Merge pull request #1034 from kernelkit/update-changelog

Update changelog for v25.04.0
2026-07-26 10:43:02 +02:00 · 2025-04-30 09:45:26 +02:00 · 2025-04-30 08:58:56 +02:00 · 2025-04-29 15:02:39 +02:00 · 2025-04-28 16:57:36 +02:00 · 2025-04-28 15:41:09 +02:00
476 changed files with 10152 additions and 7761 deletions
@@ -0,0 +1,26 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Infix, please use GitHub's built-in
+[Report a Vulnerability](https://github.com/kernelkit/infix/security/advisories/new)
+feature for a private and secure disclosure.
+
+When reporting, include:
+
+- A clear description of the vulnerability.
+- Steps to reproduce the issue.
+- Potential impact of the vulnerability.
+
+## Supported Versions
+
+We provide security updates only for the main branch.
+
+Individual support contracts are provided by _Wires_. See
+[Support](https://github.com/kernelkit/infix/blob/main/.github/SUPPORT.md)
+for more information.
+
+## Acknowledgments
+
+We appreciate the efforts of the security community to help improve the security
+of Infix. Thank you for your responsible disclosure.
@@ -35,6 +35,7 @@ jobs:
      - uses: actions/checkout@v4
        with:
          clean: true
+          fetch-depth: 0
          submodules: recursive

      - name: Set Build Variables
@@ -124,7 +125,7 @@ jobs:
          cd output/
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
-          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

      - uses: actions/upload-artifact@v4
        with:
@@ -55,7 +55,7 @@ jobs:
          sudo apt-get -y update
          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                       libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev libite-dev
+                       libuev-dev

      - name: Build dependencies
        run: |
@@ -65,6 +65,8 @@ jobs:
          git clone https://github.com/sysrepo/sysrepo.git
          mkdir sysrepo/build
          (cd sysrepo/build && cmake .. && make all && sudo make install)
+          git clone https://github.com/troglobit/libite.git
+          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
          make dep

      - name: Check applications
@@ -85,16 +85,21 @@ jobs:
          cd output/
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
-          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

          mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar chfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}

      - uses: actions/upload-artifact@v4
        with:
          name: artifact-${{ matrix.target }}
          path: output/*.tar.gz

+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-disk-image-${{ matrix.target }}
+          path: output/images/*.qcow2
+
  release:
    name: Release Infix ${{ github.ref_name }}
    needs: build
@@ -141,6 +146,11 @@ jobs:
          for file in *.tar.gz; do
              sha256sum $file > $file.sha256
          done
+          if ls *.qcow2 &>/dev/null; then
+            for file in *.qcow2; do
+              sha256sum "$file" > "$file.sha256"
+            done
+          fi

      - name: Extract ChangeLog entry ...
        run: |
@@ -155,7 +165,7 @@ jobs:
          makeLatest: ${{ steps.rel.outputs.latest }}
          discussionCategory: ${{ steps.rel.outputs.cat }}
          bodyFile:  release.md
-          artifacts: "*.tar.gz*"
+          artifacts: "*.tar.gz*,*.qcow2*"

      - name: Summary
        run: |
@@ -106,6 +106,16 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
 >
 > For *customer specific builds* of Infix, see your product repository.

+
+----
+
+<div align="center">
+  <a href="https://github.com/wires-se"><img src="https://raw.githubusercontent.com/wires-se/.github/main/profile/logo.png" width=300></a>
+  <br />Infix development is sponsored by <a href="https://wires.se">Wires<a>
+</div>
+
+----
+
 [^1]: An immutable operating system is one with read-only file systems,
    atomic updates, rollbacks, declarative configuration, and workload
    isolation.  All to improve reliability, scalability, and security.
@@ -230,7 +230,6 @@ CONFIG_MAC80211_LEDS=y
 CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
-# CONFIG_ETHTOOL_NETLINK is not set
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
@@ -481,7 +480,6 @@ CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_PCA954x=y
-CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_GPIO=m
 CONFIG_I2C_RK3X=y
 CONFIG_I2C_SLAVE=y
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.36.1
-# Tue Oct 22 13:12:02 2024
+# Sun Feb  9 12:25:37 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y

@@ -17,7 +17,7 @@ CONFIG_SHOW_USAGE=y
 CONFIG_FEATURE_VERBOSE_USAGE=y
 # CONFIG_FEATURE_COMPRESS_USAGE is not set
 CONFIG_LFS=y
-# CONFIG_PAM is not set
+CONFIG_PAM=y
 CONFIG_FEATURE_DEVPTS=y
 CONFIG_FEATURE_UTMP=y
 CONFIG_FEATURE_WTMP=y
@@ -325,7 +325,7 @@ CONFIG_FEATURE_STAT_FILESYSTEM=y
 CONFIG_STTY=y
 CONFIG_SUM=y
 CONFIG_SYNC=y
-# CONFIG_FEATURE_SYNC_FANCY is not set
+CONFIG_FEATURE_SYNC_FANCY=y
 CONFIG_FSYNC=y
 # CONFIG_TAC is not set
 CONFIG_TAIL=y
@@ -336,7 +336,7 @@ CONFIG_TEST=y
 CONFIG_TEST1=y
 CONFIG_TEST2=y
 CONFIG_FEATURE_TEST_64=y
-# CONFIG_TIMEOUT is not set
+CONFIG_TIMEOUT=y
 CONFIG_TOUCH=y
 CONFIG_FEATURE_TOUCH_SUSV3=y
 CONFIG_TR=y
@@ -357,7 +357,7 @@ CONFIG_BASE32=y
 CONFIG_BASE64=y
 CONFIG_UUENCODE=y
 CONFIG_WC=y
-# CONFIG_FEATURE_WC_LARGE is not set
+CONFIG_FEATURE_WC_LARGE=y
 CONFIG_WHO=y
 CONFIG_W=y
 CONFIG_USERS=y
@@ -127,7 +127,7 @@ bootdata=
 diskimg=disk.img
 bootimg=
 bootpart=
-
+tmpimage=$(mktemp)
 while getopts "a:b:B:n:s:" opt; do
    case ${opt} in
 	a)
@@ -166,7 +166,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vdiskimg=$diskimg \
+	  -vdiskimg=$tmpimage \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -211,5 +211,7 @@ genimage \
    --rootpath "$root" \
    --tmppath  "$tmp" \
    --inputpath "$BINARIES_DIR" \
-    --outputpath "$BINARIES_DIR" \
    --config "$root/genimage.cfg"
+
+qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
+rm "$tmpimage"
@@ -23,7 +23,7 @@ if [ -n "$IMAGE_ID" ]; then
 else
    NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
 fi
-diskimg=disk.img
+diskimg=disk.qcow2

 ver()
 {
@@ -48,7 +48,7 @@ fi
 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
    ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk$(ver).img"
+    diskimg="${NAME}-disk$(ver).qcow2"
    bootcfg=
    if [ "$DISK_IMAGE_BOOT_DATA" ]; then
 	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
@@ -90,7 +90,7 @@ if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
    rel=$(ver)
    ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
    if [ -n "$rel" ]; then
-	ln -sf "$BINARIES_DIR/${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
+	ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
    fi
 fi

@@ -66,7 +66,7 @@ endchoice

 config QEMU_MACHINE
 	string "Select emulated machine"
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max" if QEMU_aarch64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
 	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
@@ -120,7 +120,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
+	echo -n "-drive file=qemu.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
    fi
 }

@@ -316,13 +316,13 @@ gdb_args()
 run_qemu()
 {
    if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	if ! qemu-img check "${CONFIG_QEMU_ROOTFS}.qcow2"; then
-	    rm -f "${CONFIG_QEMU_ROOTFS}.qcow2"
+	if ! qemu-img check "qemu.qcow2"; then
+	    rm -f "qemu.qcow2"
 	fi
-	if [ ! -f "${CONFIG_QEMU_ROOTFS}.qcow2" ]; then
+	if [ ! -f "qemu.qcow2" ]; then
 	    echo "Creating qcow2 disk image for Qemu ..."
 	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
-		     -F raw "${CONFIG_QEMU_ROOTFS}.qcow2" > /dev/null
+		     -F qcow2 "qemu.qcow2" > /dev/null
 	fi
    fi

@@ -9,46 +9,20 @@
 #   $3 IP adddress

 PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
-NAME="/etc/frr/static.d/$2-zeroconf.conf"
-NEXT="${NAME}+"

 log()
 {
    logger -I $$ -t zeroconf -p user.notice "$*"
 }

-# Reduce changes needed by comparing with previous route(s)
-act()
-{
-    case $1 in
-	add)
-	    echo "! Generated by avahi-autoipd"  > "$NEXT"
-	    echo "ip route 0.0.0.0/0 $2 254"    >> "$NEXT"
-	    cmp -s "$NAME" "$NEXT" && return
-	    mv "$NEXT" "$NAME"
-	    ;;
-	del)
-	    [ -f "$NAME" ] || return
-	    rm "$NAME"
-	    ;;
-	*)
-	    return
-	    ;;
-    esac
-
-    initctl -nbq restart staticd
-}
-
 case "$1" in
    BIND)
        ip addr flush dev "$2" proto random
        ip addr add "$3"/16 brd 169.254.255.255 scope link dev "$2" proto random
-	act add "$2"
 	log "set ipv4ll $3 on iface $2"
        ;;

    CONFLICT|UNBIND|STOP)
-	act del "$2"
        ip addr flush dev "$2" proto random
 	log "clr ipv4ll on iface $2"
        ;;
@@ -1,4 +1,7 @@
-task    name:container-%i :setup \
-	[2345] container -n %i setup -- Setup container %i
-sysv    <!usr/container:%i> :%i pid:!/run/container:%i.pid log:prio:local1,tag:%i kill:10 \
-	[2345] container -n %i -- container %i
+# Start a container instance (%i) and redirect logs to /log/container
+# Give podman enough time to properly shut down the container.  Every
+# time we start a container we run the setup stage, disable the Finit
+# timeout to allow the setup stage to run to completion.
+sysv    log:prio:local1,tag:%i kill:10 pid:!/run/container:%i.pid \
+	pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container   \
+	[2345] <!> :%i container -n %i -- container %i
@@ -1 +1 @@
-service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)
+service [2345] <!> ttyd -i lo -W -p 8001 login -- Web terminal daemon (ttyd)
@@ -2,10 +2,15 @@
 net.ipv6.route.max_size=131072
 net.ipv6.conf.all.ignore_routes_with_linkdown=1

-# IP Routing
-net.ipv6.conf.all.forwarding=1
+# IP Routing is disabled by default, enabled globally, and per
+# interface, for each interface in confd.  See also accept_ra.
+net.ipv6.conf.all.forwarding=0
 net.ipv6.conf.default.forwarding=0

+# Accept router advertisements even when forwarding is enabled
+net.ipv6.conf.all.accept_ra=2
+net.ipv6.conf.default.accept_ra=2
+
 # IPv6 SLAAC
 net.ipv6.conf.all.autoconf=0
 net.ipv6.conf.default.autoconf=0
@@ -21,7 +21,11 @@ dir()
 if [ -d "$1" ]; then
    dir "$1"
 else
-    dir "$HOME"
+    if [ "$USER" = "root" ]; then
+	dir "$HOME"
+    else
+	dir "/home/$USER"
+    fi
    dir "/cfg"
    dir "/log"
 fi
@@ -0,0 +1,12 @@
+#!/bin/sh
+if [ $# -lt 2 ]; then
+        echo "usage: $0 <quirk-name> <ifname>"
+        exit 1
+fi
+quirk=$1
+ifname=$2
+if [ -f "/etc/product/interface-quirks.json" ]; then
+        echo "$(jq -r --arg iface "$ifname" --arg quirk "$quirk" '.[$iface][$quirk] // "false"' /etc/product/interface-quirks.json)"
+else
+        echo "false"
+fi
@@ -39,8 +39,10 @@ fi
 # init scripts to prevent select services from starting.
 initctl -nbq cond set led

-note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
-/usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
+if [ -d "$PRODUCT_INIT" ]; then
+    note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
+    /usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
+fi

 # Product specific init done.
 initctl -nbq cond set product
@@ -43,6 +43,7 @@ while [ "$1" ]; do
    txqs="$2"
    shift 2

+    [ $(/usr/libexec/infix/has-quirk "broken-mqprio" "$iface") = "true" ] && echo "Skipping $iface, does not support mqprio" && continue
    [ $txqs -lt 2 ] && continue
    [ $txqs -gt 8 ] && txqs=8

@@ -0,0 +1,8 @@
+#!/bin/sh
+# Initialize speed/duplex of virtio interfaces
+# For virtual test systems (lacp tests)
+
+ifaces=$(ip -d -json link show | jq -r '.[] | select(.parentbus == "virtio") | .ifname')
+for iface in $ifaces; do
+    ethtool -s "$iface" speed 1000 duplex full
+done
@@ -4,10 +4,14 @@
 # the migrate tool inserts old version in name before .cfg extension.
 CONFIG_FILE="/cfg/startup-config.cfg"
 BACKUP_FILE="/cfg/backup/startup-config.cfg"
-mkdir -p "$(dirname "$BACKUP_FILE")"
+BACKUP_DIR="$(dirname "$BACKUP_FILE")"
+
+mkdir -p         "$BACKUP_DIR"
+chown root:wheel "$BACKUP_DIR"
+chmod 0770       "$BACKUP_DIR"

 if [ ! -f "$CONFIG_FILE" ]; then
-    note "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
+    logger -I $$ -k -p user.notice -t $(basename "$0")  "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
    exit 0
 elif migrate -cq "$CONFIG_FILE"; then
    exit 0
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 # This script can be used to start, stop, create, and delete containers.
 # It is what confd use, with the Finit container@.conf template, to set
 # up, run, and delete containers.
@@ -9,6 +9,7 @@
 DOWNLOADS=/var/lib/containers/oci
 BUILTIN=/lib/oci
 TMPDIR=/var/tmp
+container=$0
 checksum=""
 extracted=
 timeout=30
@@ -38,6 +39,11 @@ err()
    [ "$rc" -eq 0 ] || exit "$rc"
 }

+pidfn()
+{
+    echo "/run/containers/${1}.pid"
+}
+
 check()
 {
    file=$1
@@ -109,33 +115,34 @@ EOF
 # If there are more index files, this function does not handle them.
 unpack_archive()
 {
-    image=$1
-    name=$2
+    uri=$1
+    tag=$2
+    img=$(basename "$uri")

    # Supported transports for load and create
-    case "$image" in
+    case "$uri" in
 	oci:*)			# Unpacked OCI image
-	    file=${image#oci:}
+	    file=${uri#oci:}
 	    ;;
 	oci-archive:*)		# Packed OCI image, .tar or .tar.gz format
-	    file=${image#oci-archive:}
+	    file=${uri#oci-archive:}
 	    ;;
 	ftp://* | http://* | https://*)
-            if ! file=$(fetch "$image"); then
+            if ! file=$(fetch "$uri"); then
 		return 1
 	    fi
            ;;
 	*)			# docker://*, docker-archive:*, or URL
-	    if podman image exists "$image"; then
-		echo "$image"
+	    if podman image exists "$img"; then
+		echo "$img"
 		return 0
 	    fi
 	    # XXX: use --retry=0 with Podman 5.0 or later.
-	    if ! id=$(podman pull --quiet "$image"); then
-		log "Failed pulling $image"
+	    if ! id=$(podman pull --quiet "$uri"); then
+		log "Failed pulling $uri"
 		return 1
 	    fi
-	    # Echo image name to caller
+	    # Echo image tag to caller
 	    podman images --filter id="$id" --format "{{.Repository}}:{{.Tag}}"
 	    return 0
 	    ;;
@@ -147,7 +154,7 @@ unpack_archive()
 	elif [ -e "$BUILTIN/$file" ]; then
 	    file="$BUILTIN/$file"
 	else
-	    err 1 "cannot find OCI archive $file in search path."
+	    err 1 "cannot find OCI archive $file in URI $uri"
 	fi
    fi

@@ -171,8 +178,8 @@ unpack_archive()

    dir=$(dirname "$index")
    if echo "$dir" | grep -q ":"; then
-        if [ -z "$name" ]; then
-            name="$dir"
+        if [ -z "$tag" ]; then
+            tag="$dir"
        fi
        sanitized_dir=$(echo "$dir" | cut -d':' -f1)
        mv "$dir" "$sanitized_dir" || err 1 "failed renaming $dir to $sanitized_dir"
@@ -188,21 +195,21 @@ unpack_archive()
 	rm -rf "$dir"
    fi

-    # Rename image from podman default $dir:latest
-    if [ -n "$name" ]; then
-	podman tag "$dir" "$name" >/dev/null
-	podman rmi "$dir"         >/dev/null
+    # Retag image from podman default $dir:latest
+    if [ -n "$tag" ]; then
+	podman tag "$dir" "$tag" >/dev/null
+	podman rmi "$dir"        >/dev/null
    else
-	name=$dir
+	tag=$dir
    fi

-    echo "$name"
+    echo "$tag"
 }

 running()
 {
-    run=$(podman inspect "$1" 2>/dev/null |jq .[].State.Running)
-    [ "$run" = "true" ] && return 0
+    status=$(podman inspect -f '{{.State.Status}}' "$1" 2>/dev/null)
+    [ "$status" = "running" ] && return 0
    return 1
 }

@@ -233,7 +240,7 @@ create()
    args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
    args="$args --restart=$restart --systemd=false --tz=local $privileged"
    args="$args $vol $mount $hostname $entrypoint $env $port $logging"
-    pidfn=/run/container:${name}.pid
+    pidfile=/run/container:${name}.pid

    [ -n "$quiet" ] || log "---------------------------------------"
    [ -n "$quiet" ] || log "Got name: $name image: $image"
@@ -256,8 +263,8 @@ create()
    fi

    # shellcheck disable=SC2048
-    log "podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
-    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
+    log "podman create --name $name --conmon-pidfile=$pidfile $args $image $*"
+    if podman create --name "$name" --conmon-pidfile="$pidfile" $args "$image" $*; then
 	[ -n "$quiet"  ] || log "Successfully created container $name from $image"
 	[ -n "$manual" ] || start "$name"

@@ -272,7 +279,6 @@ create()
 delete()
 {
    name=$1
-    image=$2

    if [ -z "$name" ]; then
 	echo "Usage:"
@@ -281,9 +287,11 @@ delete()
    fi

    # Should already be stopped, but if not ...
-    container stop "$name"
+    log "$name: should already be stopped, double checking ..."
+    container stop "$name" >/dev/null

    while running "$name"; do
+	log "$name: still running, waiting for it to stop ..."
 	_=$((timeout -= 1))
 	if [ $timeout -le 0 ]; then
 	    err 1 "timed out waiting for container $1 to stop before deleting it."
@@ -291,6 +299,7 @@ delete()
 	sleep 1
    done

+    log "$name: calling podman rm -vif ..."
    podman rm -vif "$name" >/dev/null 2>&1
    [ -n "$quiet" ] || log "Container $name has been removed."
 }
@@ -315,7 +324,7 @@ start()
 	return
    fi

-    initctl -bq cond set "container:$name"
+    initctl start container:$name
    # Real work is done by wrap() courtesy of finit sysv emulation
 }

@@ -328,7 +337,7 @@ stop()
 	return
    fi

-    initctl -bq cond clr "container:$name"
+    initctl stop container:$name
    # Real work is done by wrap() courtesy of finit sysv emulation
 }

@@ -336,8 +345,27 @@ wrap()
 {
    name=$1
    cmd=$2
+    pidfile=$(pidfn "$name")

-    podman "$cmd" "$name"
+    # Containers have three phases: setup, running, and teardown.
+
+    # The setup phase may run forever in the background trying to fetch
+    # the image.  It saves its PID in /run/containers/${name}.pid
+    if [ "$cmd" = "stop" ] && [ -f "$pidfile" ]; then
+        pid=$(cat "$pidfile")
+
+	# Check if setup is still running ...
+	if kill -0 "$pid" 2>/dev/null; then
+            kill "$pid"
+            wait "$pid" 2>/dev/null
+        fi
+
+        rm -f "$pidfile"
+        return 0
+    fi
+
+    # Skip "echo $name" from podman start in log
+    podman "$cmd" "$name" >/dev/null
 }

 # Removes network $1 from all containers
@@ -370,7 +398,14 @@ netrestart()

 cleanup()
 {
+    pidfile=$(pidfn "$name")
+
    log "Received signal, exiting."
+    if [ -n "$name" ] && [ -f "$pidfile" ]; then
+	log "$name: in setup phase, removing $pidfile ..."
+	rm -f "$pidfile"
+    fi
+
    exit 1
 }

@@ -426,11 +461,12 @@ commands:
  run      NAME [CMD]      Run a container interactively, with an optional command
  save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
  setup    NAME            Create and set up container as a Finit task
-  shell                    Start a shell inside a container
+  shell   [CMD]            Start a shell, or run CMD, inside a container
  show    [image | volume] Show containers, images, or volumes
  stat                     Show continuous stats about containers (Ctrl-C aborts)
  start   [NAME]           Start a container, see -n
  stop    [NAME]           Stop a container, see -n
+  upgrade  NAME            Upgrade a running container (stop, pull, restart)
  volume  [prune]          Prune unused volumes
 EOF
 }
@@ -568,7 +604,7 @@ if [ -n "$cmd" ]; then
    shift
 fi

-trap cleanup INT TERM
+trap cleanup INT HUP TERM

 case $cmd in
    # Does not work atm., cannot attach to TTY because
@@ -582,19 +618,24 @@ case $cmd in
 	;;
    delete)
 	cmd=$1
-	name=$2
+	[ -n "$name" ] || name=$2
 	if [ "$cmd" = "network" ] && [ -n "$name" ]; then
 	    netwrm "$name"
 	else
-	    delete "$@"
+	    [ -n "$name" ] || name=$1
+	    delete "$name"
 	fi
 	;;
    exec)
-	podman exec -it "$@"
+	if [ -z "$name" ]; then
+	    name="$1"
+	    shift
+	fi
+	podman exec -i "$name" "$@"
 	;;
    flush)
 	echo "Cleaning up any lingering containers";
-	podman rm -av
+	podman rm -av $force
 	;;
    find)
 	cmd=$1
@@ -699,18 +740,34 @@ case $cmd in
 	[ -n "$name" ] || err 1 "setup: missing container name."
 	script=/run/containers/${name}.sh
 	[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."
+
+	# Save our PID in case we get stuck here and someone wants to
+	# stop us, e.g., due to reconfiguration or reboot.
+	pidfile=$(pidfn "${name}")
+	echo $$ > "$pidfile"
+
 	while ! "$script"; do
-	    # Wait for address/route changes, or retry every 60 secods
-	    # shellcheck disable=2162,3045
-	    ip monitor address route | while read -t 60 _; do break; done
+            log "${name}: setup failed, waiting for network changes ..."
+	    read -t 60 _ < <(ip monitor address route)

