package/skeleton-init-finit: enable rngd by default

Platforms with /dev/hwrandom use that to see /dev/urandom. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Merge pull request #796 from kernelkit/rtc
2026-07-22 01:13:00 +02:00 · 2024-11-05 13:32:38 +01:00 · 2024-11-05 13:05:59 +01:00 · 2024-11-04 14:25:48 +01:00 · 2024-11-04 14:19:29 +01:00 · 2024-11-04 11:33:51 +01:00
600 changed files with 20775 additions and 10355 deletions
@@ -0,0 +1,35 @@
+Checklists for Pull Requests and Releases
+=========================================
+
+Maintainer checklists for reviewing pull requests and doing releases.
+
+
+Pull Requests
+-------------
+
+ - If applicable, is there a readable ChangeLog entry?
+ - If any LICENSE file has been updated, has the `.hash` file been updated?
+ - If any change to a Finit `.svc` file, does any run/task linger?  
+   I.e., is there a runlevel and/or condition defined to prevent them
+   from running outside of their intended runlevel?
+ - If any change to grub or qemu/qeneth setup, has it been tested in GNS3?
+   - If any change to u-boot/buildroot, has it been tested with `<booloader>_defconfig`
+ - If any change to logging, have the resulting logs been audited?
+   - Check for duplicate entries, misspellings
+   - Check for sneaky severity changes, e.g., error vs note, error vs warning
+ - If new subsystem, or major changes to a subsystem, have the docs been updated?
+ - If change to mDNS, has it been tested with netbrowse?
+ - If change to `_defconfig`, verify `local.mk` and sync with other archs
+   - Test manually as well, e.g., CLI changes do not have ha regression tests
+   - Build from distclean, or use artifacts built by build servers, for manual tests
+
+
+Releases
+--------
+
+ - Make at least one -betaN release to verify the GitHub workflow well in time release day
+   - Stuff happens, remember kernelkit/infix#735
+ - Make at least one -rcN to flush out any issues in customer repos
+   - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
+ - Ensure the markdown link for the release diff is updated
+ - Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
@@ -1,25 +1,49 @@
-Contributing to Infix
-=====================
+Contributing Guidelines
+=======================

-We welcome any and all help in the form of bug reports, fixes, patches
-to add new features -- *preferably as GitHub pull requests*.
+Thank :heart: you for taking the time to read this!

-If you are unsure of what to do, or how to implement an idea or bug fix,
-open an issue with `"[RFC]: Unsure if this is a bug ... ?"`, or use the
-[GitHub discussions forum](https://github.com/orgs/kernelkit/discussions).
-Talking about code and problems first is often the best way to get started
-before submitting a pull request.
+We welcome any help in the form of bug reports, fixes, or patches to add
+new features.  We *prefer* GitHub pull requests, but are open to other
+forms of collaboration as well.  [Let's talk!][support] :handshake:

-When submitting a bug report, patch, or pull request, please start by
-stating the version the change is made against, what it does, *and why*.
+If you are unsure how to start implementing an idea or fix:
+
+ - :bug: open an issue, there are human friendly templates for _bugs_
+   and _feature requests_ at <https://github.com/kernelkit/infix/issues>
+ - :speech_balloon: use the [Q&A Forum][discuss]
+ - :technologist: The [Developer's Guide][devguide] is also a useful start
+
+> _Talking about code and problems first is often the best way to get
+> started before submitting a pull request.  We have found it always
+> saves time, yours and ours._
+
+
+:sparkles: General Guidelines
+-----------------------------
+
+When submitting bug reports or patches to bugs, please state which
+version the change is made against, what it does, and, more importantly
+*why* -- from your perspective, why is it a bug, why does the code need
+changing in this way.  Start with why.
+
+ - :bug: Bug reports need metadata like Infix version or commit hash
+ - :adhesive_bandage: Bug fixes also need version, and (preferably) a
+   corresponding issue number for the ChangeLog
+ - :new: New features, you need to get approval of the YANG model first!  
+   :speech_balloon: Please use the [Forum][discuss], e.g., category:
+   *Ideas*, or open a :pray: feature request issue
+ - :white_check_mark: New features also need new regression tests, this
+   can be basic tests or more complex use-case tests comprising multiple
+   subsystems, see [Testing Changes](#test_tube-testing-changes), below

 Please take care to ensure you follow the project coding style and the
 commit message format.  If you follow these recommendations you help
-the maintainer(s) and make it easier for them to include your code.
+the maintainers and make it easier for them to include your code.


-Coding Style
------------
+:woman_technologist: Coding Style
+---------------------------------

 Before jumping into code, remember to **document new features** and bug
 fixes.  Both the manual and ChangeLog are in the `doc/` sub-directory
@@ -40,23 +64,58 @@ We expect code contributions for:
 > code!  Legacy takes precedence, and remember, we read code a lot more
 > than write it, so legibility is important.

-As a final note, lines are allowed to be longer than 72 characters these
-days.  There is no enforced maximum, but the team usually keep it around
-100 characters for both C and Python.
+The ChangeLog deserves a separate mention:
+
+ - Releases are listed in reverse chronological order order, so the
+   latest/next release is at the beginning of the file
+ - Only *user-facing bugs and features* are detailed, so code refactor,
+   new tests, etc. are not listed.
+ - Add your changes/features to the Changes section
+ - Add your Fix line in the Fixes section, in numeric order 
+ - Changes and fixes without an issue number are listed after all
+   numbered ones
+ - YANG model changes are documented in their respective model, for
+   standard models, e.g., for `ietf-interfaces.yang`, the corresponding
+   `infix-interfaces.yang` detail augments/deviations as revisions.
+
+A final note, lines of code are allowed to be longer than 72 characters
+these days, unless you live by PEP-8 (see above).  There is no enforced
+maximum, but the team usually keep it around 100 characters for both C
+and Python.


-Commit Messages
---------------
+:test_tube: Testing Changes
+---------------------------
+
+Please test your changes, no matter how trivial or obviously correct
+they may seem.  Nobody is infallible, making mistakes is only human.
+It is also the best insurance policy for your feature, it ensures your
+use-case will remain functional as the source base evolves.
+
+For new functionality we expect new regression tests to be added in
+the same pull request.
+
+For help getting started with testing, see the following resources:
+
+ - [Developer's Guide][devguide]
+ - [Regression Testing][testing]
+
+
+:memo: Commit Messages
+----------------------

 Commit messages exist to track *why* a change was made.  Try to be as
 clear and concise as possible in your commit messages, and always, be
 proud of your work and set up a proper GIT identity for your commits:

+<img src="../doc/jack.png" width=70 align="right">
+
    $ git config --global user.name "Jacky Linker"
    $ git config --global user.email jacky.linker@example.com

-Example commit message from the [Pro Git][gitbook] online book, notice
-how `git commit -s` is used to automatically add a `Signed-off-by`:
+Example commit message from one of many [online guides][cbeams].  Use
+`git commit -s` to automatically add a `Signed-off-by` for proof of
+origin, see [DCO][] for more info.

    subsystem: brief, but clear and concise summary of changes
    
@@ -73,20 +132,58 @@ how `git commit -s` is used to automatically add a `Signed-off-by`:
     - Typically a hyphen or asterisk is used for the bullet, preceded
       by a single space, with blank lines in between, but conventions
       vary here
-    
+
+	If you use an issue tracker, put references to them at the bottom,
+	like this:
+
+	Resolves: #123
+	See also: #456, #789
+
    Signed-off-by: Jacky Linker <jacky.linker@example.com>

+This is an example of how to [automatically close][closing] an issue
+when the commit is merged to mainline.  Several keywords are available.

-Code of Conduct
---------------
+
+:twisted_rightwards_arrows: Pull Requests
+-----------------------------------------
+
+> _The git repository is the canonical location for information._
+
+A pull request should preferably address a single issue or change.  This
+may of course include multiple related changes, but what is important to
+remember is the bandwidth of the maintainers.  A smaller well documented
+PR is more likely to get attention quicker in some reviewer's busy day.
+
+Well documented here means that each commit message stands on its own,
+telling the complete story of the change.  In fact each commit should,
+as much as possible, be independent of other changes.  This is very
+important, not only when digging though logs to understand why a piece
+of code exists, but also when bisecting a problem -- each single commit
+should also compile and be possible to run.
+
+If you've worked on projects that send patches, like the Linux kernel or
+Buildroot, consider the pull request message body similar to the cover
+letter for a series of patches -- it's a summary of changes, and it is
+lost when the changes are merged to the mainline branch.
+
+
+:balance_scale: Code of Conduct
+-------------------------------

 It is expected of everyone to respect the [Code of Conduct][conduct].
 The *"maintainers have the right and responsibility to remove, edit, or
 reject comments, commits, code, discussion forum threads, issues, and
 other contributions that are not aligned to this Code of Conduct."*

-[Linux]:   https://www.kernel.org/doc/html/v6.9/process/coding-style.html
-[PEP-8]:   https://peps.python.org/pep-0008/
-[RDD]:     https://tom.preston-werner.com/2010/08/23/readme-driven-development
-[gitbook]: https://git-scm.com/book/ch5-2.html
-[conduct]: CODE-OF-CONDUCT.md
+[support]:  https://github.com/kernelkit/infix/blob/main/.github/SUPPORT.md
+[discuss]:  https://github.com/orgs/kernelkit/discussions
+[testing]:  https://github.com/kernelkit/infix/blob/main/doc/testing.md
+[devguide]: https://github.com/kernelkit/infix/blob/main/doc/developers-guide.md
+[Linux]:    https://www.kernel.org/doc/html/v6.9/process/coding-style.html
+[PEP-8]:    https://peps.python.org/pep-0008/
+[RDD]:      https://tom.preston-werner.com/2010/08/23/readme-driven-development
+[cbeams]:   https://cbea.ms/git-commit/#seven-rules
+[conduct]:  CODE-OF-CONDUCT.md
+[DCO]:      https://developercertificate.org/
+[closing]:  https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
@@ -1 +1,12 @@
-Paid support and development provided by Addiva Elektronik <https://addiva.se>
+Limited free support is only available using the online resources of the
+project on GitHub, and Discord, see <https://github.com/kernelkit>:
+
+&nbsp;&nbsp; :speech_balloon: <https://github.com/orgs/kernelkit/discussions>  
+&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>
+
+Support contracts, development of new features, fast-tracking of reviews
+and contributions, customer branding of Infix, and even customer specific
+features for dedicated products is provided by Addiva Elektronik.
+
+&nbsp;&nbsp; :globe_with_meridians: <https://www.addiva.se/electronics/>  
+&nbsp;&nbsp; :e-mail: <mailto:ael@addiva.se>
@@ -5,12 +5,6 @@
  -- Remember: assign a reviewer, or use @mentions if org. member.
  -->

-
-## Other information
-
-<!-- Other relevant info, e.g., before/after screenshots -->
-
-
 ## Checklist

 Tick *relevant* boxes, this PR is-a or has-a:
@@ -23,9 +17,12 @@ Tick *relevant* boxes, this PR is-a or has-a:
  - [ ] Regression tests added?
  - [ ] ChangeLog updates (for next release)
  - [ ] Documentation added?
+- [ ] Test changes
+  - [ ] Checked in changed Readme.adoc (make test-spec)
+  - [ ] Added new test to group Readme.adoc and yaml file
 - [ ] Code style update (formatting, renaming)
 - [ ] Refactoring (please detail in commit messages)
 - [ ] Build related changes
 - [ ] Documentation content changes
+  - [ ] ChangeLog updated (for major changes)
 - [ ] Other (please describe):
-
@@ -0,0 +1,16 @@
+name: Adds all issues to project Infix & C:o
+
+on:
+  issues:
+    types:
+      - opened
+
+jobs:
+  add-to-project:
+    name: Add issue to project Infix&co
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@v1.0.2
+        with:
+          project-url: https://github.com/orgs/kernelkit/projects/3
+          github-token: ${{ secrets.ADD_TO_PROJECT }}
@@ -2,10 +2,17 @@ name: Bob the Builder

 on:
  pull_request:
+    types: [opened, synchronize, reopened, labeled]
  push:
    branches:
      - main
  workflow_dispatch:
+    inputs:
+      minimal:
+        description: 'Build minimal defconfigs'
+        required: false
+        default: true
+        type: boolean

 jobs:
  build:
@@ -31,10 +38,26 @@ jobs:
      - name: Set Build Variables
        id: vars
        run: |
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+              if [ "${{ github.event.inputs.minimal }}" == "true" ]; then
+                  flavor="_minimal"
+              fi
+          else
+              # Ensure 'release' job get the proper image when building main
+              if [ "$GITHUB_REF_NAME" != "main" ]; then
+                  flavor="_minimal"
+              else
+                  flavor=""
+              fi
+              if ${{ contains(github.event.pull_request.labels.*.name, 'ci:main') }}; then
+                  flavor=""
+              fi
+          fi
          target=${{ matrix.target }}
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-
+          echo "flv=$flavor"              >> $GITHUB_OUTPUT
+          echo "Building target ${target}${flavor}_defconfig"
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
@@ -52,23 +75,38 @@ jobs:
            ccache-${{ matrix.target }}-
            ccache-

-      - name: Configure ${{ matrix.target }}
+      - name: Configure ${{ matrix.target }}${{ steps.vars.outputs.flv }}
        run: |
-          make ${{ matrix.target }}_defconfig
+          make ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig

      - name: Unit Test ${{ matrix.target }}
        run: |
          make test-unit

-      - name: Build ${{ matrix.target }}
+      - name: Build ${{ matrix.target }}${{ steps.vars.outputs.flv }}
        run: |
-          echo "Building ${{ matrix.target }}_defconfig ..."
+          echo "Building ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
          make

      - name:  Check SBOM from Build
        run: |
          make legal-info

+      - name: Build test specification
+        run: |
+          make test-spec
+
+      - name: Resulting size of build
+        run: |
+          printf "Size of complete tree : "
+          du -sh .
+          printf "Size of output/       : "
+          du -sh output
+          printf "Size of dl/           : "
+          du -sh dl
+          printf "Size of output/images/: "
+          ls -l output/images/
+
      - name: Prepare ${{ matrix.target }} Artifact
        run: |
          cd output/
@@ -91,16 +129,26 @@ jobs:
          clean: true
          submodules: recursive

-      - name: Configure x86_64
+      - name: Set Build Variables
+        id: vars
        run: |
-          make x86_64_defconfig
+          if [ "$GITHUB_REF_NAME" != "main" ]; then
+              flavor="_minimal"
+          else
+              flavor=""
+          fi
+          echo "flv=$flavor"              >> $GITHUB_OUTPUT
+
+      - name: Configure x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          make x86_64${{ steps.vars.outputs.flv }}_defconfig

      - uses: actions/download-artifact@v4
        with:
          pattern: "artifact-*"
          merge-multiple: true

-      - name: Restore x86-64 output/
+      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
        run: |
          ls -l
          mkdir -p output
@@ -109,11 +157,11 @@ jobs:
          tar xf infix-x86_64.tar.gz
          ln -s infix-x86_64 images

-      - name: Regression Test
+      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
        run: |
          make test

-      - name: Publish Test Result
+      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
        # Ensure this runs even if Regression Test fails
        if: always()
        run: cat test/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
@@ -152,7 +200,7 @@ jobs:
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
          # Latest Build Complete! :rocket:
-          
+
          For the public download links of these build artifacts, please see:
           <https://github.com/kernelkit/infix/releases/tag/latest>
          EOF
@@ -76,6 +76,10 @@ jobs:
        run: |
          make legal-info

+      - name: Build test specification
+        run: |
+          make test-spec
+
      - name: Prepare Artifacts
        run: |
          cd output/
@@ -83,8 +87,8 @@ jobs:
          ln -s ${{ steps.vars.outputs.dir }} images
          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

-          mv legal-info legal-info-$target
-          tar chfz legal-info-$target.tar.gz legal-info-$target
+          mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+          tar chfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}

      - uses: actions/upload-artifact@v4
        with:
@@ -146,6 +150,7 @@ jobs:
          name: Infix ${{ github.ref_name }}
          prerelease: ${{ steps.rel.outputs.pre }}
          makeLatest: ${{ steps.rel.outputs.latest }}
+          discussionCategory: Releases
          bodyFile:  release.md
          artifacts: "*.tar.gz*"

@@ -153,7 +158,7 @@ jobs:
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
          # Infix ${{ github.ref_name }} Released! :rocket:
-          
+
          For the public download links of this release, please see:
           <https://github.com/kernelkit/infix/releases/tag/${{ github.ref_name }}>
          EOF
@@ -1,28 +0,0 @@
-# To enable automatic sync of your Infix fork every day, or on dispatch,
-# set the repoistory or organisation variable (not secret):
-#
-#     SYNC_FORK = true
-#
-# You also need a GH_SYNC_REPO token allowed to update workflows.  For
-# more information on variables and secrets, see the GitHub docs.
-# See https://docs.github.com/en/actions/learn-github-actions/variables
-name: Synchronize your fork of Infix with upstream
-
-on:
-  schedule:
-    - cron: 42 2 * * *
-  workflow_dispatch:
-
-jobs:
-  sync_fork:
-    if: ${{github.repository_owner != 'kernelkit' && vars.SYNC_FORK == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: TobKed/github-forks-sync-action@master
-        with:
-          github_token: ${{ secrets.GH_SYNC_REPO }}
-          upstream_repository: KernelKit/infix
-          upstream_branch: main
-          target_branch: main
-          force: false
-          tags: true
@@ -52,6 +52,17 @@ config INFIX_IMAGE_ID
 	  Mandatory.  When INFIX_RELEASE is set, this string is appended to
 	  the IMAGE_ID with a '-' separator.

