Merge pull request #986 from kernelkit/mvpp2-tcam-fix

Fix `mvpp2` TCAM memory corruption

.github/SECURITY.md

@@ -1,26 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-If you discover a security vulnerability in Infix, please use GitHub's built-in
-[Report a Vulnerability](https://github.com/kernelkit/infix/security/advisories/new)
-feature for a private and secure disclosure.
-
-When reporting, include:
-
-- A clear description of the vulnerability.
-- Steps to reproduce the issue.
-- Potential impact of the vulnerability.
-
-## Supported Versions
-
-We provide security updates only for the main branch.
-
-Individual support contracts are provided by _Wires_. See
-[Support](https://github.com/kernelkit/infix/blob/main/.github/SUPPORT.md)
-for more information.
-
-## Acknowledgments
-
-We appreciate the efforts of the security community to help improve the security
-of Infix. Thank you for your responsible disclosure.

.github/SUPPORT.md

@@ -6,7 +6,7 @@ project on GitHub, and Discord, see <https://github.com/kernelkit>:
 
 Support contracts, development of new features, fast-tracking of reviews
 and contributions, customer branding of Infix, and even customer specific
-features for dedicated products is provided by _Wires_.
+features for dedicated products is provided by Addiva Elektronik.
 
-&nbsp;&nbsp; :globe_with_meridians: <https://www.wires.se>  
-&nbsp;&nbsp; :e-mail: <mailto:infix@wires.se>
+&nbsp;&nbsp; :globe_with_meridians: <https://www.addiva.se/electronics/>  
+&nbsp;&nbsp; :e-mail: <mailto:ael@addiva.se>

.github/workflows/build-boot.yml

@@ -1,143 +0,0 @@
-name: Build Bootloaders
-
-on:
-  workflow_dispatch:
-    inputs:
-      branch:
-        description: 'Branch to build from'
-        default: 'main'
-        type: string
-
-jobs:
-  build:
-    name: Build ${{ matrix.defconfig }}
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        defconfig:
-          - fireant_boot
-          - cn9130_crb_boot
-          - aarch64_qemu_boot
-          - rpi4_boot
-    env:
-      MAKEFLAGS: -j5
-    steps:
-      - name: Cleanup Build Folder
-        run: |
-          ls -la ./
-          rm -rf ./* || true
-          rm -rf ./.??* || true
-          ls -la ./
-
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || github.ref }}
-          clean: true
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          defconfig=${{ matrix.defconfig }}
-          version=$(awk -F'"' '/BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE=/ {print $2}' configs/${defconfig}_defconfig)
-          version=${version:-git}
-          filename=$(echo "${defconfig}" | tr '_' '-')
-
-          # TODO: Replace hardcoded rev with actual revision stepping
-          rev="latest"
-
-          archive="${filename}-${version}-${rev}.tar.gz"
-          dirname="${filename}-${version}-${rev}"
-
-          echo "defconfig=${defconfig}" >> $GITHUB_OUTPUT
-          echo "version=${version}"     >> $GITHUB_OUTPUT
-          echo "rev=${rev}"             >> $GITHUB_OUTPUT
-          echo "archive=${archive}"     >> $GITHUB_OUTPUT
-          echo "dirname=${dirname}"     >> $GITHUB_OUTPUT
-
-          echo "Building ${defconfig}_defconfig, version ${version}-${rev}, artifact ${archive} ..."
-
-      - name: Restore Cache of dl/
-        uses: actions/cache@v4
-        with:
-          path: dl/
-          key: dl-boot-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-boot-
-            dl-
-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-boot-${{ matrix.defconfig }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-boot-${{ matrix.defconfig }}-
-            ccache-boot-
-            ccache-
-
-      - name: Configure ${{ matrix.defconfig }}_defconfig
-        run: |
-          make ${{ matrix.defconfig }}_defconfig
-
-      - name: Build ${{ matrix.defconfig }}_defconfig
-        run: |
-          echo "Building ${{ matrix.defconfig }}_defconfig ..."
-          make -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))
-
-      - name: Resulting size of build
-        run: |
-          printf "Size of output/images/: "
-          ls -l output/images/
-
-      - name: Prepare ${{ matrix.defconfig }} Artifact
-        run: |
-          cd output/
-          mv images ${{ steps.vars.outputs.dirname }}
-          tar cfz ${{ steps.vars.outputs.archive }} ${{ steps.vars.outputs.dirname }}/
-
-      - uses: actions/upload-artifact@v4
-        with:
-          path: output/${{ steps.vars.outputs.archive }}
-          name: artifact-${{ matrix.defconfig }}
-
-  publish:
-    name: Upload Bootloader Artifacts
-    runs-on: ubuntu-latest
-    needs: build
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
-      - uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest-boot"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Bootloader Build Complete! :rocket:
-
-          For the public download links of these bootloader artifacts, please see:
-           <https://github.com/kernelkit/infix/releases/tag/latest-boot>
-          EOF

.github/workflows/build.yml

@@ -1,57 +1,27 @@
-name: Build
+name: Bob the Builder
 
 on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches:
+      - main
   workflow_dispatch:
     inputs:
-      target:
-        description: "Build target (e.g. aarch64 or aarch64_minimal)"
-        default: "x86_64"
-        type: string
-      parallel:
-        description: 'Massive parallel build of each image'
+      minimal:
+        description: 'Build minimal defconfigs'
+        required: false
         default: true
         type: boolean
-      name:
-        description: "Name (for spin overrides)"
-        default: "infix"
-        type: string
-      infix_repo:
-        description: 'Repo to checkout (for spin overrides)'
-        default: kernelkit/infix
-        type: string
-
-  workflow_call:
-    inputs:
-      target:
-        required: true
-        type: string
-      name:
-        required: true
-        type: string
-      infix_repo:
-        required: false
-        type: string
-        default: kernelkit/infix
-      parallel:
-        required: false
-        type: boolean
-        default: false
-
-env:
-  NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
-  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
-  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
 
 jobs:
   build:
-    name: Build ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+    name: Build Infix ${{ matrix.target }}
     runs-on: [ self-hosted, latest ]
-    env:
-      PARALLEL: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.parallel == 'true' || github.event_name != 'workflow_dispatch' && inputs.parallel == true }}
     strategy:
+      matrix:
+        target: [aarch64, x86_64]
       fail-fast: false
-    outputs:
-      build_id: ${{ steps.vars.outputs.INFIX_BUILD_ID }}
     steps:
       - name: Cleanup Build Folder
         run: |
@@ -60,35 +30,34 @@ jobs:
           rm -rf ./.??* || true
           ls -la ./
 
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
         with:
-          repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
           clean: true
-          fetch-depth: 0
           submodules: recursive
 
       - name: Set Build Variables
         id: vars
         run: |
-          if [ -n "${{ github.event.pull_request.head.sha }}" ]; then
-              # Since PRs are built from an internally generated merge
-              # commit, reverse lookups of PRs and/or commits from
-              # image version information are cumbersome.  Therefore:
-              # explicitly set a build id that references both the PR
-              # and the commit.
-              printf "INFIX_BUILD_ID=pr%d.%.7s\n" \
-                  "${{ github.event.number }}" "${{ github.event.pull_request.head.sha }}" \
-                  | tee -a $GITHUB_OUTPUT $GITHUB_ENV
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+              if [ "${{ github.event.inputs.minimal }}" == "true" ]; then
+                  flavor="_minimal"
+              fi
+          else
+              # Ensure 'release' job get the proper image when building main
+              if [ "$GITHUB_REF_NAME" != "main" ]; then
+                  flavor="_minimal"
+              else
+                  flavor=""
+              fi
+              if ${{ contains(github.event.pull_request.labels.*.name, 'ci:main') }}; then
+                  flavor=""
+              fi
           fi
-
-          target=${{ env.TARGET }}
-          name=${{ env.NAME }}
-          echo "dir=${name}-${target}"        >> $GITHUB_OUTPUT
-          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
-          echo "Building target ${target}_defconfig"
-
+          target=${{ matrix.target }}
+          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+          echo "flv=$flavor"              >> $GITHUB_OUTPUT
+          echo "Building target ${target}${flavor}_defconfig"
       - name: Restore Cache of dl/
         uses: actions/cache@v4
         with:
@@ -101,37 +70,23 @@ jobs:
         uses: actions/cache@v4
         with:
           path: .ccache/
-          key: ccache-${{ env.TARGET }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
           restore-keys: |
-            ccache-${{ env.TARGET }}-
+            ccache-${{ matrix.target }}-
             ccache-
 
-      - name: Configure ${{ env.TARGET }}
+      - name: Configure ${{ matrix.target }}${{ steps.vars.outputs.flv }}
         run: |
-          make ${{ env.TARGET }}_defconfig
+          make ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig
 
-      - name: Unit Test ${{ env.TARGET }}
+      - name: Unit Test ${{ matrix.target }}
         run: |
           make test-unit
 
-      - name: Prepare parallel build
-        id: parallel
+      - name: Build ${{ matrix.target }}${{ steps.vars.outputs.flv }}
         run: |
-
-          if [ "$PARALLEL" == "true" ]; then
-             echo "BR2_PER_PACKAGE_DIRECTORIES=y" >> output/.config
-             MAKE="make -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
-             echo "Building in parallel with -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
-          else
-             echo "Disabling parallel build"
-             MAKE="make"
-          fi
-          echo "MAKE=$MAKE" >> $GITHUB_OUTPUT
-
-      - name: Build ${{ env.TARGET }}
-        run: |
-          echo "Building ${{ env.TARGET }}_defconfig ..."
-          eval "${{ steps.parallel.outputs.MAKE }}"
+          echo "Building ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
+          make
 
       - name:  Check SBOM from Build
         run: |
@@ -152,14 +107,100 @@ jobs:
           printf "Size of output/images/: "
           ls -l output/images/
 
-      - name: Prepare ${{ env.TARGET }} Artifact
+      - name: Prepare ${{ matrix.target }} Artifact
         run: |
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
       - uses: actions/upload-artifact@v4
         with:
           path: output/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ env.TARGET }}
+          name: artifact-${{ matrix.target }}
+
+  test:
+    name: Regression Test of Infix x86_64
+    needs: build
+    runs-on: [ self-hosted, regression ]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          clean: true
+          submodules: recursive
+
+      - name: Set Build Variables
+        id: vars
+        run: |
+          if [ "$GITHUB_REF_NAME" != "main" ]; then
+              flavor="_minimal"
+          else
+              flavor=""
+          fi
+          echo "flv=$flavor"              >> $GITHUB_OUTPUT
+
+      - name: Configure x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          make x86_64${{ steps.vars.outputs.flv }}_defconfig
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
+        run: |
+          ls -l
+          mkdir -p output
+          mv infix-x86_64.tar.gz output/
+          cd output/
+          tar xf infix-x86_64.tar.gz
+          ln -s infix-x86_64 images
+
+      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          make test
+
+      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: cat test/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+
+  release:
+    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
+    name: Upload Latest Build
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          omitName: true
+          omitBody: true
+          omitBodyDuringUpdate: true
+          prerelease: true
+          tag: "latest"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          artifacts: "*.tar.gz*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Latest Build Complete! :rocket:
+
+          For the public download links of these build artifacts, please see:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+          EOF

.github/workflows/coverity.yml

@@ -55,7 +55,7 @@ jobs:
           sudo apt-get -y update
           sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                        libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev
+                       libuev-dev libite-dev
 
       - name: Build dependencies
         run: |
@@ -65,8 +65,6 @@ jobs:
           git clone https://github.com/sysrepo/sysrepo.git
           mkdir sysrepo/build
           (cd sysrepo/build && cmake .. && make all && sudo make install)
-          git clone https://github.com/troglobit/libite.git
-          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
           make dep
 
       - name: Check applications

.github/workflows/docs.yml

@@ -1,67 +0,0 @@
-name: User Guide Generator
-
-on:
-  push:
-    branches:
-      - doc
-      - main
-    tags:
-      - 'v*'
-    paths:
-      - 'doc/**'
-      - 'mkdocs.yml'
-      - '.github/workflows/docs.yml'
-
-permissions:
-  contents: write
-
-concurrency:
-  group: "docs-${{ github.ref }}"
-  cancel-in-progress: false
-
-jobs:
-  docs:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.x'
-
-      - name: Install dependencies
-        run: |
-          pipx install mkdocs
-          pipx inject mkdocs mkdocs-material
-          pipx inject mkdocs pymdown-extensions
-          pipx inject mkdocs mkdocs-callouts
-          pipx inject mkdocs mike
-          pipx inject mkdocs mkdocs-to-pdf
-          # Workaround, if pipx inject fails to install symlink
-          ln -s "$(pipx environment -V PIPX_LOCAL_VENVS)/mkdocs/bin/mike" \
-                "$(pipx environment -V PIPX_BIN_DIR)/mike" || true
-
-      - name: Configure Git
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-
-      - name: Deploy dev version
-        if: github.event_name == 'push' && (github.ref == 'refs/heads/doc' || github.ref == 'refs/heads/main')
-        run: |
-          mike deploy --push --update-aliases dev latest
-          mike set-default --push latest
-
-      - name: Deploy tagged version
-        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-        run: |
-          TAG=${GITHUB_REF#refs/tags/v}
-          # Extract YEAR.MONTH from tag (e.g., v25.06.0-beta1 -> 25.06)
-          VERSION=$(echo $TAG | sed -E 's/^([0-9]+\.[0-9]+)(\.[0-9]+)?(-.*)?$/\1/')
-          echo "Deploying tag $TAG as docs version $VERSION"
-          mike deploy --push --update-aliases $VERSION latest
-          mike set-default --push latest

.github/workflows/generic-x86-build.yml

@@ -1,73 +0,0 @@
-name: Generic X86 GitHub Build
-
-on:
-  push:
-
-jobs:
-  build:
-    if: github.repository != 'kernelkit/infix'
-    name: Infix x86_64
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Install build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            bc binutils build-essential bzip2 cpio \
-            diffutils file findutils git gzip \
-            libncurses-dev libssl-dev perl patch \
-            python3 rsync sed tar unzip wget \
-            autopoint bison flex autoconf automake \
-            mtools
-
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
-        with:
-          repository: ${{ github.repository }}
-          ref: ${{ github.ref }}
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          echo "INFIX_BUILD_ID=${{ github.run_id }}" >> $GITHUB_OUTPUT
-          echo "dir=Infix-x86_64" >> $GITHUB_OUTPUT
-          echo "tgz=Infix-x86_64.tar.gz" >> $GITHUB_OUTPUT
-
-      - name: Configure x86_64_minimal
-        run: |
-          make x86_64_minimal_defconfig
-
-      - name: Unit Test x86_64
-        run: |
-          make test-unit
-
-      - name: Build x86_64_minimal
-        run: |
-          make
-
-      - name: Check SBOM
-        run: |
-          make legal-info
-
-      - name: Report Build Size
-        run: |
-          du -sh .
-          du -sh output
-          du -sh dl || true
-          ls -l output/images/
-
-      - name: Prepare Artifact
-        run: |
-          cd output/
-          mv images Infix-x86_64
-          ln -s Infix-x86_64 images
-          tar cfz Infix-x86_64.tar.gz Infix-x86_64
-
-      - uses: actions/upload-artifact@v4
-        with:
-          path: output/Infix-x86_64.tar.gz
-          name: artifact-x86_64
-

.github/workflows/publish.yml

@@ -1,44 +0,0 @@
-name: Publish latest Infix
-
-on:
-  workflow_dispatch:
-  workflow_call:
-
-jobs:
-  publish:
-    name: Upload Latest Build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
-      - uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          replacesArtifacts: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Latest Build Complete! :rocket:
-
-          For the public download links of these build artifacts, please see:
-           <https://github.com/kernelkit/infix/releases/tag/latest>
-          EOF

.github/workflows/release.yml

@@ -85,21 +85,16 @@ jobs:
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
           mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+          tar chfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
 
       - uses: actions/upload-artifact@v4
         with:
           name: artifact-${{ matrix.target }}
           path: output/*.tar.gz
 
-      - uses: actions/upload-artifact@v4
-        with:
-          name: artifact-disk-image-${{ matrix.target }}
-          path: output/images/*.qcow2
-
   release:
     name: Release Infix ${{ github.ref_name }}
     needs: build
@@ -146,11 +141,6 @@ jobs:
           for file in *.tar.gz; do
               sha256sum $file > $file.sha256
           done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi
 
       - name: Extract ChangeLog entry ...
         run: |
@@ -165,7 +155,7 @@ jobs:
           makeLatest: ${{ steps.rel.outputs.latest }}
           discussionCategory: ${{ steps.rel.outputs.cat }}
           bodyFile:  release.md
-          artifacts: "*.tar.gz*,*.qcow2*"
+          artifacts: "*.tar.gz*"
 
       - name: Summary
         run: |

.github/workflows/test.yml

@@ -1,110 +0,0 @@
-name: Test Infix
-
-on:
-  workflow_dispatch:
-    inputs:
-      infix_repo:
-        description: 'Repo to checkout (for spin overrides)'
-        required: false
-        default: kernelkit/infix
-        type: string
-
-  workflow_call:
-    inputs:
-      target:
-        required: true
-        type: string
-      name:
-        required: true
-        type: string
-      infix_repo:
-        required: false
-        type: string
-        default: kernelkit/infix
-      ninepm-conf:
-        required: false
-        type: string
-        default: ''
-      test-path:
-        required: false
-        type: string
-        default: 'test'
-
-env:
-  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
-  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
-  NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
-  TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}
-
-jobs:
-  test:
-    name: Regression Test ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
-    runs-on: [ self-hosted, regression ]
-    steps:
-      - name: Checkout infix repo
-        uses: actions/checkout@v4
-        with:
-          repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
-          clean: true
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
-              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
-                   >>$GITHUB_ENV
-          fi
-
-      - name: Configure ${{ env.TARGET }}
-        run: |
-          make ${{ env.TARGET }}_defconfig
-
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Restore ${{ env.TARGET }} output/
-        run: |
-          target=${{ env.TARGET }}
-          name=${{ inputs.name }}
-
-          ls -l
-          mkdir -p output
-          mv ${name}-${target}.tar.gz output/
-          cd output/
-          tar xf ${name}-${target}.tar.gz
-          ln -s ${name}-${target} images
-
-      - name: Regression Test ${{ env.TARGET }}
-        run: |
-          if [ -n "$NINEPM_CONF" ]; then
-            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
-            echo "DEBUG: NINEPM_PROJ_CONFIG is '$NINEPM_PROJ_CONFIG'"
-          fi
-          make test
-
-      - name: Publish Test Result for ${{ env.TARGET }} 
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Generate Test Report for ${{ env.TARGET }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: |
-          asciidoctor-pdf \
-          --theme $TEST_PATH/9pm/report/theme.yml \
-          -a pdf-fontsdir=$TEST_PATH/9pm/report/fonts \
-          $TEST_PATH/.log/last/report.adoc \
-          -o $TEST_PATH/.log/last/report.pdf
-
-      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-report
-          path: ${{ env.TEST_PATH }}/.log/last/report.pdf
-

.github/workflows/trigger.yml

@@ -1,38 +0,0 @@
-name: Kernelkit Trigger
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches:
-      - main
-      - ci-work
-  workflow_dispatch:
-
-jobs:
-  build-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
-    uses: ./.github/workflows/build.yml
-    with:
-      name: "infix"
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
-
-  build-aarch64:
-    if: startsWith(github.repository, 'kernelkit/')
-    uses: ./.github/workflows/build.yml
-    with:
-      name: "infix"
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'aarch64_minimal' || 'aarch64' }}
-
-  test-run-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
-    needs: build-x86_64
-    uses: ./.github/workflows/test.yml
-    with:
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
-      name: "infix"
-
-  test-publish-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
-    needs: test-run-x86_64
-    uses: ./.github/workflows/publish.yml

Config.in

@@ -65,7 +65,7 @@ config INFIX_COMPATIBLE
 
 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix OS — Immutable.Friendly.Secure"
+	default "Infix -- a Network Operating System"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.

README.md

@@ -2,69 +2,55 @@
 
 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 
-Turn any ARM or x86 device into a powerful, manageable network appliance
-in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
-routers, IoT gateways, edge devices, or custom network solutions that
-just work.
+Infix is a free, Linux based, immutable Network Operating System (NOS)
+built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
+porting to different platforms, simplify long-term maintenance, and
+provide made-easy management using NETCONF, RESTCONF[^2], or the
+built-in command line interface (CLI) from a console or SSH login.
 
-## Our Values
+> Click the **▶ Example CLI Session** foldout below for an example, or
+> head on over to the [Infix Documentation](doc/README.md) for more
+> information on how to set up the system.
 
-**🔒 Immutable**  
-Your system never breaks.  Read-only filesystem with atomic upgrades
-means no configuration drift, no corrupted updates, and instant rollback
-if something goes wrong.  Deploy once, trust forever.
+Although primarily focused on switches and routers, the core values
+may be appealing for other use-cases as well:
 
-**🤝 Friendly**  
-Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit `?` or TAB for
-context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
-[comprehensive documentation][4] mean you're never stuck.  Whether
-you're learning networking or managing enterprise infrastructure.
+- Runs from a squashfs image on a read-only partition
+- Single configuration file on a separate partition
+- Built around YANG with standard IETF models
+- Linux switchdev provides open switch APIs
+- Atomic upgrades to secondary partition
+- Highly security focused
 
-**🛡️ Secure**  
-Built with security as a foundation, not an afterthought.  Minimal
-attack surface, separation between system and data, and container
-isolation.  Sleep better knowing your infrastructure is protected.
+An immutable[^1] operating system enhances security and inherently makes
+it maintenance-free.  Configuration and data, e.g, containers, is stored
+on separate partitions to ensure complete separation from system files
+and allow for seamless backup, restore, and provisioning.
 
-## Why Choose Infix
+In itself, Infix is perfectly suited for dedicated networking tasks, and
+with native support for Docker containers, the operating system provides
+a versatile platform that can easily be adapted to any customer need.
+Be it legacy applications, network protocols, process monitoring, or
+edge data analysis, it can run close to end equipment.  Either directly
+connected on dedicated Ethernet ports or indirectly using virtual
+network cables to exist on the same LAN as other connected equipment.
 
-**Hardware Flexibility**: Start with a $35 Raspberry Pi, scale to
-enterprise switching hardware.  Same OS, same tools, same reliability.
+The simple design of Infix provides complete control over both system
+and data, minimal cognitive burden, and makes it incredibly easy to get
+started.
 