 	    # On IP address/route changes, wait a few seconds more to ensure
 	    # the system has ample time to react and set things up for us.
+	    log "${name}: retrying ..."
 	    sleep 2
 	done
+
+	rm -f "$pidfile"
 	;;
    shell)
-	podman exec -it "$1" sh -l
+	if [ -z "$name" ]; then
+	    name="$1"
+	    shift
+	fi
+	if [ $# -gt 0 ]; then
+	    podman exec -i "$name" sh -c "$*"
+	else
+	    podman exec -it "$name" sh -l
+	fi
 	;;
    show)
 	cmd=$1
@@ -803,15 +860,15 @@ case $cmd in

 	# Likely an OCI archive, or local directory, assume user has updated image.
 	if echo "$img" | grep -Eq '^localhost/'; then
-	    file=$(awk '{s=$NF} END{print s}' "$script")
-	    echo "Upgrading container ${1} with local archive: $file ..."
+	    file=$(awk '/^# meta-image:/ {print $3}' "$script")
+	    echo ">> Upgrading container $1 using $file ..."
 	else
 	    printf ">> Stopping ... "
 	    podman stop "$1"
 	    printf ">> "
 	    podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
+	    echo ">> Starting $1 ..."
 	fi
-	echo ">> Starting $1 ..."
 	if ! "$script"; then
 	    echo ">> Failed recreating container $1"
 	    exit 1
@@ -831,6 +888,22 @@ case $cmd in
 	esac
 	;;
    *)
+	if [ -n "$SERVICE_SCRIPT_TYPE" ] && [ -n "$SERVICE_ID" ]; then
+	    case "$SERVICE_SCRIPT_TYPE" in
+		pre)
+		    # Called as pre-script from Finit service
+		    exec $container -q -n "$SERVICE_ID" setup
+		    ;;
+		cleanup)
+		    # Called as cleanup-script from Finit service
+		    log "Calling $container -n $SERVICE_ID delete"
+		    exec $container -q -n "$SERVICE_ID" delete
+		    ;;
+		*)
+		    false
+		    ;;
+	    esac
+	fi
 	usage
 	exit 1
 	;;
@@ -13,8 +13,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -27,13 +27,14 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.25"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -55,8 +56,8 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -119,6 +120,7 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
@@ -138,6 +140,7 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -161,11 +164,12 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_LIBINPUT=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-DISK_IMAGE_BOOT_BIN=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
@@ -27,13 +27,14 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.25"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -119,6 +120,7 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -137,6 +139,8 @@ BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -8,7 +8,6 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -30,7 +29,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.10.3"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.25"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
@@ -42,6 +41,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
@@ -74,7 +74,6 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
@@ -178,6 +177,7 @@ INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -201,8 +201,10 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set
@@ -39,6 +39,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
@@ -169,6 +170,7 @@ BR2_PACKAGE_CONFD=y
 # BR2_PACKAGE_CONFD_TEST_MODE is not set
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -194,6 +196,8 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set
@@ -12,8 +12,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.25"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,6 +34,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -54,10 +55,8 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_LINUX_PAM=y
@@ -126,6 +125,7 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
@@ -142,6 +142,7 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -165,8 +166,10 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 GNS3_APPLIANCE_RAM=512
@@ -7,13 +7,14 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -26,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.25"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,6 +35,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -50,10 +52,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
-BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_LIBMNL=y
@@ -83,6 +82,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_GETENT=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
@@ -138,6 +138,7 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 TRUSTED_KEYS=y
@@ -4,6 +4,81 @@ Change Log
 All notable changes to the project are documented in this file.


+[v25.04.0][] - 2025-04-30
+-------------------------
+
+### Changes
+ - Upgrade Linux kernel to 6.12.25 (LTS)
+ - Upgrade Buildroot to 2025.02.1 (LTS)
+ - Format for disk image (for QEMU) has changed to `qcow2`
+
+### Fixes
+ - Fix #1002: Broken symlink in release package
+ - Fix #1006: NanoPi R2S corrupt startup, regression in Infix v25.02.0
+   - Bump R2S kernel, now same as tier one boards
+ - Fix #1015: Not possible to save custom SSH settings in startup-config
+ - Fix group owner and permissions of `/cfg/backup` directory
+ - Fix extraction of old version for `/cfg/backup/` files
+ - Fix configuration migration issues when upgrading
+
+[v25.03.0][] - 2025-03-31
+-------------------------
+
+> [!IMPORTANT]
+> This release is the first with the new Buildroot 2025.02 (LTS)
+
+### Changes
+ - Upgrade Linux kernel to 6.12.21 (LTS)
+ - Upgrade Buildroot to 2025.02.0 (LTS)
+
+### Fixes
+ - Fix #964: YANG schema warning in syslog: missing 'monitor' node for lag
+ - Fix #980: the system fails to reboot when a container is (stuck), for
+   whatever reason, in its 'setup' state
+ - Fix #990: web console, ttyd service, stopped working after upgrade to
+   Buildroot 2025.02, caused by new (missing) option `--writable`
+ - Fix TCAM memory corruption in `mvpp2` Ethernet controller
+ - Fix annoying (but harmless) usage message from the logger tool when
+   `startup-config` fails to load and the system reverts to failure mode
+ - Fix harmless log warning for product specific init when no product
+   specific init scripts are found
+ - Backport fixes for sysklogd, affecting hostname filtering and periods
+   in TAG names, pending official backport in Buildroot
+
+
+[v25.02.0][] - 2025-03-04
+-------------------------
+
+### Changes
+ - Upgrade Linux kernel to 6.12.18 (LTS)
+ - Upgrade Buildroot to 2024.02.11 (LTS)
+ - Add support for link aggregation (lag), static (balance-xor) and LACP
+ - Add support for the [i.MX 8M Plus EVK][EVK]
+ - YANG type change for SSH private/public keys, from ietf-crypto-types
+   to infix-crypto-types
+ - Disable global IPv6 forwarding by default, enable by per-interface
+   setting.  Note, route advertisements are always accepted.  Issue #785
+ - Drop automatic default route (interface route) for IPv4 autoconf, not
+   necessary and causes more confusion than good.  Issue #923
+ - Update scripting with new RESTCONF examples
+
+### Fixes
+ - Fix #896: `/etc/resolv.conf` not properly generated when system runs
+   in fail secure mode (failing to load `startup-config`)
+ - Fix #902: containers "linger" in the system (state 'exited') after
+   having removed them from the configuration
+ - Fix #930: container configuration changes does not apply at runtime
+   only when saved to `startup-config` and system is rebooted
+ - Fix #936: DHCP server reconfiguration does not always take effect.
+ - Fix #956: CLI `copy` command complains it cannot change owner when
+   copying `factory-config` to `running-config`.  Bogus error, the
+   latter is not really a file
+ - Fix #977: "Operation not permitted" when saving `running-config` to
+   `startup-config` (harmless warning but annoying and concerning)
+
+[EVK]: https://www.nxp.com/design/design-center/development-boards-and-designs/8MPLUSLPD4-EVK
+
+
 [v25.01.0][] - 2025-01-31
 -------------------------

@@ -1471,7 +1546,10 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.01.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.04.0...HEAD
+[v25.04.0]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
+[v25.03.0]:   https://github.com/kernelkit/infix/compare/v25.02.0...v25.03.0
+[v25.02.0]:   https://github.com/kernelkit/infix/compare/v25.01.0...v25.02.0
 [v25.01.0]:   https://github.com/kernelkit/infix/compare/v24.11.0...v25.01.0
 [v24.11.1]:   https://github.com/kernelkit/infix/compare/v24.11.0...v24.11.1
 [v24.11.0]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.11.0
@@ -1,13 +1,16 @@
+<img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>

 Welcome to Infix, your friendly Network Operating System!  On these
 pages you can find both user and developer documentation.

-> Topics on configuring the system include CLI examples, every setting
-> is also possible to perform using NETCONF.  In fact, the Infix test
-> system solely relies on NETCONF for configuring network topologies.
+Most topics on configuring the system include CLI examples, but every
+setting, as well as status read-back from the operational datastore, is
+also possible to perform using NETCONF or RESTCONF.  In fact, the Infix
+regression test system solely relies on NETCONF and RESTCONF.

-The CLI documentation is also available from inside the CLI itself using
-the `help` command.
+> [!TIP]
+> The CLI documentation is also available from inside the CLI itself
+> using the `help` command in admin-exec mode.

 - **CLI Topics**
   - [Introduction to the CLI](cli/introduction.md)
@@ -18,6 +21,7 @@ the `help` command.
   - [Introduction](introduction.md)
   - [System Configuration](system.md)
   - [Network Configuration](networking.md)
+   - [DHCP Server](dhcp.md)
   - [Syslog Support](syslog.md)
 - **Infix In-Depth**
   - [Boot Procedure](boot.md)
@@ -31,9 +31,9 @@ Infix comes with native support for Docker containers using [podman][].
 The [YANG model][1] describes the current level of support, complete
 enough to run both system and application containers.

-Key design features, like using Linux switchdev, allow users to assign
-switch ports directly to containers, not just bridged VETH pairs, this
-is a rare and in many cases *unique* feature of Infix.
+Key design features of Infix, like using Linux switchdev, allow users to
+assign switch ports directly to containers, not just bridged VETH pairs.
+This is a rare and in many cases *unique* feature of Infix.

 All network specific settings are done using the IETF interfaces YANG
 model, with augments for containers to ensure smooth integration with
@@ -43,7 +43,7 @@ container networking in podman.
 > Even though the `podman` command can be used directly from a shell
 > prompt, we strongly recommend using the CLI commands instead.  They
 > employ the services of a wrapper `container` script which handles the
-> integration of containers in the system.
+> integration of Docker containers in the system.


 Caution
@@ -83,18 +83,20 @@ In the CLI, containers can be run in one of two ways:
 1. `container run IMAGE [COMMAND]`, or
 2. enter `configure` context, then `edit container NAME`

-The former is useful mostly for testing, or running single commands in
-an image.  It is a wrapper for `podman run -it --rm ...`, while the
-latter is a wrapper and adaptation of `podman create ...`.
+The first is useful mostly for testing, or running single commands in
+an image.  It is a wrapper for `podman run -it --rm ...`.

-The second creates a read-only container that is automatically started
-at every boot.  When non-volatile storage is needed, data stored in a
-volume is persisted until explicitly removed from the configuration,
-i.e., across host and container reboots and upgrades.
+The second creates a read-only container that by default automatically
+start at every boot.   It basically wraps `podman create ...`.

-Another option is [Content Mounts](#content-mounts), where the content
-of a file mounted into the container is kept along with the container
-configuration in the device's `startup-config`.
+When non-volatile storage is needed two complementary options exist:
+
+ - **Volumes:** data stored in a volume is persisted until explicitly
+   removed from the configuration, i.e., across host reboots and
+   container upgrades
+ - **[Content Mounts](#content-mounts):** where the content of a file
+  mounted into the container is kept along with the container
+  configuration in the device's `startup-config`

 Podman ensures (using tmpfs) all containers have writable directories
 for certain critical file system paths: `/dev`, `/dev/shm`, `/run`,
@@ -127,24 +129,30 @@ Classic Hello World:
    Hello from Docker!
    This message shows that your installation appears to be working correctly.

-Persistent web server using nginx, sharing the host's network:
+A web server with [nginx][], using standard docker bridge.  Podman will
+automatically create a VETH pair for us, connecting the container to the
+`docker0` bridge:

    admin@example:/> configure
-    admin@example:/config> edit container web
-    admin@example:/config/container/web> set image docker://nginx:alpine
-    admin@example:/config/container/web> set publish 80:80
-    admin@example:/config/container/web> set network host
-    admin@example:/config/container/web> leave
+    admin@example:/config/> edit interface docker0
+    admin@example:/config/interface/docker0/> set container-network
+    admin@example:/config/interface/docker0/> end
+    admin@example:/config/> edit container web
+    admin@example:/config/container/web/> set image docker://nginx:alpine
+    admin@example:/config/container/web/> set network publish 8080:80
+    admin@example:/config/container/web/> set network interface docker0
+    admin@example:/config/container/web/> set volume cache target /var/cache
+    admin@example:/config/container/web/> leave
    admin@example:/> show container

 Exit to the shell and verify the service with curl, or try to attach
 to your device's IP address using your browser:

-    admin@example:~$ curl http://localhost
+    admin@example:~$ curl http://localhost:8080

-or connect to port 80 of your running Infix system with a browser.  See
-the following sections for how to add more interfaces and manage your
-container at runtime.
+or connect to port 8080 of your running Infix system with a browser.
+See the following sections for how to add more interfaces and manage
+your container at runtime.


 Container Images
@@ -456,11 +464,11 @@ in a `bridge`.  Below an example of a system container calls `set
 network interface docker0`, here we show how to set options for that
 network:

-    admin@example:/config/container/ntpd/> edit network docker0 
-    admin@example:/config/container/ntpd/network/docker0/> 
-    admin@example:/config/container/ntpd/network/docker0/> set option 
+    admin@example:/config/container/ntpd/> edit network interface docker0
+    admin@example:/config/container/ntpd/network/interface/docker0/>
+    admin@example:/config/container/ntpd/network/interface/docker0/> set option
    <string>  Options for masquerading container bridges.
-    admin@example:/config/container/ntpd/network/docker0/> help option 
+    admin@example:/config/container/ntpd/network/interface/docker0/> help option
    NAME
            option <string>
    
@@ -471,9 +479,9 @@ network:
                     mac=00:01:02:c0:ff:ee -- set fixed MAC address in container
                     interface_name=foo0   -- set interface name inside container
    
-    admin@example:/config/container/ntpd/network/docker0/> set option ip=172.17.0.2
-    admin@example:/config/container/ntpd/network/docker0/> set option interface_name=wan
-    admin@example:/config/container/ntpd/network/docker0/> leave
+    admin@example:/config/container/ntpd/network/interface/docker0/> set option ip=172.17.0.2
+    admin@example:/config/container/ntpd/network/interface/docker0/> set option interface_name=wan
+    admin@example:/config/container/ntpd/network/interface/docker0/> leave


 ### Container Host Interface
@@ -903,4 +911,5 @@ Container Image](#upgrading-a-container-image) (above).
 [14]:     https://github.com/kernelkit/curiOS/
 [15]:     https://github.com/kernelkit/curiOS/blob/2e4748f65e356b2c117f586cd9420d7ba66f79d5/board/system/rootfs/etc/inittab
 [tini]:   https://github.com/krallin/tini
+[nginx]:  https://hub.docker.com/_/nginx
 [podman]: https://podman.io
@@ -131,6 +131,8 @@ This rebuilds (and installs) `foo` and `bar`, the `all` target calls
 on Buildroot to finalize the target filesystem and generate the images.
 The final `run` argument is explained below.

+
+
 ### `confd`

 The Infix `src/confd/` is the engine of the system.  Currently it is a
@@ -164,17 +166,78 @@ Now you can rebuild `confd`, just as described above, and restart Infix:
    make confd-rebuild all run


+### `statd`
+
+The Infix status daemon, `src/statd`, is responsible for populating the 
+sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions, 
+but unlike `confd`, it relies entirely on `yanger`, a Python script that 
+gathers data from local linux services and feeds it into sysrepo.
+
+To apply changes, rebuild the image:
+
+    make python-statd-rebuild statd-rebuild all
+
+Rebuilding the image and testing on target for every change during 
+development process can be tedious. Instead, `yanger` allows remote 
+execution, running the script directly on the host system (test 
+container):
+
+    infamy0:test # ../src/statd/python/yanger/yanger -x "../utils/ixll -A ssh d3a" ieee802-dot1ab-lldp
+
+`ixll` is a utility script that lets you run network commands using an
+**interface name** instead of a hostname. It makes operations like 
+`ssh`, `scp`, and network discovery easier.
+
+Normally, `yanger` runs commands **locally** to retrieve data 
+(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when 
+executed with `-x "../utils/ixll -A ssh d3a"` it redirects these 
+commands to a remote system connected to the local `d3a` interface via 
+SSH. This setup is used for running `yanger` in an 
+[interactive test environment](testing.md#interactive-usage). The yanger
+script runs on the `host` system, but key commands are executed on the 
+`target` system.
+
+For debugging or testing, you can capture system command output and 
+replay it later without needing a live system.
+
+To capture:
+
+    infamy0:test # ../src/statd/python/yanger/yanger -c /tmp/capture ieee802-dot1ab-lldp
+
+To replay:
+
+    infamy0:test # ../src/statd/python/yanger/yanger -r /tmp/capture ieee802-dot1ab-lldp
+
+This is especially useful when working in isolated environments or debugging
+issues without direct access to the DUT.
+
+### Agree on YANG Model
+
+When making changes to the `confd` and `statd` services, you will often need to update
+the YANG models. If you are adding a new YANG module, it's best to follow the 
+structure of an existing one. However, before making any changes, **always discuss
+them with the Infix core team**. This helps avoid issues later in development and 
+makes pull request reviews smoother.
+
+
 Testing
 -------

 Manual testing can be done using Qemu by calling <kbd>make run</kbd>,
-see also [Infix in Virtual Environments](virtual.md).
+see also [Infix in Virtual Environments](virtual.md), or on a physical
+device by upgrading to the latest build or "[netbooting](netboot.md)"
+and running the image from RAM.  The latter is how most board porting
+work is done -- **much quicker** change-load-test cycles.

 The Infix automated test suite is built around Qemu and [Qeneth][2], see:

 * [Testing](testing.md)
 * [Docker Image](../test/docker/README.md)

+With any new feature added to Infix, it is essential to include relevant
+test case(s).  See the [Test Development](testing.md#test-development)
+section for guidance on adding test cases.
+

 Reviewing
 ---------
@@ -6,13 +6,7 @@ This column contains the mapping between YANG and Linux / Ethtool counters.
 ┌─────────────────────────────────┬──────────────────────────────────┐
 │ YANG                            │ Linux / Ethtool                  │
 ├─────────────────────────────────┼──────────────────────────────────┤
-│ out-frames                      │ FramesTransmittedOK              │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ out-multicast-frames            │ MulticastFramesXmittedOK         │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ out-broadcast-frames            │ BroadcastFramesXmittedOK         │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ in-total-frames                 │ FramesReceivedOK,                │
+│ in-total-octets                 │ FramesReceivedOK,                │
 │                                 │ FrameCheckSequenceErrors         │
 │                                 │ FramesLostDueToIntMACRcvError    │
 │                                 │ AlignmentErrors                  │
@@ -25,8 +19,23 @@ This column contains the mapping between YANG and Linux / Ethtool counters.
 ├─────────────────────────────────┼──────────────────────────────────┤
 │ in-broadcast-frames             │ BroadcastFramesReceivedOK        │
 ├─────────────────────────────────┼──────────────────────────────────┤
+│ in-error-fcs-frames             │ FrameCheckSequenceErrors         │
+├─────────────────────────────────┼──────────────────────────────────┤
 │ in-error-undersize-frames       │ undersize_pkts                   │
 ├─────────────────────────────────┼──────────────────────────────────┤
-│ in-error-fcs-frames             │ FrameCheckSequenceErrors         │
+| in-error-oversize-frames        | etherStatsJabbers,               |
+|                                 | etherStatsOversizePkts           |
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-error-mac-internal-frames    │ FramesLostDueToIntMACRcvError    │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-frames                      │ FramesTransmittedOK              │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-multicast-frames            │ MulticastFramesXmittedOK         │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-broadcast-frames            │ BroadcastFramesXmittedOK         │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ infix-eth:out-good-octets       │ OctetsTransmittedOK              │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ infix-eth:in-good-octets        │ OctetsReceivedOK                 │
 └─────────────────────────────────┴──────────────────────────────────┘
 ```
@@ -0,0 +1,130 @@
+Netboot HowTo
+=============
+
+This document describes how to set up network booting U-Boot devices on
+a LAN, e.g., when working with an evaluation board or other embedded
+system.  The most secure way to do this is with a local LAN between a PC
+and the device.
+
+Instead of setting up everything in U-Boot to download the Linux Image,
+device tree, and initramfs, we will let U-Boot download a script with
+instructions to run.  When you have multiple systems (boards) this
+quickly becomes a lot easier to manage.
+
+> [!NOTE]
+> Instructions in this HowTo assume a Debian based development system,
+> e.g., Ubuntu or Linux Mint.
+
+
+## Network Interface Setup
+
+For two dedicated network interfaces, here `eth2` and `eth3` (ymmv), we
+create an old-style interfaces config[^1] with the following content:
+
+```
+# /etc/network/interfaces.d/gimli
+auto eth2
+iface eth2 inet static
+        address 192.168.0.1
+        netmask 255.255.255.0
+
+auto eth3
+iface eth3 inet manual
+```
+
+> [!TIP]
+> Use configuration file names in `.d/` directories that make sense and
+> can easily be remembered.  Here we use the hostname of the PC.
+
+
+## DHCP/TFTP Server Setup
+
+The examples given here use `dnsmasq`, which provides both DHCP and TFTP
+server support.  The same can be achieved with other implementations.
+
+Similar to `interfaces.d`, dnsmasq has an `/etc/dnsmasq.d` directory so
+we can use "snippets" instead of modifying `/etc/dnsmasq.conf` directly.
+Add a file called `/etc/dnsmasq.d/gimli`.
+
+Initial content:
+
+```
+# Remember IP address handed out to BOOTP clients
+bootp-dynamic
+# Disable check-if-ip-address-is-already-used
+no-ping
+
+# Enable TFTP server, use /srv/ftp, same as any FTP server, useful
+# when using the same images for system upgrade as for netbooting.
+enable-tftp
+tftp-root=/srv/ftp
+```
+
+> [!CAUTION]
+> First of all, make sure you DO NOT accidentally set up dnsmasq so that
+> it starts acting as a DHCP server also on your office LAN!  Follow the
+> instructions below for more details.
+
+If you have many interfaces used for lab equipment and only one office
+LAN interface, then use something like this:
+
+```
+# Disable DHCP server on loopback and office LAN (eth0)
+except-interface=lo
+except-interface=eth0
+```
+
+To further lock this down, we only run the DHCP server on each of the
+interfaces used for lab equipment, with a dedicated IP range as well:
+
+```
+# Currently I have an imx8mp-evk on eth2, so on my system I have a
+# symlink bootfile-eth2 -> netboot.scr
+interface=eth2
+dhcp-range=192.168.0.100,192.168.0.199,1h
+dhcp-boot=tag:eth2,bootfile-eth2
+```
+
+## Bootfile netboot.scr
+
+The bootfile U-Boot retrieves from the TFTP server is a script that
+looks like this, `netboot.sh`:
+
+```sh
+setenv ramdisk_addr_r 0x58000000
+setenv fdt_addr_r     0x50400000
+
+setenv autoboot off
+tftp ${fdt_addr_r}     imx8mp-evk/imx8mp-evk.dtb
+tftp ${kernel_addr_r}  imx8mp-evk/Image
+tftp ${ramdisk_addr_r} imx8mp-evk/rootfs.squashfs
+
+setenv bootargs console=ttymxc1,115200 root=/dev/ram0 brd.rd_size=500000 rauc.slot=net
+booti ${kernel_addr_r} ${ramdisk_addr_r}:${filesize} ${fdt_addr_r}
+```
+
+U-Boot cannot read script files directly, so we need to wrap it with a
+FIT format header, this is done by first converting it on the PC:
+
+```
+$ mkimage -T script -d netboot.sh netboot.scr
+```
+
+The output is `netboot.scr` which we symlink to above in the dnsmasq
+setup step.
+
+
+## U-Boot Commands
+
+U-Boot is a maze of environment variables, some with values, some wrap
+commands, and most are undocumented.  We will use a prefix for our
+variables to ensure we do not overwrite anything you may want to use
+later.
+
+```sh
+==> setenv ixboot 'dhcp && source \${fileaddr}'
+==> saveenv
+```
+
+
+[^1]: To prevent NetworkManager from automatically managing the interfaces.
@@ -48,7 +48,7 @@ other traffic would be bridged as usual.
 | bridge   | infix-if-bridge            | SW implementation of an IEEE 802.1Q bridge                   |
 | ip       | ietf-ip, infix-ip          | IP address to the subordinate interface                      |
 | vlan     | infix-if-vlan              | Capture all traffic belonging to a specific 802.1Q VID       |
-| lag[^1]  | infix-if-lag               | Bond multiple interfaces into one, creating a link aggregate |
+| lag      | infix-if-lag               | Link aggregation, static and IEEE 802.3ad (LACP)             |
 | lo       | ietf-interfaces            | Software loopback interface                                  |
 | eth      | ieee802-ethernet-interface | Physical Ethernet device/port.                               |
 |          | infix-ethernet-interface   |                                                              |
@@ -430,6 +430,265 @@ admin@example:/config/interface/br0/bridge/> set ieee-group-forward lldp
 admin@example:/config/interface/br0/bridge/>
 ```