+config INFIX_COMPATIBLE
+	string "Operating system compatible string"
+	default "${INFIX_IMAGE_ID}"
+	help
+	  A lower-case string (no spaces or other characters outside of 0–9,
+	  a–z, ".", "_" and "-"), used for image identification at upgrade.
+	  E.g., the RAUC [system] compatible string.
+
+	  Mandatory.  Defaults to $INFIX_IMAGE_ID, which in turn is composed
+	  of $INFIX_ID-$BR2_ARCH.
+
 config INFIX_TAGLINE
 	string "Operating system tagline"
 	default "Infix -- a Network Operating System"
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Copyright (C) 2021 Marvell International Ltd.
+ * Copyright (C) 2024 Addiva Elektronik AB
+ *
+ * Device tree for revision A of DCP-SC-28P
+ */
+
+#include "dcp-sc-28p.dtsi"
+/ {
+	compatible = "styx,dcp-sc-28p-a",
+		"styx,dcp-sc-28p",
+		"marvell,armada-ap807-quad",
+		"marvell,armada-ap807";
+};
+
+&sw3 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		/* Can't use XSWP macro as port 0 does not have
+		 * any LEDs attached to it. LEDs for port 10 seem
+		 * to be wired to the corresponding SFP cage. Maybe
+		 * we can apply a static workaround by binding port
+		 * 10's green LED to "Special LED 1", so we can at
+		 * least see link/act.
+		 */
+		port@0 {
+			reg = <0>;
+			label = "e16";
+			nvmem-cells = <&base_mac 16>;
+			nvmem-cell-names = "mac-address";
+			phy-mode = "10gbase-r";
+			managed = "in-band-status";
+			sfp = <&sfp3>;
+		};
+		XSWCPU(9, &cp0_eth0);
+		sw3p10: XSWLINK(a, &sw2p10 &sw1p0);
+	};
+
+};
+
+&sw2 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		sw2p0:  XSWLINK(0, &sw1p0);
+		XSWP(9, "e15", 15, &sfp2);
+		sw2p10: XSWLINK(a, &sw3p10);
+	};
+};
+
+&sw1 {
+	ports {
+		sw1p0: XSWLINK(0, &sw2p0 &sw3p10);
+		XSWP(9, "e14", 14, &sfp1);
+		XSWP(a, "e13", 13, &sfp0);
+	};
+};
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Copyright (C) 2021 Marvell International Ltd.
+ * Copyright (C) 2024 Addiva Elektronik AB
+ *
+ * Device tree for revision B of DCP-SC-28P
+ */
+
+#include "dcp-sc-28p.dtsi"
+/ {
+	compatible = "styx,dcp-sc-28p-b",
+		"styx,dcp-sc-28p",
+		"marvell,armada-ap807-quad",
+		"marvell,armada-ap807";
+};
+
+&sw3 {
+	ports {
+		XSWCPU(0, &cp0_eth0);
+		sw3p9: XSWLINK(9, &sw2p0 &sw1p0);
+		XSWP(a, "e16", 16, &sfp3);
+	};
+};
+
+&sw2 {
+	ports {
+		sw2p0:  XSWLINK(0, &sw3p9);
+		XSWP(9, "e15", 15, &sfp2);
+		sw2p10: XSWLINK(a, &sw1p0);
+	};
+};
+
+&sw1 {
+	ports {
+		sw1p0: XSWLINK(0, &sw2p10 &sw3p9);
+		XSWP(9, "e14", 14, &sfp1);
+		XSWP(a, "e13", 13, &sfp0);
+	};
+};
@@ -1,5 +1,5 @@
-#ifndef _STYX_MPP_H
-#define _STYX_MPP_H
+#ifndef _DCP_SC_28P_MPP_H
+#define _DCP_SC_28P_MPP_H

 #define SFP0_TX_DISABLE(X) X( "mpp0", cp0_gpio1,  0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)
 #define SFP1_TX_DISABLE(X) X( "mpp1", cp0_gpio1,  1, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)
@@ -73,4 +73,4 @@
 #define MPP_GPIO_REF_NO_CHIP(_mpp, _chip, _no, _flags) <_no (_flags)>
 #define MPP_IRQ_REF(_mpp, _chip, _no, _flags) <&_chip _no (_flags)>

-#endif	/* _STYX_MPP_H */
+#endif	/* _DCP_SC_28P_MPP_H */
@@ -3,7 +3,7 @@
 * Copyright (C) 2021 Marvell International Ltd.
 * Copyright (C) 2023 Addiva Elektronik AB
 *
- * Device tree for Styx board
+ * Device tree base for DCP-SC-28P
 */

 #include <dt-bindings/input/input.h>
@@ -12,13 +12,10 @@

 #include "../marvell/cn9130-patched.dtsi"

-#include "styx-mpp.h"
+#include "dcp-sc-28p-mpp.h"

 / {
-	model = "Styx";
-	compatible = "styx,styx",
-		"marvell,armada-ap807-quad",
-		"marvell,armada-ap807";
+	model = "DCP-SC-28P";

 	chosen {
 		stdout-path = "serial0:115200n8";
@@ -36,6 +33,14 @@
 	};
 };

+/*
+ * RTC has no valid bit, and this board does not connect any
+ * backup power (e.g. supercap) to it, so it returns garbage
+ * after every cold reset.
+ */
+&cp0_rtc {
+	status = "disabled";
+};

 /* UART0 (Console) */

@@ -271,12 +276,6 @@
 			color = <LED_COLOR_ID_GREEN>; \
 			default-state = "keep"; \
 		}; \
-		led@1 { \
-			reg = <1>; \
-			function = _func; \
-			color = <LED_COLOR_ID_YELLOW>; \
-			default-state = "off"; \
-		}; \
 	}

 #define XSWP(_n, _label, _mac_offs, _sfp) \
@@ -287,10 +286,33 @@
 		nvmem-cell-names = "mac-address"; \
 		phy-mode = "10gbase-r"; \
 		managed = "in-band-status"; \
-		sfp = <&_sfp>; \
+		sfp = <_sfp>; \
 		SWP_LED("sfp"); \
 	}

+#define XSWCPU(_n, _eth) \
+	port@_n { \
+		reg = <0x ## _n>; \
+		label = "cpu"; \
+		ethernet = <_eth>; \
+		phy-mode = "10gbase-r"; \
+		fixed-link { \
+			speed = <10000>; \
+			full-duplex; \
+		}; \
+	}
+
+#define XSWLINK(_n, _link) \
+	port@_n { \
+		reg = <0x ## _n>; \
+		link = <_link>; \
+		phy-mode = "10gbase-r"; \
+		fixed-link { \
+			speed = <10000>; \
+			full-duplex; \
+		}; \
+	}
+
 #define GSWP(_n, _label, _mac_offs, _phy) \
 	port@_n { \
 		reg = <0x ## _n>; \
@@ -298,7 +320,7 @@
 		nvmem-cells = <&base_mac _mac_offs>; \
 		nvmem-cell-names = "mac-address"; \
 		phy-mode = "gmii"; \
-		phy-handle = <&_phy>; \
+		phy-handle = <_phy>; \
 		SWP_LED("tp"); \
 	}

@@ -332,52 +354,14 @@
 			#address-cells = <1>;
 			#size-cells = <0>;

-			port@9 {
-				reg = <0x9>;
-				label = "cpu";
-				ethernet = <&cp0_eth0>;
-				phy-mode = "10gbase-r";
-				fixed-link {
-					speed = <10000>;
-					full-duplex;
-				};
-			};
-
-			sw3p10: port@a {
-				reg = <0xa>;
-				link = <&sw2p10 &sw1p0>;
-				phy-mode = "10gbase-r";
-				fixed-link {
-					speed = <10000>;
-					full-duplex;
-				};
-			};
-
-			/* Can't use XSWP macro as port 0 does not have
-			 * any LEDs attached to it. LEDs for port 10 seem
-			 * to be wired to the corresponding SFP cage. Maybe
-			 * we can apply a static workaround by binding port
-			 * 10's green LED to "Special LED 1", so we can at
-			 * least see link/act.
-			 */
-			port@0 {
-				reg = <0>;
-				label = "e16";
-				nvmem-cells = <&base_mac 16>;
-				nvmem-cell-names = "mac-address";
-				phy-mode = "10gbase-r";
-				managed = "in-band-status";
-				sfp = <&sfp3>;
-			};
-
-			GSWP(1,  "e22", 22, sw3phy1);
-			GSWP(2,  "e21", 21, sw3phy2);
-			GSWP(3,  "e24", 24, sw3phy3);
-			GSWP(4,  "e23", 23, sw3phy4);
-			GSWP(5,  "e26", 26, sw3phy5);
-			GSWP(6,  "e25", 25, sw3phy6);
-			GSWP(7,  "e28", 28, sw3phy7);
-			GSWP(8,  "e27", 27, sw3phy8);
+			GSWP(1,  "e22", 22, &sw3phy1);
+			GSWP(2,  "e21", 21, &sw3phy2);
+			GSWP(3,  "e24", 24, &sw3phy3);
+			GSWP(4,  "e23", 23, &sw3phy4);
+			GSWP(5,  "e26", 26, &sw3phy5);
+			GSWP(6,  "e25", 25, &sw3phy6);
+			GSWP(7,  "e28", 28, &sw3phy7);
+			GSWP(8,  "e27", 27, &sw3phy8);
 		};

 		mdio {
@@ -412,36 +396,14 @@
 			#address-cells = <1>;
 			#size-cells = <0>;

-			sw2p0: port@0 {
-				reg = <0x0>;
-				link = <&sw1p0>;
-				phy-mode = "10gbase-r";
-				fixed-link {
-					speed = <10000>;
-					full-duplex;
-				};
-			};
-
-			sw2p10: port@a {
-				reg = <0xa>;
-				link = <&sw3p10>;
-				phy-mode = "10gbase-r";
-				fixed-link {
-					speed = <10000>;
-					full-duplex;
-				};
-			};
-
-
-			GSWP(1, "e10", 10, sw2phy1);
-			GSWP(2,  "e9",  9, sw2phy2);
-			GSWP(3, "e12", 12, sw2phy3);
-			GSWP(4, "e11", 11, sw2phy4);
-			GSWP(5, "e18", 18, sw2phy5);
-			GSWP(6, "e17", 17, sw2phy6);
-			GSWP(7, "e20", 20, sw2phy7);
-			GSWP(8, "e19", 19, sw2phy8);
-			XSWP(9, "e15", 15, sfp2);
+			GSWP(1, "e10", 10, &sw2phy1);
+			GSWP(2,  "e9",  9, &sw2phy2);
+			GSWP(3, "e12", 12, &sw2phy3);
+			GSWP(4, "e11", 11, &sw2phy4);
+			GSWP(5, "e18", 18, &sw2phy5);
+			GSWP(6, "e17", 17, &sw2phy6);
+			GSWP(7, "e20", 20, &sw2phy7);
+			GSWP(8, "e19", 19, &sw2phy8);
 		};

 		mdio {
@@ -476,26 +438,14 @@
 			#address-cells = <1>;
 			#size-cells = <0>;

-			sw1p0: port@0 {
-				reg = <0x0>;
-				link = <&sw2p0 &sw3p10>;
-				phy-mode = "10gbase-r";
-				fixed-link {
-					speed = <10000>;
-					full-duplex;
-				};
-			};
-
-			GSWP(1,  "e2",  2, sw1phy1);
-			GSWP(2,  "e1",  1, sw1phy2);
-			GSWP(3,  "e4",  4, sw1phy3);
-			GSWP(4,  "e3",  3, sw1phy4);
-			GSWP(5,  "e6",  6, sw1phy5);
-			GSWP(6,  "e5",  5, sw1phy6);
-			GSWP(7,  "e8",  8, sw1phy7);
-			GSWP(8,  "e7",  7, sw1phy8);
-			XSWP(9, "e14", 14, sfp1);
-			XSWP(a, "e13", 13, sfp0);
+			GSWP(1,  "e2",  2, &sw1phy1);
+			GSWP(2,  "e1",  1, &sw1phy2);
+			GSWP(3,  "e4",  4, &sw1phy3);
+			GSWP(4,  "e3",  3, &sw1phy4);
+			GSWP(5,  "e6",  6, &sw1phy5);
+			GSWP(6,  "e5",  5, &sw1phy6);
+			GSWP(7,  "e8",  8, &sw1phy7);
+			GSWP(8,  "e7",  7, &sw1phy8);
 		};

 		mdio {
@@ -1,9 +0,0 @@
-// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
-/*
- * Copyright (C) 2021 Marvell International Ltd.
- * Copyright (C) 2023 Addiva Elektronik AB
- *
- * Device tree for Styx board
- */
-
-#include "styx.dtsi"
@@ -539,6 +539,8 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_TIMEOUT=20
 CONFIG_DETECT_HUNG_TASK=y
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set
@@ -128,7 +128,7 @@ what provides a default, the same default MAC addresses to Linux:

 This is important in case you want to run multiple R2S devices on the
 same LAN.  Meaning you either have to change the MAC address in the
-U-Boot environment (below), or modify your `phys-address` setting in
+U-Boot environment (below), or use the `custom-phys-address` setting in
 Infix for the interface(s).

 Break into U-Boot using Ctrl-C at power-on, preferably when the text
@@ -58,6 +58,7 @@
    }
  },
  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
    "groups": {
      "group": [
        {
@@ -83,6 +84,21 @@
            "comment": "Allow 'admin' group complete access to all operations and data."
          }
        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name":  "deny-password-read",
+            "module-name": "ietf-system",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny"
+          }
+        ]
      }
    ]
  },
@@ -123,7 +139,8 @@
          "name": "ntp.org",
          "udp": {
            "address": "pool.ntp.org"
-          }
+          },
+	  "iburst": true
        }
      ]
    },
@@ -169,7 +186,7 @@
    ]
  },
  "infix-meta:meta": {
-    "infix-meta:version": "1.0"
+    "infix-meta:version": "1.2"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -0,0 +1 @@
+dcp-sc-28p-b.dtb
@@ -0,0 +1 @@
+dcp-sc-28p-a.dtb
@@ -0,0 +1,2 @@
+# empty to disable port LED control on Styx, for details, see issue
+# https://github.com/kernelkit/infix/issues/670#issuecomment-2419025575
@@ -107,18 +107,6 @@ config DISK_IMAGE_BOOT_OFFSET
 	  to make sure that the GPT still fits at the start of the
 	  image.

-config DISK_IMAGE_TEST_MODE
-	bool "Enable Test Mode"
-	depends on DISK_IMAGE
-	default y
-	help
-	  Enable the test mode option by default. This setting creates a test-mode flag
-	  in the auxiliary partition of the disk image, initiating the system with the test-config
-	  instead of regular startup-config. The primary purpose of running an image in this mode
-	  is to ensure proper execution of all Infix tests. Additionally, it enables extra RPCs
-	  related to system restart and configuration overrides, allowing tests to be run even on
-	  systems where the factory configuration may potentially create L2 loops. 
-
 config DISK_IMAGE_RELEASE_URL
 	string "Infix URL"
 	depends on DISK_IMAGE
@@ -0,0 +1,130 @@
+Welcome to Infix!
+=================
+
+Nice to meet ❤️ you!  If you are reading this then you have possibly
+just downloaded and unpacked a release build and are curious about how
+to proceed from here.
+
+To test Infix You need a Linux 🐧 system with Qemu or GNS3 installed.
+We recommend Debian based systems, like Ubuntu and Linux Mint.
+
+> For a pain-free experience we recommend enabling CPU virtualization in
+> your BIOS/UEFI, which for many computers is disabled by default.
+
+From this point we assume you have your x86_64/AMD64 based Linux system
+up and running.  Time to start your favorite terminal application! 😃
+
+
+Installing Qemu
+---------------
+
+This README focus on getting you started with Qemu.  From a terminal,
+install (at least) the x86/x86_64 emulator.  The 'virt-manager' is a
+package that helps pull in other dependencies you may need:
+
+    $ sudo apt install qemu-system-x86 virt-manager
+
+That's it.
+
+
+Running Infix in Qemu
+---------------------
+
+Depending on how your Linux installation is set up, the following may
+require being run with superuser privileges, i.e., you may need to
+repend the command with 'sudo'.
+
+    $ ./qemu.sh
+
+You should now see the Infix init system booting up.  When the final
+"Please press Enter to activate this console." is shown, press Enter
+and the login: prompt is displayed.
+
+The default credentials for the demo builds is
+
+    login: admin
+    password: admin
+
+    Infix -- a Network Operating System v24.09.0-rc1 (hvc0)
+    infix-00-00-00 login: admin
+    Password: 
+    .-------.
+    |  . .  | Infix -- a Network Operating System
+    |-. v .-| https://kernelkit.org
+    '-'---'-'
+
+    Run the command 'cli' for interactive OAM
+
+    admin@infix-00-00-00:~$
+
+You're in!  Play around in your sandbox as much as you like, if you
+run into problems or have questions, please see the documentation,
+and don't hesitate to get in touch with us! 😃
+
+ - https://github.com/kernelkit/infix/tree/main/doc
+
+
+Customizing your "Hardware"
+---------------------------
+
+For more Ethernet ports in your emulated system you need to change the
+Qemu configuration used for Infix.  This can be done using a menuconfig
+interface, which requires the following extra package:
+
+    $ sudo apt install kconfig-frontends
+
+We can now enter the configuration:
+
+    $ ./qemu.sh -c
+
+Go down to *Networking*, select *TAP*, now you can change the *Number of
+TAPs*, e.g. to 10.  Exit and save the configuration, then you can start
+Qemu again:
+
+   ./qemu.sh
+
+> Make sure to do a factory reset from the CLI, otherwise you will be
+> stuck with that single interface from before.
+
+
+Errors on Console
+-----------------
+
+If you see the following line printed one or more times, don't panic.
+
+    LABEL=var: Can't lookup blockdev
+
+See the Customizing section above.  To silence the error you need to
+create another writable partition for Infix to store logs, container
+images, etc.  Look for the 'var' keyword, you can adjust the size of
+the partition.
+
+
+Graphical Network Simulator 3 (GNS3)
+------------------------------------
+
+GNS3 is a very powerful front-end to Qemu which takes care of creating
+virtual links between network devices running in Qemu.  This README is
+only link to the material you need.  This directory holds the appliance
+file, .gns3a, that references image files also in this directory, that
+you need to load into GNS3.
+
+The necessary extra packages are available through the offical PPA.  If
+you don't know what a PPA is, read up on that first:
+
+ - https://launchpad.net/~gns3/+archive/ubuntu/ppa
+
+There's a lot of tutorials and guides online, start here:
+
+ - https://docs.gns3.com/docs/
+
+
+About
+-----
+
+Infix is a free, Linux based, immutable Network Operating System (NOS)
+built on Buildroot, and sysrepo.  A powerful mix that ease porting to
+different platforms, simplify long-term maintenance, and provide easy
+management using NETCONF, RESTCONF, or the built-in command line
+interface (CLI) from a console or SSH login.
+
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.36.0
-# Thu Feb  8 08:22:32 2024
+# Busybox version: 1.36.1
+# Tue Oct 22 13:12:02 2024
 #
 CONFIG_HAVE_DOT_CONFIG=y

@@ -957,10 +957,10 @@ CONFIG_FEATURE_NETSTAT_PRG=y
 CONFIG_NSLOOKUP=y
 CONFIG_FEATURE_NSLOOKUP_BIG=y
 CONFIG_FEATURE_NSLOOKUP_LONG_OPTIONS=y
-CONFIG_NTPD=y
-CONFIG_FEATURE_NTPD_SERVER=y
-CONFIG_FEATURE_NTPD_CONF=y
-CONFIG_FEATURE_NTP_AUTH=y
+# CONFIG_NTPD is not set
+# CONFIG_FEATURE_NTPD_SERVER is not set
+# CONFIG_FEATURE_NTPD_CONF is not set
+# CONFIG_FEATURE_NTP_AUTH is not set
 CONFIG_PING=y
 CONFIG_PING6=y
 CONFIG_FEATURE_FANCY_PING=y
@@ -16,13 +16,22 @@ die()
 #      DISK_IMAGE_SIZE="512"
 #      etc.
 #
+# Nested variables, like INFIX_COMPATIBLE="${INFIX_IMAGE_ID}"
+# are handled by sourcing the file in a subshell.
+#
 # shellcheck disable=SC1090
 load_cfg()
 {
    tmp=$(mktemp -p /tmp)
+    (
+	. "$BR2_CONFIG" 2>/dev/null
+
+	# Set *all* matching variables
+	set | grep -E "^${1}[^=]*=" | while IFS= read -r line; do
+            echo "$line"
+	done
+    ) > "$tmp"

-    grep -E "${1}.*=" "$BR2_CONFIG" >"$tmp"
    .  "$tmp"
-
    rm "$tmp"
 }
@@ -128,7 +128,7 @@ diskimg=disk.img
 bootimg=
 bootpart=

-while getopts "a:b:B:n:s:t" opt; do
+while getopts "a:b:B:n:s:" opt; do
    case ${opt} in
 	a)
 	    arch=$OPTARG
@@ -145,9 +145,6 @@ while getopts "a:b:B:n:s:t" opt; do
 	s)
 	    total=$(size2int $OPTARG)
 	    ;;
-	t)
-		testmode=true
-		;;
    esac
 done
 shift $((OPTIND - 1))
@@ -193,12 +190,6 @@ cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
 cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
 cp -f $BINARIES_DIR/rauc.status $root/aux/rauc.status

-if [ "$testmode" = true ]; then
-    touch "$root/aux/test-mode"
-else 
-    rm -f "$root/aux/test-mode"
-fi
-
 case "$arch" in
    aarch64)
 	mkenvimage -s 0x4000 -o "$root/aux/uboot.env" \
@@ -62,7 +62,7 @@ else
 fi

 if [ -f "$TARGET_DIR/etc/rauc/system.conf" ]; then
-    sed -i "s/compatible=.*/compatible=$NAME/" "$TARGET_DIR/etc/rauc/system.conf"
+    sed -i "s/compatible=.*/compatible=$INFIX_COMPATIBLE/" "$TARGET_DIR/etc/rauc/system.conf"
 fi

 # This is a symlink to /usr/lib/os-release, so we remove this to keep
@@ -104,6 +104,10 @@ rm -f "$TARGET_DIR/etc/os-release"

 echo "$INFIX_TAGLINE $VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"

+# In case of ambguities, this is what the image was built from
+cp "$BR2_CONFIG" "$TARGET_DIR/usr/share/infix/config"
+gzip -f "$TARGET_DIR/usr/share/infix/config"
+
 # Drop Buildroot default symlink to /tmp
 if [ -L "$TARGET_DIR/var/lib/avahi-autoipd" ]; then
 	rm    "$TARGET_DIR/var/lib/avahi-autoipd"
@@ -7,11 +7,14 @@ common=$(dirname "$(readlink -f "$0")")
 # shellcheck disable=SC1091
 . "$TARGET_DIR/etc/os-release"

