
-CONFIG_BRIDGE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
+CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
+CONFIG_NF_CONNTRACK_BRIDGE=y
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
-CONFIG_NET_DSA=m
-CONFIG_NET_DSA_TAG_OCELOT=m
-CONFIG_NET_DSA_TAG_OCELOT_8021Q=m
-CONFIG_VLAN_8021Q=m
+CONFIG_BRIDGE_MRP=y
+CONFIG_BRIDGE_CFM=y
+CONFIG_VLAN_8021Q=y
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
 CONFIG_NET_SCHED=y
@@ -121,13 +200,22 @@ CONFIG_NET_SCH_TAPRIO=m
 CONFIG_NET_SCH_MQPRIO=m
 CONFIG_NET_SCH_INGRESS=m
 CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_BPF=m
 CONFIG_NET_CLS_FLOWER=m
 CONFIG_NET_CLS_ACT=y
-CONFIG_NET_ACT_GACT=m
-CONFIG_NET_ACT_MIRRED=m
-CONFIG_NET_ACT_GATE=m
+CONFIG_NET_ACT_GACT=y
+CONFIG_NET_ACT_MIRRED=y
+CONFIG_NET_ACT_NAT=y
+CONFIG_NET_ACT_SKBEDIT=y
+CONFIG_NET_ACT_VLAN=y
+CONFIG_NET_ACT_BPF=y
+CONFIG_DCB=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_MPLS=y
+CONFIG_NET_MPLS_GSO=y
+CONFIG_MPLS_ROUTING=m
+CONFIG_NET_PKTGEN=y
 CONFIG_BT=m
-CONFIG_BT_HIDP=m
 # CONFIG_BT_LE is not set
 CONFIG_BT_LEDS=y
 # CONFIG_BT_DEBUGFS is not set
@@ -142,6 +230,7 @@ CONFIG_MAC80211_LEDS=y
 CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
+# CONFIG_ETHTOOL_NETLINK is not set
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
@@ -157,6 +246,7 @@ CONFIG_PCI_EPF_TEST=m
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_VEXPRESS_CONFIG=y
 CONFIG_ARM_SCMI_PROTOCOL=y
 CONFIG_ARM_SCPI_PROTOCOL=y
 CONFIG_EFI_CAPSULE_LOADER=y
@@ -171,6 +261,7 @@ CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_PHYSMAP_OF=y
 CONFIG_MTD_DATAFLASH=y
 CONFIG_MTD_SST25L=y
+CONFIG_MTD_BLOCK2MTD=y
 CONFIG_MTD_RAW_NAND=y
 CONFIG_MTD_NAND_DENALI_DT=y
 CONFIG_MTD_SPI_NOR=y
@@ -191,6 +282,7 @@ CONFIG_SCSI_HISI_SAS=y
 CONFIG_SCSI_HISI_SAS_PCI=y
 CONFIG_MEGARAID_SAS=y
 CONFIG_SCSI_MPT3SAS=m
+CONFIG_SCSI_VIRTIO=y
 CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_AHCI_PLATFORM=y
@@ -198,24 +290,29 @@ CONFIG_AHCI_CEVA=y
 CONFIG_SATA_SIL24=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_MD=y
-CONFIG_BLK_DEV_MD=m
-CONFIG_BLK_DEV_DM=m
-CONFIG_DM_MIRROR=m
-CONFIG_DM_ZERO=m
+# CONFIG_MD_BITMAP_FILE is not set
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_INIT=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
-CONFIG_DUMMY=y
+CONFIG_DUMMY=m
 CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
-CONFIG_VXLAN=y
+CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
+CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_BAREUDP=m
-CONFIG_TUN=y
+CONFIG_MACSEC=m
+CONFIG_TUN=m
 CONFIG_VETH=m
-CONFIG_VIRTIO_NET=m
+CONFIG_VIRTIO_NET=y
+CONFIG_NLMON=y
+CONFIG_NET_VRF=y
 # CONFIG_NET_VENDOR_3COM is not set
-# CONFIG_NET_VENDOR_ACTIONS is not set
 # CONFIG_NET_VENDOR_ADAPTEC is not set
 # CONFIG_NET_VENDOR_AGERE is not set
 # CONFIG_NET_VENDOR_ALACRITECH is not set
@@ -283,15 +380,12 @@ CONFIG_STMMAC_ETH=y
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 # CONFIG_NET_VENDOR_XILINX is not set
+CONFIG_LED_TRIGGER_PHY=y
 CONFIG_AX88796B_PHY=y
-CONFIG_MICREL_PHY=y
-CONFIG_MICROSEMI_PHY=y
-CONFIG_AT803X_PHY=m
+CONFIG_DAVICOM_PHY=m
 CONFIG_REALTEK_PHY=y
 CONFIG_ROCKCHIP_PHY=y
 CONFIG_MDIO_BITBANG=y
-CONFIG_MDIO_BCM_UNIMAC=m
-CONFIG_MDIO_THUNDER=y
 CONFIG_MDIO_BUS_MUX_MULTIPLEXER=y
 CONFIG_MDIO_BUS_MUX_MMIOREG=y
 CONFIG_USB_RTL8150=m
@@ -299,6 +393,7 @@ CONFIG_USB_RTL8152=m
 CONFIG_USB_USBNET=y
 CONFIG_USB_NET_AX8817X=m
 CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_CDC_NCM=m
 CONFIG_USB_NET_DM9601=m
 CONFIG_USB_NET_SMSC75XX=m
 CONFIG_USB_NET_SMSC95XX=m
@@ -306,13 +401,12 @@ CONFIG_USB_NET_NET1080=m
 CONFIG_USB_NET_PLUSB=m
 CONFIG_USB_NET_MCS7830=m
 CONFIG_USB_NET_CDC_SUBSET=m
-CONFIG_USB_NET_ZAURUS=m
+# CONFIG_USB_NET_ZAURUS is not set
 CONFIG_ATH10K=m
 CONFIG_ATH10K_PCI=m
 CONFIG_WCN36XX=m
 # CONFIG_WLAN_VENDOR_ATMEL is not set
 # CONFIG_WLAN_VENDOR_BROADCOM is not set
-# CONFIG_WLAN_VENDOR_CISCO is not set
 # CONFIG_WLAN_VENDOR_INTEL is not set
 # CONFIG_WLAN_VENDOR_INTERSIL is not set
 # CONFIG_WLAN_VENDOR_MARVELL is not set
@@ -355,9 +449,11 @@ CONFIG_RTW89_DEBUGMSG=y
 # CONFIG_WLAN_VENDOR_TI is not set
 # CONFIG_WLAN_VENDOR_ZYDAS is not set
 # CONFIG_WLAN_VENDOR_QUANTENNA is not set
-CONFIG_NET_FAILOVER=y
 CONFIG_INPUT_FF_MEMLESS=y
-# CONFIG_INPUT_KEYBOARD is not set
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_EVBUG=y
+CONFIG_KEYBOARD_GPIO=y
+CONFIG_KEYBOARD_GPIO_POLLED=y
 # CONFIG_INPUT_MOUSE is not set
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_RK805_PWRKEY=y
@@ -404,47 +500,38 @@ CONFIG_PPS=y
 CONFIG_DEBUG_PINCTRL=y
 CONFIG_PINCTRL_RK805=y
 CONFIG_PINCTRL_SINGLE=y
-CONFIG_GPIO_ALTERA=m
-CONFIG_GPIO_DWAPB=y
-CONFIG_GPIO_MB86S7X=y
-CONFIG_GPIO_PL061=y
-CONFIG_GPIO_XGENE=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_MAX732X=y
 CONFIG_GPIO_PCA953X=y
 CONFIG_GPIO_PCA953X_IRQ=y
-CONFIG_POWER_RESET_XGENE=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
 CONFIG_POWER_RESET_SYSCON=y
 CONFIG_SYSCON_REBOOT_MODE=y
-CONFIG_BATTERY_SBS=m
-CONFIG_BATTERY_BQ27XXX=y
-CONFIG_BATTERY_MAX17042=m
-CONFIG_CHARGER_BQ25890=m
-CONFIG_CHARGER_BQ25980=m
+CONFIG_CHARGER_RK817=y
 CONFIG_SENSORS_ARM_SCMI=y
 CONFIG_SENSORS_ARM_SCPI=y
-CONFIG_SENSORS_LM90=m
 CONFIG_SENSORS_PWM_FAN=m
-CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
 CONFIG_CPU_THERMAL=y
 CONFIG_THERMAL_EMULATION=y
 CONFIG_ROCKCHIP_THERMAL=m
 CONFIG_WATCHDOG=y
-CONFIG_ARM_SP805_WATCHDOG=y
-CONFIG_ARM_SBSA_WATCHDOG=y
-CONFIG_DW_WATCHDOG=y
-CONFIG_ARM_SMC_WATCHDOG=y
+CONFIG_WATCHDOG_SYSFS=y
+CONFIG_SOFT_WATCHDOG=y
 CONFIG_MFD_RK8XX_I2C=y
 CONFIG_MFD_RK8XX_SPI=y
-CONFIG_MFD_STMFX=y
+# CONFIG_MFD_VEXPRESS_SYSREG is not set
+CONFIG_REGULATOR=y
 CONFIG_REGULATOR_DEBUG=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_USERSPACE_CONSUMER=y
+CONFIG_REGULATOR_NETLINK_EVENTS=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_PWM=y
 CONFIG_REGULATOR_RK808=y
 CONFIG_REGULATOR_VCTRL=y
-CONFIG_REGULATOR_VEXPRESS=m
-# CONFIG_HID_GENERIC is not set
-# CONFIG_USB_HID is not set
+# CONFIG_HID_SUPPORT is not set
+CONFIG_USB_ULPI_BUS=y
 CONFIG_USB_CONN_GPIO=y
 CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
@@ -452,6 +539,7 @@ CONFIG_USB_DYNAMIC_MINORS=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_HCD_PLATFORM=y
@@ -460,10 +548,6 @@ CONFIG_USB_STORAGE=y
 CONFIG_USB_MUSB_HDRC=y
 CONFIG_USB_DWC3=y
 CONFIG_USB_DWC2=y
-CONFIG_USB_CHIPIDEA=y
-CONFIG_USB_CHIPIDEA_UDC=y
-CONFIG_USB_CHIPIDEA_HOST=y
-CONFIG_USB_ISP1760=y
 CONFIG_USB_SERIAL=m
 CONFIG_USB_SERIAL_GENERIC=y
 CONFIG_USB_SERIAL_SIMPLE=m
@@ -471,7 +555,6 @@ CONFIG_USB_SERIAL_CP210X=m
 CONFIG_USB_SERIAL_FTDI_SIO=m
 CONFIG_USB_SERIAL_PL2303=m
 CONFIG_USB_SERIAL_OPTION=m
-CONFIG_USB_HSIC_USB3503=y
 CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
@@ -488,12 +571,6 @@ CONFIG_USB_CONFIGFS_RNDIS=y
 CONFIG_USB_CONFIGFS_EEM=y
 CONFIG_USB_CONFIGFS_MASS_STORAGE=y
 CONFIG_USB_CONFIGFS_F_FS=y
-CONFIG_TYPEC=m
-CONFIG_TYPEC_TCPM=m
-CONFIG_TYPEC_TCPCI=m
-CONFIG_TYPEC_FUSB302=m
-CONFIG_TYPEC_TPS6598X=m
-CONFIG_TYPEC_HD3SS3220=m
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_ARMMMCI=y
@@ -505,13 +582,9 @@ CONFIG_MMC_SDHCI_CADENCE=y
 CONFIG_MMC_SDHCI_F_SDH30=y
 CONFIG_MMC_SPI=y
 CONFIG_MMC_DW=y
-CONFIG_MMC_DW_EXYNOS=y
 CONFIG_MMC_DW_HI3798CV200=y
 CONFIG_MMC_DW_K3=y
 CONFIG_MMC_DW_ROCKCHIP=y
-CONFIG_MMC_MTK=y
-CONFIG_MMC_SDHCI_XENON=y
-CONFIG_MMC_SDHCI_AM654=y
 CONFIG_SCSI_UFSHCD=y
 CONFIG_SCSI_UFSHCD_PLATFORM=y
 CONFIG_NEW_LEDS=y
@@ -527,6 +600,7 @@ CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_LEDS_TRIGGER_CPU=y
 CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_RK808=y
 CONFIG_RTC_DRV_EFI=y
@@ -541,7 +615,6 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 # CONFIG_VHOST_MENU is not set
 CONFIG_STAGING=y
-CONFIG_PRISM2_USB=m
 CONFIG_RTLLIB=m
 CONFIG_RTL8192E=m
 CONFIG_RTL8723BS=m
@@ -565,7 +638,6 @@ CONFIG_ROCKCHIP_IODOMAIN=y
 CONFIG_ROCKCHIP_DTPM=m
 CONFIG_ROCKCHIP_PM_DOMAINS=y
 CONFIG_DEVFREQ_GOV_USERSPACE=m
-CONFIG_EXTCON_PTN5150=m
 CONFIG_EXTCON_USB_GPIO=y
 CONFIG_MEMORY=y
 CONFIG_IIO=y
@@ -578,6 +650,7 @@ CONFIG_IIO_ST_MAGN_3AXIS=m
 CONFIG_MPL3115=m
 CONFIG_PWM=y
 CONFIG_PWM_ROCKCHIP=y
+CONFIG_RESET_GPIO=y
 CONFIG_PHY_ROCKCHIP_DPHY_RX0=m
 CONFIG_PHY_ROCKCHIP_EMMC=y
 CONFIG_PHY_ROCKCHIP_INNO_HDMI=m
@@ -590,8 +663,6 @@ CONFIG_PHY_ROCKCHIP_USB=m
 CONFIG_POWERCAP=y
 CONFIG_ARM_SCMI_POWERCAP=y
 CONFIG_DTPM=y
-CONFIG_DTPM_CPU=y
-CONFIG_DTPM_DEVFREQ=y
 CONFIG_ARM_SMMU_V3_PMU=m
 CONFIG_NVMEM_RMEM=m
 CONFIG_NVMEM_ROCKCHIP_EFUSE=m
@@ -603,30 +674,48 @@ CONFIG_INTERCONNECT=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_BTRFS_FS=y
+CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FANOTIFY=y
 CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA=y
-CONFIG_OVERLAY_FS=m
+CONFIG_AUTOFS_FS=y
+CONFIG_FUSE_FS=y
+CONFIG_VIRTIO_FS=y
+CONFIG_OVERLAY_FS=y
+CONFIG_MSDOS_FS=y
 CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_UTF8=y
+CONFIG_EXFAT_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_PROC_CHILDREN=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_HUGETLBFS=y
 CONFIG_EFIVAR_FS=y
+CONFIG_JFFS2_FS=y
+CONFIG_JFFS2_FS_XATTR=y
 CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_SQUASHFS_ZSTD=y
 CONFIG_NFS_FS=y
 CONFIG_NFS_V4=y
 CONFIG_NFS_V4_1=y
 CONFIG_NFS_V4_2=y
 CONFIG_ROOT_NFS=y
 CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_CRYPTO_DH=m
 CONFIG_CRYPTO_CURVE25519=m
 CONFIG_CRYPTO_ECHAINIV=y
-CONFIG_CRYPTO_BLAKE2B=m
-CONFIG_CRYPTO_XXHASH=m
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_ZSTD=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
@@ -635,20 +724,22 @@ CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_SHA512_ARM64_CE=m
 CONFIG_CRYPTO_SHA3_ARM64=m
 CONFIG_CRYPTO_SM3_ARM64_CE=m
-CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_CRYPTO_AES_ARM64_BS=m
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=m
 CONFIG_CRYPTO_DEV_ROCKCHIP=y
 CONFIG_CRYPTO_DEV_CCREE=m
+CONFIG_PACKING=y
 CONFIG_INDIRECT_PIO=y
 CONFIG_CRC_CCITT=m
 CONFIG_CRC8=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
+CONFIG_DETECT_HUNG_TASK=y
 # CONFIG_SCHED_DEBUG is not set
-# CONFIG_FTRACE is not set
+CONFIG_FUNCTION_TRACER=y
 CONFIG_MEMTEST=y
@@ -0,0 +1,189 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.2.1",
+              "prefix-length": 24
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {}
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet"
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-address": "::"
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "r2s",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo="
+  },
+  "infix-dhcp-client:dhcp-client": {
+    "client-if": [
+      {
+        "if-name": "wan",
+        "option": [
+          {
+            "name": "broadcast"
+          },
+          {
+            "name": "dns"
+          },
+          {
+            "name": "domain"
+          },
+          {
+            "name": "hostname"
+          },
+          {
+            "name": "ntpsrv"
+          },
+          {
+            "name": "router"
+          },
+          {
+            "name": "subnet"
+          }
+        ]
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "infix-meta:version": "1.0"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1 @@
+../available/input-event-daemon.conf
@@ -0,0 +1 @@
+service [12345789] log wan-monitor.sh -- WAN Health monitor
@@ -0,0 +1,91 @@
+{
+    "input": {
+	"path": {
+	    "locate":       { "path": "/run/led/locate" },
+
+	    "status-prime": { "path": "/run/led/status-prime" },
+	    "status-ok":    { "path": "/run/led/status-ok" },
+	    "status-err":   { "path": "/run/led/status-err" },
+	    "status-crit":  { "path": "/run/led/status-crit" },
+
+	    "fault-prime":  { "path": "/run/led/fault-prime" },
+	    "fault-ok":     { "path": "/run/led/fault-ok" },
+	    "fault-err":    { "path": "/run/led/fault-err" },
+	    "fault-crit":   { "path": "/run/led/fault-crit" },
+
+	    "wan-up":       { "path": "/run/led/wan-up" },
+
+	    "startup":   { "path": "/run/finit/cond/run/startup/success" },
+	    "fail-safe": { "path": "/run/finit/cond/run/failure/success" },
+	    "panic":     { "path": "/run/finit/cond/run/failure/failure" }
+	},
+	"udev": {
+	    "power-a": { "subsystem": "power_supply" },
+	    "power-b": { "subsystem": "power_supply" }
+	}
+    },
+
+    "output": {
+	"led-group": {
+	    "port-link-act": {
+		"match": ["*:green:tp", "*:green:sfp", "*:green:port" ],
+
+		"rules": [
+		    { "if": "true", "then": { "trigger": "netdev", "link": 1, "rx": 1, "tx": 1 } }
+		]
+	    },
+	    "port-alarm": {
+		"match": ["*:yellow:tp", "*:yellow:sfp", "*:yellow:port" ],
+
+		"rules": [
+		]
+	    }
+	},
+	"led": {
+	    "nanopi-r2s:red:sys": {
+		"rules": [
+		    { "if": "locate",    "then": "@blink-1hz" },
+		    { "if": "panic",     "then": "@blink-5hz" },
+		    { "if": "fail-safe", "then": "@blink-5hz" },
+		    { "if": "startup",   "then": "@off" },
+		    { "if": "true",      "then": "@blink-1hz" }
+		]
+	    },
+
+	    "nanopi-r2s:green:lan": {
+		"rules": [
+		    { "if": "locate",  "then": "@blink-1hz" },
+		    { "if": "panic",   "then": "@blink-5hz" },
+		    { "if": "startup", "then": "@on" }
+		]
+	    },
+
+	    "nanopi-r2s:green:wan": {
+		"rules": [
+		    { "if": "locate", "then": "@blink-1hz" },
+		    { "if": "panic",  "then": "@blink-5hz" },
+		    { "if": "wan-up", "then": "@on" }
+		]
+	    }
+	}
+    },
+
+    "aliases": {
+	"on": {
+	    "brightness": true
+	},
+	"off": {
+	    "brightness": false
+	},
+	"blink-1hz": {
+	    "trigger": "timer",
+	    "delay_on": 500,
+	    "delay_off": 500
+	},
+	"blink-5hz": {
+	    "trigger": "timer",
+	    "delay_on": 100,
+	    "delay_off": 100
+	}
+    }
+}
@@ -0,0 +1,5 @@
+[Global]
+listen = /dev/input/event1
+
+[Keys]
+RESTART = reboot
@@ -0,0 +1,2 @@
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/ff540000.ethernet/net/eth0", NAME="wan"
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/ff600000.usb/xhci-hcd.0.auto/usb3/3-1/3-1:1.0/net/*", NAME="lan"
@@ -0,0 +1,41 @@
+#!/bin/sh
+# Background WAN interface monitor.  Lights up WAN LED
+# while the interface has a DHCP address.
+
+LED_FILE="/run/led/wan-up"
+PID_FILE="/run/$(basename "$0").pid"
+
+check_wan()
+{
+    ip_info=$(ip a show wan)
+
+    if echo "$ip_info" | grep -q "inet .* proto dhcp"; then
+        [ ! -f "$LED_FILE" ] && touch "$LED_FILE"
+    else
+        [ -f "$LED_FILE" ] && rm "$LED_FILE"
+    fi
+}
+
+cleanup()
+{
+    rm -f "$LED_FILE"
+    rm -f "$PID_FILE"
+    exit 0
+}
+
+trap 'cleanup' TERM INT HUP QUIT
+echo $$ > "$PID_FILE"
+
+remaining_time=$((1800 - $(awk '{print int($1)}' /proc/uptime)))
+[ "$remaining_time" -lt 0 ] && remaining_time=0
+
+while [ "$remaining_time" -gt 0 ]; do
+    check_wan
+    sleep 1
+    remaining_time=$((remaining_time - 1))
+done
+
+while :; do
+    check_wan
+    sleep 5
+done
@@ -0,0 +1,16 @@
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+
+CONFIG_LED=y
+CONFIG_LED_GPIO=y
+
+# CONFIG_MMC_PCI is not set
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi r2s-env.dtsi"
+CONFIG_SYS_PROMPT="(r2s) "
+
+CONFIG_ENV_OVERWRITE=y
+# CONFIG_ENV_IS_NOWHERE is not set
+CONFIG_ENV_IS_IN_EXT4=y
+# CONFIG_ENV_IS_IN_MMC is not set
+CONFIG_ENV_EXT4_INTERFACE="mmc"
+CONFIG_ENV_EXT4_DEVICE_AND_PART="1:1"
@@ -0,0 +1,47 @@
+/ {
+	config {
+		environment {
+			boot_targets = "mmc1";
+			ethprime = "eth0";
+
+			/* This is a development platform, hard code developer mode */
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+
+			/* Override default definitiion to add LED feedback */
+                        ixbtn-factory = "
+if button factory-reset; then
+    echo \"Keep button pressed for 10 seconds to engage factory reset ...\"
+
+    for tick in . . . . . . . . . .; do
+        led nanopi-r2s:red:sys   on
+        led nanopi-r2s:green:lan on
+        led nanopi-r2s:green:wan on
+        sleep 0.5
+        led nanopi-r2s:red:sys   off
+        led nanopi-r2s:green:lan off
+        led nanopi-r2s:green:wan off
+        sleep 0.5
+        echo -n \"Checking button: \"
+        button factory-reset || exit
+    done
+
+    echo -n \"Final button check: \"
+    if button factory-reset; then
+        setenv factory_reset yes
+        echo \"FACTORY RESET ENGAGED\"
+    fi
+fi
+";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		factory-reset {
+			gpios = <&gpio0 0 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_POWER>;
+			label = "factory-reset";
+		};
+	};
+};
@@ -107,6 +107,18 @@ config DISK_IMAGE_BOOT_OFFSET
 	  to make sure that the GPT still fits at the start of the
 	  image.

