board/common: tune kernel memory settings

Add vm.conf with sysctl parameters optimized for embedded network
devices 512MB-8GB of memory.

Focus on fast recovery and determinism.
- Panic on OOM
- Aggressive dirty page writeback
- Increased watermark scale factor for proactive reclaim

Includes tuning guide documentation for alternative scenarios.

Signed-off-by: Richard Alpe <richard@bit42.se>

.gitignore

@@ -1,4 +1,5 @@
 *~
+.claude
 .gdb_history
 /.backup
 /.ccache

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg

@@ -99,7 +99,6 @@
       {
         "name": "wan",
         "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [

board/aarch64/board.mk

@@ -1,3 +1,4 @@
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/*/*.mk))
 
 .PHONY: board-enable-qemu-uboot
 board-enable-qemu-uboot:
@@ -19,13 +20,6 @@ board-enable-qemu-uboot:
 			'$$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config' \
 		--enable TARGET_UBOOT_FORMAT_DTB
 
-.PHONY: board-enable-sparx-fit
-board-enable-sparx-fit:
-	@$(call IXMSG,"Enabling SparX-5i compatible FIT options")
-	@BR2_PREFIX= ./utils/config --file $(BR2_CONFIG) \
-	 	--enable FIT_IMAGE \
-	 	--set-str FIT_KERNEL_LOAD_ADDR "0x7 0x00000000"
-
 .PHONY: board-sparx-flash-uboot
 board-sparx-flash-uboot: $(BINARIES_DIR)/u-boot.bin
 	@grep -q 'BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mscc_fireant_pcb135_emmc"' $(BR2_CONFIG) || \

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg

@@ -58,7 +58,6 @@
       {
         "name": "wan",
         "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [

board/board.mk

@@ -1,2 +1,3 @@
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/common.mk
 include $(BR2_EXTERNAL_INFIX_PATH)/board/ix-board.mk
-include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/*/*/*.mk))
+-include $(BR2_EXTERNAL_INFIX_PATH)/board/$(patsubst "%",%,$(BR2_ARCH))/board.mk

board/common/Config.in

@@ -1,32 +1,28 @@
-menuconfig SIGN_ENABLED
-	bool "Image Signing"
+menu "Images"
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rootfs/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-qcow/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"
+
+endmenu
+
+config QEMU_SCRIPTS
+	bool "QEMU scripts"
 	default y
-
-choice
-	prompt "Signing key source"
-	depends on SIGN_ENABLED
-	default SIGN_SRC_DIR
-
-config SIGN_SRC_DIR
-	bool "Directory"
-
-config SIGN_SRC_PKCS11
-	bool "PKCS#11 URL"
-
-endchoice
-
-config SIGN_KEY
-	string "Signing key"
-	depends on SIGN_ENABLED
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development"  if SIGN_SRC_DIR
+	help
+	  Install QEMU scripts and related files in the images
+	  directory, which can be used to launch virtual Infix
+	  instances.
 
 menuconfig TRUSTED_KEYS
 	bool "Trusted keys for image"
-	depends on SIGN_ENABLED
 	help
 	 Keys that will be accepted for this image
 
-
 config TRUSTED_KEYS_DEVELOPMENT
 	bool "Development key"
 	depends on TRUSTED_KEYS
@@ -39,130 +35,3 @@ config TRUSTED_KEYS_DEVELOPMENT_PATH
 config TRUSTED_KEYS_EXTRA_PATH
 	string "Path to extra keys to include in image"
 	depends on TRUSTED_KEYS
-
-menuconfig DISK_IMAGE
-	bool "Disk image"
-	help
-	  Compose a full disk image with redundant Linux OS partitions,
-	  configuration partition, etc.
-
-	  This is useful when:
-	  - Bringing up a blank system during manufacturing
-	  - Creating a GNS3 appliance
-	  - Developing/debugging issues in the boot process in QEMU
-
-menuconfig DISK_IMAGE_SIZE
-	string "Image size"
-	depends on DISK_IMAGE
-	default "512M"
-	help
-	  Create a disk image of this size.  A K/M/G suffix may be used
-	  to multiply by powers of 1024.  Suffixes like KB/MB/GB may be
-	  used to multiply by powers of 1000.  The image will be split
-	  proportionally to fit the two rootfs, a kernel, a writable
-	  /cfg and /var partiotions.
-
-	  Minimum supported size is 512M.
-
-choice
-	prompt "Bootloader"
-	depends on DISK_IMAGE
-	default DISK_IMAGE_BOOT_EFI if BR2_x86_64
-	default DISK_IMAGE_BOOT_NONE
-
-config DISK_IMAGE_BOOT_NONE
-	bool "None"
-	help
-	  Do not create any bootloader partition in the disk image.
-
-config DISK_IMAGE_BOOT_EFI
-	bool "EFI"
-	help
-	  Create a boot partition from a directory containing an EFI
-	  boot application, e.g. GRUB.
-
-config DISK_IMAGE_BOOT_BIN
-	bool "Binary"
-	help
-	  Create a boot partition from a raw image containing the boot
-	  application, e.g. U-Boot.
-
-endchoice
-
-config DISK_IMAGE_BOOT_DATA
-	string "Bootloader data"
-	depends on DISK_IMAGE
-	depends on DISK_IMAGE_BOOT_EFI || DISK_IMAGE_BOOT_BIN
-	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
-	help
-	  Path to the directory or file holding the bootloader data.
-
-config DISK_IMAGE_BOOT_OFFSET
-	hex "Bootloader offset"
-	depends on DISK_IMAGE
-	depends on DISK_IMAGE_BOOT_EFI || DISK_IMAGE_BOOT_BIN
-	default 0x8000
-	help
-	  Offset at which the bootloader partition is placed. Remember
-	  to make sure that the GPT still fits at the start of the
-	  image.
-
-config DISK_IMAGE_RELEASE_URL
-	string "Infix URL"
-	depends on DISK_IMAGE
-	depends on !BR2_TARGET_ROOTFS_SQUASHFS
-	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
-	help
-	  In situations where Infix itself is not being built, but a
-	  disk image is, i.e. when building a bootloader: place this
-	  Infix release in the primary and secondary partitions.
-
-menuconfig GNS3_APPLIANCE
-	bool "GNS3 Appliance"
-	select DISK_IMAGE
-	default y
-	help
-	  Create a GNS3 appliance description that, together with the
-	  disk image, can be imported into GNS3.
-
-config GNS3_APPLIANCE_RAM
-	int "Reserved RAM (MiB)"
-	depends on GNS3_APPLIANCE
-	default "192"
-	help
-	  Amount of host RAM reserved for an appliance instance.
-
-	  Minimum supported size is 192M.
-
-config GNS3_APPLIANCE_IFNUM
-	int "Number of interfaces"
-	depends on GNS3_APPLIANCE
-	default "1"
-	help
-	  Number of Ethernet interfaces to create for an appliance instance.
-
-menuconfig FIT_IMAGE
-	bool "Traditional FIT image"
-	help
-	  Create a "regular" FIT image where the kernel and DTBs are
-	  stored in the FIT rather than inside the rootfs (like it
-	  normally is in Infix).
-
-	  This is useful when trying out Infix on targets whose
-	  bootloader might not be capable of booting a raw Squash, but
-	  is able to handle an FIT.
-
-config FIT_ARCH
-	string
-	depends on FIT_IMAGE
-	default "arm64" if BR2_aarch64
-
-config FIT_KERNEL_LOAD_ADDR
-	string "Kernel load address"
-	depends on FIT_IMAGE
-
-config SDCARD_AUX
-	bool "Create SD-card aux partition"
-	help
-	  Create and populate aux.ext4 with rootfs.itbh and rauc.status
-	  For use with a static genimage.cfg for, e.g., SD-cards.