-load_cfg INFIX_ID
+# The INFIX_* variables may be composed from BR2_* variables,
+# so we source them last.
 load_cfg BR2_ARCH
 load_cfg BR2_DEFCONFIG
 load_cfg BR2_EXTERNAL_INFIX_PATH
 load_cfg BR2_TARGET_ROOTFS
+load_cfg INFIX_ID
+load_cfg INFIX_COMPATIBLE

 # The default IMAGE_ID is infix-$BR2_ARCH but can be overridden
 # for imaage names, and compat strings, like infix-r2s
@@ -39,7 +42,7 @@ if [ "$SIGN_ENABLED" = "y" ]; then
    $common/sign.sh $BR2_ARCH $SIGN_KEY

    ixmsg "Creating RAUC Update Bundle"
-    $common/mkrauc.sh "$NAME$(ver)" $NAME $SIGN_KEY
+    $common/mkrauc.sh "$NAME$(ver)" $INFIX_COMPATIBLE $SIGN_KEY
 fi

 load_cfg DISK_IMAGE
@@ -59,13 +62,8 @@ if [ "$DISK_IMAGE" = "y" ]; then
 	tar -xa --strip-components=1 -C "$BINARIES_DIR" -f "$archive"
    fi

-    testmode_flag=""
-    if [ "$DISK_IMAGE_TEST_MODE" = "y" ]; then 
-	testmode_flag="-t"
-    fi
-
    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
-    $common/mkdisk.sh -a $BR2_ARCH -n $diskimg $testmode_flag -s $DISK_IMAGE_SIZE $bootcfg
+    $common/mkdisk.sh -a $BR2_ARCH -n $diskimg -s $DISK_IMAGE_SIZE $bootcfg
 fi

 load_cfg SDCARD_AUX
@@ -107,3 +105,6 @@ rm -f "$BINARIES_DIR/qemu.cfg"
 CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
       "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
 rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
+
+# Quick intro for beginners, with links to more information
+cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"
@@ -106,6 +106,8 @@ config QEMU_DTB_EXTEND
 	depends on QEMU_LOADER_UBOOT
 	default y if QEMU_aarch64

+if QEMU_ROOTFS_INITRD
+
 config QEMU_RW
 	string "Writable /cfg layer"
 	depends on QEMU_ROOTFS_INITRD
@@ -123,6 +125,8 @@ config QEMU_RW_VAR
 	default "var.ext4"
 endif

+endif
+
 config QEMU_VPD
 	bool "Emulate a Vital Product Data (VPD) Memory"

@@ -137,6 +141,51 @@ config QEMU_APPEND
 config QEMU_EXTRA
 	string "Extra QEMU options"

+
+comment "RTC"
+
+choice
+	prompt "Mode"
+	default QEMU_RTC_UTC
+
+config QEMU_RTC_UTC
+	bool "UTC"
+
+config QEMU_RTC_LOCAL
+	bool "Local time"
+
+config QEMU_RTC_RANDOM
+	bool "Random"
+
+endchoice
+
+choice
+	prompt "Clock"
+	default QEMU_CLOCK_HOST
+
+config QEMU_CLOCK_HOST
+	bool "Host clock"
+
+config QEMU_CLOCK_RT
+	bool "Independent (monotonic)"
+
+config QEMU_CLOCK_VM
+	bool "Virtual"
+
+endchoice
+
+config QEMU_RTC
+	string
+	default "utc"       if QEMU_RTC_UTC
+	default "localtime" if QEMU_RTC_LOCAL
+	default "random"    if QEMU_RTC_RANDOM
+
+config QEMU_CLOCK
+	string
+	default "host"      if QEMU_CLOCK_HOST
+	default "rt"        if QEMU_CLOCK_RT
+	default "vm"        if QEMU_CLOCK_VM
+
 comment "Networking"

 choice
@@ -261,7 +261,25 @@ EOF

 wdt_args()
 {
-    echo -n "-device i6300esb -rtc clock=host"
+    echo -n "-device i6300esb "
+}
+
+random_date()
+{
+    rand=$(($(date +%_s) * $$ + $(date +%N | sed 's/^0*//')))
+    when=$((rand % 7258118400)) # 1970 - 2200
+    date -d "@$when" +"%Y-%m-%dT%H:%M:%S"
+}
+
+rtc_args()
+{
+    rtc="${CONFIG_QEMU_RTC:-utc}"
+    clock="${CONFIG_QEMU_CLOCK:-host}"
+    if [ "$rtc" = "random" ]; then
+	rtc=$(random_date)
+    fi
+
+    echo -n "-rtc base=$rtc,clock=$clock"
 }

 gdb_args()
@@ -273,11 +291,19 @@ gdb_args()
 run_qemu()
 {
    if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	 qemu-img create -f qcow2 -o backing_file=$CONFIG_QEMU_ROOTFS -F raw $CONFIG_QEMU_ROOTFS.qcow2 > /dev/null
+	if ! qemu-img check "${CONFIG_QEMU_ROOTFS}.qcow2"; then
+	    rm -f "${CONFIG_QEMU_ROOTFS}.qcow2"
+	fi
+	if [ ! -f "${CONFIG_QEMU_ROOTFS}.qcow2" ]; then
+	    echo "Creating qcow2 disk image for Qemu ..."
+	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
+		     -F raw "${CONFIG_QEMU_ROOTFS}.qcow2" > /dev/null
+	fi
    fi
+
    local qemu
    read qemu <<EOF
-	$CONFIG_QEMU_MACHINE -m $CONFIG_QEMU_MACHINE_RAM \
+	$CONFIG_QEMU_MACHINE -nodefaults -m $CONFIG_QEMU_MACHINE_RAM \
 	  $(loader_args) \
 	  $(rootfs_args) \
 	  $(serial_args) \
@@ -286,16 +312,23 @@ run_qemu()
 	  $(host_args) \
 	  $(net_args) \
 	  $(wdt_args) \
+	  $(rtc_args) \
 	  $(vpd_args) \
 	  $(gdb_args) \
 	  $CONFIG_QEMU_EXTRA
 EOF

+    echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
+    line=$(stty -g)
+    stty raw
+
    if [ "$CONFIG_QEMU_KERNEL" ]; then
 	$qemu -append "$(append_args)" "$@"
    else
 	$qemu "$@"
    fi
+
+    stty "$line"
 }

 dtb_args()
@@ -401,8 +434,4 @@ fi

 generate_dot

-echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
-line=$(stty -g)
-stty raw
 run_qemu $(dtb_args)
-stty "$line"
@@ -1,24 +1,4 @@
 #!/bin/sh
-
-# This file is part of avahi.
-#
-# avahi is free software; you can redistribute it and/or modify it
-# under the terms of the GNU Lesser General Public License as
-# published by the Free Software Foundation; either version 2 of the
-# License, or (at your option) any later version.
-#
-# avahi is distributed in the hope that it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
-# License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public
-# License along with avahi; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
-# USA.
-
-set -e
-
 # Command line arguments:
 #   $1 event that happened:
 #          BIND:     Successfully claimed address
@@ -29,60 +9,54 @@ set -e
 #   $3 IP adddress

 PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
+NAME="/etc/frr/static.d/$2-zeroconf.conf"
+NEXT="${NAME}+"

-# Use a different metric for each interface, so that we can set
-# identical routes to multiple interfaces.
+log()
+{
+    logger -I $$ -t zeroconf -p user.notice "$*"
+}

-METRIC=$((1000 + `cat "/sys/class/net/$2/ifindex" 2>/dev/null || echo 0`))
-
-if [ -x /bin/ip -o -x /sbin/ip ] ; then
-
-    # We have the Linux ip tool from the iproute package
-
-    case "$1" in
-        BIND)
-            ip addr flush dev "$2" label "$2:avahi"
-            ip addr add "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2" proto 6
-            ip route add default dev "$2" metric "$METRIC" scope link proto zeroconf ||:
-            ;;
-
-        CONFLICT|UNBIND|STOP)
-            ip route del default dev "$2" metric "$METRIC" scope link ||:
-            ip addr del "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2"
-            ;;
-
-        *)
-            echo "Unknown event $1" >&2
-            exit 1
-            ;;
+# Reduce changes needed by comparing with previous route(s)
+act()
+{
+    case $1 in
+	add)
+	    echo "! Generated by avahi-autoipd"  > "$NEXT"
+	    echo "ip route 0.0.0.0/0 $2 254"    >> "$NEXT"
+	    cmp -s "$NAME" "$NEXT" && return
+	    mv "$NEXT" "$NAME"
+	    ;;
+	del)
+	    [ -f "$NAME" ] || return
+	    rm "$NAME"
+	    ;;
+	*)
+	    return
+	    ;;
    esac

-elif [ -x /bin/ifconfig -o -x /sbin/ifconfig ] ; then
+    initctl -nbq restart staticd
+}

-    # We have the old ifconfig tool
+case "$1" in
+    BIND)
+        ip addr flush dev "$2" proto random
+        ip addr add "$3"/16 brd 169.254.255.255 scope link dev "$2" proto random
+	act add "$2"
+	log "set ipv4ll $3 on iface $2"
+        ;;

-    case "$1" in
-        BIND)
-            ifconfig "$2:avahi" inet "$3" netmask 255.255.0.0 broadcast 169.254.255.255 up
-            route add default dev "$2:avahi" metric "$METRIC" ||:
-            ;;
+    CONFLICT|UNBIND|STOP)
+	act del "$2"
+        ip addr flush dev "$2" proto random
+	log "clr ipv4ll on iface $2"
+        ;;

-        CONFLICT|STOP|UNBIND)
-            route del default dev "$2:avahi" metric "$METRIC" ||:
-            ifconfig "$2:avahi" down
-            ;;
-
-        *)
-            echo "Unknown event $1" >&2
-            exit 1
-            ;;
-    esac
-
-else
-
-    echo "No network configuration tool found." >&2
-    exit 1
-
-fi
+    *)
+        log "Unknown event $1 on iface $2"
+        exit 1
+        ;;
+esac

 exit 0
@@ -0,0 +1 @@
+CONFD_TIMEOUT=60
@@ -1,3 +1,3 @@
-service name:rousette notify:none log <pid/confd> \
-	[12345] rousette --syslog -t 60 \
+service name:rousette notify:none log <pid/confd> env:/etc/default/confd \
+	[12345] rousette --syslog -t $CONFD_TIMEOUT \
 	-- RESTCONF server
@@ -0,0 +1,9 @@
+! Default settings for staticd, used for both
+! confd generated routes, udhcpc and zeroconf
+frr defaults traditional
+hostname Router
+password zebra
+enable password zebra
+no log unique-id
+log syslog informational
+log facility local2
@@ -1 +1,6 @@
+# Micro GNU Emacs default configuration file
+auto-indent-mode
+auto-fill-mode
 make-backup-files 0
+require-final-newline T
+set-fill-column 72
@@ -1 +1,4 @@
+# Allow client to pass locale environment
+AcceptEnv LANG LC_*
+
 Include /etc/ssh/sshd_config.d/*.conf
@@ -1 +0,0 @@
-Subsystem cli /usr/bin/klish
@@ -0,0 +1 @@
+Subsystem	sftp	/usr/libexec/sftp-server
@@ -2,4 +2,4 @@
 # Silly wrapper around sudo to prevent it from printing an error for
 # unprivileged users: sudo: a password is required

-id -nG $LOGNAME | grep -qw wheel && sudo -n $@
+id -nG "$LOGNAME" | grep -qw wheel && sudo -n "$@"
@@ -0,0 +1,366 @@
+#!/bin/sh
+# Displays basic information about the system
+# shellcheck disable=SC2048,SC2086
+. /etc/os-release
+
+bopt="-c"
+opt="-br"
+all=""
+plain=""
+
+h1()
+{
+    STR="$*"
+    if [ -n "$plain" ]; then
+	echo "$STR" | tr '[:lower:]' '[:upper:]'
+    else
+	printf "\033[7m%-${COLUMNS}s\033[0m\n" "$STR"
+    fi
+}
+
+h2()
+{
+    STR="$*"
+    if [ -n "$plain" ]; then
+	echo "$STR"
+	echo "$STR" | sed 's/./-/g'
+    else
+	printf "\033[1m%-${COLUMNS}s\033[0m\n" "$STR"
+    fi
+}
+
+dm()
+{
+    if [ -n "$plain" ]; then
+	echo "${*}"
+    else
+	printf "\033[2m%s\033[0m\n" "$*"
+    fi
+}
+
+ul()
+{
+    if [ -n "$plain" ]; then
+	printf "__%s__" "$*"
+    else
+	printf "\033[4%s\033[0m" "$*"
+    fi
+}
+
+em()
+{
+    if [ -n "$plain" ]; then
+	printf "**%s**" "$*"
+    else
+	printf "\033[5m%s\033[0m" "$*"
+    fi
+}
+
+usage()
+{
+    cat <<EOF
+usage:
+  show [opt] cmd
+
+options:
+  -a            Show all, of something
+  -f            Show full output, not brief port/iface listings
+  -h            Show this help text
+  -n            Show output without any footer
+  -p            Show plain output, no bells or whistles
+
+commands:
+  port PORT     Show port configuration and link information
+  ports         Show ports available for bridging
+  vlans         Show port groups in bridge
+  ifaces        Show interfaces and their addresses
+  fdb           Show forwarding database (unicast)
+  mdb           Show multicast forwarding database
+  ip   addr     Show IPv4 addresses
+       route    Show routing table
+  ipv6 addr     Show IPv6 addresses
+       route    Show routing table
+  log [FILE]    Show latest entries from syslog, or other FILE
+  rmon PORT     Show RMON counters for PORT (when applicable)
+  system        Show OS details
+  version       Show OS verson
+EOF
+}
+
+# Usage 1: show port eth0
+# Usage 2: show port
+# Usage 3: show ports
+#
+# The first show ethtool output for 'eth0' (in this case).  The latter
+# two are the same, showing a summary of all interfaces classified as
+# access ports.
+ports()
+{
+    if [ $# -gt 0 ] && [ -e "/sys/class/net/$1" ]; then
+	for port in $*; do
+	    ethtool "$port"
+	done
+	return
+    fi
+
+    h1 "PORT             STATE          MAC ADDRESS        FLAGS"
+    if grep -q port /etc/iproute2/group; then
+	ip $opt link show group port
+    else
+	ip $opt link show
+    fi
+
+    if [ -z "$plain" ] && [ -z "$nofoot" ]; then
+	dm "______________________________________________________________________________"
+	dm "Use: '[ip|bridge] --help' and '[ip|bridge] link help' for more details."
+    fi
+}
+
+vlans()
+{
+    h1 "INTERFACE         VLAN  FLAGS"
+    bridge $bopt vlan show |tail +2 | awk 'NF { iface=$1; vid=$2; printf("%-16s  %4d  ", iface, vid); for (i=3; i <= NF; i++) printf("%s ", $i); printf("\n"); }'
+    if [ -z "$plain" ] && [ -z "$nofoot" ]; then
+	dm "______________________________________________________________________________"
+	dm "See: 'bridge --help' and 'bridge vlan help' for more details."
+    fi
+}
+
+ifaces()
+{
+    if [ -n "$all" ]; then
+	if [ $# -gt 0 ]; then
+	    for iface in $*; do
+		ip $opt addr show dev "$iface"
+	    done
+	    return
+	fi
+
+	h1 "INTERFACE        STATE          ADDRESS"
+	ip $opt addr show
+	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
+	    dm "______________________________________________________________________________"
+	    dm "See: 'ip --help' and 'ip address help' for more details."
+	fi
+    else
+	if [ $# -gt 0 ]; then
+	    for iface in $*; do
+		sysrepocfg -f json -X -d operational -x \
+			   "/ietf-interfaces:interfaces/interface[name='$iface']" | \
+		    /usr/libexec/statd/cli-pretty "show-interfaces" -n "$iface"
+	    done
+	    return
+	fi
+        sysrepocfg -f json -X -d operational -m ietf-interfaces | \
+          /usr/libexec/statd/cli-pretty "show-interfaces"
+    fi
+}
+
+log()
+{
+    if [ -n "$1" ] && [ -r "/var/log/$1" ]; then
+	fn="/var/log/$1"
+    else
+	fn="/var/log/syslog"
+    fi
+    less +G $fn
+}
+
+rmon()
+{
+    if [ -z "$*" ]; then
+	echo "Missing argument, see 'show port' for available interfaces"
+	exit 1
+    fi
+    for port in $*; do
+	ethtool -S "$port"
+    done
+    if [ -z "$plain" ] && [ -z "$nofoot" ]; then
+	dm "______________________________________________________________________________"
+	dm "See: 'ethtool --help' for more details."
+    fi
+}
+
+rstp()
+{
+    mstpctl showbridge
+    echo "br0 port info"
+    mstpctl showport br0
+}
+
+fdb()
+{
+    bridge $bopt fdb show
+}
+
+mdb()
+{
+    bridge $bopt mdb show
+}
+
+routes()
+{
+    if [ -n "$1" ]; then
+	arg="-i $1"
+    else
+	arg="-i ipv4"
+    fi
+    sysrepocfg -f json -X -d operational -x "/ietf-routing:routing/ribs" | \
+	/usr/libexec/statd/cli-pretty "show-routing-table" $arg
+}
+
+igmp()
+{
+    mctl $@
+}
+
+system()
+{
+    h1 "SYSTEM INFORMATION"
+    echo "System Name        : $(uname -n)"
+    echo "System Variant     : $VARIANT"
+    echo "System Description : $PRETTY_NAME"
+    echo "System Contact     : $HOME_URL"
+    echo "System Timezone    : $(cat /etc/timezone)"
+    echo "System Type        : $NAME"
+    echo "System Version     : $(cat /etc/version)"
+    echo "System Arch        : $(uname -m)"
+    echo "Kernel Version     : $(uname -sr)"
+}
+
+version()
+{
+    cat /etc/version
+}
+
+while [ "$1" != "" ]; do
+    case $1 in
+	-a)
+	    all=1
+	    ;;
+	-f)
+	    opt=""
+	    if [ -n "$plain" ]; then
+		opt="-color=never"
+		bopt="-color=never"
+	    fi
+	    opt="-d $opt"
+	    bopt="-d $bopt"
+	    ;;
+	-n)
+	    nofoot="yes"
+	    ;;
+	-p)
+	    plain="yes"
+	    opt="$opt -color=never"
+	    bopt="$bopt -color=never"
+	    ;;
+	-h)
+	    usage
+	    exit 0
+	    ;;
+	*)
+	    break
+    esac
+    shift
+done
+
+if [ -z "$plain" ]; then
+    TTY=$(resize)
+    eval "$TTY"
+
+    # COLUMS and ROWS should be set on the console, if not, use fallback
+    if [ -z "$COLUMNS" ]; then
+	if command -v tput; then
+	    COLUMNS=$(tput cols)
+	else
+	    COLUMNS=80
+	fi
+    fi
+fi
+
+cmd=$1
+if [ -n "$cmd" ]; then
+    shift
+fi
+
+case $cmd in
+    help)
+	usage
+	;;
+    port*)
+	ports $*
+	;;
+    vlan*)
+	vlans
+	;;
+    fdb)
+	fdb
+	;;
+    mdb)
+	mdb
+	;;
+    ifa*)
+	ifaces $*
+	;;
+    ip)
+	cmd=$1
+	shift
+	case $cmd in
+	    addr*)
+		all=1
+		opt="$opt -d"
+		ifaces $*
+		;;
+	    route*)
+		routes ipv4
+		;;
+	    igmp*)
+		igmp $*
+		;;
+	    *)
+		usage
+		;;
+	esac
+	;;
+    ipv6)
+	cmd=$1
+	shift
+	case $cmd in
+	    addr*)
+		ifaces
+		;;
+	    route*)
+		routes ipv6
+		;;
+	    mld*)
+		igmp $*
+		;;
+	    *)
+		usage
+		;;
+	esac
+	;;
+    log)
+	log $1
+	;;
+    rmon)
+	rmon $*
+	;;
+    route*)
+	routes
+	;;
+    span*)
+	rstp
+	;;
+    sys*)
+	system
+	;;
+    ver*)
+	version
+	;;
+    *)
+	usage
+	exit 1
+	;;
+esac
@@ -14,6 +14,24 @@ for file in /sys/firmware/qemu_fw_cfg/by_name/opt/mactab/raw /etc/mactab; do
 	fi
 done

