confd: Add support to upload images directly

This add support for upgrading images with curl only, without FTP or
similiar. The image needs to be base64 encoded.

Example:

TEMP_JSON=/tmp/restconf.txt
echo -n '{"infix-system:input":{"image":"' > "$TEMP_JSON"
base64 -w 0 "$BUNDLE_FILE" >> "$TEMP_JSON"
echo '"}}' >> "$TEMP_JSON"

curl -k \
  -X POST \
  -u "admin:admin" \
  -H "Content-Type: application/yang-data+json" \
  -H "Accept: application/yang-data+json" \
  -d @"$TEMP_JSON" \
  "https://192.168.30.1/restconf/operations/infix-system:install-bundle"

.github/SECURITY.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Infix, please use GitHub's built-in
+[Report a Vulnerability](https://github.com/kernelkit/infix/security/advisories/new)
+feature for a private and secure disclosure.
+
+When reporting, include:
+
+- A clear description of the vulnerability.
+- Steps to reproduce the issue.
+- Potential impact of the vulnerability.
+
+## Supported Versions
+
+We provide security updates only for the main branch.
+
+Individual support contracts are provided by _Wires_. See
+[Support](https://github.com/kernelkit/infix/blob/main/.github/SUPPORT.md)
+for more information.
+
+## Acknowledgments
+
+We appreciate the efforts of the security community to help improve the security
+of Infix. Thank you for your responsible disclosure.

.github/workflows/build.yml

@@ -1,26 +1,51 @@
-name: Bob the Builder
+name: Build
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches:
-      - main
   workflow_dispatch:
     inputs:
-      minimal:
+      flavor:
-        description: 'Build minimal defconfigs'
+        description: 'Optional build flavor (e.g. _minimal)'
+        required: false
+        default: ''
+        type: string
+      parallel:
+        description: 'Massive parallel build of each image'
         required: false
         default: true
         type: boolean
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        required: false
+        default: kernelkit/infix
+        type: string
+
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      flavor:
+        required: false
+        type: string
+        default: ''
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+
+env:
+  FLV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.flavor || inputs.flavor }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
 
 jobs:
   build:
-    name: Build Infix ${{ matrix.target }}
+    name: Build ${{ inputs.name }} ${{ inputs.target }}
     runs-on: [ self-hosted, latest ]
     strategy:
-      matrix:
-        target: [aarch64, x86_64]
       fail-fast: false
     outputs:
       build_id: ${{ steps.vars.outputs.INFIX_BUILD_ID }}
@@ -32,9 +57,13 @@ jobs:
           rm -rf ./.??* || true
           ls -la ./
 
-      - uses: actions/checkout@v4
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
         with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ github.ref }}
           clean: true
+          fetch-depth: 0
           submodules: recursive
 
       - name: Set Build Variables
@@ -50,26 +79,14 @@ jobs:
                   "${{ github.event.number }}" "${{ github.event.pull_request.head.sha }}" \
                   | tee -a $GITHUB_OUTPUT $GITHUB_ENV
           fi
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+
-              if [ "${{ github.event.inputs.minimal }}" == "true" ]; then
+          target=${{ inputs.target }}
-                  flavor="_minimal"
+          name=${{ inputs.name }}
-              fi
+          echo "dir=${name}-${target}"        >> $GITHUB_OUTPUT
-          else
+          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
-              # Ensure 'release' job get the proper image when building main
+          echo "flv=$FLV"              >> $GITHUB_OUTPUT
-              if [ "$GITHUB_REF_NAME" != "main" ]; then
+          echo "Building target ${target}${FLV}_defconfig"
-                  flavor="_minimal"
+
-              else
-                  flavor=""
-              fi
-              if ${{ contains(github.event.pull_request.labels.*.name, 'ci:main') }}; then
-                  flavor=""
-              fi
-          fi
-          target=${{ matrix.target }}
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-          echo "flv=$flavor"              >> $GITHUB_OUTPUT
-          echo "Building target ${target}${flavor}_defconfig"
       - name: Restore Cache of dl/
         uses: actions/cache@v4
         with:
@@ -82,23 +99,37 @@ jobs:
         uses: actions/cache@v4
         with:
           path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ inputs.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
           restore-keys: |
-            ccache-${{ matrix.target }}-
+            ccache-${{ inputs.target }}-
             ccache-
 
-      - name: Configure ${{ matrix.target }}${{ steps.vars.outputs.flv }}
+      - name: Configure ${{ inputs.target }}${{ steps.vars.outputs.flv }}
         run: |
-          make ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig
+          make ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig
 
-      - name: Unit Test ${{ matrix.target }}
+      - name: Unit Test ${{ inputs.target }}
         run: |
           make test-unit
 
-      - name: Build ${{ matrix.target }}${{ steps.vars.outputs.flv }}
+      - name: Prepare parallel build
+        id: parallel
         run: |
-          echo "Building ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
+
-          make
+          if [ "${{ ((github.event.inputs.parallel == 'true' && github.event_name == 'workflow_dispatch') || (github.ref_name != 'main' && github.event_name != 'workflow_dispatch')) }}" == "true" ]; then
+             echo "BR2_PER_PACKAGE_DIRECTORIES=y" >> output/.config
+             MAKE="make -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
+             echo "Building in parallel with -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
+          else
+             echo "Disabling parallel build"
+             MAKE="make"
+          fi
+          echo "MAKE=$MAKE" >> $GITHUB_OUTPUT
+
+      - name: Build ${{ inputs.target }}${{ steps.vars.outputs.flv }}
+        run: |
+          echo "Building ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
+          eval "${{ steps.parallel.outputs.MAKE }}"
 
       - name:  Check SBOM from Build
         run: |
@@ -119,121 +150,14 @@ jobs:
           printf "Size of output/images/: "
           ls -l output/images/
 
-      - name: Prepare ${{ matrix.target }} Artifact
+      - name: Prepare ${{ inputs.target }} Artifact
         run: |
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
-          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
       - uses: actions/upload-artifact@v4
         with:
           path: output/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ matrix.target }}
+          name: artifact-${{ inputs.target }}
-
-  test:
-    name: Regression Test of Infix x86_64
-    needs: build
-    runs-on: [ self-hosted, regression ]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          clean: true
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
-              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
-                   >>$GITHUB_ENV
-          fi
-
-          if [ "$GITHUB_REF_NAME" != "main" ]; then
-              flavor="_minimal"
-          else
-              flavor=""
-          fi
-          echo "flv=$flavor"              >> $GITHUB_OUTPUT
-
-      - name: Configure x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          make x86_64${{ steps.vars.outputs.flv }}_defconfig
-
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
-        run: |
-          ls -l
-          mkdir -p output
-          mv infix-x86_64.tar.gz output/
-          cd output/
-          tar xf infix-x86_64.tar.gz
-          ln -s infix-x86_64 images
-
-      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          make test
-
-      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: cat test/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: |
-          asciidoctor-pdf \
-          --theme test/9pm/report/theme.yml \
-          -a pdf-fontsdir=test/9pm/report/fonts \
-          test/.log/last/report.adoc \
-          -o test/.log/last/report.pdf
-
-      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-report
-          path: test/.log/last/report.pdf
-
-  release:
-    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
-    name: Upload Latest Build
-    needs: test
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
-      - uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Latest Build Complete! :rocket:
-
-          For the public download links of these build artifacts, please see:
-           <https://github.com/kernelkit/infix/releases/tag/latest>
-          EOF

.github/workflows/coverity.yml

@@ -55,7 +55,7 @@ jobs:
           sudo apt-get -y update
           sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                        libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev libite-dev
+                       libuev-dev
 
       - name: Build dependencies
         run: |
@@ -65,6 +65,8 @@ jobs:
           git clone https://github.com/sysrepo/sysrepo.git
           mkdir sysrepo/build
           (cd sysrepo/build && cmake .. && make all && sudo make install)
+          git clone https://github.com/troglobit/libite.git
+          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
           make dep
 
       - name: Check applications

.github/workflows/publish.yml

@@ -0,0 +1,43 @@
+name: Publish latest Infix
+
+on:
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  publish:
+    name: Upload Latest Build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          omitName: true
+          omitBody: true
+          omitBodyDuringUpdate: true
+          prerelease: true
+          tag: "latest"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          artifacts: "*.tar.gz*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Latest Build Complete! :rocket:
+
+          For the public download links of these build artifacts, please see:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+          EOF

.github/workflows/release.yml

@@ -85,16 +85,21 @@ jobs:
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
-          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
           mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar chfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
 
       - uses: actions/upload-artifact@v4
         with:
           name: artifact-${{ matrix.target }}
           path: output/*.tar.gz
 
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-disk-image-${{ matrix.target }}
+          path: output/images/*.qcow2
+
   release:
     name: Release Infix ${{ github.ref_name }}
     needs: build
@@ -141,6 +146,11 @@ jobs:
           for file in *.tar.gz; do
               sha256sum $file > $file.sha256
           done
+          if ls *.qcow2 &>/dev/null; then
+            for file in *.qcow2; do
+              sha256sum "$file" > "$file.sha256"
+            done
+          fi
 
       - name: Extract ChangeLog entry ...
         run: |
@@ -155,7 +165,7 @@ jobs:
           makeLatest: ${{ steps.rel.outputs.latest }}
           discussionCategory: ${{ steps.rel.outputs.cat }}
           bodyFile:  release.md
-          artifacts: "*.tar.gz*"
+          artifacts: "*.tar.gz*,*.qcow2*"
 
       - name: Summary
         run: |

.github/workflows/test.yml

@@ -0,0 +1,116 @@
+name: Test Infix
+
+on:
+  workflow_dispatch:
+    inputs:
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        required: false
+        default: kernelkit/infix
+        type: string
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      flavor:
+        required: false
+        type: string
+        default: ''
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+      ninepm-conf:
+        required: false
+        type: string
+        default: ''
+      test-path:
+        required: false
+        type: string
+        default: 'test'
+
+env:
+  FLV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.flavor || inputs.flavor }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
+  TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}
+
+jobs:
+  test:
+    name: Regression Test ${{ inputs.name }} ${{ inputs.target }}
+    runs-on: [ self-hosted, regression ]
+    steps:
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ github.ref }}
+          clean: true
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set Build Variables
+        id: vars
+        run: |
+          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
+              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
+                   >>$GITHUB_ENV
+          fi
+
+          echo "flv=$FLV" >> $GITHUB_OUTPUT
+
+      - name: Configure ${{ inputs.target }}${{ steps.vars.outputs.flv }}
+        run: |
+          make ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
+        run: |
+          target=${{ inputs.target }}
+          name=${{ inputs.name }}
+
+          ls -l
+          mkdir -p output
+          mv ${name}-${target}.tar.gz output/
+          cd output/
+          tar xf ${name}-${target}.tar.gz
+          ln -s ${name}-${target} images
+
+      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          if [ -n "$NINEPM_CONF" ]; then
+            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
+            echo "DEBUG: NINEPM_PROJ_CONFIG is '$NINEPM_PROJ_CONFIG'"
+          fi
+          make test
+
+      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+
+      - name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: |
+          asciidoctor-pdf \
+          --theme $TEST_PATH/9pm/report/theme.yml \
+          -a pdf-fontsdir=$TEST_PATH/9pm/report/fonts \
+          $TEST_PATH/.log/last/report.adoc \
+          -o $TEST_PATH/.log/last/report.pdf
+
+      - name: Upload Test Report as Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-report
+          path: ${{ env.TEST_PATH }}/.log/last/report.pdf
+

.github/workflows/trigger.yml

@@ -0,0 +1,37 @@
+name: Self Trigger
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches:
+      - main
+      - ci-workflow-redesign
+  workflow_dispatch:
+
+jobs:
+  build-x86_64:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: "x86_64"
+      name: "infix"
+      flavor: "_minimal"
+
+  build-aarch64:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: "aarch64"
+      name: "infix"
+      flavor: "_minimal"
+
+  test-run-x86_64:
+    needs: build-x86_64
+    uses: ./.github/workflows/test.yml
+    with:
+      target: "x86_64"
+      name: "infix"
+
+  test-publish-x86_64:
+    needs: test-run-x86_64
+    uses: ./.github/workflows/publish.yml
+

Config.in

@@ -65,7 +65,7 @@ config INFIX_COMPATIBLE
 
 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix -- a Network Operating System"
+	default "Infix OS — Immutable.Friendly.Secure"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.

README.md

@@ -2,11 +2,11 @@
 
 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 
-Infix is a free, Linux based, immutable Network Operating System (NOS)
+Infix is a free, Linux-based, immutable operating system built around
-built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
+[Buildroot][1] and [sysrepo][2].  A powerful mix that ease porting to
-porting to different platforms, simplify long-term maintenance, and
+different platforms, simplify long-term maintenance, and provide
-provide made-easy management using NETCONF, RESTCONF[^2], or the
+made-easy management using NETCONF, RESTCONF[^2], or the built-in
-built-in command line interface (CLI) from a console or SSH login.
+command line interface (CLI) from a console or SSH login.
 
 > Click the **▶ Example CLI Session** foldout below for an example, or
 > head on over to the [Infix Documentation](doc/README.md) for more
@@ -27,13 +27,15 @@ it maintenance-free.  Configuration and data, e.g, containers, is stored
 on separate partitions to ensure complete separation from system files
 and allow for seamless backup, restore, and provisioning.
 
-In itself, Infix is perfectly suited for dedicated networking tasks, and
+In itself, Infix is perfectly suited for dedicated networking tasks,
-with native support for Docker containers, the operating system provides
+such as routing, switching, and monitoring.  This is how it started, as
-a versatile platform that can easily be adapted to any customer need.
+a network focused operating system.  Now, with native support for Docker
-Be it legacy applications, network protocols, process monitoring, or
+containers, it provides a versatile platform that can easily be adapted
-edge data analysis, it can run close to end equipment.  Either directly
+to any customer need.  Be it legacy applications, network protocols,
-connected on dedicated Ethernet ports or indirectly using virtual
+process monitoring, or edge data analysis, it can run close to end
-network cables to exist on the same LAN as other connected equipment.
+equipment.  Either directly connected on dedicated Ethernet ports or
+indirectly using virtual network cables to exist on the same LAN as
+other connected equipment.
 
 The simple design of Infix provides complete control over both system
 and data, minimal cognitive burden, and makes it incredibly easy to get
@@ -93,12 +95,14 @@ The [following boards](board/aarch64/README.md) are fully supported:
  - Marvell CN9130 CRB
  - Marvell EspressoBIN
  - Microchip SparX-5i PCB135 (eMMC)
- - StarFive VisionFive2
+ - Raspberry Pi 4B
  - NanoPi R2S
 
-An x86_64 build is also available, primarily intended for development
+Additionally, StarFive VisionFive2, a RISC-V based two-port router, and
-and testing, but can also be used for evaluation and demo purposes.  For
+an x86_64 build is also available.  The latter is primarily intended for
-more information, see: [Infix in Virtual Environments](doc/virtual.md).
+development and testing, but can also be used for evaluation and demo
+purposes.  For more information, see: [Infix in Virtual
+Environments](doc/virtual.md).
 
 > See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
 > page for our pre-built images.  The *[Latest Build][]* has bleeding
@@ -106,6 +110,16 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
 >
 > For *customer specific builds* of Infix, see your product repository.
 
+
+----
+
+<div align="center">
+  <a href="https://github.com/wires-se"><img src="https://raw.githubusercontent.com/wires-se/.github/main/profile/logo.png" width=300></a>
+  <br />Infix development is sponsored by <a href="https://wires.se">Wires<a>
+</div>
+
+----
+
 [^1]: An immutable operating system is one with read-only file systems,
     atomic updates, rollbacks, declarative configuration, and workload
     isolation.  All to improve reliability, scalability, and security.

board/aarch64/r2s/linux_defconfig

@@ -230,7 +230,6 @@ CONFIG_MAC80211_LEDS=y
 CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
-# CONFIG_ETHTOOL_NETLINK is not set
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
@@ -481,7 +480,6 @@ CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_PCA954x=y
-CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_GPIO=m
 CONFIG_I2C_RK3X=y
 CONFIG_I2C_SLAVE=y

board/aarch64/rpi/bcm2711-rpi-4-b-dts.patch

@@ -0,0 +1,14 @@
+--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts	2025-04-28 00:13:06.880003668 +0200
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts	2025-04-28 00:14:17.708941263 +0200
+@@ -14,6 +14,11 @@
+ 	chosen {
+ 		/* 8250 auxiliary UART instead of pl011 */
+ 		stdout-path = "serial1:115200n8";
++
++		infix {
++			/* Default admin user password: 'admin' */
++			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
++		};
+ 	};
+ 
+ 	cam1_reg: regulator-cam1 {

board/aarch64/rpi/cmdline.txt

@@ -0,0 +1 @@
+root=/dev/mmcblk0p2 rootwait console=tty1 console=ttyAMA0,115200

board/aarch64/rpi/config.txt

@@ -0,0 +1,41 @@
+# Please note that this is only a sample, we recommend you to change it to fit
+# your needs.
+# You should override this file using BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE.
+# See http://buildroot.org/manual.html#rootfs-custom
+# and http://elinux.org/RPiconfig for a description of config.txt syntax
+
+start_file=start4.elf
+fixup_file=fixup4.dat
+
+kernel=u-boot.bin
+
+device_tree=bcm2711-rpi-4-b.dtb
+dtoverlay=rpi-env
+dtoverlay=infix-key
+
+# To use an external initramfs file
+#initramfs rootfs.cpio.gz
+
+# Disable overscan assuming the display supports displaying the full resolution
+# If the text shown on the screen disappears off the edge, comment this out
+disable_overscan=1
+
+# How much memory in MB to assign to the GPU on Pi models having
+# 256, 512 or 1024 MB total memory
+gpu_mem_256=100
+gpu_mem_512=100
+gpu_mem_1024=100
+
+# Enable UART0 for serial console on ttyAMA0
+enable_uart=1
+force_turbo=1
+#dtoverlay=miniuart-bt
+
+# Run as fast as firmware / board allows
+arm_boost=1
+
+# enable 64bits support
+arm_64bit=1
+
+# Enable early debugging info
+uart_2ndstage=1

board/aarch64/rpi/genimage.cfg.in

@@ -0,0 +1,71 @@
+image boot.vfat {
+	vfat {
+		files = {
+#BOOT_FILES#
+		}
+	}
+
+	size = 32M
+}
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
+	ext4 {
+		label = "cfg"
+	}
+}
+
+image var.ext4 {
+	empty = true
+	temporary = true
+	size = 512M
+
+	ext4 {
+		label = "var"
+		use-mke2fs = true
+	}
+}
+
+image sdcard.img {
+	hdimage {
+		partition-table-type = "gpt"
+	}
+
+	partition boot {
+		partition-type-uuid = EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
+		bootable = "true"
+		image = "boot.vfat"
+	}
+
+	partition aux {
+		partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 200M
+		image = "rootfs.squashfs"
+	}
+
+	partition secondary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 200M
+		image = "rootfs.squashfs"
+	}
+
+	partition cfg {
+		partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+		image = "var.ext4"
+	}
+}

board/aarch64/rpi/post-build.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+# Armbian firmware installs to /lib/firmware but driver wants the
+# file(s) in /lib/firmware/brcm/
+if [ -f "${TARGET_DIR}/lib/firmware/BCM4345C0.hcd" ]; then
+    mv "${TARGET_DIR}/lib/firmware/BCM4345C0.hcd" "${TARGET_DIR}/lib/firmware/brcm/"
+fi

board/aarch64/rpi/post-image.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+set -e
+
+BOARD_DIR=$(dirname "$0")
+GENIMAGE_CFG="${BUILD_DIR}/genimage.cfg"
+GENIMAGE_TMP="${BUILD_DIR}/genimage.tmp"
+
+# Device trees are installed for distro boot (syslinux.conf), but on RPi
+# we need them for the SPL, which feeds the TPL (U-Boot) for use instead
+# of the (built-in) control DT other platforms use.
+find "${TARGET_DIR}/boot" -type f -name '*.dtb' -exec cp '{}' "${BINARIES_DIR}/" \;
+
+# We've asked U-Boot previously to build overlays for us: Infix signing
+# key and our ixboot scripts.  Make sure here they are installed in the
+# proper directory so genimage can create the DOS partition the SPL
+# reads config.txt from.
+find "${BINARIES_DIR}" -type f -name '*.dtbo' -exec mv '{}' "${BINARIES_DIR}/rpi-firmware/overlays/" \;
+
+# Create FILES array for the genimage.cfg generation
+FILES=""
+for f in "${BINARIES_DIR}"/*.dtb "${BINARIES_DIR}"/rpi-firmware/*; do
+    case "$f" in
+        *~|*.bak) continue ;;
+    esac
+    FILES="${FILES}\t\t\t\"${f#"${BINARIES_DIR}/"}\",\n"
+done
+
+KERNEL=$(sed -n 's/^kernel=//p' "${BINARIES_DIR}/rpi-firmware/config.txt")
+FILES="${FILES}\t\t\t\"${KERNEL}\""
+
+sed "s|#BOOT_FILES#|${FILES}|" "${BOARD_DIR}/genimage.cfg.in" > "${GENIMAGE_CFG}"
+
+ROOTPATH_TMP=$(mktemp -d)
+trap 'rm -rf \"$ROOTPATH_TMP\"' EXIT
+
+rm -rf "${GENIMAGE_TMP}"
+
+genimage					\
+    --rootpath   "${ROOTPATH_TMP}"		\
+    --tmppath    "${GENIMAGE_TMP}"		\
+    --inputpath  "${BINARIES_DIR}"		\
+    --outputpath "${BINARIES_DIR}"		\
+    --config     "${GENIMAGE_CFG}"

board/aarch64/rpi/rootfs/boot/syslinux/syslinux.conf

@@ -0,0 +1,16 @@
+default rpi4b
+menu title Boot Menu
+prompt 1
+timeout 30
+
+label rpi4b
+        menu label Infix on Raspberry Pi 4B
+	kernel /boot/Image
+	devicetree /boot/broadcom/bcm2711-rpi-4-b.dtb
+	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}
+
+label rpi400
+	menu label Infix on Raspberry Pi 400
+	kernel /boot/Image
+	devicetree /boot/broadcom/bcm2711-rpi-400.dtb
+	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}

board/aarch64/rpi/rootfs/etc/factory-config.cfg

@@ -0,0 +1,193 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "eth0",
+        "type": "infix-if-type:ethernet"
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name":  "deny-password-read",
+            "module-name": "ietf-system",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny"
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-address": "::"
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "rpi4",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          },
+	  "iburst": true
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo="
+  },
+  "infix-dhcp-client:dhcp-client": {
+    "client-if": [
+      {
+        "if-name": "eth0",
+        "option": [
+          {
+            "id": "netmask"
+          },
+          {
+            "id": "broadcast"
+          },
+          {
+            "id": "router"
+          },
+          {
+            "id": "domain"
+          },
+          {
+            "id": "hostname"
+          },
+          {
+            "id": "dns-server"
+          },
+          {
+            "id": "ntp-server"
+          }
+        ]
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "infix-meta:version": "1.2"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}

board/aarch64/rpi/rootfs/etc/product/interface-quirks.json

@@ -0,0 +1,5 @@
+{
+    "eth0": {
+	"phy-detached-when-down": true
+    }
+}

board/aarch64/rpi/rootfs/etc/watchdogd.conf

@@ -0,0 +1,6 @@
+# Broadcom BCM2835 Watchdog timer
+device /dev/watchdog0 {
+    timeout    = 60
+    interval   = 5
+    safe-exit  = true
+}

board/aarch64/rpi/uboot/extras.config

@@ -0,0 +1,3 @@
+# CONFIG_MMC_PCI is not set
+CONFIG_OF_OVERLAY_LIST="rpi-env infix-key"
+# CONFIG_ENV_IS_IN_FAT is not set

board/aarch64/rpi/uboot/rpi-env.dtso

@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+&{/} {
+	config {
+		environment {
+			vendor = "infix";
+			preboot = "run ixpreboot";
+			ixbootdelay = "0.5";
+			bootdelay = "-2";
+			bootmenu_delay = "10";
+			boot_targets = "mmc1";
+			ethprime = "eth0";
+			bootcmd = "run ixboot";
+
+			ixpreboot     = /incbin/("scripts/ixpreboot.sh");
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+			ixbtn-factory = "echo \"No button available, use bootmenu\"";
+			ixfactory     = /incbin/("scripts/ixfactory.sh");
+
+			ixboot      = /incbin/("scripts/ixboot.sh");
+			ixbootslot  = /incbin/("scripts/ixbootslot.sh");
+			ixprepblk   = /incbin/("scripts/ixprepblk.sh");
+			ixprepdhcp  = /incbin/("scripts/ixprepdhcp.sh");
+		};
+	};
+};

board/common/README.txt

@@ -45,11 +45,11 @@ The default credentials for the demo builds is
     login: admin
     password: admin
 