board/common/common.mk

@@ -1,4 +1,7 @@
-ifeq ($(SIGN_ENABLED),y)
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/image.mk
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/qemu/qemu.mk
+
+ifeq ($(TRUSTED_KEYS),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk
 
 TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)

board/common/image/image-itb-aux/Config.in

@@ -0,0 +1,10 @@
+config IMAGE_ITB_AUX
+	bool "aux partition"
+	depends on IMAGE_ITB_ROOTFS
+	select BR2_PACKAGE_HOST_UBOOT_TOOLS
+	select BR2_PACKAGE_HOST_GENIMAGE
+	help
+	  Create and populate auxiliary partition, aux.ext4, with
+	  metadata needed by U-Boot and RAUC to operate properly on
+	  systems using ITB images. This may then be included as a
+	  partition in a larger disk image.

board/common/image/image-itb-aux/generate.sh

@@ -0,0 +1,85 @@
+#!/bin/sh
+
+set -e
+
+boot="${1}"
+squash="${BINARIES_DIR}"/rootfs.squashfs
+itbh="${BINARIES_DIR}"/rootfs.itbh
+aux="${BINARIES_DIR}"/aux.ext4
+
+mkdir -p "${WORKDIR}"/aux
+rm -rf   "${WORKDIR}"/tmp
+mkdir -p "${WORKDIR}"/tmp
+
+cp -f "${itbh}" "${WORKDIR}"/aux/primary.itbh
+cp -f "${itbh}" "${WORKDIR}"/aux/secondary.itbh
+
+tstamp=$(date -u +%FT%TZ)
+rootsha=$(sha256sum "${squash}" | cut -d" " -f1)
+rootsize=$(stat -c %s "${squash}")
+cat <<EOF >"${WORKDIR}"/aux/rauc.status
+[slot.rootfs.0]
+bundle.compatible=${COMPATIBLE}
+bundle.version=${VERSION}
+status=ok
+sha256=${rootsha}
+size=${rootsize}
+installed.timestamp=$tstamp
+installed.count=1
+activated.timestamp=$tstamp
+activated.count=1
+
+[slot.rootfs.1]
+bundle.compatible=${COMPATIBLE}
+bundle.version=${VERSION}
+status=ok
+sha256=${rootsha}
+size=${rootsize}
+installed.timestamp=$tstamp
+installed.count=1
+activated.timestamp=$tstamp
+activated.count=1
+EOF
+
+case "${boot}" in
+    uboot)
+	cat <<EOF | mkenvimage -s 0x4000 -o "${WORKDIR}"/aux/uboot.env -
+BOOT_ORDER=primary secondary net
+BOOT_primary_LEFT=1
+BOOT_secondary_LEFT=1
+BOOT_net_LEFT=1
+EOF
+	;;
+    grub)
+	mkdir -p "${WORKDIR}"/aux/grub
+	cp -f "${PKGDIR}"/grub.cfg "${PKGDIR}"/grubenv "${WORKDIR}"/aux/grub
+	;;
+    *)
+	echo "UNSUPPORTED BOOTLOADER ${boot}" >&2
+	exit 1
+esac
+
+cat <<EOF >"${WORKDIR}"/genimage.cfg
+image $(basename ${aux}) {
+	mountpoint = "/"
+	size = 8M
+
+	ext4 {
+		label = "aux"
+		use-mke2fs = true
+		features = "^metadata_csum,^metadata_csum_seed,uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+# Silence genimage warnings
+config {}
+EOF
+
+genimage \
+    --loglevel 1 \
+    --tmppath    "${WORKDIR}"/tmp \
+    --rootpath   "${WORKDIR}"/aux \
+    --inputpath  "${WORKDIR}" \
+    --outputpath "$(dirname ${aux})" \
+    --config     "${WORKDIR}"/genimage.cfg