+# Sometimes the sysfs is not populated when the switch driver is loaded, with the result
+# that the DSA interface was not found (no /dsa/tagging entry in sysfs. See issue #685.
+#
+# This mitigates that problem by waiting for sysfs to come up if a DSA switch is found
+if [ -n "$(devlink -j dev info | jq -r '.info.[].driver' | grep -q mv88e6085)" ]; then
+	timeout=50
+	while [ -z "$(ls /sys/class/net/*/dsa/tagging)" ]; do
+		timeout=$((timeout-1))
+		if [ $timeout -eq 0 ]; then
+			logger -k -p user.emerg -t "$ident" "Failed to find DSA interface"
+			exit 1
+		fi
+		sleep 0.1
+	done
+
+	logger -k -p user.notice -t "$ident" "Found DSA interface in $timeout seconds"
+fi
+
 # Find CPU interfaces used for connecting to a switch managed by DSA
 for netif in /sys/class/net/*; do
 	iface=$(basename "$netif")
@@ -1,102 +1,16 @@
 #!/bin/sh
-# Run .cfg migration jq scripts to backup and transform older .cfg files
-ident=$(basename "$0")
-
-MIGRATIONS_DIR="/usr/share/confd/migrate"
+# Check if /cfg/startup-config.cfg needs to be migrated to new syntax.
+# Backup of the original is created in /cfg/backup/ for old versions,
+# the migrate tool inserts old version in name before .cfg extension.
 CONFIG_FILE="/cfg/startup-config.cfg"
-BACKUP_DIR="/cfg/backup"
-
-note()
-{
-    logger -I $$ -k -p user.notice -t "$ident" "$1"
-}
-
-err()
-{
-    logger -I $$ -k -p user.err -t "$ident" "$1"
-}
-
-file_version()
-{
-    jq -r '
-        if .["infix-meta:meta"] | has("version") then
-            .["infix-meta:meta"]["version"]
-        else
-            "0.0"
-        end
-    ' "$1"
-}
-
-atoi()
-{
-    echo "$1" | awk -F. '{print $1 * 1000 + $2}'
-}
+BACKUP_FILE="/cfg/backup/startup-config.cfg"
+mkdir -p "$(dirname "$BACKUP_FILE")"

 if [ ! -f "$CONFIG_FILE" ]; then
-    # Nothing to migrate
    note "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
    exit 0
-fi
-
-cfg_version=$(file_version "$CONFIG_FILE")
-current_version=$(atoi "$cfg_version")
-
-# Find the latest version by examining the highest numbered directory
-sys_version=$(find "$MIGRATIONS_DIR" -mindepth 1 -maxdepth 1 -type d | sort -V | tail -n1 | xargs -n1 basename)
-latest_version=$(atoi "$sys_version")
-
-# Check for downgrade
-if [ "$current_version" -gt "$latest_version" ]; then
-    err "Configuration file $CONFIG_FILE version ($cfg_version) is newer than the latest supported version ($sys_version). Exiting."
-    exit 1
-fi
-
-# If the current version is already the latest, exit the script
-if [ "$current_version" -eq "$latest_version" ]; then
-    note "Configuration is already at the latest version ($sys_version). No migration needed."
+elif migrate -cq "$CONFIG_FILE"; then
    exit 0
 fi

-note "Configuration file $CONFIG_FILE is of version $cfg_version, migrating ..."
-
-# Create the backup directory if it doesn't exist
-mkdir -p "$BACKUP_DIR"
-
-# Create a backup of the current configuration file
-nm=$(basename "$CONFIG_FILE" .cfg)
-BACKUP_FILE="$BACKUP_DIR/${nm}-${cfg_version}.cfg"
-if cp "$CONFIG_FILE" "$BACKUP_FILE"; then
-    note "Backup created: $BACKUP_FILE"
-else
-    err "Failed creating backup: $BACKUP_FILE"
-    exit 1
-fi
-
-# Apply the scripts for each version directory in sequence
-for version_dir in $(find "$MIGRATIONS_DIR" -mindepth 1 -maxdepth 1 -type d | sort -V); do
-    dir=$(basename "$version_dir")
-    version=$(atoi "$dir")
-
-    # Step by step upgrade file to latest version
-    if [ "$current_version" -lt "$version" ]; then
-        note "Applying migrations for version $dir ..."
-
-        # Apply all scripts in the version directory in order
-        for script in $(find "$version_dir" -type f -name '*.sh' | sort -V); do
-	    note "Calling $script for $CONFIG_FILE ..."
-            sh "$script" "$CONFIG_FILE"
-        done
-
-	# File now at $version ...
-        current_version="$version"
-    fi
-done
-
-# Update the JSON file to the latest version
-if jq --arg version "$sys_version" '.["infix-meta:meta"]["infix-meta:version"] = $version' "$CONFIG_FILE" \
-   > "${CONFIG_FILE}.tmp" && mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE"; then
-    note "Configuration updated to version $sys_version."
-else
-    err "Failed updating configuration to version $sys_version!"
-    exit 1
-fi
+migrate -i -b "$BACKUP_FILE" "$CONFIG_FILE"
@@ -146,7 +146,7 @@ mount_overlay home "$cfgsrc" /home
 mount_overlay root "$cfgsrc" /root
 mount_bind         "$varsrc" /var

-[ "$vlibsrc" ] && mount_bind "$vlibsrc" /var/lib
+[ -n "$vlibsrc" ] && mount_bind "$vlibsrc" /var/lib

 for tag in $(ls /sys/bus/virtio/devices/*/mount_tag 2>/dev/null); do
    if [ "$(cat $tag | tr -d '\0')" = hostfs ]; then
@@ -17,6 +17,13 @@ device
  - Initializes auxiliary and configuration filesystems and metadata
  - Installs Infix to both primary and secondary partitions

+To run this script again (on an already provisioned system), erase the
+partition table, reboot and netboot Infix again.
+
+Example:
+
+  sudo sgdisk --zap-all /dev/mmcblk0
+
 EOF
 }

@@ -33,8 +33,8 @@ unpack_archive()
    esac

    if [ ! -e "$file" ]; then
-	if [ -e "/var/lib/conatainers/oci/$file" ]; then
-	    file="/var/lib/conatainers/oci/$file"
+	if [ -e "/var/lib/containers/oci/$file" ]; then
+	    file="/var/lib/containers/oci/$file"
 	elif [ -e "/lib/oci/$file" ]; then
 	    file="/lib/oci/$file"
 	else
@@ -280,6 +280,7 @@ commands:
  help                     Show this help text
  list    [image | oci]    List names (only) of containers, images, or OCI archives
  load    [NAME | URL] NM  Load OCI tarball fileNAME or URL to image NM
+  locate                   Find container that currently owns '--net IFNAME'
  remove   IMAGE           Remove an (unused) container image
  restart [network] NAME   Restart a (crashed) container or container(s) using network
  run      NAME [CMD]      Run a container interactively, with an optional command
@@ -474,6 +475,23 @@ case $cmd in
 	    exit 1
 	fi
 	;;
+    locate)			# Find where the host's ifname lives
+	if [ -z "$network" ]; then
+	    echo "Missing --net IFNAME option."
+	    exit 1
+	fi
+	containers=$(podman ps $all --format "{{.Names}}")
+	for c in $containers; do
+	    json=$(podman inspect "$c")
+	    nets=$(echo "$json" |jq -r '.[].NetworkSettings.Networks | keys[]' 2>/dev/null)
+	    for n in $nets; do
+		if [ "$network" = "$n" ]; then
+		    echo "$c"
+		    exit 0;
+		fi
+	    done
+	done
+	;;
    ls | list)
 	cmd=$1
 	[ -n "$cmd" ] && shift
@@ -608,20 +626,32 @@ case $cmd in
 	podman stats -i 2
 	;;
    upgrade)
+	# Start script used to initially create container
+	script=/var/lib/containers/active/S01-${1}.sh
+
+	# Find container image
 	img=$(podman inspect "$1" | jq -r .[].ImageName)
 	if [ -z "$img" ]; then
 	    echo "No such container ($1), or invalid ImageName.  Cannot upgrade."
 	    exit 1;
 	fi
+
+	# Likely an OCI archive, or local directory, assume user has updated image.
 	if echo "$img" | grep -Eq '^localhost/'; then
-	    # Likely an OCI archive, or local directory, assume user has updated image.
-	    file=$(awk '{s=$NF} END{print s}' "/var/lib/containers/active/${1}.sh")
+	    file=$(awk '{s=$NF} END{print s}' "$script")
 	    echo "Upgrading container ${1} with local archive: $file ..."
 	else
+	    printf ">> Stopping ... "
 	    podman stop "$1"
+	    printf ">> "
 	    podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
 	fi
-	"/var/lib/containers/active/${1}.sh" || (echo "Failed recreating container $1"; exit 1)
+	echo ">> Starting $1 ..."
+	if ! "$script"; then
+	    echo ">> Failed recreating container $1"
+	    exit 1
+	fi
+	echo ">> Done."
 	;;
    volume)
 	cmd=$1
@@ -0,0 +1,15 @@
+#!/bin/sh
+# Sort and collate all /etc/frr/static.d/*.conf files managed by confd,
+# udhcpc, and avahi-autoipd before starting staticd.
+
+DIRD=/etc/frr/static.d
+NAME=/etc/frr/staticd.conf
+NEXT=${NAME}+
+
+rm -f "$NEXT"
+find "$DIRD" -type f -name '*.conf' ! -name '*~' | sort | while read -r file; do
+    cat "$file" >> "$NEXT"
+done
+
+cmp -s "$NAME" "$NEXT" && exit 0
+mv "$NEXT" "$NAME"
@@ -7,9 +7,12 @@ ACTION="$1"
 IP_CACHE="/var/lib/misc/${interface}.cache"
 RESOLV_CONF="/run/resolvconf/interfaces/${interface}.conf"
 NTPFILE="/run/chrony/dhcp-sources.d/${interface}.sources"
+NAME="/etc/frr/static.d/${interface}-dhcp.conf"
+NEXT="${NAME}+"
+
 [ -n "$broadcast" ] && BROADCAST="broadcast $broadcast"
 [ -n "$subnet" ] || subnet=32
-[ -n "$metric" ] || metric=100
+[ -n "$metric" ] || metric=5

 # Handle stateful DHCPv6 like DHCPv4
 [ -n "$ipv6" ] && ip="$ipv6/128"
@@ -23,7 +26,7 @@ log()
    logger -I $$ -t udhcpc -p user.notice "$*"
 }

-wwait_for_ipv6_default_route()
+wait_for_ipv6_default_route()
 {
    log "waiting for IPv6 default route to be installed."
    while [ $IF_WAIT_DELAY -gt 0 ]; do
@@ -42,28 +45,35 @@ wwait_for_ipv6_default_route()
 # client MUST ignore the Router option.
 set_dhcp_routes()
 {
+    echo "! Generated by udhcpc" > "$NEXT"
    if [ -n "$staticroutes" ]; then
 	# format: dest1/mask gw1 ... destn/mask gwn
 	set -- $staticroutes
 	while [ -n "$1" -a -n "$2" ]; do
 	    log "adding route $1 via $2 dev $interface proto dhcp"
-	    ip route add "$1" via "$2" dev $interface metric $metric proto dhcp
+	    echo "ip route $1 $2 $metric tag 100" >> "$NEXT"
 	    shift 2
 	done
    elif [ -n "$router" ] ; then
 	for i in $router ; do
-	    ip route add default via $i dev $interface metric $((metric++)) proto dhcp
+	    echo "ip route 0.0.0.0/0 $i $metric tag 100" >> "$NEXT"
 	done
    fi
+
+    # Reduce changes needed by comparing with previous route(s)
+    cmp -s "$NAME" "$NEXT" && return
+    mv "$NEXT" "$NAME"
+
+    initctl -nbq restart staticd
 }

 clr_dhcp_routes()
 {
    log "deleting DHCP routes from $interface"
-    ip route show proto dhcp dev $interface | while read rt via nh dev dev; do
-	log "removing $rt nh $nh on $dev"
-	ip route del $rt via $nh dev $dev proto dhcp
-    done
+    [ -f "$NAME" ] || return
+    rm "$NAME"
+
+    initctl -nbq restart staticd
 }

 clr_dhcp_addresses()
@@ -112,7 +122,6 @@ case "$ACTION" in
 	    wait_for_ipv6_default_route
 	fi

-	clr_dhcp_routes
 	set_dhcp_routes

 	# set hostname if given
@@ -1,4 +1,4 @@
-echo "Press Ctrl-C NOW to enter boot menu"
+echo "Press Ctrl-C NOW to override the default boot sequence"
 if sleep "${ixbootdelay}"; then
    run ixbootorder

@@ -7,8 +7,12 @@ if sleep "${ixbootdelay}"; then
    reset
 fi

-bootmenu
 if test "${dev_mode}" != "yes"; then
+    bootmenu
    pause "Console shell access PROHIBITED. Press any key to reset..."
    reset
 fi
+
+echo
+echo 'Run "bootmenu" to interactively select a boot device'
+echo
@@ -1,16 +1,20 @@
 setenv autoload no

-if dhcp; then
+if test -n "${ipaddr}" || dhcp; then
    setenv proto tftp
    setenv dltool tftpboot
+    setenv dlfile "${bootfile}"

-    if setexpr proto sub "^(http|tftp)://.*" "\\1" "${bootfile}" && setexpr bootfile sub "^(http|tftp)://([^/]+?)/(.*)" "\2:\3"; then
+    if setexpr proto sub "^(http|tftp)://.*" "\\1" "${bootfile}"; then
 	if test "${proto}" = "http"; then
 	    setenv dltool wget
+	    setexpr dlfile sub "^http://([^/]+?)/(.*)" "\\1:/\\2" "${bootfile}"
+	else
+	    setexpr dlfile sub "^tftp://([^/]+?)/(.*)" "\\1:\\2" "${bootfile}"
 	fi
    fi

-    if ${dltool} ${ramdisk_addr_r} "${bootfile}"; then
+    if ${dltool} ${ramdisk_addr_r} "${dlfile}"; then
 	setenv old_fdt_addr ${fdt_addr}
 	if fdt addr ${ramdisk_addr_r}; then
 	    fdt get value sqoffs /images/rootfs data-position
@@ -260,6 +260,8 @@ CONFIG_CRYPTO_GCM=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_TIMEOUT=20
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 # CONFIG_FTRACE is not set
@@ -14,6 +14,7 @@ BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -24,14 +25,13 @@ BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_ROOTFS_MERGED_USR=y
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.46"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
-BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/styx marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/dcp-sc-28p-a styx/dcp-sc-28p-b marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
 BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
 BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -131,7 +131,9 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
+BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
@@ -140,6 +142,8 @@ BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
 BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
@@ -0,0 +1,141 @@
+BR2_aarch64=y
+BR2_ARM_FPU_VFPV4=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_TARGET_GENERIC_HOSTNAME="ix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
+BR2_TARGET_GENERIC_GETTY_TERM="xterm"
+BR2_SYSTEM_DHCP="eth0"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
+BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/dcp-sc-28p-a styx/dcp-sc-28p-b marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
+BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_STRACE=y
+BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_LINUX_PAM=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FRR=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_DBUS=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_LESS=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_PACKAGE_HOST_E2FSPROGS=y
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+INFIX_VENDOR_HOME="https://github.com/kernelkit"
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CONFD_TEST_MODE=y
+BR2_PACKAGE_GENCERT=y
+BR2_PACKAGE_STATD=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_KEYACK=y
+BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_LIBINPUT=y
+BR2_PACKAGE_ROUSETTE=y
+DISK_IMAGE_BOOT_BIN=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+GNS3_APPLIANCE_RAM=512
+GNS3_APPLIANCE_IFNUM=10
@@ -183,6 +183,8 @@ BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
 BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
@@ -11,8 +11,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -65,9 +65,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
-BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
-BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
@@ -166,6 +164,7 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+# BR2_PACKAGE_CONFD_TEST_MODE is not set
 BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
@@ -174,6 +173,8 @@ BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
 BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
@@ -13,6 +13,7 @@ BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -23,10 +24,9 @@ BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_ROOTFS_MERGED_USR=y
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.46"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -57,6 +57,7 @@ BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_LINUX_PAM=y
@@ -134,7 +135,9 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
+BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
@@ -143,6 +146,8 @@ BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
 BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
@@ -0,0 +1,143 @@
+BR2_x86_64=y
+BR2_x86_corei7=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_TARGET_GENERIC_HOSTNAME="ix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
+BR2_TARGET_GENERIC_GETTY_TERM="xterm"
+BR2_SYSTEM_DHCP="eth0"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
+BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
+BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_STRACE=y
+BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_LIBMNL=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_LINUX_PAM=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FRR=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_DBUS=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_LESS=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_EDK2=y
+BR2_TARGET_GRUB2=y
+BR2_TARGET_GRUB2_X86_64_EFI=y
+BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback cat search"
+BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
+BR2_TARGET_GRUB2_INSTALL_TOOLS=y
+BR2_PACKAGE_HOST_DOSFSTOOLS=y
+BR2_PACKAGE_HOST_E2FSPROGS=y
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+INFIX_VENDOR_HOME="https://github.com/kernelkit"
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CONFD_TEST_MODE=y
+BR2_PACKAGE_GENCERT=y
+BR2_PACKAGE_STATD=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_KEYACK=y
+BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_ROUSETTE=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+GNS3_APPLIANCE_RAM=512
+GNS3_APPLIANCE_IFNUM=10
@@ -4,6 +4,213 @@ Change Log
 All notable changes to the project are documented in this file.