-    Infix -- a Network Operating System v24.09.0-rc1 (hvc0)
+    Infix OS — Immutable.Friendly.Secure v24.09.0-rc1 (hvc0)
     infix-00-00-00 login: admin
     Password: 
     .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
     |-. v .-| https://kernelkit.org
     '-'---'-'
 
@@ -122,9 +122,9 @@ There's a lot of tutorials and guides online, start here:
 About
 -----
 
-Infix is a free, Linux based, immutable Network Operating System (NOS)
+Infix is a free, Linux-based, immutable operating system built around
-built on Buildroot, and sysrepo.  A powerful mix that ease porting to
+Buildroot, and sysrepo.  A powerful mix that ease porting to different
-different platforms, simplify long-term maintenance, and provide easy
+platforms, simplify long-term maintenance, and provide easy management
-management using NETCONF, RESTCONF, or the built-in command line
+using NETCONF, RESTCONF, or the built-in command line interface (CLI)
-interface (CLI) from a console or SSH login.
+from a console or SSH login.
 

board/common/busybox_defconfig

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.36.1
-# Tue Oct 22 13:12:02 2024
+# Sun Feb  9 12:25:37 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -17,7 +17,7 @@ CONFIG_SHOW_USAGE=y
 CONFIG_FEATURE_VERBOSE_USAGE=y
 # CONFIG_FEATURE_COMPRESS_USAGE is not set
 CONFIG_LFS=y
-# CONFIG_PAM is not set
+CONFIG_PAM=y
 CONFIG_FEATURE_DEVPTS=y
 CONFIG_FEATURE_UTMP=y
 CONFIG_FEATURE_WTMP=y
@@ -325,7 +325,7 @@ CONFIG_FEATURE_STAT_FILESYSTEM=y
 CONFIG_STTY=y
 CONFIG_SUM=y
 CONFIG_SYNC=y
-# CONFIG_FEATURE_SYNC_FANCY is not set
+CONFIG_FEATURE_SYNC_FANCY=y
 CONFIG_FSYNC=y
 # CONFIG_TAC is not set
 CONFIG_TAIL=y
@@ -336,7 +336,7 @@ CONFIG_TEST=y
 CONFIG_TEST1=y
 CONFIG_TEST2=y
 CONFIG_FEATURE_TEST_64=y
-# CONFIG_TIMEOUT is not set
+CONFIG_TIMEOUT=y
 CONFIG_TOUCH=y
 CONFIG_FEATURE_TOUCH_SUSV3=y
 CONFIG_TR=y
@@ -357,7 +357,7 @@ CONFIG_BASE32=y
 CONFIG_BASE64=y
 CONFIG_UUENCODE=y
 CONFIG_WC=y
-# CONFIG_FEATURE_WC_LARGE is not set
+CONFIG_FEATURE_WC_LARGE=y
 CONFIG_WHO=y
 CONFIG_W=y
 CONFIG_USERS=y

board/common/mkdisk.sh

@@ -127,7 +127,7 @@ bootdata=
 diskimg=disk.img
 bootimg=
 bootpart=
-
+tmpimage=$(mktemp)
 while getopts "a:b:B:n:s:" opt; do
     case ${opt} in
 	a)
@@ -166,7 +166,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vdiskimg=$diskimg \
+	  -vdiskimg=$tmpimage \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -211,5 +211,7 @@ genimage \
     --rootpath "$root" \
     --tmppath  "$tmp" \
     --inputpath "$BINARIES_DIR" \
-    --outputpath "$BINARIES_DIR" \
     --config "$root/genimage.cfg"
+
+qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
+rm "$tmpimage"

board/common/post-image.sh

@@ -23,7 +23,7 @@ if [ -n "$IMAGE_ID" ]; then
 else
     NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
 fi
-diskimg=disk.img
+diskimg=disk.qcow2
 
 ver()
 {
@@ -48,7 +48,7 @@ fi
 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
     ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk$(ver).img"
+    diskimg="${NAME}-disk$(ver).qcow2"
     bootcfg=
     if [ "$DISK_IMAGE_BOOT_DATA" ]; then
 	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
@@ -90,7 +90,7 @@ if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
     rel=$(ver)
     ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
     if [ -n "$rel" ]; then
-	ln -sf "$BINARIES_DIR/${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
+	ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
     fi
 fi
 

board/common/qemu/Config.in.in

@@ -66,7 +66,7 @@ endchoice
 
 config QEMU_MACHINE
 	string "Select emulated machine"
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max" if QEMU_aarch64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
 	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
@@ -78,7 +78,7 @@ config QEMU_MACHINE
 
 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
-	default "384M"
+	default "448M"
 	help
 	  The default, 384 MiB, works for most configurations.  However,
 	  if you get kernel panic with: "System is deadlocked on memory",

board/common/qemu/qemu.sh

@@ -120,7 +120,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
     elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
+	echo -n "-drive file=qemu.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
     fi
 }
 
@@ -316,13 +316,13 @@ gdb_args()
 run_qemu()
 {
     if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	if ! qemu-img check "${CONFIG_QEMU_ROOTFS}.qcow2"; then
+	if ! qemu-img check "qemu.qcow2"; then
-	    rm -f "${CONFIG_QEMU_ROOTFS}.qcow2"
+	    rm -f "qemu.qcow2"
 	fi
-	if [ ! -f "${CONFIG_QEMU_ROOTFS}.qcow2" ]; then
+	if [ ! -f "qemu.qcow2" ]; then
 	    echo "Creating qcow2 disk image for Qemu ..."
 	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
-		     -F raw "${CONFIG_QEMU_ROOTFS}.qcow2" > /dev/null
+		     -F qcow2 "qemu.qcow2" > /dev/null
 	fi
     fi
 

board/common/rootfs/etc/avahi/avahi-autoipd.action

@@ -9,46 +9,20 @@
 #   $3 IP adddress
 
 PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
-NAME="/etc/frr/static.d/$2-zeroconf.conf"
-NEXT="${NAME}+"
 
 log()
 {
     logger -I $$ -t zeroconf -p user.notice "$*"
 }
 
-# Reduce changes needed by comparing with previous route(s)
-act()
-{
-    case $1 in
-	add)
-	    echo "! Generated by avahi-autoipd"  > "$NEXT"
-	    echo "ip route 0.0.0.0/0 $2 254"    >> "$NEXT"
-	    cmp -s "$NAME" "$NEXT" && return
-	    mv "$NEXT" "$NAME"
-	    ;;
-	del)
-	    [ -f "$NAME" ] || return
-	    rm "$NAME"
-	    ;;
-	*)
-	    return
-	    ;;
-    esac
-
-    initctl -nbq restart staticd
-}
-
 case "$1" in
     BIND)
         ip addr flush dev "$2" proto random
         ip addr add "$3"/16 brd 169.254.255.255 scope link dev "$2" proto random
-	act add "$2"
 	log "set ipv4ll $3 on iface $2"
         ;;
 
     CONFLICT|UNBIND|STOP)
-	act del "$2"
         ip addr flush dev "$2" proto random
 	log "clr ipv4ll on iface $2"
         ;;

board/common/rootfs/etc/finit.d/available/container@.conf

@@ -1,4 +1,7 @@
-task    name:container-%i :setup \
+# Start a container instance (%i) and redirect logs to /log/container
-	[2345] container -n %i setup -- Setup container %i
+# Give podman enough time to properly shut down the container.  Every
-sysv    <!usr/container:%i> :%i pid:!/run/container:%i.pid log:prio:local1,tag:%i kill:10 \
+# time we start a container we run the setup stage, disable the Finit
-	[2345] container -n %i -- container %i
+# timeout to allow the setup stage to run to completion.
+sysv    log:prio:local1,tag:%i kill:10 pid:!/run/container:%i.pid \
+	pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container   \
+	[2345] <!> :%i container -n %i -- container %i

board/common/rootfs/etc/finit.d/available/ttyd.conf

@@ -1 +1 @@
-service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)
+service [2345] <!> ttyd -i lo -W -p 8001 login -- Web terminal daemon (ttyd)

board/common/rootfs/etc/finit.d/available/wifi@.conf

@@ -0,0 +1,5 @@
+service name:wpa_supplicant :%i \
+			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+			       -- WPA supplicant @%i
+
+task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i

board/common/rootfs/etc/motd

@@ -1,4 +1,4 @@
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

board/common/rootfs/etc/nginx/restconf.app

@@ -1,5 +1,11 @@
 # /telemetry/optics is for streaming (not used atm)
+# Proxy buffer settings for large files
+proxy_buffering off;                 # Disable buffering for streaming
+proxy_request_buffering off;         # Stream request body immediately
+proxy_max_temp_file_size 0;         # No temp files
 location ~ ^/(restconf|yang|.well-known)/ {
+    client_max_body_size 200M;
+    client_body_buffer_size 1M;
     grpc_pass grpc://[::1]:10080;
     grpc_set_header Host $host;
     grpc_set_header X-Real-IP $remote_addr;

board/common/rootfs/etc/sysctl.d/ipv6.conf

@@ -2,10 +2,15 @@
 net.ipv6.route.max_size=131072
 net.ipv6.conf.all.ignore_routes_with_linkdown=1
 
-# IP Routing
+# IP Routing is disabled by default, enabled globally, and per
-net.ipv6.conf.all.forwarding=1
+# interface, for each interface in confd.  See also accept_ra.
+net.ipv6.conf.all.forwarding=0
 net.ipv6.conf.default.forwarding=0
 
+# Accept router advertisements even when forwarding is enabled
+net.ipv6.conf.all.accept_ra=2
+net.ipv6.conf.default.accept_ra=2
+
 # IPv6 SLAAC
 net.ipv6.conf.all.autoconf=0
 net.ipv6.conf.default.autoconf=0

board/common/rootfs/etc/udev/rules.d/70-rename-wifi.rules

@@ -0,0 +1 @@
+SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"

board/common/rootfs/usr/bin/dir

@@ -21,7 +21,11 @@ dir()
 if [ -d "$1" ]; then
     dir "$1"
 else
-    dir "$HOME"
+    if [ "$USER" = "root" ]; then
+	dir "$HOME"
+    else
+	dir "/home/$USER"
+    fi
     dir "/cfg"
     dir "/log"
 fi

board/common/rootfs/usr/libexec/infix/has-quirk

@@ -0,0 +1,12 @@
+#!/bin/sh
+if [ $# -lt 2 ]; then
+        echo "usage: $0 <quirk-name> <ifname>"
+        exit 1
+fi
+quirk=$1
+ifname=$2
+if [ -f "/etc/product/interface-quirks.json" ]; then
+        echo "$(jq -r --arg iface "$ifname" --arg quirk "$quirk" '.[$iface][$quirk] // "false"' /etc/product/interface-quirks.json)"
+else
+        echo "false"
+fi

board/common/rootfs/usr/libexec/infix/init.d/05-product

@@ -39,8 +39,10 @@ fi
 # init scripts to prevent select services from starting.
 initctl -nbq cond set led
 
-note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
+if [ -d "$PRODUCT_INIT" ]; then
-/usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
+    note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
+    /usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
+fi
 
 # Product specific init done.
 initctl -nbq cond set product

board/common/rootfs/usr/libexec/infix/init.d/25-mqprio

@@ -43,6 +43,7 @@ while [ "$1" ]; do
     txqs="$2"
     shift 2
 
+    [ $(/usr/libexec/infix/has-quirk "broken-mqprio" "$iface") = "true" ] && echo "Skipping $iface, does not support mqprio" && continue
     [ $txqs -lt 2 ] && continue
     [ $txqs -gt 8 ] && txqs=8
 

board/common/rootfs/usr/libexec/infix/init.d/25-qemu

@@ -0,0 +1,8 @@
+#!/bin/sh
+# Initialize speed/duplex of virtio interfaces
+# For virtual test systems (lacp tests)
+
+ifaces=$(ip -d -json link show | jq -r '.[] | select(.parentbus == "virtio") | .ifname')
+for iface in $ifaces; do
+    ethtool -s "$iface" speed 1000 duplex full
+done

board/common/rootfs/usr/libexec/infix/init.d/30-cfg-migrate

@@ -4,10 +4,14 @@
 # the migrate tool inserts old version in name before .cfg extension.
 CONFIG_FILE="/cfg/startup-config.cfg"
 BACKUP_FILE="/cfg/backup/startup-config.cfg"
-mkdir -p "$(dirname "$BACKUP_FILE")"
+BACKUP_DIR="$(dirname "$BACKUP_FILE")"
+
+mkdir -p         "$BACKUP_DIR"
+chown root:wheel "$BACKUP_DIR"
+chmod 0770       "$BACKUP_DIR"
 
 if [ ! -f "$CONFIG_FILE" ]; then
-    note "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
+    logger -I $$ -k -p user.notice -t $(basename "$0")  "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
     exit 0
 elif migrate -cq "$CONFIG_FILE"; then
     exit 0

board/common/rootfs/usr/libexec/infix/wifi-scanner

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+if [ $# -ne 1 ]; then
+	echo "usage: $0 <ifname>"
+	exit 1
+fi
+ifname=$1
+
+TIMEOUT=300
+status=$(wpa_cli -i $ifname scan)
+while [ "$status" != "OK" ]; do
+	status=$(wpa_cli -i $ifname scan)
+	TIMEOUT=$((TIMEOUT-1))
+	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
+	sleep 0.5
+done

board/common/rootfs/usr/sbin/container

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 # This script can be used to start, stop, create, and delete containers.
 # It is what confd use, with the Finit container@.conf template, to set
 # up, run, and delete containers.
@@ -9,6 +9,7 @@
 DOWNLOADS=/var/lib/containers/oci
 BUILTIN=/lib/oci
 TMPDIR=/var/tmp
+container=$0
 checksum=""
 extracted=
 timeout=30
@@ -38,6 +39,11 @@ err()
     [ "$rc" -eq 0 ] || exit "$rc"
 }
 
+pidfn()
+{
+    echo "/run/containers/${1}.pid"
+}
+
 check()
 {
     file=$1
@@ -109,33 +115,34 @@ EOF
 # If there are more index files, this function does not handle them.
 unpack_archive()
 {
-    image=$1
+    uri=$1
-    name=$2
+    tag=$2
+    img=$(basename "$uri")
 
     # Supported transports for load and create
-    case "$image" in
+    case "$uri" in
 	oci:*)			# Unpacked OCI image
-	    file=${image#oci:}
+	    file=${uri#oci:}
 	    ;;
 	oci-archive:*)		# Packed OCI image, .tar or .tar.gz format
-	    file=${image#oci-archive:}
+	    file=${uri#oci-archive:}
 	    ;;
 	ftp://* | http://* | https://*)
-            if ! file=$(fetch "$image"); then
+            if ! file=$(fetch "$uri"); then
 		return 1
 	    fi
             ;;
 	*)			# docker://*, docker-archive:*, or URL
-	    if podman image exists "$image"; then
+	    if podman image exists "$img"; then
-		echo "$image"
+		echo "$img"
 		return 0
 	    fi
 	    # XXX: use --retry=0 with Podman 5.0 or later.
-	    if ! id=$(podman pull --quiet "$image"); then
+	    if ! id=$(podman pull --quiet "$uri"); then
-		log "Failed pulling $image"
+		log "Failed pulling $uri"
 		return 1
 	    fi
-	    # Echo image name to caller
+	    # Echo image tag to caller
 	    podman images --filter id="$id" --format "{{.Repository}}:{{.Tag}}"
 	    return 0
 	    ;;
@@ -147,7 +154,7 @@ unpack_archive()
 	elif [ -e "$BUILTIN/$file" ]; then
 	    file="$BUILTIN/$file"
 	else
-	    err 1 "cannot find OCI archive $file in search path."
+	    err 1 "cannot find OCI archive $file in URI $uri"
 	fi
     fi
 
@@ -171,8 +178,8 @@ unpack_archive()
 
     dir=$(dirname "$index")
     if echo "$dir" | grep -q ":"; then
-        if [ -z "$name" ]; then
+        if [ -z "$tag" ]; then
-            name="$dir"
+            tag="$dir"
         fi
         sanitized_dir=$(echo "$dir" | cut -d':' -f1)
         mv "$dir" "$sanitized_dir" || err 1 "failed renaming $dir to $sanitized_dir"
@@ -188,21 +195,21 @@ unpack_archive()
 	rm -rf "$dir"
     fi
 
-    # Rename image from podman default $dir:latest
+    # Retag image from podman default $dir:latest
-    if [ -n "$name" ]; then
+    if [ -n "$tag" ]; then
-	podman tag "$dir" "$name" >/dev/null
+	podman tag "$dir" "$tag" >/dev/null
-	podman rmi "$dir"         >/dev/null
+	podman rmi "$dir"        >/dev/null
     else
-	name=$dir
+	tag=$dir
     fi
 
-    echo "$name"
+    echo "$tag"
 }
 
 running()
 {
-    run=$(podman inspect "$1" 2>/dev/null |jq .[].State.Running)
+    status=$(podman inspect -f '{{.State.Status}}' "$1" 2>/dev/null)
-    [ "$run" = "true" ] && return 0
+    [ "$status" = "running" ] && return 0
     return 1
 }
 
@@ -233,7 +240,7 @@ create()
     args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
     args="$args --restart=$restart --systemd=false --tz=local $privileged"
     args="$args $vol $mount $hostname $entrypoint $env $port $logging"
-    pidfn=/run/container:${name}.pid
+    pidfile=/run/container:${name}.pid
 
     [ -n "$quiet" ] || log "---------------------------------------"
     [ -n "$quiet" ] || log "Got name: $name image: $image"
@@ -256,8 +263,8 @@ create()
     fi
 
     # shellcheck disable=SC2048
-    log "podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
+    log "podman create --name $name --conmon-pidfile=$pidfile $args $image $*"
-    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
+    if podman create --name "$name" --conmon-pidfile="$pidfile" $args "$image" $*; then
 	[ -n "$quiet"  ] || log "Successfully created container $name from $image"
 	[ -n "$manual" ] || start "$name"
 
@@ -272,7 +279,6 @@ create()
 delete()
 {
     name=$1
-    image=$2
 
     if [ -z "$name" ]; then
 	echo "Usage:"
@@ -281,9 +287,11 @@ delete()
     fi
 
     # Should already be stopped, but if not ...
-    container stop "$name"
+    log "$name: should already be stopped, double checking ..."
+    container stop "$name" >/dev/null
 
     while running "$name"; do
+	log "$name: still running, waiting for it to stop ..."
 	_=$((timeout -= 1))
 	if [ $timeout -le 0 ]; then
 	    err 1 "timed out waiting for container $1 to stop before deleting it."
@@ -291,6 +299,7 @@ delete()
 	sleep 1
     done
 
+    log "$name: calling podman rm -vif ..."
     podman rm -vif "$name" >/dev/null 2>&1
     [ -n "$quiet" ] || log "Container $name has been removed."
 }
@@ -315,7 +324,7 @@ start()
 	return
     fi
 
-    initctl -bq cond set "container:$name"
+    initctl start container:$name
     # Real work is done by wrap() courtesy of finit sysv emulation
 }
 
@@ -328,7 +337,7 @@ stop()
 	return
     fi
 
-    initctl -bq cond clr "container:$name"
+    initctl stop container:$name
     # Real work is done by wrap() courtesy of finit sysv emulation
 }
 
@@ -336,8 +345,27 @@ wrap()
 {
     name=$1
     cmd=$2
+    pidfile=$(pidfn "$name")
 
-    podman "$cmd" "$name"
+    # Containers have three phases: setup, running, and teardown.
+
+    # The setup phase may run forever in the background trying to fetch
+    # the image.  It saves its PID in /run/containers/${name}.pid
+    if [ "$cmd" = "stop" ] && [ -f "$pidfile" ]; then
+        pid=$(cat "$pidfile")
+
+	# Check if setup is still running ...
+	if kill -0 "$pid" 2>/dev/null; then
+            kill "$pid"
+            wait "$pid" 2>/dev/null
+        fi
+
+        rm -f "$pidfile"
+        return 0
+    fi
+
+    # Skip "echo $name" from podman start in log
+    podman "$cmd" "$name" >/dev/null
 }
 