board/common/image/image-itb-aux/grub.cfg

@@ -0,0 +1,80 @@
+set timeout="1"
+
+load_env ORDER DEBUG
+
+if [ -z "$ORDER" ]; then
+    set ORDER="primary secondary"
+fi
+
+set ORDER="$ORDER reboot"
+
+for slot in $ORDER; do
+    if [ -z "$default" ]; then
+        set default="$slot"
+    else
+        # Contrary to what the documentation says, GRUB (2.06) does
+        # not support using titles or IDs in the fallback variable, so
+        # we translate to indices.
+        if [ "$slot" = "primary" ]; then
+            set fallback="$fallback 0"
+        elif [ "$slot" = "secondary" ]; then
+            set fallback="$fallback 1"
+        elif [ "$slot" = "net" ]; then
+            set fallback="$fallback 2"
+        elif [ "$slot" = "reboot" ]; then
+            set fallback="$fallback 3"
+	fi
+    fi
+done
+
+if [ "$DEBUG" ]; then
+    set log="debug"
+else
+    set log="loglevel=4"
+fi
+
+# From board/common/rootfs/etc/partition-uuid
+search -p 107ae911-a97b-4380-975c-7ce1a2dde1e0 --set primary
+search -p 352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02 --set secondary
+
+export primary
+export secondary
+
+submenu "primary" "$log" {
+    set slot="$1"
+    set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
+    set root="($primary)"
+    source /boot/grub/grub.cfg
+}
+
+submenu "secondary" "$log"  {
+    set slot="$1"
+    set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
+    set root="($secondary)"
+    source /boot/grub/grub.cfg
+}
+
+submenu "net" "$log"  {
+    net_dhcp
+
+    if [ "$net_efinet0_dhcp_next_server" -a "$net_efinet0_dhcp_boot_file" ]; then
+	set initrd=(tftp,$net_efinet0_dhcp_next_server)/$net_efinet0_dhcp_boot_file
+	loopback initrd $initrd
+	set root=(initrd)
+
+	set slot="$1"
+	set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 qroot=/dev/ram0 ramdisk_size=65536 $2"
+	source /boot/grub/grub.cfg
+    else
+	if [ -z "$net_efinet0_dhcp_next_server" ]; then
+	    echo "No TFTP server supplied in DHCP response"
+	fi
+	if [ -z "$net_efinet0_dhcp_boot_file" ]; then
+	    echo "No bootfile supplied in DHCP response"
+	fi
+    fi
+}
+
+submenu "reboot" {
+    reboot
+}

board/common/image/image-itb-aux/grubenv

@@ -0,0 +1,10 @@
+# GRUB Environment Block
+# WARNING: Do not edit this file by tools other than grub-editenv!!!
+ORDER=primary secondary net
+primary_OK=1
+secondary_OK=1
+net_OK=1
+primary_TRY=0
+secondary_TRY=0
+net_TRY=0
+#########################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################

board/common/image/image-itb-aux/image-itb-aux.mk

@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-itb-aux
+#
+################################################################################
+
+IMAGE_ITB_AUX_DEPENDENCIES := host-uboot-tools host-genimage image-itb-rootfs
+IMAGE_ITB_AUX_OPTS := $(if $(BR2_TARGET_GRUB2),grub,uboot)
+
+$(eval $(ix-image))

board/common/image/image-itb-dl-release/Config.in

@@ -0,0 +1,15 @@
+menuconfig IMAGE_ITB_DL_RELEASE
+	bool "Download existing release"
+	depends on !BR2_TARGET_ROOTFS_SQUASHFS
+	help
+	  This is primarily used by target specific builds, where the
+	  bootloader artifact needs to be combined with an existing
+	  Infix image, to create a full disk image that can be
+	  provisioned to an SD-card or eMMC.
+
+config IMAGE_ITB_DL_RELEASE_URL
+	string "URL"
+	depends on IMAGE_ITB_DL_RELEASE
+	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
+	help
+	  URL to release tarball.

board/common/image/image-itb-dl-release/generate.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+set -e
+
+squash="${BINARIES_DIR}"/rootfs.squashfs
+aux="${BINARIES_DIR}"/aux.ext4
+
+[ -f "${squash}" ] && [ -f "${aux}" ] && exit 0
+
+archive="${WORKDIR}/$(basename ${URL})"
+[ -f "${archive}" ] || wget -O"${archive}" "${URL}"
+
+echo "Unpacking..."
+tar -xa --strip-components=1 -C "${BINARIES_DIR}" -f "${archive}"
+
+auxsize=$(stat -c %s "${aux}")
+if [ "${auxsize}" -gt $((8 << 20)) ]; then
+    # In older releases, 16M aux.ext4 images were generated. In order
+    # to keep the image-itb-qcow logic simpler, trim it 8M, which we
+    # always generate nowadays.
+    echo "WARNING: Auxiliary partition is unexpectedly large. Resizing..."
+    resize2fs "${aux}" 8M
+    truncate -s 8M "${aux}"
+    tune2fs -l "${aux}"
+fi

board/common/image/image-itb-dl-release/image-itb-dl-release.mk

@@ -0,0 +1,9 @@
+################################################################################
+#
+# image-itb-dl-release
+#
+################################################################################
+
+IMAGE_ITB_DL_RELEASE_CONFIG_VARS := URL
+
+$(eval $(ix-image))

board/common/image/image-itb-gns3a/Config.in

@@ -0,0 +1,23 @@
+menuconfig IMAGE_ITB_GNS3A
+	bool "GNS3 Appliance (ITB)"
+	depends on BR2_x86_64
+	select IMAGE_ITB_QCOW
+	help
+	  Create a GNS3 appliance description that, together with the
+	  disk image, can be imported into GNS3.
+
+config IMAGE_ITB_GNS3A_RAM
+	int "Reserved RAM (MiB)"
+	depends on IMAGE_ITB_GNS3A
+	default "192"
+	help
+	  Amount of host RAM reserved for an appliance instance.
+
+	  Minimum supported size is 192M.
+
+config IMAGE_ITB_GNS3A_IFNUM
+	int "Number of interfaces"
+	depends on IMAGE_ITB_GNS3A
+	default "1"
+	help
+	  Number of Ethernet interfaces to create for an appliance instance.

board/common/image/image-itb-gns3a/generate.sh

@@ -0,0 +1,59 @@
+#!/bin/sh
+
+set -e
+
+bios="${BINARIES_DIR}"/OVMF.fd
+qcow="${BINARIES_DIR}"/"${ARTIFACT}".qcow2
+gns3a="${BINARIES_DIR}"/"${ARTIFACT}".gns3a
+
+cat <<EOF >"${gns3a}"
+{
+    "name": "${ARTIFACT} devel",
+    "category": "router",
+    "description": "${ARTIFACT} development appliance",
+    "vendor_name": "Kernelkit",
+    "vendor_url": "https://kernelkit.org",
+    "product_name": "${ARTIFACT} devel",
+    "registry_version": 6,
+    "status": "experimental",
+    "maintainer": "Kernelkit",
+    "maintainer_email": "null@kernelkit.org",
+    "usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
+    "port_name_format": "eth{0}",
+    "linked_clone": true,
+    "qemu": {
+        "adapter_type": "virtio-net-pci",
+        "adapters": ${IFNUM},
+        "ram": ${RAM},
+        "cpus": 1,
+        "hda_disk_interface": "virtio",
+        "arch": "x86_64",
+        "console_type": "telnet",
+        "bios_image": "$(basename ${bios})",
+        "kvm": "allow"
+    },
+    "images": [
+        {
+            "filename": "$(basename "${bios}")",
+            "filesize": $(stat --printf='%s' "${bios}"),
+            "md5sum": "$(md5sum "${bios}" | awk '{print $1}')",
+            "version": "0.0"
+        },
+        {
+            "filename": "$(basename "${qcow}")",
+            "filesize": $(stat --printf='%s' "${qcow}"),
+            "md5sum": "$(md5sum "${qcow}" | awk '{print $1}')",
+            "version": "${VERSION}"
+        }
+    ],
+    "versions": [
+        {
+            "name": "${VERSION}",
+            "images": {
+                "bios_image": "$(basename ${bios})",
+                "hda_disk_image": "$(basename ${qcow})"
+            }
+        }
+    ]
+}
+EOF