+
+### Link Aggregation
+
+A link aggregate, or *lag*, allows multiple physical interfaces to be
+combined into a single logical interface, providing increased bandwidth
+(in some cases) and redundancy (primarily).  Two modes of qualifying lag
+member ports are available:
+
+ 1. **static**: Active members selected based on link status (carrier)
+ 2. **lacp:** IEEE 802.3ad Link Aggregation Control Protocol
+
+In LACP mode, LACPDUs are exchanged by the link partners to qualify each
+lag member, while in static mode only carrier is used.  This additional
+exchange in LACP ensures traffic can be forwarded in both directions.
+
+Traffic distribution, for both modes, across the active lag member ports
+is determined by the hash policy[^1].  It uses an XOR of the source,
+destination MAC addresses and the EtherType field.  This, IEEE
+802.3ad-compliant, algorithm will place all traffic to a particular
+network peer on the same link.  Meaning there is no increased bandwidth
+for communication between two specific devices.
+
+> [!TIP]
+> Similar to other interface types, naming your interface `lagN`, where
+> `N` is a number, allows the CLI to automatically infer the interface
+> type as LAG.
+
+
+#### Basic Configuration
+
+Creating a link aggregate interface and adding member ports:
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface lag0
+admin@example:/config/interface/lag0/> set lag mode static
+admin@example:/config/interface/lag0/> end
+admin@example:/config/> set interface eth7 lag-port lag lag0
+admin@example:/config/> set interface eth8 lag-port lag lag0
+admin@example:/config/> leave
+```
+
+A static lag responds only to link (carrier) changes of member ports.
+E.g., in this example egressing traffic is continuously distributed over
+the two links until link down on one link is detected, triggering all
+traffic to be steered to the sole remaining link.
+
+
+#### LACP Configuration
+
+LACP mode provides dynamic negotiation of the link aggregate.  Key
+settings include:
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface lag0
+admin@example:/config/interface/lag0/> set lag mode lacp
+admin@example:/config/interface/lag0/> set lag lacp mode passive
+admin@example:/config/interface/lag0/> set lag lacp rate fast
+admin@example:/config/interface/lag0/> set lag lacp system-priority 100
+```
+
+LACP mode supports two operational modes:
+
+ - **active:** Initiates negotiation by sending LACPDUs (default)
+ - **passive:** Waits for peer to initiate negotiation
+
+> [!NOTE]
+> At least one end of the link must be in active mode for negotiation to occur.
+
+The LACP rate setting controls protocol timing:
+
+ - **slow:** LACPDUs sent every 30 seconds, with 90 second timeout (default)
+ - **fast:** LACPDUs sent every second, with 3 second timeout
+
+
+#### Link Flapping
+
+To protect against link flapping, debounce timers can be configured to
+delay link qualification.  Usually only the `up` delay is needed:
+
+```
+admin@example:/config/interface/lag0/lag/link-monitor/> edit debounce
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set up 500
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set down 200
+```
+
+#### Operational Status, Overview
+
+Like other interfaces, link aggregates are also available in the general
+interfaces overview in the CLI admin-exec context.  Here is the above
+static mode aggregate:
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+.
+.
+.
+lag0            lag        UP          static: balance-xor, hash: layer2
+│               ethernet   UP          00:a0:85:00:02:00
+├ eth7          lag        ACTIVE
+└ eth8          lag        ACTIVE
+```
+
+Same aggregate, but in LACP mode:
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+.
+.
+.
+lag0            lag        UP          lacp: active, rate: fast (1s), hash: layer2
+│               ethernet   UP          00:a0:85:00:02:00
+├ eth7          lag        ACTIVE      active, short_timeout, aggregating, in_sync, collecting, distributing
+└ eth8          lag        ACTIVE      active, short_timeout, aggregating, in_sync, collecting, distributing
+```
+
+
+#### Operational Status, Detail
+
+In addition to basic status shown in the interface overview, detailed
+LAG status can be inspected:
+
+```
+admin@example:/> show interfaces name lag0
+name                : lag0
+index               : 25
+mtu                 : 1500
+operational status  : up
+physical address    : 00:a0:85:00:02:00
+lag mode            : static
+lag type            : balance-xor
+lag hash            : layer2
+link debounce up    : 0 msec
+link debounce down  : 0 msec
+ipv4 addresses      :
+ipv6 addresses      :
+in-octets           : 0
+out-octets          : 2142
+```
+
+Same aggregate, but in LACP mode:
+
+```
+admin@example:/> show interfaces name lag0
+name                : lag0
+index               : 24
+mtu                 : 1500
+operational status  : up
+physical address    : 00:a0:85:00:02:00
+lag mode            : lacp
+lag hash            : layer2
+lacp mode           : active
+lacp rate           : fast (1s)
+lacp aggregate id   : 1
+lacp system priority: 65535
+lacp actor key      : 9
+lacp partner key    : 9
+lacp partner mac    : 00:a0:85:00:03:00
+link debounce up    : 0 msec
+link debounce down  : 0 msec
+ipv4 addresses      :
+ipv6 addresses      :
+in-octets           : 100892
+out-octets          : 111776
+```
+
+Member ports provide additional status information:
+
+ - Link failure counter: number of detected link failures
+ - LACP state flags: various states of LACP negotiation:
+   - `active`: port is actively sending LACPDUs
+   - `short_timeout`: using fast rate (1s) vs. slow rate (30s)
+   - `aggregating`: port is allowed to aggregate in this LAG
+   - `in_sync`: port is synchronized with partner
+   - `collecting`: port is allowed to receive traffic
+   - `distributing`: port is allowed to send traffic
+   - `defaulted`: using default partner info (partner not responding)
+   - `expired`: partner info has expired (no LACPDUs received)
+ - Aggregator ID: unique identifier for this LAG group
+ - Actor state: LACP state flags for this port (local)
+ - Partner state: LACP state flags from the remote port
+
+Example member port status:
+
+```
+admin@example:/> show interfaces name eth7
+name                : eth7
+index               : 8
+mtu                 : 1500
+operational status  : up
+physical address    : 00:a0:85:00:02:00
+lag member          : lag0
+lag member state    : active
+lacp aggregate id   : 1
+lacp actor state    : active, short_timeout, aggregating, in_sync, collecting, distributing
+lacp partner state  : active, short_timeout, aggregating, in_sync, collecting, distributing
+link failure count  : 0
+ipv4 addresses      :
+ipv6 addresses      :
+in-octets           : 473244
+out-octets          : 499037
+```
+
+
+#### Example: Switch Uplink with LACP
+
+LACP mode provides the most robust operation, automatically negotiating
+the link aggregate and detecting configuration mismatches.
+
+A common use case is connecting a switch to an upstream device:
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface lag0
+admin@example:/config/interface/lag0/> set lag mode lacp
+```
+
+Enable fast LACP for quicker fail-over:
+
+```
+admin@example:/config/interface/lag0/> set lag lacp rate fast
+```
+
+Add uplink ports
+
+```
+admin@example:/config/interface/lag0/> end
+admin@example:/config/> set interface eth7 lag-port lag lag0
+admin@example:/config/> set interface eth8 lag-port lag lag0
+```
+
+Enable protection against "link flapping".
+
+```
+admin@example:/config/interface/lag0/> edit lag link-monitor
+admin@example:/config/interface/lag0/lag/link-monitor/> edit debounce
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set up 500
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set down 200
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> top
+```
+
+Add to bridge for switching
+
+```
+admin@example:/config/interface/lag0/lag/link-monitor/debounce/> end
+admin@example:/config/> set interface lag0 bridge-port bridge br0
+admin@example:/config/> leave
+```
+
+
 ### VLAN Interfaces

 Creating a VLAN can be done in many ways.  This section assumes VLAN
@@ -800,7 +1059,7 @@ The resulting address (10.1.2.100/24) is of type *dhcp*.
 The (only) way to disable IPv6 link-local addresses is by disabling IPv6
 on the interface.

-```(disabling
+```
 admin@example:/> configure
 admin@example:/config/> edit interface eth0 ipv6
 admin@example:/config/interface/eth0/ipv6/> set enabled false
@@ -914,33 +1173,38 @@ have changed type to *random*.
 To be able to route (static or dynamic) on the interface it is
 required to enable forwarding. This setting controls if packets
 received on this interface can be forwarded.
-   ```
-   admin@example:/config/> edit interface eth0
-   admin@example:/config/interface/eth0/> set ipv4 forwarding
-   admin@example:/config/interface/eth0/> leave
-   admin@example:/>
-   ```
+
+```
+admin@example:/config/> edit interface eth0
+admin@example:/config/interface/eth0/> set ipv4 forwarding
+admin@example:/config/interface/eth0/> leave
+admin@example:/>
+```


 ### IPv6 forwarding

-This flag behaves totally different than for IPv4. For IPv6 the
-ability to route between interfaces is always enabled, instead this
-flag controls if the interface will be in host/router mode.
+Due to how the Linux kernel manages IPv6 forwarding, we can not fully
+control it per interface via this setting like how IPv4 works.  Instead,
+IPv6 forwarding is globally enabled when at least one interface enable
+forwarding, otherwise it is disabled.

-| **Feature**                              | **Forward enabled** | **Forward disabled** |
-|:-----------------------------------------|:--------------------|:---------------------|
-| IsRouter set in Neighbour Advertisements | Yes                 | No                   |
-| Transmit Router Solicitations            | No                  | Yes                  |
-| Router Advertisements are ignored        | No                  | Yes                  |
-| Accept Redirects                         | No                  | Yes                  |
+The following table shows the system IPv6 features that the `forwarding`
+setting control when it is *Enabled* or *Disabled:

-   ```
-   admin@example:/config/> edit interface eth0
-   admin@example:/config/interface/eth0/> set ipv6 forwarding
-   admin@example:/config/interface/eth0/> leave
-   admin@example:/>
-   ```
+| **IPv6 Feature**                         | **Enabled** | **Disabled** |
+|:-----------------------------------------|:------------|:-------------|
+| IsRouter set in Neighbour Advertisements | Yes         | No           |
+| Transmit Router Solicitations            | No          | Yes          |
+| Router Advertisements are ignored        | Yes         | Yes          |
+| Accept Redirects                         | No          | Yes          |
+
+```
+admin@example:/config/> edit interface eth0
+admin@example:/config/interface/eth0/> set ipv6 forwarding
+admin@example:/config/interface/eth0/> leave
+admin@example:/>
+```


 ## Routing support
@@ -1228,7 +1492,7 @@ currently supported, namely `ipv4` and `ipv6`.
 [4]: https://www.rfc-editor.org/rfc/rfc3442
 [0]: https://frrouting.org/

-[^1]: Please note, link aggregates are not yet supported.
+[^1]: `(source MAC XOR destination MAC XOR EtherType) MODULO num_links`
 [^2]: Link-local IPv6 addresses are implicitly enabled when enabling
    IPv6.  IPv6 can be enabled/disabled per interface in the
    [ietf-ip][2] YANG model.
@@ -853,14 +853,18 @@ models for details.
 ### Factory Reset

 ```
-~$ curl -kX POST -H "Content-Type: application/yang-data+json" https://example.local/restconf/operations/ietf-factory-default:factory-reset -u admin:admin
+~$ curl -kX POST -u admin:admin \
+        -H "Content-Type: application/yang-data+json" \
+		https://example.local/restconf/operations/ietf-factory-default:factory-reset
 curl: (56) OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while reading, errno 0
 ```

 ### System Reboot

 ```
-~$ curl -kX POST -H "Content-Type: application/yang-data+json" https://example.local/restconf/operations/ietf-system:system-restart -u admin:admin
+~$ curl -kX POST -u admin:admin \
+        -H "Content-Type: application/yang-data+json" \
+		https://example.local/restconf/operations/ietf-system:system-restart
 ```

 ### Set Date and Time
@@ -868,7 +872,11 @@ curl: (56) OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while r
 Here's an example of an RPC that takes input/argument:

 ```
-~$ curl -kX POST -H "Content-Type: application/yang-data+json" https://example.local/restconf/operations/ietf-system:set-current-datetime -u admin:admin -d '{"ietf-system:input": {"current-datetime": "2024-04-17T13:48:02-01:00"}}'
+~$ curl -kX POST -u admin:admin \
+	    -H "Content-Type: application/yang-data+json" \
+	    -d '{"ietf-system:input": {"current-datetime": "2024-04-17T13:48:02-01:00"}}' \
+		https://example.local/restconf/operations/ietf-system:set-current-datetime
+
 ```