 # Removes network $1 from all containers
@@ -370,7 +398,14 @@ netrestart()
 
 cleanup()
 {
+    pidfile=$(pidfn "$name")
+
     log "Received signal, exiting."
+    if [ -n "$name" ] && [ -f "$pidfile" ]; then
+	log "$name: in setup phase, removing $pidfile ..."
+	rm -f "$pidfile"
+    fi
+
     exit 1
 }
 
@@ -426,11 +461,12 @@ commands:
   run      NAME [CMD]      Run a container interactively, with an optional command
   save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
   setup    NAME            Create and set up container as a Finit task
-  shell                    Start a shell inside a container
+  shell   [CMD]            Start a shell, or run CMD, inside a container
   show    [image | volume] Show containers, images, or volumes
   stat                     Show continuous stats about containers (Ctrl-C aborts)
   start   [NAME]           Start a container, see -n
   stop    [NAME]           Stop a container, see -n
+  upgrade  NAME            Upgrade a running container (stop, pull, restart)
   volume  [prune]          Prune unused volumes
 EOF
 }
@@ -514,7 +550,7 @@ while [ "$1" != "" ]; do
 	    ;;
 	-m | --mount)
 	    shift
-	    mount="--mount=$1"
+	    mount="$mount --mount=$1"
 	    ;;
 	--manual)
 	    manual=true
@@ -568,7 +604,7 @@ if [ -n "$cmd" ]; then
     shift
 fi
 
-trap cleanup INT TERM
+trap cleanup INT HUP TERM
 
 case $cmd in
     # Does not work atm., cannot attach to TTY because
@@ -582,19 +618,24 @@ case $cmd in
 	;;
     delete)
 	cmd=$1
-	name=$2
+	[ -n "$name" ] || name=$2
 	if [ "$cmd" = "network" ] && [ -n "$name" ]; then
 	    netwrm "$name"
 	else
-	    delete "$@"
+	    [ -n "$name" ] || name=$1
+	    delete "$name"
 	fi
 	;;
     exec)
-	podman exec -it "$@"
+	if [ -z "$name" ]; then
+	    name="$1"
+	    shift
+	fi
+	podman exec -i "$name" "$@"
 	;;
     flush)
 	echo "Cleaning up any lingering containers";
-	podman rm -av
+	podman rm -av $force
 	;;
     find)
 	cmd=$1
@@ -655,7 +696,7 @@ case $cmd in
 	    oci)
 		find $BUILTIN $DOWNLOADS -type f 2>/dev/null
 		;;
-	    *)		
+	    *)
 		podman ps $all --format "{{.Names}}"
 		;;
 	esac
@@ -699,18 +740,34 @@ case $cmd in
 	[ -n "$name" ] || err 1 "setup: missing container name."
 	script=/run/containers/${name}.sh
 	[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."
+
+	# Save our PID in case we get stuck here and someone wants to
+	# stop us, e.g., due to reconfiguration or reboot.
+	pidfile=$(pidfn "${name}")
+	echo $$ > "$pidfile"
+
 	while ! "$script"; do
-	    # Wait for address/route changes, or retry every 60 secods
+            log "${name}: setup failed, waiting for network changes ..."
-	    # shellcheck disable=2162,3045
+	    read -t 60 _ < <(ip monitor address route)
-	    ip monitor address route | while read -t 60 _; do break; done
 
 	    # On IP address/route changes, wait a few seconds more to ensure
 	    # the system has ample time to react and set things up for us.
+	    log "${name}: retrying ..."
 	    sleep 2
 	done
+
+	rm -f "$pidfile"
 	;;
     shell)
-	podman exec -it "$1" sh -l
+	if [ -z "$name" ]; then
+	    name="$1"
+	    shift
+	fi
+	if [ $# -gt 0 ]; then
+	    podman exec -i "$name" sh -c "$*"
+	else
+	    podman exec -it "$name" sh -l
+	fi
 	;;
     show)
 	cmd=$1
@@ -803,15 +860,15 @@ case $cmd in
 
 	# Likely an OCI archive, or local directory, assume user has updated image.
 	if echo "$img" | grep -Eq '^localhost/'; then
-	    file=$(awk '{s=$NF} END{print s}' "$script")
+	    file=$(awk '/^# meta-image:/ {print $3}' "$script")
-	    echo "Upgrading container ${1} with local archive: $file ..."
+	    echo ">> Upgrading container $1 using $file ..."
 	else
 	    printf ">> Stopping ... "
 	    podman stop "$1"
 	    printf ">> "
 	    podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
+	    echo ">> Starting $1 ..."
 	fi
-	echo ">> Starting $1 ..."
 	if ! "$script"; then
 	    echo ">> Failed recreating container $1"
 	    exit 1
@@ -831,6 +888,22 @@ case $cmd in
 	esac
 	;;
     *)
+	if [ -n "$SERVICE_SCRIPT_TYPE" ] && [ -n "$SERVICE_ID" ]; then
+	    case "$SERVICE_SCRIPT_TYPE" in
+		pre)
+		    # Called as pre-script from Finit service
+		    exec $container -q -n "$SERVICE_ID" setup
+		    ;;
+		cleanup)
+		    # Called as cleanup-script from Finit service
+		    log "Calling $container -n $SERVICE_ID delete"
+		    exec $container -q -n "$SERVICE_ID" delete
+		    ;;
+		*)
+		    false
+		    ;;
+	    esac
+	fi
 	usage
 	exit 1
 	;;

board/common/uboot/uboot.mk

@@ -17,14 +17,23 @@ endef
 # U-Boot build tree. This will then be built in to the final U-Boot
 # image's control DT via the CONFIG_DEVICE_TREE_INCLUDES option (see
 # extras.config).
+#
+# Some platforms, most notably Raspberry Pi, load the device tree
+# from the SPL, effectively overriding the built-in control DT.
+# For that we bundle an overlay that can be included instead.
 define UBOOT_PRE_BUILD_INSTALL_KEY
-	$(HOST_DIR)/bin/dtc <(echo '/dts-v1/; / { signature {}; };') >$(@D)/infix-key.dtb
+	$(HOST_DIR)/bin/dtc -a 1024 <(echo '/dts-v1/; / { signature {}; };') \
+		>$(@D)/infix-key.dtb
 	$(foreach key, \
 		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
 		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
-	| sed -e 's:/dts-v[0-9]\+/;::' >$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi
+		| sed -e 's:/dts-v[0-9]\+/;::' \
+		| tee $(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi \
+		| sed -e '1i\/dts-v1/;\n/plugin/;\n' -e '/^$$/d' -e 's:/ {:\&{/} {:' \
+		>$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtso
+
 	rm $(@D)/infix-key.dtb
 endef
 UBOOT_PRE_BUILD_HOOKS += UBOOT_PRE_BUILD_INSTALL_KEY

configs/aarch64_defconfig

@@ -13,8 +13,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -27,13 +27,14 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -55,8 +56,8 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -119,12 +120,13 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -138,6 +140,7 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -161,11 +164,14 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_LIBINPUT=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-DISK_IMAGE_BOOT_BIN=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10

configs/aarch64_minimal_defconfig

@@ -27,13 +27,14 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -107,7 +108,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -119,6 +120,7 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -137,6 +139,8 @@ BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

configs/r2s_defconfig

@@ -8,7 +8,6 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -30,7 +29,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.10.3"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
@@ -42,6 +41,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
@@ -74,7 +74,6 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
@@ -171,13 +170,14 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-r2s"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -201,8 +201,10 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set

configs/riscv64_defconfig

@@ -39,6 +39,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
@@ -161,7 +162,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -169,6 +170,7 @@ BR2_PACKAGE_CONFD=y
 # BR2_PACKAGE_CONFD_TEST_MODE is not set
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -194,6 +196,8 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set

configs/rpi4_defconfig

@@ -0,0 +1,201 @@
+BR2_aarch64=y
+BR2_cortex_a72=y
+BR2_ARM_FPU_VFPV4=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_GLOBAL_PATCH_DIR="board/raspberrypi/patches ${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_TARGET_GENERIC_HOSTNAME="infix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
+BR2_TARGET_GENERIC_GETTY_TERM="xterm"
+BR2_SYSTEM_DHCP="eth0"
+BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
+BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-image.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
+BR2_LINUX_KERNEL_PATCH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711-rpi-4-b-dts.patch"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="broadcom/bcm2711-rpi-4-b broadcom/bcm2711-rpi-400"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
+BR2_PACKAGE_XZ=y
+BR2_PACKAGE_STRACE=y
+BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_ARMBIAN_FIRMWARE=y
+BR2_PACKAGE_ARMBIAN_FIRMWARE_AP6255=y
+BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI=y
+BR2_PACKAGE_LINUX_FIRMWARE=y
+BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XXX=y
+BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366B1=y
+BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366C0=y
+BR2_PACKAGE_RPI_FIRMWARE=y
+BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4=y
+BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4_X=y
+BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/config.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/cmdline.txt"
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_EVEMU=y
+BR2_PACKAGE_EVTEST=y
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_INPUT_EVENT_DAEMON=y
+BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_LINUX_PAM=y
+BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_CONNTRACK_TOOLS=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FRR=y
+BR2_PACKAGE_HOSTAPD=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPTABLES_NFTABLES=y
+BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_IW=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_MSTPD=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NETCAT_OPENBSD=y
+BR2_PACKAGE_NETSNMP=y
+BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_NMAP=y
+BR2_PACKAGE_NMAP_NCAT=y
+BR2_PACKAGE_NMAP_NMAP=y
+BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_TRACEROUTE=y
+BR2_PACKAGE_ULOGD=y
+BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIRELESS_REGDB=y
+BR2_PACKAGE_WIRELESS_TOOLS=y
+BR2_PACKAGE_WPA_SUPPLICANT=y
+BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
+BR2_PACKAGE_GETENT=y
+BR2_PACKAGE_HTOP=y
+BR2_PACKAGE_IRQBALANCE=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_DBUS=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_RAUC_JSON=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_LESS=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_arm64"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/extras.config"
+BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/rpi-env.dtso"
+BR2_PACKAGE_HOST_DOSFSTOOLS=y
+BR2_PACKAGE_HOST_E2FSPROGS=y
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_KMOD_XZ=y
+BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+INFIX_VENDOR_HOME="https://github.com/kernelkit"
+INFIX_IMAGE_ID="${INFIX_ID}-rpi4"
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_GENCERT=y
+BR2_PACKAGE_STATD=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_KEYACK=y
+BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
+BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
+BR2_PACKAGE_PODMAN=y
+BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
+BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
+BR2_PACKAGE_PODMAN_DRIVER_VFS=y
+BR2_PACKAGE_SHOW=y
+BR2_PACKAGE_TETRIS=y
+BR2_PACKAGE_ROUSETTE=y
+BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+SDCARD_AUX=y

configs/x86_64_defconfig

@@ -12,8 +12,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,6 +34,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -54,10 +55,8 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_LINUX_PAM=y
@@ -126,13 +125,14 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -142,6 +142,7 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -165,8 +166,12 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 GNS3_APPLIANCE_RAM=512

configs/x86_64_minimal_defconfig

@@ -7,13 +7,14 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -26,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,6 +35,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -50,10 +52,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
-BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_LIBMNL=y
@@ -83,6 +82,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_GETENT=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
@@ -115,7 +115,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -138,6 +138,7 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 TRUSTED_KEYS=y

doc/ChangeLog.md

@@ -3,6 +3,128 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
+[v25.06.0][] - 2025-07-01
+-------------------------
+
+### Changes
+- Upgrade Buildroot to 2025.02.4 (LTS)
+- Upgrade Linux kernel to 6.12.35 (LTS)
+- Upgrade curiOS built-in containers to v25.06.0
+- Add support for setting mode of a container content mount, issue #1070
+- Add Wi-Fi client support and add support for some USB-Wi-Fi cards
+- New slogan: Infix OS — Immutable.Friendly.Secure
+
+### Fixes
+- cli: fix by-word movement, detect word barrier using non-alphanum chars
+- cli: fix delete word left/right, make sure to save word in kill buffer
+
+
+[v25.05.1][] - 2025-06-12
+-------------------------
+
+### Changes
+- Upgrade Linux kernel to 6.12.32 (LTS)
+
+### Fixes
+- Fix #1060: Restore of missing CLI commands, regression in Infix v25.05.0
+
+[v25.05.0][] - 2025-05-27
+-------------------------
+
+### Changes
+- Upgrade Buildroot to 2025.02.3 (LTS)
+- Upgrade Linux kernel to 6.12.30 (LTS)
+- Upgrade libyang to 3.12.2
+- Upgrade sysrepo to 3.6.11
+- Upgrade netopeer2 (NETCONF) to 2.4.1
+- New hardware support: Raspberry Pi 4B (aarch64)
+- Add documentation on Infix upgrading and downgrading, issue #1009
+- Add HDMI and USB support for iMX8MP-evk
+- Enforced strict format for LLDP destination MAC address:
+  - Only accepts colon-separated format: `01:80:C2:00:00:0E`
+- Add `show lldp` command to show discovered neighbors per interface.
+- Add configuration support for per-interface LLDP administrative status
+
+### Fixes
+- Fix containers with multiple mounts
+- Correct description for LAG LACP modes
+- Fix #1040: Add `mount` constraint for container config
+
+
+[v25.04.0][] - 2025-04-30
+-------------------------
+
+### Changes
+ - Upgrade Linux kernel to 6.12.25 (LTS)
+ - Upgrade Buildroot to 2025.02.1 (LTS)
+ - Format for disk image (for QEMU) has changed to `qcow2`
+
+### Fixes
+ - Fix #1002: Broken symlink in release package
+ - Fix #1006: NanoPi R2S corrupt startup, regression in Infix v25.02.0
+   - Bump R2S kernel, now same as tier one boards
+ - Fix #1015: Not possible to save custom SSH settings in startup-config
+ - Fix group owner and permissions of `/cfg/backup` directory
+ - Fix extraction of old version for `/cfg/backup/` files
+ - Fix configuration migration issues when upgrading
+
+[v25.03.0][] - 2025-03-31
+-------------------------
+
+> [!IMPORTANT]
+> This release is the first with the new Buildroot 2025.02 (LTS)
+
+### Changes
+ - Upgrade Linux kernel to 6.12.21 (LTS)
+ - Upgrade Buildroot to 2025.02.0 (LTS)
+
+### Fixes
+ - Fix #964: YANG schema warning in syslog: missing 'monitor' node for lag
+ - Fix #980: the system fails to reboot when a container is (stuck), for
+   whatever reason, in its 'setup' state
+ - Fix #990: web console, ttyd service, stopped working after upgrade to
+   Buildroot 2025.02, caused by new (missing) option `--writable`
+ - Fix TCAM memory corruption in `mvpp2` Ethernet controller
+ - Fix annoying (but harmless) usage message from the logger tool when
+   `startup-config` fails to load and the system reverts to failure mode
+ - Fix harmless log warning for product specific init when no product
+   specific init scripts are found
+ - Backport fixes for sysklogd, affecting hostname filtering and periods
+   in TAG names, pending official backport in Buildroot
+
+
+[v25.02.0][] - 2025-03-04
+-------------------------
+
+### Changes
+ - Upgrade Linux kernel to 6.12.18 (LTS)
+ - Upgrade Buildroot to 2024.02.11 (LTS)
+ - Add support for link aggregation (lag), static (balance-xor) and LACP
+ - Add support for the [i.MX 8M Plus EVK][EVK]
+ - YANG type change for SSH private/public keys, from ietf-crypto-types
+   to infix-crypto-types
+ - Disable global IPv6 forwarding by default, enable by per-interface
+   setting.  Note, route advertisements are always accepted.  Issue #785
+ - Drop automatic default route (interface route) for IPv4 autoconf, not
+   necessary and causes more confusion than good.  Issue #923
+ - Update scripting with new RESTCONF examples
+
+### Fixes
+ - Fix #896: `/etc/resolv.conf` not properly generated when system runs
+   in fail secure mode (failing to load `startup-config`)
+ - Fix #902: containers "linger" in the system (state 'exited') after
+   having removed them from the configuration
+ - Fix #930: container configuration changes does not apply at runtime
+   only when saved to `startup-config` and system is rebooted
+ - Fix #936: DHCP server reconfiguration does not always take effect.
+ - Fix #956: CLI `copy` command complains it cannot change owner when
+   copying `factory-config` to `running-config`.  Bogus error, the
+   latter is not really a file
+ - Fix #977: "Operation not permitted" when saving `running-config` to
+   `startup-config` (harmless warning but annoying and concerning)
+
+[EVK]: https://www.nxp.com/design/design-center/development-boards-and-designs/8MPLUSLPD4-EVK
+
 
 [v25.01.0][] - 2025-01-31
 -------------------------
@@ -39,6 +161,7 @@ All notable changes to the project are documented in this file.
  - Add support for GRE/GRETAP tunnels
  - Add support for STP/RSTP on bridges
  - Add support for VXLAN tunnels
+ - Add support for configuring global LLDP `message-tx-interval`
 
 ### Fixes
 
@@ -1471,7 +1594,12 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
  - N/A
 
 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.01.0...HEAD
+[v25.06.0]:   https://github.com/kernelkit/infix/compare/v25.05.1...v26.06.0
+[v25.05.1]:   https://github.com/kernelkit/infix/compare/v25.05.0...v25.05.1
+[v25.05.0]:   https://github.com/kernelkit/infix/compare/v25.04.0...v25.05.0
+[v25.04.0]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
+[v25.03.0]:   https://github.com/kernelkit/infix/compare/v25.02.0...v25.03.0
+[v25.02.0]:   https://github.com/kernelkit/infix/compare/v25.01.0...v25.02.0
 [v25.01.0]:   https://github.com/kernelkit/infix/compare/v24.11.0...v25.01.0
 [v24.11.1]:   https://github.com/kernelkit/infix/compare/v24.11.0...v24.11.1
 [v24.11.0]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.11.0

doc/README.md

@@ -1,13 +1,16 @@
+<img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 
-Welcome to Infix, your friendly Network Operating System!  On these
+Welcome to Infix, your immutable, friendly, and secure operating system!
-pages you can find both user and developer documentation.
+On these pages you can find both user and developer documentation.
 
-> Topics on configuring the system include CLI examples, every setting
+Most topics on configuring the system include CLI examples, but every
-> is also possible to perform using NETCONF.  In fact, the Infix test
+setting, as well as status read-back from the operational datastore, is
-> system solely relies on NETCONF for configuring network topologies.
+also possible to perform using NETCONF or RESTCONF.  In fact, the Infix
+regression test system solely relies on NETCONF and RESTCONF.
 
-The CLI documentation is also available from inside the CLI itself using
+> [!TIP]
-the `help` command.
+> The CLI documentation is also available from inside the CLI itself
+> using the `help` command in admin-exec mode.
 
 - **CLI Topics**
    - [Introduction to the CLI](cli/introduction.md)
@@ -18,6 +21,7 @@ the `help` command.
    - [Introduction](introduction.md)
    - [System Configuration](system.md)
    - [Network Configuration](networking.md)
+   - [DHCP Server](dhcp.md)
    - [Syslog Support](syslog.md)
  - **Infix In-Depth**
    - [Boot Procedure](boot.md)

doc/boot.md

@@ -63,7 +63,7 @@ bootloader's validation procedure, user configuration is kept to a
 minimum.  Two settings are available:
 
 - **Boot order**: Since Infix maintains two copies of its software image,
-  and as some bootloaders support netbooting, the order in which boot
+  and as some bootloaders support [netbooting][2], the order in which boot
   sources are considered can be configured. To select the active
   source, use [RAUC][]:
 
@@ -349,5 +349,8 @@ can funtion reasonably well without a persistent `/var`, loosing
 If `var` is not available, Infix will still persist `/var/lib` using
 `cfg` as the backing storage.
 
-[^1]: See [CLI Upgrade](cli/upgrade.md) for information on upgrading
+[^1]: See [Upgrading procedures and boot
-    via CLI.
+    order](system.md#upgrade-procedures-and-boot-order) for
+    information on upgrading via CLI.
+
+[2]: netboot.md

doc/branding.md

@@ -214,7 +214,7 @@ text file without line breaks (`-w0`):
 ```bash
 $ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" |base64 -d
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.github.io
 '-'---'-'
 ```

doc/cli/upgrade.md

@@ -39,7 +39,12 @@ The secondary partition (`rootfs.1`) has now been upgraded and will be used as
 the *active* partition on the next boot.  Leaving the primary partition, with
 the version we are currently running, intact in case of trouble.
 
+See [upgrading procedures and boot order][2] for more information on
+    upgrading.
+
 [^1]: It is not possible to upgrade the partition we booted from.  Thankfully
     the underlying "rauc" subsystem keeps track of this.  Hence, to upgrade
     both partitions you must reboot to the new version (to verify it works)
     and then repeat the same command.
+
+[2]: ../system.md#upgrade-procedures-and-boot-order

doc/container.md

@@ -31,9 +31,9 @@ Infix comes with native support for Docker containers using [podman][].
 The [YANG model][1] describes the current level of support, complete
 enough to run both system and application containers.
 
-Key design features, like using Linux switchdev, allow users to assign
+Key design features of Infix, like using Linux switchdev, allow users to
-switch ports directly to containers, not just bridged VETH pairs, this
+assign switch ports directly to containers, not just bridged VETH pairs.
-is a rare and in many cases *unique* feature of Infix.
+This is a rare and in many cases *unique* feature of Infix.
 
 All network specific settings are done using the IETF interfaces YANG
 model, with augments for containers to ensure smooth integration with
@@ -43,7 +43,7 @@ container networking in podman.
 > Even though the `podman` command can be used directly from a shell
 > prompt, we strongly recommend using the CLI commands instead.  They
 > employ the services of a wrapper `container` script which handles the
-> integration of containers in the system.
+> integration of Docker containers in the system.
 
 
 Caution
@@ -83,18 +83,20 @@ In the CLI, containers can be run in one of two ways:
  1. `container run IMAGE [COMMAND]`, or
  2. enter `configure` context, then `edit container NAME`
 
-The former is useful mostly for testing, or running single commands in
+The first is useful mostly for testing, or running single commands in
-an image.  It is a wrapper for `podman run -it --rm ...`, while the
+an image.  It is a wrapper for `podman run -it --rm ...`.
-latter is a wrapper and adaptation of `podman create ...`.
 