board/common/image/image-itb-gns3a/image-itb-gns3a.mk

@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-itb-gns3a
+#
+################################################################################
+
+IMAGE_ITB_GNS3A_DEPENDENCIES := image-itb-qcow
+IMAGE_ITB_GNS3A_CONFIG_VARS  := IFNUM RAM
+
+$(eval $(ix-image))

board/common/image/image-itb-qcow/Config.in

@@ -0,0 +1,68 @@
+menuconfig IMAGE_ITB_QCOW
+	bool "QEMU disk image (ITB)"
+	depends on (IMAGE_ITB_ROOTFS && IMAGE_ITB_AUX) || IMAGE_ITB_DL_RELEASE
+	select BR2_PACKAGE_HOST_GENIMAGE
+	help
+	  Compose a full disk image with redundant Linux OS partitions,
+	  configuration partition, etc., for systems using ITB images.
+
+	  This is useful when:
+	  - Bringing up a blank system during manufacturing
+	  - Creating a GNS3 appliance
+	  - Developing/debugging issues in the boot process in QEMU
+
+menuconfig IMAGE_ITB_QCOW_SIZE
+	string "Image size"
+	depends on IMAGE_ITB_QCOW
+	default "512M"
+	help
+	  Create a disk image of this size.  A K/M/G suffix may be used
+	  to multiply by powers of 1024.  Suffixes like KB/MB/GB may be
+	  used to multiply by powers of 1000.  The image will be split
+	  proportionally to fit the two rootfs, a kernel, a writable
+	  /cfg and /var partiotions.
+
+	  Minimum supported size is 512M.
+
+choice
+	prompt "Bootloader"
+	depends on IMAGE_ITB_QCOW
+	default IMAGE_ITB_QCOW_BOOT_EFI if BR2_x86_64
+	default IMAGE_ITB_QCOW_BOOT_NONE
+
+config IMAGE_ITB_QCOW_BOOT_NONE
+	bool "None"
+	help
+	  Do not create any bootloader partition in the disk image.
+
+config IMAGE_ITB_QCOW_BOOT_EFI
+	bool "EFI"
+	help
+	  Create a boot partition from a directory containing an EFI
+	  boot application, e.g. GRUB.
+
+config IMAGE_ITB_QCOW_BOOT_BIN
+	bool "Binary"
+	help
+	  Create a boot partition from a raw image containing the boot
+	  application, e.g. U-Boot.
+
+endchoice
+
+config IMAGE_ITB_QCOW_BOOT_DATA
+	string "Bootloader data"
+	depends on IMAGE_ITB_QCOW
+	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
+	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
+	help
+	  Path to the directory or file holding the bootloader data.
+
+config IMAGE_ITB_QCOW_BOOT_OFFSET
+	hex "Bootloader offset"
+	depends on IMAGE_ITB_QCOW
+	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
+	default 0x8000
+	help
+	  Offset at which the bootloader partition is placed. Remember
+	  to make sure that the GPT still fits at the start of the
+	  image.

board/common/image/image-itb-qcow/generate.sh

@@ -1,8 +1,6 @@
 #!/bin/sh
 set -e
 
-. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
-
 K=10
 M=20
 G=30
@@ -47,43 +45,32 @@ dimension()
 	exit 1
     fi
 
-    # Size var to fit whatever is left over. Also reserve another 32K
-    # at the end to make room for the backup GPT.
-    varsize=$(($total - $auxsize - 2 * $imgsize - $cfgsize))
-    if [ "$bootoffs" ]; then
-	varsize=$(($varsize - $bootsize))
-    fi
-    varsize=$(($varsize - (32 << K)))
+    # Place aux right after the GPT...
+    auxoffs=$((32 << K))
 
     if [ "$bootoffs" ]; then
-	# Align the end of the boot partition to an even MiB. E.g. if
-	# boot was dimensioned to 4M, and bootoffs is 32K, then the
-	# final bootsize becomes 4M - 32K, meaning aux will start on
-	# exactly 4M.
-	auxoffs=$bootsize
-	bootsize=$(($bootsize - $bootoffs))
-    else
-	# No bootloader, place aux after GPT, resize it to end on an
-	# even MiB (as is done for boot above).
-	auxoffs=$((32 << K))
-	auxsize=$(($auxsize - $auxoffs))
-    fi
-}
+	if [ $((bootoffs)) -lt $((32 << K)) ]; then
+	    echo "Boot partition collides with GPT"
+	    exit 1
+	fi
 
-probeboot()
-{
-    # If we have built an EFI app, typically grub, make sure to
-    # include it.
-    if [ -d $BINARIES_DIR/efi-part/EFI ]; then
-	bootoffs=$((32 << K))
+	# ...unless we have a boot partition, in which case we place
+	# it after that.
+	auxoffs=$((auxoffs + bootsize))
     fi
+
+    # Finally, size var to fit whatever is left over by subtracting
+    # all other images, plus another 32K at the end for the backup
+    # GPT.
+    varsize=$((total - auxoffs - auxsize - 2 * imgsize - cfgsize - (32 << K)))
 }
 
 genboot()
 {
     if [ -d "$bootdata" ]; then
 	bootimg=$(cat <<EOF
-image $BINARIES_DIR/efi-part.vfat {
+image efi-part.vfat {
+	temporary = true
 	size = $bootsize
 	vfat {
 		file EFI {
@@ -98,7 +85,7 @@ EOF
 		offset = $bootoffs
 		partition-type-uuid = U
 		bootable = true
-		image = $BINARIES_DIR/efi-part.vfat
+		image = efi-part.vfat
 	}
 EOF
 		  )
@@ -117,44 +104,29 @@ EOF
     fi
 }
 