 You can verify that the changes took by a remote SSH command:
@@ -879,6 +887,51 @@ Wed Apr 17 14:48:12 UTC 2024
 ~$
 ```

+### Read Hostname
+
+Example of fetching JSON configuration data to stdout:
+
+```
+~$ curl -kX GET -u admin:admin \
+        -H 'Accept: application/yang-data+json' \
+		https://example.local/restconf/data/ietf-system:system/hostname
+{
+  "ietf-system:system": {
+    "hostname": "foo"
+  }
+}
+```
+
+### Set Hostname
+
+Example of inline JSON data:
+
+```
+~$ curl -kX PATCH -u admin:admin \
+     -H 'Content-Type: application/yang-data+json' \
+     -d '{"ietf-system:system":{"hostname":"bar"}}' \
+     https://example.local/restconf/data/ietf-system:system
+```
+
+### Copy Running to Startup
+
+No copy command available yet to copy between datastores, and the
+Rousette back-end also does not support "write-through" to the
+startup datastore.
+
+To save running-config to startup-config, use the following example to
+fetch running to a local file and then update startup with it:
+
+```
+~$ curl -kX GET -u admin:admin -o running-config.json \
+        -H 'Accept: application/yang-data+json'       \
+         https://example.local/restconf/ds/ietf-datastores:running
+
+~$ curl -kX PUT -u admin:admin -d @running-config.json \
+        -H 'Content-Type: application/yang-data+json'  \
+        https://example.local/restconf/ds/ietf-datastores:startup
+```
+

 ## Miscellaneous

@@ -243,23 +243,15 @@ spanning tree matches the expected one.

 Integration to Infix
 --------------------
-To successfully run all Infix tests, the image must be built in 
-'test-mode'. This can be achieved by setting the DISK_IMAGE_TEST_MODE
-parameter to true. Although this is the default setting, it’s advisable
-to verify it by running:
+When the test environment is started with Qeneth, it doesn't use the 
+base image directly. Instead, it creates a copy and inserts a `test-mode`
+flag into it. During the bootstrap phase, the system checks for the 
+presence of the test-mode flag (file).

-    $ make menuconfig
-    (External Options --> -*- Disk image --> [*] Enable Test Mode)
-
-Building an image in 'test-mode' results in the creation of a 'test-mode'
-file within the auxiliary (aux) partition of the Infix disk image 
-(/mnt/aux/test-mode).
-
-During the bootstrap phase, the system checks for the presence of this 
-test-mode flag (file). If the flag exists, a 'test-config.cfg' file is 
-generated. In the following step, the system loads the 'test-config' 
-instead of the standard startup-config (or factory-config). This 
-configuration is simple and safe, equivalent to the one used in 'Secure Mode'
+If the flag exists, a 'test-config.cfg' file is generated. In the 
+following step, the system loads the 'test-config' instead of the
+standard `startup-config` (or `factory-config`). This configuration
+is simple and safe, equivalent to the one used in 'Secure Mode' 
 (also known as 'failure-config').

 Additionally, the configuration enables extra RPCs related to system 
@@ -25,17 +25,6 @@ for `x86_64`:
    $ make
    $ make test

-It is important to mention that Infix build system by default creates
-an image in 'test-mode'. The mode is set by DISK_IMAGE_TEST_MODE
-parameter (default=true). To generate a standard image set the
-DISK_IMAGE_TEST_MODE to 'false'. However, only the test mode ensures
-that all Infix tests are executed properly. Prior to the set of commands
-above, it is always good to check that DISK_IMAGE_TEST_MODE is properly
-set by running:
-
-    $ make menuconfig
-    (External Options --> -*- Disk image --> [*] Enable Test Mode)
-
 ### Physical Devices

 To run the tests on a preexisting topology from the host's network
@@ -99,8 +88,11 @@ arguments:
 To run a suite of tests, e.g., only the DHCP client tests, pass the
 suite as an argument to [9PM][]:

-    11:42:53 infamy0:test # ./9pm/9pm.py case/infix_dhcp/all.yaml
+    11:42:53 infamy0:test # ./9pm/9pm.py case/infix_dhcp/infix_dhcp.yaml

+To run the suite of all tests:
+
+    11:42:53 infamy0:test # ./9pm/9pm.py case/all.yaml

 ### Connecting to Infamy

@@ -315,5 +307,52 @@ The test specifaction can be genererated with:

 	$ make test-spec

+### Test Development
+
+For adding a new test to the automated regression test suite, it's best
+to start by reviewing an existing test case.
+
+All tests are located in the `infix/test/case` repository and are 
+grouped by the features they verify. For example, 
+`infix/test/case/infix_services` contains tests for various Infix 
+services, such as LLDP and mDNS.
+
+While test grouping is flexible, each test should be placed in a 
+logically relevant category.
+
+When creating a new test group, add it to `infix/test/case/all.yaml`,
+to enable it to run as a 
+[subset of the test suite](#running-subsets-of-tests):
+
+```
+- name:  infix-services
+  suite: infix_services/infix_services.yaml
+```
+
+A new test (e.g., lldp_enable_disable) should be added to the 
+corresponding test group .yaml file, such as 
+`infix/test/cases/infix_services.yaml`:
+
+```
+- name: lldp_enable_disable
+  case: lldp_enable_disable/test.py
+```
+
+It is necessary to include the test in 
+`infix/test/case/infix_services/Readme.adoc` to ensure proper test 
+specification generation:
+
+```
+include::lldp_enable_disable/Readme.adoc[]
+```
+
+Each test case should have its own directory under, 
+`infix/test/case/infix_services`, containing: 
+  - `test.py` - the test script
+  - `topology.dot` - the logical topology definition.
+
+When the [test specification](#test-specification) is generated, 
+`topology.svg` and `Readme.adoc` should also be created. 
+
 [9PM]:    https://github.com/rical/9pm
 [Qeneth]: https://github.com/wkz/qeneth
@@ -34,6 +34,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/python-libyang/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/python-statd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/python-yangdoc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/skeleton-init-finit/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/show/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/tetris/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/libyang-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-cpp/Config.in"
@@ -1,6 +1,7 @@
 menu "Boards"

 source "$BR2_EXTERNAL_INFIX_PATH/package/board/alder-alder/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/board/freescale-imx8mp-evk/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/marvell-cn9130-crb/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/marvell-espressobin/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/microchip-sparx5-pcb135/Config.in"
@@ -0,0 +1,6 @@
+config BR2_PACKAGE_FREESCALE_IMX8MP_EVK
+	bool "NXP i.MX8MP EVK"
+	depends on BR2_aarch64
+	help
+	  NXP i.MX8MP EVK
+
@@ -0,0 +1,26 @@
+define FREESCALE_IMX8MP_EVK_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_NXP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MXC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FEC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DWMAC_IMX8)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_IMX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_IMX_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_I2C_IMX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SPI_IMX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_IMX8MP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_MXC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_IMX2_WDT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_OF_ESDHC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_ESDHC_IMX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_IMX8MP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NVMEM_IMX_OCOTP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INTERCONNECT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INTERCONNECT_IMX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INTERCONNECT_IMX8MP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))
@@ -1,3 +1,9 @@
+################################################################################
+#
+# confd-test-mode
+#
+################################################################################
+
 CONFD_TEST_MODE_VERSION = 1.0
 CONFD_TEST_MODE_SITE_METHOD = local
 CONFD_TEST_MODE_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/test-mode
@@ -16,7 +22,8 @@ COMMON_SYSREPO_ENV = \

 define CONFD_TEST_MODE_INSTALL_YANG_MODULES
        $(COMMON_SYSREPO_ENV) \
-        SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/test-mode/" $(BR2_EXTERNAL_INFIX_PATH)/utils/sysrepo-load-modules.sh $(@D)/yang/test-mode.inc
+        SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/test-mode/" \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/test-mode.inc
 endef
 define CONFD_TEST_MODE_PERMISSIONS
 	/etc/sysrepo/data/ r 660 root wheel - - - - -
@@ -17,17 +17,15 @@ run name:startup log:prio:user.notice norestart <pid/confd> env:/etc/default/con
 	-- Loading startup-config

 # Run if loading startup-config fails for some reason
-run name:failure log:prio:user.critical norestart <pid/confd> env:/etc/default/confd if:<run/startup/failure> \
-	[S] /usr/libexec/confd/load -t $CONFD_TIMEOUT failure-config \
+run	name:failure log:prio:user.crit norestart env:/etc/default/confd \
+	if:<run/startup/failure> \
+	[S] <pid/confd> /usr/libexec/confd/load -t $CONFD_TIMEOUT failure-config \
 	-- Loading failure-config

-run name:error :2 log:console norestart if:<run/failure/failure> \
+run	name:error :2 log:console norestart \
+	if:<run/failure/failure> \
 	[S] /usr/libexec/confd/error --

-service name:netopeer notify:none log <pid/confd> env:/etc/default/confd \
-	[12345] netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
+service name:netopeer notify:none log env:/etc/default/confd \
+	[12345] <pid/confd> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
 	-- NETCONF server
-
-# Create initial /etc/resolv.conf after successful bootstrap
-task name:resolv :conf norestart <pid/dnsmasq> if:<run/startup/success> \
-	[S] resolvconf -u -- Update DNS configuration
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CONFD_VERSION = 1.4
+CONFD_VERSION = 1.5
 CONFD_SITE_METHOD = local
 CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
 CONFD_LICENSE = BSD-3-Clause
@@ -26,46 +26,66 @@ CONFD_CONF_OPTS += --disable-containers
 endif

 define CONFD_INSTALL_EXTRA
-	cp $(CONFD_PKGDIR)/confd.conf  $(FINIT_D)/available/
-	ln -sf ../available/confd.conf $(FINIT_D)/enabled/confd.conf
+	for fn in confd.conf resolvconf.conf; do \
+		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
+		ln -sf ../available/$$fn $(FINIT_D)/enabled/$$fn; \
+	done
 	cp $(CONFD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/etc/tmpfiles.d/confd.conf
 	mkdir -p $(TARGET_DIR)/etc/avahi/services
 	cp $(CONFD_PKGDIR)/avahi.service $(TARGET_DIR)/etc/avahi/services/netconf.service
 endef

+NETOPEER2_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/netopeer2/
+SYSREPO_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/sysrepo/
+LIBNETCONF2_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/libnetconf2/
+CONFD_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/confd/
+TEST_MODE_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/test-mode/
+ROUSETTE_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/rousette/
 COMMON_SYSREPO_ENV = \
 	SYSREPO_SHM_PREFIX=$(CONFD_SYSREPO_SHM_PREFIX) \
 	SYSREPOCTL_EXECUTABLE="$(HOST_DIR)/bin/sysrepoctl" \
 	SYSREPOCFG_EXECUTABLE="$(HOST_DIR)/bin/sysrepocfg" \
-	SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/confd/"
+	SEARCH_PATH="$(NETOPEER2_SEARCHPATH) $(SYSREPO_SEARCHPATH) $(LIBNETCONF2_SEARCHPATH) $(TEST_MODE_SEARCHPATH) $(CONFD_SEARCHPATH) $(ROUSETTE_SEARCHPATH)"
+

 define CONFD_INSTALL_YANG_MODULES
 	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/sysrepo-load-modules.sh $(@D)/yang/confd.inc
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/sysrepo.inc
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/libnetconf2.inc
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/netopeer2.inc
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/rousette.inc
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/test-mode.inc
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/confd.inc
 endef

 ifeq ($(BR2_PACKAGE_PODMAN),y)
 define CONFD_INSTALL_YANG_MODULES_CONTAINERS
 	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/sysrepo-load-modules.sh $(@D)/yang/containers.inc
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/containers.inc
 endef
 endif

 define CONFD_PERMISSIONS
-	/etc/sysrepo/data/ r 660 root wheel - - - - -
-	/etc/sysrepo/data  d 770 root wheel - - - - -
+	/etc/sysrepo/data/ r 660 root sys-cli - - - - -
+	/etc/sysrepo/data  d 770 root sys-cli - - - - -
 endef

+define CONFD_EMPTY_SYSREPO
+	rm -rf $(TARGET_DIR)/etc/sysrepo/data/
+endef
 define CONFD_CLEANUP
 	rm -f /dev/shm/$(CONFD_SYSREPO_SHM_PREFIX)*
 endef
-
+CONFD_PRE_INSTALL_TARGET_HOOKS += CONFD_EMPTY_SYSREPO
 CONFD_PRE_INSTALL_TARGET_HOOKS += CONFD_CLEANUP
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_EXTRA
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
-ifeq ($(BR2_PACKAGE_PODMAN),y)
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
-endif
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_CLEANUP

 $(eval $(autotools-package))
@@ -0,0 +1,3 @@
+# Create initial /etc/resolv.conf after successful bootstrap, regardless
+# of startup-config or failure-config.  Condition set by confd.
+task [S12345] <usr/bootstrap> resolvconf -u -- Update DNS configuration
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  f8725f39b9d9d45c8ad6fd2cfc3c1c834a80c32b4217a3d07dd8ed7fe4b6e352  faux-df1d569287bc45d8fd880287c00e3874c5627c19-br1.tar.gz
+sha256  b385d30b88cab31bf910436ceb1262947bf34a19ca85098c28510e639dc4b37d  faux-df1d569287bc45d8fd880287c00e3874c5627c19-git4.tar.gz
@@ -1,67 +0,0 @@
-From 46ffa81f5c88ce95db011369d8bfb802313e4217 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Thu, 17 Oct 2024 14:23:24 +0200
-Subject: [PATCH 1/7] Only mark rdeps dirty if main service is nohup
-Organization: Addiva Elektronik
-
-This patch changes a behavior that's been default since Finit 4.0,
-introduced in 4d05bf9 with 4.0-rc2.
-
-If service B depends on A and A needs to be reloaded, then B may be
-affected.  If A is declared as NOHUP <!>, then A will be stopped and
-restarted, during which time the condition it provides is removed,
-and B will also be stopped.
-
-However, and as of this patch, if A is declared supporting HUP, then the
-condition A provides will only go into flux, during which time B will be
-SIGSTOPed instead of needing to be reloaded.
-
-Fix #415
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- src/service.c | 8 ++++++++
- src/svc.h     | 1 +
- 2 files changed, 9 insertions(+)
-
-diff --git a/src/service.c b/src/service.c
-index 61be85c..b995ff4 100644
--- a/src/service.c
-+++ b/src/service.c
-@@ -2001,6 +2001,10 @@ static void svc_mark_affected(char *cond)
-  * Called on conf_reload() to update service reverse dependencies.
-  * E.g., if ospfd depends on zebra and the zebra Finit conf has
-  * changed, we need to mark the ospfd Finit conf as changed too.
-+ *
-+ * However, a daemon that depends on syslogd (sysklogd project), need
-+ * not be reloeaded (SIGHUP'ed or stop/started) because syslogd support
-+ * reloading its configuration file on SIGHUP.
-  */
- void service_update_rdeps(void)
- {
-@@ -2012,6 +2016,10 @@ void service_update_rdeps(void)
- 		if (!svc_is_changed(svc))
- 			continue;
- 
-+		/* Service supports reloading conf without stop/start  */
-+		if (!svc_is_nohup(svc))
-+			continue; /* Yup, no need to stop start rdeps */
-+
- 		svc_mark_affected(mkcond(svc, cond, sizeof(cond)));
- 	}
- }
-diff --git a/src/svc.h b/src/svc.h
-index d00ac14..e2f6bd8 100644
--- a/src/svc.h
-+++ b/src/svc.h
-@@ -259,6 +259,7 @@ static inline int svc_is_tty       (svc_t *svc) { return svc && SVC_TYPE_TTY
- static inline int svc_is_runtask   (svc_t *svc) { return svc && (SVC_TYPE_RUNTASK & svc->type);}
- static inline int svc_is_forking   (svc_t *svc) { return svc && svc->forking; }
- static inline int svc_is_manual    (svc_t *svc) { return svc && svc->manual; }
-+static inline int svc_is_nohup     (svc_t *svc) { return svc && (0 == svc->sighup); }
- 
- static inline int svc_in_runlevel  (svc_t *svc, int runlevel) { return svc && ISSET(svc->runlevels, runlevel); }
- static inline int svc_nohup        (svc_t *svc) { return svc &&  (0 == svc->sighup || 0 != svc->args_dirty); }
-- 
-2.43.0
-
@@ -1,33 +0,0 @@
-From 119e66a7e9c95283918639b51dd03a3d666955f8 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Mon, 28 Oct 2024 10:58:04 +0100
-Subject: [PATCH 2/7] Reset color attributes and clear screen when starting up
-Organization: Addiva Elektronik
-
-Some boot loaders, like GRUB, leave background color artifacts from
-their boot menu.  This patch resets the foreground and background
-color attributes, and then clears the screen, without clearing the
-scrollback buffer.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- src/helpers.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/src/helpers.c b/src/helpers.c
-index 8768de8..99c4557 100644
--- a/src/helpers.c
-+++ b/src/helpers.c
-@@ -87,6 +87,9 @@ void console_init(void)
- 	/* Enable line wrap, if disabled previously, e.g., qemu */
- 	dprint(STDOUT_FILENO, "\033[?7h", 5);
- 
-+	/* Reset atttributes, background and foreground color  */
-+	dprint(STDOUT_FILENO, "\033[49m\033[39m\e[2J", 14);
-+
- 	log_init();
- }
- 
-- 
-2.43.0
-
@@ -1,196 +0,0 @@
-From 0c0e880f3fdd38f7bbde618408378dc0a19ff005 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Sun, 3 Nov 2024 09:39:46 +0100
-Subject: [PATCH 3/7] plugins: refactor rtc.so
-Organization: Addiva Elektronik
-
-Factor out time_set() and time_get() for readability and reuse.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- plugins/rtc.c | 116 +++++++++++++++++++++++++++++---------------------
- 1 file changed, 68 insertions(+), 48 deletions(-)
-
-diff --git a/plugins/rtc.c b/plugins/rtc.c
-index 238791f..9520c7d 100644
--- a/plugins/rtc.c
-+++ b/plugins/rtc.c
-@@ -68,6 +68,60 @@ static void tz_restore(char *tz)
- 	tzset();
- }
- 
-+static int time_set(struct tm *tm)
-+{
-+	struct tm fallback = { 0 };
-+	struct timeval tv = { 0 };
-+	char tz[128];
-+	int rc = 0;
-+
-+	tz_set(tz, sizeof(tz));
-+
-+	if (!tm) {
-+		logit(LOG_NOTICE, "Resetting system clock to kernel default, %s.", rtc_timestamp);
-+		tm = &fallback;
-+
-+		/* Attempt to set RTC to a sane value ... */
-+		tv.tv_sec = rtc_date_fallback;
-+		if (!gmtime_r(&tv.tv_sec, tm)) {
-+			rc = 1;
-+			goto out;
-+		}
-+	}
-+
-+	tm->tm_isdst = -1; /* Use tzdata to figure it out, please. */
-+	tv.tv_sec = mktime(tm);
-+	if (tv.tv_sec == (time_t)-1 || tv.tv_sec < rtc_date_fallback) {
-+		errno = EINVAL;
-+		rc = 2;
-+	} else {
-+		if (settimeofday(&tv, NULL) == -1)
-+			rc = 1;
-+	}
-+out:
-+	tz_restore(tz);
-+	return rc;
-+}
-+
-+static int time_get(struct tm *tm)
-+{
-+	struct timeval tv = { 0 };
-+	char tz[128];
-+	int rc = 0;
-+
-+	tz_set(tz, sizeof(tz));
-+
-+	rc = gettimeofday(&tv, NULL);
-+	if (rc < 0 || tv.tv_sec < rtc_date_fallback)
-+		rc = 2;
-+	else
-+		gmtime_r(&tv.tv_sec, tm);
-+
-+	tz_restore(tz);
-+
-+	return rc;
-+}
-+
- static int rtc_open(void)
- {
- 	char *alt[] = {
-@@ -91,10 +145,8 @@ static int rtc_open(void)
- 
- static void rtc_save(void *arg)
- {
-	struct timeval tv = { 0 };
- 	struct tm tm = { 0 };
- 	int fd, rc = 0;
-	char tz[128];
- 
- 	if (rescue) {
- 		dbg("Skipping %s plugin in rescue mode.", __FILE__);
-@@ -105,38 +157,26 @@ static void rtc_save(void *arg)
- 	if (fd < 0)
- 		return;
- 
-	tz_set(tz, sizeof(tz));
-	rc = gettimeofday(&tv, NULL);
-	if (rc < 0 || tv.tv_sec < rtc_date_fallback) {
-+	if ((rc = time_get(&tm))) {
- 		print_desc(NULL, "System clock invalid, not saving to RTC");
-	invalid:
-		logit(LOG_ERR, "System clock invalid, before %s, not saving to RTC", rtc_timestamp);
-		rc = 2;
-		goto out;
-+	} else {
-+		print_desc(NULL, "Saving system clock (UTC) to RTC");
-+		rc = ioctl(fd, RTC_SET_TIME, &tm);
- 	}
- 
-	print_desc(NULL, "Saving system time (UTC) to RTC");
-
-	gmtime_r(&tv.tv_sec, &tm);
-	if (ioctl(fd, RTC_SET_TIME, &tm) < 0) {
-		if (EINVAL == errno)
-			goto invalid;
-		rc = 1;
-		goto out;
-+	if (rc && errno == EINVAL) {
-+		logit(LOG_ERR, "System clock invalid, before %s, not saving to RTC", rtc_timestamp);
-+		rc = 2;
- 	}
- 
-out:
-	tz_restore(tz);
- 	print(rc, NULL);
- 	close(fd);
- }
- 
- static void rtc_restore(void *arg)
- {
-	struct timeval tv = { 0 };
- 	struct tm tm = { 0 };
- 	int fd, rc = 0;
-	char tz[128];
- 
- 	if (rescue) {
- 		dbg("Skipping %s plugin in rescue mode.", __FILE__);
-@@ -149,16 +189,19 @@ static void rtc_restore(void *arg)