-The second creates a read-only container that is automatically started
+The second creates a read-only container that by default automatically
-at every boot.  When non-volatile storage is needed, data stored in a
+start at every boot.   It basically wraps `podman create ...`.
-volume is persisted until explicitly removed from the configuration,
-i.e., across host and container reboots and upgrades.
 
-Another option is [Content Mounts](#content-mounts), where the content
+When non-volatile storage is needed two complementary options exist:
-of a file mounted into the container is kept along with the container
+
-configuration in the device's `startup-config`.
+ - **Volumes:** data stored in a volume is persisted until explicitly
+   removed from the configuration, i.e., across host reboots and
+   container upgrades
+ - **[Content Mounts](#content-mounts):** where the content of a file
+  mounted into the container is kept along with the container
+  configuration in the device's `startup-config`
 
 Podman ensures (using tmpfs) all containers have writable directories
 for certain critical file system paths: `/dev`, `/dev/shm`, `/run`,
@@ -127,24 +129,30 @@ Classic Hello World:
     Hello from Docker!
     This message shows that your installation appears to be working correctly.
 
-Persistent web server using nginx, sharing the host's network:
+A web server with [nginx][], using standard docker bridge.  Podman will
+automatically create a VETH pair for us, connecting the container to the
+`docker0` bridge:
 
     admin@example:/> configure
-    admin@example:/config> edit container web
+    admin@example:/config/> edit interface docker0
-    admin@example:/config/container/web> set image docker://nginx:alpine
+    admin@example:/config/interface/docker0/> set container-network
-    admin@example:/config/container/web> set publish 80:80
+    admin@example:/config/interface/docker0/> end
-    admin@example:/config/container/web> set network host
+    admin@example:/config/> edit container web
-    admin@example:/config/container/web> leave
+    admin@example:/config/container/web/> set image docker://nginx:alpine
+    admin@example:/config/container/web/> set network publish 8080:80
+    admin@example:/config/container/web/> set network interface docker0
+    admin@example:/config/container/web/> set volume cache target /var/cache
+    admin@example:/config/container/web/> leave
     admin@example:/> show container
 
 Exit to the shell and verify the service with curl, or try to attach
 to your device's IP address using your browser:
 
-    admin@example:~$ curl http://localhost
+    admin@example:~$ curl http://localhost:8080
 
-or connect to port 80 of your running Infix system with a browser.  See
+or connect to port 8080 of your running Infix system with a browser.
-the following sections for how to add more interfaces and manage your
+See the following sections for how to add more interfaces and manage
-container at runtime.
+your container at runtime.
 
 
 Container Images
@@ -456,11 +464,11 @@ in a `bridge`.  Below an example of a system container calls `set
 network interface docker0`, here we show how to set options for that
 network:
 
-    admin@example:/config/container/ntpd/> edit network docker0 
+    admin@example:/config/container/ntpd/> edit network interface docker0
-    admin@example:/config/container/ntpd/network/docker0/> 
+    admin@example:/config/container/ntpd/network/interface/docker0/>
-    admin@example:/config/container/ntpd/network/docker0/> set option 
+    admin@example:/config/container/ntpd/network/interface/docker0/> set option
     <string>  Options for masquerading container bridges.
-    admin@example:/config/container/ntpd/network/docker0/> help option 
+    admin@example:/config/container/ntpd/network/interface/docker0/> help option
     NAME
             option <string>
     
@@ -471,9 +479,9 @@ network:
                      mac=00:01:02:c0:ff:ee -- set fixed MAC address in container
                      interface_name=foo0   -- set interface name inside container
     
-    admin@example:/config/container/ntpd/network/docker0/> set option ip=172.17.0.2
+    admin@example:/config/container/ntpd/network/interface/docker0/> set option ip=172.17.0.2
-    admin@example:/config/container/ntpd/network/docker0/> set option interface_name=wan
+    admin@example:/config/container/ntpd/network/interface/docker0/> set option interface_name=wan
-    admin@example:/config/container/ntpd/network/docker0/> leave
+    admin@example:/config/container/ntpd/network/interface/docker0/> leave
 
 
 ### Container Host Interface
@@ -903,4 +911,5 @@ Container Image](#upgrading-a-container-image) (above).
 [14]:     https://github.com/kernelkit/curiOS/
 [15]:     https://github.com/kernelkit/curiOS/blob/2e4748f65e356b2c117f586cd9420d7ba66f79d5/board/system/rootfs/etc/inittab
 [tini]:   https://github.com/krallin/tini
+[nginx]:  https://hub.docker.com/_/nginx
 [podman]: https://podman.io

doc/developers-guide.md

@@ -131,6 +131,8 @@ This rebuilds (and installs) `foo` and `bar`, the `all` target calls
 on Buildroot to finalize the target filesystem and generate the images.
 The final `run` argument is explained below.
 
+
+
 ### `confd`
 
 The Infix `src/confd/` is the engine of the system.  Currently it is a
@@ -164,17 +166,239 @@ Now you can rebuild `confd`, just as described above, and restart Infix:
     make confd-rebuild all run
 
 
+### `statd`
+
+The Infix status daemon, `src/statd`, is responsible for populating the
+sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions,
+but unlike `confd`, it relies entirely on `yanger`, a Python script that
+gathers data from local linux services and feeds it into sysrepo.
+
+To apply changes, rebuild the image:
+
+    make python-statd-rebuild statd-rebuild all
+
+Rebuilding the image and testing on target for every change during
+development process can be tedious. Instead, `yanger` allows remote
+execution, running the script directly on the host system (test
+container):
+
+    infamy0:test # ../src/statd/python/yanger/yanger -x "../utils/ixll -A ssh d3a" ieee802-dot1ab-lldp
+
+`ixll` is a utility script that lets you run network commands using an
+**interface name** instead of a hostname. It makes operations like
+`ssh`, `scp`, and network discovery easier.
+
+Normally, `yanger` runs commands **locally** to retrieve data
+(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when
+executed with `-x "../utils/ixll -A ssh d3a"` it redirects these
+commands to a remote system connected to the local `d3a` interface via
+SSH. This setup is used for running `yanger` in an
+[interactive test environment](testing.md#interactive-usage). The yanger
+script runs on the `host` system, but key commands are executed on the
+`target` system.
+
+For debugging or testing, you can capture system command output and
+replay it later without needing a live system.
+
+To capture:
+
+    infamy0:test # ../src/statd/python/yanger/yanger -c /tmp/capture ieee802-dot1ab-lldp
+
+To replay:
+
+    infamy0:test # ../src/statd/python/yanger/yanger -r /tmp/capture ieee802-dot1ab-lldp
+
+This is especially useful when working in isolated environments or debugging
+issues without direct access to the DUT.
+
+### Upgrading Packages
+
+#### Buildroot
+
+Kernelkit maintains an internal [fork of
+Buildroot](https://github.com/kernelkit/buildroot), with branches
+following the naming scheme `YYYY.MM.patch-kkit`
+e.g. `2025.02.1-kkit`, which means a new branch should be created
+whenever Buildroot is updated. These branches should contain **only**
+changes to existing packages (but no new patches), modifications to
+Buildroot itself or upstream backports.
+
+KernelKit track the latest Buildroot LTS (Long-Term Support) release
+and updates. The upgrade of LTS minor releases is expected to have low
+impact and should be done as soon there is a patch release of
+Buildroot LTS is available.
+
+> **Depending on your setup, follow the appropriate steps below.**
+
+🔁 If you **already have** the Buildroot repo locally
+
+1. Navigate to the Buildroot directory
+   ```bash
+    $ cd buildroot
+   ```
+2. Pull the latest changes from KernelKit
+   ```bash
+   $ git pull
+   ```
+3. Fetch the latest tags from upstream
+   ```bash
+   $ git fetch upstream --tags
+   ```
+
+
+🆕 If you don't have the repo locally
+
+1. Clone the Kernelkit Buildroot repository
+   ```bash
+   $ git clone git@github.com:kernelkit/buildroot.git
+   ```
+
+2. Add the upstream remote
+   ```bash
+   $ git remote add upstream https://gitlab.com/buildroot.org/buildroot.git
+   ```
+3. Checkout old KernelKit branch
+   ```bash
+   $ git checkout 2025.02.1-kkit
+   ```
+
+
+🛠  Continue from here (applies to both cases):
+
+4. Create a new branch based on the **previous** KernelKit Buildroot
+   release (e.g.  `2025.02.1-kkit`) and name it according to the naming scheme (e.g. `2025.02.2-kkit`)
+   ```bash
+   $ git checkout -b 2025.02.2-kkit
+   ```
+5. Rebase the new branch onto the corresponding upstream release
+   ```bash
+   $ git rebase 2025.02.2
+   ```
+> [!NOTE] It is **not** allowed to rebase the branch when bumped in Infix.
+
+6. Push the new branch and tags
+   ```bash
+   $ git push origin 2025.02.2-kkit --tags
+   ```
+7. In Infix, checkout new branch of Buildroot
+   ```bash
+   $ cd buildroot
+   $ git fetch
+   $ git checkout 2025.02.2-kkit
+   ```
+8. Push changes
+Commit and push the changes. Don’t forget to update the changelog.
+
+9. Create a pull request.
+
+> [!NOTE] Remember to set the pull request label to `ci:main` to ensure full CI coverage.
+
+
+#### Linux kernel
+
+KernelKit maintains an internal [fork of Linux
+kernel](https://github.com/kernelkit/linux), with branches following
+the naming scheme `kkit-linux-[version].y`, e.g. `kkit-6.12.y`, which
+means a new branch should be created whenever the major kernel version
+is updated. This branch should contain *all* kernel patches used by
+Infix.
+
+KernelKit track the latest Linux kernel LTS (Long-Term Support)
+release and updates. The upgrade of LTS minor releases is expected to
+have low impact and should be done as soon as a patch release of the
+LTS Linux kernel is available.
+
+
+🔁 If you **already have** the Linux kernel repo locally
+
+1. Navigate to the Linux kernel directory
+   ```bash
+   $ cd linux
+   ```
+2. Get latest changes from KernelKit
+   ```bash
+   $ git pull
+   ```
+3. Fetch the latest tags from upstream
+   ```bash
+   $ git fetch upstream --tags
+   ```
+
+🆕 If you don't have the repo locally
+
+1. Clone the KernelKit Linux kernel repository
+   ```bash
+   $ git clone git@github.com:kernelkit/linux.git
+	```
+2. Add the upstream remote
+   ```bash
+   $ git remote add upstream git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+   ```
+
+3. Checkout correct kernel branch
+   ```bash
+   $ git checkout kkit-linux-6.12.y
+   ```
+
+🛠  Continue from here (applies to both cases)
+
+
+4. Rebase on the upstream release
+   ```bash
+   $ git rebase v6.12.29
+   ```
+
+6. Push changes and the tags
+   ```bash
+
+   $ git push -f origin kkit-linux-6.12.y --tags
+   ```
+
+**Move to your infix directory**
+
+7. Generate patches
+   ```bash
+   $ make x86_64_defconfig
+   $ cd output
+   $ ../utils/kernel-refresh.sh -k /path/to/linux -o 6.12.28 -t v6.12.29
+   ```
+   > [!NOTE] See help of `kernel-refresh.sh` script for more information
+
+
+8. Push changes
+   Commit and push the changes. Don’t forget to update the s:changelog:doc/ChangeLog.md.
+
+9. Create a pull request.
+   > [!NOTE] Remember to set the pull request label to `ci:main` to ensure full CI coverage.
+
+
+### Agree on YANG Model
+
+When making changes to the `confd` and `statd` services, you will often need to update
+the YANG models. If you are adding a new YANG module, it's best to follow the
+structure of an existing one. However, before making any changes, **always discuss
+them with the Infix core team**. This helps avoid issues later in development and
+makes pull request reviews smoother.
+
+
 Testing
 -------
 
 Manual testing can be done using Qemu by calling <kbd>make run</kbd>,
-see also [Infix in Virtual Environments](virtual.md).
+see also [Infix in Virtual Environments](virtual.md), or on a physical
+device by upgrading to the latest build or "[netbooting](netboot.md)"
+and running the image from RAM.  The latter is how most board porting
+work is done -- **much quicker** change-load-test cycles.
 
 The Infix automated test suite is built around Qemu and [Qeneth][2], see:
 
  * [Testing](testing.md)
  * [Docker Image](../test/docker/README.md)
 
+With any new feature added to Infix, it is essential to include relevant
+test case(s).  See the [Test Development](testing.md#test-development)
+section for guidance on adding test cases.
+
 
 Reviewing
 ---------

doc/discovery.md

@@ -46,7 +46,7 @@ admin@infix-c0-ff-ee:~$
 
 ## LLDP
 
-Infix supports LLDP (IEEE 802.1AB).  For a device with factory default
+Infix supports LLDP (IEEE 802.1AB). For a device with factory default
 settings, the link-local IPv6 address can be read from the Management
 Address TLV using *tcpdump* or other sniffing tools[^1]:
 
@@ -131,6 +131,10 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
 linux-pc:#
 ```
 
+The following capabilities are available via NETCONF/RESTCONF or the Infix CLI.
+
+### LLDP Enable/Disable
+
 The LLDP service can be disabled using the following commands.
 
 ```
@@ -140,6 +144,59 @@ admin@infix-c0-ff-ee:/config/> leave
 admin@infix-c0-ff-ee:/> 
 ```
 
+To reenable it from the CLI config mode:
+
+```
+admin@test-00-01-00:/config/> set lldp enabled 
+admin@test-00-01-00:/config/> leave
+```
+
+### LLDP Message Transmission Interval
+
+By default, LLDP uses a `message-tx-interval` of 30 seconds, as defined
+by the IEEE standard. Infix allows this value to be customized.
+To change it using the CLI:
+
+```
+admin@test-00-01-00:/config/> set lldp message-tx-interval 1
+admin@test-00-01-00:/config/> leave
+```
+
+### LLDP Administrative Status per Interface
+
+Infix supports configuring the LLDP administrative status on a per-port
+basis. The default mode is `tx-and-rx`, but the following options are 
+also supported:
+
+- `rx-only` – Receive LLDP packets only
+- `tx-only` – Transmit LLDP packets only
+- `disabled` – Disable LLDP on the interface
+
+Example configuration:
+
+```
+admin@test-00-01-00:/config/> set lldp port e8 dest-mac-address 01:80:C2:00:00:0E admin-status disabled
+admin@test-00-01-00:/config/> set lldp port e5 dest-mac-address 01:80:C2:00:00:0E admin-status rx-only 
+admin@test-00-01-00:/config/> set lldp port e6 dest-mac-address 01:80:C2:00:00:0E admin-status tx-only
+admin@test-00-01-00:/config/> leave
+```
+
+> [!NOTE]
+> The destination MAC address must be the standard LLDP multicast 
+> address: `01:80:C2:00:00:0E`.
+
+###  Displaying LLDP Neighbor Information
+
+In CLI mode, Infix also provides a convenient `show lldp` command to
+list LLDP neighbors detected on each interface:
+
+```
+admin@test-00-01-00:/> show lldp 
+INTERFACE       REM-IDX   TIME        CHASSIS-ID          PORT-ID             
+e5              1         902         00:a0:85:00:04:01   00:a0:85:00:04:07   
+e6              3         897         00:a0:85:00:03:01   00:a0:85:00:03:07   
+e8              2         901         00:a0:85:00:02:01   00:a0:85:00:02:05
+```
 
 ## mDNS-SD
 
@@ -237,7 +294,7 @@ rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
 linux-pc:# ssh admin@infix-c0-ff-ee.local
 (admin@infix-c0-ff-ee.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-
 
@@ -277,7 +334,7 @@ rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
 linux-pc:# ssh admin@infix.local
 (admin@infix.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-
 

doc/eth-counters.md

@@ -6,13 +6,7 @@ This column contains the mapping between YANG and Linux / Ethtool counters.
 ┌─────────────────────────────────┬──────────────────────────────────┐
 │ YANG                            │ Linux / Ethtool                  │
 ├─────────────────────────────────┼──────────────────────────────────┤
-│ out-frames                      │ FramesTransmittedOK              │
+│ in-total-octets                 │ FramesReceivedOK,                │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ out-multicast-frames            │ MulticastFramesXmittedOK         │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ out-broadcast-frames            │ BroadcastFramesXmittedOK         │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ in-total-frames                 │ FramesReceivedOK,                │
 │                                 │ FrameCheckSequenceErrors         │
 │                                 │ FramesLostDueToIntMACRcvError    │
 │                                 │ AlignmentErrors                  │
@@ -25,8 +19,23 @@ This column contains the mapping between YANG and Linux / Ethtool counters.
 ├─────────────────────────────────┼──────────────────────────────────┤
 │ in-broadcast-frames             │ BroadcastFramesReceivedOK        │
 ├─────────────────────────────────┼──────────────────────────────────┤
+│ in-error-fcs-frames             │ FrameCheckSequenceErrors         │
+├─────────────────────────────────┼──────────────────────────────────┤
 │ in-error-undersize-frames       │ undersize_pkts                   │
 ├─────────────────────────────────┼──────────────────────────────────┤
-│ in-error-fcs-frames             │ FrameCheckSequenceErrors         │
+| in-error-oversize-frames        | etherStatsJabbers,               |
+|                                 | etherStatsOversizePkts           |
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-error-mac-internal-frames    │ FramesLostDueToIntMACRcvError    │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-frames                      │ FramesTransmittedOK              │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-multicast-frames            │ MulticastFramesXmittedOK         │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-broadcast-frames            │ BroadcastFramesXmittedOK         │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ infix-eth:out-good-octets       │ OctetsTransmittedOK              │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ infix-eth:in-good-octets        │ OctetsReceivedOK                 │
 └─────────────────────────────────┴──────────────────────────────────┘
 ```

doc/management.md

@@ -79,11 +79,11 @@ typically setup to run at 115200 baud, 8N1.
 
 
 ```
-Infix -- a Network Operating System v24.11.1 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v24.11.1 (ttyS0)
 example login: admin
 Password:
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'
 
@@ -193,3 +193,11 @@ admin@example:/config/web/> edit restconf
 admin@example:/config/web/restconf/> no enabled
 admin@example:/config/web/restconf/>
 ```
+
+# System Upgrade
+
+See [upgrading procedures and boot order][1] for information on
+    upgrading.
+
+
+[1]: system.md#upgrade-procedures-and-boot-order

doc/netboot.md

@@ -0,0 +1,130 @@
+Netboot HowTo
+=============
+
+This document describes how to set up network booting U-Boot devices on
+a LAN, e.g., when working with an evaluation board or other embedded
+system.  The most secure way to do this is with a local LAN between a PC
+and the device.
+
+Instead of setting up everything in U-Boot to download the Linux Image,
+device tree, and initramfs, we will let U-Boot download a script with
+instructions to run.  When you have multiple systems (boards) this
+quickly becomes a lot easier to manage.
+
+> [!NOTE]
+> Instructions in this HowTo assume a Debian based development system,
+> e.g., Ubuntu or Linux Mint.
+
+
+## Network Interface Setup
+
+For two dedicated network interfaces, here `eth2` and `eth3` (ymmv), we
+create an old-style interfaces config[^1] with the following content:
+
+```
+# /etc/network/interfaces.d/gimli
+auto eth2
+iface eth2 inet static
+        address 192.168.0.1
+        netmask 255.255.255.0
+
+auto eth3
+iface eth3 inet manual
+```
+
+> [!TIP]
+> Use configuration file names in `.d/` directories that make sense and
+> can easily be remembered.  Here we use the hostname of the PC.
+
+
+## DHCP/TFTP Server Setup
+
+The examples given here use `dnsmasq`, which provides both DHCP and TFTP
+server support.  The same can be achieved with other implementations.
+
+Similar to `interfaces.d`, dnsmasq has an `/etc/dnsmasq.d` directory so
+we can use "snippets" instead of modifying `/etc/dnsmasq.conf` directly.
+Add a file called `/etc/dnsmasq.d/gimli`.
+
+Initial content:
+
+```
+# Remember IP address handed out to BOOTP clients
+bootp-dynamic
+# Disable check-if-ip-address-is-already-used
+no-ping
+
+# Enable TFTP server, use /srv/ftp, same as any FTP server, useful
+# when using the same images for system upgrade as for netbooting.
+enable-tftp
+tftp-root=/srv/ftp
+```
+
+> [!CAUTION]
+> First of all, make sure you DO NOT accidentally set up dnsmasq so that
+> it starts acting as a DHCP server also on your office LAN!  Follow the
+> instructions below for more details.
+
+If you have many interfaces used for lab equipment and only one office
+LAN interface, then use something like this:
+
+```
+# Disable DHCP server on loopback and office LAN (eth0)
+except-interface=lo
+except-interface=eth0
+```
+
+To further lock this down, we only run the DHCP server on each of the
+interfaces used for lab equipment, with a dedicated IP range as well:
+
+```
+# Currently I have an imx8mp-evk on eth2, so on my system I have a
+# symlink bootfile-eth2 -> netboot.scr
+interface=eth2
+dhcp-range=192.168.0.100,192.168.0.199,1h
+dhcp-boot=tag:eth2,bootfile-eth2
+```
+
+## Bootfile netboot.scr
+
+The bootfile U-Boot retrieves from the TFTP server is a script that
+looks like this, `netboot.sh`:
+
+```sh
+setenv ramdisk_addr_r 0x58000000
+setenv fdt_addr_r     0x50400000
+
+setenv autoboot off
+tftp ${fdt_addr_r}     imx8mp-evk/imx8mp-evk.dtb
+tftp ${kernel_addr_r}  imx8mp-evk/Image
+tftp ${ramdisk_addr_r} imx8mp-evk/rootfs.squashfs
+
+setenv bootargs console=ttymxc1,115200 root=/dev/ram0 brd.rd_size=500000 rauc.slot=net
+booti ${kernel_addr_r} ${ramdisk_addr_r}:${filesize} ${fdt_addr_r}
+```
+
+U-Boot cannot read script files directly, so we need to wrap it with a
+FIT format header, this is done by first converting it on the PC:
+
+```
+$ mkimage -T script -d netboot.sh netboot.scr
+```
+
+The output is `netboot.scr` which we symlink to above in the dnsmasq
+setup step.
+
+
+## U-Boot Commands
+
+U-Boot is a maze of environment variables, some with values, some wrap
+commands, and most are undocumented.  We will use a prefix for our
+variables to ensure we do not overwrite anything you may want to use
+later.
+
+```sh
+==> setenv ixboot 'dhcp && source \${fileaddr}'
+==> saveenv
+```
+
+
+[^1]: To prevent NetworkManager from automatically managing the interfaces.

doc/networking.md

@@ -48,7 +48,7 @@ other traffic would be bridged as usual.
 | bridge   | infix-if-bridge            | SW implementation of an IEEE 802.1Q bridge                   |
 | ip       | ietf-ip, infix-ip          | IP address to the subordinate interface                      |
 | vlan     | infix-if-vlan              | Capture all traffic belonging to a specific 802.1Q VID       |
-| lag[^1]  | infix-if-lag               | Bond multiple interfaces into one, creating a link aggregate |
+| lag      | infix-if-lag               | Link aggregation, static and IEEE 802.3ad (LACP)             |
 | lo       | ietf-interfaces            | Software loopback interface                                  |
 | eth      | ieee802-ethernet-interface | Physical Ethernet device/port.                               |
 |          | infix-ethernet-interface   |                                                              |
@@ -430,6 +430,265 @@ admin@example:/config/interface/br0/bridge/> set ieee-group-forward lldp
 admin@example:/config/interface/br0/bridge/>
 ```
 