+config DISK_IMAGE_TEST_MODE
+	bool "Enable Test Mode"
+	depends on DISK_IMAGE
+	default y
+	help
+	  Enable the test mode option by default. This setting creates a test-mode flag
+	  in the auxiliary partition of the disk image, initiating the system with the test-config
+	  instead of regular startup-config. The primary purpose of running an image in this mode
+	  is to ensure proper execution of all Infix tests. Additionally, it enables extra RPCs
+	  related to system restart and configuration overrides, allowing tests to be run even on
+	  systems where the factory configuration may potentially create L2 loops. 
+
 config DISK_IMAGE_RELEASE_URL
 	string "Infix URL"
 	depends on DISK_IMAGE
@@ -160,3 +172,9 @@ config FIT_ARCH
 config FIT_KERNEL_LOAD_ADDR
 	string "Kernel load address"
 	depends on FIT_IMAGE
+
+config SDCARD_AUX
+	bool "Create SD-card aux partition"
+	help
+	  Create and populate aux.ext4 with rootfs.itbh and rauc.status
+	  For use with a static genimage.cfg for, e.g., SD-cards.
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+rootdir=$BUILD_DIR/genimage.root
+tempdir=$BUILD_DIR/genimage.tmp
+
+cat <<EOF > /tmp/mkaux.cfg
+image aux.ext4 {
+	mountpoint = "/aux"
+	size = 16M
+
+	ext4 {
+		label = "aux"
+		use-mke2fs = true
+		features = "^metadata_csum,^metadata_csum_seed"
+	}
+}
+
+# Silence genimage warnings
+config {}
+EOF
+
+rm -rf   "$rootdir/aux"
+mkdir -p "$rootdir/aux"
+cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/primary.itbh"
+cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/secondary.itbh"
+cp -f "$BINARIES_DIR/rauc.status" "$rootdir/aux/rauc.status"
+
+mkenvimage -s 0x4000 -o "$rootdir/aux/uboot.env" \
+	   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
+
+rm -rf "$BINARIES_DIR/aux.ext4"
+rm -rf "$tempdir"
+
+genimage \
+    --rootpath   "$rootdir" \
+    --tmppath    "$tempdir" \
+    --inputpath  "$BINARIES_DIR" \
+    --outputpath "$BINARIES_DIR" \
+    --config "/tmp/mkaux.cfg"
@@ -128,7 +128,7 @@ diskimg=disk.img
 bootimg=
 bootpart=