-common=$(dirname $(readlink -f "$0"))
-root=$BUILD_DIR/genimage.root
-tmp=$BUILD_DIR/genimage.tmp
+mkdir -p "${WORKDIR}"/root
+rm -rf   "${WORKDIR}"/tmp
+mkdir -p "${WORKDIR}"/tmp
 
-total=$((512 << M))
-bootoffs=$((32 << K))
-bootdata=
-diskimg=disk.img
+qcowimg="${ARTIFACT}.qcow2"
+total=$(size2int $SIZE)
+bootoffs=
+bootdata=$BOOT_DATA
 bootimg=
 bootpart=
-tmpimage=$(mktemp)
-while getopts "a:b:B:n:s:" opt; do
-    case ${opt} in
-	a)
-	    arch=$OPTARG
-	    ;;
-	b)
-	    bootdata=$OPTARG
-	    ;;
-	B)
-	    bootoffs=$(($OPTARG))
-	    ;;
-	n)
-	    diskimg=${OPTARG}
-	    ;;
-	s)
-	    total=$(size2int $OPTARG)
-	    ;;
-    esac
-done
-shift $((OPTIND - 1))
 
-mkdir -p $root
+if [ -n "${BOOT_OFFSET}" ]; then
+    bootoffs=$(($BOOT_OFFSET))
+fi
 
-probeboot
 dimension
 genboot
 
+. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
+[ -n "${AUX_UUID}" ]
+[ -n "${PRIMARY_UUID}" ]
+[ -n "${SECONDARY_UUID}" ]
+
 # Use awk over sed because replacement text may contain newlines,
 # which sed does not approve of.
 awk \
@@ -166,7 +138,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vdiskimg=$tmpimage \
+	  -vqcowimg=$qcowimg \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -175,7 +147,7 @@ awk \
 		sub(/@IMGSIZE@/, imgsize);
 		sub(/@CFGSIZE@/, cfgsize);
 		sub(/@VARSIZE@/, varsize);
-		sub(/@DISKIMG@/, diskimg);
+		sub(/@QCOWIMG@/, qcowimg);
 		sub(/@BOOTIMG@/, bootimg);
 		sub(/@BOOTPART@/, bootpart);
 		sub(/@AUXUUID@/, auxuuid);
@@ -183,35 +155,11 @@ awk \
 		sub(/@SECONDARYUUID@/, secondaryuuid);
 
 	  }1' \
-	      < $common/genimage.cfg.in >$root/genimage.cfg
-
-mkdir -p $root/aux
-cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
-cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
-cp -f $BINARIES_DIR/rauc.status $root/aux/rauc.status
-
-case "$arch" in
-    aarch64)
-	mkenvimage -s 0x4000 -o "$root/aux/uboot.env" \
-		   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
-	;;
-    x86_64)
-	mkdir -p "$root/aux/grub"
-	cp -f "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grub.cfg" \
-	      "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grubenv"  \
-	      "$root/aux/grub/"
-	;;
-    *)
-	;;
-esac
-
-rm -rf "$tmp"
+	      < $PKGDIR/genimage.cfg.in >$WORKDIR/genimage.cfg
 
 genimage \
-    --rootpath "$root" \
-    --tmppath  "$tmp" \
-    --inputpath "$BINARIES_DIR" \
-    --config "$root/genimage.cfg"
-
-qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
-rm "$tmpimage"
+    --tmppath    "${WORKDIR}"/tmp  \
+    --rootpath   "${WORKDIR}"/root \
+    --inputpath  "$BINARIES_DIR"   \
+    --outputpath "$BINARIES_DIR"   \
+    --config "${WORKDIR}"/genimage.cfg

board/common/image/image-itb-qcow/genimage.cfg.in

@@ -1,16 +1,5 @@
 @BOOTIMG@
 
-image aux.ext4 {
-	mountpoint = "/aux"
-	temporary = true
-	size = @AUXSIZE@
-
-	ext4 {
-		label = "aux"
-		use-mke2fs = true
-	}
-}
-
 image cfg.ext4 {
 	empty = true
 	temporary = true
@@ -33,7 +22,8 @@ image var.ext4 {
 	}
 }
 
-image @DISKIMG@ {
+image disk.img {
+	temporary = true
 	size = @TOTALSIZE@
 	hdimage {
 		partition-table-type = "gpt"
@@ -68,5 +58,15 @@ image @DISKIMG@ {
 	}
 }
 
+image @QCOWIMG@ {
+	qemu {
+		format = "qcow2"
+	}
+
+	partition disk {
+		image = "disk.img"
+	}
+}
+
 # Silence genimage warnings
 config {}

board/common/image/image-itb-qcow/image-itb-qcow.mk

@@ -0,0 +1,15 @@
+################################################################################
+#
+# image-itb-qcow
+#
+################################################################################
+
+# We can source the rootfs+aux from a local build, or from a
+# downloaded release; so adjust our dependencies accordingly.
+IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_ROOTFS)     := image-itb-rootfs image-itb-aux
+IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_DL_RELEASE) := image-itb-dl-release
+
+IMAGE_ITB_QCOW_DEPENDENCIES := host-genimage $(IMAGE_ITB_QCOW_SRC-y)
+IMAGE_ITB_QCOW_CONFIG_VARS := BOOT_DATA BOOT_OFFSET SIZE
+
+$(eval $(ix-image))

board/common/image/image-itb-rauc/Config.in

@@ -0,0 +1,27 @@
+menuconfig IMAGE_ITB_RAUC
+	bool "RAUC upgrade bundle (ITB)"
+	select IMAGE_ITB_ROOTFS
+	select BR2_PACKAGE_HOST_RAUC
+	help
+	  Create RAUC upgrade bundle, for targets using ITB images,
+	  that can be used to upgrade a running system to this version
+	  of Infix.
+
+config IMAGE_ITB_RAUC_KEY
+	string "signing key"
+	depends on IMAGE_ITB_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private key, in PKCS#8 format, used to sign
+	  the RAUC bundle; or a PKCS#11 URI.
+
+config IMAGE_ITB_RAUC_CERT
+	string "signing certificate"
+	depends on IMAGE_ITB_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+	help
+	  Path to the X509 certificate which will be associated with
+	  the bundle signature.
+
+	  NOTE: This cert MUST be included in the trust store of the
+	        system on which this bundle is to be installed.