+[v24.10.2][UNRELEASED]
+-------------------------
+
+### Changes
+
+- Support for showing interfaces owned by running containers in the CLI
+  command `show interfaces`.  This also adds support for showing the
+  peer interface of VETH pairs.  Issue #626
+- Reboot system on kernel "oops", on "oops" the kernel now panics and
+  reboots after 20 seconds.  Issue #740
+- Update static factory-config for NanoPi R2S: enable NACM, securing all
+  passwords, and enabling `iburst` for the NTP client.  Issue #750
+- Updated QoS documentation with pictures and more information on VLAN
+  interface ingress/egress priority handling, issue #759
+- Disable RTC device in Styx device tree, issue #794
+- Support for saving and restoring system clock from a disk file.  This
+  allows restoring the system clock to a sane date in case the RTC is
+  disabled or does not have a valid time, issue #794
+
+### Fixes
+- Fix #685: DSA conduit interface not always detected, randomly causing
+  major issues configuring systems with multiple switch cores
+- Fix #778: reactivate OpenSSL backend for libssh/libssh2 for NanoPI R2S.
+  This fixes a regression in v24.10.0 causing loss of NETCONF supprt
+
+
+[v24.10.1][] - 2024-10-18
+-------------------------
+
+### Changes
+ - Add support for interface description, sometimes referred to as
+   "ifAlias".  Saved as an Linux interface alias (not `altname`), e.g.,
+   `/sys/class/interfaces/veth0a/ifalias`, includes operational support
+
+### Fixes
+ - Fix #735: `copy` and `erase` commands missing from CLI, regression
+   in Infix v24.10.0 defconfigs, now added as dep. in klish package
+
+
+[v24.10.0][] - 2024-10-18
+-------------------------
+
+**News:** this release contains *breaking YANG changes* in custom MAC
+addresses for interfaces!  For details, see below issue #680.
+
+Also, heads-up to all downstream users of Infix.  YANG models have been
+renamed to ease maintenance, more info below.
+
+### Changes
+- Software control of port LEDs on the Styx platform has been disabled.
+  Default driver behavior, green link and green traffic blink, is kept
+  as-is, which should mitigate issues reported in #670
+- Correcting documentation on QoS. For packets containing both a VLAN
+  tag and an IP header, PCP priority takes precedence over DSCP
+  priority (not vice versa).
+- Update CONTRIBUTING.md for scaling core team and helping external
+  contributors understand the development process, issue #672
+- Updated branding documentation with more information on how dynamic
+  and static factory-config work, including examples
+- Updated container documentation, improved images, detail how to set
+  interface name inside the container, and some syntax fixes
+- Updated networking documentation, new General settings section, and
+  more details added to initial section on network building blocks
+- As of this release, all Infix YANG models have dropped the `@DATE`
+  suffix from the name, this type of versioning is not handled using
+  symlinks instead.
+- Update Infix `provision` script, used to install Infix on eMMC, add
+  example of how to erase partition table to be able to re-run the
+  script on already provisioned devices, issue #671
+- OSPF: Add limitation to allow an interface to be in one area only
+- Add support for "dummy" interfaces, mostly useful for testing
+- Add support for container hostname format specifiers, just like it
+  already works for the host's hostname setting
+- Hide all `status obsolete` YANG nodes in CLI
+- Add YANG `units`, if available, to CLI help text (default value)
+- The CLI commands `copy` and `erase` are now available also from Bash
+- Greatly reduced size of bundled curiOS httpd OCI container image,
+  reduced from 1.8 MiB to 281 KiB
+- Add deviation to ietf-interfaces.yang, `link-up-down-trap-enable` is
+  not supported (yet) in Infix, issue #709
+- The default builds now include the curiOS nftables container image,
+  which can be used for advanced firewall setups.  For an introduction
+  see <https://kernelkit.org/posts/firewall-container/>
+
+### Fixes
+- Fix #499: add an NACM rule to factory-config, which by default deny
+  everyone to read user password hash(es)
+- Fix #663: internal Ethernet interfaces shown in CLI tab completion
+- Fix #674: CLI `show interfaces` display internal Ethernet interfaces,
+  regression introduced late in v24.09 release cycle
+- Fix #676: port dropped from bridge when changing its VLAN membership
+  from tagged to untagged
+- Fix #680: replace deviation for `phys-address` in ietf-interfaces.yang
+  with `custom-phys-address` to allow for constructing more free-form
+  MAC addresses based on the chassis MAC (a.k.a., base MAC) address.
+  For more information, see the YANG model, a few examples are listed in
+  the updated documentation.  
+  The syntax will be automatically updated in the `startup-config` and
+  `factory-config` -- make sure to verify the changes and update any
+  static `factory-config` used for your products
+- Fix #690: CLI `show ip route` command stops working after 24 hours,
+  this includes all operational data in ietf-routing:/routing/ribs.
+- Fix #697: password is not always set for new users, bug introduced
+  in v24.06.0 when replacing Augeas with native user handling
+- Fix #700: add missing `admin-status` to interface operational data
+- Fix #701: make sure CLI (and Bash) `copy` command use same sysrepo
+  timeout as other operations that load sysrepo.  Was 10 second timeout,
+  which caused some (really big) configurations not to apply from the
+  CLI, but worked at boot, for instance.  New timeout is 60 seconds
+- Fix #708: allow all container networks to set interface name inside
+  container, not just auto-generated veth-pair ends for `docker0` bridge
+- Fix `show interfaces` on platforms like the NanoPi R2S, which does not
+  support reading RMON counters in JSON format using `ethtool`
+- Fix #730: CLI command `show ntp [sources]` stopped working in v24.08.
+  Missing access rights after massive CLI lock-down
+- Fix BFD in OSPF, previously you could not enable BFD on a single
+  interface without enabling it on all interfaces
+
+
+[v24.09.0][] - 2024-09-30
+-------------------------
+
+**News:** this release enhances the integration of all types of static
+routes with FRRouting ([Frr][]), including all routes that can be set by
+DHCP and IPvLL (ZeroConf) clients.  Due to this fundamental change, the
+system routing table is now primarily read from Frr, which increases the
+amount of relevant routing information available to the user.  E.g., in
+the CLI exec command `show ip route` and `show ipv6 route`.  Support for
+adjusting the administrative distance of all types of static routes has
+also been added to facilitate site specific adaptations.  Please see the
+documentation for details.
+
+### Known Issues
+- The CLI command `show interfaces` may for some terminal resolutions
+  not display all interfaces (on systems with >20 interfaces).  This
+  problem is limited to the console port and only occurs for smaller
+  terminals (30-50 rows height).  Calling `show ifaces` from the shell,
+  dumping `/ietf-interfaces:interfaces` XPath using `sysrepocfg`, or
+  using the CLI from an SSH session, is not affected.  Issue #659
+
+### Changes
+- Upgrade Buildroot to 2024.02.6 (LTS)
+- Upgrade Linux kernel to 6.6.52 (LTS)
+- Upgrade libyang to 3.4.2
+- Upgrade sysrepo to 2.11.7
+- Upgrade netopeer2 (NETCONF) to 2.2.31
+- Updated `infix-routing.yang` to declare deviations for unsupported
+  OSPF RPCs and Notifications in `ietf-ospf.yang`
+- The CLI admin-exec command `show dns` now also shows any configured
+  name servers, not just ones acquired via DHCP.  Issue #510
+- Add support for IPv4 (autoconf) `request-address`.  This instructs the
+  ZeroConf client to start with the requested address.  If this is not
+  successful the client falls back to its default behavior.  Issue #628
+- Major speedup (10x) in operational data, in particular when querying
+  interface status.  Very noticeable in the CLI `show interfaces`
+  command on devices with large port counts.  Issue #651
+- Silence `yanger` log warnings for failing `mctl` command.  Caused
+  by `mctl` reporting no multicast filtering enabled on bridge
+
+### Fixes
+- Fix #357: EUI-64 based IPv6 autoconf address on bridges seem to be
+  randomized.  Problem caused by kernel setting a random MAC before any
+  bridge port is added.  Fixed by using the device's base MAC address on
+  bridge interfaces.  Possible to override using `phys-address` option
+- Fix #601: CLI regression in `show ospf` family of commands causing
+  authorized users, like `admin`, to not being able to query status
+  of OSPF or BFD.  Workaround by using the UNIX shell `sudo vtysh`.
+  Regression introduced in v24.08.0
+- Fix #603: regression in GNS3 image, starts in test mode by default.
+  Introduced in v24.08.
+- Fix #613: CLI regression in tab completion of container commands,
+  e.g., `container shell <TAB>`.  Regression introduced in v24.08.0
+- Fix #616: Silent failure when selecting bash as login shell for
+  non-admin user, this silent lock has been removed
+- Fix #618: CLI command `show interfaces` does not show bridges and
+  bridge ports, regression introduced in v24.08.0 -- only affects
+  bridges without multicast snooping
+- Fix #623: CLI command `container upgrade NAME` does not work,
+  regression introduced in v24.06.0
+- Fix #625: initialize sysrepo startup datastore at boot.  Improves
+  usability when working directly against the sysrepo datastores from
+  the shell with `sysrepocfg` and `sysrepoctl` tools
+- Fix #635: OSPF: all router neighbors reported as neighbor on every
+  interface
+- Fix #638: Disabling IPv4LL (autoconf) on an interface does not clean
+  up 169.254/16 addresses
+- Fix #640: unable to set static default route due to priority inversion
+  from DHCP or IPv4LL (ZeroConf) clients setting their routes directly
+  in the kernel.  This has resulted in a complete overhaul of route
+  management, using FRRouting for all routes, including DHCP and IPv4LL
+  routes, presentation in the CLI, and also support for custom route
+  preference for static routes
+- Fix #658: deleting VETH pairs does not work unless rebooting first.
+  Creating a VETH pair, followed by at least one other reconfiguration
+  before removing the pair, causes `confd` to fail when applying the
+  interface changes (tries to delete both ends of the pair)
+- Spellcheck path to `/var/lib/containers` when unpacking OCI archives
+  on container upgrade
+- cli: restore `tcpdump` permissions for administrator level users,
+  regression introduced in v24.08.0
+- The timeout before giving up on loading the `startup-config` at boot
+  is now 1 minute, just like operations via other front-ends (NETCONF
+  and RESTCONF). This was previously (incorrectly) set to 10 seconds
+
+[Frr]: https://frrouting.org/
+
+
 [v24.08.0][] - 2024-08-30
 -------------------------

@@ -22,7 +229,7 @@ Finally, the following consumer boards are now fully supported:
 - Upgrade Buildroot to 2024.02.5 (LTS)
 - Upgrade Linux kernel to 6.6.46 (LTS)
 - Issue #158: enhance security of factory reset.  All file content
-  is now overwritten x3, the last time with zeroes, then removed.  
+  is now overwritten x3, the last time with zeroes, then removed.
  Example, on the NanoPi R2S this process takes ~30 seconds, but may
  take longer in setups with bigger configurations, e.g., containers
 - Issue #497: support for auto-mounting USB media.  Useful for logging,
@@ -162,7 +369,7 @@ Finally, the following consumer boards are now fully supported:
 - Merge infix-shell-types.yang with infix-system.yang
 - cli: improved error/warning message on missing or incomplete command

-[yescrypt]: https://en.wikipedia.org/wiki/Yescrypt)
+[yescrypt]: https://en.wikipedia.org/wiki/Yescrypt

 ### Fixes
 - Fix #424: regression, root user can log in without password
@@ -1068,7 +1275,10 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.08.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.10.1...HEAD
+[v24.10.1]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.10.1
+[v24.10.0]:   https://github.com/kernelkit/infix/compare/v24.09.0...v24.10.0
+[v24.09.0]:   https://github.com/kernelkit/infix/compare/v24.08.0...v24.09.0
 [v24.08.0]:   https://github.com/kernelkit/infix/compare/v24.06.0...v24.08.0
 [v24.06.0]:   https://github.com/kernelkit/infix/compare/v24.04.0...v24.06.0
 [v24.04.2]:   https://github.com/kernelkit/infix/compare/v24.04.1...v24.04.2
@@ -143,7 +143,7 @@ which offers lots of benefits out-of-the-box:
  media like USB sticks or SD-cards) and from remote servers using FTP
  or HTTP(S).

-To initiate a system upgrade, run:
+To initiate a system upgrade from the shell[^1], run:

    rauc install <file|url>

@@ -349,3 +349,5 @@ can funtion reasonably well without a persistent `/var`, loosing
 If `var` is not available, Infix will still persist `/var/lib` using
 `cfg` as the backing storage.

+[^1]: See [CLI Upgrade](cli/upgrade.md) for information on upgrading
+    via CLI.
@@ -41,13 +41,92 @@ Verify the result after a build by inspecting:
    printed on a label on the device.


-Factory Defaults
----------------
+Factory & Failure Config
+------------------------

-The Infix default configuration, factory-config, is part static files
-and part per-device generated files, e.g., SSH hostkey and hostname.
-The latter is constructed from the file `/etc/hostname`, appended with
-the last three octets of the system's base MAC address.  To override the
+To support booting the same image (CPU architecture) on multiple boards,
+Infix by default generates the device's initial configuration every time
+at boot.  This also ensures the device can always be restored to a known
+state after a factory reset, since the `factory-config` is guaranteed to
+be compatible with the YANG models for the given software version. (For
+more information on how the system boots, please see the section [Key
+Concepts](introduction.md#key-concepts) in the Introduction document.)
+
+However, for custom builds of Infix it is possible to override this with
+a single static `/etc/factory-config.cfg` (and failure-config) in your
+rootfs overlay -- with a [VPD](vpd.md) you can even support several!
+
+
+### Variables & Format Specifiers
+
+Parts of the configuration you likely always want to generated, like the
+SSH hostkey used by NETCONF, a unique hostname, or the `admin` user's
+unique (per-device with a VPD) password hash.  This section lists the
+available keywords, see the next section for examples of how to use
+them:
+
+ - **Default password hash:** `$factory$` (from VPD, .dtb, or built-in)  
+   XPath: `/ietf-system:system/authentication/user/password`
+ - **Default NETCONF hostkey:** `genkey` (regenerated at factory reset)  
+   XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
+ - **Hostname format specifiers:**  
+   XPath: `/ietf-system:system/hostname`
+   - `%i`: OS ID, from `/etc/os-release`, from Menuconfig branding
+   - `%h`: Default hostname, from `/etc/os-release`, from branding
+   - `%m`: NIC specific part of base MAC, e.g., to `c0-ff-ee`
+   - `%%`: Literal %
+
+
+### Static Files
+
+> **Caveat:** maintaining static a factory-config and failure-config may
+> seem like an obvious choice, but as YANG models evolve (even the IETF
+> models get upgraded), you may need to upgrade your static files.
+
+First, for one-off builds (one image per product), the simplest way is
+to override the location where the system looks for the files, `/etc`
+already at build time.  This can be done using a Buildroot rootfs
+overlay providing, e.g., `/etc/factory-config.cfg`.  Example: [NanoPi
+R2S][] in `${INFIX}/board/aarch64/r2s/rootfs/etc/factory-config.cfg`.
+
+Second, to support multiple products in a single image, we can employ
+another method to install a `/etc/factory-config.cfg` override -- at
+runtime.  This relies on the very early system `probe` that detects the
+specific product from VPD data.
+
+The `probe` consists of several sequential steps that currently run from
+`${INFIX}/board/common/rootfs/usr/libexec/infix/init.d/`.  One of them
+check if `/usr/share/product/<PRODUCT>` exists, and if so attempts to
+copy the entire contents to `/`.  Here, `<PRODUCT>` is determined from
+the VPD, which is available in `/run/system.json` as `"product-name"`,
+after `00-probe` has run. The lower case version of the string is used.
+
+I.e., create a rootfs overlay that provides any combination of:
+
+ - `/usr/share/product/<PRODUCT>/etc/factory-config.cfg`
+ - `/usr/share/product/<PRODUCT>/etc/failure-config.cfg`
+
+
+### Dynamically Generated
+
+The generated `factory-config` and `failure-config` files consist of
+both static JSON files and part generated files at runtime for each
+device.  The resulting files are written to the RAM disk in `/run`:
+
+ - `/run/confd/factory-config.gen`
+ - `/run/confd/failure-config.gen`
+
+Provided no custom overrides (see above) have been installed already,
+these files are then copied to:
+
+ - `/etc/factory-config.cfg`
+ - `/etc/failure-config.cfg`
+
+... where the bootstrap process expects them to be in the next step.
+
+Examples of generated contents are the SSH hostkey and hostname.  The
+latter is constructed from the file `/etc/hostname`, appended with the
+last three octets of the system's base MAC address.  To override the
 base hostname, set `BR2_TARGET_GENERIC_HOSTNAME` in your defconfig.

 The static files are installed by Infix `confd` in `/usr/share/confd/`
@@ -97,6 +176,112 @@ bootstrap script for more help, and up-to-date information.
 > you may want to look into `GEN_IFACE_OPTS`.


+### Example Snippets
+
+**IETF System:**
+
+```hsib
+  "ietf-system:system": {
+    "hostname": "example-%m",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo="
+  },            # <---- REMEMBER COMMA SEPARATORS IN SNIPPETS!
+                # <---- ... and no comments.
+```
+
+The `motd-banner` is a binary type, which is basically a Base64 encoded
+text file without line breaks (`-w0`):
+
+```bash
+$ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" |base64 -d
+.-------.
+|  . .  | Infix -- a Network Operating System
+|-. v .-| https://kernelkit.github.io
+'-'---'-'
+```
+
+**IETF Keystore**
+
+Notice how both the public and private keys are left empty here.  The
+`genkey` is always automatically regenerated after each factory reset.
+Keeping the `factory-config` snippet like this means we can use the same
+file on multiple devices, without risking them sharing the same host
+keys.  Sometimes you may want the same host keys, but that is the easy
+use-case and not documented here.
+
+```json
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+```
+
+The `genkey` is currently only used by the NETCONF SSH backend.
+
+**IETF NETCONF Server**
+
+```json
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-address": "::"
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+```
+
+
+
 Integration
 -----------

@@ -203,3 +388,4 @@ variable `INFIX_OEM_PATH` to that of the br2-external.  It is also
 possible to set the `GIT_VERSION` variable in your `post-build.sh`
 script to change how the VCS version is extracted.

+[NanoPi R2S]: https://github.com/kernelkit/infix/blob/main/board/aarch64/r2s/rootfs/etc/factory-config.cfg
@@ -1,5 +1,6 @@
 Containers in Infix
 ===================
+<img align="right" src="img/docker.webp" alt="Docker whale" width=360>

 * [Introduction](#introduction)
 * [Caution](#caution)
@@ -75,19 +76,20 @@ Getting Started

 In the CLI, containers can be run in one of two ways:

- 1. `container run IMAGE [COMMAND]`, and
+ 1. `container run IMAGE [COMMAND]`, or
 2. enter `configure` context, then `edit container NAME`

-The first is useful mostly for testing, or running single commands in an
-image.  It is a wrapper for `podman run -it --rm ...`, while the latter
-is a wrapper and adaptation of `podman create ...`.
+The former is useful mostly for testing, or running single commands in
+an image.  It is a wrapper for `podman run -it --rm ...`, while the
+latter is a wrapper and adaptation of `podman create ...`.

 The second create a container with a semi-persistent writable layer that
 survives container restarts and host system restarts.  However, if you
 change the container configuration or upgrade the image (see below), the
 container will be recreated and the writable layer is lost.  This is why
 it is recommended to set up a named volume for directories, or use file
-[Content Mounts][], in your container you want truly persistent content.
+[Content Mounts](#content-mounts), in your container if you want truly
+persistent content.

 In fact, in many cases the best way is to create a `read-only` container
 and use file mounts and volumes only for the critical parts.  Podman
@@ -103,11 +105,23 @@ application to run.
 > unlike virtualization, containers reuse the host's CPU and kernel.


+<img align="right" src="img/docker-hello-world.svg" alt="Hello World" width=360>
+
 ### Examples

 Classic Hello World:

    admin@example:/> container run docker://hello-world
+    Starting docker://hello-world :: use Ctrl-p Ctrl-q to detach
+    Trying to pull docker.io/library/hello-world:latest...
+    Getting image source signatures
+    Copying blob c1ec31eb5944 done
+    Copying config d2c94e258d done
+    Writing manifest to image destination
+    Storing signatures
+
+    Hello from Docker!
+    This message shows that your installation appears to be working correctly.

 Persistent web server using nginx, sharing the host's network:

@@ -132,7 +146,7 @@ container at runtime.
 Container Images
 ----------------

-The underlying `podman` project support importing and fetching images in
+The underlying `podman` project supports importing and fetching images in
 a variety of ways, the most common ones are also supported by Infix.  In
 this section we present how to use them and in the next section we show
 how to upgrade to a newer base image.
@@ -209,7 +223,7 @@ admin-exec context ...
    admin@example:/var/tmp$ cli
    admin@example:/> container load /var/tmp/curios-oci-amd64.tar.gz name curios:edge

-> By assigning The `name curios:edge` is the tag you give the imported
+> The `name curios:edge` is the tag you give the imported
 > (raw) archive which you can then reference in your container image
 > configuration: `set image curios:edge`.

@@ -221,10 +235,13 @@ archive, which helps greatly with container upgrades (see below):

 Upgrading a Container Image
 ---------------------------
+<img align="right" src="img/shield-checkmark.svg" alt="Hello World" width=100>

-> **Note:** the default writable layer is lost when upgrading the image
-> Use named volumes for directories with writable content you wish to
-> keep over an upgrade.
+The applications in your container are an active part of the system as a
+whole, so make it a routine to keep your container images up-to-date!
+
+> **Note:** the default writable layer is lost when upgrading the image.
+> Use named volumes for content that you want to persist across upgrades.

 All container configurations are locked to the image hash at the time of
 first download, not just ones that use an `:edge` or `:latest` tag.  An
@@ -300,14 +317,19 @@ Currently two types of of container networks are supported:

 > For more information on VETH pairs, see the [Networking Guide][0].

+
 ### Container Bridge

 A container bridge is what most container setups use and users want.
+
+![IP Masquerading Container Bridge](img/cni-bridge-firewall.svg)
+
 The difference from a regular bridge is that the container runtime fully
-manages them -- connecting containers automatically with VETH pairs and
-setting up firewall rules between the host and other containers, as well
-as managing port forwarding.  This transparent background management is
-what makes container use seem to be so simple.
+manages them -- connecting containers with automatically created VETH
+pairs (look at the bridge port names) and setting up firewall rules
+between the host and other containers, as well as managing port
+forwarding.  This transparent background management is what makes
+container use seem to be so simple.

 All interface configuration is done in configure context.

@@ -326,7 +348,7 @@ have to set manually:
    admin@example:/config/interface/docker0/> set container-network type bridge

 > **Note:** when doing the same operation over NETCONF there is no
-> inference, so all the "magic" settings needs to be defined.  This
+> inference, so all the "magic" settings need to be defined.  This
 > makes the CLI very useful for first setup and then extracting the
 > resulting XML from the shell using the `cfg -X` command.