-**Standards-Based**: Built around YANG models and IETF standards. Learn
-once, use everywhere - no vendor lock-in.
+<details><summary><b>Example CLI Session</b></summary>
 
-**Container Ready**: Run your applications alongside networking
-functions.  GPIO access, dedicated Ethernet ports, custom protocols —
-your device, your rules.
+The CLI configure context is automatically generated from the loaded
+YANG models and their corresponding [sysrepo][2] plugins.  The following
+is brief example of how to set the IP address of an interface:
 
-## Use Cases
-
-1. **Home Labs & Hobbyists**:  
-   Transform a Raspberry Pi into a full-featured router with WiFi  
-1. **IoT & Edge Computing**:  
-   Bridge devices to the cloud with reliable, updatable gateways  
-1. **Small Business Networks**:  
-   Enterprise-grade features without the complexity or cost  
-1. **Developers & Makers**:  
-   Test networking concepts, prototype IoT solutions, or build custom
-   appliances
-1. **Network Professionals**:  
-   Consistent tooling from development to production deployment.  
-   How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
-
-## See It In Action
-
-Configure an interface in seconds - the CLI guides you with built-in help:
-
-<details><summary><b>Click Here for an example CLI Session</b></summary>
-
-```bash
+```
 admin@infix-12-34-56:/> configure
 admin@infix-12-34-56:/config/> edit interface eth0
 admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
       address     autoconf bind-ni-name      enabled
-      forwarding  mtu      neighbor
+	  forwarding  mtu      neighbor
 admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
 admin@infix-12-34-56:/config/interface/eth0/> show
 type ethernet;
@@ -73,6 +59,7 @@ ipv4 {
     prefix-length 24;
   }
 }
+ipv6
 admin@infix-12-34-56:/config/interface/eth0/> diff
 interfaces {
   interface eth0 {
@@ -95,65 +82,43 @@ lo              ethernet   UP          00:00:00:00:00:00
 admin@infix-12-34-56:/> copy running-config startup-config
 ```
 
-Notice how TAB completion shows available options, `show` displays
-current config, and `diff` shows exactly what changed before you
-commit your changes with the `leave` command.
-
+[Click here][3] for more details.
 </details>
 
-> [Full CLI documentation →][3]
+Infix can run on many different types of architectures and boards, much
+thanks to Linux and Buildroot.  Currently the focus is on 64-bit ARM
+devices, optionally with switching fabric supported by Linux switchdev.
+The [following boards](board/aarch64/README.md) are fully supported:
 
-## Get Started
+ - Marvell CN9130 CRB
+ - Marvell EspressoBIN
+ - Microchip SparX-5i PCB135 (eMMC)
+ - StarFive VisionFive2
+ - NanoPi R2S
 
-Get [pre-built images][5] for your hardware.  Use the CLI, web
-interface, or standard NETCONF/RESTCONF tools, e.g., `curl`.  Add
-containers for any custom functionality you need.
+An x86_64 build is also available, primarily intended for development
+and testing, but can also be used for evaluation and demo purposes.  For
+more information, see: [Infix in Virtual Environments](doc/virtual.md).
 
-### Supported Platforms
+> See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
+> page for our pre-built images.  The *[Latest Build][]* has bleeding
+> edge images, if possible we recommend using a versioned release.
+>
+> For *customer specific builds* of Infix, see your product repository.
 
-- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
-- **NanoPi R2S** - Compact dual-port router in a tiny package  
-- **x86_64** - Run in VMs or on mini PCs for development and testing
-- **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM platforms
-- **Microchip SparX-5i, NXP i.MX8MP EVK** - Enterprise switching capabilities
-- **StarFive VisionFive2** - RISC-V architecture support
+[^1]: An immutable operating system is one with read-only file systems,
+    atomic updates, rollbacks, declarative configuration, and workload
+    isolation.  All to improve reliability, scalability, and security.
+    For more information, see <https://ceur-ws.org/Vol-3386/paper9.pdf>
+    and <https://www.zdnet.com/article/what-is-immutable-linux-heres-why-youd-run-an-immutable-linux-distro/>.
 
-*Why start with Raspberry Pi?* It's affordable, widely available, has
-built-in WiFi + Ethernet, and runs the exact same Infix OS you'd deploy
-in production. Perfect for learning, prototyping, or even small-scale
-deployments.
+[^2]: Partial RESTCONF support, features like HTTP PATCH, OPTIONS, HEAD,
+    and copying between datastores are still missing.
 
-> 📖 **[Complete documentation][4]** • 💬 **[Join our Discord][discord-url]**
-
-## Technical Details
-
-Built on proven open-source foundations ([Buildroot][1] + [sysrepo][2])
-for reliability you can trust:
-
-- **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
-- **YANG Configuration**: Industry-standard models with auto-generated tooling
-- **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
-- **Container Integration**: Docker support with flexible network and hardware access
-- **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
-
-Perfect for everything from resource-constrained edge devices to
-high-throughput network appliances.
-
-> Check the *[Latest Build][]* for bleeding-edge features.
-
----
-
-<div align="center">
-  <a href="https://github.com/wires-se"><img src="https://raw.githubusercontent.com/wires-se/.github/main/profile/play.svg" width=300></a>
-  <br />Infix development is sponsored by <a href="https://wires.se">Wires</a>
-</div>
-
-[1]: https://buildroot.org/ "Buildroot Homepage"
-[2]: https://www.sysrepo.org/ "Sysrepo Homepage"
-[3]: https://kernelkit.org/infix/latest/cli/introduction/
-[4]: https://kernelkit.org/infix/
-[5]: https://github.com/kernelkit/infix/releases
-[Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
+[1]: https://buildroot.org/
+[2]: https://www.sysrepo.org/
+[3]: doc/cli/introduction.md
+[Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/

board/aarch64/README.md

@@ -7,48 +7,3 @@ Board Specific Documentation
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
 - [NanoPi R2S](r2s/)
-- [Raspberry Pi 4 b](#raspberry-pi-4-b)
-
-# Raspberry Pi 4 b
-
-## Support level
-Full support for base board but not any extension board on the
-GPIOs.
-
-### Touch screen
-The [Raspberry Pi touch display v1][RPI-TOUCH] is supported, including
-touch functionality. There are multiple touchscreens on the market for
-Raspberry Pi, but only the official (first version with 800x480
-resolution) is currently supported. Infix supplies all drivers
-required to utilize the hardware, but you need to add the actual
-graphical application in a container.
-
-There are some important considerations you need to know about when
-using Infix for graphical applications. The container needs access to
-/dev/dri/ to be able to access the graphics card, and it also needs
-access to /run/udev to be able to find the input devices.
-
-Example of running Doom in Infix:
-
-```cli
-	admin@example:/> configure
-	admin@example:/config/> edit container doom
-	admin@example:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
-	admin@example:/config/container/doom/> set privileged
-	admin@example:/config/container/doom/> edit mount udev
-	admin@example:/config/container/doom/mount/udev/> set type bind
-	admin@example:/config/container/doom/mount/udev/> set target /run/udev/
-	admin@example:/config/container/doom/mount/udev/> set source /run/udev/
-	admin@example:/config/container/doom/mount/udev/> end
-	admin@example:/config/container/doom/mount/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
-	admin@example:/config/container/doom/mount/xorg.conf/> set target /etc/X11/xorg.conf
-	admin@example:/config/container/doom/mount/xorg.conf/> end
-	admin@example:/config/container/doom/> edit volume var
-	admin@example:/config/container/doom/volume/var/> set target /var
-	admin@example:/config/container/doom/volume/var/> leave
-	admin@example:/>
-
-```
-
-
-[RPI-TOUCH]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/

board/aarch64/cn9130-crb/README.md

@@ -128,9 +128,5 @@ SD-card partition.
 > If possible, serve `infix-aarch64.pkg` over HTTP instead, as
 > libcurl's TFTP implementation is quite slow.
 
-## Console Port
-
-The console port runs at 115200 baud, 8N1.
-
 [release]: https://github.com/kernelkit/infix/releases
 [mvebu64boot]: https://github.com/addiva-elektronik/mvebu64boot

board/aarch64/dts/marvell/cn9130-crb-A.dts

@@ -3,7 +3,7 @@
  * Copyright (C) 2020 Marvell International Ltd.
  */
 
-#include "arm64/marvell/cn9130-crb.dtsi"
+#include "cn9130-crb.dtsi"
 
 / {
 	model = "Marvell Armada CN9130-CRB-A";

board/aarch64/dts/marvell/cn9130-patched.dtsi

@@ -1,4 +1,4 @@
-#include <arm64/marvell/cn9130.dtsi>
+#include "cn9130.dtsi"
 
 &cp0_syscon0 {
 	cp0_pinctrl: pinctrl {

board/aarch64/dts/microchip/sparx5_pcb135_emmc_no_psci.dts

@@ -5,7 +5,7 @@
  */
 
 /dts-v1/;
-#include <arm64/microchip/sparx5_pcb135_emmc.dts>
+#include "sparx5_pcb135_emmc.dts"
 
 &cpu0 {
 	enable-method = "spin-table";

board/aarch64/linux_defconfig

@@ -34,10 +34,6 @@ CONFIG_PROFILING=y
 CONFIG_ARCH_SPARX5=y
 CONFIG_ARCH_MVEBU=y
 CONFIG_ARCH_VEXPRESS=y
-CONFIG_ARM64_ERRATUM_2441007=y
-CONFIG_ARM64_ERRATUM_1286807=y
-CONFIG_ARM64_ERRATUM_1542419=y
-CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
 CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
@@ -61,7 +57,6 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CMA=y
-CONFIG_CMA_AREAS=7
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_XDP_SOCKETS=y
@@ -170,6 +165,7 @@ CONFIG_BRIDGE_EBT_REDIRECT=m
 CONFIG_BRIDGE_EBT_SNAT=m
 CONFIG_BRIDGE_EBT_LOG=m
 CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BPFILTER=y
 CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_BRIDGE_MRP=y
@@ -231,7 +227,6 @@ CONFIG_SCSI_SAS_ATA=y
 CONFIG_SCSI_VIRTIO=y
 CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
-CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
 CONFIG_AHCI_MVEBU=y
 CONFIG_PATA_OF_PLATFORM=y
@@ -287,7 +282,6 @@ CONFIG_NET_DSA_MV88E6XXX_PTP=y
 CONFIG_MVNETA=m
 CONFIG_MVPP2=m
 # CONFIG_NET_VENDOR_MELLANOX is not set
-# CONFIG_NET_VENDOR_META is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 CONFIG_SPARX5_SWITCH=y
 # CONFIG_NET_VENDOR_MICROSEMI is not set
@@ -359,14 +353,13 @@ CONFIG_SERIAL_XILINX_PS_UART=y
 CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
 CONFIG_SERIAL_MVEBU_UART=y
 CONFIG_VIRTIO_CONSOLE=y
-CONFIG_HW_RANDOM_CN10K=m
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_GPIO=y
 CONFIG_I2C_MUX_PCA954x=y
 CONFIG_I2C_MUX_PINCTRL=y
-CONFIG_I2C_DESIGNWARE_CORE=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_MV64XXX=y
 CONFIG_I2C_SLAVE=y
 CONFIG_SPI=y
@@ -502,7 +495,6 @@ CONFIG_EXTCON_USB_GPIO=y
 CONFIG_IIO=y
 CONFIG_TI_ADC081C=y
 CONFIG_PWM=y
-CONFIG_RESET_GPIO=y
 CONFIG_PHY_MVEBU_CP110_COMPHY=y
 CONFIG_PHY_MVEBU_CP110_UTMI=y
 CONFIG_PHY_SAMSUNG_USB2=y
@@ -531,13 +523,13 @@ CONFIG_9P_FS=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_SECURITY=y
-CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
 CONFIG_CRYPTO_SHA1_ARM64_CE=y
 CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0

board/aarch64/qemu/uboot/extras.config

@@ -1,3 +0,0 @@
-# QEMU-specific U-Boot config
-# Enable PCI MMC for QEMU virtualized environment
-CONFIG_MMC_PCI=y

board/aarch64/r2s/README.md

@@ -101,13 +101,6 @@ Worth noting, unlike many other boards, the Rockchip family of chipsets
 runs the UART at 1500000 bps (1.5 Mbps) 8N1.
 
 
-Console Port
-------------
-
-Unlike many other boards, the NanoPi R2S console, and in fact all
-Rockchip family chipsets, runs at 1500000 bps (1.5 Mbps) 8N1. 
-
-
 Secure Boot
 -----------
 

board/aarch64/r2s/linux_defconfig

@@ -230,6 +230,7 @@ CONFIG_MAC80211_LEDS=y
 CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
+# CONFIG_ETHTOOL_NETLINK is not set
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
@@ -480,6 +481,7 @@ CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_GPIO=m
 CONFIG_I2C_RK3X=y
 CONFIG_I2C_SLAVE=y

board/common/README.txt

@@ -45,11 +45,11 @@ The default credentials for the demo builds is
     login: admin
     password: admin
 
-    Infix OS — Immutable.Friendly.Secure v24.09.0-rc1 (hvc0)
+    Infix -- a Network Operating System v24.09.0-rc1 (hvc0)
     infix-00-00-00 login: admin
     Password: 
     .-------.
-    |  . .  | Infix OS — Immutable.Friendly.Secure
+    |  . .  | Infix -- a Network Operating System
     |-. v .-| https://kernelkit.org
     '-'---'-'
 
@@ -122,9 +122,9 @@ There's a lot of tutorials and guides online, start here:
 About
 -----
 
-Infix is a free, Linux-based, immutable operating system built around
-Buildroot, and sysrepo.  A powerful mix that ease porting to different
-platforms, simplify long-term maintenance, and provide easy management
-using NETCONF, RESTCONF, or the built-in command line interface (CLI)
-from a console or SSH login.
+Infix is a free, Linux based, immutable Network Operating System (NOS)
+built on Buildroot, and sysrepo.  A powerful mix that ease porting to
+different platforms, simplify long-term maintenance, and provide easy
+management using NETCONF, RESTCONF, or the built-in command line
+interface (CLI) from a console or SSH login.
 

board/common/busybox_defconfig

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.36.1
-# Sun Feb  9 12:25:37 2025
+# Tue Oct 22 13:12:02 2024
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -17,7 +17,7 @@ CONFIG_SHOW_USAGE=y
 CONFIG_FEATURE_VERBOSE_USAGE=y
 # CONFIG_FEATURE_COMPRESS_USAGE is not set
 CONFIG_LFS=y
-CONFIG_PAM=y
+# CONFIG_PAM is not set
 CONFIG_FEATURE_DEVPTS=y
 CONFIG_FEATURE_UTMP=y
 CONFIG_FEATURE_WTMP=y
@@ -325,7 +325,7 @@ CONFIG_FEATURE_STAT_FILESYSTEM=y
 CONFIG_STTY=y
 CONFIG_SUM=y
 CONFIG_SYNC=y
-CONFIG_FEATURE_SYNC_FANCY=y
+# CONFIG_FEATURE_SYNC_FANCY is not set
 CONFIG_FSYNC=y
 # CONFIG_TAC is not set
 CONFIG_TAIL=y
@@ -336,7 +336,7 @@ CONFIG_TEST=y
 CONFIG_TEST1=y
 CONFIG_TEST2=y
 CONFIG_FEATURE_TEST_64=y
-CONFIG_TIMEOUT=y
+# CONFIG_TIMEOUT is not set
 CONFIG_TOUCH=y
 CONFIG_FEATURE_TOUCH_SUSV3=y
 CONFIG_TR=y
@@ -357,7 +357,7 @@ CONFIG_BASE32=y
 CONFIG_BASE64=y
 CONFIG_UUENCODE=y
 CONFIG_WC=y
-CONFIG_FEATURE_WC_LARGE=y
+# CONFIG_FEATURE_WC_LARGE is not set
 CONFIG_WHO=y
 CONFIG_W=y
 CONFIG_USERS=y

board/common/mkdisk.sh

@@ -127,7 +127,7 @@ bootdata=
 diskimg=disk.img
 bootimg=
 bootpart=
-tmpimage=$(mktemp)
+
 while getopts "a:b:B:n:s:" opt; do
     case ${opt} in
 	a)
@@ -166,7 +166,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vdiskimg=$tmpimage \
+	  -vdiskimg=$diskimg \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -211,7 +211,5 @@ genimage \
     --rootpath "$root" \
     --tmppath  "$tmp" \
     --inputpath "$BINARIES_DIR" \
+    --outputpath "$BINARIES_DIR" \
     --config "$root/genimage.cfg"
-
-qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
-rm "$tmpimage"

board/common/mkrauc.sh

@@ -2,6 +2,8 @@
 
 set -e
 
+GIT_VERSION=$(git -C "$BR2_EXTERNAL_INFIX_PATH" describe --always --dirty --tags)
+
 name=$1
 compat=$2
 sign=$3
@@ -24,7 +26,7 @@ cp -f "$BINARIES_DIR/rootfs.itbh"     "$work/rootfs.itbh"
 cat >"$work/manifest.raucm" <<EOF
 [update]
 compatible=${compat}
-version=${INFIX_VERSION}
+version=${GIT_VERSION}
 
 [bundle]
 format=verity

board/common/post-build.sh

@@ -39,6 +39,22 @@ if [ -n "${ID_LIKE}" ]; then
     ID="${ID} ${ID_LIKE}"
 fi
 
+if [ -z "$GIT_VERSION" ]; then
+    infix_path="$BR2_EXTERNAL_INFIX_PATH"
+    if [ -n "$INFIX_OEM_PATH" ]; then
+	# Use version from br2-external OEM:ing Infix
+	infix_path="$INFIX_OEM_PATH"
+    fi
+    GIT_VERSION=$(git -C "$infix_path" describe --always --dirty --tags)
+fi
+
+# Override VERSION in /etc/os-release and filenames for release builds
+if [ -n "$INFIX_RELEASE" ]; then
+    VERSION="$INFIX_RELEASE"
+else
+    VERSION=$GIT_VERSION
+fi
+
 if [ -n "$INFIX_IMAGE_ID" ]; then
     NAME="$INFIX_IMAGE_ID"
 else
@@ -55,12 +71,12 @@ rm -f "$TARGET_DIR/etc/os-release"
 {
     echo "NAME=\"$INFIX_NAME\""
     echo "ID=$INFIX_ID"
-    echo "PRETTY_NAME=\"$INFIX_TAGLINE $INFIX_VERSION\""
+    echo "PRETTY_NAME=\"$INFIX_TAGLINE $VERSION\""
     echo "ID_LIKE=\"${ID}\""
     echo "DEFAULT_HOSTNAME=$BR2_TARGET_GENERIC_HOSTNAME"
-    echo "VERSION=\"${INFIX_VERSION}\""
-    echo "VERSION_ID=${INFIX_VERSION}"
-    echo "BUILD_ID=\"${INFIX_BUILD_ID}\""
+    echo "VERSION=\"${VERSION}\""
+    echo "VERSION_ID=${VERSION}"
+    echo "BUILD_ID=\"${GIT_VERSION}\""
     if [ -n "$INFIX_IMAGE_ID" ]; then
 	echo "IMAGE_ID=\"$INFIX_IMAGE_ID\""
     fi
@@ -86,7 +102,7 @@ rm -f "$TARGET_DIR/etc/os-release"
     fi
 } > "$TARGET_DIR/etc/os-release"
 
-echo "$INFIX_TAGLINE $INFIX_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
+echo "$INFIX_TAGLINE $VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
 
 # In case of ambguities, this is what the image was built from
 cp "$BR2_CONFIG" "$TARGET_DIR/usr/share/infix/config"
@@ -114,12 +130,6 @@ grep -qsE '^/bin/true$$' "$TARGET_DIR/etc/shells" \
 grep -qsE '^/bin/false$$' "$TARGET_DIR/etc/shells" \
         || echo "/bin/false" >> "$TARGET_DIR/etc/shells"
 
-boards=$(${BR2_EXTERNAL_INFIX_PATH}/board/common/selected-boards.sh ${BR2_EXTERNAL_INFIX_PATH} ${O})
-
-for board in $boards; do
-	[ ! -f "${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh" ] && continue
-	${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh
-done
 # Allow clish (symlink to /usr/bin/klish) to be a login shell
 grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
         || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"

board/common/post-image.sh

@@ -23,7 +23,7 @@ if [ -n "$IMAGE_ID" ]; then
 else
     NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
 fi
-diskimg=disk.qcow2
+diskimg=disk.img
 
 ver()
 {
@@ -48,7 +48,7 @@ fi
 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
     ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk$(ver).qcow2"
+    diskimg="${NAME}-disk$(ver).img"
     bootcfg=
     if [ "$DISK_IMAGE_BOOT_DATA" ]; then
 	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
@@ -86,27 +86,25 @@ if [ "$FIT_IMAGE" = "y" ]; then
     $common/mkfit.sh
 fi
 
-# Only for regular builds, not bootloader-only builds
 if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
     rel=$(ver)
     ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
     if [ -n "$rel" ]; then
-	ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
+	ln -sf "$BINARIES_DIR/${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
     fi
-
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
-
-    # Menuconfig support for modifying Qemu args in release tarballs
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
-    sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
-	-e "s/@DISK_IMG@/$diskimg/"   \
-	< "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in.in" \
-	> "$BINARIES_DIR/Config.in"
-    rm -f "$BINARIES_DIR/qemu.cfg"
-    CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
-	   "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
-    rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
-
-    # Quick intro for beginners, with links to more information
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"
 fi
+
+# Menuconfig support for modifying Qemu args in release tarballs
+cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
+cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
+sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
+    -e "s/@DISK_IMG@/$diskimg/"   \
+    < "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in.in" \
+    > "$BINARIES_DIR/Config.in"
+rm -f "$BINARIES_DIR/qemu.cfg"
+CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
+       "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
+rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
+
+# Quick intro for beginners, with links to more information
+cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"

board/common/qemu/Config.in.in

@@ -66,7 +66,7 @@ endchoice
 
 config QEMU_MACHINE
 	string "Select emulated machine"
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max" if QEMU_aarch64
 	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
@@ -78,7 +78,7 @@ config QEMU_MACHINE
 
 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
-	default "448M"
+	default "384M"
 	help
 	  The default, 384 MiB, works for most configurations.  However,
 	  if you get kernel panic with: "System is deadlocked on memory",

board/common/qemu/qemu.sh

@@ -120,7 +120,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
     elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=qemu.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
+	echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
     fi
 }
 
@@ -316,13 +316,13 @@ gdb_args()
 run_qemu()
 {
     if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	if ! qemu-img check "qemu.qcow2"; then
-	    rm -f "qemu.qcow2"
+	if ! qemu-img check "${CONFIG_QEMU_ROOTFS}.qcow2"; then
+	    rm -f "${CONFIG_QEMU_ROOTFS}.qcow2"
 	fi
-	if [ ! -f "qemu.qcow2" ]; then
+	if [ ! -f "${CONFIG_QEMU_ROOTFS}.qcow2" ]; then
 	    echo "Creating qcow2 disk image for Qemu ..."
 	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
-		     -F qcow2 "qemu.qcow2" > /dev/null
+		     -F raw "${CONFIG_QEMU_ROOTFS}.qcow2" > /dev/null
 	fi
     fi
 

board/common/rootfs/etc/avahi/avahi-autoipd.action

@@ -9,20 +9,46 @@
 #   $3 IP adddress
 
 PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
+NAME="/etc/frr/static.d/$2-zeroconf.conf"
+NEXT="${NAME}+"
 
 log()
 {
     logger -I $$ -t zeroconf -p user.notice "$*"
 }
 
+# Reduce changes needed by comparing with previous route(s)
+act()
+{
+    case $1 in
+	add)
+	    echo "! Generated by avahi-autoipd"  > "$NEXT"
+	    echo "ip route 0.0.0.0/0 $2 254"    >> "$NEXT"
+	    cmp -s "$NAME" "$NEXT" && return
+	    mv "$NEXT" "$NAME"
+	    ;;
+	del)
+	    [ -f "$NAME" ] || return
+	    rm "$NAME"
+	    ;;
+	*)
+	    return
+	    ;;
+    esac
+
+    initctl -nbq restart staticd
+}
+
 case "$1" in
     BIND)
         ip addr flush dev "$2" proto random
         ip addr add "$3"/16 brd 169.254.255.255 scope link dev "$2" proto random
+	act add "$2"
 	log "set ipv4ll $3 on iface $2"
         ;;
 
     CONFLICT|UNBIND|STOP)
+	act del "$2"
         ip addr flush dev "$2" proto random
 	log "clr ipv4ll on iface $2"
         ;;

board/common/rootfs/etc/dnsmasq.conf

@@ -3,19 +3,16 @@
 # and similar events feed servers and configuration to dnsmasq.
 domain-needed
 
-# Allow configuration and cache clear over D-Bus
-enable-dbus
+# Only listen to loopback (local system)
+interface=lo
+bind-dynamic
+#listen-address=127.0.0.1,::1
 
-# Disable the following dnsmasq default DHCP options
-#dhcp-option=option:netmask
-#dhcp-option=28			# option:broadcast
-#dhcp-option=option:domain-name
-dhcp-option=option:router
-dhcp-option=option:dns-server
-dhcp-option=12			# option:hostname
+enable-dbus
 
 # Generated by openresolv
 resolv-file=/var/lib/misc/resolv.conf
 
 # Include all files in a directory which end in .conf
 conf-dir=/etc/dnsmasq.d/,*.conf
+

board/common/rootfs/etc/finit.d/available/container@.conf

@@ -1,7 +1,4 @@
-# Start a container instance (%i) and redirect logs to /log/container
-# Give podman enough time to properly shut down the container, kill:30
-# The pre:script, which is responsibe for fetching a remote image, must
-# not have a timeout.  The cleanup should take no longer than a minute.
-sysv    log:prio:local1,tag:%i kill:30 pid:!/run/container:%i.pid \
-	pre:0,/usr/sbin/container cleanup:60,/usr/sbin/container   \
-	[2345] <!> :%i container -n %i -- container %i
+task    name:container-%i :setup \
+	[2345] container -n %i setup -- Setup container %i
+sysv    <!usr/container:%i> :%i pid:!/run/container:%i.pid log:prio:local1,tag:%i kill:10 \
+	[2345] container -n %i -- container %i

board/common/rootfs/etc/finit.d/available/mstpd.conf

@@ -1,9 +0,0 @@
-# A single mstpd instance can manage multiple bridges, which are
-# dynamically added/removed by the kernel via the /sbin/bridge-stp
-# usermode helper. We use a manual service so that confd can
-# enable/disable it without an initctl barrier, since it needs to
-# already be running when a bridge interface with spanning tree
-# enabled is created.
-
-service env:-/etc/default/mstpd manual:yes \
-	 [S0123456789] mstpd $MSTPD_ARGS -- Spanning Tree daemon

board/common/rootfs/etc/finit.d/available/ttyd.conf

@@ -1 +1 @@
-service [2345] <!> ttyd -i lo -W -p 8001 login -- Web terminal daemon (ttyd)
+service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)

board/common/rootfs/etc/finit.d/available/wifi@.conf

@@ -1,5 +0,0 @@
-service name:wpa_supplicant :%i \
-			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
-			       -- WPA supplicant @%i
-
-task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i

board/common/rootfs/etc/finit.d/enabled/mstpd.conf

@@ -1 +0,0 @@
-../available/mstpd.conf

board/common/rootfs/etc/motd

@@ -1,4 +1,4 @@
 .-------.
-|  . .  | Infix OS — Immutable.Friendly.Secure
+|  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.org
 '-'---'-'

board/common/rootfs/etc/ssh/sshd_config.d/var-keys.conf

@@ -0,0 +1,3 @@
+HostKey /var/lib/ssh/ssh_host_rsa_key
+HostKey /var/lib/ssh/ssh_host_ecdsa_key
+HostKey /var/lib/ssh/ssh_host_ed25519_key

board/common/rootfs/etc/sysctl.d/forwarding.conf

@@ -0,0 +1,3 @@
+net.ipv4.ip_forward=1
+net.ipv4.ip_forward_update_priority=0
+net.ipv6.conf.all.forwarding=1

board/common/rootfs/etc/sysctl.d/ipv4.conf

@@ -1,32 +1 @@
-# Router defaults
-net.ipv4.conf.default.rp_filter=0
-net.ipv4.conf.all.rp_filter=0
-
-net.ipv4.conf.lo.rp_filter=0
-
-net.ipv4.icmp_errors_use_inbound_ifaddr=1
-net.ipv4.conf.all.ignore_routes_with_linkdown=1
-
-# Use neigh information on selection of nexthop for multipath hops
-net.ipv4.fib_multipath_use_neigh=1
-
-# Sane ARP defaults for a switch/router
-net.ipv4.conf.default.arp_announce=2
-net.ipv4.conf.all.arp_announce=2
-
-net.ipv4.conf.default.arp_notify=1
-net.ipv4.conf.all.arp_notify=1
-
-net.ipv4.conf.default.arp_ignore=1
-net.ipv4.conf.all.arp_ignore=1
-
-# IP Routing
-net.ipv4.ip_forward=1
-net.ipv4.ip_forward_update_priority=0
-
 net.ipv4.conf.all.forwarding=0
-net.ipv4.conf.default.forwarding=0
-
-# Multicast group subscriptions
-net.ipv4.igmp_max_memberships=1000
-net.ipv4.neigh.default.mcast_solicit=10

board/common/rootfs/etc/sysctl.d/ipv6.conf

@@ -1,23 +1,5 @@
-# Router defaults
-net.ipv6.route.max_size=131072
-net.ipv6.conf.all.ignore_routes_with_linkdown=1
-
-# IP Routing is disabled by default, enabled globally, and per
-# interface, for each interface in confd.  See also accept_ra.
-net.ipv6.conf.all.forwarding=0
+net.ipv6.conf.all.forwarding=1
 net.ipv6.conf.default.forwarding=0
-
-# Accept router advertisements even when forwarding is enabled
-net.ipv6.conf.all.accept_ra=2
-net.ipv6.conf.default.accept_ra=2
-
-# IPv6 SLAAC
 net.ipv6.conf.all.autoconf=0
 net.ipv6.conf.default.autoconf=0
-
-# Keep permanent addresses on an admin down
-net.ipv6.conf.all.keep_addr_on_down=1
 net.ipv6.conf.default.keep_addr_on_down=1
-
-# Multicast group subscriptions
-net.ipv6.mld_max_msf=512

board/common/rootfs/etc/sysctl.d/readme.txt

@@ -1,145 +0,0 @@
-Many of the defaults here are are taken from the Frr recommendations [1].