-while getopts "a:b:B:n:s:" opt; do
+while getopts "a:b:B:n:s:t" opt; do
    case ${opt} in
 	a)
 	    arch=$OPTARG
@@ -145,6 +145,9 @@ while getopts "a:b:B:n:s:" opt; do
 	s)
 	    total=$(size2int $OPTARG)
 	    ;;
+	t)
+		testmode=true
+		;;
    esac
 done
 shift $((OPTIND - 1))
@@ -190,6 +193,12 @@ cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
 cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
 cp -f $BINARIES_DIR/rauc.status $root/aux/rauc.status

+if [ "$testmode" = true ]; then
+    touch "$root/aux/test-mode"
+else 
+    rm -f "$root/aux/test-mode"
+fi
+
 case "$arch" in
    aarch64)
 	mkenvimage -s 0x4000 -o "$root/aux/uboot.env" \
@@ -2,30 +2,30 @@

 set -e

-GIT_VERSION=$(git -C $BR2_EXTERNAL_INFIX_PATH describe --always --dirty --tags)
+GIT_VERSION=$(git -C "$BR2_EXTERNAL_INFIX_PATH" describe --always --dirty --tags)

 name=$1
-arch=$2
+compat=$2
 sign=$3

 crt=$(ls $sign/*.crt)
 key=$(ls $sign/*.key)

-common=$(dirname $(readlink -f "$0"))
+common=$(dirname "$(readlink -f "$0")")

 work=$BUILD_DIR/mkrauc
-mkdir -p $work
+mkdir -p "$work"

-cp -f $common/rauc-hooks.sh $work/hooks.sh
+cp -f "$common/rauc-hooks.sh" "$work/hooks.sh"

 # RAUC internally uses the file extension to find a suitable install
 # handler, hence the name must be .img
-cp -f $BINARIES_DIR/rootfs.squashfs $work/rootfs.img
-cp -f $BINARIES_DIR/rootfs.itbh $work/rootfs.itbh
+cp -f "$BINARIES_DIR/rootfs.squashfs" "$work/rootfs.img"
+cp -f "$BINARIES_DIR/rootfs.itbh"     "$work/rootfs.itbh"

-cat >$work/manifest.raucm <<EOF
+cat >"$work/manifest.raucm" <<EOF
 [update]
-compatible=infix-${arch}
+compatible=${compat}
 version=${GIT_VERSION}

 [bundle]
@@ -39,7 +39,7 @@ filename=rootfs.img
 hooks=post-install
 EOF

-rm -f $BINARIES_DIR/$name.pkg
+rm -f "$BINARIES_DIR/$name.pkg"

-rauc --cert=$crt --key=$key \
-    bundle $work $BINARIES_DIR/$name.pkg
+rauc --cert="$crt" --key="$key" \
+     bundle "$work" "$BINARIES_DIR/$name.pkg"
@@ -55,6 +55,16 @@ else
    VERSION=$GIT_VERSION
 fi

+if [ -n "$INFIX_IMAGE_ID" ]; then
+    NAME="$INFIX_IMAGE_ID"
+else
+    NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
+fi
+
+if [ -f "$TARGET_DIR/etc/rauc/system.conf" ]; then
+    sed -i "s/compatible=.*/compatible=$NAME/" "$TARGET_DIR/etc/rauc/system.conf"
+fi
+
 # This is a symlink to /usr/lib/os-release, so we remove this to keep
 # original Buildroot information.
 rm -f "$TARGET_DIR/etc/os-release"
@@ -100,6 +110,9 @@ if [ -L "$TARGET_DIR/var/lib/avahi-autoipd" ]; then
 	mkdir "$TARGET_DIR/var/lib/avahi-autoipd"
 fi

+# Drop Buildroot default pam_lastlog.so from login chain
+sed -i '/^[^#]*pam_lastlog.so/s/^/# /' "$TARGET_DIR/etc/pam.d/login"
+
 # Allow pdmenu (setup) and bash to be login shells, bash is added
 # automatically when selected in menuyconfig, but not when BusyBox
 # provides a symlink (for ash).  The /bin/{true,false} are old UNIX
@@ -12,6 +12,9 @@ load_cfg BR2_ARCH
 load_cfg BR2_DEFCONFIG
 load_cfg BR2_EXTERNAL_INFIX_PATH
 load_cfg BR2_TARGET_ROOTFS
+
+# The default IMAGE_ID is infix-$BR2_ARCH but can be overridden
+# for imaage names, and compat strings, like infix-r2s
 if [ -n "$IMAGE_ID" ]; then
    NAME="$IMAGE_ID"
 else
@@ -36,7 +39,7 @@ if [ "$SIGN_ENABLED" = "y" ]; then
    $common/sign.sh $BR2_ARCH $SIGN_KEY

    ixmsg "Creating RAUC Update Bundle"
-    $common/mkrauc.sh "$NAME$(ver)" $BR2_ARCH $SIGN_KEY
+    $common/mkrauc.sh "$NAME$(ver)" $NAME $SIGN_KEY
 fi

 load_cfg DISK_IMAGE
@@ -56,8 +59,21 @@ if [ "$DISK_IMAGE" = "y" ]; then
 	tar -xa --strip-components=1 -C "$BINARIES_DIR" -f "$archive"
    fi

+    testmode_flag=""
+    if [ "$DISK_IMAGE_TEST_MODE" = "y" ]; then 
+	testmode_flag="-t"
+    fi
+
    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
-    $common/mkdisk.sh -a $BR2_ARCH -n $diskimg -s $DISK_IMAGE_SIZE $bootcfg
+    $common/mkdisk.sh -a $BR2_ARCH -n $diskimg $testmode_flag -s $DISK_IMAGE_SIZE $bootcfg
+fi
+
+load_cfg SDCARD_AUX
+if [ "$SDCARD_AUX" = "y" ]; then
+    ixmsg "Creating initial rauc.status"
+    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
+    ixmsg "Creating aux.ext4 for sdcard.img"
+    $common/mkaux.sh
 fi

 load_cfg GNS3_APPLIANCE
@@ -81,7 +97,7 @@ if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
 fi

 # Menuconfig support for modifying Qemu args in release tarballs
-cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/bin/onieprom" "$BINARIES_DIR/"
+cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
 cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
 sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
    -e "s/@DISK_IMG@/$diskimg/"   \
@@ -4,6 +4,10 @@ choice
 	prompt "Target Architecture"
 	default @ARCH@

+config QEMU_riscv64
+	bool "risv64"
+	select QEMU_ARCH_IS_64
+
 config QEMU_x86_64
 	bool "x86_64"
 	select QEMU_ARCH_IS_64
@@ -146,13 +146,22 @@ usb_args()
    USBSTICK="usb.vfat"
    if ! [ -f $USBSTICK ]; then
 	dd if=/dev/zero of=${USBSTICK} bs=8M count=1 >/dev/null 2>&1
-	mkfs.vfat $USBSTICK >/dev/null 2>&1
+
+	if command -v mkfs.vfat >/dev/null; then
+	    mkfs.vfat -n "log" $USBSTICK >/dev/null 2>&1
+	else
+	    if command -v mkfs.exfat >/dev/null; then
+		mkfs.exfat -L "log" $USBSTICK >/dev/null 2>&1
+	    fi
+	fi
    fi
+
    echo -n "-drive if=none,id=usbstick,format=raw,file=$USBSTICK "
    echo -n "-usb "
    echo -n "-device usb-ehci,id=ehci "
    echo -n "-device usb-storage,bus=ehci.0,drive=usbstick "
 }
+
 rw_args()
 {
    [ "$CONFIG_QEMU_RW" ] ||  return
@@ -1 +0,0 @@
-/sbin/ip
@@ -1,3 +1,4 @@
+# Hey Emacs, this is -*-sh-*-
 # System-wide .bashrc file for interactive bash(1) shells.

 # If not running interactively, don't do anything
@@ -13,3 +14,30 @@ export PROMPT_COMMAND=prompt_command
 # check the window size after each command and, if necessary,
 # update the values of LINES and COLUMNS.
 shopt -s checkwinsize
+
+log()
+{
+    local fn="/var/log/syslog"
+    [ -n "$1" ] && fn="/var/log/$1"
+    less +G "$fn"
+}
+
+follow()
+{
+    local fn="/var/log/syslog"
+    [ -n "$1" ] && fn="/var/log/$1"
+    tail -F "$fn"
+}
+
+_logfile_completions()
+{
+    local cur=${COMP_WORDS[COMP_CWORD]}
+    local files=$(compgen -f -- "/var/log/$cur")
+    COMPREPLY=()
+    for file in $files; do
+        [ -f "$file" ] && COMPREPLY+=("$(basename "$file")")
+    done
+}
+
+complete -F _logfile_completions log
+complete -F _logfile_completions follow
@@ -1 +1,3 @@
-task name:ixinit log:tag:ixinit [S] <pid/syslogd> /libexec/finit/runparts -bp /libexec/infix/init.d -- Probing system
+task name:ixinit log:tag:ixinit [S] <pid/syslogd> \
+	/usr/libexec/finit/runparts -bp /usr/libexec/infix/init.d \
+	-- Probing system
@@ -1 +1 @@
-task [S] <service/confd/ready> /libexec/infix/mkcert -- Verifying self-signed https certificate
+task [S] <service/confd/ready> /usr/libexec/infix/mkcert -- Verifying self-signed https certificate
@@ -7,16 +7,17 @@ tmpfs		/dev/shm	tmpfs		mode=0777		0	0
 proc		/proc		proc		defaults		0	0
 tmpfs		/tmp		tmpfs		mode=1777,nosuid,nodev	0	0
 tmpfs		/run		tmpfs		mode=0755,nosuid,nodev	0	0
+tmpfs		/media		tmpfs		mode=1755,nosuid,nodev	0	0
 sysfs		/sys		sysfs		defaults		0	0
 debugfs	/sys/kernel/debug	debugfs		nofail			0	0
 cfgfs		/config		configfs	nofail,noauto		0	0

 # The chosen backing storage for the overlays placed on /cfg, /etc,
-# /home, /root, and /var, are determined dynamically by /libexec/infix/mnt
+# /home, /root, and /var, are determined dynamically by /usr/libexec/infix/mnt
 # depending on the available devices.
 mnttmp		/mnt/tmp	tmpfs		defaults			0	0
 LABEL=aux	/mnt/aux	auto		noatime,nodiratime,noauto	0	0
 LABEL=var	/mnt/var	auto		noatime,nodiratime,noauto	0	0
 LABEL=cfg	/mnt/cfg	auto		noatime,nodiratime,noauto	0	0
 hostfs		/mnt/host	9p		cache=none,msize=16384,noauto	0	0
-/libexec/infix/mnt# /cfg	helper		none				0	0
+/usr/libexec/infix/mnt#	/cfg	helper		none				0	0
@@ -1,4 +1,4 @@
 .-------.
 |  . .  | Infix -- a Network Operating System
-|-. v .-| https://kernelkit.github.io
+|-. v .-| https://kernelkit.org
 '-'---'-'
@@ -16,5 +16,4 @@ password	required			pam_permit.so
 session     required    pam_loginuid.so
 session     include     common-session
 session     optional    pam_keyinit.so   force revoke
-session     optional    pam_lastlog.so   showfailed
 session     optional    pam_motd.so
@@ -16,5 +16,4 @@ password	required			pam_permit.so
 session     required    pam_loginuid.so
 session     include     common-session
 session     optional    pam_keyinit.so   force revoke
-session     optional    pam_lastlog.so   showfailed
 session     optional    pam_motd.so
@@ -6,6 +6,7 @@ alias ls='ls --color=auto'
 export EDITOR=/usr/bin/edit
 export VISUAL=/usr/bin/edit
 export LESS="-P %f (press h for help or q to quit)"
+export LESSOPEN="|/usr/bin/lesspipe.sh %s"
 alias vim='vi'
 alias view='vi -R'
 alias emacs='mg'
@@ -0,0 +1,84 @@
+# /etc/syslog.conf - Configuration file for syslogd(8)
+#
+# For information about the format of this file, see syslog.conf(5)
+#
+
+#
+# First some standard log files.  Log by facility.
+#
+auth,authpriv.*			 /var/log/auth.log
+#*.*;auth,authpriv.none		-/var/log/syslog
+
+#cron.*				/var/log/cron.log
+#daemon.*			-/var/log/daemon.log
+kern.*				-/var/log/kern.log
+#lpr.*				-/var/log/lpr.log
+mail.*				-/var/log/mail.log
+#user.*				-/var/log/user.log
+
+#
+# Logging for the mail system.  Split it up so that
+# it is easy to write scripts to parse these files.
+#
+#mail.info			-/var/log/mail.info
+#mail.warn			-/var/log/mail.warn
+mail.err			 /var/log/mail.err
+#mail.*;mail.!=info		-/var/log/mail
+#mail,news.=info 		-/var/log/info
+
+# The tcp wrapper loggs with mail.info, we display all
+# the connections on tty12
+#
+#mail.=info			/dev/tty12
+
+#
+# Some "catch-all" log files.
+#
+#*.=debug;\
+#	auth,authpriv.none;\
+#	news.none;mail.none	-/var/log/debug
+*.=info;*.=notice;*.=warn;\
+	auth,authpriv.none;\
+	cron,daemon.none;\
+	mail,news.none		-/var/log/messages
+
+#
+# Store all critical events, except kernel logs, in critical RFC5424 format.
+# Overide global log rotation settings, rotate every 10MiB, keep 5 old logs,
+#
+#*.=crit;kern.none		/var/log/critical	;rotate=10M:5,RFC5424
+
+# Example of sending events to remote syslog server.
+# All events from notice and above, except auth, authpriv
+# and any kernel message are sent to server finlandia in
+# RFC5424 formatted output.
+#
+#*.notice;auth,authpriv.none;
+#	kern.none\		@finlandia	;RFC5424
+
+# Emergencies are sent to anyone logged in
+#
+*.=emerg			*
+
+# Priority alert and above are sent to the operator
+#
+#*.alert			root,joey
+
+#
+# Secure mode, same as -s, none(0), on(1), full(2).  When enabled
+# only logging to remote syslog server possible, with full secure
+# mode, not even that is possible.  We default to prevent syslogd
+# from opening UDP/514 and receving messages from other systems.
+#
+secure_mode 1
+
+#
+# Global log rotation, same as -r SIZE:COUNT, command line wins.
+#
+#rotate_size  1M
+#rotate_count 5
+
+#
+# Include all config files in /etc/syslog.d/
+#
+include /etc/syslog.d/*.conf
@@ -0,0 +1,2 @@
+rotate_size  1M
+rotate_count 10
@@ -0,0 +1,2 @@
+# Log critical and above to console, system likely unusable.
+*.=crit;*.=alert;*.=emerg	/dev/console
@@ -2,7 +2,7 @@ Reserved facilities for logging in various subsystems:

 - local0: rauc
 - local1: containers
- - local2: 
+ - local2: routing (frr)
 - local3: 
 - local5: 
 - local6: reserved 
@@ -0,0 +1 @@
+local2.*                -/var/log/routing
@@ -0,0 +1,3 @@
+# Skip debug level messages in our /var/log/syslog, we have a dedicate
+# debug log instead, as well as facility specific logs, e.g., routing
+*.info;auth,authpriv.none          -/var/log/syslog
@@ -0,0 +1,5 @@
+KERNEL=="sd[a-z]",      SUBSYSTEMS=="usb", ACTION=="add|change", RUN+="/usr/libexec/infix/media add %k"
+KERNEL=="sd[a-z]",      SUBSYSTEMS=="usb", ACTION=="remove",     RUN+="/usr/libexec/infix/media del %k"
+
+KERNEL=="sd[a-z][0-9]", SUBSYSTEMS=="usb", ACTION=="add|change", RUN+="/usr/libexec/infix/media add %k"
+KERNEL=="sd[a-z][0-9]", SUBSYSTEMS=="usb", ACTION=="remove",     RUN+="/usr/libexec/infix/media del %k"
@@ -1,16 +0,0 @@
-#!/bin/sh
-
-# When changing default IPv4/6 settings, this does not apply to
-# existing interfaces. This syncs the default settings to all known
-# interfaces at boot, such that physical interfaces will start from
-# the same point as virtual ones.
-tmp=$(mktemp)
-
-sysctl net.ipv4.conf.default  >$tmp
-sysctl net.ipv6.conf.default >>$tmp
-
-for iface in $(ip -j link show | jq -r .[].ifname); do
-    sed -e "s/.default./.${iface}./g" $tmp | sysctl -q -p -
-done
-
-rm $tmp
@@ -19,5 +19,5 @@ if [ -z "$OUTPUT" ]; then
 fi

 umask 0177
-echo "$password" | mkpasswd > "$OUTPUT"
+echo "$password" | mkpasswd -s > "$OUTPUT"
 exit 0
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+dir()
+{
+    path=$1
+
+    if [ -z "$COLUMS" ]; then
+	TTY=$(resize)
+	eval "$TTY"
+    fi
+
+    printf "\033[7m%-*s\033[0m\n" "$COLUMNS" "$path directory"
+    if [ -d "$path" ]; then
+        ls -p "$path/"
+    else
+        echo "Directory $path does not exist."
+    fi
+    echo
+}
+
+if [ -d "$1" ]; then
+    dir "$1"
+else
+    dir "$HOME"
+    dir "/cfg"
+    dir "/log"
+fi
@@ -0,0 +1,5 @@
+#!/bin/sh
+# Silly wrapper around sudo to prevent it from printing an error for
+# unprivileged users: sudo: a password is required
+
+id -nG $LOGNAME | grep -qw wheel && sudo -n $@
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+case "$1" in
+    *.gz)
+	zcat "$1"
+	;;
+    *)
+	cat "$1"
+	;;
+esac
@@ -0,0 +1 @@
+d /var/run/frr 0755 frr frr -
@@ -7,7 +7,7 @@ PRODUCT=$(jq -r '."product-name" | ascii_downcase' /run/system.json)

 note()
 {
-    logger -k -p user.notice -t "$ident" "$1"
+    logger -I $$ -k -p user.notice -t "$ident" "$1"
 }

 DIR="$PREFIXD/$PRODUCT"
@@ -0,0 +1,28 @@
+#!/bin/sh
+
+# When changing default IPv4/6 settings, this does not apply to
+# existing interfaces. This syncs the default settings to all known
+# interfaces at boot, such that physical interfaces will start from
+# the same point as virtual ones.
+tmp=$(mktemp)
+fil=$(mktemp)
+
+# Ignore unreadable entries, like net.ipv6.conf.default.stable_secret
+sysctl net.ipv4.conf.default  >"$tmp" 2>/dev/null
+sysctl net.ipv6.conf.default >>"$tmp" 2>/dev/null
+
+# Filter out read-only entries like net.ipv4.conf.default.mc_forwarding
+# to prevent misleading error messages in syslog
+while IFS= read -r line; do
+    entry=$(echo "$line" | awk '{print $1}')
+    path="/proc/sys/$(echo "$entry" | tr . /)"
+    if [ -w "$path" ]; then
+        echo "$line" >> "$fil"
+    fi
+done < "$tmp"
+
+for iface in $(ip -j link show | jq -r .[].ifname); do
+    sed -e "s/.default./.${iface}./g" "$fil" | sysctl -q -p -
+done
+
+rm "$tmp" "$fil"
@@ -8,12 +8,12 @@ BACKUP_DIR="/cfg/backup"

 note()
 {
-    logger -k -p user.notice -t "$ident" "$1"
+    logger -I $$ -k -p user.notice -t "$ident" "$1"
 }

 err()
 {
-    logger -k -p user.err -t "$ident" "$1"
+    logger -I $$ -k -p user.err -t "$ident" "$1"
 }

 file_version()
@@ -0,0 +1,107 @@
+#!/bin/sh
+# Mounts and unmounts external media
+
+ACTION=$1
+DEVBASE=$2
+DEVICE="/dev/${DEVBASE}"
+
+log()
+{
+    logger -sk -I $$ -p user.notice -t "media" "$1"
+}
+
+usage()
+{
+    echo "Usage: $0 {add|start|del|remove|stop} DEV (e.g. sdb1)"
+    exit 1
+}
+
+if [ $# -ne 2 ]; then
+    usage
+fi
+
+# See if this drive is already mounted, and if so where
+MOUNT_POINT=$(mount | grep "${DEVICE}" | awk '{ print $3 }')
+
+do_mount()
+{
+    if [ -n "${MOUNT_POINT}" ]; then
+        log "skipping ${DEVICE}, already mounted at ${MOUNT_POINT}"
+        exit 1
+    fi
+
+    # Get info for this drive: $ID_FS_LABEL, $ID_FS_UUID, and $ID_FS_TYPE
+    eval $(udevadm info --query=property --name="${DEVICE}")
+
+    # Figure out a mount point to use
+    LABEL=${ID_FS_LABEL}
+    if [ -z "${LABEL}" ]; then
+        LABEL=${DEVBASE}
+    elif grep -q " /media/${LABEL} " /etc/mtab; then
+        # Already in use, make a unique one
+        LABEL="${LABEL}-${DEVBASE}"
+    fi
+    MOUNT_POINT="/media/${LABEL}"
+
+    umask 007
+    mkdir -p "${MOUNT_POINT}"
+
+    OPTS="rw,relatime,noexec,nodev,uid=0,gid=10"
+    case ${ID_FS_TYPE} in
+	vfat)
+            OPTS="${OPTS},umask=007,shortname=mixed,utf8=1,flush"
+	    ;;
+	exfat)
+            OPTS="${OPTS},sync"
+	    ;;
+	*)
+	    log "unsupported filesystem ${ID_FS_TYPE}, skipping."
+            rmdir "${MOUNT_POINT}"
+            exit 1
+	    ;;
+    esac
+
+    log "mount -o ${OPTS} ${DEVICE} ${MOUNT_POINT}"
+    if ! mount -t "${ID_FS_TYPE}" -o ${OPTS} "${DEVICE}" "${MOUNT_POINT}"; then
+        log "failed mounting ${DEVICE}"
+        rmdir "${MOUNT_POINT}"
+        exit 1
+    fi
+
+    log "mounted ${DEVICE} at ${MOUNT_POINT} for root:wheel with 770 permissions"
+}
+
+do_unmount()
+{
+    if [ -z "${MOUNT_POINT}" ]; then
+        log "cannot unmount ${DEVICE}, is not mounted."
+    else
+        umount -l "${DEVICE}"
+        log "unmounted ${DEVICE}"
+    fi
+
+    # Delete all empty dirs in /media that aren't being used as mount
+    # points. This is kind of overkill, but if the drive was unmounted
+    # prior to removal we no longer know its mount point, and we don't
+    # want to leave it orphaned...
+    for f in /media/* ; do
+        if [ -n "$(find "$f" -maxdepth 0 -type d -empty)" ]; then
+            if ! grep -q " $f " /etc/mtab; then
+                log "removing mount point $f"
+                rmdir "$f"
+            fi
+        fi
+    done
+}
+
+case "${ACTION}" in
+    add|start)
+        do_mount
+        ;;
+    del|remove|stop)
+        do_unmount
+        ;;
+    *)
+        usage
+        ;;
+esac
@@ -33,18 +33,26 @@ check_factory()
    fi

    # Add to your br2-external to extend factory-reset check
-    if [ ! -x /libexec/infix/check-factory ]; then
+    if [ ! -x /usr/libexec/infix/check-factory ]; then
 	return 1;
    fi

-    /libexec/infix/check-factory
+    /usr/libexec/infix/check-factory
 }

 factory_reset()
 {
-    # XXX: flash LEDs to confirm factory-reset in progress
+    find /sys/class/leds/ -type l -exec sh -c 'echo 100 > $0/brightness' {} \;
    logger $opt -p user.crit -t "$nm" "Resetting to factory defaults."
+
+    # Shred all files to prevent restoring contents
+    find /mnt/cfg -type f -exec shred -zu {} \;
+    find /mnt/var -type f -exec shred -zu {} \;
+
+    # Remove any lingering directories and symlinks as well
    rm -rf /mnt/cfg/* /mnt/var/*
+
+    logger $opt -p user.crit -t "$nm" "Factory reset complete."
    sync
 }

@@ -63,7 +63,7 @@ ok

 step "Formatting $blk"
 [ -b $blk ] || { echo "$blk is not a block device" >&2; err; }
-/libexec/infix/prod/fdisk $blk || err
+/usr/libexec/infix/prod/fdisk $blk || err
 sleep 1
 ok