@@ -395,20 +417,21 @@ namespace of a container[^3].  This of course works with plain Ethernet
 interfaces as well, but here we will use one end of a VETH pair as an
 example.

+The network `option` setting is available also for this case, but only
+the `interface_name=foo0` option works.  Which is still very useful.  To
+change the MAC address, you need to use the `custom-phys-address` in the
+general network settings.
+
 [^3]: Something which the container bridge network type does behind the
    scenes with one end of an automatically created VETH pair.

+
 #### Routed Setup

 In this routed setup we reserve 192.168.0.0/24 for the network between
 the host and the `ntpd` container.

-                                _____________
-                               |             |
-    veth0 .1                   |   .2 eth0   |
-           \   192.168.0.0/24  |  /          |
-            '--------------------'  [ntpd]   |
-                               |_____________|
+![Basic VETH pair connecting ntpd container.](img/cni-ntpd-routed.svg)

 Configuration is a straight-forward VETH pair setup where we name the
 container-end of pair `ntpd`.  This is just a convenience for us when
@@ -421,7 +444,7 @@ line where we declare the `ntpd` end as a container network interface:
    admin@example:/config/interface/veth0/> end
    admin@example:/config/> edit interface ntpd
    admin@example:/config/interface/ntpd/> set ipv4 address 192.168.0.2 prefix-length 24
-    admin@example:/config/interface/ntpd/> set phys-address 00:c0:ff:ee:00:01
+    admin@example:/config/interface/ntpd/> set custom-phys-address static 00:c0:ff:ee:00:01
    admin@example:/config/interface/ntpd/> set container-network

 > Notice how you can also set a custom MAC address at the same time.
@@ -430,9 +453,12 @@ Adding the interface to the container is the same as before, but since
 everything for host interfaces is set up in the interfaces context, we
 can take a bit of a shortcut.

-    admin@example:/config/container/ntpd/> set network ntpd
+    admin@example:/config/container/ntpd/> set network interface ntpd
    admin@example:/config/container/ntpd/> leave

+> Use the `set network interface ntpd option interface_name=foo0` to set
+> the name of the interface inside the container to `foo0`.
+
 The point of the routed case is that port forwarding from the container
 in this case is limited to a single interface, not *all interfaces* as
 is the default in the masquerading container bridge setup.
@@ -444,21 +470,15 @@ A perhaps more common case is to bridge the other end of the VETH pair
 with other physical ports.  In this section we show how to add a new
 pair to give our container two interfaces:

-                              _______________
-                             |               |                     .1 br0
-    veth0 .1                 |   .2 eth0     |                       /   \
-           \  192.168.0.0/24 |  /   eth1 .2  |                 veth1b     e1
-            '------------------'          \  | 192.168.1.0/24  /
-                             |     [ntpd]  '------------------'
-                             |_______________|
+![Bridged setup with ntpd container.](img/cni-ntpd-bridged.svg)

 We start by adding the second VETH pair:

    admin@example:/config/> edit interface veth1a
-    admin@example:/config/interface/veth1a/> set veth peer veth1b
+    admin@example:/config/interface/veth1a/> set veth peer veth1
    admin@example:/config/interface/veth1a/> set ipv4 address 192.168.1.2 prefix-length 24

-> The LAN bridge (br0) in this example has IP address 192.168.1.1.
+> The LAN bridge (br1) in this example has IP address 192.168.1.1.

 When a container has multiple host interfaces it can often be useful to
 have a default route installed.  This can be added from the host with a
@@ -474,15 +494,16 @@ have a default route installed.  This can be added from the host with a
 	  }
 	}
 	veth {
-	  peer veth1b;
+	  peer veth1;
 	}
    admin@example:/config/interface/veth1a/> end
-    admin@example:/config/> set interface veth1b bridge-port bridge br0
+    admin@example:/config/> set interface veth1 bridge-port bridge br1

 Please note, container network routes require the base interface also
 have a static IP address set.  Setting only the route, but no address,
 means the route is skipped.

+
 ### Host Networking

 The third use-case is host networking, this is where a container share
@@ -492,7 +513,7 @@ the host operating system.

 The host networking setup cannot be combined with any other network.

-For an example, see below.
+For an example, [see below](#application-container-nftables).


 Mounts and Volumes
@@ -600,6 +621,17 @@ container ID (hash) is used, but this can be easily changed:
    admin@example:/> container shell system
    root@sys101:/#

+In fact, the container `hostname` setting supports the same format
+specifiers as the host's `hostname` setting:
+
+ - `%i`: OS ID, from `/etc/os-release`, from Menuconfig branding
+ - `%h`: Default hostname, from `/etc/os-release`, from branding
+ - `%m`: NIC specific part of base MAC, e.g., to `c0-ff-ee`
+ - `%%`: Literal %
+
+The most useful combination is probably `"container-name-%m"`, which in
+this example give the container hostname `container-name-c0-ff-ee`.
+
 [^1]: this does not apply to the admin-exec command `container run`.
    This command is intended to be used for testing and evaluating
 	container images.  Such containers are given a private network
@@ -627,6 +659,7 @@ Notice how we `set network host`, so the container can see and act on
 all the host's interfaces, and that we also have to run the container
 in *privileged* mode.

+
 ### Application Container: ntpd

 The default NTP server/client in Infix is Chrony, a fully working and
@@ -707,7 +740,7 @@ and then asking what the hostname is on the host:

 One use-case for this method is when extending Infix with a management
 container that connects to other systems.  For some tips on how to
-control an Infix system this way, see [Scripting Infix](scriptiong.md).
+control an Infix system this way, see [Scripting Infix](scripting.md).

 [^2]: The `nsenter` program is available from either the util-linux
    package in Debian/Ubuntu/Mint, or in BusyBox.  Note, however,
@@ -715,7 +748,7 @@ control an Infix system this way, see [Scripting Infix](scriptiong.md).


 [0]:      networking.md
-[1]:      https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-containers%402023-12-14.yang
+[1]:      https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-containers.yang
 [2]:      https://github.com/troglobit/mg
 [3]:      https://github.com/opencontainers/image-spec/blob/main/image-layout.md
 [4]:      system.md#ssh-authorized-key
@@ -67,14 +67,7 @@ $ sudo apt install bc binutils build-essential bzip2 cpio \
                   diffutils file findutils git gzip      \
                   libncurses-dev libssl-dev perl patch   \
                   python3 rsync sed tar unzip wget       \
-                   autopoint bison flex
-```
-
-For testing, a few more tools and services are required on your system:
-
-```bash
-$ sudo apt install jq graphviz qemu-system-x86 qemu-system-arm \
-				   ethtool gdb-multiarch tcpdump tshark
+                   autopoint bison flex autoconf automake
 ```

 > For details, see the Getting Started and System Requirements sections
@@ -94,6 +87,23 @@ To see available defconfigs for supported targets, use:
    make list-defconfigs


+### Test
+
+Working with the regression test framework, *Infamy*, a few more tools
+and services are required on your system:
+
+```bash
+$ sudo apt install jq graphviz qemu-system-x86 qemu-system-arm \
+				   ethtool gdb-multiarch tcpdump tshark
+```
+
+To be able to build the test specification you also need:
+
+```bash
+$ sudo apt-get install python3-graphviz ruby-asciidoctor-pdf
+```
+
+
 Development
 -----------

@@ -166,23 +176,48 @@ The Infix automated test suite is built around Qemu and [Qeneth][2], see:
 * [Docker Image](../test/docker/README.md)


+Reviewing
+---------
+
+While reviewing a pull request, you might find yourself wanting to
+play around with a VM running that _exact_ version.  For such
+occations, [gh-dl-artifact.sh](../utils/gh-dl-artifact.sh) is your
+friend in need!  It will use the [GitHub CLI
+(gh)](https://cli.github.com) to locate a prebuilt image from our CI
+workflow, download it, and prepare a local output directory from which
+you can launch both `make run` instances, and run regression tests
+with `make test` and friends.
+
+For example, if you are curious about how PR 666 behaves in some
+particular situation, you can use `gh` to switch to that branch, from
+which `gh-dl-artifact.sh` can then download and prepare the
+corresponding image for execution with our normal tooling:
+
+    gh pr checkout 666
+    ./utils/gh-dl-artifact.sh
+    cd x-artifact-a1b2c3d4-x86_64
+    make run
+
+> **Note:** CI artifacts are built from a merge commit of the source
+> and target branches.  Therefore, the version in the Infix banner
+> will not match the SHA of the commit you have checked out.
+
+
 Contributing
 ------------

-Infix is built from many parts, when contributing you need to set up
-your own fork, create a local branch for your change, push to your fork,
-and then use GitHub to create a *Pull Reqeuest*.
+Infix is built from many components, when contributing you need to set
+up your own fork, create a local branch for your change, push to your
+fork, and then use GitHub to create a *Pull Reqeuest*.

-For this to work as painlessly as possible:
+For this to work as *painlessly as possible* for everyone involved:

-  1. Fork Infix to your own user or organization[^1]
-  2. Fork all the Infix submodules, e.g., `kernelkit/buildroot` to your
-     own user or organization as well
-  3. Clone your fork of Infix to your laptop/workstation
-
-If you use a GitHub organization you get the added benefit of having
-local peer reviews of changes before making a pull request to the
-upstream Infix repository.
+ 1. Fork Infix to your own user or organization[^1]
+ 2. Fork all the Infix submodules, e.g., `kernelkit/buildroot` to your
+    own user or organization as well
+ 3. Clone your fork of Infix to your laptop/workstation
+ 4. [Deactivate the Actions][6] you don't want in your fork
+ 5. Please read the [Contributing Guidelines][5] as well!

 ```bash
 $ cd ~/Projects
@@ -190,10 +225,10 @@ $ git clone https://github.com/YOUR_USER_NAME/infix.git
 $ cd infix/
 $ git submodule update --init
 ```
-
 > **Note:** when updating/synchronizing with upstream Infix changes you
 > may have to synchronize your forks as well.  GitHub have a `Sync fork`
-> button in the GUI for your fork for this purpose.
+> button in the GUI for your fork for this purpose.  A cronjob on your
+> server of choice can do this for you with the [GitHub CLI tool][7].

 [^1]: Organizations should make sure to lock the `main` (or `master`)
    branch of their clones to ensure members do not accidentally merge
@@ -206,3 +241,6 @@ $ git submodule update --init
 [2]: https://github.com/wkz/qeneth
 [3]: https://netopeer.liberouter.org/doc/sysrepo/master/html/dev_guide.html
 [4]: https://buildroot.org/downloads/manual/manual.html#_developer_guide
+[5]: https://github.com/kernelkit/infix/blob/main/.github/CONTRIBUTING.md
+[6]: https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-workflow-runs/disabling-and-enabling-a-workflow
+[7]: https://cli.github.com/
@@ -15,7 +15,8 @@ managing entire fleets of installed equipment.
 Nevertheless, when it comes to initial deployment and debugging, it
 is very useful to know how to navigate and use the CLI.

-> Proceed to the [CLI User Guide](cli/tutorial.md).
+> Proceed to the [CLI Introduction](cli/introduction.md) or [CLI
+> Configuration Tutorial](cli/configure.md).


 ## Key Concepts
@@ -62,9 +63,11 @@ The system has several datastores (or files):
   configure context.  Any changes made here can be discarded (`abort`,
   `rollback`) or committed (`commit`, `leave`) to `running-config`.

-> See the [Branding & Releases](branding.md) for information on how
-> `factory-config` and `failure-config` can be adapted to different
-> customer requirements.
+> Please see the [Branding & Releases](branding.md) document for more
+> in-depth information on how `factory-config` and `failure-config` can
+> be adapted to different customer requirements.  Including how you can
+> override the generated versions of these files with plain per-product
+> ones -- this may even protect against some of the failure modes below.


 ## System Boot
@@ -90,7 +93,8 @@ password in VPD, are detailed later in this section.
    there is a working fail safe, or rather *fail secure*, mode
 4. On first power-on, and after a factory reset, the system does not
    have a `startup-config`, in which case `factory-config` is copied
-    to `startup-config`
+    to `startup-config` -- if a per-product specific version exists it
+    is preferred over the generated one
 5. Provided the integrity of the `startup-config` is OK, a system
    service loads and activates the configuration

@@ -123,13 +127,17 @@ syntax, failed validation against the system's YANG model, or a bug in
 the system's `confd` service, the *Fail Secure Mode* is triggered and
 `failure-config` is loaded (unless VPD Failure, see above).

+> Again, please see the [Branding & Releases](branding.md) document for
+> how to provide a per-product hard-coded `failure-config` to suit your
+> products preferences.
+
 *Fail Secure Mode* is a fail-safe mode provided for debugging the
-system.  The default[^3] is isolated interfaces with communication only to
-the management CPU, SSH and console login using the device's factory
-reset password, IP connectivity only using IPv6 link-local, and device
-discovery protocols: LLDP, mDNS-SD.  The login and shell prompt are set
-to `failure-c0-ff-ee`, the last three octets of the device's base MAC
-address.
+system.  The default[^3] creates a setup of isolated interfaces with
+communication only to the management CPU, SSH and console login using
+the device's factory reset password, IP connectivity only using IPv6
+link-local, and device discovery protocols: LLDP, mDNS-SD.  The login
+and shell prompt are set to `failure-c0-ff-ee`, the last three octets of
+the device's base MAC address.

 [^1]: YANG is a modeling language from IETF, replacing that used for
    SNMP (MIB), used to describe the subsystems and properties of
@@ -14,18 +14,47 @@ Infix to exploit the unique features not available in IEEE models.

 ## Interface LEGO®

+The network building blocks available in Linux are akin to the popular
+LEGO® bricks.
+
 ![Linux Networking Blocks](img/lego.svg)

+There are two types of relationships that can link two blocks together:
+
+  1. **Lower-to-upper**: Visually represented by an extruding square
+     connected upwards to a square socket.  An interface _can only have
+     a single_ lower-to-upper relationship, i.e., it can be attached to
+     a single upper interface like a bridge or a LAG.  In `iproute2`
+     parlance, this corresponds to the interface's `master` setting
+  2. **Upper-to-lower**: Visually represented by an extruding semicircle
+     connected downwards to a semicircle socket.  The lower interface in
+     these relationships _accepts multiple_ upper-to-lower relationships
+     from different upper blocks.  E.g., multiple VLANs and IP address
+     blocks can be connected to the same lower interface
+
+![Stacking order dependencies](img/lego-relations.svg)
+
+An interface may simultaneously have a _lower-to-upper_ relation to some
+other interface, and be the target of one or more _upper-to-lower_
+relationships.  It is valid, for example, for a physical port to be
+attached to a bridge, but also have a VLAN interface stacked on top of
+it.  In this example, traffic assigned to the VLAN in question would be
+diverted to the VLAN interface before entering the bridge, while all
+other traffic would be bridged as usual.
+
 | **Type** | **Yang Model**             | **Description**                                               |
-| -------- | -----------------          | ------------------------------------------------------------- |
+|----------|----------------------------|---------------------------------------------------------------|
 | bridge   | infix-if-bridge            | SW implementation of an IEEE 802.1Q bridge                    |
 | ip       | ietf-ip, infix-ip          | IP address to the subordinate interface                       |
 | vlan     | infix-if-vlan              | Capture all traffic belonging to a specific 802.1Q VID        |
 | lag[^1]  | infix-if-lag               | Bonds multiple interfaces into one, creating a link aggregate |
 | lo       | ietf-interfaces            | Software loopback interface                                   |
-| eth      | ietf-interfaces,           | Physical Ethernet device/port                                 |
-|          | ieee802-ethernet-interface |                                                               |
+| eth      | ieee802-ethernet-interface | Physical Ethernet device/port.                                |
+|          | infix-ethernet-interface   |                                                               |
 | veth     | infix-if-veth              | Virtual Ethernet pair, typically one end is in a container    |
+| *common* | ietf-interfaces,           | Properties common to all interface types                      |
+|          | infix-interfaces           |                                                               |
+

 ## Data Plane

@@ -50,6 +79,69 @@ possible to share with a container.  Meaning, all the building blocks
 used on the left hand side can also be used freely on the right hand
 side as well.

+
+### General
+
+General interface settings include `type`, `enable`, custom MAC address,
+and text `description`.  Other settings have their own sections, below.
+
+The `type` is important to set when configuring devices remotely because
+unlike the CLI, a NETCONF or RESTCONF session cannot guess the interface
+type for you.  The operating system provides an override of the
+available interface types.
+
+An `enabled` interface can be inspected using the operational datastore,
+nodes `admin-state` and `oper-state` show the status, .  Possible values
+are listed in the YANG model.
+
+The `custom-phys-address` can be used to set an interface's MAC address.
+This is an extension to the ietf-interfaces YANG model, which defines
+`phys-address` as read-only[^4].  The following shows the different
+configuration options.
+
+The `description` is saved as Linux `ifalias` on an interface.  It is a
+free-form string, useful for describing purpose or just adding comments
+for remote debugging, e.g., using the operational datastore.
+
+> **Note:** there is no validation or safety checks performed by the
+> system when using `custom-phys-address`.  In particular the `offset`
+> variant can be dangerous to use -- pay attention to the meaning of
+> bits in the upper-most octet: local bit, multicast/group, etc.
+
+#### Fixed custom MAC
+
+```
+admin@example:/config/> edit interface veth0a
+admin@example:/config/interface/veth0a/> set custom-phys-address static 00:ab:00:11:22:33
+
+=> 00:ab:00:11:22:33
+```
+
+#### Chassis MAC
+
+Chassis MAC, sometimes also referred to as base MAC.  In these two
+examples it is `00:53:00:c0:ff:ee`.
+
+```
+admin@example:/config/> edit interface veth0a
+admin@example:/config/interface/veth0a/> set custom-phys-address chassis
+
+=> 00:53:00:c0:ff:ee
+```
+
+#### Chassis MAC, with offset
+
+When constructing a derived address it is recommended to set the locally
+administered bit.  Same chassis MAC as before.
+
+```
+admin@example:/config/> edit interface veth0a
+admin@example:/config/interface/veth0a/> set custom-phys-address chassis offset 02:00:00:00:00:02
+
+=> 02:53:00:c0:ff:f0
+```
+
+
 ### Bridging

 This is the most central part of the system.  A bridge is a switch, and
@@ -57,6 +149,8 @@ a switch is a bridge.  In Linux, setting up a bridge with ports
 connected to physical switch fabric, means you manage the actual switch
 fabric!

+#### MAC Bridge
+
 In Infix ports are by default not switch ports, unless the customer
 specific factory config sets it up this way.  To enable switching
 between ports you create a bridge and then add ports to that
@@ -79,6 +173,13 @@ Here we add two ports to bridge `br0`: `eth0` and `eth1`.
 > Other "magic" names are `ethN.M` for VLAN M on top of `ethN`, or
 > `dockerN` to create an IP masquerading container bridge.

+![A MAC bridge with two ports](img/mac-bridge.svg)
+
+It is possible to create multiple MAC bridges, however, it is
+currently[^5] _not recommended_ to use more than one MAC bridge on
+products with Marvell LinkStreet switching ASICs. A VLAN filtering
+bridge should be used instead.
+
 #### VLAN Filtering Bridge

 By default bridges in Linux do not filter based on VLAN tags.  It can be
@@ -92,7 +193,7 @@ admin@example:/config/> edit interface br0
 admin@example:/config/interface/br0/> up
 admin@example:/config/> set interface eth0 bridge-port bridge br0
 admin@example:/config/> set interface eth0 bridge-port pvid 10
-admin@example:/config interface eth1 bridge-port bridge br0
+admin@example:/config/> set interface eth1 bridge-port bridge br0
 admin@example:/config/> set interface eth1 bridge-port pvid 20
 admin@example:/config/> edit interface br0
 admin@example:/config/interface/br0/> set bridge vlans vlan 10 untagged eth0
@@ -103,6 +204,8 @@ This sets `eth0` as an untagged member of VLAN 10 and `eth1` as an
 untagged member of VLAN 20.  Switching between these ports is thus
 prohibited.

+![A VLAN bridge with two VLANs](img/vlan-bridge.svg)
+
 To terminate a VLAN in the switch itself, either for switch management
 or for routing, the bridge must become a (tagged) member of the VLAN.

@@ -115,6 +218,7 @@ admin@example:/config/interface/br0/> set bridge vlans vlan 20 tagged br0
 > on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
 > below for more on this topic.

+
 #### Multicast Filtering and Snooping

 Multicast filtering in the bridge is handled by the bridge itself.  It
@@ -329,7 +433,7 @@ top of a bridge interface *br0* is named *vlan10*.
 #### Ethernet Settings and Status

 Physical Ethernet interfaces provide low-level settings for speed/duplex as
-well as packet status and statistics (*ieee802-ethernet-interface.yang*).
+well as packet status and [statistics](#ethernet-statistics).

 By default, Ethernet interfaces defaults to auto-negotiating
 speed/duplex modes, advertising all speed and duplex modes available.
@@ -411,7 +515,7 @@ require auto-negotiation to be enabled.

 #### Ethernet statistics

-Ethernet packet statistics can be listed as shown below.
+Ethernet packet statistics[^6] can be listed as shown below.