-Below are relevant excerpts from the kernel documentation.
-
-
-accept_ra, accept Router Advertisements; autoconfigure using them, also
-           determines whether or not to transmit Router Solicitations.
-           If and only if the functional setting is to accept Router
-           Advertisements, Router Solicitations will be transmitted.
-
-  0 - Do not accept Router Advertisements.
-
-  1 - Accept Router Advertisements if forwarding is disabled.
-
-  2 - Overrule forwarding behaviour. Accept Router Advertisements even
-      if forwarding is enabled.
-
-  Default:
-    - enabled if local forwarding is disabled
-    - disabled if local forwarding is enabled
-
-
-accept_ra_pinfo, learn Prefix Information in Router Advertisement.
-
-   Default:
-    - enabled if accept_ra is enabled
-    - disabled if accept_ra is disabled
-
-
-autoconf, autoconfigure IPv6 addresses using Prefix Information in
-          Router Advertisements.
-
-   Default:
-    - enabled if accept_ra_pinfo is enabled
-    - disabled if accept_ra_pinfo is disabled
-
-
-arp_announce, define restriction level for announcing the local source
-              address from IP packets in ARP requests sent on interface:
-
-  0 - (default) Use any local address, configured on any interface
-
-  1 - Try to avoid local addresses that are not in the target’s subnet
-      for this interface.  Useful when target hosts reachable via this
-      interface require the source IP address in ARP requests to be part
-      of their logical network configured on the receiving interface.
-      When we generate the request we will check all our subnets that
-      include the target IP and will preserve the source address if it
-      is from such subnet. If there is no such subnet we select source
-      address according to the rules for level 2.
-
-  2 - Always use the best local address for this target. In this mode we
-      ignore the source address in the IP packet and try to select local
-      address that we prefer for talks with the target host. Such local
-      address is selected by looking for primary IP addresses on all our
-      subnets on the outgoing interface that include the target address.
-      If no suitable local address is found we select the first local
-      address we have on the outgoing interface or on all other
-      interfaces, with the hope we will receive reply for our request
-      and even sometimes no matter the source IP address we announce.
-
-
-arp_notify, define mode for notification of address and device changes.
-
-  0 - (default): do nothing
-  1 - generate gratuitous arp requests when device is brought up or
-      hardware address changes.
-
-
-arp_ignore, define different modes for sending replies in response to
-            received ARP requests that resolve local target addresses:
-
-  0 - (default): reply for any local target IP address, configured on
-      any interface
-
-  1 - reply only if the target IP address is a local address configured
-      on the incoming interface
-
-  2 - reply only if the target IP address is local address configured on
-      the incoming interface and both with the sender’s IP address are part
-      from same subnet on this interface
-
-  3 - do not reply for local addresses configured with scope host, only
-      resolutions for global and link addresses are replied
-
-  4-7 - reserved
-
-  8 - do not reply for all local addresses
-
-
-arp_accept, define behavior for accepting gratuitous ARP (garp) frames
-      from devices that are not already present in the ARP table:
-
-  0 - don’t create new entries in the ARP table
-
-  1 - create new entries in the ARP table
-
-  2 - create new entries only if the source IP address is in the same
-      subnet as an address configured on the interface that received
-      the garp message.
-
-  Both replies and requests type gratuitous arp will trigger the ARP
-  table to be updated, if this setting is on.  If the ARP table already
-  contains the IP address of the gratuitous arp frame, the arp table
-  will be updated regardless if this setting is on or off.
-
-
-icmp_errors_use_inbound_ifaddr
-
-  0 - (default): icmp error messages are sent with the primary address
-      of the exiting interface.
-
-  1 - the message will be sent with the primary address of the interface
-      that received the packet that caused the icmp error. This is the
-      behaviour many network administrators will expect from a router.
-      And it can make debugging complicated network layouts much easier.
-
-  Note, if no primary address exists for the interface selected, then
-  the primary address of the first non-loopback interface that has one
-  will be used regardless of this setting.
-
-
-rp_filter, reverse path source filtering:
-
-  0 - (default): no source validation.
-
-  1 - Strict mode as defined in RFC3704, 'Strict Reverse Path'.  Each
-      incoming packet is tested against the FIB and if the interface is
-      not the best reverse path the packet check will fail.  By default
-      failed packets are discarded.
-
-  2 - Loose mode as defined in RFC3704, 'Loose Reverse Path'.  Each
-      incoming packet’s source address is also tested against the FIB
-      and if the source address is not reachable via any interface the
-      packet check will fail.
-
-  Current recommended practice in RFC3704 is to enable strict mode to
-  prevent IP spoofing from DDos attacks. If using asymmetric routing or
-  other complicated routing, then loose mode is recommended.
-
-  The max value from conf/{all,interface}/rp_filter is used when doing
-  source validation on the {interface}.
-
-
-
-[1]: https://github.com/FRRouting/frr/blob/master/doc/user/Useful_Sysctl_Settings.md

board/common/rootfs/etc/udev/rules.d/70-rename-wifi.rules

@@ -1 +0,0 @@
-SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"

board/common/rootfs/etc/watchdogd.conf

@@ -1,165 +0,0 @@
-# /etc/watchdogd.conf sample
-# Commented out values are program defaults.
-#
-# The checker/monitor `warning` and `critical` levels are 0.00-1.00,
-# i.e. 0-100%, except for load average which can vary a lot between
-# systems and use-cases, not just because of the number of CPU cores.
-# Use the `script = ...` setting to call script when `warning` and
-# `critical` are reached for a monitor.  In `critical` the monitor
-# otherwise triggers an unconditional reboot.
-#
-# NOTE: `critical` is optional, omitting it disables the reboot action.
-#
-
-### Watchdogs ##########################################################
-# Global settings that can be overridden per watchdog
-
-# Do not set WDT timeout and kick interval too low, the daemon runs at
-# SCHED_OTHER level with all other tasks, unless the process supervisor
-# is enabled.  The monitor plugins (below) need CPU time as well.
-#timeout   = 20
-#interval  = 10
-
-# With safe-exit enabled (true) the daemon will ask the driver disable
-# the WDT before exiting (SIGINT).  However, some WDT drivers (or HW)
-# may not support this.
-#safe-exit = true
-
-# Multiple watchdogs can be kicked, the default, even if no .conf file
-# is found or device node given on the command line, is /dev/watchdog
-device /dev/watchdog {
-    timeout    = 60
-    interval   = 5
-    safe-exit  = true
-}
-
-#device /dev/watchdog2 {
-#    timeout    = 20
-#    interval   = 10
-#    safe-exit  = true
-#}
-
-### Supervisor #########################################################
-# Instrumented processes can have their main loop supervised.  Processes
-# subscribe to this service using the libwdog API, see the docs for more
-# on this.  When the supervisor is enabled and the priority is set to a
-# value > 0, watchdogd runs as a SCHED_RR process with elevated realtime
-# priority.  When disabled, or the priority is set to zero (0), it runs
-# as a regular SCHED_OTHER process, this is the default.
-#
-# When a supervised process fails to meet its deadline, the daemon will
-# perform an unconditional reset having saved the reset reason.  If a
-# script is provided in this section it will be called instead.  The
-# script is called as:
-#
-#    script.sh supervisor CODE PID LABEL
-#
-# Availabel CODEs for the reset reason are avilable in wdog.h
-#
-#supervisor {
-#    !!!REMEMBER TO ENABLE reset-reason (below) AS WELL!!!
-#    enabled  = true
-#    priority = 98
-#    script = "/path/to/supervisor-script.sh"
-#}
-
-### Reset reason #######################################################
-# The following section controls if/how the reset reason & reset counter
-# is tracked.  By default this is disabled, since not all systems allow
-# writing to disk, e.g. embedded systems using MTD devices with limited
-# number of write cycles.
-#
-# The default file setting is a non-volatile path, according to the FHS.
-# It can be changed to another location, but make sure that location is
-# writable first.
-reset-reason {
-    enabled = true
-    file    = "/var/lib/misc/watchdogd.state"
-}
-
-### Checkers/Monitors ##################################################
-#
-# Script or command to run instead of reboot when a monitor plugin
-# reaches any of its critical or warning level.  Setting this will
-# disable the built-in reboot on critical, it is therefore up to the
-# script to perform reboot, if needed.  The script is called as:
-#
-#    script.sh {filenr, fsmon, loadavg, meminfo} {crit, warn} VALUE
-#
-#script = "/path/to/reboot-action.sh"
-
-# Monitors file descriptor leaks based on /proc/sys/fs/file-nr
-filenr {
-#    enabled = true
-    interval = 300
-    logmark  = false
-    warning  = 0.9
-    critical = 1.0
-#    script = "/path/to/alt-reboot-action.sh"
-}
-
-# Monitors a file system, blocks and inode usage against watermarks
-# The script is called with fsmon as the first argument and there
-# are two environment variables FSMON_NAME, for the monitored path,
-# and FSMON_TYPE indicating either 'blocks' or 'inodes'.
-#fsmon /var {
-#    enabled = true
-#    interval = 300
-#    logmark  = false
-#    warning  = 0.95
-#    critical = 1.0
-#    script = "/path/to/alt-reboot-action.sh"
-#}
-
-# Monitors load average based on sysinfo() from /proc/loadavg
-# The level is composed from the average of the 1 and 5 min marks.
-loadavg {
-#    enabled = true
-    interval = 300
-    logmark  = false
-    warning  = 1.0
-    critical = 2.0
-#    script = "/path/to/alt-reboot-action.sh"
-}
-
-# Monitors free RAM based on data from /proc/meminfo
-meminfo {
-#    enabled = true
-    interval = 300
-    logmark  = false
-    warning  = 0.9
-    critical = 0.95
-#    script = "/path/to/alt-reboot-action.sh"
-}
-
-# Monitor temperature.  The critical value is unset by default, so no
-# action is taken at that watermark (by default).  Both the critical and
-# warning watermarks are relative to the trip/critical/max value from
-# sysfs.  The warning is default 0.9, i.e., 90% of critical.  Use script
-# to to reset the fan controller or poweroff(8) the system.
-#
-# Each temp monitor caches the last 10 values, calculates the mean, and
-# compares that to the warning and critical levels.  Logging is only
-# done every 10 x interval (if enabled).
-#tempmon /sys/class/hwmon/hwmon0/temp1_input {
-#    enabled  = true
-#    interval = 30
-#    warning  = 0.9
-#    critical = 0.95
-#    logmark  = true
-#    script   = "/script/to/log/and/poweroff.sh"
-#}
-
-# Monitor a generic script, executes 'monitor-script' every 'interval'
-# seconds, with a max runtime of 'timeout' seconds.  When the exit code
-# of the monitor script is above the critical level watchdogd either
-# starts the reboot, or calls the alternate 'script' to determin the
-# next cause of action.
-#generic /path/to/monitor-script.sh {
-#    enabled = true
-#    interval = 300
-#    timeout = 60
-#    warning  = 1
-#    critical = 10
-#    script = "/path/to/alt-reboot-action.sh"
-#}

board/common/rootfs/usr/bin/dir

@@ -21,11 +21,7 @@ dir()
 if [ -d "$1" ]; then
     dir "$1"
 else
-    if [ "$USER" = "root" ]; then
-	dir "$HOME"
-    else
-	dir "/home/$USER"
-    fi
+    dir "$HOME"
     dir "/cfg"
     dir "/log"
 fi

board/common/rootfs/usr/bin/show

@@ -70,14 +70,12 @@ options:
   -p            Show plain output, no bells or whistles
 
 commands:
-  dhcp          Show DHCP server
   port PORT     Show port configuration and link information
   ports         Show ports available for bridging
   vlans         Show port groups in bridge
   ifaces        Show interfaces and their addresses
   fdb           Show forwarding database (unicast)
   mdb           Show multicast forwarding database
-  stp           Show spanning tree status
   ip   addr     Show IPv4 addresses
        route    Show routing table
   ipv6 addr     Show IPv6 addresses
@@ -89,41 +87,6 @@ commands:
 EOF
 }
 
-is_dhcp_running()
-{
-    sysrepocfg -X -f json -m infix-dhcp-server | jq -r '
-        ."infix-dhcp-server:dhcp-server".enabled as $global |
-        if ."infix-dhcp-server:dhcp-server".subnet? then
-                (."infix-dhcp-server:dhcp-server".subnet[] |
-                select(.enabled != false)) |
-                if $global != false and . then "true" else "false" end
-        else "false" end
-    ' 2>/dev/null | grep -q true
-}
-
-dhcp()
-{
-    if ! is_dhcp_running; then
-	echo "DHCP server not enabled."
-	exit 0
-    fi
-
-    case $1 in
-	detail)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
-		jq -C .
-	    ;;
-	stat*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
-		/usr/libexec/statd/cli-pretty "show-dhcp-server" -s
-	    ;;
-	*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
-		/usr/libexec/statd/cli-pretty "show-dhcp-server"
-	    ;;
-    esac
-}
-
 # Usage 1: show port eth0
 # Usage 2: show port
 # Usage 3: show ports
@@ -225,12 +188,6 @@ rstp()
     mstpctl showport br0
 }
 
-stp()
-{
-    sysrepocfg -f json -X -d operational -m ietf-interfaces | \
-        /usr/libexec/statd/cli-pretty "show-bridge-stp"
-}
-
 fdb()
 {
     bridge $bopt fdb show
@@ -331,9 +288,6 @@ case $cmd in
     help)
 	usage
 	;;
-    dhcp | dhcp-server)
-	dhcp $*
-	;;
     port*)
 	ports $*
 	;;
@@ -399,9 +353,6 @@ case $cmd in
     span*)
 	rstp
 	;;
-    stp*)
-	stp
-	;;
     sys*)
 	system
 	;;

board/common/rootfs/usr/libexec/infix/has-quirk

@@ -1,12 +0,0 @@
-#!/bin/sh
-if [ $# -lt 2 ]; then
-        echo "usage: $0 <quirk-name> <ifname>"
-        exit 1
-fi
-quirk=$1
-ifname=$2
-if [ -f "/etc/product/interface-quirks.json" ]; then
-        echo "$(jq -r --arg iface "$ifname" --arg quirk "$quirk" '.[$iface][$quirk] // "false"' /etc/product/interface-quirks.json)"
-else
-        echo "false"
-fi

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -308,52 +308,16 @@ def probe_qemusystem(out):
     subprocess.run("initctl -nbq cond set qemu".split(), check=False)
     return 0
 
-def rasberry_pi_4_usb_ports(out):
-    out["usb-ports"] = [
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized"
-        },
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized_default"
-        },
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-1/authorized",
-        },
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-0:1.0/authorized"
-        },
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized"
-        },
-        {
-            "name": "USB",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized_default"
-        },
-        {
-            "name": "USB3",
-            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/2-0:1.0/authorized"
-        }
-    ]
 
 def probe_dtsystem(out):
     """Probe DTS based system, expects a VPD in ONIE PROM format."""
     dtsys = DTSystem()
     vpds = dtsys.infix_vpds()
-
+    dtsys.infix_usb_devices(out)
     model = dtsys.base.str("model")
     if model:
         out["product-name"] = model
 
-    # Since rpi4 has USB on PCIe, there is no phandle reference
-    if model and model.startswith("Raspberry Pi 4"):
-        rasberry_pi_4_usb_ports(out)
-    else:
-        dtsys.infix_usb_devices(out)
     out["compatible"] = dtsys.base.str_array("compatible")
 
     staticpw = dtsys.infix.str("factory-password-hash")

board/common/rootfs/usr/libexec/infix/init.d/05-product

@@ -39,10 +39,8 @@ fi
 # init scripts to prevent select services from starting.
 initctl -nbq cond set led
 
-if [ -d "$PRODUCT_INIT" ]; then
-    note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
-    /usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
-fi
+note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
+/usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
 
 # Product specific init done.
 initctl -nbq cond set product

board/common/rootfs/usr/libexec/infix/init.d/25-mqprio

@@ -43,7 +43,6 @@ while [ "$1" ]; do
     txqs="$2"
     shift 2
 
-    [ $(/usr/libexec/infix/has-quirk "broken-mqprio" "$iface") = "true" ] && echo "Skipping $iface, does not support mqprio" && continue
     [ $txqs -lt 2 ] && continue
     [ $txqs -gt 8 ] && txqs=8
 

board/common/rootfs/usr/libexec/infix/init.d/25-qemu

@@ -1,8 +0,0 @@
-#!/bin/sh
-# Initialize speed/duplex of virtio interfaces
-# For virtual test systems (lacp tests)
-
-ifaces=$(ip -d -json link show | jq -r '.[] | select(.parentbus == "virtio") | .ifname')
-for iface in $ifaces; do
-    ethtool -s "$iface" speed 1000 duplex full
-done

board/common/rootfs/usr/libexec/infix/init.d/30-cfg-migrate

@@ -4,14 +4,10 @@
 # the migrate tool inserts old version in name before .cfg extension.
 CONFIG_FILE="/cfg/startup-config.cfg"
 BACKUP_FILE="/cfg/backup/startup-config.cfg"
-BACKUP_DIR="$(dirname "$BACKUP_FILE")"
-
-mkdir -p         "$BACKUP_DIR"
-chown root:wheel "$BACKUP_DIR"
-chmod 0770       "$BACKUP_DIR"
+mkdir -p "$(dirname "$BACKUP_FILE")"
 
 if [ ! -f "$CONFIG_FILE" ]; then
-    logger -I $$ -k -p user.notice -t $(basename "$0")  "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
+    note "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
     exit 0
 elif migrate -cq "$CONFIG_FILE"; then
     exit 0

board/common/rootfs/usr/libexec/infix/mksshkey

@@ -1,24 +0,0 @@
-#!/bin/bash
-# Store and convert RSA PUBLIC/PRIVATE KEYs to be able to use them in
-# OpenSSHd.
-set -e
-
-NAME="$1"
-DIR="$2"
-PUBLIC="$3"
-PRIVATE="$4"
-TMP="$(mktemp)"
-
-echo -e '-----BEGIN RSA PRIVATE KEY-----' > "$DIR/$NAME"
-echo "$PRIVATE" >> "$DIR/$NAME"
-echo -e '-----END RSA PRIVATE KEY-----' >> "$DIR/$NAME"
-
-echo -e "-----BEGIN RSA PUBLIC KEY-----" > "$TMP"
-echo -e "$PUBLIC" >> "$TMP"
-echo -e "-----END RSA PUBLIC KEY-----" >> "$TMP"
-
-ssh-keygen -i -m PKCS8 -f "$TMP" > "$DIR/$NAME.pub"
-chmod 0600 "$DIR/$NAME.pub"
-chmod 0600 "$DIR/$NAME"
-chown sshd:sshd "$DIR/$NAME.pub"
-chown sshd:sshd "$DIR/$NAME"

board/common/rootfs/usr/libexec/infix/wifi-scanner

@@ -1,16 +0,0 @@
-#!/bin/sh
-
-if [ $# -ne 1 ]; then
-	echo "usage: $0 <ifname>"
-	exit 1
-fi
-ifname=$1
-
-TIMEOUT=300
-status=$(wpa_cli -i $ifname scan)
-while [ "$status" != "OK" ]; do
-	status=$(wpa_cli -i $ifname scan)
-	TIMEOUT=$((TIMEOUT-1))
-	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
-	sleep 0.5
-done

board/common/rootfs/usr/sbin/container

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 # This script can be used to start, stop, create, and delete containers.
 # It is what confd use, with the Finit container@.conf template, to set
 # up, run, and delete containers.
@@ -8,8 +8,7 @@
 #
 DOWNLOADS=/var/lib/containers/oci
 BUILTIN=/lib/oci
-BASEDIR=/var/tmp
-container=$0
+TMPDIR=/var/tmp
 checksum=""
 extracted=
 timeout=30
@@ -29,21 +28,16 @@ err()
     rc=$1; shift
     logger -I $PPID -t container -p local1.err -- "Error: $*"
 
-    if [ -n "$extracted" ] && [ -n "$tmpdir" ]; then
-	if [ -d "$tmpdir" ]; then
-	    log "Cleaning up temporary directory $tmpdir"
-	    rm -rf "$tmpdir"
+    if [ -n "$extracted" ]; then
+	if [ -d "$TMPDIR/$dir" ]; then
+	    log "Cleaning up extracted $dir"
+	    rm -rf "$dir"
 	fi
     fi
 
     [ "$rc" -eq 0 ] || exit "$rc"
 }
 
-pidfn()
-{
-    echo "/run/containers/${1}.pid"
-}
-
 check()
 {
     file=$1
@@ -110,40 +104,38 @@ EOF
     return 1
 }
 
-# Extracts an oci-archive.tar[.gz] in a temporary directory.  Finds and
-# sanity checks that at least one index.json exist in the archive. This
-# is the OCI directory fed to `podman load` and also used as repo name.
-# NOTE: if there are >1 index.json, this function does not handle them.
-load_archive()
+# Unpacks a given oci-archive.tar[.gz] in the current directory.  Sanity
+# checks, at least one index.json in the top-level dir of the archive.
+# If there are more index files, this function does not handle them.
+unpack_archive()
 {
-    uri=$1
-    tag=$2
-    img=$(basename "$uri")
+    image=$1
+    name=$2
 
     # Supported transports for load and create
-    case "$uri" in
+    case "$image" in
 	oci:*)			# Unpacked OCI image
-	    file=${uri#oci:}
+	    file=${image#oci:}
 	    ;;
 	oci-archive:*)		# Packed OCI image, .tar or .tar.gz format
-	    file=${uri#oci-archive:}
+	    file=${image#oci-archive:}
 	    ;;
 	ftp://* | http://* | https://*)
-            if ! file=$(fetch "$uri"); then
+            if ! file=$(fetch "$image"); then
 		return 1
 	    fi
             ;;
 	*)			# docker://*, docker-archive:*, or URL
-	    if podman image exists "$img"; then
-		echo "$img"
+	    if podman image exists "$image"; then
+		echo "$image"
 		return 0
 	    fi
 	    # XXX: use --retry=0 with Podman 5.0 or later.
-	    if ! id=$(podman pull --quiet "$uri"); then
-		log "Failed pulling $uri"
+	    if ! id=$(podman pull --quiet "$image"); then
+		log "Failed pulling $image"
 		return 1
 	    fi
-	    # Echo image tag to caller
+	    # Echo image name to caller
 	    podman images --filter id="$id" --format "{{.Repository}}:{{.Tag}}"
 	    return 0
 	    ;;
@@ -155,94 +147,62 @@ load_archive()
 	elif [ -e "$BUILTIN/$file" ]; then
 	    file="$BUILTIN/$file"
 	else
-	    err 1 "cannot find OCI archive $file in URI $uri"
+	    err 1 "cannot find OCI archive $file in search path."
 	fi
     fi
 
-    file=$(realpath "$file")
     if [ -d "$file" ]; then
 	index=$(find "$file" -name index.json)
 	if [ -z "$index" ]; then
 	    err 1 "cannot find index.json in OCI image $file"
 	fi
     else
-	# Extract files in a temporary directory, because most OCI
-	# archives are flat/bare, all files in the root w/o a dir/
-	tmpdir=$(mktemp -d -p "$BASEDIR") || err 1 "failed creating temporary directory"
-	cd "$tmpdir" || err 1 "failed cd to temporary directory $tmpdir"
+	cd "$TMPDIR" || err 0 "failed cd $TMPDIR, wiill use $(pwd) for OCI archive extraction."
 
-	index="$tmpdir/$(tar tf "$file" |grep index.json)"
+	index=$(tar tf "$file" |grep index.json)
 	if [ -z "$index" ]; then
 	    err 1 "invalid OCI archive, cannot find index.json in $file"
 	fi
 
 	[ -n "$quiet" ] || log "Extracting OCI archive $file ..."
-        tar xf "$file"  || err 1 "failed unpacking $file in $tmpdir"
+        tar xf "$file"  || err 1 "failed unpacking $file in $(pwd)"
 	extracted=true
-	cd - >/dev/null || err 0 "failed cd -"
     fi
 
     dir=$(dirname "$index")
-
-    # Handle flat tarballs without a sub-directory, because
-    # the $dir name is used as fallback when retagging below.
-    if [ -n "$extracted" ] && [ "$dir" = "$tmpdir" ]; then
-	parent=$(dirname "$dir")
-	dirnam=$(echo "$img" | sed 's/\(.*\)\.tar.*/\1/')
-	tmpdir="${parent}/${dirnam}"
-	mv "$dir" "$tmpdir"
-	dir="$tmpdir"
-    fi
-
-    if basename "$dir" | grep -q ":"; then
-        if [ -z "$tag" ]; then
-            tag=$(basename "$dir")
+    if echo "$dir" | grep -q ":"; then
+        if [ -z "$name" ]; then
+            name="$dir"
         fi
-
         sanitized_dir=$(echo "$dir" | cut -d':' -f1)
         mv "$dir" "$sanitized_dir" || err 1 "failed renaming $dir to $sanitized_dir"
         dir="$sanitized_dir"
     fi
 
     [ -n "$quiet" ] || log "Loading OCI image $dir ..."
-    output=$(podman load -qi "$dir")
-
-    # Extract image ID from podman load output:
-    # "Loaded image: sha256:cd9d0aaf81be..."
-    if echo "$output" | grep -q "sha256:"; then
-	img_id="${output##*sha256:}"
-    else
-	# Fallback to directory name if no SHA found
-	img_id="$dir"
-    fi
-
-    # On podman < 4.7.0 we had to retag images from default $dir:latest
-    # From >= 4.7.0 we always tag since loads come in as <none>:<none>
-    if [ -z "$tag" ]; then
-	tag=$(basename "$dir")
-    fi
-
-    # Repo names must be lowercase, and only '[a-z0-9._/-]+' and ':tag'
-    tag=$(printf "%s" "$tag" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9._/:-' '-')
-
-    [ -n "$quiet" ] || log "Tagging loaded image $img_id as $tag"
-    if ! podman tag "$img_id" "$tag"; then
-	err 1 "failed tagging image as $tag"
-    fi
+    podman load -qi "$dir"        >/dev/null
 
     # Clean up after ourselves
     if [ -n "$extracted" ]; then
 	log "Cleaning up extracted $dir"
-	rm -rf "$tmpdir"
+	rm -rf "$dir"
     fi
 
-    echo "$tag"
+    # Rename image from podman default $dir:latest
+    if [ -n "$name" ]; then
+	podman tag "$dir" "$name" >/dev/null
+	podman rmi "$dir"         >/dev/null
+    else
+	name=$dir
+    fi
+
+    echo "$name"
 }
 
 running()
 {
-    status=$(podman inspect -f '{{.State.Status}}' "$1" 2>/dev/null)
-    [ "$status" = "running" ] && return 0
+    run=$(podman inspect "$1" 2>/dev/null |jq .[].State.Running)
+    [ "$run" = "true" ] && return 0
     return 1
 }
 
@@ -261,19 +221,19 @@ create()
 
     # Unpack and load docker-archive/oci/oci-archive, returning image
     # name, or return docker:// URL for download.
-    if ! image=$(load_archive "$image"); then
+    if ! image=$(unpack_archive "$image"); then
 	exit 1
     fi
 
     if [ -z "$logging" ]; then
-	logging="--log-driver syslog"
+	logging="--log-driver none"
     fi
 
     # When we get here we've already fetched, or pulled, the image
     args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
     args="$args --restart=$restart --systemd=false --tz=local $privileged"
     args="$args $vol $mount $hostname $entrypoint $env $port $logging"
-    pidfile=/run/container:${name}.pid
+    pidfn=/run/container:${name}.pid
 
     [ -n "$quiet" ] || log "---------------------------------------"
     [ -n "$quiet" ] || log "Got name: $name image: $image"
@@ -296,8 +256,8 @@ create()
     fi
 
     # shellcheck disable=SC2048
-    log "podman create --name $name --conmon-pidfile=$pidfile $args $image $*"
-    if podman create --name "$name" --conmon-pidfile="$pidfile" $args "$image" $*; then
+    log "podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
+    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
 	[ -n "$quiet"  ] || log "Successfully created container $name from $image"
 	[ -n "$manual" ] || start "$name"
 
@@ -312,6 +272,7 @@ create()
 delete()
 {
     name=$1
+    image=$2
 
     if [ -z "$name" ]; then
 	echo "Usage:"
@@ -320,10 +281,9 @@ delete()
     fi
 
     # Should already be stopped, but if not ...
-    container stop "$name" >/dev/null
+    container stop "$name"
 
     while running "$name"; do
-	log "$name: still running, waiting for it to stop ..."
 	_=$((timeout -= 1))
 	if [ $timeout -le 0 ]; then
 	    err 1 "timed out waiting for container $1 to stop before deleting it."
@@ -333,9 +293,6 @@ delete()
 
     podman rm -vif "$name" >/dev/null 2>&1