+
+### Link Aggregation
+
+A link aggregate, or *lag*, allows multiple physical interfaces to be
+combined into a single logical interface, providing increased bandwidth
+(in some cases) and redundancy (primarily).  Two modes of qualifying lag
+member ports are available:
+
+ 1. **static**: Active members selected based on link status (carrier)
+ 2. **lacp:** IEEE 802.3ad Link Aggregation Control Protocol
+
+In LACP mode, LACPDUs are exchanged by the link partners to qualify each
+lag member, while in static mode only carrier is used.  This additional
+exchange in LACP ensures traffic can be forwarded in both directions.
+
+Traffic distribution, for both modes, across the active lag member ports
+is determined by the hash policy[^1].  It uses an XOR of the source,
+destination MAC addresses and the EtherType field.  This, IEEE
+802.3ad-compliant, algorithm will place all traffic to a particular
+network peer on the same link.  Meaning there is no increased bandwidth
+for communication between two specific devices.
+
+> [!TIP]
+> Similar to other interface types, naming your interface `lagN`, where
+> `N` is a number, allows the CLI to automatically infer the interface
+> type as LAG.
+
+
+#### Basic Configuration
+
+Creating a link aggregate interface and adding member ports:
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface lag0
+admin@example:/config/interface/lag0/> set lag mode static
+admin@example:/config/interface/lag0/> end
+admin@example:/config/> set interface eth7 lag-port lag lag0
+admin@example:/config/> set interface eth8 lag-port lag lag0
+admin@example:/config/> leave
+```
+
+A static lag responds only to link (carrier) changes of member ports.
+E.g., in this example egressing traffic is continuously distributed over
+the two links until link down on one link is detected, triggering all
+traffic to be steered to the sole remaining link.
+
+
+#### LACP Configuration
+
+LACP mode provides dynamic negotiation of the link aggregate.  Key
+settings include:
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface lag0
+admin@example:/config/interface/lag0/> set lag mode lacp
+admin@example:/config/interface/lag0/> set lag lacp mode passive
+admin@example:/config/interface/lag0/> set lag lacp rate fast
+admin@example:/config/interface/lag0/> set lag lacp system-priority 100
+```
+
+LACP mode supports two operational modes:
+
+ - **active:** Initiates negotiation by sending LACPDUs (default)
+ - **passive:** Waits for peer to initiate negotiation
+
+> [!NOTE]
+> At least one end of the link must be in active mode for negotiation to occur.
+
+The LACP rate setting controls protocol timing:
+
+ - **slow:** LACPDUs sent every 30 seconds, with 90 second timeout (default)
+ - **fast:** LACPDUs sent every second, with 3 second timeout
+
+
+#### Link Flapping
+
+To protect against link flapping, debounce timers can be configured to
+delay link qualification.  Usually only the `up` delay is needed:
+
+```
+admin@example:/config/interface/lag0/lag/link-monitor/> edit debounce
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set up 500
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set down 200
+```
+
+#### Operational Status, Overview
+
+Like other interfaces, link aggregates are also available in the general
+interfaces overview in the CLI admin-exec context.  Here is the above
+static mode aggregate:
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+.
+.
+.
+lag0            lag        UP          static: balance-xor, hash: layer2
+│               ethernet   UP          00:a0:85:00:02:00
+├ eth7          lag        ACTIVE
+└ eth8          lag        ACTIVE
+```
+
+Same aggregate, but in LACP mode:
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+.
+.
+.
+lag0            lag        UP          lacp: active, rate: fast (1s), hash: layer2
+│               ethernet   UP          00:a0:85:00:02:00
+├ eth7          lag        ACTIVE      active, short_timeout, aggregating, in_sync, collecting, distributing
+└ eth8          lag        ACTIVE      active, short_timeout, aggregating, in_sync, collecting, distributing
+```
+
+
+#### Operational Status, Detail
+
+In addition to basic status shown in the interface overview, detailed
+LAG status can be inspected:
+
+```
+admin@example:/> show interfaces name lag0
+name                : lag0
+index               : 25
+mtu                 : 1500
+operational status  : up
+physical address    : 00:a0:85:00:02:00
+lag mode            : static
+lag type            : balance-xor
+lag hash            : layer2
+link debounce up    : 0 msec
+link debounce down  : 0 msec
+ipv4 addresses      :
+ipv6 addresses      :
+in-octets           : 0
+out-octets          : 2142
+```
+
+Same aggregate, but in LACP mode:
+
+```
+admin@example:/> show interfaces name lag0
+name                : lag0
+index               : 24
+mtu                 : 1500
+operational status  : up
+physical address    : 00:a0:85:00:02:00
+lag mode            : lacp
+lag hash            : layer2
+lacp mode           : active
+lacp rate           : fast (1s)
+lacp aggregate id   : 1
+lacp system priority: 65535
+lacp actor key      : 9
+lacp partner key    : 9
+lacp partner mac    : 00:a0:85:00:03:00
+link debounce up    : 0 msec
+link debounce down  : 0 msec
+ipv4 addresses      :
+ipv6 addresses      :
+in-octets           : 100892
+out-octets          : 111776
+```
+
+Member ports provide additional status information:
+
+ - Link failure counter: number of detected link failures
+ - LACP state flags: various states of LACP negotiation:
+   - `active`: port is actively sending LACPDUs
+   - `short_timeout`: using fast rate (1s) vs. slow rate (30s)
+   - `aggregating`: port is allowed to aggregate in this LAG
+   - `in_sync`: port is synchronized with partner
+   - `collecting`: port is allowed to receive traffic
+   - `distributing`: port is allowed to send traffic
+   - `defaulted`: using default partner info (partner not responding)
+   - `expired`: partner info has expired (no LACPDUs received)
+ - Aggregator ID: unique identifier for this LAG group
+ - Actor state: LACP state flags for this port (local)
+ - Partner state: LACP state flags from the remote port
+
+Example member port status:
+
+```
+admin@example:/> show interfaces name eth7
+name                : eth7
+index               : 8
+mtu                 : 1500
+operational status  : up
+physical address    : 00:a0:85:00:02:00
+lag member          : lag0
+lag member state    : active
+lacp aggregate id   : 1
+lacp actor state    : active, short_timeout, aggregating, in_sync, collecting, distributing
+lacp partner state  : active, short_timeout, aggregating, in_sync, collecting, distributing
+link failure count  : 0
+ipv4 addresses      :
+ipv6 addresses      :
+in-octets           : 473244
+out-octets          : 499037
+```
+
+
+#### Example: Switch Uplink with LACP
+
+LACP mode provides the most robust operation, automatically negotiating
+the link aggregate and detecting configuration mismatches.
+
+A common use case is connecting a switch to an upstream device:
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface lag0
+admin@example:/config/interface/lag0/> set lag mode lacp
+```
+
+Enable fast LACP for quicker fail-over:
+
+```
+admin@example:/config/interface/lag0/> set lag lacp rate fast
+```
+
+Add uplink ports
+
+```
+admin@example:/config/interface/lag0/> end
+admin@example:/config/> set interface eth7 lag-port lag lag0
+admin@example:/config/> set interface eth8 lag-port lag lag0
+```
+
+Enable protection against "link flapping".
+
+```
+admin@example:/config/interface/lag0/> edit lag link-monitor
+admin@example:/config/interface/lag0/lag/link-monitor/> edit debounce
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set up 500
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set down 200
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> top
+```
+
+Add to bridge for switching
+
+```
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> end
+admin@example:/config/> set interface lag0 bridge-port bridge br0
+admin@example:/config/> leave
+```
+
+
 ### VLAN Interfaces
 
 Creating a VLAN can be done in many ways.  This section assumes VLAN
@@ -800,7 +1059,7 @@ The resulting address (10.1.2.100/24) is of type *dhcp*.
 The (only) way to disable IPv6 link-local addresses is by disabling IPv6
 on the interface.
 
-```(disabling
+```
 admin@example:/> configure
 admin@example:/config/> edit interface eth0 ipv6
 admin@example:/config/interface/eth0/ipv6/> set enabled false
@@ -914,33 +1173,38 @@ have changed type to *random*.
 To be able to route (static or dynamic) on the interface it is
 required to enable forwarding. This setting controls if packets
 received on this interface can be forwarded.
-   ```
+
-   admin@example:/config/> edit interface eth0
+```
-   admin@example:/config/interface/eth0/> set ipv4 forwarding
+admin@example:/config/> edit interface eth0
-   admin@example:/config/interface/eth0/> leave
+admin@example:/config/interface/eth0/> set ipv4 forwarding
-   admin@example:/>
+admin@example:/config/interface/eth0/> leave
-   ```
+admin@example:/>
+```
 
 
 ### IPv6 forwarding
 
-This flag behaves totally different than for IPv4. For IPv6 the
+Due to how the Linux kernel manages IPv6 forwarding, we can not fully
-ability to route between interfaces is always enabled, instead this
+control it per interface via this setting like how IPv4 works.  Instead,
-flag controls if the interface will be in host/router mode.
+IPv6 forwarding is globally enabled when at least one interface enable
+forwarding, otherwise it is disabled.
 
-| **Feature**                              | **Forward enabled** | **Forward disabled** |
+The following table shows the system IPv6 features that the `forwarding`
-|:-----------------------------------------|:--------------------|:---------------------|
+setting control when it is *Enabled* or *Disabled:
-| IsRouter set in Neighbour Advertisements | Yes                 | No                   |
-| Transmit Router Solicitations            | No                  | Yes                  |
-| Router Advertisements are ignored        | No                  | Yes                  |
-| Accept Redirects                         | No                  | Yes                  |
 
-   ```
+| **IPv6 Feature**                         | **Enabled** | **Disabled** |
-   admin@example:/config/> edit interface eth0
+|:-----------------------------------------|:------------|:-------------|
-   admin@example:/config/interface/eth0/> set ipv6 forwarding
+| IsRouter set in Neighbour Advertisements | Yes         | No           |
-   admin@example:/config/interface/eth0/> leave
+| Transmit Router Solicitations            | No          | Yes          |
-   admin@example:/>
+| Router Advertisements are ignored        | Yes         | Yes          |
-   ```
+| Accept Redirects                         | No          | Yes          |
+
+```
+admin@example:/config/> edit interface eth0
+admin@example:/config/interface/eth0/> set ipv6 forwarding
+admin@example:/config/interface/eth0/> leave
+admin@example:/>
+```
 
 
 ## Routing support
@@ -1228,7 +1492,7 @@ currently supported, namely `ipv4` and `ipv6`.
 [4]: https://www.rfc-editor.org/rfc/rfc3442
 [0]: https://frrouting.org/
 
-[^1]: Please note, link aggregates are not yet supported.
+[^1]: `(source MAC XOR destination MAC XOR EtherType) MODULO num_links`
 [^2]: Link-local IPv6 addresses are implicitly enabled when enabling
     IPv6.  IPv6 can be enabled/disabled per interface in the
     [ietf-ip][2] YANG model.

doc/scripting.md

@@ -92,7 +92,7 @@ Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
 Warning: Permanently added 'fe80::ff:fe00:0%eth0' (ED25519) to the list of known hosts.
 admin@fe80::ff:fe00:0%eth0's password: *****
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'
 
@@ -853,14 +853,18 @@ models for details.
 ### Factory Reset
 
 ```
-~$ curl -kX POST -H "Content-Type: application/yang-data+json" https://example.local/restconf/operations/ietf-factory-default:factory-reset -u admin:admin
+~$ curl -kX POST -u admin:admin \
+        -H "Content-Type: application/yang-data+json" \
+		https://example.local/restconf/operations/ietf-factory-default:factory-reset
 curl: (56) OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while reading, errno 0
 ```
 
 ### System Reboot
 
 ```
-~$ curl -kX POST -H "Content-Type: application/yang-data+json" https://example.local/restconf/operations/ietf-system:system-restart -u admin:admin
+~$ curl -kX POST -u admin:admin \
+        -H "Content-Type: application/yang-data+json" \
+		https://example.local/restconf/operations/ietf-system:system-restart
 ```
 
 ### Set Date and Time
@@ -868,7 +872,11 @@ curl: (56) OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while r
 Here's an example of an RPC that takes input/argument:
 
 ```
-~$ curl -kX POST -H "Content-Type: application/yang-data+json" https://example.local/restconf/operations/ietf-system:set-current-datetime -u admin:admin -d '{"ietf-system:input": {"current-datetime": "2024-04-17T13:48:02-01:00"}}'
+~$ curl -kX POST -u admin:admin \
+	    -H "Content-Type: application/yang-data+json" \
+	    -d '{"ietf-system:input": {"current-datetime": "2024-04-17T13:48:02-01:00"}}' \
+		https://example.local/restconf/operations/ietf-system:set-current-datetime
+
 ```
 