 ```
 admin@example:/> show interfaces name eth1
@@ -499,6 +603,9 @@ Multiple address assignment methods are available:
 | link-local | infix-ip          | Auto-assignment of IPv4 address in 169.254.x.x/16 range        |
 | dhcp       | infix-dhcp-client | Assignment of IPv4 address by DHCP server, e.g., *10.0.1.1/24* |

+> **Note:** DHCP address method is only available for *LAN* interfaces
+> (Ethernet, virtual Ethernet (veth), bridge, link aggregates, etc.)
+
 Supported DHCP (request) options, configurability (Cfg) and defaults,
 are listed below.  Configurable options can be disabled on a per client
 interface basis, some options, like `clientid` and option 81, are
@@ -524,8 +631,16 @@ possible to set the value of as well.
 **Default:** `router`, `dns`, `domain`, `broadcast`, `ntpsrv`, `search`,
             `address`, `staticroutes`, `msstaticroutes`

-> **Note:** DHCP address method is only available for *LAN* interfaces
-> (Ethernet, virtual Ethernet (veth), bridge, link aggregates, etc.)
+When configuring a DHCP client, ensure that the NTP client is enabled
+for the `ntpsrv` DHCP option to be processed correctly. If the NTP
+client is not enabled, any NTP servers provided by the DHCP server will
+be ignored. For details on how to enable the NTP client, see the 
+[NTP Client Configuration](system.md#ntp-client-configuration) section.
+
+> **Note:** as per [RFC3442][4], if the DHCP server returns both a
+> Classless Static Routes option (121) and Router option (3), the
+> DHCP client *must* ignore the latter.
+

 ### IPv6 Address Assignment

@@ -598,6 +713,13 @@ As shown, the link-local IPv4 address is configured with `set autconf
 enabled true`.  The resulting address (169.254.1.3/16) is of type
 *random* ([ietf-ip.yang][2]).

+The IPv4LL client also supports a `request-address` setting which can be
+used to "seed" the client's starting address.  If the address is free it
+will be used, otherwise it falls back to the default algorithm.
+
+    admin@example:/config/interface/eth0/ipv4/> set autoconf request-address 169.254.1.2
+
+
 #### Use of DHCP for IPv4 address assignment

 ![Using DHCP for IPv4 address assignment](img/ip-address-example-ipv4-dhcp.svg)
@@ -657,6 +779,7 @@ admin@example:/>
                    ipv6                   ::1/128 (static)
    admin@example:/>

+
 #### Stateless Auto-configuration of Global IPv6 Address

 ![Auto-configuration of global IPv6](img/ip-address-example-ipv6-auto-global.svg)
@@ -693,6 +816,7 @@ below.
                    ipv6                   ::1/128 (static)
    admin@example:/>

+
 #### Random Link Identifiers for IPv6 Stateless Autoconfiguration

 ![Auto-configuration of global IPv6](img/ip-address-example-ipv6-auto-global.svg)
@@ -731,9 +855,11 @@ possible to specify use of a random identifier ([ietf-ip.yang][2] and
 Both the link-local address (fe80::) and the global address (2001:)
 have changed type to *random*.

+
 ### IPv4 forwarding
+
 To be able to route (static or dynamic) on the interface it is
-required to enable forwarding. This setting controlls if packets
+required to enable forwarding. This setting controls if packets
 received on this interface can be forwarded.
   ```
   admin@example:/config/> edit interface eth0
@@ -742,17 +868,19 @@ received on this interface can be forwarded.
   admin@example:/>
   ```

+
 ### IPv6 forwarding
+
 This flag behaves totally different than for IPv4. For IPv6 the
 ability to route between interfaces is always enabled, instead this
 flag controls if the interface will be in host/router mode.

-| **Feature**                               | **Forward enabled** | **Forward disabled** |
-|:------------------------------------------|:--------------------|:---------------------|
-| IsRouter set in Neighbour Advertisements. | Yes                 | No                   |
-| Transmit Router Solicitations.            | No                  | Yes                  |
-| Router Advertisements are ignored         | No                  | Yes                  |
-| Accept Redirects                          | No                  | Yes                  |
+| **Feature**                              | **Forward enabled** | **Forward disabled** |
+|:-----------------------------------------|:--------------------|:---------------------|
+| IsRouter set in Neighbour Advertisements | Yes                 | No                   |
+| Transmit Router Solicitations            | No                  | Yes                  |
+| Router Advertisements are ignored        | No                  | Yes                  |
+| Accept Redirects                         | No                  | Yes                  |

   ```
   admin@example:/config/> edit interface eth0
@@ -760,18 +888,36 @@ flag controls if the interface will be in host/router mode.
   admin@example:/config/interface/eth0/> leave
   admin@example:/>
   ```
+
+
 ## Routing support

-| **Yang Model**            | **Description**                                                                       |
-|:--------------------------|:--------------------------------------------------------------------------------------|
-| ietf-routing              | Base model, used to set configuration and read operational status in the other models |
-| ietf-ipv4-unicast-routing | Static IPv4 unicast routing                                                           |
-| ietf-ipv6-unicast-routing | Static IPv6 unicast routing                                                           |
-| ietf-ospf                 | OSPF routing                                                                          |
-| infix-routing             | Infix deviations                                                                      |
+Currently supported YANG models:
+
+| **YANG Model**            | **Description**                 |
+|:--------------------------|:--------------------------------|
+| ietf-routing              | Base model for all other models |
+| ietf-ipv4-unicast-routing | Static IPv4 unicast routing     |
+| ietf-ipv6-unicast-routing | Static IPv6 unicast routing     |
+| ietf-ospf                 | OSPF routing                    |
+| infix-routing             | Infix deviations and extensions |
+
+The base model, ietf-routing, is where all the other models hook in.  It
+is used to set configuration and read operational status (RIB tables) in
+the other models.
+
+> **Note:** the standard IETF routing models allows multiple instances,
+> but Infix currently *only support one instance* per routing protocol!
+> In the examples presented here, the instance name `default` is used.
+

 ### IPv4 Static routes
-Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the interfaces.
+
+The standard IETF model for static routes reside under the `static`
+control plane protocol.  For our examples we use the instance name
+`default`, you can use any name.
+
+For a route with destination 192.168.200.0/24 via 192.168.1.1:

    admin@example:/> configure
    admin@example:/config/> edit routing control-plane-protocol static name default
@@ -779,7 +925,18 @@ Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the interfaces.
    admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
    admin@example:/>

-> **Note:** You can only have one instance per routing protocol.
+For a "floating" static route with destination 10.0.0.0/16 via a backup
+router 192.168.1.1, using the highest possible distance:
+
+    admin@example:/> configure
+    admin@example:/config/> edit routing control-plane-protocol static name default
+    admin@example:/config/routing/control-plane-protocol/static/name/default/> set ipv4 route 10.0.0.0/16 next-hop next-hop-address 192.168.1.1 route-preference 254
+    admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
+    admin@example:/>
+
+> Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the
+> interfaces you want to route between.
+

 ### IPv6 Static routes

@@ -789,24 +946,25 @@ Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the interfaces.
    admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
    admin@example:/>

-> **Note:** You can only have one instance per routing protocol.

 ### OSPFv2 Routing
-Infix supports OSPF dynamic routing for IPv4, i.e., OSPFv2.
-Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the
-interfaces you want to run OSPFv2.
+
+The system supports OSPF dynamic routing for IPv4, i.e., OSPFv2.  To
+enable OSPF and set one active interface in area 0:

    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.0 interface e0 enabled true
+    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.0 interface e0 enabled
    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
    admin@example:/>

-> **Note:** You can only have one instance per routing protocol.
+> Remember to enable [IPv4 forwarding](#IPv4-forwarding) for all the
+> interfaces you want to route between.
+

 #### OSPF area types
-In addition to *regular* OSPF areas, area types *NSSA* and *Stub* are supported.

-To configure a NSSA area with summary routes:
+In addition to *regular* OSPF areas, area types *NSSA* and *Stub* are
+also supported.  To configure an NSSA area with summary routes:

    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.1 area-type nssa-area
@@ -814,8 +972,10 @@ To configure a NSSA area with summary routes:
    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
    admin@example:/>

+
 #### Bidirectional Forwarding Detection (BFD)
-It is possible to enable BFD per interface to speed up detection of
+
+It is possible to enable BFD per OSPF interface to speed up detection of
 link loss.

    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
@@ -823,12 +983,13 @@ link loss.
    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
    admin@example:/>

+
 #### OSPF interface settings

 We have already seen how to enable OSPF per interface (*enabled true*)
-and BFD for OSPF per interface (*bfd enabled true*). These and other
-OSPF interface settings are done in context of an OSFP area, e.g.,
-*area 0.0.0.0*. Available commands can be listed using the `?` mark.
+and BFD for OSPF per interface (*bfd enabled true*).  These and other
+OSPF interface settings are done in context of an OSFP area, e.g., *area
+0.0.0.0*.  Available commands can be listed using the `?` mark.

    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> edit ospf area 0.0.0.0
    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/> edit interface e0
@@ -870,47 +1031,113 @@ routes`.

 ### View routing table

-The routing table can be viewed from the operational datastore over
-NETCONF or using the CLI:
+The routing table can be inspected from the operational datastore, XPath
+`/routing/ribs`, using sysrepocfg, NETCONF/RESTCONF, or using the CLI.
+

 #### IPv4 routing table

-    admin@example:/> show routes ipv4
-    PREFIX                        NEXT-HOP                      PREF  PROTOCOL
-    192.168.1.0/24                e0                                  kernel
-    192.168.200.0/24              192.168.1.1                     20  static
+This CLI example shows the IPv4 routing table with a few connected
+routes and some routes learned from OSPF.  See the next section for
+an explanation of route preferences (PREF).
+
+The `>` at the start of a line marks a selected route (in the IETF YANG
+model referred to as *active*), if there are more than one route with
+the same destination the `*` marks the next-hop used and installed in
+the kernel FIB (the YANG model refers to this as *installed*).
+
+    admin@example:/> show ip route
+       DESTINATION            PREF NEXT-HOP         PROTO     UPTIME
+    >* 0.0.0.0/0             110/2 10.0.23.1        ospfv2   4h2m43s
+    >* 10.0.0.1/32        110/4000 10.0.13.1        ospfv2   4h2m43s
+       10.0.0.3/32           110/0 lo               ospfv2   4h2m57s
+    >* 10.0.0.3/32             0/0 lo               direct   4h2m58s
+       10.0.13.0/30       110/2000 e5               ospfv2   4h2m57s
+    >* 10.0.13.0/30            0/0 e5               direct   4h2m58s
+       10.0.23.0/30          110/1 e6               ospfv2   4h2m57s
+    >* 10.0.23.0/30            0/0 e6               direct   4h2m58s
+       192.168.3.0/24        110/1 e2               ospfv2   4h2m57s
+    >* 192.168.3.0/24          0/0 e2               direct   4h2m58s
    admin@example:/>

+
 #### IPv6 routing table

-    admin@example:/> show routes ipv6
-    PREFIX                        NEXT-HOP                      PREF  PROTOCOL
-    2001:db8:3c4d:50::/64         eth4                           256  kernel
-    fe80::/64                     eth5                           256  kernel
-    fe80::/64                     eth3                           256  kernel
-    fe80::/64                     eth1                           256  kernel
-    fe80::/64                     eth0                           256  kernel
-    fe80::/64                     eth2                           256  kernel
-    fe80::/64                     eth4                           256  kernel
+This CLI example show the IPv6 routing table.
+
+    admin@example:/> show ipv6 route
+       DESTINATION                      PREF NEXT-HOP              PROTO     UPTIME
+    >* ::/0                              1/0 2001:db8:3c4d:50::1   static   0h1m20s
+    >* 2001:db8:3c4d:50::/64             0/0 e6                    direct   0h1m20s
+    >* 2001:db8:3c4d:200::1/128          0/0 lo                    direct   0h1m20s
+     * fe80::/64                         0/0 e7                    direct   0h1m20s
+     * fe80::/64                         0/0 e6                    direct   0h1m20s
+     * fe80::/64                         0/0 e5                    direct   0h1m20s
+     * fe80::/64                         0/0 e4                    direct   0h1m20s
+     * fe80::/64                         0/0 e3                    direct   0h1m20s
+     * fe80::/64                         0/0 e2                    direct   0h1m20s
+    >* fe80::/64                         0/0 e1                    direct   0h1m20s
    admin@example:/>

+
+#### Route Preference
+
+The operating system leverages FRRouting ([Frr][0]) as routing engine
+for both static and dynamic routing.  Even routes injected from a DHCP
+client, and IPv4 link-local (IPv4) routes, are injected into Frr to let
+it weigh all routes before installing them into the kernel routing table
+(sometimes referred to as FIB).
+
+Routes have different weights made up from a *distance* and a *metric*.
+The kernel routing table only talks about *metric*, which unfortunately
+is **not the same** -- this is one of the reasons why the term *route
+preference* is used instead.  It is recommended to use the CLI, or any
+of the other previously mentioned YANG based front-ends, to inspect the
+routing table.
+
+Default distances used (lower numeric value wins):
+
+| **Distance** | **Protocol**                            |
+|--------------|-----------------------------------------|
+| 0            | Kernel routes, i.e., connected routes   |
+| 1            | Static routes                           |
+| 5            | DHCP routes                             |
+| 110          | OSPF                                    |
+| 254          | IPv4LL (ZeroConf) device routes         |
+| 255          | Route will not be used or redistributed |
+
+Hence, a route learned from OSPF may be overridden by a static route set
+locally.  By default, even a route to the same destination, but with a
+different next-hop, learned from a DHCP server wins over an OSPF route.
+
+The distance used for static routes and DHCP routes can be changed by
+setting a different *routing preference* value.
+
+> **Note:** the kernel metric is an unsigned 32-bit value, which is read
+> by Frr as (upper) 8 bits distance and 24 bits metric.  But it does not
+> write it back to the kernel FIB this way, only selected routes are
+> candidates to be installed in the FIB by Frr.
+
+
 #### Source protocol

 The source protocol describes the origin of the route.

-| **Protocol** | **Description**                                                      |
-|:-------------|:---------------------------------------------------------------------|
-| kernel       | Added when setting a subnet address on an interface                  |
-| static       | User created static routes                                           |
-| dhcp         | Routes retrieved from DHCP                                           |
-| ospf         | Routes retreived from OSPFv2                                         |
+| **Protocol** | **Description**                                     |
+|:-------------|:----------------------------------------------------|
+| kernel       | Added when setting a subnet address on an interface |
+| static       | User created, learned from DHCP, or IPv4LL          |
+| ospfv2       | Routes learned from OSPFv2                          |

 The YANG model *ietf-routing* support multiple ribs but only two are
 currently supported, namely `ipv4` and `ipv6`.

+
 [1]: https://www.rfc-editor.org/rfc/rfc8343
 [2]: https://www.rfc-editor.org/rfc/rfc8344
 [3]: https://www.rfc-editor.org/rfc/rfc8981
+[4]: https://www.rfc-editor.org/rfc/rfc3442
+[0]: https://frrouting.org/

 [^1]: Please note, link aggregates are not yet supported in Infix.
 [^2]: Link-local IPv6 addresses are implicitly enabled when enabling
@@ -920,3 +1147,14 @@ currently supported, namely `ipv4` and `ipv6`.
    mapping the low-order 23-bits of the IP address in the low-order 23
    bits of the Ethernet address 01:00:5E:00:00:00.  Meaning, more than
 	one IP multicast group maps to the same MAC multicast group.
+[^4]: A YANG deviation was previously used to make it possible to set
+    `phys-address`, but this has been replaced with the more flexible
+	`custom-phys-address`.
+[^5]: Infix MAC bridges on Marvell Linkstreet devices are currently
+    limited to use a single MAC database, causing issues if the same
+    MAC address appears on different MAC bridges.
+[^6]: Ethernet counters are described in
+    *ieee802-ethernet-interface.yang* and
+    *infix-ethernet-interface.yang*. [Ethernet
+    Counters](eth-counters.md) page provides additional details on
+    statistics support.
@@ -12,14 +12,6 @@ packets to drop and which ones to prioritize, such that critical
 services remain operational.


-## Software Forwarded Traffic
-
-For packets which are processed by a CPU, i.e. typically routed
-traffic, and bridged traffic between interfaces that do not belong to
-the same hardware switching domain, an [nftables container][1] can be
-used to define a QoS policy.
-
-
 ## Hardware Forwarded Traffic

 The default QoS policy for flows which are offloaded to a switching
@@ -34,6 +26,14 @@ chips in this family where limited to 4 output queues per port, this
 documentation is _only_ valid for newer generations with 8 output
 queues per port.

+![Hardware offloading for Marvell Link Street](img/qos-hw-mvls.svg)
+
+The picture illustrates packets having their priority determined at
+ingress, here interface _e1_ and _e3_. In this example, both packets
+are forwarded to the same outgoing interface (_e2_), subject to output
+queueing. The sections below provides more information on these
+topics. 
+
 #### Default Policy

 ##### Queueing
@@ -54,8 +54,8 @@ significant bits of the DSCP is used to select the queue:
 |   6 | 48-55 | ⇒ |     6 |     25 |
 |   7 | 56-63 | ⇒ |     7 |     33 |

-For packets containing both a VLAN tag and an IP header, DSCP priority
-takes precedence over PCP priority. In cases where neither are
+For packets containing both a VLAN tag and an IP header, PCP priority
+takes precedence over DSCP priority. In cases where neither are
 available, packets are always assigned to queue 0.

 Each port's set of 8 egress queues operate on a Weighted Round Robin
@@ -73,6 +73,41 @@ set to the 3 most significant bits of it. If no priority information
 is available in the frame on ingress (i.e. untagged non-IP), then
 packets will egress out of tagged ports with PCP set to 0.