     [ -n "$quiet" ] || log "Container $name has been removed."
-
-    cnt=$(podman image prune -af | wc -l)
-    log "Pruned $cnt image(s)"
 }
 
 waitfor()
@@ -358,7 +315,7 @@ start()
 	return
     fi
 
-    initctl start container:$name
+    initctl -bq cond set "container:$name"
     # Real work is done by wrap() courtesy of finit sysv emulation
 }
 
@@ -371,7 +328,7 @@ stop()
 	return
     fi
 
-    initctl stop container:$name
+    initctl -bq cond clr "container:$name"
     # Real work is done by wrap() courtesy of finit sysv emulation
 }
 
@@ -379,27 +336,8 @@ wrap()
 {
     name=$1
     cmd=$2
-    pidfile=$(pidfn "$name")
 
-    # Containers have three phases: setup, running, and teardown.
-
-    # The setup phase may run forever in the background trying to fetch
-    # the image.  It saves its PID in /run/containers/${name}.pid
-    if [ "$cmd" = "stop" ] && [ -f "$pidfile" ]; then
-        pid=$(cat "$pidfile")
-
-	# Check if setup is still running ...
-	if kill -0 "$pid" 2>/dev/null; then
-            kill "$pid"
-            wait "$pid" 2>/dev/null
-        fi
-
-        rm -f "$pidfile"
-        return 0
-    fi
-
-    # Skip "echo $name" from podman start in log
-    podman "$cmd" "$name" >/dev/null
+    podman "$cmd" "$name"
 }
 
 # Removes network $1 from all containers
@@ -432,14 +370,7 @@ netrestart()
 
 cleanup()
 {
-    pidfile=$(pidfn "$name")
-
     log "Received signal, exiting."
-    if [ -n "$name" ] && [ -f "$pidfile" ]; then
-	log "$name: in setup phase, removing $pidfile ..."
-	rm -f "$pidfile"
-    fi
-
     exit 1
 }
 
@@ -476,7 +407,7 @@ options:
   -q, --quiet              Quiet operation, called from confd
   -r, --restart POLICY     One of "no", "always", or "on-failure:NUM"
   -s, --simple             Show output in simplified format
-  -t, --timeout SEC        Set timeout for delete/restart commands, default: 30
+  -t, --timeout SEC        Set timeout for delete/restart commands, default: 20
   -v, --volume NAME:PATH   Create named volume mounted inside container on PATH
 
 commands:
@@ -495,12 +426,11 @@ commands:
   run      NAME [CMD]      Run a container interactively, with an optional command
   save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
   setup    NAME            Create and set up container as a Finit task
-  shell   [CMD]            Start a shell, or run CMD, inside a container
+  shell                    Start a shell inside a container
   show    [image | volume] Show containers, images, or volumes
   stat                     Show continuous stats about containers (Ctrl-C aborts)
   start   [NAME]           Start a container, see -n
   stop    [NAME]           Stop a container, see -n
-  upgrade  NAME            Upgrade a running container (stop, pull, restart)
   volume  [prune]          Prune unused volumes
 EOF
 }
@@ -584,7 +514,7 @@ while [ "$1" != "" ]; do
 	    ;;
 	-m | --mount)
 	    shift
-	    mount="$mount --mount=$1"
+	    mount="--mount=$1"
 	    ;;
 	--manual)
 	    manual=true
@@ -638,7 +568,7 @@ if [ -n "$cmd" ]; then
     shift
 fi
 
-trap cleanup INT HUP TERM
+trap cleanup INT TERM
 
 case $cmd in
     # Does not work atm., cannot attach to TTY because
@@ -652,24 +582,19 @@ case $cmd in
 	;;
     delete)
 	cmd=$1
-	[ -n "$name" ] || name=$2
+	name=$2
 	if [ "$cmd" = "network" ] && [ -n "$name" ]; then
 	    netwrm "$name"
 	else
-	    [ -n "$name" ] || name=$1
-	    delete "$name"
+	    delete "$@"
 	fi
 	;;
     exec)
-	if [ -z "$name" ]; then
-	    name="$1"
-	    shift
-	fi
-	podman exec -i "$name" "$@"
+	podman exec -it "$@"
 	;;
     flush)
 	echo "Cleaning up any lingering containers";
-	podman rm -av $force
+	podman rm -av
 	;;
     find)
 	cmd=$1
@@ -697,7 +622,7 @@ case $cmd in
 	;;
     load)
 	# shellcheck disable=SC2086
-	name=$(load_archive "$1" $2)
+	name=$(unpack_archive "$1" $2)
 	[ -n "$name" ] || exit 1
 
 	# Show resulting image(s) matching $name
@@ -730,7 +655,7 @@ case $cmd in
 	    oci)
 		find $BUILTIN $DOWNLOADS -type f 2>/dev/null
 		;;
-	    *)
+	    *)		
 		podman ps $all --format "{{.Names}}"
 		;;
 	esac
@@ -774,40 +699,18 @@ case $cmd in
 	[ -n "$name" ] || err 1 "setup: missing container name."
 	script=/run/containers/${name}.sh
 	[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."
-
-	# Save our PID in case we get stuck here and someone wants to
-	# stop us, e.g., due to reconfiguration or reboot.
-	pidfile=$(pidfn "${name}")
-	echo $$ > "$pidfile"
-
 	while ! "$script"; do
-            log "${name}: setup failed, waiting for network changes ..."
-
-	    # Timeout and retry after 60 seconds, on SIGTERM, or when
-	    # any network event is caught.
-	    timeout -s TERM -k 1 60 sh -c \
-		    'ip monitor address route 2>/dev/null | head -n1 >/dev/null' || true
+	    # Wait for address/route changes, or retry every 60 secods
+	    # shellcheck disable=2162,3045
+	    ip monitor address route | while read -t 60 _; do break; done
 
 	    # On IP address/route changes, wait a few seconds more to ensure
 	    # the system has ample time to react and set things up for us.
-	    log "${name}: retrying ..."
 	    sleep 2
 	done
-
-	rm -f "$pidfile"
-	cnt=$(podman image prune -f | wc -l)
-	log "setup: pruned $cnt image(s)"
 	;;
     shell)
-	if [ -z "$name" ]; then
-	    name="$1"
-	    shift
-	fi
-	if [ $# -gt 0 ]; then
-	    podman exec -i "$name" sh -c "$*"
-	else
-	    podman exec -it "$name" sh -l
-	fi
+	podman exec -it "$1" sh -l
 	;;
     show)
 	cmd=$1
@@ -900,15 +803,15 @@ case $cmd in
 
 	# Likely an OCI archive, or local directory, assume user has updated image.
 	if echo "$img" | grep -Eq '^localhost/'; then
-	    file=$(awk '/^# meta-image:/ {print $3}' "$script")
-	    echo ">> Upgrading container $1 using $file ..."
+	    file=$(awk '{s=$NF} END{print s}' "$script")
+	    echo "Upgrading container ${1} with local archive: $file ..."
 	else
 	    printf ">> Stopping ... "
 	    podman stop "$1"
 	    printf ">> "
 	    podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
-	    echo ">> Starting $1 ..."
 	fi
+	echo ">> Starting $1 ..."
 	if ! "$script"; then
 	    echo ">> Failed recreating container $1"
 	    exit 1
@@ -928,22 +831,6 @@ case $cmd in
 	esac
 	;;
     *)
-	if [ -n "$SERVICE_SCRIPT_TYPE" ] && [ -n "$SERVICE_ID" ]; then
-	    case "$SERVICE_SCRIPT_TYPE" in
-		pre)
-		    # Called as pre-script from Finit service
-		    exec $container -q -n "$SERVICE_ID" setup
-		    ;;
-		cleanup)
-		    # Called as cleanup-script from Finit service
-		    log "Calling $container -n $SERVICE_ID delete"
-		    exec $container -q -n "$SERVICE_ID" delete
-		    ;;
-		*)
-		    false
-		    ;;
-	    esac
-	fi
 	usage
 	exit 1
 	;;

board/common/uboot/extras.config

@@ -20,6 +20,7 @@ CONFIG_CMD_SETEXPR_FMT=y
 
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
+CONFIG_MMC_PCI=y
 CONFIG_CMD_MMC=y
 
 CONFIG_FS_SQUASHFS=y

board/common/uboot/uboot.mk

@@ -17,23 +17,14 @@ endef
 # U-Boot build tree. This will then be built in to the final U-Boot
 # image's control DT via the CONFIG_DEVICE_TREE_INCLUDES option (see
 # extras.config).
-#
-# Some platforms, most notably Raspberry Pi, load the device tree
-# from the SPL, effectively overriding the built-in control DT.
-# For that we bundle an overlay that can be included instead.
 define UBOOT_PRE_BUILD_INSTALL_KEY
-	$(HOST_DIR)/bin/dtc -a 1024 <(echo '/dts-v1/; / { signature {}; };') \
-		>$(@D)/infix-key.dtb
+	$(HOST_DIR)/bin/dtc <(echo '/dts-v1/; / { signature {}; };') >$(@D)/infix-key.dtb
 	$(foreach key, \
 		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
 		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
-		| sed -e 's:/dts-v[0-9]\+/;::' \
-		| tee $(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi \
-		| sed -e '1i\/dts-v1/;\n/plugin/;\n' -e '/^$$/d' -e 's:/ {:\&{/} {:' \
-		>$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtso
-
+	| sed -e 's:/dts-v[0-9]\+/;::' >$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi
 	rm $(@D)/infix-key.dtb
 endef
 UBOOT_PRE_BUILD_HOOKS += UBOOT_PRE_BUILD_INSTALL_KEY

board/x86_64/linux_defconfig

@@ -145,6 +145,7 @@ CONFIG_BRIDGE_EBT_REDIRECT=m
 CONFIG_BRIDGE_EBT_SNAT=m
 CONFIG_BRIDGE_EBT_LOG=m
 CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BPFILTER=y
 CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_BRIDGE_MRP=y
@@ -261,7 +262,6 @@ CONFIG_NLS_ISO8859_1=y
 CONFIG_CRYPTO_AES=y
 CONFIG_CRYPTO_GCM=y
 CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y

configs/aarch64_defconfig

@@ -13,8 +13,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -27,14 +27,17 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.44"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/dcp-sc-28p-a styx/dcp-sc-28p-b marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
+BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -56,8 +59,8 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
-BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -77,7 +80,6 @@ BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
@@ -107,7 +109,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -120,28 +121,21 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_ALDER_ALDER=y
-BR2_PACKAGE_MARVELL_CN9130_CRB=y
-BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
-BR2_PACKAGE_STYX_DCP_SC_28P=y
-BR2_PACKAGE_RASPBERRY_PI_4=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -165,14 +159,10 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_PACKAGE_FEATURE_WIFI=y
-BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
+DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10

configs/aarch64_minimal_defconfig

@@ -27,14 +27,17 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.44"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/dcp-sc-28p-a styx/dcp-sc-28p-b marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
+BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -72,7 +75,6 @@ BR2_PACKAGE_FRR=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
@@ -90,7 +92,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -108,19 +109,14 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_ALDER_ALDER=y
-BR2_PACKAGE_MARVELL_CN9130_CRB=y
-BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
-BR2_PACKAGE_STYX_DCP_SC_28P=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -138,9 +134,6 @@ BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
 DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

configs/aarch64_qemu_boot_defconfig

@@ -20,11 +20,15 @@ BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2023.07.02"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="qemu_arm64"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/qemu/uboot/extras.config"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config"
 BR2_TARGET_UBOOT_FORMAT_DTB=y
 BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-# GNS3_APPLIANCE is not set
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
+DISK_IMAGE_BOOT_DATA="${BINARIES_DIR}/flash-image.bin"
+DISK_IMAGE_BOOT_OFFSET=0x00200000

configs/cn9130_crb_boot_defconfig

@@ -38,4 +38,8 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-# GNS3_APPLIANCE is not set
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
+DISK_IMAGE_BOOT_DATA="${BINARIES_DIR}/flash-image.bin"
+DISK_IMAGE_BOOT_OFFSET=0x00200000

configs/fireant_boot_defconfig

@@ -11,7 +11,6 @@ BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
 BR2_INIT_NONE=y
 BR2_SYSTEM_BIN_SH_NONE=y
 # BR2_PACKAGE_BUSYBOX is not set
-BR2_PACKAGE_LIBBSD=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_UBOOT=y
@@ -21,5 +20,3 @@ BR2_TARGET_UBOOT_CUSTOM_REPO_URL="https://github.com/kernelkit/u-boot.git"
 BR2_TARGET_UBOOT_CUSTOM_REPO_VERSION="c3d9cdcc7d9e3eb490d4036f5eece3fb91a2485c"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mscc_fireant_pcb135_emmc"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config"
-BR2_TARGET_UBOOT_NEEDS_DTC=y
-# GNS3_APPLIANCE is not set

configs/r2s_defconfig

@@ -8,6 +8,7 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -29,7 +30,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.44"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.10.3"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
@@ -41,7 +42,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
@@ -74,6 +74,7 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
@@ -127,7 +128,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -170,14 +170,13 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-r2s"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -201,10 +200,7 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set

configs/riscv64_defconfig

@@ -39,7 +39,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
@@ -89,7 +88,6 @@ BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
@@ -119,7 +117,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -162,7 +159,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -170,7 +167,6 @@ BR2_PACKAGE_CONFD=y
 # BR2_PACKAGE_CONFD_TEST_MODE is not set
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -195,9 +191,6 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set

configs/rpi4_boot_defconfig

@@ -1,37 +0,0 @@
-BR2_aarch64=y
-BR2_cortex_a72=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
-BR2_ENABLE_DEBUG=y
-BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
-BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
-BR2_SSP_NONE=y
-BR2_INIT_NONE=y
-BR2_SYSTEM_BIN_SH_NONE=y
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-# BR2_PACKAGE_BUSYBOX is not set
-BR2_PACKAGE_RPI_FIRMWARE=y
-BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/config.txt"
-BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/cmdline.txt"
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
-BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_arm64"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/uboot/extras.config"
-BR2_TARGET_UBOOT_NEEDS_DTC=y
-BR2_TARGET_UBOOT_FORMAT_DTB=y
-BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
-BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
-BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/uboot/rpi-env.dtso"
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-# GNS3_APPLIANCE is not set

configs/x86_64_defconfig

@@ -12,8 +12,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.44"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,7 +34,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -55,8 +54,10 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_LINUX_PAM=y
@@ -75,7 +76,6 @@ BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
@@ -105,7 +105,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -125,14 +124,13 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -142,7 +140,6 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -166,12 +163,7 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_PACKAGE_FEATURE_WIFI=y
-BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 GNS3_APPLIANCE_RAM=512

configs/x86_64_minimal_defconfig

@@ -7,14 +7,13 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -27,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.44"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -35,7 +34,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -52,7 +50,10 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_LIBMNL=y
@@ -70,7 +71,6 @@ BR2_PACKAGE_FRR=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
@@ -82,14 +82,12 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
-BR2_PACKAGE_GETENT=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
@@ -115,7 +113,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -138,9 +136,7 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 GNS3_APPLIANCE_RAM=512

doc/ChangeLog.md

@@ -3,208 +3,12 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
-[v25.08.0][] - 2025-09-01
+[v24.11.2][] - 2025-03-19
 -------------------------
 
-### Changes
-- Upgrade Buildroot to 2025.02.5 (LTS)
-- Upgrade Linux kernel to 6.12.44 (LTS)
-- Raspberry Pi 4 is now a part of the aarch64 image.
-- Add support for [Raspberry Pi touch display][RPI-TOUCH] on Raspberry Pi 4
-
-### Fixes
-- Fix #1098: Prune dangling container images to reclaim disk space
-- Fix #1123: Disabling or removing a container may cause podman to hang
-- Fix #1124: Container setup with unreachable remote image spawns
-  excessive `ip monitor` processes
-- Fix #1127: Silence libyang Obsolete schema node warnings in log
-
-[RPI-TOUCH]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
-
-[v25.06.0][] - 2025-07-01
--------------------------
-
-### Changes
-- Upgrade Buildroot to 2025.02.4 (LTS)
-- Upgrade Linux kernel to 6.12.35 (LTS)
-- Upgrade curiOS built-in containers to v25.06.0
-- Add support for setting mode of a container content mount, issue #1070
-- Add Wi-Fi client support and add support for some USB-Wi-Fi cards
-- New slogan: Infix OS — Immutable.Friendly.Secure
-
-### Fixes
-- cli: fix by-word movement, detect word barrier using non-alphanum chars
-- cli: fix delete word left/right, make sure to save word in kill buffer
-
-
-[v25.05.1][] - 2025-06-12
--------------------------
-
-### Changes
-- Upgrade Linux kernel to 6.12.32 (LTS)
-
-### Fixes
-- Fix #1060: Restore of missing CLI commands, regression in Infix v25.05.0
-
-[v25.05.0][] - 2025-05-27
--------------------------
-
-### Changes
-- Upgrade Buildroot to 2025.02.3 (LTS)
-- Upgrade Linux kernel to 6.12.30 (LTS)
-- Upgrade libyang to 3.12.2
-- Upgrade sysrepo to 3.6.11
-- Upgrade netopeer2 (NETCONF) to 2.4.1
-- New hardware support: Raspberry Pi 4B (aarch64)
-- Add documentation on Infix upgrading and downgrading, issue #1009
-- Add HDMI and USB support for iMX8MP-evk
-- Enforced strict format for LLDP destination MAC address:
-  - Only accepts colon-separated format: `01:80:C2:00:00:0E`
-- Add `show lldp` command to show discovered neighbors per interface.
-- Add configuration support for per-interface LLDP administrative status
-
-### Fixes
-- Fix containers with multiple mounts
-- Correct description for LAG LACP modes
-- Fix #1040: Add `mount` constraint for container config
-
-
-[v25.04.0][] - 2025-04-30
--------------------------
-
-### Changes
- - Upgrade Linux kernel to 6.12.25 (LTS)
- - Upgrade Buildroot to 2025.02.1 (LTS)
- - Format for disk image (for QEMU) has changed to `qcow2`
-
-### Fixes
- - Fix #1002: Broken symlink in release package
- - Fix #1006: NanoPi R2S corrupt startup, regression in Infix v25.02.0
-   - Bump R2S kernel, now same as tier one boards
- - Fix #1015: Not possible to save custom SSH settings in startup-config
- - Fix group owner and permissions of `/cfg/backup` directory
- - Fix extraction of old version for `/cfg/backup/` files
- - Fix configuration migration issues when upgrading
-
-[v25.03.0][] - 2025-03-31
--------------------------
-
-> [!IMPORTANT]
-> This release is the first with the new Buildroot 2025.02 (LTS)
-
-### Changes
- - Upgrade Linux kernel to 6.12.21 (LTS)
- - Upgrade Buildroot to 2025.02.0 (LTS)
-
-### Fixes
- - Fix #964: YANG schema warning in syslog: missing 'monitor' node for lag
- - Fix #980: the system fails to reboot when a container is (stuck), for
-   whatever reason, in its 'setup' state
- - Fix #990: web console, ttyd service, stopped working after upgrade to
-   Buildroot 2025.02, caused by new (missing) option `--writable`
- - Fix TCAM memory corruption in `mvpp2` Ethernet controller
- - Fix annoying (but harmless) usage message from the logger tool when
-   `startup-config` fails to load and the system reverts to failure mode
- - Fix harmless log warning for product specific init when no product
-   specific init scripts are found
- - Backport fixes for sysklogd, affecting hostname filtering and periods
-   in TAG names, pending official backport in Buildroot
-
-
-[v25.02.0][] - 2025-03-04
--------------------------
-
-### Changes
- - Upgrade Linux kernel to 6.12.18 (LTS)
- - Upgrade Buildroot to 2024.02.11 (LTS)
- - Add support for link aggregation (lag), static (balance-xor) and LACP
- - Add support for the [i.MX 8M Plus EVK][EVK]
- - YANG type change for SSH private/public keys, from ietf-crypto-types
-   to infix-crypto-types
- - Disable global IPv6 forwarding by default, enable by per-interface
-   setting.  Note, route advertisements are always accepted.  Issue #785
- - Drop automatic default route (interface route) for IPv4 autoconf, not
-   necessary and causes more confusion than good.  Issue #923
- - Update scripting with new RESTCONF examples
-
-### Fixes
- - Fix #896: `/etc/resolv.conf` not properly generated when system runs
-   in fail secure mode (failing to load `startup-config`)
- - Fix #902: containers "linger" in the system (state 'exited') after
-   having removed them from the configuration
- - Fix #930: container configuration changes does not apply at runtime
-   only when saved to `startup-config` and system is rebooted
- - Fix #936: DHCP server reconfiguration does not always take effect.
- - Fix #956: CLI `copy` command complains it cannot change owner when
-   copying `factory-config` to `running-config`.  Bogus error, the
-   latter is not really a file
- - Fix #977: "Operation not permitted" when saving `running-config` to
-   `startup-config` (harmless warning but annoying and concerning)
-
-[EVK]: https://www.nxp.com/design/design-center/development-boards-and-designs/8MPLUSLPD4-EVK
-
-
-[v25.01.0][] - 2025-01-31
--------------------------
-
-> [!NOTE]
-> This release contains breaking changes in the configuration file
-> syntax for DHCP clients.  Specifically DHCP options *with value*,
-> i.e., the syntax for sending a hexadecimal value now require `hex`
-> prefix before a string of colon-separated pairs of hex values.
-
-### Changes
-
- - Upgrade Linux kernel to 6.12.11 (LTS)
- - Upgrade Buildroot to 2024.02.10 (LTS)
- - Upgrade FRR from 9.1.2 to 9.1.3
- - Add support for configuring SSH server, issue #441.  As a result,
-   both SSH and NETCONF now use the same host key in `factory-config`
- - Add operational support for reading DNS resolver info, issue #510
- - Add operational support for NTP client, issue #510
- - Add support for more mDNS settings: allow/deny interfaces, acting
-   as "reflector" and filtering of reflected services.  Issue #678
- - Add DHCPv4 server support, multiple subnets with static hosts and
-   DHCP options on global, subnet, or host level, issue #703.
-   Contributed by [MINEx Networks](https://minexn.com/)
-   - DHCP client options aligned with DHCP server, `startup-config`
-     files with old syntax are automatically migrated
- - Breaking change in DHCP client options *with value*.  Hexadecimal
-   values must now be formatted as `{ "hex": "c0:ff:ee" }` (JSON)
- - Add documentation on management via SSH, Web (RESTCONF, Web
-   Console), and Console Port, issue #787
- - Add documentation of DNS client use and configuration, issue #798
- - Add support for changing boot order for the system with an RPC,
-   including support for reading boot order from operational datastore
- - Add support for GRE/GRETAP tunnels
- - Add support for STP/RSTP on bridges
- - Add support for VXLAN tunnels
- - Add support for configuring global LLDP `message-tx-interval`
-
 ### Fixes
 
- - Fix #777: Authorized SSH key not applied to `startup-config`
- - Fix #829: Avahi (mDNS responder) not starting properly on switches
-   with *many* ports (>10).  This led to a review of `sysctl`:
-   - New for IPv4:
-	 - Adjust IGMP max memberships: 20 -> 1000
-	 - Use neighbor information on nexthop selection
-	 - Use inbound interface address on ICMP errors
-	 - Ignore routes with link down
-	 - Disable `rp_filter`
-     - ARP settings have been changed to better fit routers, i.e.,
-       systems with multiple interfaces:
-	   - Always use best local address when sending ARP
-	   - Only reply to ARP if target IP is on the inbound interface
-	   - Generate ARP requests when device is brought up or HW address changes
-   - New for IPv6:
-	 - Keep static global addresses on link down
-	 - Ignore routes with link down
- - Fix #861: Fix error when running 251+ reconfigurations in test-mode
- - Fix #869: Setup of bridges is now more robust
- - Fix #899: DHCP client with client-id does not work
- - Minor cleanup of Networking Guide
- - Fix memory leaks in `confd`
+- Fix TCAM memory corruption in `mvpp2` Ethernet controller
 
 
 [v24.11.1][] - 2024-11-29
@@ -424,7 +228,7 @@ renamed to ease maintenance, more info below.
   with `custom-phys-address` to allow for constructing more free-form
   MAC addresses based on the chassis MAC (a.k.a., base MAC) address.
   For more information, see the YANG model, a few examples are listed in
-  the updated documentation.
+  the updated documentation.  
   The syntax will be automatically updated in the `startup-config` and
   `factory-config` -- make sure to verify the changes and update any
   static `factory-config` used for your products
@@ -1612,15 +1416,8 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
  - N/A
 
 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.08.0...HEAD
-[v25.08.0]:   https://github.com/kernelkit/infix/compare/v25.06.1...v26.08.0
-[v25.06.0]:   https://github.com/kernelkit/infix/compare/v25.05.1...v26.06.0
-[v25.05.1]:   https://github.com/kernelkit/infix/compare/v25.05.0...v25.05.1
-[v25.05.0]:   https://github.com/kernelkit/infix/compare/v25.04.0...v25.05.0
-[v25.04.0]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
-[v25.03.0]:   https://github.com/kernelkit/infix/compare/v25.02.0...v25.03.0
-[v25.02.0]:   https://github.com/kernelkit/infix/compare/v25.01.0...v25.02.0
-[v25.01.0]:   https://github.com/kernelkit/infix/compare/v24.11.0...v25.01.0
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.11.0...HEAD
+[v24.11.2]:   https://github.com/kernelkit/infix/compare/v24.11.1...v24.11.2
 [v24.11.1]:   https://github.com/kernelkit/infix/compare/v24.11.0...v24.11.1
 [v24.11.0]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.11.0
 [v24.10.2]:   https://github.com/kernelkit/infix/compare/v24.10.1...v24.10.2

doc/README.md

@@ -1,16 +1,13 @@
-<img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 
-Welcome to Infix, your immutable, friendly, and secure operating system!
-On these pages you can find both user and developer documentation.
+Welcome to Infix, your friendly Network Operating System!  On these
+pages you can find both user and developer documentation.
 
-Most topics on configuring the system include CLI examples, but every
-setting, as well as status read-back from the operational datastore, is
-also possible to perform using NETCONF or RESTCONF.  In fact, the Infix
-regression test system solely relies on NETCONF and RESTCONF.
+> Topics on configuring the system include CLI examples, every setting
+> is also possible to perform using NETCONF.  In fact, the Infix test
+> system solely relies on NETCONF for configuring network topologies.
 
-> [!TIP]
-> The CLI documentation is also available from inside the CLI itself
-> using the `help` command in admin-exec mode.
+The CLI documentation is also available from inside the CLI itself using
+the `help` command.
 
 - **CLI Topics**
    - [Introduction to the CLI](cli/introduction.md)
@@ -21,7 +18,6 @@ regression test system solely relies on NETCONF and RESTCONF.
    - [Introduction](introduction.md)