board/common/image/image-itb-rauc/generate.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+
+squash="${BINARIES_DIR}"/rootfs.squashfs
+itbh="${BINARIES_DIR}"/rootfs.itbh
+pkg="${BINARIES_DIR}"/"${ARTIFACT}.pkg"
+
+cp -f "${PKGDIR}"/hooks.sh "${WORKDIR}"/hooks.sh
+
+# RAUC internally uses the file extension to find a suitable install
+# handler, hence the name must be .img
+cp -f "${squash}" "${WORKDIR}"/rootfs.img
+cp -f "${itbh}"   "${WORKDIR}"/rootfs.itbh
+
+cat >"${WORKDIR}"/manifest.raucm <<EOF
+[update]
+compatible=${COMPATIBLE}
+version=${VERSION}
+
+[bundle]
+format=verity
+
+[hooks]
+filename=hooks.sh
+
+[image.rootfs]
+filename=rootfs.img
+hooks=post-install
+EOF
+
+rauc --cert="${CERT}" --key="${KEY}" \
+     bundle "${WORKDIR}" "${pkg}.next"
+
+mv "${pkg}.next" "${pkg}"

board/common/image/image-itb-rauc/image-itb-rauc.mk

@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-itb-rauc
+#
+################################################################################
+
+IMAGE_ITB_RAUC_DEPENDENCIES := host-rauc image-itb-rootfs
+IMAGE_ITB_RAUC_CONFIG_VARS := KEY CERT
+
+$(eval $(ix-image))

board/common/image/image-itb-rootfs/Config.in

@@ -0,0 +1,20 @@
+menuconfig IMAGE_ITB_ROOTFS
+	bool "rootfs.itb+.itbh"
+	select BR2_TARGET_ROOTFS_SQUASHFS
+	select BR2_PACKAGE_HOST_UBOOT_TOOLS
+	help
+	  Create a signed ITB image containing a SquashFS of rootfs
+	  and extract detached header (.itbh) for U-Boot based
+	  targets.
+
+config IMAGE_ITB_ROOTFS_KEY
+	string "signing key"
+	depends on IMAGE_ITB_ROOTFS
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private RSA key, in PKCS#8 format, used to sign
+	  the root filesystem.
+
+	  If the path is prefixed with "<hint>:", then that used as
+	  the "key-name-hint" in the resulting ITB, otherwise the
+	  basename of the path, with any extension removed, is used.

board/common/image/image-itb-rootfs/generate.sh

@@ -0,0 +1,71 @@
+#!/bin/sh
+
+set -e
+
+squash="${BINARIES_DIR}"/rootfs.squashfs
+
+itb="${BINARIES_DIR}"/rootfs.itb
+itbh_size=0x1000
+
+IFS=:
+set ${KEY}
+case $# in
+    1)
+	keyfile="$1"
+	hint=$(basename ${keyfile%.*})
+	;;
+    2)
+	keyfile="$2"
+	hint="$1"
+	;;
+    *)
+	echo "INVALID KEY" >&2
+	exit 1
+	;;
+esac
+
+rsanibbles=$(openssl rsa -in "${KEY}" -noout -modulus | \
+		 sed -e 's/^Modulus=//' | tr -d '\n' | wc -c)
+if [ "${rsanibbles}" -le 0 ]; then
+    echo "ONLY RSA KEYS ARE SUPPORTED" >&2
+    exit 1
+fi
+
+cat >"${WORKDIR}"/rootfs.its <<EOF
+/dts-v1/;
+
+/ {
+	description = "${ARTIFACT}";
+	creator = "infix";
+	#address-cells = <0x1>;
+
+	images {
+		rootfs {
+			description = "rootfs";
+			type = "ramdisk";
+			os = "linux";
+			compression = "none";
+			data = /incbin/("${squash}");
+			signature-1 {
+				algo = "sha256,rsa$((rsanibbles << 2))";
+				key-name-hint = "${hint}";
+			};
+		};
+	};
+
+	configurations {
+		default = "verity";
+		verity {
+			ramdisk = "rootfs";
+		};
+	};
+};
+
+EOF
+
+mkimage -E -p $itbh_size -B $itbh_size \
+	-f "${WORKDIR}"/rootfs.its \
+	-g "${hint}" -G "${keyfile}" \
+	"${itb}"
+
+dd if="${itb}" bs=$((itbh_size)) count=1 of="${itb}h" status=none

board/common/image/image-itb-rootfs/image-itb-rootfs.mk

@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-itb-rootfs
+#
+################################################################################
+
+IMAGE_ITB_ROOTFS_DEPENDENCIES := rootfs-squashfs
+IMAGE_ITB_ROOTFS_CONFIG_VARS := KEY
+
+$(eval $(ix-image))

board/common/image/image-readme/Config.in

@@ -0,0 +1,6 @@
+config IMAGE_README
+	bool "Install README.md in images"
+	help
+	  Install a README.md with useful information about getting
+	  started with Infix in the images directory (thereby also
+	  including it in the resulting release tarball).

board/common/image/image-readme/image-readme.mk

@@ -0,0 +1,18 @@
+################################################################################
+#
+# image-readme
+#
+################################################################################
+
+IMAGE_README_DIR := $(pkgdir)
+
+image-readme: $(BINARIES_DIR)/README.md
+
+$(BINARIES_DIR)/README.md: $(IMAGE_README_DIR)/README.md
+	@$(call IXMSG,"Installing README.md")
+	@mkdir -p $(BINARIES_DIR)
+	@cp $< $@
+
+ifeq ($(IMAGE_README),y)
+TARGETS_ROOTFS += image-readme
+endif

board/common/image/image.mk

@@ -0,0 +1,2 @@
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/ix-image.mk
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/*/*.mk))