 You can verify that the changes took by a remote SSH command:
@@ -879,6 +887,51 @@ Wed Apr 17 14:48:12 UTC 2024
 ~$
 ```
 
+### Read Hostname
+
+Example of fetching JSON configuration data to stdout:
+
+```
+~$ curl -kX GET -u admin:admin \
+        -H 'Accept: application/yang-data+json' \
+		https://example.local/restconf/data/ietf-system:system/hostname
+{
+  "ietf-system:system": {
+    "hostname": "foo"
+  }
+}
+```
+
+### Set Hostname
+
+Example of inline JSON data:
+
+```
+~$ curl -kX PATCH -u admin:admin \
+     -H 'Content-Type: application/yang-data+json' \
+     -d '{"ietf-system:system":{"hostname":"bar"}}' \
+     https://example.local/restconf/data/ietf-system:system
+```
+
+### Copy Running to Startup
+
+No copy command available yet to copy between datastores, and the
+Rousette back-end also does not support "write-through" to the
+startup datastore.
+
+To save running-config to startup-config, use the following example to
+fetch running to a local file and then update startup with it:
+
+```
+~$ curl -kX GET -u admin:admin -o running-config.json \
+        -H 'Accept: application/yang-data+json'       \
+         https://example.local/restconf/ds/ietf-datastores:running
+
+~$ curl -kX PUT -u admin:admin -d @running-config.json \
+        -H 'Content-Type: application/yang-data+json'  \
+        https://example.local/restconf/ds/ietf-datastores:startup
+```
+
 
 ## Miscellaneous
 
@@ -1210,7 +1263,7 @@ It should now be possible to access the switch from the PC via SSH (or NETCONF).
 ~ $ ssh admin@fe80::0053:00ff:fe06:1101%eth1
 admin@fe80::0053:00ff:fe06:1101%eth1's password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'
 

doc/system.md

@@ -323,7 +323,439 @@ reference ID, stratum, time offsets, frequency, and root delay.
 > The system uses `chronyd` Network Time Protocol (NTP) daemon.  The
 > output shown here is best explained in the [Chrony documentation][4].
 
+## Upgrade procedures and boot order
+
+For resilience purposes, Infix maintains two software
+images referred to as the _primary_ and _secondary_ partition image.
+In addition, some bootloaders support [netbooting][6].
+
+The _boot order_ defines which image is tried first, and is listed
+with the CLI `show software` command. It also shows Infix version
+installed per partition, and which image was used when booting (`STATE
+booted`).
+
+```
+admin@example:/> show software
+BOOT ORDER
+primary secondary net
+
+NAME      STATE     VERSION                DATE
+primary   booted    v25.01.0               2025-04-25T10:15:00+00:00
+secondary inactive  v25.01.0               2025-04-25T10:07:20+00:00
+admin@example:/>
+```
+
+YANG support for upgrading Infix, inspecting and _modifying_ the
+boot-order, is defined in [infix-system-software][5].
+
+
+### Upgrading Infix
+
+Upgrading Infix is done one partition at a time. If the system has
+booted from one partition, an `upgrade` will apply to the other
+(inactive) partition.
+
+1. Download and unpack the release to install. Make the image *pkg*
+   bundle available at some URL[^10]
+2. (Optional) Backup the startup configuration
+3. Assume the unit has booted the `primary` image. Then running the
+   `upgrade` command installs a new image on the `secondary`
+   partition
+4. As part of a successful upgrade, the boot-order is implictly
+   changed to boot the newly installed image
+5. Reboot the unit
+6. The unit now runs the new image. To upgrade the remaining partition
+   (`primary`), run the same upgrade command again, and (optionally)
+   reboot to verify the upgrade
+   
+> [!CAUTION]
+> During boot (step 5), the unit may
+> [migrate](#configuration-migration) the startup configuration for
+> any syntax changes.  It is therefore important that you make sure to
+> upgrade the other partition as well after reboot, of course after
+> having verified your setup.
+
+The CLI example below shows steps 2-5.
+
+*Backup startup configuration:* It is recommended to backup the
+startup configuration before performing an upgrade. The backup is
+useful if the upgrade fails, and makes a later
+[downgrade](#downgrading-infix) smoother to conduct.
+
+```
+admin@example:/> dir /cfg
+/cfg directory
+backup/             ssl/                startup-config.cfg
+
+admin@example:/> copy /cfg/startup-config.cfg /cfg/v25.01.0-startup-config.cfg
+admin@example:/> dir /cfg
+/cfg directory
+backup/             ssl/                startup-config.cfg           v25.01.0-startup-config.cfg
+
+admin@example:/> 
+```
+
+*Upgrade:* Here the image *pkg bundle* was made available via TFTP.
+
+```
+admin@example:/> upgrade tftp://198.18.117.1/infix-aarch64-25.03.1.pkg
+installing
+  0% Installing
+  0% Determining slot states
+ 10% Determining slot states done.
+...
+ 98% Copying image to rootfs.1
+ 99% Copying image to rootfs.1
+ 99% Copying image to rootfs.1 done.
+ 99% Updating slots done.
+100% Installing done.
+Installing `tftp://198.18.117.1/infix-aarch64-25.03.1.pkg` succeeded
+admin@example:/>
+```
+
+*Reboot:* The unit will boot on the other partition, with the newly
+installed image. The `Loading startup-config` step conducts migration
+of startup configuration if applicable.
+
+```
+admin@example:/> reboot
+[ OK ] Stopping Static routing daemon
+[ OK ] Stopping Zebra routing daemon
+...
+[ OK ] Loading startup-config
+[ OK ] Verifying self-signed https certificate
+[ OK ] Update DNS configuration
+[ OK ] Starting Status daemon
+
+Infix OS — Immutable.Friendly.Secure v25.03.1 (ttyS0)
+example login: admin
+Password:
+.-------.
+|  . .  | Infix OS — Immutable.Friendly.Secure
+|-. v .-| https://kernelkit.org
+'-'---'-'
+
+Run the command 'cli' for interactive OAM
+
+admin@example:~$ cli
+
+See the 'help' command for an introduction to the system
+
+admin@example:/> show software
+BOOT ORDER
+secondary primary net
+
+NAME      STATE     VERSION                DATE
+primary   inactive  v25.01.0               2025-04-25T10:15:00+00:00
+secondary booted    v25.03.1               2025-04-25T10:24:31+00:00
+admin@example:/>
+```
+
+As shown, the *boot order* has been updated, so that *secondary* is
+now the preferred boot source.
+
+To upgrade the remaining partition (`primary`), run the `upgrade URL`
+command again, and (optionally) reboot.
+
+### Configuration Migration
+
+The example above illustrated an upgrade from Infix v25.01.0 to
+v25.03.1. Inbetween these versions, YANG configuration definitions
+changed slightly (more details given below).
+
+During boot, Infix inspects the `version` meta information within the
+startup configuration file to determine if configuration migration is
+needed. In this specific case, the configuration file has version
+`1.4` while the booted software expects version `1.5` (the
+configuration version numbering differs from the Infix image version
+numbering).  The startup configuration is migrated to `1.5`
+definitions and stored, while a backup previous startup configuration
+is stored in directory `/cfg/backup/`.
+
+```
+admin@example:/> dir /cfg/backup/
+/cfg/backup/ directory
+startup-config-1.4.cfg
+
+admin@example:/>
+```
+
+The modifications made to the startup configuration can be viewed by
+comparing the files from the *shell*. An example is shown below.
+
+```
+admin@example:/> exit
+admin@example:~$ diff /cfg/backup/startup-config-1.4.cfg /cfg/startup-config.cfg
+--- /cfg/backup/startup-config-1.4.cfg
++++ /cfg/startup-config.cfg
+...
+-          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
++          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+...
+-          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
++          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+...
+-    "version": "1.4"
++    "version": "1.5"
+...
+admin@example:~$
+```
+
+### Downgrading Infix
+
+Downgrading to an earlier Infix version is possible, however,
+downgrading is **not** guaranteed to work smoothly. In particular,
+when the unit boots up with the downgraded version, it may fail to
+apply the *startup config*, and instead apply its [failure config][7].
+
+We consider two cases: downgrading with or without applying a backup
+startup configuration before rebooting.
+
+In both cases we start out with a unit running Infix v25.03.1, and
+wish to downgrade to v25.01.0.
+
+```
+admin@example:/> show software
+BOOT ORDER
+primary secondary net
+
+NAME      STATE     VERSION                DATE
+primary   booted    v25.03.1               2025-04-25T11:36:26+00:00
+secondary inactive  v25.03.1               2025-04-25T10:24:31+00:00
+admin@example:/>
+```
+
+#### Downgrading when applying a backup startup configuration
+
+This is the recommended approach to downgrade, given that you have a
+backup configuration available.  The objective is to avoid ending up
+with the unit in *failure config*.
+
+1. Find the backup configuration file.
+2. Run `upgrade URL` to install Infix image to downgrade to.
+3. Copy backup startup configuration to current startup configuration
+   (from shell).
+4. Reboot.
+
+*Find the backup configuration file:*
+
+Assume you have a backup startup config for the Infix version to
+downgrade to (here Infix v25.01.0, config `version 1.4`).
+
+The preferred approach is to use a startup configuration backed up
+when running Infix v25.01.0 on the unit. See the section on [upgrading
+Infix](#upgrading-infix) above for more information. In the example
+below, there is a backup file available named
+*v25.01.0-startup-config.cfg* 
+
+```
+admin@example:/> dir /cfg
+/cfg directory
+backup/             ssl/                startup-config.cfg           v25.01.0-startup-config.cfg
+
+admin@example:/> 
+```
+
+The alternative is to use a startup config implicitly backed up by the
+system as part of [configuration migration](#configuration-migration).
+
+```
+admin@example:/> dir /cfg/backup/
+/cfg/backup/ directory
+startup-config-1.4.cfg
+
+admin@example:/>
+```
+
+> [!CAUTION] Using a backup configuration file stored when the unit
+> was running the old version (e.g., v25.01.0-startup-config.cfg) is
+> preferred. Although backup files stored due to configuration
+> migration (e.g., startup-config-1.4.cfg) usually works too if the
+> configuration file version (`1.4`) matches, there are
+> situations when the system may fail to apply it as described below.
+
+The *configuration file version* (`1.4`) is only incremented when
+changes in YANG configuration syntax mandates it to handle
+*upgrading*.  Say the next Infix version includes a new feature
+setting, it can still have version `1.4`, as upgrading to it would not
+need migration. If a user then enables the new feature setting, the
+new configuration will no longer be compatible with the previous *Infix
+version*. A downgrade after enabling new features risks ending up with
+the unit in *failure config*. 
+
+
+*Use `upgrade` command to downgrade:*
+
+```
+admin@example:/> upgrade tftp://198.18.117.1/infix-aarch64-25.01.0.pkg
+installing
+  0% Installing
+  0% Determining slot states
+ 10% Determining slot states done.
+ ...
+ 99% Copying image to rootfs.1 done.
+ 99% Updating slots done.
+100% Installing done.
+Installing `tftp://198.18.117.1/infix-aarch64-25.01.0.pkg` succeeded
+admin@example:/>
+```
+
+*Apply the backup configuration file:*
+
+It is recommended to use a backup configuration file for the Infix version to
+downgrade to, if there is one available.
+
+```
+admin@example:/> copy /cfg/v25.01.0-startup-config.cfg /cfg/startup-config.cfg
+Overwrite existing file /cfg/startup-config.cfg (y/N)? y
+admin@example:/>
+```
+
+An alternative is to use a backup file stored when the system
+conducted a [configuration migration](#configuration-migration). See
+the *caution* note above.
+
+```
+admin@example:/> copy /cfg/backup/startup-config-1.4.cfg /cfg/startup-config.cfg
+Overwrite existing file /cfg/startup-config.cfg (y/N)? y
+admin@example:/>
+```
+
+*Reboot:*
+
+The unit will come up with the applied backup configuration. 
+
+```
+admin@example:/> reboot
+[ OK ] Saving system clock to file
+[ OK ] Stopping Software update service
+[ OK ] Stopping Status daemon
+...
+[ OK ] Bootstrapping YANG datastore
+[ OK ] Starting Configuration daemon
+[ OK ] Loading startup-config
+[ OK ] Update DNS configuration
+[ OK ] Verifying self-signed https certificate
+[ OK ] Starting Status daemon
+
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
+example login:
+```
+> [!NOTE]
+> If the unit despite these measures ends up in *failure config*, see
+> the next section for more information on how to recover.
+
+#### Downgrading without applying a backup startup configuration
+
+This procedure assumes you have access to the unit's console port and
+its default login credentials[^9].
+
+1. Downgrade
+2. Reboot
+3. Login with unit's default credentials
+4. Conduct factory reset
+5. (Then go on configure the unit as you wish)
+
+*Use `upgrade` command to downgrade:*
+
+```
+admin@example:/> upgrade tftp://198.18.117.1/infix-aarch64-25.01.0.pkg
+installing
+  0% Installing
+  0% Determining slot states
+ 10% Determining slot states done.
+ ...
+ 99% Copying image to rootfs.1 done.
+ 99% Updating slots done.
+100% Installing done.
+Installing `tftp://198.18.117.1/infix-aarch64-25.01.0.pkg` succeeded
+admin@example:/>
+```
+
+*Reboot:*
+
+Conduct a reboot. During boot, the unit fails to apply the existing
+startup configuration (config version `1.5` while software expects
+version `1.4` or earlier), and instead applies its [failure
+config][7]. This is what is seen on the console when this situation
+occurs. Note that the login prompt displays `failed` as part of the
+*hostname*.
+
+```
+admin@example:/> reboot
+[ OK ] Saving system clock to file
+[ OK ] Stopping Software update service
+[ OK ] Stopping Status daemon
+...
+[ OK ] Verifying SSH host keys
+[ OK ] Bootstrapping YANG datastore
+[ OK ] Starting Configuration daemon
+[FAIL] Loading startup-config
+[ OK ] Loading failure-config
+[ OK ] Verifying self-signed https certificate
+[ OK ] Starting Status daemon
+
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
+
+ERROR: Corrupt startup-config, system has reverted to default login credentials
+failed-00-00-00 login:
+```
+
+To remedy a situation like this, you can login with the unit's *default
+login credentials*, preferrably via a [console port][8].
+The unit's default credentials are typically printed on a sticker on
+the unit.
+
+```
+failed-00-00-00 login: admin
+Password:
+
+Run the command 'cli' for interactive OAM
+
+admin@failed-00-00-00:~$
+```
+
+When it is *safe* from a network operations perspective, you can
+conduct a factory reset and reboot. It is recommended to remove the
+unit from any production network before doing this, as a factory reset
+may enable undesired connectivity between the unit's ports.
+
+```
+admin@failed-00-00-00:~$ factory
+Factory reset device (y/N)? y
+factory: scheduled factory reset on next boot.
+Reboot now to perform reset, (y/N)? y
+[ OK ] Saving system time (UTC) to RTC
+[ OK ] Stopping mDNS alias advertiser
+...
+[ OK ] Starting Configuration daemon
+[ OK ] Loading startup-config
+[ OK ] Update DNS configuration
+[ OK ] Verifying self-signed https certificate
+[ OK ] Starting Status daemon
+[ OK ] Starting Status daemon
+
+
+Please press Enter to activate this console.
+
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
+example login:
+```
+
+Continued configuration is done as with any unit after factory reset.
+
 [1]: https://www.rfc-editor.org/rfc/rfc7317
 [2]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-system%402024-02-29.yang
 [3]: https://www.rfc-editor.org/rfc/rfc8341
 [4]: https://chrony-project.org/doc/4.6.1/chronyc.html
+[5]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/confd/infix-system-software.yang
+[6]: netboot.md
+[7]: introduction.md#system-boot
+[8]: management.md#console-port
+[^9]: In failure config, Infix puts all Ethernet ports as individual
+    interfaces. With direct access, one can connect with e.g., SSH,
+    using link local IPv6 addresses. This as an alternative to
+    connecting via a console port.
+[^10]: Set up an FTP/TFTP/SFTP or HTTP/HTTPS server on the same LAN. 
+
+[11]: scripting.md#-backup-configuration-using-sysrepocfg-and-scp

doc/test-arch.md

@@ -243,23 +243,15 @@ spanning tree matches the expected one.
 
 Integration to Infix
 --------------------
-To successfully run all Infix tests, the image must be built in 
+When the test environment is started with Qeneth, it doesn't use the 
-'test-mode'. This can be achieved by setting the DISK_IMAGE_TEST_MODE
+base image directly. Instead, it creates a copy and inserts a `test-mode`
-parameter to true. Although this is the default setting, it’s advisable
+flag into it. During the bootstrap phase, the system checks for the 
-to verify it by running:
+presence of the test-mode flag (file).
 
-    $ make menuconfig
+If the flag exists, a 'test-config.cfg' file is generated. In the 
-    (External Options --> -*- Disk image --> [*] Enable Test Mode)
+following step, the system loads the 'test-config' instead of the
-
+standard `startup-config` (or `factory-config`). This configuration
-Building an image in 'test-mode' results in the creation of a 'test-mode'
+is simple and safe, equivalent to the one used in 'Secure Mode' 
-file within the auxiliary (aux) partition of the Infix disk image 
-(/mnt/aux/test-mode).
-
-During the bootstrap phase, the system checks for the presence of this 
-test-mode flag (file). If the flag exists, a 'test-config.cfg' file is 
-generated. In the following step, the system loads the 'test-config' 
-instead of the standard startup-config (or factory-config). This 
-configuration is simple and safe, equivalent to the one used in 'Secure Mode'
 (also known as 'failure-config').
 
 Additionally, the configuration enables extra RPCs related to system 

doc/testing.md

@@ -25,17 +25,6 @@ for `x86_64`:
     $ make
     $ make test
 
-It is important to mention that Infix build system by default creates
-an image in 'test-mode'. The mode is set by DISK_IMAGE_TEST_MODE
-parameter (default=true). To generate a standard image set the
-DISK_IMAGE_TEST_MODE to 'false'. However, only the test mode ensures
-that all Infix tests are executed properly. Prior to the set of commands
-above, it is always good to check that DISK_IMAGE_TEST_MODE is properly
-set by running:
-
-    $ make menuconfig
-    (External Options --> -*- Disk image --> [*] Enable Test Mode)
-
 ### Physical Devices
 
 To run the tests on a preexisting topology from the host's network
@@ -99,8 +88,11 @@ arguments:
 To run a suite of tests, e.g., only the DHCP client tests, pass the
 suite as an argument to [9PM][]:
 
-    11:42:53 infamy0:test # ./9pm/9pm.py case/infix_dhcp/all.yaml
+    11:42:53 infamy0:test # ./9pm/9pm.py case/infix_dhcp/infix_dhcp.yaml
 
+To run the suite of all tests:
+
+    11:42:53 infamy0:test # ./9pm/9pm.py case/all.yaml
 
 ### Connecting to Infamy
 
@@ -131,11 +123,11 @@ there is another helper script in Infamy for this:
     Trying 127.0.0.1...
     Connected to 127.0.0.1.
 
-    Infix -- a Network Operating System v23.11.0-226-g0c144da (console)
+    Infix OS — Immutable.Friendly.Secure v23.11.0-226-g0c144da (console)
     infix-00-00-00 login: admin
     Password:
     .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
     |-. v .-| https://kernelkit.org
     '-'---'-'
 
@@ -315,5 +307,52 @@ The test specifaction can be genererated with:
 
 	$ make test-spec
 
+### Test Development
+
+For adding a new test to the automated regression test suite, it's best
+to start by reviewing an existing test case.
+
+All tests are located in the `infix/test/case` repository and are 
+grouped by the features they verify. For example, 
+`infix/test/case/infix_services` contains tests for various Infix 
+services, such as LLDP and mDNS.
+
+While test grouping is flexible, each test should be placed in a 
+logically relevant category.
+
+When creating a new test group, add it to `infix/test/case/all.yaml`,
+to enable it to run as a 
+[subset of the test suite](#running-subsets-of-tests):
+
+```
+- name:  infix-services
+  suite: infix_services/infix_services.yaml
+```
+
+A new test (e.g., lldp_enable_disable) should be added to the 
+corresponding test group .yaml file, such as 
+`infix/test/cases/infix_services.yaml`:
+
+```
+- name: lldp_enable_disable
+  case: lldp_enable_disable/test.py
+```
+
+It is necessary to include the test in 
+`infix/test/case/infix_services/Readme.adoc` to ensure proper test 
+specification generation:
+
+```
+include::lldp_enable_disable/Readme.adoc[]
+```
+
+Each test case should have its own directory under, 
+`infix/test/case/infix_services`, containing: 
+  - `test.py` - the test script
+  - `topology.dot` - the logical topology definition.
+
+When the [test specification](#test-specification) is generated, 
+`topology.svg` and `Readme.adoc` should also be created. 
+
 [9PM]:    https://github.com/rical/9pm
 [Qeneth]: https://github.com/wkz/qeneth

doc/wifi.md

@@ -0,0 +1,152 @@
+# Wi-Fi (Wireless LAN)
+
+Infix includes built-in Wi-Fi client support for connecting to
+wireless networks. When a compatible Wi-Fi adapter is detected, the
+system automatically begins scanning for available networks.
+
+## Current Limitations
+
+- Only client mode is supported (no access point functionality)
+- USB hotplug is not supported - adapters must be present at boot
+- Interface naming may be inconsistent with multiple USB Wi-Fi adapters
+
+## Supported Wi-Fi Adapters
+
+Wi-Fi support is primarily tested with Realtek chipset-based adapters.
+
+### Known Working Chipsets
+
+- RTL8821CU
+- Other Realtek chipsets may work but are not guaranteed
+
+
+> [!NOTE]  Some Realtek chipsets require proprietary drivers not included in the standard kernel
+>          Firmware requirements vary by chipset
+>          Check kernel logs if your adapter is not detected
+
+## Configuration
+
+Add a supported Wi-Fi network device. To verify that it has been
+detected, look for `wifi0` in `show interfaces`
+
+```
+admin@example:/>  show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   DOWN        f0:09:0d:36:5f:86
+                wifi                   ssid: ------, signal: ------
+
+```
+Add the new Wi-Fi interface to the configuration to start scanning.
+```
+admin@example:/config/> set interface wifi0
+admin@example:/config/> leave
+```
+Now the system will now start scanning in the background. To
+see the result read the operational datastore for interface `wifi0` or
+use the CLI
+
+```
+admin@infix-00-00-00:/> show interfaces name wifi0
+name                : wifi0
+type                : wifi
+index               : 3
+mtu                 : 1500
+operational status  : down
+physical address    : f0:09:0d:36:5f:86
+ipv4 addresses      :
+ipv6 addresses      :