    - [System Configuration](system.md)
    - [Network Configuration](networking.md)
-   - [DHCP Server](dhcp.md)
    - [Syslog Support](syslog.md)
  - **Infix In-Depth**
    - [Boot Procedure](boot.md)

doc/boot.md

@@ -1,36 +1,37 @@
-# Boot Procedure
+Boot Procedure
+==============
 
 Systems running Infix will typically boot in multiple phases, forming
 a boot chain. Each link in the chain has three main responsibilities:
 
 1. Ensuring the integrity of the next link before passing control to
    it. This avoids silent failures stemming from data corruption.
-1. Ensuring the authenticity of the next link before passing control
+
+2. Ensuring the authenticity of the next link before passing control
    to it, commonly referred to as _Secure Boot_. This protects against
    malicious attempts to modify a system's firmware.
-1. Preparing the system state according to the requirements of the
+
+3. Preparing the system state according to the requirements of the
    next link. E.g. the Linux kernel requires the system's RAM to be
    operational.
 
 A typical chain consists of four stages:
 
-```
-    .---------.
-    |   ROM   >---.   Determine the location of and load the SPL
-    '---------'   |
-.-----------------'
-|   .---------.
-'--->   SPL   >---.   Perform DDR training and load the TPL
-    '---------'   |
-.-----------------'
-|   .---------.
-'--->   TPL   >---.   Load Linux kernel, device tree, and root filesystem
-    '---------'   |
-.-----------------'
-|   .---------.
-'--->  Infix  |       Get down to business
-    '---------'
-```
+        .---------.
+        |   ROM   >---.   Determine the location of and load the SPL
+        '---------'   |
+    .-----------------'
+    |   .---------.
+    '--->   SPL   >---.   Perform DDR training and load the TPL
+        '---------'   |
+    .-----------------'
+    |   .---------.
+    '--->   TPL   >---.   Load Linux kernel, device tree, and root filesystem
+        '---------'   |
+    .-----------------'
+    |   .---------.
+    '--->  Infix  |       Get down to business
+        '---------'
 
 After a reset, hardware will pass control to a program (_ROM_) which
 is almost always programmed into the SoC by the vendor.  This program
@@ -51,7 +52,9 @@ This document's focus is to describe the final two phases of the boot
 chain, as the initial phases are very hardware dependent, better
 described by existing documentation provided by the SoC vendor.
 
-## Bootloader
+
+Bootloader
+----------
 
 ### Configuration
 
@@ -59,42 +62,33 @@ To mitigate the risk of a malicious user being able to circumvent the
 bootloader's validation procedure, user configuration is kept to a
 minimum.  Two settings are available:
 
-**Boot order**: Since Infix maintains two copies of its software image,
-and as some bootloaders support [netbooting][2], the order in which boot
-sources are considered can be configured. To select the active
-source, use [RAUC][]:
+- **Boot order**: Since Infix maintains two copies of its software image,
+  and as some bootloaders support netbooting, the order in which boot
+  sources are considered can be configured. To select the active
+  source, use [RAUC][]:
 
-```
-root@example:~# rauc status mark-active <slot>
-...
-```
+  `rauc status mark-active <slot>`
 
-Where `<slot>` is one of:
+  Where `<slot>` is one of:
 
-| **`<slot>`** | **Source**                |
-|--------------|---------------------------|
-| `rootfs.0`   | Primary partition         |
-| `rootfs.1`   | Secondary partition       |
-| `net.0`      | Netboot (where supported) |
+  | `<slot>` | Source                    |
+  |----------|---------------------------|
+  | rootfs.0 | Primary partition         |
+  | rootfs.1 | Secondary partition       |
+  | net.0    | Netboot (where supported) |
 
-**Debug**: By default, the kernel will only output errors to the
-console during boot. Optionally, this can be altered such that all
-enabled messages are logged.
+- **Debug**: By default, the kernel will only output errors to the
+  console during boot. Optionally, this can be altered such that all
+  enabled messages are logged.
 
-On systems using _U-Boot_, this can be enabled by running `fw_setenv
-DEBUG 1`. To restore the default behavior, run `fw_setenv DEBUG`.
+  On systems using _U-Boot_, this can be enabled by running `fw_setenv
+  DEBUG 1`. To restore the default behavior, run `fw_setenv DEBUG`.
 
-On systems running _GRUB_, this can be enabled by running:
+  On systems running _GRUB_, this can be enabled by running
+  `grub-editenv /mnt/aux/grub/grubenv set DEBUG=1`. To restore the
+  default behavior, run `grub-editenv /mnt/aux/grub/grubenv unset
+  DEBUG`
 
-```
-root@example:~# grub-editenv /mnt/aux/grub/grubenv set DEBUG=1
-```
-
-To restore the default behavior, run:
-
-```
-root@example:~# grub-editenv /mnt/aux/grub/grubenv unset DEBUG
-```
 
 ### U-Boot
 
@@ -113,7 +107,8 @@ and TFTP to transfer the image to the system's RAM.
 
 Access to U-Boot's shell is disabled to prevent side-loading of
 malicious software.  To configure the active boot partition, refer to
-the [Bootloader Configuration](#configuration) section.
+the [Bootloader Interface](#bootloader-interface) section.
+
 
 ### GRUB
 
@@ -124,82 +119,14 @@ standard [System Upgrade](#system-upgrade) can be performed on
 virtualized instances.
 
 Access to the GRUB shell is not limited in any way, and the boot
-partition can be selected interactively at boot using the arrow keys. It
-is also possible to permanently configure the default partition from
-Infix using the [Bootloader Configuration](#configuration).
+partition can be selected interactively at boot using the arrow
+keys. It is also possible to permanently configure the default
+partition from Infix using the [Bootloader
+Interface](#bootloader-interface).
 
-## System Boot
 
-After the system firmware (BIOS or and [boot loader](boot.md) start
-Linux the following happens.  The various failure modes, e.g., missing
-password in VPD, are detailed later in this section.
-
-![System boot flowchart](img/fail-secure.svg)
-
-1. Before mounting `/cfg` and `/var` partitions, hosting read-writable
-   data like `startup-config` and container images, the system first
-   checks if a factory reset has been requested by the user, if so it
-   wipes the contents of these partitions
-1. Linux boots with a device tree which is used for detecting generic
-   make and model of the device, e.g., number of interfaces.  It may
-   also reference an EEPROM with [Vital Product Data](vpd.md).  That is
-   where the base MAC address and per-device password hash is stored.
-   (Generic builds use the same MAC address and password)
-1. On every boot the system's `factory-config` and `failure-config` are
-   generated from the YANG[^2] models of the current firmware version.
-   This ensures that a factory reset device can always boot, and that
-   there is a working fail safe, or rather *fail secure*, mode
-1. On first power-on, and after a factory reset, the system does not
-   have a `startup-config`, in which case `factory-config` is copied
-   to `startup-config` -- if a per-product specific version exists it
-   is preferred over the generated one
-1. Provided the integrity of the `startup-config` is OK, a system
-   service loads and activates the configuration
-
-### Failure Modes
-
-So, what happens if any of the steps above fail?
-
-#### VPD Fail
-
-The per-device password cannot be read, or is corrupt, so the system
-`factory-config` and `failure-config` are not generated:
-
-1. First boot, or after factory reset: `startup-config` cannot be
-   created or loaded, and `failure-config` cannot be loaded.  The
-   system ends up in an unrecoverable state, i.e., **RMA[^3] Mode**
-1. The system has booted (at least) once with correct VPD and password
-   and already has a `startup-config`.  Provided the `startup-config`
-   is OK (see below), it is loaded and system boots successfully
-
-In both cases, external factory reset modes/button will not help, and
-in the second case will cause the device to fail on the next boot.
-
-> [!NOTE]
-> The second case does not yet have any warning or event that can be
-> detected from the outside.  This is planned for a later release.
-
-#### Broken startup-config
-
-If loading `startup-config` fails for some reason, e.g., invalid JSON
-syntax, failed validation against the system's YANG model, or a bug in
-the system's `confd` service, the *Fail Secure Mode* is triggered and
-`failure-config` is loaded (unless VPD Failure, see above).
-
-> [!TIP]
-> Please see the [Branding & Releases](branding.md) document for how to
-> provide per-product `failure-config`, or `factory-config` to suit your
-> product's preferences.
-
-*Fail Secure Mode* is a fail-safe mode provided for debugging the
-system.  The default[^4] creates a setup of isolated interfaces with
-communication only to the management CPU, SSH and console login using
-the device's factory reset password, IP connectivity only using IPv6
-link-local, and device discovery protocols: LLDP, mDNS-SD.  The login
-and shell prompt are set to `failure-c0-ff-ee`, the last three octets of
-the device's base MAC address.
-
-## System Upgrade
+System Upgrade
+==============
 
 Much of the minutiae of software upgrades is delegated to [RAUC][],
 which offers lots of benefits out-of-the-box:
@@ -207,21 +134,21 @@ which offers lots of benefits out-of-the-box:
 - Upgrade Bundles are always signed, such that their authenticity can
   be verified by the running operating system, before the new one is
   installed.
+
 - The bureaucracy of interfacing with different bootloaders, manage
   the boot order, is a simple matter of providing a compatible
   configuration.
+
 - Updates can be sourced from the local filesystem (including external
   media like USB sticks or SD-cards) and from remote servers using FTP
   or HTTP(S).
 
 To initiate a system upgrade from the shell[^1], run:
 
-```
-root@example:~# rauc install <file|url>
-...
-```
+    rauc install <file|url>
 
-Where the file or URL points to a [RAUC Upgrade Bundle](#rauc-upgrade-bundle).
+Where the file or URL points to a [RAUC Upgrade
+Bundle](#rauc-upgrade-bundle).
 
 This will upgrade the partition not currently running.  After a
 successful upgrade is completed, you can reboot your system, which
@@ -229,9 +156,14 @@ will then boot from the newly installed image.  Since the partition
 from which you were originally running is now inactive, running the
 same upgrade command again will bring both partitions into sync.
 
-## Image Formats
+[RAUC]: https://rauc.io
 
-### SquashFS Image
+
+Image Formats
+=============
+
+SquashFS Image
+--------------
 
 **Canonical Name**: `rootfs.squashfs`
 
@@ -242,7 +174,10 @@ this image, or is dependent on it, in one way or another.
 On its own, it can be used as an [initrd][] to efficiently boot a
 virtual instance of Infix.
 
-### FIT Framed Squash Image
+[initrd]: https://docs.kernel.org/admin-guide/initrd.html
+
+FIT Framed Squash Image
+-----------------------
 
 **Canonical Name**: `rootfs.itb`
 
@@ -259,9 +194,9 @@ stored in the `/boot` directory of the filesystem.
 
 On disk, this image is then stored broken up into its two components;
 the _FIT header_ (`rootfs.itbh`) and the SquashFS image.  The header
-is stored on the [Auxiliary Data](#aux-auxiliary-data) partition of
+is stored on the [Auxiliary Data](#aux---auxiliary-data) partition of
 the [Disk Image](#disk-image), while the SquashFS image is stored in
-one of the [Root Filesystem](#primarysecondary-root-filesystems)
+one of the [Root Filesystem](#primarysecondary---root-filesystems)
 partitions.
 
 When the system boots, U-Boot will concatenate the two parts to
@@ -281,20 +216,25 @@ validate the SquashFS's contents. This path was chosen because:
 In its full form, it can be used to netboot Infix, as it contains all
 the information needed by U-Boot in a single file.
 
-### RAUC Upgrade Bundle
+[FIT]: https://u-boot.readthedocs.io/en/latest/usage/fit.html
+
+
+RAUC Upgrade Bundle
+-------------------
 
 **Canonical Name**: `infix-${ARCH}.pkg`
 
-Itself a SquashFS image, this bundle (sometimes referred to package)
-contains the Infix [SquashFS Image](#squashfs-image) along with the
-header of the [FIT Framed Squash Image](#fit-framed-squash-image), and
-some supporting files to let [RAUC][] know how install it on the target
-system.
+Itself a SquashFS image, it contains the Infix [SquashFS
+Image](#squashfs-image) along with the header of the [FIT Framed
+Squash Image](#fit-framed-squash-image), and some supporting files to
+let [RAUC][] know how install it on the target system.
 
-When performing a [System Upgrade](#system-upgrade), this is the format
-to use.
+When performing a [System Upgrade](#system-upgrade), this is the
+format to use.
 
-### Disk Image
+
+Disk Image
+----------
 
 **Canonical Name**: `disk.img`
 
@@ -302,37 +242,35 @@ Infix runs from a block device (e.g. eMMC or virtio disk) with the
 following layout. The disk is expected to use the GPT partitioning
 scheme. Partitions marked with an asterisk are optional.
 
-```
-.-----------.
-| GPT Table |
-:-----------:
-|    boot*  |
-:-----------:
-|    aux    |
-:-----------:
-|           |
-|  primary  |
-|           |
-:-----------:
-|           |
-| secondary |
-|           |
-:-----------:
-|    cfg    |
-:-----------:
-|           |
-|    var*   |
-|           |
-'-----------'
-```
+    .-----------.
+    | GPT Table |
+    :-----------:
+    |    boot*  |
+    :-----------:
+    |    aux    |
+    :-----------:
+    |           |
+    |  primary  |
+    |           |
+    :-----------:
+    |           |
+    | secondary |
+    |           |
+    :-----------:
+    |    cfg    |
+    :-----------:
+    |           |
+    |    var*   |
+    |           |
+    '-----------'
 
-#### `boot` - Bootloader
+### `boot` - Bootloader
 
-| **Parameter** | **Value**                               |
-|---------------|-----------------------------------------|
-| Required      | No                                      |
-| Size          | 4 MiB                                   |
-| Format        | Raw binary, as dictated by the hardware |
+| Parameter | Value                                   |
+|-----------|-----------------------------------------|
+| Required  | No                                      |
+| Size      | 4 MiB                                   |
+| Format    | Raw binary, as dictated by the hardware |
 
 Optional partition containing the system's bootloader. May also reside
 in a separate storage device, e.g. a serial FLASH.
@@ -340,13 +278,14 @@ in a separate storage device, e.g. a serial FLASH.
 On x86_64, this partition holds the EFI system partition, containing
 the GRUB bootloader.
 
-#### `aux` - Auxiliary Data
 
-| **Parameter** | **Value**       |
-|---------------|-----------------|
-| Required      | Yes             |
-| Size          | 4 MiB           |
-| Format        | EXT4 filesystem |
+### `aux` - Auxiliary Data
+
+| Parameter | Value           |
+|-----------|-----------------|
+| Required  | Yes             |
+| Size      | 4 MiB           |
+| Format    | EXT4 filesystem |
 
 Holds information that is shared between Infix and its bootloader,
 such as image signatures required to validate the chain of trust,
@@ -354,12 +293,10 @@ bootloader configuration etc.
 
 Typical layout when using U-Boot bootloader:
 
-```
-/
-├ primary.itbh
-├ secondary.itbh
-└ uboot.env
-```
+    /
+    ├ primary.itbh
+    ├ secondary.itbh
+    └ uboot.env
 
 During boot, an ITB header along with the corresponding root
 filesystem image are concatenated in memory, by U-Boot, to form a
@@ -370,36 +307,39 @@ Note that the bootloader's primary environment is bundled in the
 binary - `uboot.env` is only used to import a few settings that is
 required to configure the boot order.
 
-#### `primary`/`secondary` - Root Filesystems
 
-| **Parameter** | **Value**         |
-|---------------|-------------------|
-| Required      | Yes               |
-| Size          | >= 256 MiB        |
-| Format        | Squash filesystem |
+### `primary`/`secondary` - Root Filesystems
+
+| Parameter | Value             |
+|-----------|-------------------|
+| Required  | Yes               |
+| Size      | >= 256 MiB        |
+| Format    | Squash filesystem |
 
 Holds the [SquashFS Image](#squashfs-image). Two copies exist so that
 an incomplete upgrade does not brick the system, and to allow fast
 rollbacks when upgrading to a new version.
 
-#### `cfg` - Configuration Data
 
-| **Parameter** | **Value**       |
-|---------------|-----------------|
-| Required      | Yes             |
-| Size          | >= 16 MiB       |
-| Format        | EXT4 filesystem |
+### `cfg` - Configuration Data
+
+| Parameter | Value           |
+|-----------|-----------------|
+| Required  | Yes             |
+| Size      | >= 16 MiB       |
+| Format    | EXT4 filesystem |
 
 Non-volatile storage of the system configuration and user data.
 Concretely, user data is everything stored under `/root` and `/home`.
 
-#### `var` - Variable Data
 
-| **Parameter** | **Value**       |
-|---------------|-----------------|
-| Required      | No              |
-| Size          | >= 16 MiB       |
-| Format        | EXT4 filesystem |
+### `var` - Variable Data
+
+| Parameter | Value           |
+|-----------|-----------------|
+| Required  | No              |
+| Size      | >= 16 MiB       |
+| Format    | EXT4 filesystem |
 
 Persistent storage for everything under `/var`. This is maintained as
 a separate filesystem from the data in `cfg`, because while the system
@@ -409,20 +349,5 @@ can funtion reasonably well without a persistent `/var`, loosing
 If `var` is not available, Infix will still persist `/var/lib` using
 `cfg` as the backing storage.
 
-[^1]: See [Upgrade & Boot Order](upgrade.md) for more information.
-[^2]: YANG is a modeling language from IETF, replacing that used for
-    SNMP (MIB), used to describe the subsystems and properties of
-    the system.
-[^3]: Return Merchandise Authorization (RMA), i.e., broken beyond repair
-    by end-user and eligible for return to manufacturer.
-[^4]: Customer specific builds can define their own `failure-config`.
-    It may be the same as `factory-config`, with the hostname set to
-    `failure`, or a dedicated configuration that isolates interfaces, or
-    even disables ports, to ensure that the device does not cause any
-    security problems on the network.  E.g., start forwarding traffic
-    between previously isolated VLANs.
-
-[2]:      netboot.md
-[FIT]:    https://u-boot.readthedocs.io/en/latest/usage/fit.html
-[RAUC]:   https://rauc.io
-[initrd]: https://docs.kernel.org/admin-guide/initrd.html
+[^1]: See [CLI Upgrade](cli/upgrade.md) for information on upgrading
+    via CLI.

doc/branding.md

@@ -1,9 +1,11 @@
-# Branding & Releases
+Branding & Releases
+===================
 
-This document is for projects using Infix as a br2-external, i.e., OEMs
-that want to create *their own "Spin"* of Infix.
+This document is for projects using Infix as a br2-external, i.e., OEMs.
 
-## Branding
+
+Branding
+--------
 
 Branding is done in menuconfig, there are several settings affecting
 it, most are in the Infix external subsection called "Branding", but
@@ -22,18 +24,25 @@ check this for you and you may end up with odd results.
 
 Verify the result after a build by inspecting:
 
-- `output/images/*`: names, missing prefix, etc.
-- `output/target/etc/os-release`: this file is sourced by other build
-  scripts, e.g., `mkgns3a.sh`.  For reference, see [os-release(5)][]
+  - `output/images/*`: names, missing prefix, etc.
+  - `output/target/etc/os-release`: this file is sourced by
+    other build scripts, e.g., `mkgns3a.sh`.  For reference, see
+	https://www.freedesktop.org/software/systemd/man/os-release.html
 
-> [!IMPORTANT]
-> To get a proper GIT revision (hash) from your OS spin, remember to set
-> in menuconfig `INFIX_OEM_PATH`.  When unset, the Infix `post-build.sh`
-> script defaults to the Infix base path.  The revision is stored in the
-> file `/etc/os-release` as `BUILD_ID`, also in the file `/etc/version`.
-> See below for more info.
+> **Note:** to get proper GIT revision (hash) from your composed OS,
+> remember in menuconfig to set `INFIX_OEM_PATH`.  When unset the
+> Infix `post-build.sh` script defaults to the Infix base path.  The
+> revision is stored in the file `/etc/os-release` as BUILD_ID and
+> is also in the file `/etc/version`.  See below for more info.
 
-## Factory & Failure Config
+[^1]: The base MAC address is defined in the device's Vital Product
+    Data (VPD) EEPROM, or similar, which is used by the kernel to
+    create the system interfaces.  This MAC address is usually also
+    printed on a label on the device.
+
+
+Factory & Failure Config
+------------------------
 
 To support booting the same image (CPU architecture) on multiple boards,
 Infix by default generates the device's initial configuration every time
@@ -41,36 +50,37 @@ at boot.  This also ensures the device can always be restored to a known
 state after a factory reset, since the `factory-config` is guaranteed to
 be compatible with the YANG models for the given software version. (For
 more information on how the system boots, please see the section [Key
-Concepts](index.md#key-concepts) in the Introduction document.)
+Concepts](introduction.md#key-concepts) in the Introduction document.)
 
 However, for custom builds of Infix it is possible to override this with
 a single static `/etc/factory-config.cfg` (and failure-config) in your
 rootfs overlay -- with a [VPD](vpd.md) you can even support several!
 
+
 ### Variables & Format Specifiers
 
 Parts of the configuration you likely always want to generated, like the
-SSH hostkey used by SSH server and NETCONF, a unique hostname, or the `admin` user's
+SSH hostkey used by NETCONF, a unique hostname, or the `admin` user's
 unique (per-device with a VPD) password hash.  This section lists the
 available keywords, see the next section for examples of how to use
 them:
 
-- **Default password hash:** `$factory$` (from VPD, .dtb, or built-in)  
-  XPath: `/ietf-system:system/authentication/user/password`
-- **Default SSH and NETCONF hostkey:** `genkey` (regenerated at factory reset)
-  XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
-- **Hostname format specifiers:**  
-  XPath: `/ietf-system:system/hostname`
+ - **Default password hash:** `$factory$` (from VPD, .dtb, or built-in)  
+   XPath: `/ietf-system:system/authentication/user/password`
+ - **Default NETCONF hostkey:** `genkey` (regenerated at factory reset)  
+   XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
+ - **Hostname format specifiers:**  
+   XPath: `/ietf-system:system/hostname`
    - `%i`: OS ID, from `/etc/os-release`, from Menuconfig branding
    - `%h`: Default hostname, from `/etc/os-release`, from branding
    - `%m`: NIC specific part of base MAC, e.g., to `c0-ff-ee`
    - `%%`: Literal %
 
+
 ### Static Files
 
-> [!CAUTION]
-> Maintaining a static `factory-config` and `failure-config` may seem
-> like an obvious choice, but as YANG models evolve (even the IETF
+> **Caveat:** maintaining static a factory-config and failure-config may
+> seem like an obvious choice, but as YANG models evolve (even the IETF
 > models get upgraded), you may need to upgrade your static files.
 
 First, for one-off builds (one image per product), the simplest way is
@@ -93,8 +103,9 @@ after `00-probe` has run. The lower case version of the string is used.
 
 I.e., create a rootfs overlay that provides any combination of:
 
-- `/usr/share/product/<PRODUCT>/etc/factory-config.cfg`
-- `/usr/share/product/<PRODUCT>/etc/failure-config.cfg`
+ - `/usr/share/product/<PRODUCT>/etc/factory-config.cfg`
+ - `/usr/share/product/<PRODUCT>/etc/failure-config.cfg`
+
 
 ### Dynamically Generated
 
@@ -102,14 +113,14 @@ The generated `factory-config` and `failure-config` files consist of
 both static JSON files and part generated files at runtime for each
 device.  The resulting files are written to the RAM disk in `/run`:
 
-- `/run/confd/factory-config.gen`
-- `/run/confd/failure-config.gen`
+ - `/run/confd/factory-config.gen`
+ - `/run/confd/failure-config.gen`
 
 Provided no custom overrides (see above) have been installed already,
 these files are then copied to:
 
-- `/etc/factory-config.cfg`
-- `/etc/failure-config.cfg`
+ - `/etc/factory-config.cfg`
+ - `/etc/failure-config.cfg`
 
 ... where the bootstrap process expects them to be in the next step.
 
@@ -121,33 +132,29 @@ base hostname, set `BR2_TARGET_GENERIC_HOSTNAME` in your defconfig.
 The static files are installed by Infix `confd` in `/usr/share/confd/`
 at build time.  It contains two subdirectories:
 
-```
-/usr/share/confd/
- |- factory.d/
- |  |- 10-foo.json
- |  |- 10-bar.json
- |  `- 10-qux.json
- `- failure.d/
-    |- 10-xyzzy.json
-    `- 10-garply.json
-```
+    /usr/share/confd/
+     |- factory.d/
+     |  |- 10-foo.json
+     |  |- 10-bar.json
+     |  `- 10-qux.json
+     `- failure.d/
+        |- 10-xyzzy.json
+        `- 10-garply.json
 
 To override, or extend, these files in you br2-external, set up a rootfs
 overlay and add it last in `BR2_ROOTFS_OVERLAY`.  Your overlay can look
 something like this:
 
-```
-./board/common/rootfs/
-  |- etc/
-  |  |- confdrc             # See below
-  |  `- confdrc.local
-  `- usr/
-     `- share/
-        `- confd/
-           |- 10-foo.json   # Override Infix foo
-           |- 30-bar.json   # Extend, probably 10-bar.json
-           `- 30-fred.json  # Extend, your own defaults
-```
+    ./board/common/rootfs/
+      |- etc/
+      |  |- confdrc             # See below
+      |  `- confdrc.local
+      `- usr/
+         `- share/
+            `- confd/
+               |- 10-foo.json   # Override Infix foo
+               |- 30-bar.json   # Extend, probably 10-bar.json
+               `- 30-fred.json  # Extend, your own defaults
 
 Using the same filename in your overlay, here `10-foo.json`, completely
 replaces the contents of the same file provided by Infix.  If you just
@@ -161,17 +168,17 @@ provide a few custom ones that the `bootstrap` knows about, e.g.,
 `gen-ifs-custom` that overrides `20-interfaces.json`.  See the
 bootstrap script for more help, and up-to-date information.
 
-> [!TIP]
-> You may not need to provide your own `/etc/confdrc` for your spin.
-> The one installed by `confd` is usually enough.  However, if you want
-> to adjust the behavior of `bootstrap` you may want to override it.
-> There is also `confdrc.local`, which usually is enough to change
-> arguments to scripts like `gen-interfaces`, e.g., to create a bridge
-> by default, you may want to look into `GEN_IFACE_OPTS`.
+> **Note:** you may not need to provide your own `/etc/confdrc`.  The
+> one installed by `confd` is usually enough.  However, if you want to
+> adjust the behavior of `bootstrap` you may want to override it.  There
+> is also `confdrc.local`, which usually is enough to change arguments
+> to scripts like `gen-interfaces`, e.g., to create a bridge by default,
+> you may want to look into `GEN_IFACE_OPTS`.
+
 
 ### Example Snippets
 
-#### IETF System
+**IETF System:**
 