board/common/image/ix-image.mk

@@ -0,0 +1,26 @@
+define inner-ix-image
+
+$(2)_DIR := $$(pkgdir)
+
+$(1): $$($(2)_DEPENDENCIES)
+	@$$(call IXMSG,"$$(if $$($(2)_MESSAGE),$$($(2)_MESSAGE),Creating $(1))")
+	@mkdir -p $$(BUILD_DIR)/$(1)
+	@ \
+	PATH=$$(BR_PATH) \
+	PKGDIR=$$($(2)_DIR) \
+	WORKDIR=$$(BUILD_DIR)/$(1) \
+	BINARIES_DIR=$$(BINARIES_DIR) \
+	BR2_EXTERNAL_INFIX_PATH=$$(BR2_EXTERNAL_INFIX_PATH) \
+	ARTIFACT=$$(INFIX_ARTIFACT) \
+	COMPATIBLE=$$(INFIX_COMPATIBLE) \
+	VERSION=$$(INFIX_VERSION) \
+	$$(foreach var,$$($(2)_CONFIG_VARS),$$(var)=$$($(2)_$$(var)) ) \
+	$$($(2)_DIR)/generate.sh $$($(2)_OPTS)
+
+ifeq ($$($(2)),y)
+TARGETS_ROOTFS += $(1)
+endif
+
+endef
+
+ix-image = $(call inner-ix-image,$(pkgname),$(call UPPERCASE,$(pkgname)))

board/common/mkaux.sh

@@ -1,40 +0,0 @@
-#!/bin/sh
-
-rootdir=$BUILD_DIR/genimage.root
-tempdir=$BUILD_DIR/genimage.tmp
-
-cat <<EOF > /tmp/mkaux.cfg
-image aux.ext4 {
-	mountpoint = "/aux"
-	size = 16M
-
-	ext4 {
-		label = "aux"
-		use-mke2fs = true
-		features = "^metadata_csum,^metadata_csum_seed,uninit_bg"
-                extraargs = "-m 0 -i 4096"
-	}
-}
-
-# Silence genimage warnings
-config {}
-EOF
-
-rm -rf   "$rootdir/aux"
-mkdir -p "$rootdir/aux"
-cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/primary.itbh"
-cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/secondary.itbh"
-cp -f "$BINARIES_DIR/rauc.status" "$rootdir/aux/rauc.status"
-
-mkenvimage -s 0x4000 -o "$rootdir/aux/uboot.env" \
-	   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
-
-rm -rf "$BINARIES_DIR/aux.ext4"
-rm -rf "$tempdir"
-
-genimage \
-    --rootpath   "$rootdir" \
-    --tmppath    "$tempdir" \
-    --inputpath  "$BINARIES_DIR" \
-    --outputpath "$BINARIES_DIR" \
-    --config "/tmp/mkaux.cfg"

board/common/mkfit.sh

@@ -1,118 +0,0 @@
-#!/bin/sh
-
-die()
-{
-    echo "$@" >&2
-    exit 1
-}
-
-load_cfg()
-{
-    local tmp=$(mktemp -p /tmp)
-
-    grep ^FIT_ $BR2_CONFIG >$tmp
-    .  $tmp
-    rm $tmp
-}
-
-load_cfg
-[ "$FIT_IMAGE" = "y" ] || exit 0
-
-work=$BUILD_DIR/fit-image-local
-dtbs=$(find $BINARIES_DIR -name '*.dtb')
-kernel=$(find $BINARIES_DIR -name '*Image' | head -n1)
-squash=$BINARIES_DIR/rootfs.squashfs
-
-mkdir -p $work
-gzip <$kernel >$work/Image.gz
-kernel=$work/Image.gz
-
-rm -rf $work/rootfs
-unsquashfs -f -d $work/rootfs $squash
-rm -f $work/rootfs/boot/*Image
-
-squash=$work/rootfs-no-kernel.squashfs
-rm -f $squash
-mksquashfs $work/rootfs $squash
-
-# mkimage will only align images to 4 bytes, but U-Boot will leave
-# both DTB and ramdisk in place when starting the kernel. So we pad
-# all components up to a 4k boundary.
-truncate -s %4k $kernel $dtbs
-
-: >$work/dtbs.itsi
-: >$work/cfgs.itsi
-for dtb in $dtbs; do
-    name=$(basename $dtb .dtb)
-
-    cat <<EOF >>$work/dtbs.itsi
-		$name-dtb {
-			description = "$name";
-			type = "flat_dt";
-			arch = "$FIT_ARCH";
-			compression = "none";
-			data = /incbin/("$dtb");
-		};
-EOF
-    cat <<EOF >>$work/cfgs.itsi
-		$name {
-			description = "$name";
-			kernel = "kernel";
-			ramdisk = "ramdisk";
-			fdt = "$name-dtb";
-		};
-EOF
-done
-
-: >$work/kernel-load.itsi
-if [ "$FIT_KERNEL_LOAD_ADDR" ]; then
-    cat <<EOF >$work/kernel-load.itsi
-			load = <$FIT_KERNEL_LOAD_ADDR>;
-			entry = <$FIT_KERNEL_LOAD_ADDR>;
-EOF
-fi
-
-cat <<EOF >$work/infix.its
-/dts-v1/;
-
-/ {
-	timestamp = <$(date +%s)>;
-	description = "Infix ($FIT_ARCH)";
-	creator = "infix";
-	#address-cells = <0x1>;
-
-	images {
-
-		kernel {
-			description = "Linux";
-			type = "kernel";
-			arch = "$FIT_ARCH";
-			os = "linux";
-$(cat $work/kernel-load.itsi)
-			compression = "gzip";
-			data = /incbin/("$kernel");
-		};
-
-		ramdisk {
-			description = "Infix";
-			type = "ramdisk";
-			os = "linux";
-			arch = "$FIT_ARCH";
-			compression = "none";
-			data = /incbin/("$squash");
-		};
-
-$(cat $work/dtbs.itsi)
-
-	};
-
-	configurations {
-$(cat $work/cfgs.itsi)
-	};
-};
-EOF
-
-mkimage \
-    -E -p 0x1000 \
-    -f $work/infix.its $BINARIES_DIR/infix.itb \
-    || die "Unable to create FIT image"