@@ -1 +0,0 @@
-/sbin/ip
@@ -33,7 +33,7 @@ for tgt in "${boot_targets}"; do
 	setexpr ixmenu_n ${ixmenu_n} + 1

 	if load ${devtype} ${devnum}:${auxpart} ${loadaddr} /uboot.env; then
-	    env import -b ${loadaddr} ${filesize} BOOT_ORDER DEBUG
+	    env import -b ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact
 	fi

 	if test -n "${DEBUG}"; then
@@ -0,0 +1,472 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+# CONFIG_CROSS_MEMORY_ATTACH is not set
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_PSI=y
+# CONFIG_CPU_ISOLATION is not set
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_XZ is not set
+# CONFIG_RD_LZO is not set
+# CONFIG_RD_LZ4 is not set
+CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_SOC_STARFIVE=y
+CONFIG_ERRATA_SIFIVE=y
+CONFIG_NONPORTABLE=y
+CONFIG_SMP=y
+# CONFIG_RISCV_ISA_SVPBMT is not set
+# CONFIG_COMPAT is not set
+CONFIG_HIBERNATION=y
+CONFIG_CPU_IDLE=y
+CONFIG_RISCV_SBI_CPUIDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+# CONFIG_STACKPROTECTOR is not set
+# CONFIG_GCC_PLUGINS is not set
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODULE_COMPRESS_ZSTD=y
+# CONFIG_BLOCK_LEGACY_AUTOLOAD is not set
+CONFIG_BLK_WBT=y
+# CONFIG_BLK_DEBUG_FS is not set
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_MQ_IOSCHED_DEADLINE is not set
+# CONFIG_MQ_IOSCHED_KYBER is not set
+CONFIG_KSM=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CMA=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_PNP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_NET_IPVTI=m
+CONFIG_NET_FOU_IP_TUNNELS=y
+CONFIG_INET_DIAG=m
+# CONFIG_IPV6_SIT is not set
+CONFIG_IPV6_GRE=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETWORK_PHY_TIMESTAMPING=y
+CONFIG_NETFILTER=y
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_CT=m
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_XFRM=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CGROUP=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
+CONFIG_NFT_BRIDGE_META=m
+CONFIG_NF_CONNTRACK_BRIDGE=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BRIDGE=y
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_BRIDGE_MRP=y
+CONFIG_BRIDGE_CFM=y
+CONFIG_NET_DSA=y
+CONFIG_VLAN_8021Q=y
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_MQPRIO=y
+CONFIG_NET_CLS_BASIC=y
+CONFIG_NET_CLS_BPF=y
+CONFIG_NET_CLS_FLOWER=y
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_GACT=y
+CONFIG_NET_ACT_MIRRED=y
+CONFIG_NET_ACT_SKBEDIT=y
+CONFIG_DCB=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_MPLS=y
+CONFIG_NET_MPLS_GSO=y
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
+CONFIG_NET_PKTGEN=y
+# CONFIG_WIRELESS is not set
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_LWTUNNEL=y
+# CONFIG_ETHTOOL_NETLINK is not set
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_UEVENT_HELPER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+# CONFIG_STANDALONE is not set
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+CONFIG_FW_LOADER=m
+CONFIG_SIFIVE_CCACHE=y
+CONFIG_FW_CFG_SYSFS=y
+CONFIG_FW_CFG_SYSFS_CMDLINE=y
+CONFIG_EFI_DISABLE_RUNTIME=y
+CONFIG_MTD=y
+CONFIG_MTD_BLOCK=y
+CONFIG_MTD_BLOCK2MTD=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_OF_OVERLAY=y
+CONFIG_BLK_DEV_NULL_BLK=y
+CONFIG_ZRAM=y
+CONFIG_ZRAM_MEMORY_TRACKING=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_LOOP_MIN_COUNT=1
+CONFIG_BLK_DEV_RAM=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_NVME=y
+CONFIG_EEPROM_AT24=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_SCSI_SAS_LIBSAS=y
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_VIRTIO=y
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_PATA_OF_PLATFORM=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_INIT=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_NET_TEAM=m
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
+CONFIG_NET_TEAM_MODE_LOADBALANCE=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
+CONFIG_VXLAN=m
+CONFIG_GENEVE=m
+CONFIG_BAREUDP=m
+CONFIG_MACSEC=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_VIRTIO_NET=y
+CONFIG_NLMON=y
+CONFIG_NET_VRF=y
+CONFIG_8139CP=y
+CONFIG_STMMAC_ETH=y
+CONFIG_DWMAC_DWC_QOS_ETH=y
+# CONFIG_DWMAC_GENERIC is not set
+CONFIG_DWMAC_STARFIVE=y
+CONFIG_MICROCHIP_PHY=y
+CONFIG_MOTORCOMM_PHY=y
+CONFIG_USB_RTL8152=m
+CONFIG_USB_USBNET=m
+# CONFIG_WLAN is not set
+CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_GPIO=y
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_VT is not set
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_LDISC_AUTOLOAD is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+# CONFIG_SERIAL_8250_16550A_VARIANTS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_NR_UARTS=6
+CONFIG_SERIAL_8250_RUNTIME_UARTS=6
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_MANY_PORTS=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_JH7110=y
+# CONFIG_I2C_COMPAT is not set
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_GPIO=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_MUX_PINCTRL=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
+CONFIG_I2C_SLAVE=y
+CONFIG_SPI=y
+CONFIG_SPI_CADENCE_QUADSPI=y
+CONFIG_SPI_PL022=y
+CONFIG_SPI_SPIDEV=y
+# CONFIG_PTP_1588_CLOCK is not set
+CONFIG_GPIOLIB_FASTPATH_LIMIT=128
+CONFIG_GPIO_SYSFS=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_SENSORS_SFCTEMP=y
+CONFIG_THERMAL=y
+CONFIG_CPU_THERMAL=y
+CONFIG_THERMAL_EMULATION=y
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_SYSFS=y
+CONFIG_SOFT_WATCHDOG=y
+CONFIG_MFD_AXP20X_I2C=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_AXP20X=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_VIDEO_CADENCE_CSI2RX=y
+CONFIG_VIDEO_IMX219=y
+CONFIG_DRM=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_SOC=y
+CONFIG_SND_DESIGNWARE_I2S=y
+CONFIG_SND_SOC_STARFIVE=y
+CONFIG_SND_SOC_JH7110_PWMDAC=y
+CONFIG_SND_SOC_JH7110_TDM=y
+CONFIG_SND_SOC_WM8960=y
+CONFIG_SND_SIMPLE_CARD=y
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_UAS=y
+CONFIG_USB_CDNS_SUPPORT=y
+CONFIG_USB_CDNS3=y
+CONFIG_USB_CDNS3_GADGET=y
+CONFIG_USB_CDNS3_HOST=y
+CONFIG_USB_CDNS3_STARFIVE=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_CONFIGFS=y
+CONFIG_USB_CONFIGFS_F_FS=y
+CONFIG_MMC=y
+# CONFIG_PWRSEQ_EMMC is not set
+# CONFIG_PWRSEQ_SIMPLE is not set
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_OF_DWCMSHC=y
+CONFIG_MMC_DW=y
+CONFIG_MMC_DW_STARFIVE=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_SYSCON=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_NETDEV=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_PCF8523=y
+CONFIG_RTC_DRV_DS3232=y
+CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_PL031=y
+CONFIG_DMADEVICES=y
+CONFIG_AMBA_PL08X=y
+CONFIG_DW_AXI_DMAC=y
+CONFIG_DMATEST=y
+# CONFIG_VIRTIO_MENU is not set
+# CONFIG_VHOST_MENU is not set
+CONFIG_STAGING=y
+CONFIG_STAGING_MEDIA=y
+CONFIG_VIDEO_STARFIVE_CAMSS=y
+CONFIG_CLK_STARFIVE_JH7110_AON=y
+CONFIG_CLK_STARFIVE_JH7110_STG=y
+CONFIG_CLK_STARFIVE_JH7110_ISP=y
+CONFIG_CLK_STARFIVE_JH7110_VOUT=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_PWM=y
+CONFIG_PHY_STARFIVE_JH7110_DPHY_RX=y
+CONFIG_PHY_STARFIVE_JH7110_PCIE=y
+CONFIG_PHY_STARFIVE_JH7110_USB=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_BTRFS_FS=y
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_AUTOFS_FS=y
+CONFIG_FUSE_FS=y
+CONFIG_VIRTIO_FS=y
+CONFIG_OVERLAY_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_UTF8=y
+CONFIG_EXFAT_FS=y
+CONFIG_NTFS_FS=y
+CONFIG_NTFS_RW=y
+CONFIG_PROC_KCORE=y
+CONFIG_PROC_CHILDREN=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_EFIVAR_FS=y
+CONFIG_JFFS2_FS=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_SQUASHFS_ZSTD=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_V4_1=y
+CONFIG_NFS_V4_2=y
+CONFIG_ROOT_NFS=y
+CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
+CONFIG_SECURITY=y
+CONFIG_LSM=""
+CONFIG_CRYPTO_CCM=m
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CRYPTO_ANSI_CPRNG=y
+# CONFIG_RAID6_PQ_BENCHMARK is not set
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=0
+CONFIG_IRQ_POLL=y
+CONFIG_PRINTK_TIME=y
+# CONFIG_DEBUG_MISC is not set
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+CONFIG_STRIP_ASM_SYMS=y
+CONFIG_DEBUG_SECTION_MISMATCH=y
+# CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_FS=y
+# CONFIG_SLUB_DEBUG is not set
+CONFIG_DEBUG_RODATA_TEST=y
+CONFIG_DEBUG_WX=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_WQ_WATCHDOG=y
+# CONFIG_SCHED_DEBUG is not set
+CONFIG_STACKTRACE=y
+CONFIG_RCU_CPU_STALL_TIMEOUT=60
+# CONFIG_RCU_TRACE is not set
+# CONFIG_FTRACE is not set
+# CONFIG_RUNTIME_TESTING_MENU is not set
+CONFIG_MEMTEST=y
@@ -0,0 +1,4 @@
+label Infix (riscv64)
+  kernel /boot/Image
+  fdtdir /boot
+  append ${bootargs_root} ${bootargs_log} -- ${bootargs_user}
@@ -0,0 +1,22 @@
+[system]
+compatible=infix-riscv64
+bootloader=uboot
+statusfile=/mnt/aux/rauc.status
+mountprefix=/var/lib/rauc/mnt
+bundle-formats=-plain
+max-bundle-download-size=1073741824
+
+[keyring]
+directory=/etc/rauc/keys
+
+[slot.rootfs.0]
+device=/dev/disk/by-partlabel/primary
+bootname=primary
+
+[slot.rootfs.1]
+device=/dev/disk/by-partlabel/secondary
+bootname=secondary
+
+[slot.net.0]
+device=/dev/ram0
+bootname=net
@@ -0,0 +1,66 @@
+Starfive VisionFive2
+====================
+
+The [VisionFive2][1] is a low-cost RISC-V 64-bit based platform, powered
+by the Starfive JH7110 processor.
+
+Infix runs from either SD card or eMMC, this guide only covers SD card.
+
+
+How to Build
+------------
+
+```
+$ make visionfive2_defconfig
+$ make
+```
+
+Once the build has finished you will have `output/images/sdcard.img`
+which you can flash to an SD card.
+
+```
+$ sudo dd if=output/images/sdcard.img of=/dev/mmcblk0 bs=1M status=progress oflag=direct
+```
+
+> **WARNING:** ensure `/dev/mmcblk0` really is the correct device for
+> your SD card, and not used by the system!
+
+
+Bootstrap Mode
+--------------
+
+Ensure the correct [bootstrap mode][3] for booting from SD card.  From
+factory the board is preset to start from QSPI flash, which also has a
+U-Boot that tries to load a Linux system from SD card, or fail-over to
+load from the network.
+
+| **Mode** | **`RGPIO_1`** | **`RGPIO_0`** |
+|----------|---------------|---------------|
+| QSPI NOR | 0 (L)         | 0 (L)         |
+| SD card  | 0 (L)         | 1 (H)         |
+| eMMC     | 1 (H)         | 0 (L)         |
+| UART     | 1 (H)         | 1 (H)         |
+
+> **Note:** the DIP switches are flipped 180° so don't get confused by
+> the socket's `ON` label.  Look at the L and H markings on the board!
+
+
+Booting the Board
+-----------------
+
+ 1. Connect a TTL UART cable to pin 6 (GND), 8 (TX) and 10 (RX)
+ 2. Insert your SD card
+ 3. Power-up the board using an USB-C cable
+
+You need a *stable power source*!  If you get the following on the
+console at power on, try to power cycle the device again:
+
+```
+dwmci_s: Response Timeout.
+dwmci_s: Response Timeout.
+BOOT fail,Error is 0xffffffff
+```
+
+[1]: https://doc-en.rvspace.org/Doc_Center/visionfive_2.html
+[2]: https://doc-en.rvspace.org/VisionFive2/Quick_Start_Guide/VisionFive2_SDK_QSG/recovering_bootloader%20-%20vf2.html
+[3]: https://doc-en.rvspace.org/VisionFive2/Quick_Start_Guide/VisionFive2_SDK_QSG/boot_mode_settings.html
@@ -0,0 +1,72 @@
+# Infix SD card image for the Starfive VisionFive2
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
+	ext4 {
+		label = "cfg"
+		use-mke2fs = true
+	}
+}
+
+image var.ext4 {
+	empty = true
+	temporary = true
+	size = 512M
+
+	ext4 {
+		label = "var"
+		use-mke2fs = true
+	}
+}
+
+image sdcard.img {
+	hdimage {
+		partition-table-type = "gpt"
+	}
+
+	partition spl {
+		partition-type-uuid = 2E54B353-1271-4842-806F-E436D6AF6985
+		image = "u-boot-spl.bin.normal.out"
+	}
+
+	partition uboot {
+		partition-type-uuid = BC13C2FF-59E6-4262-A352-B275FD6F7172
+		image = "u-boot.itb"
+	}
+
+	partition aux {
+		partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+		# Created by mkaux.sh
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 200M
+		image = "rootfs.squashfs"
+	}
+
+	partition secondary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 200M
+		image = "rootfs.squashfs"
+	}
+
+	partition cfg {
+		partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+		image = "var.ext4"
+	}
+}
+
+# Silence genimage warnings
+config {}
@@ -0,0 +1,14 @@
+--- a/arch/riscv/boot/dts/starfive/jh7110-starfive-visionfive-2.dtsi
+++ b/arch/riscv/boot/dts/starfive/jh7110-starfive-visionfive-2.dtsi
+@@ -24,6 +24,11 @@ aliases {
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+ 	};
+ 
+ 	cpus {
@@ -0,0 +1,6 @@
+# CONFIG_MMC_PCI is not set
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi visionfive2-env.dtsi "
+CONFIG_SYS_PROMPT="(visionfive2) "
+
+CONFIG_ENV_IS_NOWHERE=y
+# CONFIG_ENV_IS_IN_MMC is not set
@@ -0,0 +1,12 @@
+/ {
+	config {
+		environment {
+			boot_targets = "mmc1";
+			ethprime = "eth1";
+
+			/* This is a development platform, hard code developer mode */
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+			ixbtn-factory = "echo \"No button available, use bootmenu\"";
+		};
+	};
+};
@@ -245,6 +245,7 @@ CONFIG_FUSE_FS=y
 CONFIG_VIRTIO_FS=y
 CONFIG_OVERLAY_FS=y
 CONFIG_VFAT_FS=y
+CONFIG_EXFAT_FS=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_SQUASHFS=y
@@ -24,9 +24,10 @@ BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
+BR2_ROOTFS_MERGED_USR=y
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.34"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.46"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
@@ -1,5 +1,4 @@
 BR2_aarch64=y
-BR2_cortex_a53=y
 BR2_ARM_FPU_VFPV4=y
 BR2_TOOLCHAIN_EXTERNAL=y
 BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
@@ -9,31 +8,35 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_ROOTFS_MERGED_USR=y
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
+BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs  ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh support/scripts/genimage.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.34"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.10.3"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/linux_defconfig"
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
 BR2_LINUX_KERNEL_INTREE_DTS_NAME="rockchip/rk3328-nanopi-r2s"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
@@ -55,8 +58,11 @@ BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_EVEMU=y
+BR2_PACKAGE_EVTEST=y
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_INPUT_EVENT_DAEMON=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
@@ -70,6 +76,7 @@ BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -107,6 +114,9 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIRELESS_REGDB=y
+BR2_PACKAGE_WIRELESS_TOOLS=y
+BR2_PACKAGE_WPA_SUPPLICANT=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_TTYD=y
@@ -124,35 +134,42 @@ BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_EXT2=y
-BR2_TARGET_ROOTFS_EXT2_4=y
-BR2_TARGET_ROOTFS_EXT2_SIZE="256M"
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
 BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="v2.5"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="v2.9"
 BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="rk3328"
 BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES=""
 BR2_TARGET_ARM_TRUSTED_FIRMWARE_NEEDS_ARM32_TOOLCHAIN=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2021.10"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2024.07"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="nanopi-r2s-rk3328"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/uboot/extras.config"
 BR2_TARGET_UBOOT_NEEDS_DTC=y
 BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
+BR2_TARGET_UBOOT_NEEDS_PYELFTOOLS=y
 BR2_TARGET_UBOOT_NEEDS_OPENSSL=y
 BR2_TARGET_UBOOT_NEEDS_ATF_BL31=y
 BR2_TARGET_UBOOT_NEEDS_ATF_BL31_ELF=y
+BR2_TARGET_UBOOT_FORMAT_DTB=y
 BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
 BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
 BR2_TARGET_UBOOT_SPL=y
 BR2_TARGET_UBOOT_SPL_NAME="idbloader.img"
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/uboot/r2s-env.dtsi"
+BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
+INFIX_IMAGE_ID="${INFIX_ID}-r2s"
 INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
@@ -183,7 +200,8 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-# SIGN_ENABLED is not set
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set
+SDCARD_AUX=y
@@ -0,0 +1,198 @@
+BR2_riscv=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_TARGET_GENERIC_HOSTNAME="infix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
+BR2_TARGET_GENERIC_GETTY_TERM="xterm"
+BR2_SYSTEM_DHCP="eth0"
+BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
+BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/riscv64/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/common/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/common/post-image.sh support/scripts/genimage.sh"
+BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/genimage.cfg"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.8.2"
+BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/jh7110-starfive-visionfive-2-dtsi.patch"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/riscv64/linux_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="starfive/jh7110-starfive-visionfive-2-v1.3b"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
+BR2_PACKAGE_STRACE=y
+BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_LINUX_FIRMWARE=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT61=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT73=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT2XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_81XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X=y
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_LINUX_PAM=y
+BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_CONNTRACK_TOOLS=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FRR=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPTABLES_NFTABLES=y
+BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NETCAT_OPENBSD=y
+BR2_PACKAGE_NETSNMP=y
+BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_NMAP=y
+BR2_PACKAGE_NMAP_NCAT=y
+BR2_PACKAGE_NMAP_NMAP=y
+BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_TRACEROUTE=y
+BR2_PACKAGE_ULOGD=y
+BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
+BR2_PACKAGE_HTOP=y
+BR2_PACKAGE_IRQBALANCE=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_DBUS=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_LESS=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_EXT2=y
+BR2_TARGET_ROOTFS_EXT2_4=y
+BR2_TARGET_ROOTFS_EXT2_SIZE="512M"
+BR2_TARGET_ROOTFS_EXT2_INODE_SIZE=0
+BR2_TARGET_ROOTFS_EXT2_MKFS_OPTIONS="-O ^64bit,large_file,ext_attr"
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_OPENSBI=y
+BR2_TARGET_OPENSBI_CUSTOM_VERSION=y
+BR2_TARGET_OPENSBI_CUSTOM_VERSION_VALUE="1.4"
+BR2_TARGET_OPENSBI_PLAT="generic"
+# BR2_TARGET_OPENSBI_INSTALL_JUMP_IMG is not set
+BR2_TARGET_OPENSBI_ADDITIONAL_VARIABLES="FW_TEXT_START=0x40000000 FW_OPTIONS=0"
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2024.07"
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="starfive_visionfive2"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/uboot/extras.config"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
+BR2_TARGET_UBOOT_NEEDS_OPENSSL=y
+BR2_TARGET_UBOOT_NEEDS_OPENSBI=y
+# BR2_TARGET_UBOOT_FORMAT_BIN is not set
+BR2_TARGET_UBOOT_FORMAT_DTB=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
+BR2_TARGET_UBOOT_SPL=y
+BR2_TARGET_UBOOT_SPL_NAME="spl/u-boot-spl.bin.normal.out"
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/uboot/visionfive2-env.dtsi"
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+INFIX_VENDOR_HOME="https://github.com/kernelkit"
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_EXECD=y
+BR2_PACKAGE_GENCERT=y
+BR2_PACKAGE_STATD=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
+BR2_PACKAGE_KEYACK=y
+BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
+BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
+BR2_PACKAGE_PODMAN=y
+BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
+BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
+BR2_PACKAGE_PODMAN_DRIVER_VFS=y
+BR2_PACKAGE_TETRIS=y
+BR2_PACKAGE_ROUSETTE=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+# GNS3_APPLIANCE is not set
+SDCARD_AUX=y
@@ -23,9 +23,10 @@ BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
+BR2_ROOTFS_MERGED_USR=y
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.34"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.46"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -4,6 +4,93 @@ Change Log
 All notable changes to the project are documented in this file.