- 		return;
- 	}
- 
-	tz_set(tz, sizeof(tz));
-	if (ioctl(fd, RTC_RD_TIME, &tm) < 0) {
-+	if ((rc = ioctl(fd, RTC_RD_TIME, &tm)) < 0) {
- 		char msg[120];
- 
- 		snprintf(msg, sizeof(msg), "Failed restoring system clock, %s",
- 			 EINVAL == errno ? "RTC time is too old"   :
- 			 ENOENT == errno ? "RTC has no saved time" : "see log for details");
- 		print_desc(NULL, msg);
-+	} else {
-+		print_desc(NULL, "Restoring system clock (UTC) from RTC");
-+		rc = time_set(&tm);
-+	}
- 
-	invalid:
-+	if (rc) {
- 		logit(LOG_ERR, "Failed restoring system clock from RTC.");
- 		if (EINVAL == errno)
- 			logit(LOG_ERR, "RTC time is too old (before %s)", rtc_timestamp);
-@@ -167,33 +210,10 @@ static void rtc_restore(void *arg)
- 		else
- 			logit(LOG_ERR, "RTC error code %d: %s", errno, strerror(errno));
- 
-		/* Been here already? */
-		if (rc)
-			goto out;
-
-		/* Attempt to set RTC to a sane value ... */
-		tv.tv_sec = rtc_date_fallback;
-		if (!gmtime_r(&tv.tv_sec, &tm))
-			goto out;
-
-		logit(LOG_NOTICE, "Resetting RTC to kernel default, %s.", rtc_timestamp);
-+		time_set(NULL);
- 		rc = 2;
- 	}
- 
-	if (!rc)
-		print_desc(NULL, "Restoring system clock (UTC) from RTC");
-	tm.tm_isdst = -1; /* Use tzdata to figure it out, please. */
-	tv.tv_sec = mktime(&tm);
-	if (tv.tv_sec == (time_t)-1 || tv.tv_sec < rtc_date_fallback) {
-		errno = EINVAL;
-		goto invalid;
-	}
-
-	if (settimeofday(&tv, NULL) == -1)
-		rc = 1;
-
-out:
-	tz_restore(tz);
- 	print(rc, NULL);
- 	close(fd);
- }
-- 
-2.43.0
-
@@ -1,239 +0,0 @@
-From bc8118d515839dc598f437aa01f07a771646968d Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Sun, 3 Nov 2024 09:47:16 +0100
-Subject: [PATCH 4/7] Fix #418: support systems with a broken RTC
-Organization: Addiva Elektronik
-
-This patch introduces a new configure option --with-rtc-file=FILE.  When
-enabled the RTC plugin detects missing RTC device and falls back to save
-and restore system time from a file instead.  When --with-rtc-file is
-used without an argument the default file is /var/lib/misc/rtc, but the
-feature itself is disabled by default.
-
-The usefulness of this feature may not be obvious at first, but some
-systems are equipped with an RTC that resets to a random date at power
-on.  This can be really bad in the case the date is far in the future,
-because an NTP sync would then cause time skips backwards, which shows
-up in logs and causes a whole lot of pain in alarm systems.
-
-The solution is to disable the RTC driver or device tree node, and when
-Finit starts up, the RTC plugin detects a the device node and instead
-restores time from the last save game.  Meaning time will always only
-move forwards.
-
-NOTE: when Finit is built --with-rtc-file we always save to disk, but
-      only restore from the "save game" if restoring from RTC fails.
-      If the system has no RTC we always restore from disk.
-
-      As an added bonus, this change also makes sure to periodically
-      sync also the RTC with the system clock.  Useful for systems
-      that do not run an NTP client.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- configure.ac  |  12 ++++++
- plugins/rtc.c | 105 ++++++++++++++++++++++++++++++++++++++++++++++----
- 2 files changed, 110 insertions(+), 7 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 483457f..ae7cd23 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -180,6 +180,10 @@ AC_ARG_WITH(rtc-date,
- 	AS_HELP_STRING([--with-rtc-date=DATE], [If RTC date/time is too old, restore to DATE, format "YYYY-MM-DD HH:MM", default "2000-01-01 00:00"]),
- 	[rtc_date=$withval], [rtc_date=no])
- 
-+AC_ARG_WITH(rtc-file,
-+        AS_HELP_STRING([--with-rtc-file=FILE], [If RTC is missing, save and restore system clock from this file, default: no]),
-+	[rtc_file=$withval], [rtc_file=no])
-+
- ### Enable features ###########################################################################
- 
- # Create config.h from selected features and fallback defaults
-@@ -281,6 +285,13 @@ AS_IF([test "x$rtc_date" != "xno"], [
- 	AC_DEFINE(RTC_TIMESTAMP_CUSTOM, "$rtc_date", [Custom RTC restore date, default: 2000-01-01 00:00])], [
- 	rtc_date=""])
- 
-+AS_IF([test "x$rtc_file" != "xno"], [
-+	AS_IF([test "x$rtc_file" = "xyes"], [
-+		rtc_file=/var/lib/misc/rtc])
-+	AC_EXPAND_DIR(rtcfile_path, "$rtc_file")
-+	AC_DEFINE_UNQUOTED(RTC_FILE, "$rtcfile_path", [Save and restore system time from this file if /dev/rtc is missing.])],[
-+	AC_DEFINE_UNQUOTED(RTC_FILE, NULL)])
-+
- AS_IF([test "x$with_keventd" != "xno"], [with_keventd=yes])
- 
- AS_IF([test "x$with_sulogin" != "xno"], [
-@@ -387,6 +398,7 @@ Behavior:
-   Boot heading..........: $heading
-   Plugins...............: $plugins
-   RTC restore date......: $RTC_DATE
-+  RTC fallback file.....: $rtc_file
- 
- Optional features:
-   Install doc/..........: $enable_doc
-diff --git a/plugins/rtc.c b/plugins/rtc.c
-index 9520c7d..9b4eeae 100644
--- a/plugins/rtc.c
-+++ b/plugins/rtc.c
-@@ -36,8 +36,15 @@
- #include "helpers.h"
- #include "plugin.h"
- 
-/* Kernel RTC driver validates against this date for sanity check */
-+/*
-+ * Kernel RTC driver validates against this date for sanity check.  The
-+ * on NTP sync the driver can also update the RTC every 11 mins.  We use
-+ * the same update interval to handle manual time set and file save.
-+ */
- #define RTC_TIMESTAMP_BEGIN_2000 "2000-01-01 00:00:00"
-+#define RTC_FMT                  "%Y-%m-%d %H:%M:%S"
-+#define RTC_PERIOD               (11 * 60 * 1000)
-+
- #ifdef  RTC_TIMESTAMP_CUSTOM
- static char  *rtc_timestamp     = RTC_TIMESTAMP_CUSTOM;
- #else
-@@ -45,6 +52,10 @@ static char  *rtc_timestamp     = RTC_TIMESTAMP_BEGIN_2000;
- #endif
- static time_t rtc_date_fallback = 946684800LL;
- 
-+static char  *rtc_file          = RTC_FILE;
-+static uev_t  rtc_timer;
-+
-+
- static void tz_set(char *tz, size_t len)
- {
- 	char *ptr;
-@@ -122,6 +133,68 @@ static int time_get(struct tm *tm)
- 	return rc;
- }
- 
-+static void file_save(void *arg)
-+{
-+	struct tm tm = { 0 };
-+	int rc = 0;
-+	FILE *fp;
-+
-+	fp = fopen(rtc_file, "w");
-+	if (!fp) {
-+		logit(LOG_WARNING, "Failed saving system clock to %s, code %d: %s",
-+		      rtc_file, errno, strerror(errno));
-+		return;
-+	}
-+
-+	if ((rc = time_get(&tm))) {
-+		logit(LOG_ERR, "System clock invalid, before %s, not saving", rtc_timestamp);
-+		print_desc(NULL, "System clock invalid, skipping");
-+	} else {
-+		char buf[32] = { 0 };
-+
-+		print_desc(NULL, "Saving system clock to file");
-+		strftime(buf, sizeof(buf), RTC_FMT, &tm);
-+		fprintf(fp, "%s\n", buf);
-+	}
-+
-+	print(rc, NULL);
-+	fclose(fp);
-+}
-+
-+static void file_restore(void *arg)
-+{
-+	struct tm tm = { 0 };
-+	int rc = 1;
-+	FILE *fp;
-+
-+	if (!rtc_file) {
-+		logit(LOG_NOTICE, "System has no RTC (missing driver?), skipping restore.");
-+		return;
-+	}
-+
-+	print_desc(NULL, "Restoring system clock from backup");
-+
-+	fp = fopen(rtc_file, "r");
-+	if (fp) {
-+		char buf[32];
-+
-+		if (fgets(buf, sizeof(buf), fp)) {
-+			chomp(buf);
-+			strptime(buf, RTC_FMT, &tm);
-+			rc = time_set(&tm);
-+		}
-+		fclose(fp);
-+	} else
-+		logit(LOG_WARNING, "Missing %s", rtc_file);
-+
-+	if (rc) {
-+		time_set(NULL);
-+		rc = 2;
-+	}
-+
-+	print(rc, NULL);
-+}
-+
- static int rtc_open(void)
- {
- 	char *alt[] = {
-@@ -185,7 +258,7 @@ static void rtc_restore(void *arg)
- 
- 	fd = rtc_open();
- 	if (fd < 0) {
-		logit(LOG_NOTICE, "System has no RTC (missing driver?), skipping restore.");
-+		file_restore(arg);
- 		return;
- 	}
- 
-@@ -210,21 +283,37 @@ static void rtc_restore(void *arg)
- 		else
- 			logit(LOG_ERR, "RTC error code %d: %s", errno, strerror(errno));
- 
-		time_set(NULL);
-		rc = 2;
-	}
-+		print(2, NULL);
-+
-+		/* Try restoring from last save game */
-+		if (rtc_file)
-+			file_restore(arg);
-+	} else
-+		print(0, NULL);
- 
-	print(rc, NULL);
- 	close(fd);
- }
- 
-+
-+static void save(void *arg)
-+{
-+	rtc_save(arg);
-+	file_save(arg);
-+}
-+
-+static void update(uev_t *w, void *arg, int events)
-+{
-+	save(arg);
-+}
-+
-+
- static plugin_t plugin = {
- 	.name = __FILE__,
- 	.hook[HOOK_BASEFS_UP] = {
- 		.cb  = rtc_restore
- 	},
- 	.hook[HOOK_SHUTDOWN] = {
-		.cb  = rtc_save
-+		.cb  = save
- 	}
- };
- 
-@@ -237,6 +326,8 @@ PLUGIN_INIT(plugin_init)
- 	else
- 		rtc_timestamp = RTC_TIMESTAMP_BEGIN_2000;
- 
-+	uev_timer_init(ctx, &rtc_timer, update, NULL, RTC_PERIOD, RTC_PERIOD);
-+
- 	plugin_register(&plugin);
- }
- 
-- 
-2.43.0
-
@@ -1,73 +0,0 @@
-From 6be16f2f6d093ef495d0fe4313f7b05b4ba3e08f Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Sun, 3 Nov 2024 10:38:38 +0100
-Subject: [PATCH 5/7] Fix buggy --with-rtc-date=DATE, introduced in Finit v4.4
-Organization: Addiva Elektronik
-
-In 42ef3d3c, for v4.4-rc1, support for setting a custom RTC restore date
-was introduced.  Unfortunately the configure script was wrong and caused
-config.h to contain
-
-    #define RTC_TIMESTAMP_CUSTOM "$rtc_date"
-
-instead of
-
-    #define RTC_TIMESTAMP_CUSTOM "2023-04-10 14:35:42"
-
-Furthermore, the error handling for strptime() was wrong, so the restore
-date was always reverted to the default.
-
-This patch fixes both issues and extends the DATE of --with-rtc-date to
-also include seconds.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- configure.ac  | 4 ++--
- plugins/rtc.c | 8 +++++---
- 2 files changed, 7 insertions(+), 5 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index ae7cd23..58b78ac 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -177,7 +177,7 @@ AC_ARG_WITH(plugin-path,
- 	[plugin_path=$withval], [plugin_path=yes])
- 
- AC_ARG_WITH(rtc-date,
-	AS_HELP_STRING([--with-rtc-date=DATE], [If RTC date/time is too old, restore to DATE, format "YYYY-MM-DD HH:MM", default "2000-01-01 00:00"]),
-+	AS_HELP_STRING([--with-rtc-date=DATE], [If RTC date/time is too old, restore to DATE, format "YYYY-MM-DD HH:MM:SS", default "2000-01-01 00:00:00"]),
- 	[rtc_date=$withval], [rtc_date=no])
- 
- AC_ARG_WITH(rtc-file,
-@@ -282,7 +282,7 @@ AS_IF([test "x$with_random_seed" != "xno"], [
- 	AC_DEFINE_UNQUOTED(RANDOMSEED, "$random_path", [Improve random at boot by seeding it with sth from before.])])
- 
- AS_IF([test "x$rtc_date" != "xno"], [
-	AC_DEFINE(RTC_TIMESTAMP_CUSTOM, "$rtc_date", [Custom RTC restore date, default: 2000-01-01 00:00])], [
-+	AC_DEFINE_UNQUOTED(RTC_TIMESTAMP_CUSTOM, "$rtc_date", [Custom RTC restore date, default: 2000-01-01 00:00])], [
- 	rtc_date=""])
- 
- AS_IF([test "x$rtc_file" != "xno"], [
-diff --git a/plugins/rtc.c b/plugins/rtc.c
-index 9b4eeae..a733f75 100644
--- a/plugins/rtc.c
-+++ b/plugins/rtc.c
-@@ -321,10 +321,12 @@ PLUGIN_INIT(plugin_init)
- {
- 	struct tm tm = { 0 };
- 
-	if (!strptime(rtc_timestamp, "%Y-%m-%d %H:%M", &tm))
-		rtc_date_fallback = mktime(&tm);
-	else
-+	if (!strptime(rtc_timestamp, RTC_FMT, &tm)) {
-+		logit(LOG_ERR, "Invalid restore date '%s', reverting to '%s'",
-+		      rtc_timestamp, RTC_TIMESTAMP_BEGIN_2000);
- 		rtc_timestamp = RTC_TIMESTAMP_BEGIN_2000;
-+	} else
-+		rtc_date_fallback = mktime(&tm);
- 
- 	uev_timer_init(ctx, &rtc_timer, update, NULL, RTC_PERIOD, RTC_PERIOD);
- 
-- 
-2.43.0
-
@@ -1,85 +0,0 @@
-From 49c0557cedd8d3c1a2f74d27fa7db83dd529914a Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Sun, 3 Nov 2024 20:49:04 +0100
-Subject: [PATCH 6/7] plugins: reduce log level LOG_ERR -> LOG_WARNING
-Organization: Addiva Elektronik
-
-These plugins signal success and failure directly to the console, the
-user should inspect syslog for more information.
-
-This change is a follow-up to 340cae4, where kernel logs of LOG_ERR and
-higher are allowed to log directly to the console.  Since syslogd has
-not been started before these plugins, the log messages would otherwise
-leak to the console.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- plugins/rtc.c     | 14 +++++++-------
- plugins/urandom.c |  2 +-
- 2 files changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/plugins/rtc.c b/plugins/rtc.c
-index a733f75..96203a0 100644
--- a/plugins/rtc.c
-+++ b/plugins/rtc.c
-@@ -147,7 +147,7 @@ static void file_save(void *arg)
- 	}
- 
- 	if ((rc = time_get(&tm))) {
-		logit(LOG_ERR, "System clock invalid, before %s, not saving", rtc_timestamp);
-+		logit(LOG_WARNING, "System clock invalid, before %s, not saving", rtc_timestamp);
- 		print_desc(NULL, "System clock invalid, skipping");
- 	} else {
- 		char buf[32] = { 0 };
-@@ -238,7 +238,7 @@ static void rtc_save(void *arg)
- 	}
- 
- 	if (rc && errno == EINVAL) {
-		logit(LOG_ERR, "System clock invalid, before %s, not saving to RTC", rtc_timestamp);
-+		logit(LOG_WARNING, "System clock invalid, before %s, not saving to RTC", rtc_timestamp);
- 		rc = 2;
- 	}
- 
-@@ -275,13 +275,13 @@ static void rtc_restore(void *arg)
- 	}
- 
- 	if (rc) {
-		logit(LOG_ERR, "Failed restoring system clock from RTC.");
-+		logit(LOG_WARNING, "Failed restoring system clock from RTC.");
- 		if (EINVAL == errno)
-			logit(LOG_ERR, "RTC time is too old (before %s)", rtc_timestamp);
-+			logit(LOG_WARNING, "RTC time is too old (before %s)", rtc_timestamp);
- 		else if (ENOENT == errno)
-			logit(LOG_ERR, "RTC has no previously saved (valid) time.");
-+			logit(LOG_WARNING, "RTC has no previously saved (valid) time.");
- 		else
-			logit(LOG_ERR, "RTC error code %d: %s", errno, strerror(errno));
-+			logit(LOG_WARNING, "RTC error code %d: %s", errno, strerror(errno));
- 
- 		print(2, NULL);
- 
-@@ -322,7 +322,7 @@ PLUGIN_INIT(plugin_init)
- 	struct tm tm = { 0 };
- 
- 	if (!strptime(rtc_timestamp, RTC_FMT, &tm)) {
-		logit(LOG_ERR, "Invalid restore date '%s', reverting to '%s'",
-+		logit(LOG_WARNING, "Invalid restore date '%s', reverting to '%s'",
- 		      rtc_timestamp, RTC_TIMESTAMP_BEGIN_2000);
- 		rtc_timestamp = RTC_TIMESTAMP_BEGIN_2000;
- 	} else
-diff --git a/plugins/urandom.c b/plugins/urandom.c
-index b9f6039..6f82779 100644
--- a/plugins/urandom.c
-+++ b/plugins/urandom.c
-@@ -154,7 +154,7 @@ static void setup(void *arg)
- 	close(fd);
- 	free(rpi);
- 	if (rc < 0)
-		logit(LOG_ERR, "Failed adding entropy to kernel random pool: %s", strerror(err));
-+		logit(LOG_WARNING, "Failed adding entropy to kernel random pool: %s", strerror(err));
- 	print_result(rc < 0);
- 	return;
- fallback:
-- 
-2.43.0
-
@@ -1,57 +0,0 @@
-From 465bc17ca4b131f8c1ef27ff8279f4ea13745a78 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Thu, 28 Nov 2024 11:06:57 +0100
-Subject: [PATCH 7/7] Fix unintended restart of template siblings
-Organization: Addiva Elektronik
-
-Consider the case where container@.conf is an available template.  When
-creating a container@foo.conf it will share the same base .conf as an
-existing container@bar.conf, but we do not expect to restart bar just
-because foo is instantiated.
-
-Up until this change, all template siblings were considered "dirty" if a
-new one was created or updated.  Skipping realpath() for all files that
-have a '@' works around the problem.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- src/conf.c | 20 +++++++++++++-------
- 1 file changed, 13 insertions(+), 7 deletions(-)
-
-diff --git a/src/conf.c b/src/conf.c
-index 1cfcd87..531923c 100644
--- a/src/conf.c
-+++ b/src/conf.c
-@@ -1432,16 +1432,22 @@ static int conf_change_act(char *dir, char *name, uint32_t mask)
- 		strlcpy(fn, dir, sizeof(fn));
- 	dbg("path: %s mask: %08x", fn, mask);
- 
-	/* Handle disabling/removal of service */
-	rp = realpath(fn, NULL);
-	if (!rp) {
-		if (errno != ENOENT)
-			goto fail;
-+	if (strchr(name, '@')) {
-+		/* Skip realpath for templates */
- 		rp = strdup(fn);
-		if (!rp)
-			goto fail;
-+	} else {
-+		/* Handle disabling/removal of service */
-+		rp = realpath(fn, NULL);
-+		if (!rp) {
-+			if (errno != ENOENT)
-+				goto fail;
-+			rp = strdup(fn);
-+		}
- 	}
- 
-+	if (!rp)
-+		goto fail;
-+
- 	node = conf_find(rp);
- 	if (node) {
- 		dbg("event already registered for %s ...", name);
-- 
-2.43.0
-
@@ -1,5 +1,5 @@
 # From https://github.com/troglobit/finit/releases/
-sha256  5026965e33f31b8fa4e2e465b9521e805fa01c31cade884c07d0fcff97cd0ddf  finit-4.8.tar.gz
+sha256  b6a0a2f98c860cf9fe5dfe7e3601d922957ad7880ae29919176ab960b7b96e70  finit-4.12.tar.gz

 # Locally calculated
 sha256  2fd62c0fe6ea6d1861669f4c87bda83a0b5ceca64f4baa4d16dd078fbd218c14  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-FINIT_VERSION = 4.8
+FINIT_VERSION = 4.12
 FINIT_SITE = https://github.com/troglobit/finit/releases/download/$(FINIT_VERSION)
 FINIT_LICENSE = MIT
 FINIT_LICENSE_FILES = LICENSE
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  b579d0028c8c88ddea27282f03c8c23fa9a758ad47918aeffb048456cf204375  klish-plugin-sysrepo-b693714a1ff5f8021651d7619556afb19945e5e6-br1.tar.gz
+sha256  598089ad964594bbbaf2b7d7214d8761c828174eef53b7cfb1cd98517f407d01  klish-plugin-sysrepo-b693714a1ff5f8021651d7619556afb19945e5e6-git4.tar.gz
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  0305355dd29dc276f7957d51e2406907e0c862dfd46f496c8a921df4f3d72a8d  klish-019ebd2704e322b5d500f5687d526431e535eec8-br1.tar.gz
+sha256  79c9b16b227320fea358114738933ea25be33f8f263d3eec1f83fb603c0c0b22  klish-019ebd2704e322b5d500f5687d526431e535eec8-git4.tar.gz
@@ -1,4 +1,4 @@
 # Locally calculated
 sha256  6b94f3abc1aabd0c72a7c7d92a77f79dda7c8a0cb3df839a97890b4116a2de2a  COPYING
-sha256  6bd96a33f41f73d6ca524efa946b5e592227a5dd6dd21f193fadf4be3583552d  nghttp2-asio-e877868abe06a83ed0a6ac6e245c07f6f20866b5-br1.tar.gz
+sha256  d971c538a31eae5714d2434d90f86794f267615e85e8d2bb0c383e83c300e1ce  nghttp2-asio-e877868abe06a83ed0a6ac6e245c07f6f20866b5-git4.tar.gz

@@ -1,3 +1,3 @@
 # Locally computed
-sha256  830a633630bf6e61f2b8d4ca00efdd9a173ef25cdd49d4a4364c293e088561df  podman-4.5.0.tar.gz
+sha256  830a633630bf6e61f2b8d4ca00efdd9a173ef25cdd49d4a4364c293e088561df  podman-4.5.0-go2.tar.gz
 sha256  62fb8a3a9621dc2388174caaabe9c2317b694bb9a1d46c98bcf5655b68f51be3  LICENSE
@@ -0,0 +1,6 @@
+config BR2_PACKAGE_SHOW
+	bool "show"
+	help
+	  Tool to retrieve and present operational data from sysrepo.
+
+	  https://github.com/kernelkit/infix
@@ -0,0 +1,19 @@
+################################################################################
+#
+# show
+#
+################################################################################
+
+SHOW_VERSION = 1.0
+SHOW_LICENSE = MIT
+SHOW_LICENSE_FILES = LICENSE
+SHOW_SITE_METHOD = local
+SHOW_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/show
+SHOW_REDISTRIBUTE = NO
+
+define SHOW_INSTALL_TARGET_CMDS
+	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D) \
+		DESTDIR="$(TARGET_DIR)" install
+endef
+
+$(eval $(generic-package))
@@ -1,7 +1,7 @@
 From 74ec0f8335f811e4f5becc8bbea4a52af4d3e749 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 17 Sep 2024 04:08:12 +0200
-Subject: [PATCH 1/2] On SIGTERM, allow dispatcher to process event before
+Subject: [PATCH 1/3] On SIGTERM, allow dispatcher to process event before
 exiting
 Organization: Addiva Elektronik

@@ -1,7 +1,7 @@
 From bceb724d328f156efa4ad18f26f1760504bd093d Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Wed, 27 Nov 2024 08:44:57 +0100
-Subject: [PATCH 2/2] avahi-daemon: allow adjusting log level
+Subject: [PATCH 2/3] avahi-daemon: allow adjusting log level
 Organization: Addiva Elektronik

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
@@ -0,0 +1,60 @@
+From 50ddfbefe5ac4d87040cb177e7cf432d4da04e97 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Wed, 26 Feb 2025 17:42:08 +0100
+Subject: [PATCH 3/3] avahi-daemon: improve error reporting in chroot
+ communication
+Organization: Addiva Elektronik
+
+Improve logging of error in chroot communication by including the
+filename in the log message.  Instead of this:
+
+    avahi-daemon[3590]: chroot.c: open() failed: No such file or directory
+
+log this:
+
+    avahi-daemon[3590]: chroot.c: open(/etc/resolv.conf) failed: No such file or directory
+
+Which on a system with resolvconf would make the sysadmin a lot calmer,
+since the file had not yet been created at boot.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ avahi-daemon/chroot.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/avahi-daemon/chroot.c b/avahi-daemon/chroot.c
+index ccd56be..fbaad69 100644
+--- a/avahi-daemon/chroot.c
+++ b/avahi-daemon/chroot.c
+@@ -237,12 +237,13 @@ static int helper_main(int fd) {
+             case AVAHI_CHROOT_GET_RECORD_BROWSER_INTROSPECT:
+ #endif
+             case AVAHI_CHROOT_GET_RESOLV_CONF: {
+                const char *fn = get_file_name_table[(int) command];
+                 int payload;
+ 
+-                if ((payload = open(get_file_name_table[(int) command], O_RDONLY)) < 0) {
+                if ((payload = open(fn, O_RDONLY)) < 0) {
+                     uint8_t c = AVAHI_CHROOT_FAILURE;
+ 
+-                    avahi_log_error(__FILE__": open() failed: %s", strerror(errno));
+                    avahi_log_error(__FILE__": open(%s) failed: %s", fn, strerror(errno));