+SSID                : ----
+Signal              : ----
+
+SSID                                    ENCRYPTION                    SIGNAL
+ssid1                                   WPA2-Personal                 excellent
+ssid2                                   WPA2-Personal                 excellent
+ssid3                                   WPA2-Personal                 excellent
+ssid4                                   WPA2-Personal                 good
+ssid5                                   WPA2-Personal                 good
+ssid6                                   WPA2-Personal                 good
+```
+
+In the CLI, signal strength is reported as: excellent, good, poor or
+bad. For precise values, use NETCONF or RESTCONF, where the RSSI (in
+dBm) is available in the operational datastore.
+
+Configure your Wi-Fi secret in the keystore, it should be between 8
+and 63 characters
+
+```
+admin@example:/> configure
+admin@example:/config/> edit keystore symmetric-key example
+admin@example:/config/keystore/symmetric-key/example/> set key-format wifi-preshared-key-format
+admin@example:/config/keystore/symmetric-key/example/> set cleartext-key mysecret
+admin@example:/config/keystore/symmetric-key/example/> leave
+admin@example:/>
+```
+
+Configure the Wi-Fi settings, set secret to the name selected above
+for the symmetric key, in this case `example`.
+
+WPA2 or WPA3 encryption will be automatically selected based on what
+the access point supports. No manual selection is required unless
+connecting to an open network. No support for certificate based
+authentication yet.
+
+Unencrypted network is also supported, to connect to an unencrypted
+network (generally not recommended):
+```
+admin@example:/config/interface/wifi0/> set wifi encryption disabled
+```
+
+A valid `country-code` is also required for regulatory compliance, the
+valid codes are documented in the YANG model `infix-wifi-country-codes`
+
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface wifi0
+admin@example:/config/interface/wifi0/>
+admin@example:/config/interface/wifi0/> set wifi ssid ssid1
+admin@example:/config/interface/wifi0/> set wifi secret example
+admin@example:/config/interface/wifi0/> set wifi country-code SE
+admin@example:/config/interface/wifi0/> leave
+```
+
+The Wi-Fi negotiation should now start immediately, provided that the
+SSID and pre-shared key are correct. You can verify the connection by
+running `show interfaces` again.
+
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   UP          f0:09:0d:36:5f:86
+                wifi                   ssid: ssid1, signal: excellent
+
+admin@example:/>
+```
+
+## Troubleshooting Connection Issues
+
+Use `show wifi scan wifi0` and `show interfaces` to verify signal strength
+and connection status. If issues arise, try the following
+troubleshooting steps:
+
+1. **Verify signal strength**: Check that the target network shows "good" or "excellent" signal
+2. **Check credentials**: Verify the preshared key in `ietf-keystore`
+3. **Review logs**: Check system logs with `show log` for Wi-Fi related errors
+4. **Regulatory compliance**: Ensure the country-code matches your location
+5. **Hardware detection**: Confirm the adapter appears in `show interfaces`
+
+If issues persist, check the system log for specific error messages that can help identify the root cause.

package/Config.in

@@ -2,6 +2,7 @@ menu "Packages"
 
 comment "Hardware Support"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/feature-wifi/Config.in"
 
 comment "Software Packages"
 source "$BR2_EXTERNAL_INFIX_PATH/package/bin/Config.in"
@@ -34,6 +35,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/python-libyang/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/python-statd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/python-yangdoc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/skeleton-init-finit/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/show/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/tetris/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/libyang-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-cpp/Config.in"
@@ -41,5 +43,4 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rauc-installation-status/Config.in"
-
 endmenu

package/board/Config.in

@@ -1,6 +1,7 @@
 menu "Boards"
 
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/alder-alder/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/board/freescale-imx8mp-evk/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/marvell-cn9130-crb/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/marvell-espressobin/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/microchip-sparx5-pcb135/Config.in"

package/board/board.mk

@@ -1,53 +1,2 @@
-define inner-ix-board
+include $(BR2_EXTERNAL_INFIX_PATH)/package/board/ix-board.mk
-
-$(2)_VERSION = ix-board
-$(2)_LICENSE = BSD-3-Clause
-$(2)_LICENSE_FILES = LICENSE
-$(2)_SITE_METHOD = local
-$(2)_SITE = $$(BR2_EXTERNAL_INFIX_PATH)/src/board/$(1)
-$(2)_REDISTRIBUTE = NO
-
-# The kernel must be built first.
-$(2)_DEPENDENCIES += \
-	linux \
-	$$(BR2_MAKE_HOST_DEPENDENCY)
-
-# This is only defined in some infrastructures (e.g. autotools, cmake),
-# but not in others (e.g. generic). So define it here as well.
-$(2)_MAKE ?= $$(BR2_MAKE)
-
-define $(2)_DTBS_BUILD
-	@$$(call MESSAGE,"Building device tree blob(s)")
-	$$(LINUX_MAKE_ENV) $$($$(PKG)_MAKE) \
-		-C $$(LINUX_DIR) \
-		$$(LINUX_MAKE_FLAGS) \
-		$$($(2)_DTB_MAKE_OPTS) \
-		PWD=$$(@D)/dts \
-		M=$$(@D)/dts \
-		modules
-endef
-$(2)_POST_BUILD_HOOKS += $(2)_DTBS_BUILD
-
-define $(2)_DTBS_INSTALL_TARGET
-	@$$(call MESSAGE,"Installing device tree blob(s)")
-	$$(TARGET_MAKE_ENV) $$(TARGET_CONFIGURE_OPTS) $$($$(PKG)_MAKE) \
-		-f $$(BR2_EXTERNAL_INFIX_PATH)/package/board/dtb-inst.makefile \
-		-C $$(@D)/dts \
-		DESTDIR="$$(TARGET_DIR)" \
-		install
-endef
-$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_DTBS_INSTALL_TARGET
-
-define $(2)_OVERLAY_INSTALL_TARGET
-	@test -d $$(@D)/rootfs && \
-	$$(call MESSAGE,"Copying overlay") && \
-	$$(call SYSTEM_RSYNC,$$(@D)/rootfs,$(TARGET_DIR)) || \
-	true
-endef
-$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_OVERLAY_INSTALL_TARGET
-
-endef
-
-ix-board = $(call inner-ix-board,$(pkgname),$(call UPPERCASE,$(pkgname)))
-
 include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/package/board/*/*.mk))

package/board/freescale-imx8mp-evk/Config.in

@@ -0,0 +1,6 @@
+config BR2_PACKAGE_FREESCALE_IMX8MP_EVK
+	bool "NXP i.MX8MP EVK"
+	depends on BR2_aarch64
+	help
+	  NXP i.MX8MP EVK
+

package/board/freescale-imx8mp-evk/imx8mp-evk.mk

@@ -0,0 +1,46 @@
+define FREESCALE_IMX8MP_EVK_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_NXP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MXC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FEC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DWMAC_IMX8)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_IMX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_IMX_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_I2C_IMX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SPI_IMX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_IMX8MP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_MXC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_IMX2_WDT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_OF_ESDHC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_ESDHC_IMX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_IMX8MP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NVMEM_IMX_OCOTP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INTERCONNECT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INTERCONNECT_IMX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INTERCONNECT_IMX8MP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+# For X
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_ETNAVIV)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_IMX8MP_DW_HDMI_BRIDGE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_FSL_SAMSUNG_HDMI_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_IMX8MP_HDMI_PVI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_IMX_LCDIF)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSEDEV)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_HID_GENERIC)
+
+# For USB
+	$(call KCONFIG_DISABLE_OPT,CONFIG_USB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3)
+	$(call KCONFIG_DISABLE_OPT,CONFIG_USB_DWC3_GADGET)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3_HOST)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARM_IMX_BUS_DEVFREQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_TYPEC_TCPCI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_TYPEC_SWITCH_GPIO)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))

package/board/ix-board.mk

@@ -0,0 +1,51 @@
+define inner-ix-board
+
+$(2)_VERSION = ix-board
+$(2)_LICENSE = BSD-3-Clause
+$(2)_LICENSE_FILES = LICENSE
+$(2)_SITE_METHOD = local
+$(2)_SITE = $$(BR2_EXTERNAL_INFIX_PATH)/src/board/$(1)
+$(2)_REDISTRIBUTE = NO
+
+# The kernel must be built first.
+$(2)_DEPENDENCIES += \
+	linux \
+	$$(BR2_MAKE_HOST_DEPENDENCY)
+
+# This is only defined in some infrastructures (e.g. autotools, cmake),
+# but not in others (e.g. generic). So define it here as well.
+$(2)_MAKE ?= $$(BR2_MAKE)
+
+define $(2)_DTBS_BUILD
+	@$$(call MESSAGE,"Building device tree blob(s)")
+	$$(LINUX_MAKE_ENV) $$($$(PKG)_MAKE) \
+		-C $$(LINUX_DIR) \
+		$$(LINUX_MAKE_FLAGS) \
+		$$($(2)_DTB_MAKE_OPTS) \
+		PWD=$$(@D)/dts \
+		M=$$(@D)/dts \
+		modules
+endef
+$(2)_POST_BUILD_HOOKS += $(2)_DTBS_BUILD
+
+define $(2)_DTBS_INSTALL_TARGET
+	@$$(call MESSAGE,"Installing device tree blob(s)")
+	$$(TARGET_MAKE_ENV) $$(TARGET_CONFIGURE_OPTS) $$($$(PKG)_MAKE) \
+		-f $$(BR2_EXTERNAL_INFIX_PATH)/package/board/dtb-inst.makefile \
+		-C $$(@D)/dts \
+		DESTDIR="$$(TARGET_DIR)" \
+		install
+endef
+$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_DTBS_INSTALL_TARGET
+
+define $(2)_OVERLAY_INSTALL_TARGET
+	@test -d $$(@D)/rootfs && \
+	$$(call MESSAGE,"Copying overlay") && \
+	$$(call SYSTEM_RSYNC,$$(@D)/rootfs,$(TARGET_DIR)) || \
+	true
+endef
+$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_OVERLAY_INSTALL_TARGET
+
+endef
+
+ix-board = $(call inner-ix-board,$(pkgname),$(call UPPERCASE,$(pkgname)))

package/confd-test-mode/confd-test-mode.mk

@@ -1,3 +1,9 @@
+################################################################################
+#
+# confd-test-mode
+#
+################################################################################
+
 CONFD_TEST_MODE_VERSION = 1.0
 CONFD_TEST_MODE_SITE_METHOD = local
 CONFD_TEST_MODE_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/test-mode
@@ -16,7 +22,8 @@ COMMON_SYSREPO_ENV = \
 
 define CONFD_TEST_MODE_INSTALL_YANG_MODULES
         $(COMMON_SYSREPO_ENV) \
-        SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/test-mode/" $(BR2_EXTERNAL_INFIX_PATH)/utils/sysrepo-load-modules.sh $(@D)/yang/test-mode.inc
+        SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/test-mode/" \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/test-mode.inc
 endef
 define CONFD_TEST_MODE_PERMISSIONS
 	/etc/sysrepo/data/ r 660 root wheel - - - - -

package/confd/confd.conf

@@ -17,17 +17,15 @@ run name:startup log:prio:user.notice norestart <pid/confd> env:/etc/default/con
 	-- Loading startup-config
 
 # Run if loading startup-config fails for some reason
-run name:failure log:prio:user.critical norestart <pid/confd> env:/etc/default/confd if:<run/startup/failure> \
+run	name:failure log:prio:user.crit norestart env:/etc/default/confd \
-	[S] /usr/libexec/confd/load -t $CONFD_TIMEOUT failure-config \
+	if:<run/startup/failure> \
+	[S] <pid/confd> /usr/libexec/confd/load -t $CONFD_TIMEOUT failure-config \
 	-- Loading failure-config
 
-run name:error :2 log:console norestart if:<run/failure/failure> \
+run	name:error :2 log:console norestart \
+	if:<run/failure/failure> \
 	[S] /usr/libexec/confd/error --
 
-service name:netopeer notify:none log <pid/confd> env:/etc/default/confd \
+service name:netopeer notify:none log env:/etc/default/confd \
-	[12345] netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
+	[12345] <pid/confd> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
 	-- NETCONF server
-
-# Create initial /etc/resolv.conf after successful bootstrap
-task name:resolv :conf norestart <pid/dnsmasq> if:<run/startup/success> \
-	[S] resolvconf -u -- Update DNS configuration

package/confd/confd.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CONFD_VERSION = 1.4
+CONFD_VERSION = 1.5
 CONFD_SITE_METHOD = local
 CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
 CONFD_LICENSE = BSD-3-Clause
@@ -25,47 +25,91 @@ else
 CONFD_CONF_OPTS += --disable-containers
 endif
 
+ifeq ($(BR2_PACKAGE_FEATURE_WIFI),y)
+CONFD_CONF_OPTS += --enable-wifi
+else
+CONFD_CONF_OPTS += --disable-wifi
+endif
 define CONFD_INSTALL_EXTRA
-	cp $(CONFD_PKGDIR)/confd.conf  $(FINIT_D)/available/
+	for fn in confd.conf resolvconf.conf; do \
-	ln -sf ../available/confd.conf $(FINIT_D)/enabled/confd.conf
+		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
+		ln -sf ../available/$$fn $(FINIT_D)/enabled/$$fn; \
+	done
 	cp $(CONFD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/etc/tmpfiles.d/confd.conf
 	mkdir -p $(TARGET_DIR)/etc/avahi/services
 	cp $(CONFD_PKGDIR)/avahi.service $(TARGET_DIR)/etc/avahi/services/netconf.service
 endef
 
+NETOPEER2_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/netopeer2/
+SYSREPO_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/sysrepo/
+LIBNETCONF2_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/libnetconf2/
+CONFD_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/confd/
+TEST_MODE_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/test-mode/
+ROUSETTE_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/rousette/
 COMMON_SYSREPO_ENV = \
 	SYSREPO_SHM_PREFIX=$(CONFD_SYSREPO_SHM_PREFIX) \
 	SYSREPOCTL_EXECUTABLE="$(HOST_DIR)/bin/sysrepoctl" \
 	SYSREPOCFG_EXECUTABLE="$(HOST_DIR)/bin/sysrepocfg" \
-	SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/confd/"
+	SEARCH_PATH="$(NETOPEER2_SEARCHPATH) $(SYSREPO_SEARCHPATH) $(LIBNETCONF2_SEARCHPATH) $(TEST_MODE_SEARCHPATH) $(CONFD_SEARCHPATH) $(ROUSETTE_SEARCHPATH)"
+
 
 define CONFD_INSTALL_YANG_MODULES
 	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/sysrepo-load-modules.sh $(@D)/yang/confd.inc
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/sysrepo.inc
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/libnetconf2.inc
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/netopeer2.inc
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/rousette.inc
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/test-mode.inc
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/confd.inc
 endef
 
 ifeq ($(BR2_PACKAGE_PODMAN),y)
 define CONFD_INSTALL_YANG_MODULES_CONTAINERS
 	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/sysrepo-load-modules.sh $(@D)/yang/containers.inc
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/containers.inc
+endef
+endif
+ifeq ($(BR2_PACKAGE_FEATURE_WIFI),y)
+define CONFD_INSTALL_YANG_MODULES_WIFI
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/wifi.inc
 endef
 endif
 
-define CONFD_PERMISSIONS
+# PER_PACKAGE_DIR
-	/etc/sysrepo/data/ r 660 root wheel - - - - -
+# Since the last package in the dependency chain that runs sysrepoctl is confd, we need to
-	/etc/sysrepo/data  d 770 root wheel - - - - -
+# manually copy the *real* content here from host-sysrepo.
+ifeq ($(BR2_PER_PACKAGE_DIRECTORIES),y)
+define CONFD_INSTALL_IN_ROMFS
+	cp -a $(PER_PACKAGE_DIR)/host-sysrepo/target/etc/sysrepo/* $(PER_PACKAGE_DIR)/confd/target/etc/sysrepo/
 endef
+endif
 
+# PER_PACKAGE_DIR
+# Need to do some special stuff if using per-packet (parallel) since sysrepo install the submodules in
+# $(PER_PACKAGE_DIR)/host-sysrepo/target/etc/sysrepo/ but $(PER_PACKAGE_DIR)/confd/target/etc/sysrepo/ contains remains
+# of other packets that have installed its models (netopeer2), we want the result in $(PER_PACKAGE_DIR)/host-sysrepo/target/etc/sysrepo/
+define CONFD_EMPTY_SYSREPO
+	rm -rf $(TARGET_DIR)/etc/sysrepo/*
+	if [ "$(BR2_PER_PACKAGE_DIRECTORIES)" = "y" ]; then \
+		rm -rf $(PER_PACKAGE_DIR)/host-sysrepo/target/etc/sysrepo/* $(PER_PACKAGE_DIR)/confd/target/etc/sysrepo/*; \
+	fi
+endef
 define CONFD_CLEANUP
 	rm -f /dev/shm/$(CONFD_SYSREPO_SHM_PREFIX)*
 endef
-
+CONFD_PRE_BUILD_HOOKS += CONFD_EMPTY_SYSREPO
-CONFD_PRE_INSTALL_TARGET_HOOKS += CONFD_CLEANUP
+CONFD_PRE_BUILD_HOOKS += CONFD_CLEANUP
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_EXTRA
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
-ifeq ($(BR2_PACKAGE_PODMAN),y)
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
-endif
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WIFI
-CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_CLEANUP
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_IN_ROMFS
+CONFD_TARGET_FINALIZE_HOOKS += CONFD_CLEANUP
 
 $(eval $(autotools-package))

package/confd/resolvconf.conf

@@ -0,0 +1,3 @@
+# Create initial /etc/resolv.conf after successful bootstrap, regardless
+# of startup-config or failure-config.  Condition set by confd.
+task [S12345] <usr/bootstrap> resolvconf -u -- Update DNS configuration

package/curios-httpd/curios-httpd.hash

@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  3e7f777a054fbc29173bcdafe50ca096a8abf9e556bec9f52617c9881c9ce3e3  curios-httpd-oci-arm64-v24.11.0.tar.gz
+sha256  c4995c0a7a96d5273c97c7c026c03ff5e2a42cade6d66808fdeba0fae9a343d8  curios-httpd-oci-arm64-v25.06.0.tar.gz
-sha256  bfa52f712301427a21b89cfee31ca315e1404973affaf34b23978a70a3ec4f63  curios-httpd-oci-amd64-v24.11.0.tar.gz
+sha256  4d48a03b38eabe558052ecbab7560e6d9f995311eb91b90ddaac336b5f001a5e  curios-httpd-oci-amd64-v25.06.0.tar.gz

package/curios-httpd/curios-httpd.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CURIOS_HTTPD_VERSION = v24.11.0
+CURIOS_HTTPD_VERSION = v25.06.0
 CURIOS_HTTPD_SOURCE = curios-httpd-oci-$(GO_GOARCH)-$(CURIOS_HTTPD_VERSION).tar.gz
 CURIOS_HTTPD_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_HTTPD_VERSION)
 CURIOS_HTTPD_LICENSE = GPL

package/curios-nftables/curios-nftables.hash

@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  95b3625587738cb0a8cc6e9eb41d10a0b2f77ae99dbb1d9b213148d35268eb75  curios-nftables-oci-arm64-v24.11.0.tar.gz
+sha256  94c7173fe4b8e64dcb1e0f67b974c23753ccce73bc07212a87e35f41a41ae5b8  curios-nftables-oci-arm64-v25.06.0.tar.gz
-sha256  4f61ccef90721b8f95a5c7b77b69ccccb5dbd215b9c38986d20e5b245244e902  curios-nftables-oci-amd64-v24.11.0.tar.gz
+sha256  feceb82327cccb4433db63e469f6ed115c10c0266242f0171b85ae1a88472757  curios-nftables-oci-amd64-v25.06.0.tar.gz

package/curios-nftables/curios-nftables.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CURIOS_NFTABLES_VERSION = v24.11.0
+CURIOS_NFTABLES_VERSION = v25.06.0
 CURIOS_NFTABLES_SOURCE = curios-nftables-oci-$(GO_GOARCH)-$(CURIOS_NFTABLES_VERSION).tar.gz
 CURIOS_NFTABLES_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_NFTABLES_VERSION)
 CURIOS_NFTABLES_LICENSE = GPL

package/faux/faux.hash

@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  f8725f39b9d9d45c8ad6fd2cfc3c1c834a80c32b4217a3d07dd8ed7fe4b6e352  faux-df1d569287bc45d8fd880287c00e3874c5627c19-br1.tar.gz
+sha256  b385d30b88cab31bf910436ceb1262947bf34a19ca85098c28510e639dc4b37d  faux-df1d569287bc45d8fd880287c00e3874c5627c19-git4.tar.gz

package/feature-wifi/Config.in

@@ -0,0 +1,20 @@
+config BR2_PACKAGE_FEATURE_WIFI
+	bool "Feature Wi-Fi"
+	select BR2_PACKAGE_WPA_SUPPLICANT
+	select BR2_PACKAGE_WPA_SUPPLICANT_WPA3
+	select BR2_PACKAGE_WPA_SUPPLICANT_DEBUG_SYSLOG
+	select BR2_PACKAGE_WPA_SUPPLICANT_AUTOSCAN
+	select BR2_PACKAGE_WPA_SUPPLICANT_CLI
+	select BR2_PACKAGE_WIRELESS_REGDB
+	select BR2_PACKAGE_IW
+	help
+	  Enables WiFi in Infix. Enables all requried applications.
+
+config BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK
+       bool "Realtek USB WiFi Dongles"
+       depends on BR2_PACKAGE_FEATURE_WIFI
+       select BR2_PACKAGE_LINUX_FIRMWARE
+       select BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88
+       select BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW89
+       help
+         Enables Support for RTW88 and RTW89 USB dongles.

package/feature-wifi/feature-wifi.mk

@@ -0,0 +1,42 @@
+################################################################################
+#
+# Wi-Fi support
+#
+################################################################################
+
+FEATURE_WIFI_PACKAGE_VERSION = 1.0
+FEATURE_WIFI_PACKAGE_LICENSE = MIT
+
+define FEATURE_WIFI_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_WLAN)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RFKILL)
+	$(call KCONFIG_SET_OPT,CONFIG_MAC80211,m)
+	$(call KCONFIG_SET_OPT,CONFIG_CFG80211,m)
+
+	$(if $(filter y,$(BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK)),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_WLAN_VENDOR_REALTEK)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW89)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8703B)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723CS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723D)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723X)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821C)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822B)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822C)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822CU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822CE)
+	)
+endef
+
+
+$(eval $(generic-package))

package/finit/0001-Only-mark-rdeps-dirty-if-main-service-is-nohup.patch

@@ -1,67 +0,0 @@
-From 46ffa81f5c88ce95db011369d8bfb802313e4217 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Thu, 17 Oct 2024 14:23:24 +0200
-Subject: [PATCH 1/7] Only mark rdeps dirty if main service is nohup
-Organization: Addiva Elektronik
-
-This patch changes a behavior that's been default since Finit 4.0,
-introduced in 4d05bf9 with 4.0-rc2.
-
-If service B depends on A and A needs to be reloaded, then B may be
-affected.  If A is declared as NOHUP <!>, then A will be stopped and
-restarted, during which time the condition it provides is removed,
-and B will also be stopped.
-
-However, and as of this patch, if A is declared supporting HUP, then the
-condition A provides will only go into flux, during which time B will be
-SIGSTOPed instead of needing to be reloaded.
-
-Fix #415
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
----
- src/service.c | 8 ++++++++
- src/svc.h     | 1 +
- 2 files changed, 9 insertions(+)
-
-diff --git a/src/service.c b/src/service.c
-index 61be85c..b995ff4 100644
---- a/src/service.c
-+++ b/src/service.c
-@@ -2001,6 +2001,10 @@ static void svc_mark_affected(char *cond)