+[v24.08.0][] - 2024-08-30
+-------------------------
+
+**News:** this release adds full configuration support for syslog, with
+logging to local files, external media, remote log server, as well as
+support for acting as a log sink/server.  External media can now be
+mounted automatically, very useful, not only for logging, but also for
+upgrading and container images.
+
+Finally, the following consumer boards are now fully supported:
+
+ - NanoPi R2S (ARM)
+ - StarFive VisionFive2 (RISC-V)
+
+### Changes
+- Upgrade Buildroot to 2024.02.5 (LTS)
+- Upgrade Linux kernel to 6.6.46 (LTS)
+- Issue #158: enhance security of factory reset.  All file content
+  is now overwritten x3, the last time with zeroes, then removed.  
+  Example, on the NanoPi R2S this process takes ~30 seconds, but may
+  take longer in setups with bigger configurations, e.g., containers
+- Issue #497: support for auto-mounting USB media.  Useful for logging,
+  upgrade, and container images.  Mounted under `/media/<LABEL>`, where
+  `<LABEL>` is the partition label(s) available on the USB media
+- Issue #503: configurable syslog support, based on IETF Syslog config
+  [draft model][syslog.yang], includes file based logging (built-in or
+  external media) and remote logging, as well as acting as a log sink
+  (remote server) for syslog clients (Infix extension).  Documentation
+  available in [Syslog Support][syslog.md]
+- Issue #521: audit trail support.  Logs changes to configuration, both
+  `running-config` and `startup-config`, as well as RPCs, e.g., setting
+  system date-time.  Logs contain name of user and the action taken.
+  Supported for CLI, NETCONF, and RESTCONF
+- Issue #545: sort loopback interface first in CLI `show interfaces`
+- New documentation for Ethernet interfaces: how to set speed, duplex,
+  query status and statistics
+- Issue #587: add YANG must expressions for bridge multicast filters
+- Initial RISC-V (riscv64) support: StarFive VisionFive2
+- Massive updates to the NanoPi R2S:
+  - Update Linux kernel to v6.10.3 and sync defconfig with aarch64
+  - Workaround `reboot` command "hang" on NanoPi R2S (failure to reboot)
+	by replacing the Rockchip watchdog driver with "softdog"
+  - Update U-Boot to v2024.07, enable secure boot loading of images
+  - Rename interfaces to LAN + WAN to match case and LEDs
+  - Rename images to `infix-r2s$ver.ext`, not same as other aarch64
+  - Change rootfs to squashfs for enhanced security
+  - Add RAUC support to simplify device maintenance/upgrade
+  - Add support for saving unique interface MAC addresses in U-Boot
+  - Add support for system LEDs, see product's README
+  - Add support for reset button from U-Boot, to trigger factory reset,
+    and from Linux, to trigger `reboot`
+  - Add static `factory-config` as an example
+  - Full LED control, including WAN LED (link up and DHCP lease)
+- Password login can now be disabled by removing the password.  Before
+  this change only empty password disabled password login (in favor of
+  SSH key login), removing the password locked the user completely out
+- Add LED indication on factory reset, *all* LEDs available in Linux
+  `/sys/class/leds` are turned on while clearing writable partitions
+- CLI: improve `dir` and `show log` command user experience.  List files
+  also in user's home directory and allow displaying gzipped log files
+- Lock down CLI admin-exec to prevent unprivileged users from managing
+  system configuration or state.
+- The local log file `/var/log/syslog` no longer contains debug level
+  log messages.  See `/var/log/debug` for *all* log messages
+
+### Fixes
+- Fix #274: add missing link/traffic LEDs on NanoPi R2S LAN port
+- Fix #489: ensure all patches are versioned, including Linux kernel
+- Fix #531: creating a new VLAN interface named `vlanN` should not set
+  `lower-layer-if` to `vlanN`.  With the `vlanN` pattern, only C-VLAN
+  and VID can be inferred
+- Fix #541: make sure Frr OSPF logs are sent to `syslogd` and filtered
+  to `/var/log/routing` for easy access from the CLI
+- Fix #542: warning message from `login`, cannot find `pam_lastlog.so`
+- Fix #570: the CLI `change password` command does not work
+- Fix #576: the CLI tab completion for `startup-config` does not work
+- Fix #585: on internal configuration database error, restart internal
+  service `sysrepo-plugind` to attempt to get remote access over NETCONF
+  and RESTCONF back to the user
+- Silence bogus `sysctl` warnings at boot (syslog)
+- Silence output from user group member check (sys-cli in syslog)
+- Fix annoying CLI freeze if pressing any key before initial prompt
+
+[syslog.yang]: https://datatracker.ietf.org/doc/draft-ietf-netmod-syslog-model/
+[syslog.md]: https://github.com/kernelkit/infix/blob/main/doc/syslog.md
+
+
 [v24.06.0][] - 2024-06-28
 -------------------------

@@ -981,7 +1068,8 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.04.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.08.0...HEAD
+[v24.08.0]:   https://github.com/kernelkit/infix/compare/v24.06.0...v24.08.0
 [v24.06.0]:   https://github.com/kernelkit/infix/compare/v24.04.0...v24.06.0
 [v24.04.2]:   https://github.com/kernelkit/infix/compare/v24.04.1...v24.04.2
 [v24.04.1]:   https://github.com/kernelkit/infix/compare/v24.04.0...v24.04.1
@@ -18,6 +18,7 @@ the `help` command.
   - [Introduction](introduction.md)
   - [System Configuration](system.md)
   - [Network Configuration](networking.md)
+   - [Syslog Support](syslog.md)
 - **Infix In-Depth**
   - [Boot Procedure](boot.md)
   - [Branding & Releases](branding.md)
@@ -44,7 +44,7 @@ build.  Its main responsibility is usually to set up the system's
 memory controller and perform DDR training, if required, before
 loading the _TPL_.