+ 
+                     if (write(fd, &c, sizeof(c)) != sizeof(c)) {
+                         avahi_log_error(__FILE__": write() failed: %s\n", strerror(errno));
+@@ -262,9 +263,11 @@ static int helper_main(int fd) {
+ 
+             case AVAHI_CHROOT_UNLINK_SOCKET:
+             case AVAHI_CHROOT_UNLINK_PID: {
+                const char *fn = unlink_file_name_table[(int) command];
+                 uint8_t c = AVAHI_CHROOT_SUCCESS;
+ 
+-                unlink(unlink_file_name_table[(int) command]);
+                if (unlink(fn) && errno != ENOENT)
+                    avahi_log_error(__FILE__": unlink(%s) failed: %s", fn, strerror(errno));
+ 
+                 if (write(fd, &c, sizeof(c)) != sizeof(c)) {
+                     avahi_log_error(__FILE__": write() failed: %s\n", strerror(errno));
+-- 
+2.43.0
+
@@ -0,0 +1,97 @@
+From 7e93dca4dab6bdbb39fd7f7c0f436839a1eb626e Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Wed, 5 Jul 2023 22:38:56 +0200
+Subject: [PATCH 1/2] adduser: clarify adduser -D behavior and add -d for SSH
+ key login
+Organization: Addiva Elektronik
+
+Clarify that -D locks the account (!), then add -d to create an account
+for which password login is disabled (*) but the user can log in with
+SSH keys.
+
+This also adjusts the long option --disabled-password, which was mapped
+to -D, probably mistakenly.  With this change BusyBox adduser behaves
+the same as Debian's --disabled-login and --disabled-password.
+
+Fixes #10981
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ loginutils/adduser.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/loginutils/adduser.c b/loginutils/adduser.c
+index d3c795afa..cf6a0264a 100644
+--- a/loginutils/adduser.c
+++ b/loginutils/adduser.c
+@@ -62,7 +62,8 @@
+ //usage:     "\n	-s SHELL	Login shell"
+ //usage:     "\n	-G GRP		Group"
+ //usage:     "\n	-S		Create a system user"
+-//usage:     "\n	-D		Don't assign a password"
+//usage:     "\n	-D		Don't assign a password (locked account)"
+//usage:     "\n	-d		Like -D but allow login using SSH keys"
+ //usage:     "\n	-H		Don't create home directory"
+ //usage:     "\n	-u UID		User id"
+ //usage:     "\n	-k SKEL		Skeleton directory (/etc/skel)"
+@@ -82,10 +83,11 @@
+ #define OPT_SHELL          (1 << 2)
+ #define OPT_GID            (1 << 3)
+ #define OPT_DONT_SET_PASS  (1 << 4)
+-#define OPT_SYSTEM_ACCOUNT (1 << 5)
+-#define OPT_DONT_MAKE_HOME (1 << 6)
+-#define OPT_UID            (1 << 7)
+-#define OPT_SKEL           (1 << 8)
+#define OPT_DISABLED_PASS  (1 << 5)
+#define OPT_SYSTEM_ACCOUNT (1 << 6)
+#define OPT_DONT_MAKE_HOME (1 << 7)
+#define OPT_UID            (1 << 8)
+#define OPT_SKEL           (1 << 9)
+ 
+ /* remix */
+ /* recoded such that the uid may be passed in *p */
+@@ -168,7 +170,8 @@ static const char adduser_longopts[] ALIGN1 =
+ 		"gecos\0"               Required_argument "g"
+ 		"shell\0"               Required_argument "s"
+ 		"ingroup\0"             Required_argument "G"
+-		"disabled-password\0"   No_argument       "D"
+		"disabled-password\0"   No_argument       "d"
+		"disabled-login\0"      No_argument       "D"
+ 		"empty-password\0"      No_argument       "D"
+ 		"system\0"              No_argument       "S"
+ 		"no-create-home\0"      No_argument       "H"
+@@ -202,10 +205,10 @@ int adduser_main(int argc UNUSED_PARAM, char **argv)
+ 	pw.pw_dir = NULL;
+ 
+ 	opts = getopt32long(argv, "^"
+-			"h:g:s:G:DSHu:k:"
+			"h:g:s:G:DdSHu:k:"
+ 			/* at least one and at most two non-option args */
+ 			/* disable interactive passwd for system accounts */
+-			"\0" "-1:?2:SD",
+			"\0" "-1:?2:SDd",
+ 			adduser_longopts,
+ 			&pw.pw_dir, &pw.pw_gecos, &pw.pw_shell,
+ 			&usegroup, &uid, &skel
+@@ -263,7 +266,8 @@ int adduser_main(int argc UNUSED_PARAM, char **argv)
+ 	 * 8. unix date when login expires (i.e. when it may no longer be used)
+ 	 */
+ 	/* fields:     2 3  4 5     6 78 */
+-	p = xasprintf("!:%u:0:99999:7:::", (unsigned)(time(NULL)) / (24*60*60));
+	p = xasprintf("%c:%u:0:99999:7:::", (opts & OPT_DISABLED_PASS) ? '*' : '!',
+			(unsigned)(time(NULL)) / (24*60*60));
+ 	/* ignore errors: if file is missing we suppose admin doesn't want it */
+ 	update_passwd(bb_path_shadow_file, pw.pw_name, p, NULL);
+ 	if (ENABLE_FEATURE_CLEAN_UP)
+@@ -305,7 +309,7 @@ int adduser_main(int argc UNUSED_PARAM, char **argv)
+ 		}
+ 	}
+ 
+-	if (!(opts & OPT_DONT_SET_PASS)) {
+	if (!(opts & (OPT_DONT_SET_PASS | OPT_DISABLED_PASS))) {
+ 		/* interactively set passwd */
+ 		passwd_wrapper(pw.pw_name);
+ 	}
+-- 
+2.34.1
+
@@ -0,0 +1,55 @@
+From 2a1462d9f6a117cf1a5ae531d36143bd0a55d533 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Wed, 5 Jul 2023 23:48:14 +0200
+Subject: [PATCH 2/2] login: add support for shadow passwords
+Organization: Addiva Elektronik
+
+login, on fallback from PAM, or when PAM support is not enabled, checks
+pw->pw_passwd for locked ("!") or passwordless ("*") accounts.  However,
+on systems with shadow passwords the first character will always be "x".
+
+This patch adds shadow password support from the passwd tool, letting
+the user end up in "Login incorrect" rather than the "login: bad salt"
+case, which could be used by an attacker to guess the state of accounts.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ loginutils/login.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/loginutils/login.c b/loginutils/login.c
+index b02be2176..0e7f20844 100644
+--- a/loginutils/login.c
+++ b/loginutils/login.c
+@@ -345,6 +345,11 @@ int login_main(int argc UNUSED_PARAM, char **argv)
+ #endif
+ #if ENABLE_LOGIN_SESSION_AS_CHILD
+ 	pid_t child_pid;
+#endif
+#if ENABLE_FEATURE_SHADOWPASSWDS
+	/* Using _r function to avoid pulling in static buffers */
+	struct spwd spw, *result = NULL;
+	char buffer[256];
+ #endif
+ 	IF_FEATURE_UTMP(pid_t my_pid;)
+ 
+@@ -493,6 +498,16 @@ int login_main(int argc UNUSED_PARAM, char **argv)
+ 			goto fake_it;
+ 		}
+ 
+#if ENABLE_FEATURE_SHADOWPASSWDS
+		if (getspnam_r(pw->pw_name, &spw, buffer, sizeof(buffer), &result)
+		    || !result || strcmp(result->sp_namp, pw->pw_name)) {
+			strcpy(username, "UNKNOWN");
+			goto fake_it;
+		} else {
+			pw->pw_passwd = result->sp_pwdp;
+		}
+#endif
+
+ 		if (pw->pw_passwd[0] == '!' || pw->pw_passwd[0] == '*')
+ 			goto auth_failed;
+ 
+-- 
+2.34.1
+
@@ -1,190 +0,0 @@
-commit 9ae2b2a466871d936ab79b15c95ba85cbc7d5cd6
-Author: Stefan Schlosser <sgs@grmmbl.org>
-Date:   Fri Aug 23 10:52:17 2024 +0200
-
-    dnsmasq: add support for option 82
-    
-    This patch adds support to insert Option 82 Relay Agent Information (see RFC3046)
-    into relayed DHCP requests.
-    
-    When relay has been turned on with --dhcp-relay, the suboptions circuit-id and remote-id
-    can be configured using directives --dhcp-circuitid and --dhcp-remoteid with a maximum of
-    4 bytes denoted in hex format:
-    
-        dhcp-circuitid=set:enterprise,00:11:22:33
-        dhcp-remoteid=set:enterprise,cc:dd:ee:ff
-    
-    If circuit-id is not set, dnsmasq will use the interface index instead.
-    
-    These options usually provide a way to map requests to --dhcp-host and --dhcp-range directives
-    but dhcp-proxy function uses them already for similar purposes.
-    
-    The existing option space will be used (no re-negotiation). If it doesn't fit to a packet a warning
-    
-        "Not enough space to add relay agent information"
-    
-    will be dropped.
-    
-    Signed-off-by: Stefan Schlosser <sgs@grmmbl.org>
-
-diff --git dnsmasq-2.90/src/dhcp.c dnsmasq-2.90/src/dhcp.c
-index b65facd..4c399eb 100644
--- dnsmasq-2.90/src/dhcp.c
-+++ dnsmasq-2.90/src/dhcp.c
-@@ -1117,7 +1117,10 @@ static int relay_upstream4(int iface_index, struct dhcp_packet *mess, size_t sz)
- 	    /* plug in our address */
- 	    mess->giaddr.s_addr = relay->local.addr4.s_addr;
- 	  }
-	
-+
-+	/* add relay agent information */
-+	add_relay_agent_info(relay, mess, sz);
-+
- 	to.sa.sa_family = AF_INET;
- 	to.in.sin_addr = relay->server.addr4;
- 	to.in.sin_port = htons(relay->port);
-diff --git dnsmasq-2.90/src/dnsmasq.h dnsmasq-2.90/src/dnsmasq.h
-index e455c3f..73cb94e 100644
--- dnsmasq-2.90/src/dnsmasq.h
-+++ dnsmasq-2.90/src/dnsmasq.h
-@@ -1902,3 +1902,6 @@ int add_update_server(int flags,
- 		      const char *interface,
- 		      const char *domain,
- 		      union all_addr *local_addr); 
-+
-+
-+int add_relay_agent_info(struct dhcp_relay *relay, struct dhcp_packet *mess, size_t sz);
-diff --git dnsmasq-2.90/src/rfc2131.c dnsmasq-2.90/src/rfc2131.c
-index 68834ea..05a4faa 100644
--- dnsmasq-2.90/src/rfc2131.c
-+++ dnsmasq-2.90/src/rfc2131.c
-@@ -2812,4 +2812,129 @@ static void apply_delay(u32 xid, time_t recvtime, struct dhcp_netid *netid)
-     }
- }
- 
-+struct relay_info {
-+  struct {
-+    unsigned char *data;
-+    int len;
-+  } circuit;
-+  struct {
-+    unsigned char *data;
-+    int len;
-+  } remote;
-+};
-+
-+static inline int subopt_add(unsigned char *ptr, size_t size,
-+                             int subopt, unsigned char *buf, int len)
-+{
-+  if ((len + 2) > size)
-+    {
-+      my_syslog(MS_DHCP | LOG_WARNING, "No space for relay sub option %d", subopt);
-+      return 0;
-+    }
-+
-+  *(ptr++) = subopt;
-+  *(ptr++) = len;
-+  memcpy(ptr, buf, len);
-+
-+  return (len + 2);
-+}
-+
-+static int option_add(struct dhcp_packet *mess, size_t sz,
-+                      struct relay_info *info)
-+{
-+  unsigned char *start = &mess->options[0] + sizeof(u32);
-+  unsigned char *end = (unsigned char *)mess + sz;
-+  unsigned char *optend = NULL;
-+  unsigned char opt[64], *sub, *p;
-+  int size, len = 0;
-+  int ret = -1;
-+
-+  sub = &opt[2];
-+  size = sizeof(opt) - 2;
-+
-+  if (info->circuit.len > 0)
-+      len += subopt_add(sub+len, size-len,
-+                        SUBOPT_CIRCUIT_ID,
-+                        info->circuit.data,
-+                        info->circuit.len);
-+
-+  if (info->remote.len > 0)
-+      len += subopt_add(sub+len, size-len,
-+                        SUBOPT_REMOTE_ID,
-+                        info->remote.data,
-+                        info->remote.len);
-+
-+  if (len == 0)
-+    return 0; /* Nothing to add */
-+
-+  opt[0] = OPTION_AGENT_ID;
-+  opt[1] = len;
-+  len += 2;
-+
-+  /* find option end */
-+  optend = option_find1(start, end, OPTION_END, 1);
-+  if (!optend)
-+    return -1;
-+
-+  *optend = 0;
-+
-+  p = dhcp_skip_opts(start);
-+  if ((p + len + 1) >= end)
-+    {
-+    my_syslog(MS_DHCP | LOG_WARNING, "Not enough space to add relay agent information");
-+    goto out;
-+    }
-+
-+  memcpy(p, opt, len);
-+  optend = p + len;
-+
-+  ret = 0;
-+out:
-+  *optend = OPTION_END;
-+  return ret;
-+}
-+
-+int add_relay_agent_info(struct dhcp_relay *relay, struct dhcp_packet *mess, size_t sz)
-+{
-+  struct dhcp_vendor *vendor;
-+  struct relay_info info;
-+  int ifindex;
-+
-+  if (option_find(mess, sz, OPTION_AGENT_ID, 1))
-+    return 0; /* don't alter any existing relay agent info */
-+
-+  /* lookup circuit-id and remote-id */
-+  info.circuit.len = info.remote.len = 0;
-+
-+  for (vendor = daemon->dhcp_vendors; vendor; vendor = vendor->next)
-+    {
-+    if (vendor->match_type == MATCH_CIRCUIT)
-+      {
-+        if (info.circuit.len == 0)
-+          {
-+          info.circuit.data = vendor->data;
-+          info.circuit.len = vendor->len;
-+          }
-+      }
-+    else if (vendor->match_type == MATCH_REMOTE)
-+      {
-+        if (info.remote.len == 0)
-+          {
-+          info.remote.data = vendor->data;
-+          info.remote.len = vendor->len;
-+          }
-+      }
-+    }
-+
-+  /* use interface index as circuit-id if not specified */
-+  if (info.circuit.len == 0)
-+    {
-+    ifindex = htonl(relay->iface_index);
-+    info.circuit.data = &ifindex;
-+    info.circuit.len = sizeof(ifindex);
-+    }
-+
-+  return option_add(mess, sz, &info);
-+}
-+
- #endif /* HAVE_DHCP */
@@ -1,22 +0,0 @@
-diff --git a/lib/yang.c b/lib/yang.c
-index ef1cf898a..c780b8e8c 100644
--- a/lib/yang.c
-+++ b/lib/yang.c
-@@ -647,7 +647,7 @@ struct yang_data *yang_data_list_find(const struct list *list,
- }
- 
- /* Make libyang log its errors using FRR logging infrastructure. */
-static void ly_log_cb(LY_LOG_LEVEL level, const char *msg, const char *path)
-+static void ly_log_cb(LY_LOG_LEVEL level, const char *msg, const char *path, uint64_t line)
- {
- 	int priority = LOG_ERR;
- 
-@@ -742,7 +742,7 @@ struct ly_ctx *yang_ctx_new_setup(bool embedded_modules, bool explicit_compile)
- void yang_init(bool embedded_modules, bool defer_compile)
- {
- 	/* Initialize libyang global parameters that affect all containers. */
-	ly_set_log_clb(ly_log_cb, 1);
-+	ly_set_log_clb(ly_log_cb);
- 	ly_log_options(LY_LOLOG | LY_LOSTORE);
- 
- 	/* Initialize libyang container for native models. */
@@ -0,0 +1,67 @@
+diff -urN frr-9.1.3.orig/lib/yang.c frr-9.1.3/lib/yang.c
+--- frr-9.1.3.orig/lib/yang.c	2024-12-27 22:06:42.000000000 +0100
+++ frr-9.1.3/lib/yang.c	2025-03-04 12:23:06.723640114 +0100
+@@ -10,11 +10,23 @@
+ #include "lib_errors.h"
+ #include "yang.h"
+ #include "yang_translator.h"
+#include <libyang/version.h>
+ #include "northbound.h"
+ 
+ DEFINE_MTYPE_STATIC(LIB, YANG_MODULE, "YANG module");
+ DEFINE_MTYPE_STATIC(LIB, YANG_DATA, "YANG data structure");
+ 
+/* Safe to remove after libyang 2.2.8 */
+#if (LY_VERSION_MAJOR < 3)
+#define yang_lyd_find_xpath3(ctx_node, tree, xpath, format, prefix_data, vars, \
+			     set)                                              \
+	lyd_find_xpath3(ctx_node, tree, xpath, vars, set)
+#else
+#define yang_lyd_find_xpath3(ctx_node, tree, xpath, format, prefix_data, vars, \
+			     set)                                              \
+	lyd_find_xpath3(ctx_node, tree, xpath, LY_VALUE_JSON, NULL, vars, set)
+#endif
+
+ /* libyang container. */
+ struct ly_ctx *ly_native_ctx;
+ 
+@@ -657,7 +669,12 @@
+ }
+ 
+ /* Make libyang log its errors using FRR logging infrastructure. */
+-static void ly_log_cb(LY_LOG_LEVEL level, const char *msg, const char *path)
+static void ly_zlog_cb(LY_LOG_LEVEL level, const char *msg, const char *data_path
+#if !(LY_VERSION_MAJOR < 3)
+		       ,
+		       const char *schema_path, uint64_t line
+#endif
+)
+ {
+ 	int priority = LOG_ERR;
+ 
+@@ -674,8 +691,14 @@
+ 		break;
+ 	}
+ 
+-	if (path)
+-		zlog(priority, "libyang: %s (%s)", msg, path);
+	if (data_path)
+		zlog(priority, "libyang: %s (%s)", msg, data_path);
+#if !(LY_VERSION_MAJOR < 3)
+	else if (schema_path)
+		zlog(priority, "libyang %s (%s)\n", msg, schema_path);
+	else if (line)
+		zlog(priority, "libyang %s (line %" PRIu64 ")\n", msg, line);
+#endif
+ 	else
+ 		zlog(priority, "libyang: %s", msg);
+ }
+@@ -752,7 +775,7 @@
+ void yang_init(bool embedded_modules, bool defer_compile)
+ {
+ 	/* Initialize libyang global parameters that affect all containers. */
+-	ly_set_log_clb(ly_log_cb, 1);
+	ly_set_log_clb(ly_zlog_cb);
+ 	ly_log_options(LY_LOLOG | LY_LOSTORE);
+ 
+ 	/* Initialize libyang container for native models. */
@@ -0,0 +1,30 @@
+From 5f37809521acda432d77aa4028b74c5713c2d988 Mon Sep 17 00:00:00 2001
+From: Tobias Waldekranz <tobias@waldekranz.com>
+Date: Wed, 20 Nov 2024 15:53:21 +0100
+Subject: [PATCH 2/2] staticd: Re-enable split config support
+Organization: Addiva Elektronik
+
+Because we can.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+---
+ staticd/static_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/staticd/static_main.c b/staticd/static_main.c
+index 165fb4d65..59e924c83 100644
+--- a/staticd/static_main.c
+++ b/staticd/static_main.c
+@@ -128,8 +128,7 @@ FRR_DAEMON_INFO(staticd, STATIC, .vty_port = STATIC_VTY_PORT,
+ 
+ 		.privs = &static_privs, .yang_modules = staticd_yang_modules,
+ 		.n_yang_modules = array_size(staticd_yang_modules),
+-
+-		.flags = FRR_NO_SPLIT_CONFIG);
+	);
+ 
+ int main(int argc, char **argv, char **envp)
+ {
+-- 
+2.43.0
+
@@ -1,236 +0,0 @@
-From c2251e09714b9715ee5ece18aa1096bc08cb8f6d Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Mon, 4 Mar 2024 16:47:28 +0100
-Subject: [PATCH 1/5] net: bridge: avoid classifying unknown multicast as
- mrouters_only
-Organization: Addiva Elektronik
-
-Unknown multicast, MAC/IPv4/IPv6, should always be flooded according to
-the per-port mcast_flood setting, as well as to detected and configured
-mcast_router ports.
-
-This patch drops the mrouters_only classifier of unknown IP multicast
-and moves the flow handling from br_multicast_flood() to br_flood().
-This in turn means br_flood() must know about multicast router ports.
-Because a multicast router should always receive both known and unknown
-multicast.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- include/uapi/linux/if_bridge.h |  1 +
- net/bridge/br.c                |  5 +++++
- net/bridge/br_device.c         | 10 ++++++----
- net/bridge/br_forward.c        | 14 ++++++++++++--
- net/bridge/br_input.c          |  2 +-
- net/bridge/br_multicast.c      | 11 +++++++++--
- net/bridge/br_private.h        | 18 ++++++++++++++++--
- 7 files changed, 50 insertions(+), 11 deletions(-)
-
-diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
-index a5b743a2f775..3bffc39d7800 100644
--- a/include/uapi/linux/if_bridge.h
-+++ b/include/uapi/linux/if_bridge.h
-@@ -830,6 +830,7 @@ enum br_boolopt_id {
- 	BR_BOOLOPT_NO_LL_LEARN,
- 	BR_BOOLOPT_MCAST_VLAN_SNOOPING,
- 	BR_BOOLOPT_MST_ENABLE,
-+	BR_BOOLOPT_MCAST_FLOOD_ALWAYS,
- 	BR_BOOLOPT_MAX
- };
- 
-diff --git a/net/bridge/br.c b/net/bridge/br.c
-index 2cab878e0a39..006fb2e5eafb 100644
--- a/net/bridge/br.c
-+++ b/net/bridge/br.c
-@@ -277,6 +277,9 @@ int br_boolopt_toggle(struct net_bridge *br, enum br_boolopt_id opt, bool on,
- 	case BR_BOOLOPT_MST_ENABLE:
- 		err = br_mst_set_enabled(br, on, extack);
- 		break;
-+	case BR_BOOLOPT_MCAST_FLOOD_ALWAYS:
-+		br_opt_toggle(br, BROPT_MCAST_FLOOD_ALWAYS, on);
-+		break;
- 	default:
- 		/* shouldn't be called with unsupported options */
- 		WARN_ON(1);
-@@ -295,6 +298,8 @@ int br_boolopt_get(const struct net_bridge *br, enum br_boolopt_id opt)
- 		return br_opt_get(br, BROPT_MCAST_VLAN_SNOOPING_ENABLED);
- 	case BR_BOOLOPT_MST_ENABLE:
- 		return br_opt_get(br, BROPT_MST_ENABLED);
-+	case BR_BOOLOPT_MCAST_FLOOD_ALWAYS:
-+		return br_opt_get(br, BROPT_MCAST_FLOOD_ALWAYS);
- 	default:
- 		/* shouldn't be called with unsupported options */
- 		WARN_ON(1);
-diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
-index fb1115857e49..6aac21d86d37 100644
--- a/net/bridge/br_device.c
-+++ b/net/bridge/br_device.c
-@@ -87,10 +87,10 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
- 
- 	dest = eth_hdr(skb)->h_dest;
- 	if (is_broadcast_ether_addr(dest)) {
-		br_flood(br, skb, BR_PKT_BROADCAST, false, true, vid);
-+		br_flood(br, skb, NULL, BR_PKT_BROADCAST, false, true, vid);
- 	} else if (is_multicast_ether_addr(dest)) {
- 		if (unlikely(netpoll_tx_running(dev))) {
-			br_flood(br, skb, BR_PKT_MULTICAST, false, true, vid);
-+			br_flood(br, skb, brmctx, BR_PKT_MULTICAST, false, true, vid);
- 			goto out;
- 		}
- 		if (br_multicast_rcv(&brmctx, &pmctx_null, vlan, skb, vid)) {
-@@ -103,11 +103,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
- 		    br_multicast_querier_exists(brmctx, eth_hdr(skb), mdst))
- 			br_multicast_flood(mdst, skb, brmctx, false, true);
- 		else
-			br_flood(br, skb, BR_PKT_MULTICAST, false, true, vid);
-+			br_flood(br, skb, brmctx, BR_PKT_MULTICAST, false, true, vid);
- 	} else if ((dst = br_fdb_find_rcu(br, dest, vid)) != NULL) {
- 		br_forward(dst->dst, skb, false, true);
- 	} else {
-		br_flood(br, skb, BR_PKT_UNICAST, false, true, vid);
-+		br_flood(br, skb, NULL, BR_PKT_UNICAST, false, true, vid);
- 	}
- out:
- 	rcu_read_unlock();
-@@ -524,6 +524,8 @@ void br_dev_setup(struct net_device *dev)
- 	br->bridge_ageing_time = br->ageing_time = BR_DEFAULT_AGEING_TIME;
- 	dev->max_mtu = ETH_MAX_MTU;
- 
-+	br_opt_toggle(br, BROPT_MCAST_FLOOD_ALWAYS, false);
-+
- 	br_netfilter_rtable_init(br);
- 	br_stp_timer_init(br);
- 	br_multicast_init(br);
-diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
-index e19b583ff2c6..1094364d96e0 100644
--- a/net/bridge/br_forward.c
-+++ b/net/bridge/br_forward.c
-@@ -198,14 +198,19 @@ static struct net_bridge_port *maybe_deliver(
- 
- /* called under rcu_read_lock */
- void br_flood(struct net_bridge *br, struct sk_buff *skb,
-	      enum br_pkt_type pkt_type, bool local_rcv, bool local_orig,
-	      u16 vid)
-+	      struct net_bridge_mcast *brmctx, enum br_pkt_type pkt_type,
-+	      bool local_rcv, bool local_orig, u16 vid)
- {
-+	struct net_bridge_port *rport = NULL;
- 	struct net_bridge_port *prev = NULL;
-+	struct hlist_node *rp = NULL;
- 	struct net_bridge_port *p;
- 
- 	br_tc_skb_miss_set(skb, pkt_type != BR_PKT_BROADCAST);
- 
-+	if (pkt_type == BR_PKT_MULTICAST)
-+		rp = br_multicast_get_first_rport_node(brmctx, skb);
-+
- 	list_for_each_entry_rcu(p, &br->port_list, list) {