 ```hsib
   "ietf-system:system": {
@@ -204,19 +211,18 @@ bootstrap script for more help, and up-to-date information.
 The `motd-banner` is a binary type, which is basically a Base64 encoded
 text file without line breaks (`-w0`):
 
-```
-$ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" \
-    | base64 -d
+```bash
+$ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" |base64 -d
 .-------.
-|  . .  | Infix OS — Immutable.Friendly.Secure
+|  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.github.io
 '-'---'-'
 ```
 
-#### IETF Keystore
+**IETF Keystore**
 
-Notice how both the public and private keys are left empty here, this
-cause them to be always automatically regenerated after each factory reset.
+Notice how both the public and private keys are left empty here.  The
+`genkey` is always automatically regenerated after each factory reset.
 Keeping the `factory-config` snippet like this means we can use the same
 file on multiple devices, without risking them sharing the same host
 keys.  Sometimes you may want the same host keys, but that is the easy
@@ -239,7 +245,9 @@ use-case and not documented here.
   },
 ```
 
-#### IETF NETCONF Server
+The `genkey` is currently only used by the NETCONF SSH backend.
+
+**IETF NETCONF Server**
 
 ```json
   "ietf-netconf-server:netconf-server": {
@@ -272,30 +280,10 @@ use-case and not documented here.
   },
 ```
 
-#### Infix Services
 
-```json
-  "infix-services:ssh": {
-    "enabled": true,
-    "hostkey": [
-      "genkey"
-    ],
-    "listen": [
-      {
-        "name": "ipv4",
-        "address": "0.0.0.0",
-        "port": 22
-      },
-      {
-        "name": "ipv6",
-        "address": "::1",
-        "port": 22
-      }
-    ]
-  }
-```
 
-## Integration
+Integration
+-----------
 
 When integrating your software stack with Infix there may be protocols
 that want to change system settings like hostname and dynamically set
@@ -322,7 +310,7 @@ root@infix-00-00-00:~# cat hostnm.xml
 </system>
 root@infix-00-00-00:~# edit hostnm.xml
 root@infix-00-00-00:~# sysrepocfg -Ehostnm.xml
-root@example:~#
+root@example:~# 
 ```
 
 Second, perform all changes on `running-config`, the running datastore.
@@ -336,8 +324,8 @@ activate all.)
 
 You can consider the system composed of two entities:
 
-- NETCONF starts up the system using `startup-config`, then
-- Hands over control to your application at runtime
+  - NETCONF starts up the system using `startup-config`, then
+  - Hands over control to your application at runtime
 
 Infix is prepared for this by already having two "runlevels" for these
 two states.  The `startup-config` is applied in runlevel S (bootstrap)
@@ -345,13 +333,15 @@ and the system then enters runlevel 2 for normal operation.
 
 This allow you to keep a set of functionality that is provided by the
 underlying system, and another managed by your application.  You can
-of course in your br2-external provide a sysrepo plugin that block
+of course in your br2-external provide a sysrepo plugin that block 
 operations on certain datastores when your application is enabled.
 E.g., to prevent changes to startup after initial deployment.  In
 that case a proper factory reset would be needed to get back to a
 "pre-deployment" state where you can reconfigure your baseline.
 
-## Releases
+
+Releases
+--------
 
 A release build requires the global variable `INFIX_RELEASE` to be set.
 It can be derived from GIT, if the source tree is kept in GIT VCS.  First,
@@ -361,14 +351,14 @@ let us talk about versioning in general.
 
 Two popular scheme for versioning a product derived from Infix:
 
-1. Track Infix major.minor, e.g. *Foobar v23.08.z*, where `z` is
-   your patch level.  I.e., Foobar v23.08.0 could be based on Infix
-   v23.08.0, or v23.08.12, it is up to you.  Maybe you based it on
-   v23.08.12 and then back ported changes from v23.10.0, but it was
-   the first release you made to your customer(s).
-1. Start from v1.0.0 and step the major number every time you sync
-   with a new Infix release, or every time Infix bumps to the next
-   Buildroot LTS.
+ 1. Track Infix major.minor, e.g. *Foobar v23.08.z*, where `z` is
+    your patch level.  I.e., Foobar v23.08.0 could be based on Infix
+    v23.08.0, or v23.08.12, it is up to you.  Maybe you based it on
+    v23.08.12 and then back ported changes from v23.10.0, but it was
+    the first release you made to your customer(s).
+ 2. Start from v1.0.0 and step the major number every time you sync
+    with a new Infix release, or every time Infix bumps to the next
+    Buildroot LTS.
 
 The important thing is to be consistent, not only for your own sake,
 but also for your end customers.  The *major.minor.patch* style is
@@ -376,40 +366,26 @@ the most common and often recommended style, which usually maps well
 to other systems, e.g. PROFINET GSDML files require this (*VX.Y.Z*).
 But you can of course use only two numbers, *major.minor*, as well.
 
-> [!WARNING]
 > What could be confusing, however, is if you use the name *Infix*
 > with your own versioning scheme.
 
-### Specifying Versioning Information
 
-Two optional environment variables control the version information
-recorded in images. Both of these **must be** a lower-case string (no
-spaces or other characters outside of 0–9, a–z, '.', '_' and '-')
-identifying the operating system version, excluding any OS name
-information or release code name, and suitable for processing by
-scripts or usage in generated filenames.
+### `INFIX_RELEASE`
 
-#### `INFIX_BUILD_ID`
-
-Used for `BUILD_ID` in `/etc/os-release`.
-
-**Default:** `$(git describe --always --dirty --tags)`, from the _top
-directory_. By default, the top directory refers to the root of the
-Infix source tree, but this can be changed by setting the branding
-variable `INFIX_OEM_PATH`, e.g. in a `defconfig` file or via `make
-menuconfig`, to the path of an enclosing br2-external.
-
-#### `INFIX_RELEASE`
+This global variable **must be** a lower-case string (no spaces or
+other characters outside of 0–9, a–z, '.', '_' and '-') identifying
+the operating system version, excluding any OS name information or
+release code name, and suitable for processing by scripts or usage
+in generated filenames.
 
 Used for `VERSION` and `VERSION_ID` in `/etc/os-release` and
 generated file names like disk images, etc.
 
-**Default:** `${INFIX_BUILD_ID}`
+**Default:** generated using `git describe --always --dirty --tags`,
+with an additional `-C $infix_path`.  This variable defaults to the
+Infix tree and can be changed by setting the menuconfig branding
+variable `INFIX_OEM_PATH` to that of the br2-external.  It is also
+possible to set the `GIT_VERSION` variable in your `post-build.sh`
+script to change how the VCS version is extracted.
 
-[^1]: The base MAC address is defined in the device's Vital Product
-    Data (VPD) EEPROM, or similar, which is used by the kernel to
-    create the system interfaces.  This MAC address is usually also
-    printed on a label on the device.
-
-[NanoPi R2S]:    https://github.com/kernelkit/infix/blob/main/board/aarch64/r2s/rootfs/etc/factory-config.cfg
-[os-release(5)]: https://www.freedesktop.org/software/systemd/man/os-release.html
+[NanoPi R2S]: https://github.com/kernelkit/infix/blob/main/board/aarch64/r2s/rootfs/etc/factory-config.cfg

doc/cli/configure.md

@@ -1,4 +1,5 @@
-# CLI Configure Context
+Configure Context
+-----------------
 
 Enter the configure context from admin-exec by typing `configure`
 followed by Enter.  Available commands, press `?` at the prompt:
@@ -40,17 +41,14 @@ admin@host:/config/interface/eth0/> up
 admin@host:/config/>
 ```
 
-----
-
-> **Note:** commands in configure context are automatically generated
-> from the system's YANG models, hence different products likely have a
-> different set of commands.  However, both the `ietf-interfaces.yang`
-> and `ietf-ip.yang` models, for instance, that provide the networking
+> **Note:** the tree structure in the configure context is automatically
+> generated from the system's supported NETCONF YANG models, which may
+> vary between products.  However, the `ietf-interfaces.yang` and
+> `ietf-ip.yang` models, for instance, that provide basic networking
 > support are common to all systems.
 
-----
 
-## Set IP Address on an Interface
+### Set IP Address on an Interface
 
 ```
 admin@host:/config/> edit interface eth0
@@ -75,7 +73,7 @@ interfaces {
 ```
 
 
-## Saving Changes
+### Saving Changes
 
 Apply the changes (from candidate to `running-config`):
 
@@ -106,14 +104,11 @@ admin@host:/> copy running-config startup-config
 The `startup-config` can also be inspected with the `show` command to
 verify the changes are saved.
 
-----
+> **Note:** most (all) commands need to be spelled out, no short forms
+> are allowed at the moment.  Use the `TAB` key to make this easier.
 
-> **Note:** all commands need to be spelled out, no short forms are
-> allowed in the CLI.  Use the `TAB` key to make your life easier.
 
-----
-
-## Changing Hostname
+### Changing Hostname
 
 Settings like hostname are located in the `ietf-system.yang` model.
 Here is how it can be set.
@@ -128,14 +123,11 @@ admin@example:/>
 Notice how the hostname in the prompt does not change until the change
 is committed.
 
-----
-
 > **Note:** critical services like syslog, mDNS, LLDP, and similar that
 > advertise the hostname, are restarted when the hostname is changed.
 
-----
 
-## Changing Password
+### Changing Password
 
 User management, including passwords, is also a part of `ietf-system`.
 
@@ -157,15 +149,12 @@ the `do password encrypt` command.  This launches the admin-exec command
 to hash, and optionally salt, your password.  This encrypted string can
 then be used with `set password ...`.
 
-----
-
 > **Tip:** if you are having trouble thinking of a password, there is
 > also `do password generate`, which generates random but readable
 > strings using the UNIX command `pwgen`.
 
-----
 
-## SSH Authorized Key
+### SSH Authorized Key
 
 Logging in remotely with SSH is possible by adding a *public key* to a
 user.  Here we add the authorized key to the admin user, multiple keys
@@ -185,15 +174,11 @@ key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTT
 admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> leave
 ```
 
-----
-
 > **Note:** the `ssh-keygen` program already base64 encodes the public
 > key data, so there is no need to use the `text-editor` command, `set`
 > does the job.
 
-----
-
-## Creating a VETH Pair
+### Creating a VETH Pair
 
 The following example creates a `veth0a <--> veth0b` virtual Ethernet
 pair which is useful for connecting, e.g., a container to the physical
@@ -229,15 +214,12 @@ admin@host:/config/> leave
 
 See the bridging example below for more.
 
-----
-
 > **Note:** in the CLI you do not have to create the `veth0b` interface.
 > The system _infers_ this for you.  When setting up a VETH pair using
 > NETCONF, however, you must include the `veth0b` interface.
 
-----
 
-## Creating a Bridge
+### Creating a Bridge
 
 Building on the previous example, we now create a non-VLAN filtering
 bridge (`br0`) that forwards any, normally link-local, LLDP traffic
@@ -291,10 +273,6 @@ the VETH pair from the previous example) are now bridged.  Any traffic
 ingressing one port will egress the other.  Only reserved IEEE multicast
 is filtered, except LLDP frames as shown above.
 
-----
-
 > **Note:** the bridge can be named anything, provided the interface
 > name is not already taken.  However, for any name outside the pattern
 > `br[0-9]+`, you have to set the interface type manually to `bridge`.
-
-----

doc/cli/introduction.md

@@ -1,4 +1,4 @@
-# CLI Introduction
+# Introduction
 
 The command line interface (CLI, see-ell-aye) implements a CISCO-like,
 or Juniper Networks JunOS-like, CLI.  It is the traditional way of
@@ -10,7 +10,8 @@ Nevertheless, when it comes to initial deployment and debugging, it
 is very useful to know how to navigate and use the CLI.  This very
 short guide intends to help you with that.
 
-----
+
+## About
 
 New users usually get the CLI as the default "shell" when logging in,
 but the default `admin` user logs in to `bash`.  To access the CLI,
@@ -34,12 +35,9 @@ admin@host-12-34-56:/> show                   # Try: Tab or ?
 admin@host-12-34-56:/>                        # Try: Tab or ?
 ```
 
-----
+> **Tip:** Even on an empty command line you can tap the Tab or ? keys.
+> See `help keybindings` for more tips!
 