-Commonly referred to as the system's _bootloader_, the _TPL_ is is
+Commonly referred to as the system's _bootloader_, the _TPL_ is
 responsible for preparing the execution environment required by the
 Linux kernel.

@@ -113,7 +113,7 @@ the [Bootloader Interface](#bootloader-interface) section.
 ### GRUB

 Used on _x86_64_ based systems.  Neither the _integrity_ nor the
-_authenticity_ of the Infix image is verified.  It only intended to
+_authenticity_ of the Infix image is verified.  It is only intended to
 provide a way of booting a [Disk Image](#disk-image), such that a
 standard [System Upgrade](#system-upgrade) can be performed on
 virtualized instances.
@@ -200,7 +200,7 @@ one of the [Root Filesystem](#primarysecondary---root-filesystems)
 partitions.

 When the system boots, U-Boot will concatenate the two parts to
-validate the SquashFS's contents. This is path was chosen because:
+validate the SquashFS's contents. This path was chosen because:

 - Having a separate raw SquashFS means Linux can directly mount it as
  the root filesystem.
@@ -210,7 +210,7 @@ validate the SquashFS's contents. This is path was chosen because:
  Infix's boot process, as we can still use a regular SquashFS as the
  root filesystem.

- It lets us use standard interfaces to boot linux, like SYSLINUX.  It
+- It lets us use standard interfaces to boot Linux, like SYSLINUX.  It
  also plays well with traditional bootloaders, like GRUB.

 In its full form, it can be used to netboot Infix, as it contains all
@@ -26,20 +26,20 @@ bus, here is an example:

 ```
 # Enable the bus
- echo 1 > /sys/bus/usb/devices/usb1/authorized
+echo 1 > /sys/bus/usb/devices/usb1/authorized
 ```

 And then enable sub-devices (e.g. USB memory)

 ```
- # Enable a device plugged into usb1
- echo 1 >  /sys/bus/usb/devices/usb1/1-1/authorized
+# Enable a device plugged into usb1
+echo 1 >  /sys/bus/usb/devices/usb1/1-1/authorized
 ```

 ### Current status

 ```
- admin@example:/> show hardware
+admin@example:/> show hardware
 USB PORTS
 NAME                STATE
 USB                 unlocked
@@ -56,10 +56,33 @@ Linux to use.
 > context.)