+## Software Forwarded Traffic
+
+For packets which are processed by a CPU, i.e. typically routed
+traffic, and bridged traffic between interfaces that do not belong to
+the same hardware switching domain, an [nftables container][1] can be
+used to define a QoS policy.
+
+For VLAN interfaces, Infix provides support for mapping the Priority
+Code Point (PCP) to internal priority on ingress, and the reverse on
+egress. 
+
+![Ingress and Egress Priority mapping for VLAN interfaces](img/qos-vlan-iface.svg)
+
+
+These `ingress-qos` and `egress-qos` settings are done per VLAN, both
+defaulting to '0'. The example below shows how to keep the PCP priority 
+for packets being routed between two VLAN interfaces.
+
+```
+admin@example:/config/> edit interface e1.10
+admin@example:/config/interface/e1.10/> set vlan ingress-qos priority from-pcp 
+admin@example:/config/interface/e1.10/> up
+admin@example:/config/> edit interface e1.20
+admin@example:/config/interface/e1.20/> set vlan egress-qos pcp from-priority 
+admin@example:/config/interface/e1.20/> leave
+admin@example:/> 
+```
+
+## A complex example
+
+The picture below shows a packet flow being subject both to software
+forwarding and hardware offloading.
+
+![Hardware and Software QoS Handling](img/qos-complex.svg)
+

 [1]: container.md#application-container-nftables
 [2]: https://en.wikipedia.org/wiki/IEEE_802.1Q
@@ -145,7 +145,7 @@ is committed by issuing the `leave` command.
 admin@host:/config/> edit system
 admin@host:/config/system/> set hostname example
 admin@host:/config/system/> leave
-admin@example:/> 
+admin@host:/> 
 ```

 The hostname is advertised over mDNS-SD in the `.local` domain.  If
@@ -201,6 +201,82 @@ admin@host:/>
 > and then re-enter configure context to use your editor of choice.


+## NTP Client Configuration
+
+Below is an example configuration for enabling NTP 
+with a specific server and the `iburst` option for faster initial 
+synchronization.
+
+```
+admin@host:/> configure
+admin@host:/config/> set system ntp enabled
+admin@host:/config/> set system ntp server ntp-pool
+admin@host:/config/> set system ntp server ntp-pool udp address pool.ntp.org
+admin@host:/config/> set system ntp server ntp-pool iburst
+admin@host:/config/> set system ntp server ntp-pool prefer
+```
+
+This configuration enables the NTP client and sets the NTP server to 
+`pool.ntp.org` with the `iburst` and `prefer` options. The `iburst` 
+option ensures faster initial synchronization, and the `prefer` option 
+designates this server as preferred.
+
+* `prefer false`: The NTP client will choose the best available source
+based on several factors, such as network delay, stratum, and other 
+metrics (default config).
+* `prefer true`: The NTP client will try to use the preferred server 
+as the primary source unless it becomes unreachable or unusable.
+
+### Show NTP Status
+
+To check the status of NTP synchronization, use the following command:
+
+```
+admin@host:/> show ntp
+Reference ID    : C0248F86 (192.36.143.134)
+Stratum         : 2
+Ref time (UTC)  : Mon Oct 21 10:06:45 2024
+System time     : 0.000000001 seconds slow of NTP time
+Last offset     : -3845.151367188 seconds
+RMS offset      : 3845.151367188 seconds
+Frequency       : 4.599 ppm slow
+Residual freq   : +1293.526 ppm
+Skew            : 12.403 ppm
+Root delay      : 1.024467230 seconds
+Root dispersion : 0.273462683 seconds
+Update interval : 0.0 seconds
+Leap status     : Normal
+admin@host:/>
+```
+
+This output provides detailed information about the NTP status, including 
+reference ID, stratum, time offsets, frequency, and root delay.
+
+### Show NTP Sources
+
+To view the sources being used by the NTP client, run:
+
+```
+admin@host:/> show ntp sources 
+
+  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
+ / .- Source state '*' = current best, '+' = combined, '-' = not combined,
+| /             'x' = may be in error, '~' = too variable, '?' = unusable.
+||                                                 .- xxxx [ yyyy ] +/- zzzz
+||      Reachability register (octal) -.           |  xxxx = adjusted offset,
+||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
+||                                \     |          |  zzzz = estimated error.
+||                                 |    |           \
+MS Name/IP address         Stratum Poll Reach LastRx Last sample               
+===============================================================================
+^* 192.36.143.134                1   6   177     9   +278ms[ -3845s] +/-  514ms
+admin@host:/>
+```
+
+> The system uses `chronyd` for Network Time Protocol (NTP)
+> synchronization. The output shown here is best explained in the
+> [Chrony documentation](https://chrony-project.org/doc/4.6.1/chronyc.html).
+
 [1]: https://www.rfc-editor.org/rfc/rfc7317
 [2]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-system%402024-02-29.yang
 [3]: https://www.rfc-editor.org/rfc/rfc8341
@@ -17,7 +17,7 @@ Tenets
  It is also much more practical and economical to build large virtual
  networks than physical ones.

- **Avoid CLI scipting & scraping**.  Reliably interacting with a DUT
+- **Avoid CLI scripting & scraping**.  Reliably interacting with a DUT
  over a serial line in a robust way is _very_ hard to get right.
  Given that we have a proper API (RESTCONF), we should leverage that
  when testing.  Front-ends can be tested by other means.
@@ -265,7 +265,7 @@ suite:
 This is useful because this value can then be used to rerun a test (or
 the whole suite) with identical topology mappings:

-    $ make PYTHONHASHSEED=3773822171 INFIX_TESTS=case/ietf_system/hostname.py test
+    $ make PYTHONHASHSEED=3773822171 TESTS=case/ietf_system/hostname.py test

 ### Deterministic Transport Protocol

@@ -274,7 +274,7 @@ chosen randomly.  If you supply a `PYTHONHASHSEED` as described above,
 you get the same protocol used for that hash.  But if you want to choose
 the protocol, add extra arguments to Infamy:

-    $ make INFAMY_EXTRA_ARGS="--transport=restconf" INFIX_TESTS=case/ietf_system/hostname.py test
+    $ make INFAMY_EXTRA_ARGS="--transport=restconf" TESTS=case/ietf_system/hostname.py test

 or, when running interactively:

@@ -282,5 +282,38 @@ or, when running interactively:
    09:08:17 infamy0:test # ./9pm/9pm.py -o"--transport=restconf" case/ietf_system/hostname.py


+### Test specification
+
+The test specification is automaticly generated from the test cases,
+this puts some constraints on the test cases:
+
+All test cases must be written so that it can be understandable with
+only the steps so the result can be reproduced manually.  E.g., instead
+of `set ip address on the interface` it should be more human readable,
+for example:
+
+```python
+test.step("Set IPv4 address on the interface dut:cross")
+test.step("Verify the IP address is set on dut:cross")
+
+```
+where dut, cross and the IPv4 address could be found inside the
+logical topology for the test.
+
+Each test case must begin with the test name followed by a empty line and
+the description of the test. For example:
+
+```
+"""
+Set hostname
+
+Verify that it it possible to change hostname
+"""
+```
+
+The test specifaction can be genererated with:
+
+	$ make test-spec
+
 [9PM]:    https://github.com/rical/9pm
 [Qeneth]: https://github.com/wkz/qeneth
@@ -1,6 +1,10 @@
 menu "Packages"
+
+source "$BR2_EXTERNAL_INFIX_PATH/package/bin/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/confd/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/confd-test-mode/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/curios-httpd/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/curios-nftables/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/execd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/gencert/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/statd/Config.in"
@@ -31,4 +35,6 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/libyang-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
+
 endmenu
@@ -0,0 +1,8 @@
+config BR2_PACKAGE_BIN
+	bool "bin"
+	select BR2_PACKAGE_SYSREPO
+	select BR2_PACKAGE_LIBITE
+	help
+	  Misc. tools for CLI and shell users.
+
+	  https://github.com/kernelkit/infix
@@ -0,0 +1 @@
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE
@@ -0,0 +1,21 @@
+################################################################################
+#
+# bin
+#
+################################################################################
+
+BIN_VERSION = 1.0
+BIN_SITE_METHOD = local
+BIN_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/bin
+BIN_LICENSE = BSD-3-Clause
+BIN_LICENSE_FILES = LICENSE
+BIN_REDISTRIBUTE = NO
+BIN_DEPENDENCIES = sysrepo libite
+BIN_CONF_OPTS = --prefix= --disable-silent-rules
+BIN_AUTORECONF = YES
+
+define BIN_CONF_ENV
+CFLAGS="$(INFIX_CFLAGS)"
+endef
+
+$(eval $(autotools-package))
@@ -0,0 +1,10 @@
+config BR2_PACKAGE_CONFD_TEST_MODE
+	bool "confd test mode"
+	depends on BR2_PACKAGE_CONFD
+	select BR2_PACKAGE_LIBITE
+	select BR2_PACKAGE_LIBYANG
+	select BR2_PACKAGE_SYSREPO
+	select BR2_PACKAGE_LIBSRX
+	help
+	  A companion plugin to confd providing functionality required to
+	  run tests with Infamy, i.e., enable Infix test mode.
@@ -0,0 +1,32 @@
+CONFD_TEST_MODE_VERSION = 1.0
+CONFD_TEST_MODE_SITE_METHOD = local
+CONFD_TEST_MODE_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/test-mode
+CONFD_TEST_MODE_LICENSE = BSD-3-Clause
+CONFD_TEST_MODE_LICENSE_FILES = LICENSE
+CONFD_TEST_MODE_REDISTRIBUTE = NO
+CONFD_TEST_MODE_DEPENDENCIES = sysrepo libite libyang confd
+CONFD_TEST_MODE_AUTORECONF = YES
+CONFD_TEST_MODE_SYSREPO_SHM_PREFIX = sr_buildroot$(subst /,_,$(CONFIG_DIR))_test_mode
+
+COMMON_SYSREPO_ENV = \
+	SYSREPO_SHM_PREFIX=$(CONFD_SYSREPO_SHM_PREFIX) \
+	SYSREPOCTL_EXECUTABLE="$(HOST_DIR)/bin/sysrepoctl" \
+	SYSREPOCFG_EXECUTABLE="$(HOST_DIR)/bin/sysrepocfg" \
+	SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/confd/"
+
+define CONFD_TEST_MODE_INSTALL_YANG_MODULES
+        $(COMMON_SYSREPO_ENV) \
+        SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/test-mode/" $(BR2_EXTERNAL_INFIX_PATH)/utils/sysrepo-load-modules.sh $(@D)/yang/test-mode.inc
+endef
+define CONFD_TEST_MODE_PERMISSIONS
+	/etc/sysrepo/data/ r 660 root wheel - - - - -
+	/etc/sysrepo/data  d 770 root wheel - - - - -
+endef
+define CONFD_TEST_MODE_CLEANUP
+        rm -f /dev/shm/$(CONFD_TEST_MODE_SYSREPO_SHM_PREFIX)*
+endef
+
+CONFD_TEST_MODE_PRE_INSTALL_TARGET_HOOKS += CONFD_TEST_MODE_CLEANUP
+CONFD_TEST_MODE_POST_INSTALL_TARGET_HOOKS += CONFD_TEST_MODE_INSTALL_YANG_MODULES
+
+$(eval $(autotools-package))
@@ -12,20 +12,20 @@ service name:confd log:prio:daemon.err <run/bootstrap/success> \
 	-- Configuration daemon

 # Bootstrap system with startup-config
-run name:startup log:prio:user.notice norestart <pid/confd> \
-	[S] /usr/libexec/confd/load startup-config \
+run name:startup log:prio:user.notice norestart <pid/confd> env:/etc/default/confd \
+	[S] /usr/libexec/confd/load -t $CONFD_TIMEOUT startup-config \
 	-- Loading startup-config

 # Run if loading startup-config fails for some reason
-run name:failure log:prio:user.critical norestart <pid/confd> if:<run/startup/failure> \
-	[S] /usr/libexec/confd/load failure-config \
+run name:failure log:prio:user.critical norestart <pid/confd> env:/etc/default/confd if:<run/startup/failure> \
+	[S] /usr/libexec/confd/load -t $CONFD_TIMEOUT failure-config \
 	-- Loading failure-config

 run name:error :2 log:console norestart if:<run/failure/failure> \
 	[S] /usr/libexec/confd/error --

-service name:netopeer notify:none log <pid/confd> \
-	[12345] netopeer2-server -F -t 60 -v 1 \
+service name:netopeer notify:none log <pid/confd> env:/etc/default/confd \
+	[12345] netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
 	-- NETCONF server

 # Create initial /etc/resolv.conf after successful bootstrap
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CONFD_VERSION = 1.0
+CONFD_VERSION = 1.2
 CONFD_SITE_METHOD = local
 CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
 CONFD_LICENSE = BSD-3-Clause
@@ -2,8 +2,8 @@ config BR2_PACKAGE_CURIOS_HTTPD
 	bool "curiOS-httpd"
 	help
 	  Example of how to bundle an OCI archive of curiOS-httpd in
-	  /lib/oci for the given target architecture.  OCI archives
-	  can also be bundled in post-build.sh, but with packaging
-	  the "source" is bundled in SDK builds.
+	  /lib/oci for the given target architecture.  OCI archives can
+	  also be bundled in post-build.sh, but with packaging all the
+	  "source" tarballs are bundled for SDK builds (archiving).

 	  https://github.com/kernelkit/curiOS
@@ -9,11 +9,11 @@ CURIOS_HTTPD_SOURCE = curios-httpd-oci-$(GO_GOARCH)-$(CURIOS_HTTPD_VERSION).tar.
 CURIOS_HTTPD_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_HTTPD_VERSION)
 CURIOS_HTTPD_LICENSE = GPL
 CURIOS_HTTPD_LICENSE_FILES = COPYING
-CURIOS_HTTPD_INSTALL_TARGET = YES

 define CURIOS_HTTPD_INSTALL_TARGET_CMDS
 	mkdir -p $(TARGET_DIR)/lib/oci
-	(cd $(@D)/.. && $(TAR) cfz $(TARGET_DIR)/lib/oci/$(notdir $(@D)).tar.gz $(notdir $(@D)))
+	cp $(CURIOS_HTTPD_DL_DIR)/$(CURIOS_HTTPD_SOURCE) \
+		$(TARGET_DIR)/lib/oci/$(notdir $(@D)).tar.gz
 endef

 $(eval $(generic-package))
@@ -0,0 +1,9 @@
+config BR2_PACKAGE_CURIOS_NFTABLES
+	bool "curiOS-nftables"
+	help
+	  Example of how to bundle an OCI archive of curiOS-nftables in
+	  /lib/oci for the given target architecture.  OCI archives can
+	  also be bundled in post-build.sh, but with packaging all the
+	  "source" tarballs are bundled for SDK builds (archiving).
+
+	  https://github.com/kernelkit/curiOS
@@ -0,0 +1,4 @@
+# Locally computed
+sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
+sha256  f25651505bf4fc635dc8d391f377b1116837e99dee522ce0691c15b090cee818  curios-nftables-oci-arm64-v24.05.0.tar.gz
+sha256  025c2a5d6c71c62ebbe6f96d8b9ffa3235d6812e87b51645f6e89357d9762669  curios-nftables-oci-amd64-v24.05.0.tar.gz
@@ -0,0 +1,20 @@
+################################################################################
+#
+# curios-nftables
+#
+################################################################################
+
+CURIOS_NFTABLES_VERSION = v24.05.0
+CURIOS_NFTABLES_SOURCE = curios-nftables-oci-$(GO_GOARCH)-$(CURIOS_NFTABLES_VERSION).tar.gz
+CURIOS_NFTABLES_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_NFTABLES_VERSION)
+CURIOS_NFTABLES_LICENSE = GPL
+CURIOS_NFTABLES_LICENSE_FILES = COPYING
+CURIOS_NFTABLES_INSTALL_TARGET = YES
+
+define CURIOS_NFTABLES_INSTALL_TARGET_CMDS
+	mkdir -p $(TARGET_DIR)/lib/oci
+	cp $(CURIOS_NFTABLES_DL_DIR)/$(CURIOS_NFTABLES_SOURCE) \
+		$(TARGET_DIR)/lib/oci/$(notdir $(@D)).tar.gz
+endef
+
+$(eval $(generic-package))
@@ -0,0 +1,29 @@
+From c8ec120afa3a66674ef30b10490eeeb36d806eed Mon Sep 17 00:00:00 2001
+From: Tomas Pecka <peckato1@fit.cvut.cz>
+Date: Fri, 17 Feb 2023 13:50:17 +0100
+Subject: [PATCH] Fix getting current timezone on ARM-based devices
+Our software using date on buildroot ARM-based device terminates with an
+uncaught exception.
+  terminate called after throwing an instance of 'std::runtime_error'
+    what():  posix/Etc/UTC not found in timezone database
+I have applied workaround from [1].
+[1] https://github.com/HowardHinnant/date/issues/252
+Bug: https://github.com/HowardHinnant/date/issues/252
+---
+ src/tz.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/src/tz.cpp b/src/tz.cpp
+index bd9fad4..eea48ce 100644
+--- a/src/tz.cpp
+++ b/src/tz.cpp
+@@ -3925,7 +3925,7 @@ sniff_realpath(const char* timezone)
+     if (realpath(timezone, rp) == nullptr)
+         throw system_error(errno, system_category(), "realpath() failed");
+     auto result = extract_tz_name(rp);
+-    return result != "posixrules";
+    return result.find("posix") == decltype(result)::npos;
+ }
+ 
+ const time_zone*
+-- 
+2.39.2
@@ -0,0 +1,6 @@
+config BR2_PACKAGE_DATE_CPP
+	bool "date-cpp"
+	help
+	  A date and time library based on the C++11/14/17 <chrono> header
+
+	  https://github.com/HowardHinnant/date
@@ -0,0 +1,3 @@
+# Locally calculated 
+sha256  c90f6c00fb961170560299cbda28ca2d45804913aa8b2a9f36dbb8e0028d6930  LICENSE.txt
+sha256  7a390f200f0ccd207e8cff6757e04817c1a0aec3e327b006b7eb451c57ee3538  date-3.0.1.tar.gz
@@ -0,0 +1,10 @@
+DATE_CPP_VERSION = 3.0.1
+DATE_CPP_SITE = $(call github,HowardHinnant,date,v$(DATE_CPP_VERSION))
+DATE_CPP_INSTALL_STAGING = YES
+DATE_CPP_LICENSE = MIT
+DATE_CPP_LICENSE_FILES = LICENSE.txt
+DATE_CPP_CONF_OPTS = \
+	 -DBUILD_TZ_LIB=ON \
+	 -DUSE_SYSTEM_TZ_DB:BOOL=ON \
+	 -DENABLE_DATE_TESTING=OFF
+$(eval $(cmake-package))
@@ -0,0 +1,67 @@
+From 46ffa81f5c88ce95db011369d8bfb802313e4217 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Thu, 17 Oct 2024 14:23:24 +0200
+Subject: [PATCH 1/6] Only mark rdeps dirty if main service is nohup
+Organization: Addiva Elektronik
+
+This patch changes a behavior that's been default since Finit 4.0,
+introduced in 4d05bf9 with 4.0-rc2.
+
+If service B depends on A and A needs to be reloaded, then B may be
+affected.  If A is declared as NOHUP <!>, then A will be stopped and
+restarted, during which time the condition it provides is removed,
+and B will also be stopped.
+
+However, and as of this patch, if A is declared supporting HUP, then the
+condition A provides will only go into flux, during which time B will be
+SIGSTOPed instead of needing to be reloaded.
+
+Fix #415
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/service.c | 8 ++++++++
+ src/svc.h     | 1 +
+ 2 files changed, 9 insertions(+)
+
+diff --git a/src/service.c b/src/service.c
+index 61be85c..b995ff4 100644
+--- a/src/service.c
+++ b/src/service.c
+@@ -2001,6 +2001,10 @@ static void svc_mark_affected(char *cond)
+  * Called on conf_reload() to update service reverse dependencies.
+  * E.g., if ospfd depends on zebra and the zebra Finit conf has
+  * changed, we need to mark the ospfd Finit conf as changed too.
+ *
+ * However, a daemon that depends on syslogd (sysklogd project), need
+ * not be reloeaded (SIGHUP'ed or stop/started) because syslogd support
+ * reloading its configuration file on SIGHUP.
+  */
+ void service_update_rdeps(void)
+ {
+@@ -2012,6 +2016,10 @@ void service_update_rdeps(void)
+ 		if (!svc_is_changed(svc))
+ 			continue;
+ 
+		/* Service supports reloading conf without stop/start  */
+		if (!svc_is_nohup(svc))
+			continue; /* Yup, no need to stop start rdeps */
+
+ 		svc_mark_affected(mkcond(svc, cond, sizeof(cond)));
+ 	}
+ }
+diff --git a/src/svc.h b/src/svc.h
+index d00ac14..e2f6bd8 100644
+--- a/src/svc.h
+++ b/src/svc.h
+@@ -259,6 +259,7 @@ static inline int svc_is_tty       (svc_t *svc) { return svc && SVC_TYPE_TTY
+ static inline int svc_is_runtask   (svc_t *svc) { return svc && (SVC_TYPE_RUNTASK & svc->type);}
+ static inline int svc_is_forking   (svc_t *svc) { return svc && svc->forking; }
+ static inline int svc_is_manual    (svc_t *svc) { return svc && svc->manual; }
+static inline int svc_is_nohup     (svc_t *svc) { return svc && (0 == svc->sighup); }
+ 
+ static inline int svc_in_runlevel  (svc_t *svc, int runlevel) { return svc && ISSET(svc->runlevels, runlevel); }
+ static inline int svc_nohup        (svc_t *svc) { return svc &&  (0 == svc->sighup || 0 != svc->args_dirty); }
+-- 
+2.43.0
+
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`sha256 d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46 LICENSE`