- 		/* Do not flood unicast traffic to ports that turn it off, nor
- 		 * other traffic if flood off, except for traffic we originate
-@@ -216,6 +221,11 @@ void br_flood(struct net_bridge *br, struct sk_buff *skb,
- 				continue;
- 			break;
- 		case BR_PKT_MULTICAST:
-+			rport = br_multicast_rport_from_node_skb(rp, skb);
-+			if (rport == p) {
-+				rp = rcu_dereference(hlist_next_rcu(rp));
-+				break;
-+			}
- 			if (!(p->flags & BR_MCAST_FLOOD) && skb->dev != br->dev)
- 				continue;
- 			break;
-diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
-index ceaa5a89b947..e54d648db7de 100644
--- a/net/bridge/br_input.c
-+++ b/net/bridge/br_input.c
-@@ -212,7 +212,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
- 		br_forward(dst->dst, skb, local_rcv, false);
- 	} else {
- 		if (!mcast_hit)
-			br_flood(br, skb, pkt_type, local_rcv, false, vid);
-+			br_flood(br, skb, brmctx, pkt_type, local_rcv, false, vid);
- 		else
- 			br_multicast_flood(mdst, skb, brmctx, local_rcv, false);
- 	}
-diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 9a1cb5079a7a..dc49df4f92a8 100644
--- a/net/bridge/br_multicast.c
-+++ b/net/bridge/br_multicast.c
-@@ -3776,6 +3776,11 @@ static void br_multicast_err_count(const struct net_bridge *br,
- 	u64_stats_update_end(&pstats->syncp);
- }
- 
-+static bool br_flood_mrouters(const struct net_bridge *br)
-+{
-+	return br_opt_get(br, BROPT_MCAST_FLOOD_ALWAYS) ? false : true;
-+}
-+
- static void br_multicast_pim(struct net_bridge_mcast *brmctx,
- 			     struct net_bridge_mcast_port *pmctx,
- 			     const struct sk_buff *skb)
-@@ -3822,7 +3827,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
- 
- 	if (err == -ENOMSG) {
- 		if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
-			BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
-+			BR_INPUT_SKB_CB(skb)->mrouters_only =
-+				br_flood_mrouters(brmctx->br);
- 		} else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
- 			if (ip_hdr(skb)->protocol == IPPROTO_PIM)
- 				br_multicast_pim(brmctx, pmctx, skb);
-@@ -3891,7 +3897,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
- 
- 	if (err == -ENOMSG || err == -ENODATA) {
- 		if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
-			BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
-+			BR_INPUT_SKB_CB(skb)->mrouters_only =
-+				br_flood_mrouters(brmctx->br);
- 		if (err == -ENODATA &&
- 		    ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
- 			br_ip6_multicast_mrd_rcv(brmctx, pmctx, skb);
-diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index d4bedc87b1d8..dfd6e2cdd13e 100644
--- a/net/bridge/br_private.h
-+++ b/net/bridge/br_private.h
-@@ -483,6 +483,7 @@ enum net_bridge_opts {
- 	BROPT_VLAN_BRIDGE_BINDING,
- 	BROPT_MCAST_VLAN_SNOOPING_ENABLED,
- 	BROPT_MST_ENABLED,
-+	BROPT_MCAST_FLOOD_ALWAYS,
- };
- 
- struct net_bridge {
-@@ -886,8 +887,8 @@ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb,
- 		bool local_rcv, bool local_orig);
- int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
- void br_flood(struct net_bridge *br, struct sk_buff *skb,
-	      enum br_pkt_type pkt_type, bool local_rcv, bool local_orig,
-	      u16 vid);
-+	      struct net_bridge_mcast *brmctx, enum br_pkt_type pkt_type,
-+	      bool local_rcv, bool local_orig, u16 vid);
- 
- /* return true if both source port and dest port are isolated */
- static inline bool br_skb_isolated(const struct net_bridge_port *to,
-@@ -1408,6 +1409,19 @@ static inline void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
- {
- }
- 
-+static inline struct hlist_node *
-+br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
-+				  struct sk_buff *skb)
-+{
-+	return NULL;
-+}
-+
-+static inline struct net_bridge_port *
-+br_multicast_rport_from_node_skb(struct hlist_node *rp, struct sk_buff *skb)
-+{
-+	return NULL;
-+}
-+
- static inline bool br_multicast_is_router(struct net_bridge_mcast *brmctx,
- 					  struct sk_buff *skb)
- {
-- 
-2.43.0
-
@@ -1,37 +0,0 @@
-From 75edfa9b690b65423aa3e63ed5870d565950d9bb Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Tue, 5 Mar 2024 06:44:41 +0100
-Subject: [PATCH 2/5] net: bridge: Ignore router ports when forwarding L2
- multicast
-Organization: Addiva Elektronik
-
-Multicast router ports are either statically configured or learned from
-control protocol traffic (IGMP/MLD/PIM).  These protocols regulate IP
-multicast -- MAC multicast should always be forwarded through flooding
-of unknown multicast or using permanent MDB entries.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- net/bridge/br_private.h | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index dfd6e2cdd13e..7aabf8bd7da2 100644
--- a/net/bridge/br_private.h
-+++ b/net/bridge/br_private.h
-@@ -1086,7 +1086,10 @@ br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
- 	if (skb->protocol == htons(ETH_P_IPV6))
- 		return rcu_dereference(hlist_first_rcu(&brmctx->ip6_mc_router_list));
- #endif
-	return rcu_dereference(hlist_first_rcu(&brmctx->ip4_mc_router_list));
-+	if (skb->protocol == htons(ETH_P_IP))
-+		return rcu_dereference(hlist_first_rcu(&brmctx->ip4_mc_router_list));
-+
-+	return NULL;
- }
- 
- static inline struct net_bridge_port *
-- 
-2.43.0
-
@@ -1,190 +0,0 @@
-From 2d2ac57a7d9354c2c1fa796659e33496fc8e918d Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Thu, 4 Apr 2024 16:36:30 +0200
-Subject: [PATCH 3/5] net: bridge: drop delay for applying strict multicast
- filtering
-Organization: Addiva Elektronik
-
-This *local* patch drops the initial delay before applying strict multicast
-filtering, introduced in [1] and recently updated in [2].
-
-The main reason for this patch is RFC conformance and customer expectations.
-At power on we assume the querier role by default and are expected to stop
-unknown flooding as soon as we have a membership report in place, not after
-10 seconds.
-
-A proper fix for upstreaming could be to add a knob to disable the delay.
-
-[1]: https://lore.kernel.org/netdev/1375311980-25575-1-git-send-email-linus.luessing@web.de/
-[2]: https://lore.kernel.org/netdev/20240127175033.9640-1-linus.luessing@c0d3.blue/
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- net/bridge/br_multicast.c | 42 +++++++--------------------------------
- net/bridge/br_private.h   |  4 +---
- 2 files changed, 8 insertions(+), 38 deletions(-)
-
-diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index dc49df4f92a8..47c0625c5553 100644
--- a/net/bridge/br_multicast.c
-+++ b/net/bridge/br_multicast.c
-@@ -1762,10 +1762,6 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t)
- }
- #endif
- 
-static void br_multicast_query_delay_expired(struct timer_list *t)
-{
-}
-
- static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx,
- 					    struct br_ip *ip,
- 					    struct sk_buff *skb)
-@@ -3198,12 +3194,8 @@ int br_multicast_dump_querier_state(struct sk_buff *skb,
- 
- static void
- br_multicast_update_query_timer(struct net_bridge_mcast *brmctx,
-				struct bridge_mcast_other_query *query,
-				unsigned long max_delay)
-+				struct bridge_mcast_other_query *query)
- {
-	if (!timer_pending(&query->timer))
-		mod_timer(&query->delay_timer, jiffies + max_delay);
-
- 	mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval);
- }
- 
-@@ -3394,13 +3386,12 @@ static void
- br_ip4_multicast_query_received(struct net_bridge_mcast *brmctx,
- 				struct net_bridge_mcast_port *pmctx,
- 				struct bridge_mcast_other_query *query,
-				struct br_ip *saddr,
-				unsigned long max_delay)
-+				struct br_ip *saddr)
- {
- 	if (!br_multicast_select_querier(brmctx, pmctx, saddr))
- 		return;
- 
-	br_multicast_update_query_timer(brmctx, query, max_delay);
-+	br_multicast_update_query_timer(brmctx, query);
- 	br_ip4_multicast_mark_router(brmctx, pmctx);
- }
- 
-@@ -3409,13 +3400,12 @@ static void
- br_ip6_multicast_query_received(struct net_bridge_mcast *brmctx,
- 				struct net_bridge_mcast_port *pmctx,
- 				struct bridge_mcast_other_query *query,
-				struct br_ip *saddr,
-				unsigned long max_delay)
-+				struct br_ip *saddr)
- {
- 	if (!br_multicast_select_querier(brmctx, pmctx, saddr))
- 		return;
- 
-	br_multicast_update_query_timer(brmctx, query, max_delay);
-+	br_multicast_update_query_timer(brmctx, query);
- 	br_ip6_multicast_mark_router(brmctx, pmctx);
- }
- #endif
-@@ -3469,7 +3459,7 @@ static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
- 
- 		br_ip4_multicast_query_received(brmctx, pmctx,
- 						&brmctx->ip4_other_query,
-						&saddr, max_delay);
-+						&saddr);
- 		goto out;
- 	}
- 
-@@ -3557,7 +3547,7 @@ static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
- 
- 		br_ip6_multicast_query_received(brmctx, pmctx,
- 						&brmctx->ip6_other_query,
-						&saddr, max_delay);
-+						&saddr);
- 		goto out;
- 	} else if (!group) {
- 		goto out;
-@@ -4065,8 +4055,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
- 		    br_ip4_multicast_local_router_expired, 0);
- 	timer_setup(&brmctx->ip4_other_query.timer,
- 		    br_ip4_multicast_querier_expired, 0);
-	timer_setup(&brmctx->ip4_other_query.delay_timer,
-		    br_multicast_query_delay_expired, 0);
- 	timer_setup(&brmctx->ip4_own_query.timer,
- 		    br_ip4_multicast_query_expired, 0);
- #if IS_ENABLED(CONFIG_IPV6)
-@@ -4074,8 +4062,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
- 		    br_ip6_multicast_local_router_expired, 0);
- 	timer_setup(&brmctx->ip6_other_query.timer,
- 		    br_ip6_multicast_querier_expired, 0);
-	timer_setup(&brmctx->ip6_other_query.delay_timer,
-		    br_multicast_query_delay_expired, 0);
- 	timer_setup(&brmctx->ip6_own_query.timer,
- 		    br_ip6_multicast_query_expired, 0);
- #endif
-@@ -4210,12 +4196,10 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
- {
- 	del_timer_sync(&brmctx->ip4_mc_router_timer);
- 	del_timer_sync(&brmctx->ip4_other_query.timer);
-	del_timer_sync(&brmctx->ip4_other_query.delay_timer);
- 	del_timer_sync(&brmctx->ip4_own_query.timer);
- #if IS_ENABLED(CONFIG_IPV6)
- 	del_timer_sync(&brmctx->ip6_mc_router_timer);
- 	del_timer_sync(&brmctx->ip6_other_query.timer);
-	del_timer_sync(&brmctx->ip6_other_query.delay_timer);
- 	del_timer_sync(&brmctx->ip6_own_query.timer);
- #endif
- }
-@@ -4643,8 +4627,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
- 
- int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
- {
-	unsigned long max_delay;
-
- 	val = !!val;
- 
- 	spin_lock_bh(&brmctx->br->multicast_lock);
-@@ -4655,19 +4637,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
- 	if (!val)
- 		goto unlock;
- 
-	max_delay = brmctx->multicast_query_response_interval;
-
-	if (!timer_pending(&brmctx->ip4_other_query.timer))
-		mod_timer(&brmctx->ip4_other_query.delay_timer,
-			  jiffies + max_delay);
-
- 	br_multicast_start_querier(brmctx, &brmctx->ip4_own_query);
- 
- #if IS_ENABLED(CONFIG_IPV6)
-	if (!timer_pending(&brmctx->ip6_other_query.timer))
-		mod_timer(&brmctx->ip6_other_query.delay_timer,
-			  jiffies + max_delay);
-
- 	br_multicast_start_querier(brmctx, &brmctx->ip6_own_query);
- #endif
- 
-diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index 7aabf8bd7da2..43fff09dfb71 100644
--- a/net/bridge/br_private.h
-+++ b/net/bridge/br_private.h
-@@ -78,7 +78,6 @@ struct bridge_mcast_own_query {
- /* other querier */
- struct bridge_mcast_other_query {
- 	struct timer_list		timer;
-	struct timer_list		delay_timer;
- };
- 
- /* selected querier */
-@@ -1164,8 +1163,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
- 		own_querier_enabled = false;
- 	}
- 
-	return !timer_pending(&querier->delay_timer) &&
-	       (own_querier_enabled || timer_pending(&querier->timer));
-+	return own_querier_enabled || timer_pending(&querier->timer);
- }
- 
- static inline bool br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
-- 
-2.43.0
-
@@ -1,49 +0,0 @@
-From c7818c4273ef1705d6e153f5e4eda683d68f59be Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Mon, 29 Apr 2024 15:14:51 +0200
-Subject: [PATCH 4/5] usb: core: adjust log level for unauthorized devices
-Organization: Addiva Elektronik
-
-The fact that a USB device currently is not authorized is not an error,
-so let's adjust the log level so these messages slip below radar for the
-commonly used 'quiet' log level.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- drivers/usb/core/driver.c  | 4 ++--
- drivers/usb/core/generic.c | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
-index e02ba15f6e34..3fe4d15cd6db 100644
--- a/drivers/usb/core/driver.c
-+++ b/drivers/usb/core/driver.c
-@@ -335,10 +335,10 @@ static int usb_probe_interface(struct device *dev)
- 		return error;
- 
- 	if (udev->authorized == 0) {
-		dev_err(&intf->dev, "Device is not authorized for usage\n");
-+		dev_warn(&intf->dev, "Device is not authorized for usage\n");
- 		return error;
- 	} else if (intf->authorized == 0) {
-		dev_err(&intf->dev, "Interface %d is not authorized for usage\n",
-+		dev_warn(&intf->dev, "Interface %d is not authorized for usage\n",
- 				intf->altsetting->desc.bInterfaceNumber);
- 		return error;
- 	}
-diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
-index b134bff5c3fe..60575a01a810 100644
--- a/drivers/usb/core/generic.c
-+++ b/drivers/usb/core/generic.c
-@@ -247,7 +247,7 @@ int usb_generic_driver_probe(struct usb_device *udev)
- 	 * with the driver core and lets interface drivers bind to them.
- 	 */
- 	if (udev->authorized == 0)
-		dev_err(&udev->dev, "Device is not authorized for usage\n");
-+		dev_warn(&udev->dev, "Device is not authorized for usage\n");
- 	else {
- 		c = usb_choose_configuration(udev);
- 		if (c >= 0) {
-- 
-2.43.0
-
@@ -1,24 +1,19 @@
-From 998f0e99f2bd7ab54e1d25acac4227335c8caaec Mon Sep 17 00:00:00 2001
+From 74f8ab9d77486305e12a075ad94d87f404429f66 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
-Subject: [PATCH 01/25] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
+Subject: [PATCH 01/35] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
 PPU on 6393X
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,
 register 0, bit 15). Therefore, increase the timeout threshold to 1s.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 284270a4ade1..1f0b0c07ed9d 100644
+index df1df6015412..54c99357540d 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -86,7 +86,7 @@ int mv88e6xxx_write(struct mv88e6xxx_chip *chip, int addr, int reg, u16 val)
@@ -30,6 +25,3 @@ index 284270a4ade1..1f0b0c07ed9d 100644
 	u16 data;
 	int err;
 	int i;
-- 
-2.43.0
-
@@ -1,12 +1,9 @@
-From 3002b9e08272f3d740c2b582cf9b01fa1fde46b8 Mon Sep 17 00:00:00 2001
+From bf88305dd98a52f698c6f866b76645a48728d628 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
-Subject: [PATCH 02/25] net: dsa: mv88e6xxx: Improve indirect register access
+Subject: [PATCH 02/35] net: dsa: mv88e6xxx: Improve indirect register access
 perf on 6393
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 When operating in multi-chip mode, the 6393 family maps a subset of
 commonly used global registers to the outermost address space (in
@@ -16,8 +13,6 @@ previous families).
 Therefore, add a new set of SMI operations which remaps accesses to
 such registers to the corresponding directly addressable register. All
 other accesses use the regular indirect interface.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c    |  7 +++
 drivers/net/dsa/mv88e6xxx/global1.h |  3 ++
@@ -27,10 +22,10 @@ Signed-off-by: Mattias Walström <lazzer@gmail.com>
 5 files changed, 119 insertions(+)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 1f0b0c07ed9d..f9d892d036be 100644
+index 54c99357540d..f6611496dc0f 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -6472,6 +6472,13 @@ static int mv88e6xxx_detect(struct mv88e6xxx_chip *chip)
+@@ -6532,6 +6532,13 @@ static int mv88e6xxx_detect(struct mv88e6xxx_chip *chip)
 	/* Update the compatible info with the probed one */
 	chip->info = info;
 
@@ -214,6 +209,3 @@ index c6c71d5757f5..788cf68b7b33 100644
 int mv88e6xxx_smi_init(struct mv88e6xxx_chip *chip,
 		       struct mii_bus *bus, int sw_addr);
 
-- 
-2.43.0
-
@@ -1,12 +1,9 @@
-From 6bad36ecd3bb8f9b97c51f8ee2409f250344c1fc Mon Sep 17 00:00:00 2001
+From be5cc28a5bac1bc968a2d6b9892cc64d41aad9ac Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
-Subject: [PATCH 03/25] net: dsa: mv88e6xxx: Honor ports being managed via
+Subject: [PATCH 03/35] net: dsa: mv88e6xxx: Honor ports being managed via
 in-band-status
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 Keep all link parameters in their unforced states when the port is
 declared as being managed via in-band-status, and let the MAC
@@ -16,14 +13,12 @@ USXGMII autoneg)
 This state is the default set up by mv88e6xxx_port_setup_mac(), so all
 we have to do is to make the phylink MAC callbacks no-ops in cases
 when in-band-status is being used.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 6 ++++++
 1 file changed, 6 insertions(+)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index f9d892d036be..98bd635b0ba9 100644
+index f6611496dc0f..216fbcfcd476 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -964,6 +964,9 @@ static void mv88e6xxx_mac_link_down(struct phylink_config *config,
@@ -46,6 +41,3 @@ index f9d892d036be..98bd635b0ba9 100644
 	ops = chip->info->ops;
 
 	mv88e6xxx_reg_lock(chip);
-- 
-2.43.0
-
@@ -1,12 +1,9 @@
-From 980366a1f8709fdfe643edb666c86a916c681a6c Mon Sep 17 00:00:00 2001
+From 0e7940b52ab43e1e97d523d8900927f2b82a54fe Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
-Subject: [PATCH 04/25] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
+Subject: [PATCH 04/35] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
 ports on 6393X
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 For packets with a DA in the IEEE reserved L2 group range, originating
 from a CPU, forward it as normal, rather than classifying it as
@@ -32,8 +29,6 @@ Before this change, due to rsvd2cpu being enabled on the CPU port, the
 switch would try to trap it back to the CPU. Given that the CPU is
 trusted, instead assume that it indeed meant for the packet to be
 forwarded like any other.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/port.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)
@@ -101,6 +96,3 @@ index 04053fdc6489..f25fb3214acb 100644
 	if (err)
 		return err;
 
-- 
-2.43.0
-
@@ -1,16 +1,11 @@
-From cfc55d98057160753158b7c5357c94ac24d918fe Mon Sep 17 00:00:00 2001
+From 6a7421879866a712d127e6588744019668b4d1bc Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 19:44:32 +0100
-Subject: [PATCH 05/25] net: dsa: mv88e6xxx: Add LED infrastructure
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Subject: [PATCH 05/35] net: dsa: mv88e6xxx: Add LED infrastructure
+Organization: Wires

 Parse DT for LEDs and register them for devices that support it,
 though no actual implementations exist yet.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/Makefile |   1 +
 drivers/net/dsa/mv88e6xxx/chip.c   |   5 +-
@@ -34,7 +29,7 @@ index a9a9651187db..6720d9303914 100644
 mv88e6xxx-objs += pcs-6352.o
 mv88e6xxx-objs += pcs-639x.o
 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 98bd635b0ba9..97cebc490fac 100644
+index 216fbcfcd476..8d386766d1ec 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -37,6 +37,7 @@
@@ -45,7 +40,7 @@ index 98bd635b0ba9..97cebc490fac 100644
 #include "phy.h"
 #include "port.h"
 #include "ptp.h"
-@@ -4115,7 +4116,9 @@ static int mv88e6xxx_port_setup(struct dsa_switch *ds, int port)
+@@ -4171,7 +4172,9 @@ static int mv88e6xxx_port_setup(struct dsa_switch *ds, int port)
 			return err;
 	}
 
@@ -314,6 +309,3 @@ index 000000000000..8afa2a0c0527
 +int mv88e6xxx_port_setup_leds(struct dsa_switch *ds, int port);
 +
 +#endif /* _MV88E6XXX_LEDS_H */
-- 
-2.43.0
-
@@ -1,18 +1,13 @@
-From 180f2b90c73bc9fdfb27335327571daf8507f9c8 Mon Sep 17 00:00:00 2001
+From 2190bebac9c7205a4a513eabed45dc9cb3dee2bd Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 21:59:35 +0100
-Subject: [PATCH 06/25] net: dsa: mv88e6xxx: Add LED support for 6393X
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Subject: [PATCH 06/35] net: dsa: mv88e6xxx: Add LED support for 6393X
+Organization: Wires

 Trigger support:
 - "none"
 - "timer"
 - "netdev"
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c |   1 +
 drivers/net/dsa/mv88e6xxx/leds.c | 229 +++++++++++++++++++++++++++++++
@@ -22,10 +17,10 @@ Signed-off-by: Mattias Walström <lazzer@gmail.com>
 5 files changed, 272 insertions(+)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 97cebc490fac..e8edf3970940 100644
+index 8d386766d1ec..3cc41fea6d41 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -5627,6 +5627,7 @@ static const struct mv88e6xxx_ops mv88e6393x_ops = {
+@@ -5685,6 +5685,7 @@ static const struct mv88e6xxx_ops mv88e6393x_ops = {
 	.gpio_ops = &mv88e6352_gpio_ops,
 	.avb_ops = &mv88e6390_avb_ops,
 	.ptp_ops = &mv88e6352_ptp_ops,