-> **Note:** even on an empty command line, you can tap the `Tab` or `?` keys.  
-> See [`help keybindings`](keybindings.md) for more tips!
-
-----
 
 ## Key Concepts
 
@@ -131,15 +129,10 @@ In *configure context* the following commands are available:
 | `do command`      | Call admin-exec command: `do show log`                 |
 | `commit`          |                                                        |
 
+### Example Session
 
-## Example Session
-
-----
-
-> Remember to use the `TAB` and `?` keys to speed up your navigation.  
-> See [`help keybindings`](keybindings.md) for more tips!
-
-----
+> Remember to use the `TAB` and `?` keys to speed up your navigation.
+> See `help keybindings` for more tips!
 
 In this example we enter configure context to add an IPv4 address to
 interface `eth0`, then we apply the changes using the `leave` command.
@@ -187,3 +180,4 @@ admin@host-12-34-56:/> copy startup-config running-config
 ```
 
 Or restarting the device.
+

doc/cli/keybindings.md

@@ -1,4 +1,4 @@
-# CLI Keybindings
+# Keybindings
 
 Writing CLI commands by hand is very tedious.  To make things easier the
 CLI has several keybindings, most significant first:
@@ -27,12 +27,10 @@ CLI has several keybindings, most significant first:
 | Ctrl-n  | Down arrow     | History, next command                            |
 | Ctrl-r  |                | History, reversed interactive search (i-search)  |
 
-## What is Meta?
+> **Note:** the Meta key is called Alt on most modern keyboards.  If you
+> have neither, first tap the Esc key instead of holding down Alt/Meta.
 
-The Meta key is called Alt on most modern keyboards.  If you have
-neither, first tap the Esc key instead of holding down Alt/Meta.
-
-## Usage
+## Examples
 
 Complete a word.  Start by typing a few characters, then tap the TAB key
 on your keyboard:

doc/cli/netcalc.md

@@ -1,4 +1,4 @@
-# Network Calculator
+## Usage
 
 ```
 netcalc <ADDRESS/LEN | NETWORK NETMASK> [split <1-32 | 64-128>]
@@ -12,8 +12,8 @@ information about the subnet.  Both IPv4 and IPv6 is supported.
 
 A subnet can be entered in two ways:
 
-- `192.168.2.0 255.255.255.0`: traditional IPv4 'address netmask' style
-- `192.168.2.0/24`: modern prefix length, same also for IPv6
+ - `192.168.2.0 255.255.255.0`: traditional IPv4 'address netmask' style
+ - `192.168.2.0/24`: modern prefix length, same also for IPv6
 
 An optional `split LEN` can be given as argument, the new length value
 must be bigger than the current prefix length.  See example below.

doc/cli/quick.md

@@ -1,4 +1,4 @@
-# CLI Quickstart Guide
+# Quick Overview
 
 The question mark `?` key along with the `Tab` key are your best friends
 in the command line interface.  They provide context help and completion
@@ -16,17 +16,14 @@ of commands you input.  See the table below for a handful of examples.
 Explore the following topics for more information.  Note, the
 keybindings are really useful to learn!
 
-| **Command**         | **Description**                                    |
-|---------------------|----------------------------------------------------|
-| `help introduction` | An introduction to the CLI                         |
-| `help configure`    | How to use configure context                       |
-| `help text-editor`  | Help with the built-in text-editor command         |
-| `help keybindings`  | Lists available keybindings & other helpful tricks |
-
-----
+| **Command**         | **Description**                            |
+|---------------------|--------------------------------------------|
+| `help introduction` | An introduction to the CLI                 |
+| `help configure`    | How to use configure context               |
+| `help text-editor`  | Help with the built-in text-editor command |
+| `help keybindings`  | Lists keybindings and other helpful tricks |
 
 > In `configure` context the `help setting` command shows the YANG
 > description text for each node and container.  To reach the admin
 > exec help from configure context, e.g., `do help text-editor`
 
-----

doc/cli/tcpdump.md

@@ -1,4 +1,4 @@
-# Network Monitoring
+## Network Traffic Inspection
 
 `tcpdump` is useful tool for analyzing and diagnosing network problems.
 This document presents the limited feature set that exposed is in the
@@ -10,7 +10,7 @@ A section called [Examples](#examples) follows that, which may be what
 you want to scroll down to.
 
 
-## Hardware Overview
+### Hardware Overview
 
 Using `tcpdump` effectively requires an understanding of how the
 underlying hardware works.  For a standard PC, or common single-board
@@ -57,21 +57,17 @@ up the switch core to mirror traffic ingressing and/or egressing a set
 of ports to another port.  On this *monitor port* you can then run your
 tcpdump, which means you need an external device (laptop).
 
-----
-
 > A planned feature is to support mirroring traffic to the CPU port,
 > which would be an effective way to log and monitor traffic over a
 > longer period of time.  Highly effective for diagnosing intermittent
 > and other rare network issues.
 
-----
-
 If only "proof of life" is required, then sometimes port counters, also
 called *RMON counters*, can be very useful too.  Seeing counters of a
 particular type increment means traffic is ingressing or egressing.
 
 
-## Examples
+### Examples
 
 Listen to all traffic on an interface:
 

doc/cli/text-editor.md

@@ -44,13 +44,10 @@ C-x i   insert    C-x g   goto-ln  C-x o other win   C-x C-x swap     M-q reform
   - tap `c`
   - release `Ctrl`
 
-----
-
 > The status field at the bottom asks if you are really sure, and/or if
 > you want to add a final Enter/newline to the file.  For binary content
 > that final newline may be important.
 
-----
 
 ## Changing the Editor
 

doc/cli/upgrade.md

@@ -1,4 +1,5 @@
-# Upgrading the System
+Upgrading the Software
+----------------------
 
 The admin-exec command `upgrade` can be used to install software images, or
 bundles.  A bundle is a signed and self-contained package that carries all the
@@ -38,8 +39,6 @@ The secondary partition (`rootfs.1`) has now been upgraded and will be used as
 the *active* partition on the next boot.  Leaving the primary partition, with
 the version we are currently running, intact in case of trouble.
 
-See [Upgrade & Boot Order](../upgrade.md) for more information on upgrading.
-
 [^1]: It is not possible to upgrade the partition we booted from.  Thankfully
     the underlying "rauc" subsystem keeps track of this.  Hence, to upgrade
     both partitions you must reboot to the new version (to verify it works)

doc/container.md

@@ -1,15 +1,39 @@
-Docker Container Support
-========================
+Containers in Infix
+===================
+<img align="right" src="img/docker.webp" alt="Docker whale" width=360>
 
-![Docker whale](img/docker.webp){ align=right width="360" }
+* [Introduction](#introduction)
+* [Caution](#caution)
+* [Getting Started](#getting-started)
+  * [Examples](#examples)
+* [Container Images](#container-images)
+* [Upgrading a Container Image](#upgrading-a-container-image)
+* [Networking and Containers](#networking-and-containers)
+  * [Container Bridge](#container-bridge)
+  * [Container Host Interface](#container-host-interface)
+  * [Host Networking](#host-networking)
+* [Mounts and Volumes](#mounts-and-volumes)
+  * [Content Mounts](#content-mounts)
+* [Example Containers](#example-containers)
+  * [System Container](#system-container)
+  * [Application Container: nftables](#application-container-nftables)
+  * [Application Container: ntpd](#application-container-ntpd)
+* [Advanced](#advanced)
+  * [Running Host Commands From Container](#running-host-commands-from-container)
+* [Container Requirements](#container-requirements)
+  * [Advanced Users](#advanced-users)
+
+
+Introduction
+------------
 
 Infix comes with native support for Docker containers using [podman][].
 The [YANG model][1] describes the current level of support, complete
 enough to run both system and application containers.
 
-Key design features of Infix, like using Linux switchdev, allow users to
-assign switch ports directly to containers, not just bridged VETH pairs.
-This is a rare and in many cases *unique* feature of Infix.
+Key design features, like using Linux switchdev, allow users to assign
+switch ports directly to containers, not just bridged VETH pairs, this
+is a rare and in many cases *unique* feature of Infix.
 
 All network specific settings are done using the IETF interfaces YANG
 model, with augments for containers to ensure smooth integration with
@@ -19,7 +43,7 @@ container networking in podman.
 > Even though the `podman` command can be used directly from a shell
 > prompt, we strongly recommend using the CLI commands instead.  They
 > employ the services of a wrapper `container` script which handles the
-> integration of Docker containers in the system.
+> integration of containers in the system.
 
 
 Caution
@@ -59,20 +83,18 @@ In the CLI, containers can be run in one of two ways:
  1. `container run IMAGE [COMMAND]`, or
  2. enter `configure` context, then `edit container NAME`
 
-The first is useful mostly for testing, or running single commands in
-an image.  It is a wrapper for `podman run -it --rm ...`.
+The former is useful mostly for testing, or running single commands in
+an image.  It is a wrapper for `podman run -it --rm ...`, while the
+latter is a wrapper and adaptation of `podman create ...`.
 
-The second creates a read-only container that by default automatically
-start at every boot.   It basically wraps `podman create ...`.
+The second creates a read-only container that is automatically started
+at every boot.  When non-volatile storage is needed, data stored in a
+volume is persisted until explicitly removed from the configuration,
+i.e., across host and container reboots and upgrades.
 
-When non-volatile storage is needed two complementary options exist:
-
- - **Volumes:** data stored in a volume is persisted until explicitly
-   removed from the configuration, i.e., across host reboots and
-   container upgrades
- - **[Content Mounts](#content-mounts):** where the content of a file
-  mounted into the container is kept along with the container
-  configuration in the device's `startup-config`
+Another option is [Content Mounts](#content-mounts), where the content
+of a file mounted into the container is kept along with the container
+configuration in the device's `startup-config`.
 
 Podman ensures (using tmpfs) all containers have writable directories
 for certain critical file system paths: `/dev`, `/dev/shm`, `/run`,
@@ -86,9 +108,10 @@ your container image and application to run.
 > support the CPU architecture of your host system.  Remember, unlike
 > virtualization, containers reuse the host's CPU and kernel.
 
-![Hello World](img/docker-hello-world.svg){ align=right width="200" }
 
-### Example: Hello World
+<img align="right" src="img/docker-hello-world.svg" alt="Hello World" width=360>
+
+### Examples
 
 Classic Hello World:
 
@@ -104,32 +127,24 @@ Classic Hello World:
     Hello from Docker!
     This message shows that your installation appears to be working correctly.
 
-### Example: Web Server
-
-A web server with [nginx][], using standard docker bridge.  Podman will
-automatically create a VETH pair for us, connecting the container to the
-`docker0` bridge:
+Persistent web server using nginx, sharing the host's network:
 
     admin@example:/> configure
-    admin@example:/config/> edit interface docker0
-    admin@example:/config/interface/docker0/> set container-network
-    admin@example:/config/interface/docker0/> end
-    admin@example:/config/> edit container web
-    admin@example:/config/container/web/> set image docker://nginx:alpine
-    admin@example:/config/container/web/> set network publish 8080:80
-    admin@example:/config/container/web/> set network interface docker0
-    admin@example:/config/container/web/> set volume cache target /var/cache
-    admin@example:/config/container/web/> leave
+    admin@example:/config> edit container web
+    admin@example:/config/container/web> set image docker://nginx:alpine
+    admin@example:/config/container/web> set publish 80:80
+    admin@example:/config/container/web> set network host
+    admin@example:/config/container/web> leave
     admin@example:/> show container
 
 Exit to the shell and verify the service with curl, or try to attach
 to your device's IP address using your browser:
 
-    admin@example:~$ curl http://localhost:8080
+    admin@example:~$ curl http://localhost
 
-or connect to port 8080 of your running Infix system with a browser.
-See the following sections for how to add more interfaces and manage
-your container at runtime.
+or connect to port 80 of your running Infix system with a browser.  See
+the following sections for how to add more interfaces and manage your
+container at runtime.
 
 
 Container Images
@@ -256,7 +271,7 @@ archive, which helps greatly with container upgrades (see below):
 
 Upgrading a Container Image
 ---------------------------
-![Up-to-date Shield](img/shield-checkmark.svg){ align=right width="100" }
+<img align="right" src="img/shield-checkmark.svg" alt="Hello World" width=100>
 
 The applications in your container are an active part of the system as a
 whole, so make it a routine to keep your container images up-to-date!
@@ -441,11 +456,11 @@ in a `bridge`.  Below an example of a system container calls `set
 network interface docker0`, here we show how to set options for that
 network:
 
-    admin@example:/config/container/ntpd/> edit network interface docker0
-    admin@example:/config/container/ntpd/network/interface/docker0/>
-    admin@example:/config/container/ntpd/network/interface/docker0/> set option
+    admin@example:/config/container/ntpd/> edit network docker0 
+    admin@example:/config/container/ntpd/network/docker0/> 
+    admin@example:/config/container/ntpd/network/docker0/> set option 
     <string>  Options for masquerading container bridges.
-    admin@example:/config/container/ntpd/network/interface/docker0/> help option
+    admin@example:/config/container/ntpd/network/docker0/> help option 
     NAME
             option <string>
     
@@ -456,9 +471,9 @@ network:
                      mac=00:01:02:c0:ff:ee -- set fixed MAC address in container
                      interface_name=foo0   -- set interface name inside container
     
-    admin@example:/config/container/ntpd/network/interface/docker0/> set option ip=172.17.0.2
-    admin@example:/config/container/ntpd/network/interface/docker0/> set option interface_name=wan
-    admin@example:/config/container/ntpd/network/interface/docker0/> leave
+    admin@example:/config/container/ntpd/network/docker0/> set option ip=172.17.0.2
+    admin@example:/config/container/ntpd/network/docker0/> set option interface_name=wan
+    admin@example:/config/container/ntpd/network/docker0/> leave
 
 
 ### Container Host Interface
@@ -888,5 +903,4 @@ Container Image](#upgrading-a-container-image) (above).
 [14]:     https://github.com/kernelkit/curiOS/
 [15]:     https://github.com/kernelkit/curiOS/blob/2e4748f65e356b2c117f586cd9420d7ba66f79d5/board/system/rootfs/etc/inittab
 [tini]:   https://github.com/krallin/tini
-[nginx]:  https://hub.docker.com/_/nginx
 [podman]: https://podman.io

doc/developers-guide.md

@@ -14,9 +14,6 @@ the Buildroot `make menuconfig` system.
          -> System configuration
             -> [*]Enable root login with password
 
-> [!IMPORTANT]
-> Please see the [Contributing](#contributing) section, below, for
-> details on how to fork and clone when contributing to Infix.
 
 Cloning
 -------
@@ -28,12 +25,14 @@ tree to your PC:
 ```bash
 $ mkdir ~/Projects; cd ~/Projects
 $ git clone https://github.com/kernelkit/infix.git
-..
 $ cd infix/
 $ git submodule update --init
-..
 ```
 
+> Please see the [Contributing](#contributing) section, below, for
+> details on how to fork and clone when contributing to Infix.
+
+
 ### Customer Builds
 
 Customer builds add product specific device trees, more OSS packages,
@@ -58,10 +57,6 @@ Other caveats should be documented in the customer specific trees.
 Building
 --------
 
-> [!TIP]
-> For more details, see the Getting Started and System Requirements
-> sections of the [excellent Buildroot manual][1].
-
 Buildroot is almost stand-alone, it needs a few locally installed tools
 to bootstrap itself.  The most common ones are usually part of the base
 install of the OS, but specific ones for building need the following.
@@ -72,10 +67,12 @@ $ sudo apt install bc binutils build-essential bzip2 cpio \
                    diffutils file findutils git gzip      \
                    libncurses-dev libssl-dev perl patch   \
                    python3 rsync sed tar unzip wget       \
-                   autopoint bison flex autoconf automake \
-                   mtools
+                   autopoint bison flex autoconf automake
 ```
 
+> For details, see the Getting Started and System Requirements sections
+> of the [excellent manual][1].
+
 To build an Infix image; select the target and then make:
 
     make x86_64_defconfig
@@ -98,43 +95,12 @@ and services are required on your system:
 ```bash
 $ sudo apt install jq graphviz qemu-system-x86 qemu-system-arm \
 				   ethtool gdb-multiarch tcpdump tshark
-..
 ```
 
 To be able to build the test specification you also need:
 
 ```bash
 $ sudo apt-get install python3-graphviz ruby-asciidoctor-pdf
-..
-```
-
-### Documentation
-
-The documentation is written in Markdown, with GitHub extensions, and
-published using [MkDocs, material theme][11].  This means some features
-require MkDocs *hinting* which may not render fully when previewing on
-GitHub -- this is OK.
-
-MkDocs is packaged and available to install via `apt`, but not all of
-the plugins and extensions we rely on are available, so instead we do
-recommend using `pipx` to install the necessary tooling:
-
-```bash
-$ sudo apt install pipx
-$ pipx install mkdocs
-$ pipx inject mkdocs mkdocs-material pymdown-extensions mkdocs-callouts mike mkdocs-to-pdf
-```
-
-The last two packages, `mike` and `mkdocs-to-pdf`, are used for online
-versioning and PDF generation by GitHub Actions, but since they are in
-the `mkdocs.yml` file, everyone who wants to preview the documentation
-have to install all the tooling.
-
-Preview with:
-
-```
-$ cd ~/src/infix/
-$ mkdocs serve
 ```
 
 
@@ -165,16 +131,6 @@ This rebuilds (and installs) `foo` and `bar`, the `all` target calls
 on Buildroot to finalize the target filesystem and generate the images.
 The final `run` argument is explained below.
 
-
-### YANG Model
-
-When making changes to the `confd` and `statd` services, you will often
-need to update the YANG models.  If you are adding a new YANG module,
-it's best to follow the structure of an existing one.  However, before
-making any changes, **always discuss them with the Infix core team**.
-This helps avoid issues later in development and makes pull request
-reviews smoother.
-
 ### `confd`
 
 The Infix `src/confd/` is the engine of the system.  Currently it is a
@@ -208,232 +164,29 @@ Now you can rebuild `confd`, just as described above, and restart Infix:
     make confd-rebuild all run
 
 
-### `statd`
-
-The Infix status daemon, `src/statd`, is responsible for populating the
-sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions,
-but unlike `confd`, it relies entirely on `yanger`, a Python script that
-gathers data from local linux services and feeds it into sysrepo.
-
-To apply changes, rebuild the image:
-
-    make python-statd-rebuild statd-rebuild all
-
-Rebuilding the image and testing on target for every change during
-development process can be tedious. Instead, `yanger` allows remote
-execution, running the script directly on the host system (test
-container):
-
-    infamy0:test # ../src/statd/python/yanger/yanger -x "../utils/ixll -A ssh d3a" ieee802-dot1ab-lldp
-
-`ixll` is a utility script that lets you run network commands using an
-**interface name** instead of a hostname. It makes operations like
-`ssh`, `scp`, and network discovery easier.
-
-Normally, `yanger` runs commands **locally** to retrieve data
-(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when
-executed with `-x "../utils/ixll -A ssh d3a"` it redirects these
-commands to a remote system connected to the local `d3a` interface via
-SSH. This setup is used for running `yanger` in an
-[interactive test environment](testing.md#interactive-usage). The yanger
-script runs on the `host` system, but key commands are executed on the
-`target` system.
-
-For debugging or testing, you can capture system command output and
-replay it later without needing a live system.
-
-To capture:
-
-    infamy0:test # ../src/statd/python/yanger/yanger -c /tmp/capture ieee802-dot1ab-lldp
-
-To replay:
-
-    infamy0:test # ../src/statd/python/yanger/yanger -r /tmp/capture ieee802-dot1ab-lldp
-
-This is especially useful when working in isolated environments or debugging
-issues without direct access to the DUT.
-
-
-## Upgrading Packages
-
-### Buildroot
-
-The Kernelkit team maintains an internal [fork of Buildroot][9], with
-branches following the naming scheme `YYYY.MM.patch-kkit`
-e.g. `2025.02.1-kkit`, which means a new branch should be created
-whenever Buildroot is updated. These branches should contain **only**
-changes to existing packages (but no new patches), modifications to
-Buildroot itself or upstream backports.
-
-The team tracks the latest Buildroot LTS (Long-Term Support) release and
-updates.  The impact of minor LTS release upgrades is expected to have a
-very low impact and should be done as soon there is a patch release of a
-Buildroot LTS available.
-
-> **Depending on your setup, follow the appropriate steps below.**
-
-#### Repo locally cloned already
-
-1. Navigate to the Buildroot directory
-
-        cd buildroot/
-
-1. Pull the latest changes from KernelKit
-
-        git pull
-
-1. Fetch the latest tags from upstream
-
-        git fetch upstream --tags
-
-#### No local repo yet
-
-1. Clone the Kernelkit Buildroot repository
-
-        git clone git@github.com:kernelkit/buildroot.git
-
-1. Add the upstream remote
-
-        git remote add upstream https://gitlab.com/buildroot.org/buildroot.git
-
-1. Checkout old KernelKit branch
- 
-        git checkout 2025.02.1-kkit
- 
-> [!NOTE] 
-> Below, it is **not** allowed to rebase the branch when bumped in Infix.
-
-#### Continue Here
-
-1. Create a new branch based on the **previous** KernelKit Buildroot
-   release (e.g.  `2025.02.1-kkit`) and name it according to the naming
-   scheme (e.g. `2025.02.2-kkit`)
-
-        git checkout -b 2025.02.2-kkit
-
-1. Rebase the new branch onto the corresponding upstream release
-
-        git rebase 2025.02.2
-
-1. Push the new branch and tags
-
-        git push origin 2025.02.2-kkit --tags
-
-1. In Infix, checkout new branch of Buildroot
-
-        cd buildroot
-        git fetch
-        git checkout 2025.02.2-kkit
-
-1. Commit and push the changes.  *Remember to update the ChangeLog!*
-
-1. Create a pull request.
-
-> [!NOTE] 
-> Remember to set the pull request label to `ci:main` to ensure full CI
-> coverage.
-
-
-### Linux kernel
-
-The KernelKit team maintains an internal [fork of Linux kernel][10],
-with branches following the naming scheme `kkit-linux-[version].y`,
-e.g. `kkit-6.12.y`, which means a new branch should be created whenever
-the major kernel version is updated. This branch should contain *all*
-kernel patches used by Infix.
-
-The team tracks the latest Linux kernel LTS (Long-Term Support) release
-and updates.  The upgrade of LTS minor releases is expected to have low
-impact and should be done as soon as a patch release of the LTS Linux
-kernel is available.
-
-#### Repo locally cloned already
-
-1. Navigate to the Linux kernel directory
-
-        cd linux
-
-1. Get latest changes from KernelKit
-
-        git pull
-
-1. Fetch the latest tags from upstream
-
-        git fetch upstream --tags
-
-#### No local repo yet
-
-1. Clone the KernelKit Linux kernel repository
-
-        git clone git@github.com:kernelkit/linux.git
-
-1. Add the upstream remote
-
-        git remote add upstream git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
-
-1. Checkout correct kernel branch
-
-        git checkout kkit-linux-6.12.y
-
-#### Continue Here
-
-1. Rebase on the upstream release
-
-        git rebase v6.12.29
-
-1. Push changes and the tags
- 
-        git push -f origin kkit-linux-6.12.y --tags
-
-**Move to your Infix source tree**
-
-> [!NOTE] 
-> See help of `kernel-refresh.sh` script for more information.
-
-1. Generate patches
-
-        make x86_64_defconfig
-        cd output
-        ../utils/kernel-refresh.sh -k /path/to/linux -o 6.12.28 -t v6.12.29
-
-1. Commit and push the changes.  Remember to update the ChangeLog
-1. Create a pull request
-
-> [!NOTE] 
-> Remember to set the pull request label to `ci:main` to ensure full CI
-> coverage.
-
-
-
 Testing
 -------
 
 Manual testing can be done using Qemu by calling <kbd>make run</kbd>,
-see also [Infix in Virtual Environments](virtual.md), or on a physical
-device by upgrading to the latest build or "[netbooting](netboot.md)"
-and running the image from RAM.  The latter is how most board porting
-work is done -- **much quicker** change-load-test cycles.
+see also [Infix in Virtual Environments](virtual.md).
 
 The Infix automated test suite is built around Qemu and [Qeneth][2], see:
 
- * [Regression Testing with Infamy](testing.md)
- * [Docker Image](https://github.com/kernelkit/infix/blob/main/test/docker/README.md)
-
-With any new feature added to Infix, it is essential to include relevant
-test case(s).  See the [Test Development](testing.md#test-development)
-section for guidance on adding test cases.
+ * [Testing](testing.md)
+ * [Docker Image](../test/docker/README.md)
 
 
 Reviewing
 ---------
 
-While reviewing a pull request, you might find yourself wanting to play
-around with a VM running that _exact_ version.  For such occasions,
-[gh-dl-artifact.sh][8] is your friend in need!  It employs the [GitHub
-CLI (gh)](https://cli.github.com) to locate a prebuilt image from our CI
+While reviewing a pull request, you might find yourself wanting to
+play around with a VM running that _exact_ version.  For such
+occations, [gh-dl-artifact.sh](../utils/gh-dl-artifact.sh) is your
+friend in need!  It will use the [GitHub CLI
+(gh)](https://cli.github.com) to locate a prebuilt image from our CI
 workflow, download it, and prepare a local output directory from which
-you can launch both `make run` instances, and run regression tests with
-`make test` and friends.
+you can launch both `make run` instances, and run regression tests
+with `make test` and friends.
 
 For example, if you are curious about how PR 666 behaves in some
 particular situation, you can use `gh` to switch to that branch, from
@@ -445,10 +198,10 @@ corresponding image for execution with our normal tooling:
     cd x-artifact-a1b2c3d4-x86_64
     make run
 
-> [!NOTE]
-> CI artifacts are built from a merge commit of the source and target
-> branches.  Therefore, the version in the Infix banner will not match
-> the SHA of the commit you have checked out.
+> **Note:** CI artifacts are built from a merge commit of the source
+> and target branches.  Therefore, the version in the Infix banner
+> will not match the SHA of the commit you have checked out.
+
 
 Contributing
 ------------
@@ -460,32 +213,28 @@ fork, and then use GitHub to create a *Pull Reqeuest*.
 For this to work as *painlessly as possible* for everyone involved:
 
  1. Fork Infix to your own user or organization[^1]
- 1. Fork all the Infix submodules, e.g., `kernelkit/buildroot` to your
+ 2. Fork all the Infix submodules, e.g., `kernelkit/buildroot` to your
     own user or organization as well
- 1. Clone your fork of Infix to your laptop/workstation
- 1. [Deactivate the Actions][6] you don't want in your fork
- 1. Please read the [Contributing Guidelines][5] as well!
+ 3. Clone your fork of Infix to your laptop/workstation
+ 4. [Deactivate the Actions][6] you don't want in your fork
+ 5. Please read the [Contributing Guidelines][5] as well!
 