-  * Called on conf_reload() to update service reverse dependencies.
-  * E.g., if ospfd depends on zebra and the zebra Finit conf has
-  * changed, we need to mark the ospfd Finit conf as changed too.
-+ *
-+ * However, a daemon that depends on syslogd (sysklogd project), need
-+ * not be reloeaded (SIGHUP'ed or stop/started) because syslogd support
-+ * reloading its configuration file on SIGHUP.
-  */
- void service_update_rdeps(void)
- {
-@@ -2012,6 +2016,10 @@ void service_update_rdeps(void)
- 		if (!svc_is_changed(svc))
- 			continue;
- 
-+		/* Service supports reloading conf without stop/start  */
-+		if (!svc_is_nohup(svc))
-+			continue; /* Yup, no need to stop start rdeps */
-+
- 		svc_mark_affected(mkcond(svc, cond, sizeof(cond)));
- 	}
- }
-diff --git a/src/svc.h b/src/svc.h
-index d00ac14..e2f6bd8 100644
---- a/src/svc.h
-+++ b/src/svc.h
-@@ -259,6 +259,7 @@ static inline int svc_is_tty       (svc_t *svc) { return svc && SVC_TYPE_TTY
- static inline int svc_is_runtask   (svc_t *svc) { return svc && (SVC_TYPE_RUNTASK & svc->type);}
- static inline int svc_is_forking   (svc_t *svc) { return svc && svc->forking; }
- static inline int svc_is_manual    (svc_t *svc) { return svc && svc->manual; }
-+static inline int svc_is_nohup     (svc_t *svc) { return svc && (0 == svc->sighup); }
- 
- static inline int svc_in_runlevel  (svc_t *svc, int runlevel) { return svc && ISSET(svc->runlevels, runlevel); }
- static inline int svc_nohup        (svc_t *svc) { return svc &&  (0 == svc->sighup || 0 != svc->args_dirty); }
--- 
-2.43.0
-

package/finit/0002-Reset-color-attributes-and-clear-screen-when-startin.patch

@@ -1,33 +0,0 @@
-From 119e66a7e9c95283918639b51dd03a3d666955f8 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Mon, 28 Oct 2024 10:58:04 +0100
-Subject: [PATCH 2/7] Reset color attributes and clear screen when starting up
-Organization: Addiva Elektronik
-
-Some boot loaders, like GRUB, leave background color artifacts from
-their boot menu.  This patch resets the foreground and background
-color attributes, and then clears the screen, without clearing the
-scrollback buffer.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
----
- src/helpers.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/src/helpers.c b/src/helpers.c
-index 8768de8..99c4557 100644
---- a/src/helpers.c
-+++ b/src/helpers.c
-@@ -87,6 +87,9 @@ void console_init(void)
- 	/* Enable line wrap, if disabled previously, e.g., qemu */
- 	dprint(STDOUT_FILENO, "\033[?7h", 5);
- 
-+	/* Reset atttributes, background and foreground color  */
-+	dprint(STDOUT_FILENO, "\033[49m\033[39m\e[2J", 14);
-+
- 	log_init();
- }
- 
--- 
-2.43.0
-

package/finit/0003-plugins-refactor-rtc.so.patch

@@ -1,196 +0,0 @@
-From 0c0e880f3fdd38f7bbde618408378dc0a19ff005 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Sun, 3 Nov 2024 09:39:46 +0100
-Subject: [PATCH 3/7] plugins: refactor rtc.so
-Organization: Addiva Elektronik
-
-Factor out time_set() and time_get() for readability and reuse.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
----
- plugins/rtc.c | 116 +++++++++++++++++++++++++++++---------------------
- 1 file changed, 68 insertions(+), 48 deletions(-)
-
-diff --git a/plugins/rtc.c b/plugins/rtc.c
-index 238791f..9520c7d 100644
---- a/plugins/rtc.c
-+++ b/plugins/rtc.c
-@@ -68,6 +68,60 @@ static void tz_restore(char *tz)
- 	tzset();
- }
- 
-+static int time_set(struct tm *tm)
-+{
-+	struct tm fallback = { 0 };
-+	struct timeval tv = { 0 };
-+	char tz[128];
-+	int rc = 0;
-+
-+	tz_set(tz, sizeof(tz));
-+
-+	if (!tm) {
-+		logit(LOG_NOTICE, "Resetting system clock to kernel default, %s.", rtc_timestamp);
-+		tm = &fallback;
-+
-+		/* Attempt to set RTC to a sane value ... */
-+		tv.tv_sec = rtc_date_fallback;
-+		if (!gmtime_r(&tv.tv_sec, tm)) {
-+			rc = 1;
-+			goto out;
-+		}
-+	}
-+
-+	tm->tm_isdst = -1; /* Use tzdata to figure it out, please. */
-+	tv.tv_sec = mktime(tm);
-+	if (tv.tv_sec == (time_t)-1 || tv.tv_sec < rtc_date_fallback) {
-+		errno = EINVAL;
-+		rc = 2;
-+	} else {
-+		if (settimeofday(&tv, NULL) == -1)
-+			rc = 1;
-+	}
-+out:
-+	tz_restore(tz);
-+	return rc;
-+}
-+
-+static int time_get(struct tm *tm)
-+{
-+	struct timeval tv = { 0 };
-+	char tz[128];
-+	int rc = 0;
-+
-+	tz_set(tz, sizeof(tz));
-+
-+	rc = gettimeofday(&tv, NULL);
-+	if (rc < 0 || tv.tv_sec < rtc_date_fallback)
-+		rc = 2;
-+	else
-+		gmtime_r(&tv.tv_sec, tm);
-+
-+	tz_restore(tz);
-+
-+	return rc;
-+}
-+
- static int rtc_open(void)
- {
- 	char *alt[] = {
-@@ -91,10 +145,8 @@ static int rtc_open(void)
- 
- static void rtc_save(void *arg)
- {
--	struct timeval tv = { 0 };
- 	struct tm tm = { 0 };
- 	int fd, rc = 0;
--	char tz[128];
- 
- 	if (rescue) {
- 		dbg("Skipping %s plugin in rescue mode.", __FILE__);
-@@ -105,38 +157,26 @@ static void rtc_save(void *arg)
- 	if (fd < 0)
- 		return;
- 
--	tz_set(tz, sizeof(tz));
--	rc = gettimeofday(&tv, NULL);
--	if (rc < 0 || tv.tv_sec < rtc_date_fallback) {
-+	if ((rc = time_get(&tm))) {
- 		print_desc(NULL, "System clock invalid, not saving to RTC");
--	invalid:
--		logit(LOG_ERR, "System clock invalid, before %s, not saving to RTC", rtc_timestamp);
--		rc = 2;
--		goto out;
-+	} else {
-+		print_desc(NULL, "Saving system clock (UTC) to RTC");
-+		rc = ioctl(fd, RTC_SET_TIME, &tm);
- 	}
- 
--	print_desc(NULL, "Saving system time (UTC) to RTC");
--
--	gmtime_r(&tv.tv_sec, &tm);
--	if (ioctl(fd, RTC_SET_TIME, &tm) < 0) {
--		if (EINVAL == errno)
--			goto invalid;
--		rc = 1;
--		goto out;
-+	if (rc && errno == EINVAL) {
-+		logit(LOG_ERR, "System clock invalid, before %s, not saving to RTC", rtc_timestamp);
-+		rc = 2;
- 	}
- 
--out:
--	tz_restore(tz);
- 	print(rc, NULL);
- 	close(fd);
- }
- 
- static void rtc_restore(void *arg)
- {
--	struct timeval tv = { 0 };
- 	struct tm tm = { 0 };
- 	int fd, rc = 0;
--	char tz[128];
- 
- 	if (rescue) {
- 		dbg("Skipping %s plugin in rescue mode.", __FILE__);
-@@ -149,16 +189,19 @@ static void rtc_restore(void *arg)
- 		return;
- 	}
- 
--	tz_set(tz, sizeof(tz));
--	if (ioctl(fd, RTC_RD_TIME, &tm) < 0) {
-+	if ((rc = ioctl(fd, RTC_RD_TIME, &tm)) < 0) {
- 		char msg[120];
- 
- 		snprintf(msg, sizeof(msg), "Failed restoring system clock, %s",
- 			 EINVAL == errno ? "RTC time is too old"   :
- 			 ENOENT == errno ? "RTC has no saved time" : "see log for details");
- 		print_desc(NULL, msg);
-+	} else {
-+		print_desc(NULL, "Restoring system clock (UTC) from RTC");
-+		rc = time_set(&tm);
-+	}
- 
--	invalid:
-+	if (rc) {
- 		logit(LOG_ERR, "Failed restoring system clock from RTC.");
- 		if (EINVAL == errno)
- 			logit(LOG_ERR, "RTC time is too old (before %s)", rtc_timestamp);
-@@ -167,33 +210,10 @@ static void rtc_restore(void *arg)
- 		else
- 			logit(LOG_ERR, "RTC error code %d: %s", errno, strerror(errno));
- 
--		/* Been here already? */
--		if (rc)
--			goto out;
--
--		/* Attempt to set RTC to a sane value ... */
--		tv.tv_sec = rtc_date_fallback;
--		if (!gmtime_r(&tv.tv_sec, &tm))
--			goto out;
--
--		logit(LOG_NOTICE, "Resetting RTC to kernel default, %s.", rtc_timestamp);
-+		time_set(NULL);
- 		rc = 2;
- 	}
- 
--	if (!rc)
--		print_desc(NULL, "Restoring system clock (UTC) from RTC");
--	tm.tm_isdst = -1; /* Use tzdata to figure it out, please. */
--	tv.tv_sec = mktime(&tm);
--	if (tv.tv_sec == (time_t)-1 || tv.tv_sec < rtc_date_fallback) {
--		errno = EINVAL;
--		goto invalid;
--	}
--
--	if (settimeofday(&tv, NULL) == -1)
--		rc = 1;
--
--out:
--	tz_restore(tz);
- 	print(rc, NULL);
- 	close(fd);
- }
--- 
-2.43.0
-

package/finit/0004-Fix-418-support-systems-with-a-broken-RTC.patch

@@ -1,239 +0,0 @@
-From bc8118d515839dc598f437aa01f07a771646968d Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Sun, 3 Nov 2024 09:47:16 +0100
-Subject: [PATCH 4/7] Fix #418: support systems with a broken RTC
-Organization: Addiva Elektronik
-
-This patch introduces a new configure option --with-rtc-file=FILE.  When
-enabled the RTC plugin detects missing RTC device and falls back to save
-and restore system time from a file instead.  When --with-rtc-file is
-used without an argument the default file is /var/lib/misc/rtc, but the
-feature itself is disabled by default.
-
-The usefulness of this feature may not be obvious at first, but some
-systems are equipped with an RTC that resets to a random date at power
-on.  This can be really bad in the case the date is far in the future,
-because an NTP sync would then cause time skips backwards, which shows
-up in logs and causes a whole lot of pain in alarm systems.
-
-The solution is to disable the RTC driver or device tree node, and when
-Finit starts up, the RTC plugin detects a the device node and instead
-restores time from the last save game.  Meaning time will always only
-move forwards.
-
-NOTE: when Finit is built --with-rtc-file we always save to disk, but
-      only restore from the "save game" if restoring from RTC fails.
-      If the system has no RTC we always restore from disk.
-
-      As an added bonus, this change also makes sure to periodically
-      sync also the RTC with the system clock.  Useful for systems
-      that do not run an NTP client.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
----
- configure.ac  |  12 ++++++
- plugins/rtc.c | 105 ++++++++++++++++++++++++++++++++++++++++++++++----
- 2 files changed, 110 insertions(+), 7 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 483457f..ae7cd23 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -180,6 +180,10 @@ AC_ARG_WITH(rtc-date,
- 	AS_HELP_STRING([--with-rtc-date=DATE], [If RTC date/time is too old, restore to DATE, format "YYYY-MM-DD HH:MM", default "2000-01-01 00:00"]),
- 	[rtc_date=$withval], [rtc_date=no])
- 
-+AC_ARG_WITH(rtc-file,
-+        AS_HELP_STRING([--with-rtc-file=FILE], [If RTC is missing, save and restore system clock from this file, default: no]),
-+	[rtc_file=$withval], [rtc_file=no])
-+
- ### Enable features ###########################################################################
- 
- # Create config.h from selected features and fallback defaults
-@@ -281,6 +285,13 @@ AS_IF([test "x$rtc_date" != "xno"], [
- 	AC_DEFINE(RTC_TIMESTAMP_CUSTOM, "$rtc_date", [Custom RTC restore date, default: 2000-01-01 00:00])], [
- 	rtc_date=""])
- 
-+AS_IF([test "x$rtc_file" != "xno"], [
-+	AS_IF([test "x$rtc_file" = "xyes"], [
-+		rtc_file=/var/lib/misc/rtc])
-+	AC_EXPAND_DIR(rtcfile_path, "$rtc_file")
-+	AC_DEFINE_UNQUOTED(RTC_FILE, "$rtcfile_path", [Save and restore system time from this file if /dev/rtc is missing.])],[
-+	AC_DEFINE_UNQUOTED(RTC_FILE, NULL)])
-+
- AS_IF([test "x$with_keventd" != "xno"], [with_keventd=yes])
- 
- AS_IF([test "x$with_sulogin" != "xno"], [
-@@ -387,6 +398,7 @@ Behavior:
-   Boot heading..........: $heading
-   Plugins...............: $plugins
-   RTC restore date......: $RTC_DATE
-+  RTC fallback file.....: $rtc_file
- 
- Optional features:
-   Install doc/..........: $enable_doc
-diff --git a/plugins/rtc.c b/plugins/rtc.c
-index 9520c7d..9b4eeae 100644
---- a/plugins/rtc.c
-+++ b/plugins/rtc.c
-@@ -36,8 +36,15 @@
- #include "helpers.h"
- #include "plugin.h"
- 
--/* Kernel RTC driver validates against this date for sanity check */
-+/*
-+ * Kernel RTC driver validates against this date for sanity check.  The
-+ * on NTP sync the driver can also update the RTC every 11 mins.  We use
-+ * the same update interval to handle manual time set and file save.
-+ */
- #define RTC_TIMESTAMP_BEGIN_2000 "2000-01-01 00:00:00"
-+#define RTC_FMT                  "%Y-%m-%d %H:%M:%S"
-+#define RTC_PERIOD               (11 * 60 * 1000)
-+
- #ifdef  RTC_TIMESTAMP_CUSTOM
- static char  *rtc_timestamp     = RTC_TIMESTAMP_CUSTOM;
- #else
-@@ -45,6 +52,10 @@ static char  *rtc_timestamp     = RTC_TIMESTAMP_BEGIN_2000;
- #endif
- static time_t rtc_date_fallback = 946684800LL;
- 
-+static char  *rtc_file          = RTC_FILE;
-+static uev_t  rtc_timer;
-+
-+
- static void tz_set(char *tz, size_t len)
- {
- 	char *ptr;
-@@ -122,6 +133,68 @@ static int time_get(struct tm *tm)
- 	return rc;
- }
- 
-+static void file_save(void *arg)
-+{
-+	struct tm tm = { 0 };
-+	int rc = 0;
-+	FILE *fp;
-+
-+	fp = fopen(rtc_file, "w");
-+	if (!fp) {
-+		logit(LOG_WARNING, "Failed saving system clock to %s, code %d: %s",
-+		      rtc_file, errno, strerror(errno));
-+		return;
-+	}
-+
-+	if ((rc = time_get(&tm))) {
-+		logit(LOG_ERR, "System clock invalid, before %s, not saving", rtc_timestamp);
-+		print_desc(NULL, "System clock invalid, skipping");
-+	} else {
-+		char buf[32] = { 0 };
-+
-+		print_desc(NULL, "Saving system clock to file");
-+		strftime(buf, sizeof(buf), RTC_FMT, &tm);
-+		fprintf(fp, "%s\n", buf);
-+	}
-+
-+	print(rc, NULL);
-+	fclose(fp);
-+}
-+
-+static void file_restore(void *arg)
-+{
-+	struct tm tm = { 0 };
-+	int rc = 1;
-+	FILE *fp;
-+
-+	if (!rtc_file) {
-+		logit(LOG_NOTICE, "System has no RTC (missing driver?), skipping restore.");
-+		return;
-+	}
-+
-+	print_desc(NULL, "Restoring system clock from backup");
-+
-+	fp = fopen(rtc_file, "r");
-+	if (fp) {
-+		char buf[32];
-+
-+		if (fgets(buf, sizeof(buf), fp)) {
-+			chomp(buf);
-+			strptime(buf, RTC_FMT, &tm);
-+			rc = time_set(&tm);
-+		}
-+		fclose(fp);
-+	} else
-+		logit(LOG_WARNING, "Missing %s", rtc_file);
-+
-+	if (rc) {
-+		time_set(NULL);
-+		rc = 2;
-+	}
-+
-+	print(rc, NULL);
-+}
-+
- static int rtc_open(void)
- {
- 	char *alt[] = {
-@@ -185,7 +258,7 @@ static void rtc_restore(void *arg)
- 
- 	fd = rtc_open();
- 	if (fd < 0) {
--		logit(LOG_NOTICE, "System has no RTC (missing driver?), skipping restore.");
-+		file_restore(arg);
- 		return;
- 	}
- 
-@@ -210,21 +283,37 @@ static void rtc_restore(void *arg)
- 		else
- 			logit(LOG_ERR, "RTC error code %d: %s", errno, strerror(errno));
- 
--		time_set(NULL);
--		rc = 2;
--	}
-+		print(2, NULL);
-+
-+		/* Try restoring from last save game */
-+		if (rtc_file)
-+			file_restore(arg);
-+	} else
-+		print(0, NULL);
- 
--	print(rc, NULL);
- 	close(fd);
- }
- 
-+
-+static void save(void *arg)
-+{
-+	rtc_save(arg);
-+	file_save(arg);
-+}
-+
-+static void update(uev_t *w, void *arg, int events)
-+{
-+	save(arg);
-+}
-+
-+
- static plugin_t plugin = {
- 	.name = __FILE__,
- 	.hook[HOOK_BASEFS_UP] = {
- 		.cb  = rtc_restore
- 	},
- 	.hook[HOOK_SHUTDOWN] = {
--		.cb  = rtc_save
-+		.cb  = save
- 	}
- };
- 
-@@ -237,6 +326,8 @@ PLUGIN_INIT(plugin_init)
- 	else
- 		rtc_timestamp = RTC_TIMESTAMP_BEGIN_2000;
- 
-+	uev_timer_init(ctx, &rtc_timer, update, NULL, RTC_PERIOD, RTC_PERIOD);
-+
- 	plugin_register(&plugin);
- }
- 
--- 
-2.43.0
-

package/finit/0005-Fix-buggy-with-rtc-date-DATE-introduced-in-Finit-v4..patch

@@ -1,73 +0,0 @@
-From 6be16f2f6d093ef495d0fe4313f7b05b4ba3e08f Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Sun, 3 Nov 2024 10:38:38 +0100
-Subject: [PATCH 5/7] Fix buggy --with-rtc-date=DATE, introduced in Finit v4.4
-Organization: Addiva Elektronik
-
-In 42ef3d3c, for v4.4-rc1, support for setting a custom RTC restore date
-was introduced.  Unfortunately the configure script was wrong and caused
-config.h to contain
-
-    #define RTC_TIMESTAMP_CUSTOM "$rtc_date"
-
-instead of
-
-    #define RTC_TIMESTAMP_CUSTOM "2023-04-10 14:35:42"
-
-Furthermore, the error handling for strptime() was wrong, so the restore
-date was always reverted to the default.
-
-This patch fixes both issues and extends the DATE of --with-rtc-date to
-also include seconds.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
----
- configure.ac  | 4 ++--
- plugins/rtc.c | 8 +++++---
- 2 files changed, 7 insertions(+), 5 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index ae7cd23..58b78ac 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -177,7 +177,7 @@ AC_ARG_WITH(plugin-path,
- 	[plugin_path=$withval], [plugin_path=yes])
- 
- AC_ARG_WITH(rtc-date,
--	AS_HELP_STRING([--with-rtc-date=DATE], [If RTC date/time is too old, restore to DATE, format "YYYY-MM-DD HH:MM", default "2000-01-01 00:00"]),
-+	AS_HELP_STRING([--with-rtc-date=DATE], [If RTC date/time is too old, restore to DATE, format "YYYY-MM-DD HH:MM:SS", default "2000-01-01 00:00:00"]),
- 	[rtc_date=$withval], [rtc_date=no])
- 
- AC_ARG_WITH(rtc-file,
-@@ -282,7 +282,7 @@ AS_IF([test "x$with_random_seed" != "xno"], [
- 	AC_DEFINE_UNQUOTED(RANDOMSEED, "$random_path", [Improve random at boot by seeding it with sth from before.])])
- 
- AS_IF([test "x$rtc_date" != "xno"], [
--	AC_DEFINE(RTC_TIMESTAMP_CUSTOM, "$rtc_date", [Custom RTC restore date, default: 2000-01-01 00:00])], [
-+	AC_DEFINE_UNQUOTED(RTC_TIMESTAMP_CUSTOM, "$rtc_date", [Custom RTC restore date, default: 2000-01-01 00:00])], [
- 	rtc_date=""])
- 
- AS_IF([test "x$rtc_file" != "xno"], [
-diff --git a/plugins/rtc.c b/plugins/rtc.c
-index 9b4eeae..a733f75 100644
---- a/plugins/rtc.c
-+++ b/plugins/rtc.c
-@@ -321,10 +321,12 @@ PLUGIN_INIT(plugin_init)
- {
- 	struct tm tm = { 0 };
- 
--	if (!strptime(rtc_timestamp, "%Y-%m-%d %H:%M", &tm))
--		rtc_date_fallback = mktime(&tm);
--	else
-+	if (!strptime(rtc_timestamp, RTC_FMT, &tm)) {
-+		logit(LOG_ERR, "Invalid restore date '%s', reverting to '%s'",
-+		      rtc_timestamp, RTC_TIMESTAMP_BEGIN_2000);
- 		rtc_timestamp = RTC_TIMESTAMP_BEGIN_2000;
-+	} else
-+		rtc_date_fallback = mktime(&tm);
- 
- 	uev_timer_init(ctx, &rtc_timer, update, NULL, RTC_PERIOD, RTC_PERIOD);
- 
--- 
-2.43.0
-

package/finit/0006-plugins-reduce-log-level-LOG_ERR-LOG_WARNING.patch

@@ -1,85 +0,0 @@
-From 49c0557cedd8d3c1a2f74d27fa7db83dd529914a Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Sun, 3 Nov 2024 20:49:04 +0100
-Subject: [PATCH 6/7] plugins: reduce log level LOG_ERR -> LOG_WARNING
-Organization: Addiva Elektronik
-
-These plugins signal success and failure directly to the console, the
-user should inspect syslog for more information.
-
-This change is a follow-up to 340cae4, where kernel logs of LOG_ERR and
-higher are allowed to log directly to the console.  Since syslogd has
-not been started before these plugins, the log messages would otherwise
-leak to the console.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
----
- plugins/rtc.c     | 14 +++++++-------
- plugins/urandom.c |  2 +-
- 2 files changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/plugins/rtc.c b/plugins/rtc.c
-index a733f75..96203a0 100644
---- a/plugins/rtc.c
-+++ b/plugins/rtc.c
-@@ -147,7 +147,7 @@ static void file_save(void *arg)
- 	}
- 
- 	if ((rc = time_get(&tm))) {
--		logit(LOG_ERR, "System clock invalid, before %s, not saving", rtc_timestamp);
-+		logit(LOG_WARNING, "System clock invalid, before %s, not saving", rtc_timestamp);
- 		print_desc(NULL, "System clock invalid, skipping");
- 	} else {
- 		char buf[32] = { 0 };
-@@ -238,7 +238,7 @@ static void rtc_save(void *arg)
- 	}
- 
- 	if (rc && errno == EINVAL) {
--		logit(LOG_ERR, "System clock invalid, before %s, not saving to RTC", rtc_timestamp);
-+		logit(LOG_WARNING, "System clock invalid, before %s, not saving to RTC", rtc_timestamp);
- 		rc = 2;
- 	}
- 
-@@ -275,13 +275,13 @@ static void rtc_restore(void *arg)
- 	}
- 
- 	if (rc) {
--		logit(LOG_ERR, "Failed restoring system clock from RTC.");
-+		logit(LOG_WARNING, "Failed restoring system clock from RTC.");
- 		if (EINVAL == errno)
--			logit(LOG_ERR, "RTC time is too old (before %s)", rtc_timestamp);
-+			logit(LOG_WARNING, "RTC time is too old (before %s)", rtc_timestamp);
- 		else if (ENOENT == errno)
--			logit(LOG_ERR, "RTC has no previously saved (valid) time.");
-+			logit(LOG_WARNING, "RTC has no previously saved (valid) time.");
- 		else
--			logit(LOG_ERR, "RTC error code %d: %s", errno, strerror(errno));
-+			logit(LOG_WARNING, "RTC error code %d: %s", errno, strerror(errno));
- 
- 		print(2, NULL);
- 
-@@ -322,7 +322,7 @@ PLUGIN_INIT(plugin_init)
- 	struct tm tm = { 0 };
- 
- 	if (!strptime(rtc_timestamp, RTC_FMT, &tm)) {
--		logit(LOG_ERR, "Invalid restore date '%s', reverting to '%s'",
-+		logit(LOG_WARNING, "Invalid restore date '%s', reverting to '%s'",
- 		      rtc_timestamp, RTC_TIMESTAMP_BEGIN_2000);
- 		rtc_timestamp = RTC_TIMESTAMP_BEGIN_2000;
- 	} else
-diff --git a/plugins/urandom.c b/plugins/urandom.c
-index b9f6039..6f82779 100644
---- a/plugins/urandom.c
-+++ b/plugins/urandom.c
-@@ -154,7 +154,7 @@ static void setup(void *arg)
- 	close(fd);
- 	free(rpi);
- 	if (rc < 0)
--		logit(LOG_ERR, "Failed adding entropy to kernel random pool: %s", strerror(err));
-+		logit(LOG_WARNING, "Failed adding entropy to kernel random pool: %s", strerror(err));
- 	print_result(rc < 0);
- 	return;
- fallback:
--- 
-2.43.0
-

package/finit/0007-Fix-unintended-restart-of-template-siblings.patch

@@ -1,57 +0,0 @@
-From 465bc17ca4b131f8c1ef27ff8279f4ea13745a78 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Thu, 28 Nov 2024 11:06:57 +0100
-Subject: [PATCH 7/7] Fix unintended restart of template siblings
-Organization: Addiva Elektronik
-
-Consider the case where container@.conf is an available template.  When
-creating a container@foo.conf it will share the same base .conf as an
-existing container@bar.conf, but we do not expect to restart bar just
-because foo is instantiated.
-
-Up until this change, all template siblings were considered "dirty" if a
-new one was created or updated.  Skipping realpath() for all files that
-have a '@' works around the problem.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
----
- src/conf.c | 20 +++++++++++++-------
- 1 file changed, 13 insertions(+), 7 deletions(-)
-
-diff --git a/src/conf.c b/src/conf.c
-index 1cfcd87..531923c 100644
---- a/src/conf.c
-+++ b/src/conf.c
-@@ -1432,16 +1432,22 @@ static int conf_change_act(char *dir, char *name, uint32_t mask)
- 		strlcpy(fn, dir, sizeof(fn));
- 	dbg("path: %s mask: %08x", fn, mask);
- 
--	/* Handle disabling/removal of service */
--	rp = realpath(fn, NULL);
--	if (!rp) {
--		if (errno != ENOENT)
--			goto fail;
-+	if (strchr(name, '@')) {
-+		/* Skip realpath for templates */
- 		rp = strdup(fn);
--		if (!rp)
--			goto fail;
-+	} else {
-+		/* Handle disabling/removal of service */
-+		rp = realpath(fn, NULL);
-+		if (!rp) {
-+			if (errno != ENOENT)
-+				goto fail;
-+			rp = strdup(fn);
-+		}
- 	}
- 
-+	if (!rp)
-+		goto fail;
-+
- 	node = conf_find(rp);
- 	if (node) {
- 		dbg("event already registered for %s ...", name);
--- 
-2.43.0
-

package/finit/finit.hash

@@ -1,5 +1,5 @@
 # From https://github.com/troglobit/finit/releases/
-sha256  5026965e33f31b8fa4e2e465b9521e805fa01c31cade884c07d0fcff97cd0ddf  finit-4.8.tar.gz
+sha256  b6a0a2f98c860cf9fe5dfe7e3601d922957ad7880ae29919176ab960b7b96e70  finit-4.12.tar.gz
 
 # Locally calculated
 sha256  2fd62c0fe6ea6d1861669f4c87bda83a0b5ceca64f4baa4d16dd078fbd218c14  LICENSE

package/finit/finit.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-FINIT_VERSION = 4.8
+FINIT_VERSION = 4.12
 FINIT_SITE = https://github.com/troglobit/finit/releases/download/$(FINIT_VERSION)
 FINIT_LICENSE = MIT
 FINIT_LICENSE_FILES = LICENSE