@@ -362,6 +357,3 @@ index ddadeb9bfdae..7157864dc20f 100644
 int mv88e6393x_set_egress_port(struct mv88e6xxx_chip *chip,
 			       enum mv88e6xxx_egress_direction direction,
 			       int port);
-- 
-2.43.0
-
@@ -1,12 +1,9 @@
-From 2e42839d4edb250b298f7683975382e9ec97c9a9 Mon Sep 17 00:00:00 2001
+From c587f8b5fa584efc53e09f110bfbd9e09f0deff5 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
-Subject: [PATCH 07/25] net: dsa: tag_dsa: Use tag priority as initial
+Subject: [PATCH 07/35] net: dsa: tag_dsa: Use tag priority as initial
 skb->priority
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 Use the 3-bit priority field from the DSA tag as the initial packet
 priority on ingress to the CPU.
@@ -22,8 +19,6 @@ Ideally we could then map this priority to an internal one, like we
 can do with an "ingress-qos-map" on VLAN interfaces. Until that is
 implemented, support the setup that is likely to be the most common; a
 1:1 mapping from FPri to skb->priority.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 net/dsa/tag_dsa.c | 7 +++++++
 1 file changed, 7 insertions(+)
@@ -46,6 +41,3 @@ index 2a2c4fb61a65..a00ae6bf2971 100644
 	return skb;
 }
 
-- 
-2.43.0
-
@@ -1,12 +1,9 @@
-From 681fc63548bae02cd286042a3470011617ff78fd Mon Sep 17 00:00:00 2001
+From a0797da07ca347ed3a8092124fef77963a52cdcb Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
-Subject: [PATCH 08/25] net: dsa: Support MDB memberships whose L2 addresses
+Subject: [PATCH 08/35] net: dsa: Support MDB memberships whose L2 addresses
 overlap
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 Multiple IP multicast groups (32 for v4, 2^80 for v6) map to the same
 L2 address. This means that switchdev drivers may receive multiple MDB
@@ -32,8 +29,6 @@ as long as the count is positive. Fortunately, all the infrastructure
 needed to do this is already in place, since it is also needed on CPU
 and DSA ports. Thus, "implement" this by simply removing the guards
 which previously skipped reference countung on user ports.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 net/dsa/switch.c | 16 ----------------
 1 file changed, 16 deletions(-)
@@ -72,6 +67,3 @@ index 3d2feeea897b..628e8a884dde 100644
 	mutex_lock(&dp->addr_lists_lock);
 
 	a = dsa_mac_addr_find(&dp->mdbs, mdb->addr, mdb->vid, db);
-- 
-2.43.0
-
@@ -1,13 +1,9 @@
-From d1c7aeac75ffe6e1350d8a08ee9ba99209636df5 Mon Sep 17 00:00:00 2001
+From e548e14cc271efa568a39afcb8f71bd5a48cf446 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
-Subject: [PATCH 09/25] net: dsa: Support EtherType based priority overrides
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Subject: [PATCH 09/35] net: dsa: Support EtherType based priority overrides
+Organization: Wires

-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 include/net/dsa.h |  4 ++++
 net/dsa/user.c    | 56 +++++++++++++++++++++++++++++++++++++++++++++--
@@ -116,6 +112,3 @@ index 64f660d2334b..e13fb22e2c2b 100644
 		}
 		break;
 	case IEEE_8021QAZ_APP_SEL_DSCP:
-- 
-2.43.0
-
@@ -1,14 +1,10 @@
-From 79d68d69f6cd6cf57ef5ed4bcba45134ff8ba174 Mon Sep 17 00:00:00 2001
+From 63e47b33b09221310e2f6f33478a1b07c4706f00 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
-Subject: [PATCH 10/25] net: dsa: mv88e6xxx: Support EtherType based priority
+Subject: [PATCH 10/35] net: dsa: mv88e6xxx: Support EtherType based priority
 overrides
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c    | 64 +++++++++++++++++++++++++++++
 drivers/net/dsa/mv88e6xxx/chip.h    | 21 ++++++++++
@@ -19,7 +15,7 @@ Signed-off-by: Mattias Walström <lazzer@gmail.com>
 6 files changed, 207 insertions(+), 4 deletions(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index e8edf3970940..3151df2a27c7 100644
+index 3cc41fea6d41..182d3a0e75c8 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -1715,6 +1715,11 @@ static int mv88e6xxx_rmu_setup(struct mv88e6xxx_chip *chip)
@@ -34,7 +30,7 @@ index e8edf3970940..3151df2a27c7 100644
 	if (chip->info->ops->pot_clear)
 		return chip->info->ops->pot_clear(chip);
 
-@@ -3386,6 +3391,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+@@ -3427,6 +3432,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
 
 	chip->ports[port].chip = chip;
 	chip->ports[port].port = port;
@@ -42,7 +38,7 @@ index e8edf3970940..3151df2a27c7 100644
 
 	err = mv88e6xxx_port_setup_mac(chip, port, LINK_UNFORCED,
 				       SPEED_UNFORCED, DUPLEX_UNFORCED,
-@@ -6532,6 +6538,7 @@ static struct mv88e6xxx_chip *mv88e6xxx_alloc_chip(struct device *dev)
+@@ -6592,6 +6598,7 @@ static struct mv88e6xxx_chip *mv88e6xxx_alloc_chip(struct device *dev)
 	chip->dev = dev;
 
 	mutex_init(&chip->reg_lock);
@@ -50,7 +46,7 @@ index e8edf3970940..3151df2a27c7 100644
 	INIT_LIST_HEAD(&chip->mdios);
 	idr_init(&chip->policies);
 	INIT_LIST_HEAD(&chip->msts);
-@@ -7064,6 +7071,61 @@ static int mv88e6xxx_crosschip_lag_leave(struct dsa_switch *ds, int sw_index,
+@@ -7131,6 +7138,61 @@ static int mv88e6xxx_crosschip_lag_leave(struct dsa_switch *ds, int sw_index,
 	return err_sync ? : err_pvt;
 }
 
@@ -112,7 +108,7 @@ index e8edf3970940..3151df2a27c7 100644
 static const struct phylink_mac_ops mv88e6xxx_phylink_mac_ops = {
 	.mac_select_pcs		= mv88e6xxx_mac_select_pcs,
 	.mac_prepare		= mv88e6xxx_mac_prepare,
-@@ -7133,6 +7195,8 @@ static const struct dsa_switch_ops mv88e6xxx_switch_ops = {
+@@ -7200,6 +7262,8 @@ static const struct dsa_switch_ops mv88e6xxx_switch_ops = {
 	.crosschip_lag_change	= mv88e6xxx_crosschip_lag_change,
 	.crosschip_lag_join	= mv88e6xxx_crosschip_lag_join,
 	.crosschip_lag_leave	= mv88e6xxx_crosschip_lag_leave,
@@ -374,6 +370,3 @@ index 7157864dc20f..7edb04c41ac8 100644
 int mv88e6xxx_port_set_message_port(struct mv88e6xxx_chip *chip, int port,
 				    bool message_port);
 int mv88e6xxx_port_set_trunk(struct mv88e6xxx_chip *chip, int port,
-- 
-2.43.0
-
@@ -1,11 +1,8 @@
-From 57eabbff1169a5641c59fc698d7b122d17733d49 Mon Sep 17 00:00:00 2001
+From d6d9d65123b6559194254079b39654883f984f13 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
-Subject: [PATCH 11/25] net: dsa: mv88e6xxx: Add mqprio qdisc support
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Subject: [PATCH 11/35] net: dsa: mv88e6xxx: Add mqprio qdisc support
+Organization: Wires

 Add support for attaching mqprio qdisc's to mv88e6xxx ports and use
 the packet's traffic class as the outgoing priority when no PCP bits
@@ -27,15 +24,13 @@ are effectively only specifying the QPri.
 Since FPri is always a 3-bit field, even on older chips with only 4
 physical queues, always report 8 queues and let the chip's policy
 handle the mapping down to the "real" number.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 70 ++++++++++++++++++++++++++++++++
 net/dsa/tag_dsa.c                |  4 +-
 2 files changed, 73 insertions(+), 1 deletion(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 3151df2a27c7..f50ad71bb28b 100644
+index 182d3a0e75c8..e73a4c2f0392 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -31,6 +31,7 @@
@@ -46,7 +41,7 @@ index 3151df2a27c7..f50ad71bb28b 100644
 
 #include "chip.h"
 #include "devlink.h"
-@@ -7126,6 +7127,68 @@ static int mv88e6xxx_port_del_etype_prio(struct dsa_switch *ds, int port,
+@@ -7193,6 +7194,68 @@ static int mv88e6xxx_port_del_etype_prio(struct dsa_switch *ds, int port,
 	return err;
 }
 
@@ -115,7 +110,7 @@ index 3151df2a27c7..f50ad71bb28b 100644
 static const struct phylink_mac_ops mv88e6xxx_phylink_mac_ops = {
 	.mac_select_pcs		= mv88e6xxx_mac_select_pcs,
 	.mac_prepare		= mv88e6xxx_mac_prepare,
-@@ -7197,6 +7260,7 @@ static const struct dsa_switch_ops mv88e6xxx_switch_ops = {
+@@ -7264,6 +7327,7 @@ static const struct dsa_switch_ops mv88e6xxx_switch_ops = {
 	.crosschip_lag_leave	= mv88e6xxx_crosschip_lag_leave,
 	.port_add_etype_prio	= mv88e6xxx_port_add_etype_prio,
 	.port_del_etype_prio	= mv88e6xxx_port_del_etype_prio,
@@ -123,7 +118,7 @@ index 3151df2a27c7..f50ad71bb28b 100644
 };
 
 static int mv88e6xxx_register_switch(struct mv88e6xxx_chip *chip)
-@@ -7223,6 +7287,12 @@ static int mv88e6xxx_register_switch(struct mv88e6xxx_chip *chip)
+@@ -7290,6 +7354,12 @@ static int mv88e6xxx_register_switch(struct mv88e6xxx_chip *chip)
 	 */
 	ds->num_lag_ids = mv88e6xxx_has_lag(chip) ? 16 : 0;
 
@@ -160,6 +155,3 @@ index a00ae6bf2971..55c296e0b5b0 100644
 		dsa_header[3] = vid & 0xff;
 	}
 
-- 
-2.43.0
-
@@ -1,12 +1,9 @@
-From 752cce791dfe31525e3974d6f6419e4be0535343 Mon Sep 17 00:00:00 2001
+From 0873cb85051b8c483d11570cb2b3ad3da6b7ca4c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
-Subject: [PATCH 12/25] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
+Subject: [PATCH 12/35] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
 are available
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 Switch the priority sourcing precdence to prefer VLAN PCP over IP
 DSCP, when both are available.
@@ -25,17 +22,15 @@ main reasons for choosing the new default:
   packet's priority. As the packet then moves through the network
   core over trusted VLAN trunks, the packet should keep its original
   priority, independent of what inner protocol fields may indicate.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index f50ad71bb28b..2a46bf5f3da8 100644
+index e73a4c2f0392..9988fc3983d1 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -3402,9 +3402,13 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+@@ -3443,9 +3443,13 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
 
 	/* Port Control: disable Drop-on-Unlock, disable Drop-on-Lock,
 	 * disable Header mode, enable IGMP/MLD snooping, disable VLAN
@@ -52,7 +47,7 @@ index f50ad71bb28b..2a46bf5f3da8 100644
 	 *
 	 * If this is the CPU link, use DSA or EDSA tagging depending
 	 * on which tagging mode was configured.
-@@ -3415,6 +3419,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+@@ -3456,6 +3460,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
 	 * forwarding of unknown unicasts and multicasts.
 	 */
 	reg = MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP |
@@ -60,6 +55,3 @@ index f50ad71bb28b..2a46bf5f3da8 100644
 		MV88E6XXX_PORT_CTL0_STATE_FORWARDING;
 	/* Forward any IPv4 IGMP or IPv6 MLD frames received
 	 * by a USER port to the CPU port to allow snooping.
-- 
-2.43.0
-
@@ -1,12 +1,9 @@
-From b3b9b97cbe4eebd6cd3d68744e11a1bde5b98a47 Mon Sep 17 00:00:00 2001
+From 6976a38c8392241021a7bc5053a1f4c4d6447956 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
-Subject: [PATCH 13/25] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
+Subject: [PATCH 13/35] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
 VLANs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 Before this change, in a setup like the following, packets assigned to
 VLAN 10 were forwarded between the switch ports, even though the
@@ -27,8 +24,6 @@ a VLAN upper interface, rather than to offload bridge VLANs, are
 marked as policy entries. As the VTU policy of user ports is already
 set to TRAP (to ensure proper standalone port operation), this will
 cause all packets assigned to these VLANs to properly terminated.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 33 ++++++++++++++++++--------------
 include/net/switchdev.h          |  4 ++++
@@ -36,10 +31,10 @@ Signed-off-by: Mattias Walström <lazzer@gmail.com>
 3 files changed, 27 insertions(+), 14 deletions(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 2a46bf5f3da8..785cd3d0e2b1 100644
+index 9988fc3983d1..74fca098b11a 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -2631,7 +2631,7 @@ static int mv88e6xxx_port_broadcast_sync(struct mv88e6xxx_chip *chip, int port,
+@@ -2665,7 +2665,7 @@ static int mv88e6xxx_port_broadcast_sync(struct mv88e6xxx_chip *chip, int port,
 }
 
 static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
@@ -48,7 +43,7 @@ index 2a46bf5f3da8..785cd3d0e2b1 100644
 {
 	const u8 non_member = MV88E6XXX_G1_VTU_DATA_MEMBER_TAG_NON_MEMBER;
 	struct mv88e6xxx_vtu_entry vlan;
-@@ -2643,9 +2643,7 @@ static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
+@@ -2677,9 +2677,7 @@ static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
 
 	if (!vlan.valid) {
 		memset(&vlan, 0, sizeof(vlan));
@@ -59,7 +54,7 @@ index 2a46bf5f3da8..785cd3d0e2b1 100644
 
 		err = mv88e6xxx_atu_new(chip, &vlan.fid);
 		if (err)
-@@ -2668,6 +2666,9 @@ static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
+@@ -2702,6 +2700,9 @@ static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
 		if (err)
 			return err;
 	} else if (vlan.member[port] != member) {
@@ -69,7 +64,7 @@ index 2a46bf5f3da8..785cd3d0e2b1 100644
 		vlan.member[port] = member;
 
 		err = mv88e6xxx_vtu_loadpurge(chip, &vlan);
-@@ -2714,7 +2715,8 @@ static int mv88e6xxx_port_vlan_add(struct dsa_switch *ds, int port,
+@@ -2748,7 +2749,8 @@ static int mv88e6xxx_port_vlan_add(struct dsa_switch *ds, int port,
 
 	mv88e6xxx_reg_lock(chip);
 
@@ -79,7 +74,7 @@ index 2a46bf5f3da8..785cd3d0e2b1 100644
 	if (err) {
 		dev_err(ds->dev, "p%d: failed to add VLAN %d%c\n", port,
 			vlan->vid, untagged ? 'u' : 't');
-@@ -3454,14 +3456,17 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+@@ -3495,14 +3497,17 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
 	if (err)
 		return err;
 
@@ -104,7 +99,7 @@ index 2a46bf5f3da8..785cd3d0e2b1 100644
 	    chip->info->ops->port_set_policy) {
 		err = chip->info->ops->port_set_policy(chip, port,
 						MV88E6XXX_POLICY_MAPPING_VTU,
-@@ -3491,7 +3496,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+@@ -3532,7 +3537,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
 	 */
 	err = mv88e6xxx_port_vlan_join(chip, port, MV88E6XXX_VID_STANDALONE,
 				       MV88E6XXX_G1_VTU_DATA_MEMBER_TAG_UNMODIFIED,
@@ -113,7 +108,7 @@ index 2a46bf5f3da8..785cd3d0e2b1 100644
 	if (err)
 		return err;
 
-@@ -3505,7 +3510,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+@@ -3546,7 +3551,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
 	 */
 	err = mv88e6xxx_port_vlan_join(chip, port, MV88E6XXX_VID_BRIDGED,
 				       MV88E6XXX_G1_VTU_DATA_MEMBER_TAG_UNMODIFIED,
@@ -159,6 +154,3 @@ index e13fb22e2c2b..f45e313f1dd0 100644
 	};
 	struct dsa_switch *ds = dp->ds;
 	struct netdev_hw_addr *ha;
-- 
-2.43.0
-
@@ -1,12 +1,9 @@
-From 1e19f28f4f44973f349ad8bbb2fe0f4624e3c0f3 Mon Sep 17 00:00:00 2001
+From 8eb1da2d6b87c0b997a1a9de6d0b964ff8a3134e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
-Subject: [PATCH 14/25] net: phy: marvell10g: Support firmware loading on
+Subject: [PATCH 14/35] net: phy: marvell10g: Support firmware loading on
 88X3310
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 When probing, if a device is waiting for firmware to be loaded into
 its RAM, ask userspace for the binary and load it over XMDIO.
@@ -14,8 +11,6 @@ its RAM, ask userspace for the binary and load it over XMDIO.
 We have no choice but to bail out of the probe if firmware is not
 available, as the device does not have any built-in image on which to
 fall back.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/phy/marvell10g.c | 161 +++++++++++++++++++++++++++++++++++
 1 file changed, 161 insertions(+)
@@ -239,6 +234,3 @@ index 6642eb642d4b..79d9483419c0 100644
 MODULE_DESCRIPTION("Marvell Alaska X/M multi-gigabit Ethernet PHY driver");
 +MODULE_FIRMWARE("mrvl/x3310fw.hdr");
 MODULE_LICENSE("GPL");
-- 
-2.43.0
-
@@ -1,18 +1,13 @@
-From 95ff23729224c6c08801c2dba8830b18c177431b Mon Sep 17 00:00:00 2001
+From c33528ebee1cd9f876b41a85f5435d6b37f1b511 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
-Subject: [PATCH 15/25] net: phy: marvell10g: Fix power-up when strapped to
+Subject: [PATCH 15/35] net: phy: marvell10g: Fix power-up when strapped to
 start powered down
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 On devices which are hardware strapped to start powered down (PDSTATE
 == 1), make sure that we clear the power-down bit on all units
 affected by this setting.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/phy/marvell10g.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)
@@ -48,6 +43,3 @@ index 79d9483419c0..268484092776 100644
 
 	/* Sometimes, the power down bit doesn't clear immediately, and
 	 * a read of this register causes the bit not to clear. Delay
-- 
-2.43.0
-
@@ -1,11 +1,8 @@
-From ecdfc7324dd50d79c81af453699467023d72e2bf Mon Sep 17 00:00:00 2001
+From b825b8b6490df0893c6172971db4a4ec45164ee9 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
-Subject: [PATCH 16/25] net: phy: marvell10g: Add LED support for 88X3310
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Subject: [PATCH 16/35] net: phy: marvell10g: Add LED support for 88X3310
+Organization: Wires

 Pickup the LEDs from the state in which the hardware reset or
 bootloader left them, but also support further configuration via
@@ -20,8 +17,6 @@ Trigger support:
 	   software blinking
 - "netdev": Offload link or duplex information to the solid behavior;
  	    tx and/or rx activity to blink behavior.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/phy/marvell10g.c | 422 +++++++++++++++++++++++++++++++++++
 1 file changed, 422 insertions(+)
@@ -515,6 +510,3 @@ index 268484092776..9f8475b67ef7 100644
 	},
 	{
 		.phy_id		= MARVELL_PHY_ID_88X3310,
-- 
-2.43.0
-
@@ -1,12 +1,9 @@
-From df3d8aede0c04a0ae93e0dc02ba6b471e3791500 Mon Sep 17 00:00:00 2001
+From a9248de91e771540c92774998111166732eba59a Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
-Subject: [PATCH 17/25] net: phy: marvell10g: Support LEDs tied to a single
+Subject: [PATCH 17/35] net: phy: marvell10g: Support LEDs tied to a single
 media side
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 In a combo-port setup, i.e. where both the copper and fiber interface
 are available to the user, the LEDs may be physically located either
@@ -17,8 +14,6 @@ tied to a particular media side, and use that information to refine
 the offloading of the "netdev" trigger, such that LEDs attached to the
 RJ45 jack only lights up when a copper link is established, and vice
 versa for the SFP cage.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/phy/marvell10g.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)
@@ -78,6 +73,3 @@ index 9f8475b67ef7..82b2e9b55b67 100644
 	/* mv3310_led_polarity_set() will not be called unless the
 	 * device tree specifies a mode that of_phy_led() considers to
 	 * be a non-default configuration. I.e., something other than
-- 
-2.43.0
-
@@ -1,11 +1,8 @@
-From f76443118313f681a62cf34a6f8b38f743832dff Mon Sep 17 00:00:00 2001
+From 9ca2c21e070baa0b3c7aca376f6bb9aaa0c801ea Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
-Subject: [PATCH 18/25] net: phy: Do not resume PHY when attaching
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Subject: [PATCH 18/35] net: phy: Do not resume PHY when attaching
+Organization: Wires

 The PHY should not start negotiating with its link-partner until
 explicitly instructed to do so.
@@ -18,17 +15,15 @@ Otherwise, drivers that attached to their PHYs during
 probing (e.g. DSA) would end up with a physical link being
 established, even though the corresponding interface was still
 administratively down.
-
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 drivers/net/phy/phy_device.c | 1 -
 1 file changed, 1 deletion(-)

 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 499797646580..0acfef4fe43e 100644
+index 8af44224480f..a2e386e9fafc 100644
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1634,7 +1634,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
+@@ -1661,7 +1661,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
 	if (err)
 		goto error;
 
@@ -36,6 +31,3 @@ index 499797646580..0acfef4fe43e 100644
 	if (!phydev->is_on_sfp_module)
 		phy_led_triggers_register(phydev);
 
-- 
-2.43.0
-
@@ -1,12 +1,9 @@
-From cd73e20a5c51dc26ab6a768a813ab805ad8b0689 Mon Sep 17 00:00:00 2001
+From 4a731f968cb458ea29e9fa0b710b87607d01c18b Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
-Subject: [PATCH 19/25] net: bridge: avoid classifying unknown multicast as
+Subject: [PATCH 19/35] net: bridge: avoid classifying unknown multicast as
 mrouters_only
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Organization: Addiva Elektronik
+Organization: Wires

 Unknown multicast, MAC/IPv4/IPv6, should always be flooded according to
 the per-port mcast_flood setting, as well as to detected and configured
@@ -19,7 +16,6 @@ Because a multicast router should always receive both known and unknown
 multicast.

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
-Signed-off-by: Mattias Walström <lazzer@gmail.com>
 ---
 include/uapi/linux/if_bridge.h |  1 +
 net/bridge/br.c                |  5 +++++
@@ -235,6 +231,3 @@ index 041f6e571a20..40651b07df94 100644
 static inline bool br_multicast_is_router(struct net_bridge_mcast *brmctx,
 					  struct sk_buff *skb)
 {
-- 
-2.43.0
-
--- a/Show More
+++ b/Show More