 ```bash
 $ cd ~/Projects
 $ git clone https://github.com/YOUR_USER_NAME/infix.git
-...
 $ cd infix/
 $ git submodule update --init
-...
 ```
-
-> [!NOTE]
-> When updating/synchronizing with upstream Infix changes you may have
-> to synchronize your forks as well.  GitHub have a `Sync fork` button
-> in the GUI for your fork for this purpose.  A cronjob on your server
-> of choice can do this for you with the [GitHub CLI tool][7].
+> **Note:** when updating/synchronizing with upstream Infix changes you
+> may have to synchronize your forks as well.  GitHub have a `Sync fork`
+> button in the GUI for your fork for this purpose.  A cronjob on your
+> server of choice can do this for you with the [GitHub CLI tool][7].
 
 [^1]: Organizations should make sure to lock the `main` (or `master`)
     branch of their clones to ensure members do not accidentally merge
     changes there.  Keeping these branches in sync with upstream Infix
     is highly recommended as a baseline and reference.  For integration
-    of local changes another company-specific branch can be used instead.
+	of local changes another company-specific branch can be used instead.
 
 [0]: https://github.com/kernelkit/infix/releases
 [1]: https://buildroot.org/downloads/manual/manual.html
@@ -495,7 +244,3 @@ $ git submodule update --init
 [5]: https://github.com/kernelkit/infix/blob/main/.github/CONTRIBUTING.md
 [6]: https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-workflow-runs/disabling-and-enabling-a-workflow
 [7]: https://cli.github.com/
-[8]: https://github.com/kernelkit/infix/blob/main/utils/gh-dl-artifact.sh
-[9]: https://github.com/kernelkit/buildroot
-[10]: https://github.com/kernelkit/linux
-[11]: https://squidfunk.github.io/mkdocs-material/

doc/dhcp.md

@@ -1,171 +0,0 @@
-DHCP Server
-===========
-
-The DHCPv4 server provides automatic IP address assignment and network
-configuration for clients.  It supports address pools, static host
-assignments, and customizable DHCP options.  It also serves as a DNS
-proxy for local subnets and can even forward queries to upstream DNS
-servers[^1].
-
-> [!NOTE]
-> When using the CLI, the system automatically enables essential options
-> like DNS servers and default gateway based on the system's network
-> configuration.  These options can be disabled, changed or overridden,
-> at any level: global, subnet, or per-host.
-
-
-## Basic Configuration
-
-The following example configures a DHCP server for subnet 192.168.2.0/24
-with an address pool:
-
-```
-admin@example:/> configure
-admin@example:/config/> edit dhcp-server
-admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> leave
-```
-
-When setting up the server from the CLI, the system automatically adds a
-few default DHCP options that will be sent to clients: both DNS server
-and default gateway will use the system address on the matching
-interface.
-
-```
-admin@example:/> show running-config
-  "infix-dhcp-server:dhcp-server": {
-    "subnet": [
-      {
-        "subnet": "192.168.2.0/24",
-        "option": [
-          {
-            "id": "dns-server",
-            "address": "auto"
-          },
-          {
-            "id": "router",
-            "address": "auto"
-          }
-        ],
-        "pool": {
-          "start-address": "192.168.2.100",
-          "end-address": "192.168.2.200"
-        }
-      }
-    ]
-  }
-```
-
-> [!IMPORTANT]
-> Remember to set up an interface in this subnet, avoid using addresses
-> in the DHCP pool, or reserved for static hosts.  In Class C networks
-> the router usually has address `.1`.  Depending on the use-case, you
-> may also want to set up routing.
-
-
-## Static Host Assignment
-
-To reserve specific IP addresses for clients based on their MAC address,
-hostname, or client ID:
-
-```
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit host 192.168.2.10
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> set match mac-address 00:11:22:33:44:55
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> set hostname printer
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> leave
-```
-
-Match hosts using a client identifier instead of MAC address:
-
-```
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> edit host 192.168.1.50
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> edit match
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/match/> set client-id hex c0:ff:ee
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/match/> leave
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> set lease-time infinite
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> leave
-```
-
-The `hex` prefix here ensures matching of client ID is done using the
-hexadecimal octets `c0:ff:ee`, three bytes.  Without the prefix the
-ASCII string "c0:ff:ee", eight bytes, is used.
-
-> [!NOTE]
-> The DHCP server is fully RFC conformant, in the case of option 61 this
-> means that using the `hex` prefix will require the client to set the
-> `htype` field of the option to `00`.  See RFC 2132 for details.
-
-
-## Custom DHCP Options
-
-Configure additional DHCP options globally, per subnet, or per host:
-
-```
-admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit option dns-server
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/dns-server/> set address 8.8.8.8
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/dns-server/> leave
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit option ntp-server
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/ntp-server/> set address 192.168.2.1
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/ntp-server/> leave
-```
-
-When configuring, e.g., `dns-server`, or `router` options with the value
-`auto`, the system uses the IP address from the interface matching the
-subnet.  For example:
-
-```
-admin@example:/> show interfaces brief
-Interface    Status  Address
-eth0         UP      192.168.1.1/24
-eth1         UP      192.168.2.1/24
-
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> edit option dns-server
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/option/dns-server/> set address auto
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/option/dns-server/> leave
-```
-
-In this case, clients in subnet 192.168.1.0/24 will receive 192.168.1.1
-as their DNS server address.
-
-
-## Multiple Subnets
-
-Configure DHCP for multiple networks:
-
-```
-admin@example:/> configure
-admin@example:/config/> edit dhcp-server
-admin@example:/config/dhcp-server/> edit subnet 192.168.1.0/24
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> set pool start-address 192.168.1.100 end-address 192.168.1.200
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> leave
-admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> leave
-```
-
-
-## Monitoring
-
-View active leases and server statistics:
-
-```
-admin@example:/> show dhcp-server
-IP ADDRESS       MAC                HOSTNAME            CLIENT ID             EXPIRES
-192.168.2.22     00:a0:85:00:02:05                      00:c0:ff:ee           3591s
-192.168.1.11     00:a0:85:00:04:06  foo                 01:00:a0:85:00:04:06  3591s
-
-admin@example:/> show dhcp-server statistics
-DHCP offers sent                : 6
-DHCP ACK messages sent          : 5
-DHCP NAK messages sent          : 0
-DHCP decline messages received  : 0
-DHCP discover messages received : 6
-DHCP request messages received  : 5
-DHCP release messages received  : 6
-DHCP inform messages received   : 6
-```
-
-
-[^1]: This requires the system DNS resolver to be configured.

doc/discovery.md

@@ -1,21 +1,21 @@
-# Device Discovery
-
-Infix advertises itself via the [mDNS-SD](#mdns-sd) and [LLDP](#lldp)
-discovery protocols.  mDNS-SD has good client support in Windows, macOS
-and on Linux systems.  More on these protocols later.
-
-An even simpler method is available when directly attached to an Infix
-device:
+Discover Infix Units
+====================
 
 ```
-.----.       Ethernet      .--------.
-| PC +---------------------+ Device |
-'----' if1              e1 '--------'
+ .----.      Ethernet       .-------.
+ | PC +---------------------+ Infix |
+ '----' if1            eth0 '-------'
 ```
+Figure 1: PC directly connected over Ethernet to Infix unit (here eth0).
 
-With IPv6 you can *ping the all-hosts* address (ff02::1), the device's
-link-local IPv6 address is then seen in the response.  In the following
-example, the PC here uses *tap0* as *if1*, Infix responds with address
+
+When you wish to discover the IP address of an Infix switch, the simplest
+way is probably to *ping the IPv6 all-hosts* address (ff02::1) over a
+directly connected Ethernet cable. The unit's link-local IPv6 address is
+seen in the response.
+
+In the example below, the PC is connected to Infix via interface *tap0*
+(*tap0* is *if1* in Figure 1) and Infix responds with address
 *fe80::ff:fec0:ffed*.
 
 ```
@@ -31,11 +31,7 @@ rtt min/avg/max/mdev = 0.389/0.455/0.558/0.073 ms
 linux-pc:# 
 ```
 
-> [!TIP]
-> The `-L` option ignores local responses from the PC.
-
-This address can then be used to connect to the device, e.g., using SSH.
-Notice the syntax `username@address%interface`:
+The PC could connect then connect to Infix, e.g., using SSH.
 
 ```
 linux-pc:# ssh admin@fe80::ff:fec0:ffed%tap0
@@ -43,13 +39,17 @@ admin@fe80::ff:fec0:ffed%tap0's password: admin
 admin@infix-c0-ff-ee:~$ 
 ```
 
+## Discovery mechanisms available in Infix
 
-## LLDP
+Infix advertises its presence via the [mDNS](#mdns) and [LLDP](#lldp)
+discovery protocols.
 
-Infix supports LLDP (IEEE 802.1AB). For a device with factory default
-settings, the link-local IPv6 address can be read from the Management
-Address TLV using *tcpdump* or other sniffing tools[^1]:
 
+### LLDP
+
+Infix supports LLDP (IEEE 802.1AB). For a unit with factory default
+settings, the PC can readout the link-local IPv6 address from the
+Management Address TLV using *tcpdump* or other sniffing tools[^1].
 ```
 linux-pc:# tcpdump -i tap0 -Qin -v ether proto 0x88cc
 tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
@@ -83,12 +83,11 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
 linux-pc:# 
 ```
 
-If the device has an IPv4 address assigned, it is shown in an additional
+If the unit has an IPv4 address assigned, it is shown in an additional
 Management Address TLV.
 
-> [!NOTE]
-> The Management Addresses shown by LLDP are not necessarily associated
-> with the port transmitting the LLDP message.
+> **Note** The Management Addresses shown by LLDP are not
+> necessarily associated with the port transmitting the LLDP message. 
 
 In the example below, the IPv4 address (10.0.1.1) happens to be
 assigned to *eth0*, while the IPv6 address (2001:db8::1) is not.
@@ -131,9 +130,9 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
 linux-pc:#
 ```
 
-The following capabilities are available via NETCONF/RESTCONF or the Infix CLI.
-
-### LLDP Enable/Disable
+[^1]: [lldpd: implementation of IEEE 802.1ab
+    (LLDP)](https://github.com/lldp/lldpd) includes *lldpcli*, which
+    is handy to sniff and display LLDP packets.
 
 The LLDP service can be disabled using the following commands.
 
@@ -144,91 +143,13 @@ admin@infix-c0-ff-ee:/config/> leave
 admin@infix-c0-ff-ee:/> 
 ```
 
-To reenable it from the CLI config mode:
+### mDNS
 
-```
-admin@test-00-01-00:/config/> set lldp enabled 
-admin@test-00-01-00:/config/> leave
-```
-
-### LLDP Message Transmission Interval
-
-By default, LLDP uses a `message-tx-interval` of 30 seconds, as defined
-by the IEEE standard. Infix allows this value to be customized.
-To change it using the CLI:
-
-```
-admin@test-00-01-00:/config/> set lldp message-tx-interval 1
-admin@test-00-01-00:/config/> leave
-```
-
-### LLDP Administrative Status per Interface
-
-Infix supports configuring the LLDP administrative status on a per-port
-basis. The default mode is `tx-and-rx`, but the following options are 
-also supported:
-
-- `rx-only` – Receive LLDP packets only
-- `tx-only` – Transmit LLDP packets only
-- `disabled` – Disable LLDP on the interface
-
-Example configuration:
-
-```
-admin@test-00-01-00:/config/> set lldp port e8 dest-mac-address 01:80:C2:00:00:0E admin-status disabled
-admin@test-00-01-00:/config/> set lldp port e5 dest-mac-address 01:80:C2:00:00:0E admin-status rx-only 
-admin@test-00-01-00:/config/> set lldp port e6 dest-mac-address 01:80:C2:00:00:0E admin-status tx-only
-admin@test-00-01-00:/config/> leave
-```
-
-> [!NOTE]
-> The destination MAC address must be the standard LLDP multicast 
-> address: `01:80:C2:00:00:0E`.
-
-###  Displaying LLDP Neighbor Information
-
-In CLI mode, Infix also provides a convenient `show lldp` command to
-list LLDP neighbors detected on each interface:
-
-```
-admin@test-00-01-00:/> show lldp 
-INTERFACE       REM-IDX   TIME        CHASSIS-ID          PORT-ID             
-e5              1         902         00:a0:85:00:04:01   00:a0:85:00:04:07   
-e6              3         897         00:a0:85:00:03:01   00:a0:85:00:03:07   
-e8              2         901         00:a0:85:00:02:01   00:a0:85:00:02:05
-```
-
-## mDNS-SD
-
-DNS-SD/mDNS-SD can be used to discover Infix devices and services.  By
-default, Infix use the `.local` domain for advertising services.  Some
-networks use `.lan` instead, so this configurable:
-
-```
-admin@infix-c0-ff-ee:/> configure
-admin@infix-c0-ff-ee:/config/> edit mdns
-admin@infix-c0-ff-ee:/config/mdns/> set domain lan
-```
-
-Other available settings include limiting the interfaces mDNS responder
-acts on:
-
-```
-admin@infix-c0-ff-ee:/config/> set interfaces allow e1
-```
-
-or
-
-```
-admin@infix-c0-ff-ee:/config/> set interfaces deny wan
-```
-
-The `allow` and `deny` settings are complementary, `deny` always wins.
-
-----
-
-In Linux, tools such as *avahi-browse* or *mdns-scan*[^2] can be used to
-search for devices advertising their services via mDNS.
+DNS-SD/mDNS can be used to discover Infix units and services. Infix
+units present their IP addresses, services and hostname within the
+.local domain. This method has good client support in Apple and Linux
+systems. On Linux, tools such as *avahi-browse* or *mdns-scan*[^2] can
+be used to search for devices advertising their services via mDNS.
 
 ```
 linux-pc:# avahi-browse -ar
@@ -260,15 +181,9 @@ linux-pc:# avahi-browse -ar
 linux-pc:#
 ```
 
-> [!TIP]
-> The `-t` option is also very useful, it stops browsing automatically
-> when a "more or less complete list" has been printed.  However, some
-> devices on the LAN may be in deep sleep so run the command again if
-> you cannot find the device you are looking for.
-
 Additionally, *avahi-resolve-host-name* can be used to verify domain
-name mappings for IP addresses.  By default, it translates from IPv4
-addresses.  This function allows users to confirm that addresses are
+name mappings for IP addresses. By default, it translates from IPv4
+addresses. This function allows users to confirm that addresses are
 mapped correctly.
 
 ```
@@ -294,7 +209,7 @@ rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
 linux-pc:# ssh admin@infix-c0-ff-ee.local
 (admin@infix-c0-ff-ee.local) Password: 
 .-------.
-|  . .  | Infix OS — Immutable.Friendly.Secure
+|  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.org
 '-'---'-
 
@@ -304,21 +219,20 @@ linux-pc:#
 ```
 
 To disable mDNS/mDNS-SD, type the commands:
-
 ```
 admin@infix-c0-ff-ee:/> configure 
 admin@infix-c0-ff-ee:/config/> no mdns
 admin@infix-c0-ff-ee:/config/> leave
 ```
 
-### Human-Friendly Hostname Alias
+#### Human-Friendly Hostname Alias
 
-Each Infix deviuce advertise itself as *infix.local*, in addition to its
-full hostname (e.g., *infix-c0-ff-ee.local* or *foo.local*).  This alias
-works seamlessly on a network with a single Infix device, and makes it
-easy to connect when the exact hostname is not known in advance.  The
-examples below show how the alias can be used for actions such as
-pinging or establishing an SSH connection:
+Each Infix unit will advertise itself as *infix.local*, in addition to
+its full hostname (e.g., *infix-c0-ff-ee.local* or *foo.local*).  This
+alias works seamlessly on a network with a single Infix device, and
+makes it easy to connect when the exact hostname is not known in
+advance. The examples below show how the alias can be used for
+actions such as pinging or establishing an SSH connection:
 
 ```
 linux-pc:# ping infix.local -c 3
@@ -334,39 +248,36 @@ rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
 linux-pc:# ssh admin@infix.local
 (admin@infix.local) Password: 
 .-------.
-|  . .  | Infix OS — Immutable.Friendly.Secure
+|  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.org
 '-'---'-
 
 Run the command 'cli' for interactive OAM
 
-admin@infix-c0-ff-ee:~$
+linux-pc:#
 ```
 
 When multiple Infix devices are present on the LAN the alias will not
 uniquely identify a device; *infix.local* will refer to any of the
 Infix devices, likely the one that first appeared.
 
-> [!NOTE]
-> When multiple Infix devices are present on the LAN, use the full name,
-> e.g., *infix-c0-ff-ee.local* or *foo.local* rather than the alias
-> *infix.local* to deterministically connect to the device.
+> When multiple Infix units are present, use the full hostname (e.g.,
+> *infix-c0-ff-ee.local* or *foo.local*) rather than the alias
+> infix.local to deterministically connect to a unit.
 
 
-### Browse Network Using *network.local*
+#### Netbrowse service to find all your devices
 
-Another mDNS alias that all Infix devices advertise is *network.local*.
-This is a web service which basically runs `avahi-browse` and displays a
-table of other Infix devices and their services.
+Another mDNS alias that all Infix devices can advertise is
+*network.local*. This is a web service which basically runs avahi-browse
+and displays a table of other Infix devices and their services. 
 
 ![Netbrowse Service - network.local](img/network-local.png)
 
-With multiple Infix devices on the LAN, one will take the role of your
-portal to access all others, if it goes down another takes its place.
-
-To disable the netbrowse service, and the *network.local* alias, the
-following commands can be used:
+With multiple Infix devices on the LAN, one will be your portal to
+access all others, if it goes down another will take its place.
 
+To disable the netbrowse service, the following commands can be used:
 ```
 admin@infix-c0-ff-ee:/> configure 
 admin@infix-c0-ff-ee:/config/> edit web
@@ -374,8 +285,6 @@ admin@infix-c0-ff-ee:/config/web/> no netbrowse
 admin@infix-c0-ff-ee:/config/web/> leave
 ```
 
-
-[^1]: E.g., [lldpd](https://github.com/lldp/lldpd) which includes the
-    *lldpcli* too, handy to sniff and display LLDP packets.
 [^2]: [mdns-scan](http://0pointer.de/lennart/projects/mdns-scan/): a
-    tool for scanning for mDNS/DNS-SD services on the local network.
+    tool for scanning for mDNS/DNS-SD published services on the local
+    network

doc/eth-counters.md

@@ -1,19 +1,32 @@
-# RMON Counters
+# YANG to Ethtool Mapping
 
-This document show the mapping between YANG and Linux / Ethtool counters.
+This column contains the mapping between YANG and Linux / Ethtool counters.
 
-| **YANG**                       | **Linux / Ethtool**                                                                                                                               |
-|--------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------|
-| `in-total-octets`              | `FramesReceivedOK`, `FrameCheckSequenceErrors`, `FramesLostDueToIntMACRcvError`, `AlignmentErrors`, `etherStatsOversizePkts`, `etherStatsJabbers` |
-| `in-frames`                    | `FramesReceivedOK`                                                                                                                                |
-| `in-multicast-frames`          | `MulticastFramesReceivedOK`                                                                                                                       |
-| `in-broadcast-frames`          | `BroadcastFramesReceivedOK`                                                                                                                       |
-| `in-error-fcs-frames`          | `FrameCheckSequenceErrors`                                                                                                                        |
-| `in-error-undersize-frames`    | `undersize_pkts`                                                                                                                                  |
-| `in-error-oversize-frames`     | `etherStatsJabbers`, `etherStatsOversizePkts`                                                                                                     |
-| `in-error-mac-internal-frames` | `FramesLostDueToIntMACRcvError`                                                                                                                   |
-| `out-frames`                   | `FramesTransmittedOK`                                                                                                                             |
-| `out-multicast-frames`         | `MulticastFramesXmittedOK`                                                                                                                        |
-| `out-broadcast-frames`         | `BroadcastFramesXmittedOK`                                                                                                                        |
-| `infix-eth:out-good-octets`    | `OctetsTransmittedOK`                                                                                                                             |
-| `infix-eth:in-good-octets`     | `OctetsReceivedOK`                                                                                                                                |
+```
+┌─────────────────────────────────┬──────────────────────────────────┐
+│ YANG                            │ Linux / Ethtool                  │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-frames                      │ FramesTransmittedOK              │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-multicast-frames            │ MulticastFramesXmittedOK         │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ out-broadcast-frames            │ BroadcastFramesXmittedOK         │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-total-frames                 │ FramesReceivedOK,                │
+│                                 │ FrameCheckSequenceErrors         │
+│                                 │ FramesLostDueToIntMACRcvError    │
+│                                 │ AlignmentErrors                  │
+│                                 │ etherStatsOversizePkts           │
+│                                 │ etherStatsJabbers                │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-frames                       │ FramesReceivedOK                 │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-multicast-frames             │ MulticastFramesReceivedOK        │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-broadcast-frames             │ BroadcastFramesReceivedOK        │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-error-undersize-frames       │ undersize_pkts                   │
+├─────────────────────────────────┼──────────────────────────────────┤
+│ in-error-fcs-frames             │ FrameCheckSequenceErrors         │
+└─────────────────────────────────┴──────────────────────────────────┘
+```

doc/extra.css

@@ -1,12 +0,0 @@
-.md-header__title {
-    font-size: 1.1rem;
-    line-height: 2.6rem;
-}
-
-[data-md-color-primary="orange"] {
-    --md-primary-fg-color: #ff7f2a;
-    --md-primary-bg-color: #5c5f5c;
-}
-[data-md-color-primary="black"] {
-    --md-primary-bg-color: #5c5f5c;
-}