 ```
- root@example:/> configure
- root@example:/config/> set hardware component USB state admin-state unlocked
- root@example:/config/> leave
- root@example:/>
+admin@example:/> configure
+admin@example:/config/> set hardware component USB state admin-state unlocked
+admin@example:/config/> leave
+admin@example:/>
 ```

+### Using a USB Stick
+
+With the USB port unlocked, a memory stick can be used to expand the
+storage of the device.  Plug it in, either directly, or via a USB hub.
+All partitions of *VFAT* or *exFAT* type are automatically mounted to
+the `/media/<LABLEL>` directory, e.g., `/media/memorystick`, or if a
+partition does not have a label, using the kernel device name, e.g.,
+`/media/sda`.
+
+Depending on the partition type the the media is either mounted in
+`flush` or `sync` mode to ensure files are properly flushed to the
+backing store of the memory stick.  This to protect against users
+yanking out a device before file(s) have been written to it.
+
+The only way currently to safely "eject" a USB memory stick is to use
+`umount` command from a UNIX shell, which explicitly synchronizes any
+cached data to disk before returning the prompt:
+
+```
+admin@example:~$ sudo umount /media/log
+```
+
+
 [1]:  https://www.rfc-editor.org/rfc/rfc8348.html
@@ -24,8 +24,14 @@ The two modes in the CLI are the admin-exec and the configure context.

 However, when logging in to the system, from the console port or SSH,
 you land in a standard UNIX shell, Bash.  This is for advanced users
-and remote scripting purposes (production equipment).  To enter the
-CLI type:
+and remote scripting purposes (production equipment):
+
+    Run the command 'cli' for interactive OAM
+    
+    admin@example:~$
+
+To enter the CLI, follow the instructions, for interactive Operations,
+Administration, and Management (OAM), type:

    admin@example:~$ cli
    admin@example:/>
@@ -16,15 +16,16 @@ Infix to exploit the unique features not available in IEEE models.

 ![Linux Networking Blocks](img/lego.svg)

-| **Type** | **Yang Model**    | **Description**                                               |
-| -------- | ----------------- | ------------------------------------------------------------- |
-| bridge   | infix-if-bridge   | SW implementation of an IEEE 802.1Q bridge                    |
-| ip       | ietf-ip, infix-ip | IP address to the subordinate interface                       |
-| vlan     | infix-if-vlan     | Capture all traffic belonging to a specific 802.1Q VID        |
-| lag[^1]  | infix-if-lag      | Bonds multiple interfaces into one, creating a link aggregate |
-| lo       | ietf-interfaces   | Software loopback interface                                   |
-| eth      | ietf-interfaces   | Physical Ethernet device/port                                 |
-| veth     | infix-if-veth     | Virtual Ethernet pair, typically one end is in a container    |
+| **Type** | **Yang Model**             | **Description**                                               |
+| -------- | -----------------          | ------------------------------------------------------------- |
+| bridge   | infix-if-bridge            | SW implementation of an IEEE 802.1Q bridge                    |
+| ip       | ietf-ip, infix-ip          | IP address to the subordinate interface                       |
+| vlan     | infix-if-vlan              | Capture all traffic belonging to a specific 802.1Q VID        |
+| lag[^1]  | infix-if-lag               | Bonds multiple interfaces into one, creating a link aggregate |
+| lo       | ietf-interfaces            | Software loopback interface                                   |
+| eth      | ietf-interfaces,           | Physical Ethernet device/port                                 |
+|          | ieee802-ethernet-interface |                                                               |
+| veth     | infix-if-veth              | Virtual Ethernet pair, typically one end is in a container    |

 ## Data Plane

@@ -323,6 +324,124 @@ top of a bridge interface *br0* is named *vlan10*.
 > **Note:** If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a number, Infix will set the interface type automatically for you.


+### Physical Ethernet Interfaces
+
+#### Ethernet Settings and Status
+
+Physical Ethernet interfaces provide low-level settings for speed/duplex as
+well as packet status and statistics (*ieee802-ethernet-interface.yang*).
+
+By default, Ethernet interfaces defaults to auto-negotiating
+speed/duplex modes, advertising all speed and duplex modes available.
+In the example below, the switch would by default auto-negotiate speed
+1 Gbit/s on port eth1 and 100 Mbit/s on port eth4, as those are the
+highest speeds supported by H1 and H2 respectively.
+
+![4-port Gbit/s switch connected to Gbit and Fast Ethernet Hosts](img/ethernet-autoneg.svg)
+
+The speed and duplex status for the links can be listed as shown
+below, assuming the link operational status is 'up'. 
+
+```
+admin@example:/> show interfaces name eth1
+name                : eth1
+index               : 2
+mtu                 : 1500
+operational status  : up
+auto-negotiation    : on
+duplex              : full
+speed               : 1000
+physical address    : 00:53:00:06:11:01
+ipv4 addresses      :
+ipv6 addresses      : 
+in-octets           : 75581
+out-octets          : 43130
+...
+admin@example:/> show interfaces name eth4
+name                : eth4
+index               : 5
+mtu                 : 1500
+operational status  : up
+auto-negotiation    : on
+duplex              : full
+speed               : 100
+physical address    : 00:53:00:06:11:04
+ipv4 addresses      :
+ipv6 addresses      : 
+in-octets           : 75439
+out-octets          : 550704
+...
+admin@example:/>
+```
+
+#### Configuring fixed speed and duplex
+
+Auto-negotiation of speed/duplex mode is desired in almost all
+use-cases, but it is possible to disable auto-negotiation and specify
+a fixed speed and duplex mode.
+
+> If setting a fixed speed and duplex mode, ensure both sides of the
+> link have matching configuration. If speed does not match, the link
+> will not come up. If duplex mode does not match, the result is
+> reported collisions and/or bad throughput.
+
+The example below configures port eth3 to fixed speed 100 Mbit/s
+half-duplex mode. 
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface eth3 ethernet
+admin@example:/config/interface/eth3/ethernet/> set speed 0.1
+admin@example:/config/interface/eth3/ethernet/> set duplex half
+admin@example:/config/interface/eth3/ethernet/> set auto-negotiation enable false
+admin@example:/config/interface/eth3/ethernet/> show
+auto-negotiation {
+  enable false;
+}
+duplex half;
+speed 0.1;
+admin@example:/config/interface/eth3/ethernet/> leave
+admin@example:/> 
+```
+
+Speed metric is in Gbit/s.  Auto-negotiation needs to be disabled in
+order for fixed speed/duplex to apply. Only speeds `0.1`(100 Mbit/s)
+and `0.01` (10 Mbit/s) can be specified. 1 Gbit/s and higher speeds
+require auto-negotiation to be enabled.
+
+#### Ethernet statistics
+
+Ethernet packet statistics can be listed as shown below.
+
+```
+admin@example:/> show interfaces name eth1
+name                : eth1
+index               : 2
+mtu                 : 1500
+operational status  : up
+auto-negotiation    : on
+duplex              : full
+speed               : 1000
+physical address    : 00:53:00:06:11:0a
+ipv4 addresses      :
+ipv6 addresses      : 
+in-octets           : 75581
+out-octets          : 43130
+
+eth-in-frames                : 434
+eth-in-multicast-frames      : 296
+eth-in-broadcast-frames      : 138
+eth-in-error-fcs-frames      : 0
+eth-in-error-oversize-frames : 0
+eth-out-frames               : 310
+eth-out-multicast-frames     : 310
+eth-out-broadcast-frames     : 0
+eth-out-good-octets          : 76821
+eth-in-good-octets           : 60598
+admin@example:/> 
+```
+
+
 ### VETH Pairs

 A Virtual Ethernet (VETH) pair is basically a virtual Ethernet cable.  A
@@ -93,7 +93,7 @@ Warning: Permanently added 'fe80::ff:fe00:0%eth0' (ED25519) to the list of known
 admin@fe80::ff:fe00:0%eth0's password: *****
 .-------.
 |  . .  | Infix -- a Network Operating System
-|-. v .-| https://kernelkit.github.io
+|-. v .-| https://kernelkit.org
 '-'---'-'

 Run the command 'cli' for interactive OAM
@@ -1147,7 +1147,7 @@ It should now be possible to access the switch from the PC via SSH (or NETCONF).
 admin@fe80::0053:00ff:fe06:1101%eth1's password: 
 .-------.
 |  . .  | Infix -- a Network Operating System
-|-. v .-| https://kernelkit.github.io
+|-. v .-| https://kernelkit.org
 '-'---'-'

 Run the command 'cli' for interactive OAM
@@ -0,0 +1,227 @@
+## Syslog Support
+
+The system comes with native logging to internal storage, `/var/log/`,
+or `/log` for a shortcut.  Depending on the device, this may be a RAM
+disk, meaning logs are not retained across reboots.  This document
+details how to log to external media or remote syslog servers.
+
+It is also possible to set up the device to act as a syslog server (log
+sink), this is covered briefly at the very end of this document.
+
+> **Note:** the native logging cannot be modified, only the log file
+> rotation can be changed.  Please see the `dir` admin-exec command for
+> a listing of existing native log files.
+
+
+### Log to File
+
+Logging to a local file is useful when combined with an external media.
+E.g., a USB stick with a log partition (named/labeled: "log").  Below is
+an example.
+
+For a list of available log facilities, see the table in a later section.
+
+```bash
+admin@example:/> configure
+admin@example:/config/> edit syslog
+admin@example:/config/syslog/> edit actions log-file file:/media/log/mylog
+admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list
+      all    audit     auth authpriv  console     cron    cron2   daemon      ftp     kern
+   local0   local1   local2   local3   local4   local5   local6   local7      lpr     mail
+     news      ntp   syslog     user     uucp
+admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list all severity
+     alert       all  critical     debug emergency     error      info      none    notice   warning
+admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list all severity critical
+admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list mail severity warning
+admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> leave
+admin@example:/>
+```
+
+> **Note:** the `log-file` syntax requires the leading prefix `file:`.
+> If the path is not absolute, e.g., `file:mylog`, the file is saved to
+> the system default path, i.e., `/log/mylog`.  In this case, verify
+> that the filename is not already in use.
+
+
+### Log Rotation
+
+By default log files are allowed to grow to a size of 1 MiB after which
+they are "rotated".  The whole reason for this is to not fill up the
+disk with outdated logs.  A rotated file is saved in stages and older
+ones are also compressed (using `gzip`).  Use the `show log` command in
+admin-exec context to start the log file viewer:
+
+    admin@example:/config/syslog/> do show log
+    log  log.0  log.1.gz  log.2.gz  log.3.gz  log.4.gz  log.5.gz
+    admin@example:/config/syslog/> do show log log.1.gz
+
+> **Tip:** use the Tab key on your keyboard list available log files.
+> The `do` prefix is also very useful in configure context to access
+> commands from admin-exec context.
+
+By default 10 compressed older files are saved.  Here the oldest is
+`log.5.gz` and the most recently rotated one is `log.0`.
+
+Log file rotation can be configured both globally and per log file.
+Here we show the global settings, the set up is the same for per log
+file, which if unset inherit the global settings:
+
+```bash
+admin@example:/> configure 
+admin@example:/config/> edit syslog file-rotation
+admin@example:/config/syslog/file-rotation/> show
+admin@example:/config/syslog/file-rotation/>
+```
+
+The defaults are not shown.  We can inspect them by asking the YANG
+model for the help texts:
+
+```bash
+admin@example:/config/syslog/file-rotation/> help
+   max-file-size    number-of-files
+admin@example:/config/syslog/file-rotation/> help max-file-size 
+NAME
+        max-file-size kilobytes
+
+DESCRIPTION
+        Maximum log file size (kiB), before rotation.
+
+DEFAULT
+        1024
+admin@example:/config/syslog/file-rotation/> help number-of-files 
+NAME
+        number-of-files [0..4294967295]
+
+DESCRIPTION
+        Maximum number of log files retained.
+
+DEFAULT
+        10
+```
+
+To change the defaults to something smaller, 512 kiB and 20 (remember
+everything after .0 is compressed, and text compresses well):
+
+```bash
+admin@example:/config/syslog/file-rotation/> set max-file-size 512
+admin@example:/config/syslog/file-rotation/> set number-of-files 20
+admin@example:/config/syslog/file-rotation/> show
+number-of-files 20;
+max-file-size 512;
+admin@example:/config/syslog/file-rotation/> leave
+admin@example:/> 
+```
+
+
+### Log Format
+
+There are three major syslog log formats, the default is [RFC3164][] for
+log files and BSD for remote logging.  Depending on time synchronization
+and remote log server capabilities, or policies, the [RFC5424][] format
+is often preferred since it not only has better time resolution but also
+supports structured logging:
+
+	BSD     : myproc[8710]: Kilroy was here.
+	RFC3164 : Aug 24 05:14:15 192.0.2.1 myproc[8710]: Kilroy was here.
+	RFC5424 : 2003-08-24T05:14:15.000003-07:00 192.0.2.1 myproc 8710 - - Kilroy was here.
+
+The BSD format is only applicable to remote logging.  It remains the
+default for compatibility reasons, and is recommended since the device
+may not have proper time, making it better for the remote log server to
+perform time stamping at the time of arrival.
+
+Configuring the log format is the same for log files and remotes:
+
+```bash
+admin@example:/config/> edit syslog actions log-file file:foobar 
+admin@example:/config/syslog/actions/log-file/file:foobar/> set log-format 
+                  bsd               rfc3164              rfc5424
+admin@example:/config/syslog/actions/log-file/file:foobar/> set log-format rfc5424 
+admin@example:/config/syslog/actions/log-file/file:foobar/> leave
+admin@example:/>
+```
+
+[RFC3164]: https://datatracker.ietf.org/doc/html/rfc3164
+[RFC5424]: https://datatracker.ietf.org/doc/html/rfc5424
+
+### Log to Remote Server
+
+Logging to a remote syslog server is the recommended way of supervising
+the system.  This way all login attempts (console, SSH, or web) and any
+configuration changes can be traced, even in cases of a remote attacker
+tries to cover their traces by deleting logs.
+
+The recommended setup involves using a fixed IP address, default BSD log
+format, and the default Internet port (514).  This is the most reliable,
+because your device may not have DNS set up or even available, and some
+remote syslog servers do not support receiving time stamped log messages
+-- this is of course entirely dependent on how the remote server is set
+up, as well as local policy.
+
+```bash
+admin@example:/config/> edit syslog
+       actions file-rotation        server
+admin@example:/config/> edit syslog actions destination moon
+admin@example:/config/syslog/actions/destination/moon/> set
+ facility-list    log-format           udp
+admin@example:/config/syslog/actions/destination/moon/> set udp
+ address    port
+admin@example:/config/syslog/actions/destination/moon/> set udp address 192.168.0.12
+admin@example:/config/syslog/actions/destination/moon/> set facility-list container severity all
+admin@example:/config/syslog/actions/destination/moon/> leave
+admin@example:/>
+```
+
+> **Note:** the alternatives shown below each prompt in the example
+> above can be found by tapping the Tab key.
+
+
+### Acting as a Log Server
+
+The syslog server can act as a log sink for other devices on a LAN.  For
+this to work you need a static IP address, here we use 10.0.0.1/24.
+
+```bash
+admin@example:/> configure
+admin@example:/config/> edit syslog server
+admin@example:/config/syslog/server/> set enabled true
+admin@example:/config/syslog/server/> set listen udp 514 address 10.0.0.1
+admin@example:/config/syslog/server/> leave
+admin@example:/>
+```
+
+See the above [Log to File](#log-to-file) section on how to set up
+filtering of received logs to local files.  Please note, filtering based
+on property, e.g., hostname, is not supported yet.
+
+
+### Facilities
+
+| **Code** | **Facility** | **Description**                           |
+|----------|--------------|-------------------------------------------|
+| 0        | kern         | Kernel log messages                       |
+| 1        | user         | User-level messages                       |
+| 2        | mail         | Mail system                               |
+| 3        | daemon       | General system daemons                    |
+| 4        | auth         | Security/authorization messages           |
+| 5        | syslog       | Messages generated by syslogd             |
+| 6        | lpr          | Line printer subsystem                    |
+| 7        | news         | Network news subsystem                    |
+| 8        | uucp         | UNIX-to-UNIX copy                         |
+| 9        | cron         | Clock/cron daemon (BSD, Linux)            |
+| 10       | authpriv     | Security/authorization messages (private) |
+| 11       | ftp          | FTP daemon                                |
+| 12       | ntp          | NTP subsystem                             |
+| 13       | audit        | Log audit (security)                      |
+| 14       | console      | Log alert                                 |
+| 15       | cron2        | Clock/cron daemon (Solaris)               |
+| 16       | rauc*        | local0, reserved for RAUC                 |
+| 17       | container*   | local1, reserved for containers           |
+| 18       | local2       | Currently unused                          |
+| 19       | local3       | Currently unused                          |
+| 20       | local4       | Currently unused                          |
+| 21       | local5       | Currently unused                          |
+| 22       | reserved*    | local6, reserved for industrial Ethernet  |
+| 23       | web*         | local7, reserved for nginx web server     |
+
+Facilities marked `*` are local augments to the model.
@@ -241,6 +241,31 @@ could accept an arbitrary physical topology, run the STP algorithm on
 it offline, enable STP on all DUTs, and then verify that the resulting
 spanning tree matches the expected one.

+Integration to Infix
+--------------------
+To successfully run all Infix tests, the image must be built in 
+'test-mode'. This can be achieved by setting the DISK_IMAGE_TEST_MODE
+parameter to true. Although this is the default setting, it’s advisable
+to verify it by running:
+
+    $ make menuconfig
+    (External Options --> -*- Disk image --> [*] Enable Test Mode)
+
+Building an image in 'test-mode' results in the creation of a 'test-mode'
+file within the auxiliary (aux) partition of the Infix disk image 
+(/mnt/aux/test-mode).
+
+During the bootstrap phase, the system checks for the presence of this 
+test-mode flag (file). If the flag exists, a 'test-config.cfg' file is 
+generated. In the following step, the system loads the 'test-config' 
+instead of the standard startup-config (or factory-config). This 
+configuration is simple and safe, equivalent to the one used in 'Secure Mode'
+(also known as 'failure-config').
+
+Additionally, the configuration enables extra RPCs related to system 
+restart and configuration overrides, allowing tests to be run even on 
+systems where the factory configuration may potentially create L2 loops. 
+
 [9PM]:    https://github.com/rical/9pm
 [Qeneth]: https://github.com/wkz/qeneth
 [TAP]:    https://testanything.org/
@@ -25,6 +25,17 @@ for `x86_64`:
    $ make
    $ make test

+It is important to mention that Infix build system by default creates
+an image in 'test-mode'. The mode is set by DISK_IMAGE_TEST_MODE
+parameter (default=true). To generate a standard image set the
+DISK_IMAGE_TEST_MODE to 'false'. However, only the test mode ensures
+that all Infix tests are executed properly. Prior to the set of commands
+above, it is always good to check that DISK_IMAGE_TEST_MODE is properly
+set by running:
+
+    $ make menuconfig
+    (External Options --> -*- Disk image --> [*] Enable Test Mode)
+
 ### Physical Devices

 To run the tests on a preexisting topology from the host's network
@@ -125,7 +136,7 @@ there is another helper script in Infamy for this:
    Password:
    .-------.
    |  . .  | Infix -- a Network Operating System
-    |-. v .-| https://kernelkit.github.io
+    |-. v .-| https://kernelkit.org
    '-'---'-'

    Run the command 'cli' for interactive OAM
@@ -256,13 +267,20 @@ the whole suite) with identical topology mappings:

    $ make PYTHONHASHSEED=3773822171 INFIX_TESTS=case/ietf_system/hostname.py test

-### Determinstic use of communication protocol (NETCONF/RESTCONF)
+### Deterministic Transport Protocol

-By default the protocol will be chosen randomly. If you supply a
-`PYTHONHASHSEED` as described above, you will get the same protocol
-chosen. If you want to choose the communcation protocol:
+By default, the communication transport protocol (NETCONF/RESTCONF) is
+chosen randomly.  If you supply a `PYTHONHASHSEED` as described above,
+you get the same protocol used for that hash.  But if you want to choose
+the protocol, add extra arguments to Infamy:

    $ make INFAMY_EXTRA_ARGS="--transport=restconf" INFIX_TESTS=case/ietf_system/hostname.py test

+or, when running interactively:
+
+    $ make test-sh
+    09:08:17 infamy0:test # ./9pm/9pm.py -o"--transport=restconf" case/ietf_system/hostname.py
+
+
 [9PM]:    https://github.com/rical/9pm
 [Qeneth]: https://github.com/wkz/qeneth
@@ -8,7 +8,8 @@ run name:error :1 log:console norestart if:<run/bootstrap/failure> \
 	[S] /usr/libexec/confd/error --

 service name:confd log:prio:daemon.err <run/bootstrap/success> \
-	[S12345] sysrepo-plugind -f -p /run/confd.pid -n -- Configuration daemon
+	[S12345] sysrepo-plugind -f -p /run/confd.pid -n -v warning \
+	-- Configuration daemon

 # Bootstrap system with startup-config
 run name:startup log:prio:user.notice norestart <pid/confd> \
@@ -24,7 +25,7 @@ run name:error :2 log:console norestart if:<run/failure/failure> \
 	[S] /usr/libexec/confd/error --

 service name:netopeer notify:none log <pid/confd> \
-	[12345] netopeer2-server -F -t 60 \
+	[12345] netopeer2-server -F -t 60 -v 1 \
 	-- NETCONF server

 # Create initial /etc/resolv.conf after successful bootstrap
@@ -1,3 +1,4 @@
 d  /run/confd/factory.d		- - -
 d  /run/confd/failure.d		- - -
+d  /run/confd/test.d            - - -   
 d  /run/resolvconf/interfaces	- - -
@@ -27,13 +27,18 @@ FINIT_D = $(TARGET_DIR)/etc/finit.d
 # no override necessary there.
 FINIT_CONF_OPTS =					\
 	--prefix=/usr					\
-	--exec-prefix=					\
 	--disable-doc					\
 	--disable-contrib				\
 	--disable-rescue				\
 	--disable-silent-rules				\
 	--with-group=$(BR2_PACKAGE_FINIT_INITCTL_GROUP)

+ifeq ($(BR2_ROOTFS_MERGED_USR),y)
+FINIT_CONF_OPTS += --exec-prefix=/usr
+else
+FINIT_CONF_OPTS += --exec-prefix=
+endif
+
 ifeq ($(BR2_PACKAGE_FINIT_ADVANCED),y)
 ifneq ($(BR2_PACKAGE_FINIT_CUSTOM_FSTAB),)
 FINIT_CONF_OPTS += --with-fstab=$(BR2_PACKAGE_FINIT_CUSTOM_FSTAB)
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`service [12345789] log wan-monitor.sh -- WAN Health monitor`