board/common/mkgns3a.sh

@@ -1,103 +0,0 @@
-#!/bin/sh
-# shellcheck disable=SC1091
-. "$TARGET_DIR/etc/os-release"
-
-if [ -n "$INFIX_RELEASE" ]; then
-    rel="-${INFIX_RELEASE}"
-fi
-
-ARCH=$1
-NM="${2:-custom}${rel}"
-DISK=$3
-RAM=${4:-512}
-IFNUM=${5:-1}
-
-# The aarch64 build currently has no "loader" but instead starts Linux
-# directly, so we need to add a basic cmdline.
-loader_args()
-{
-    if [ "$ARCH" = "aarch64" ]; then
-	cat <<EOF
-"kernel_command_line": "console=ttyAMA0 root=PARTLABEL=primary quiet",
-EOF
-    fi
-}
-
-loader_img()
-{
-    if [ "$ARCH" = "x86_64" ]; then
-	cat <<EOF
-"bios_image": "$loader",
-EOF
-    else
-	cat <<EOF
-"kernel_image": "$loader",
-EOF
-    fi
-}
-
-if [ "$ARCH" = "x86_64" ]; then
-    loader=OVMF.fd
-    accel=allow
-    opts=
-else
-    loader=Image
-    accel=disable
-    opts="-M virt -cpu cortex-a72"
-fi
-
-echo ">> Disk image MD5: $(md5sum "$BINARIES_DIR/$DISK" | awk '{print $1}')"
-
-cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
-{
-    "name": "$NM",
-    "category": "router",
-    "description": "$INFIX_DESC",
-    "vendor_name": "$VENDOR_NAME",
-    "vendor_url": "$VENDOR_HOME",
-    "product_name": "$NAME",
-    "registry_version": 6,
-    "status": "stable",
-    "maintainer": "$VENDOR_NAME",
-    "maintainer_email": "${SUPPORT_URL#mailto:}",
-    "usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
-    "port_name_format": "eth{0}",
-    "linked_clone": true,
-    "qemu": {
-        "adapter_type": "virtio-net-pci",
-        "adapters": ${IFNUM},
-        "ram": ${RAM},
-        "cpus": 1,
-        "hda_disk_interface": "virtio",
-        "arch": "$ARCH",
-        "console_type": "telnet",
-        $(loader_img)
-        $(loader_args)
-        "kvm": "$accel",
-	"options": "$opts"
-    },
-    "images": [
-        {
-            "filename": "$loader",
-            "filesize": $(stat --printf='%s' "$BINARIES_DIR/$loader"),
-            "md5sum": "$(md5sum "$BINARIES_DIR/$loader" | awk '{print $1}')",
-            "version": "0.0"
-        },
-        {
-            "filename": "$DISK",
-            "filesize": $(stat --printf='%s' "$BINARIES_DIR/$DISK"),
-            "md5sum": "$(md5sum "$BINARIES_DIR/$DISK" | awk '{print $1}')",
-            "version": "0.0"
-        }
-    ],
-    "versions": [
-        {
-            "name": "0.0",
-            "images": {
-                $(loader_img)
-                "hda_disk_image": "$DISK"
-            }
-        }
-    ]
-}
-EOF

board/common/mkmmc.sh

@@ -1,22 +0,0 @@
-#!/bin/sh
-
-set -e
-
-common=$(dirname $(readlink -f "$0"))
-root=$BUILD_DIR/genimage.root
-tmp=$BUILD_DIR/genimage.tmp
-
-
-mkdir -p $root/aux
-cp -f $BINARIES_DIR/uboot-env.bin $root/aux/uboot.env
-cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
-cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
-
-rm -rf $tmp
-
-genimage \
-    --rootpath $root \
-    --tmppath  $tmp \
-    --inputpath $BINARIES_DIR \
-    --outputpath $BINARIES_DIR \
-    --config $common/genimage.cfg

board/common/mkrauc-status.sh

@@ -1,35 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# Bootstrap a RAUC status file showing the newly created image
-# installed to both the primary and secondary slots. This then bundled
-# in the aux partition in mkdisk.sh, so that RAUC (on the target) can
-# always report the installed versions.
-rauc info --no-verify --output-format=shell $1 >/tmp/rauc-$$.info
-. /tmp/rauc-$$.info
-rm /tmp/rauc-$$.info
-tstamp=$(date -u +%FT%TZ)
-cat <<EOF
-[slot.rootfs.0]
-bundle.compatible=$RAUC_MF_COMPATIBLE
-bundle.version=$RAUC_MF_VERSION
-status=ok
-sha256=$RAUC_IMAGE_DIGEST_0
-size=$RAUC_IMAGE_SIZE_0
-installed.timestamp=$tstamp
-installed.count=1
-activated.timestamp=$tstamp
-activated.count=1
-
-[slot.rootfs.1]
-bundle.compatible=$RAUC_MF_COMPATIBLE
-bundle.version=$RAUC_MF_VERSION
-status=ok
-sha256=$RAUC_IMAGE_DIGEST_0
-size=$RAUC_IMAGE_SIZE_0
-installed.timestamp=$tstamp
-installed.count=1
-activated.timestamp=$tstamp
-activated.count=1
-EOF

board/common/mkrauc.sh

@@ -1,43 +0,0 @@
-#!/bin/sh
-
-set -e
-
-name=$1
-compat=$2
-sign=$3
-
-crt=$(ls $sign/*.crt)
-key=$(ls $sign/*.key)
-
-common=$(dirname "$(readlink -f "$0")")
-
-work=$BUILD_DIR/mkrauc
-mkdir -p "$work"
-
-cp -f "$common/rauc-hooks.sh" "$work/hooks.sh"
-
-# RAUC internally uses the file extension to find a suitable install
-# handler, hence the name must be .img
-cp -f "$BINARIES_DIR/rootfs.squashfs" "$work/rootfs.img"
-cp -f "$BINARIES_DIR/rootfs.itbh"     "$work/rootfs.itbh"
-
-cat >"$work/manifest.raucm" <<EOF
-[update]
-compatible=${compat}
-version=${INFIX_VERSION}
-
-[bundle]
-format=verity
-
-[hooks]
-filename=hooks.sh
-
-[image.rootfs]
-filename=rootfs.img
-hooks=post-install
-EOF
-
-rm -f "$BINARIES_DIR/$name.pkg"
-
-rauc --cert="$crt" --key="$key" \
-     bundle "$work" "$BINARIES_DIR/$name.pkg"

board/common/post-image.sh

@@ -1,112 +0,0 @@
-#!/bin/sh
-# shellcheck disable=SC2086
-
-common=$(dirname "$(readlink -f "$0")")
-. "$common/lib.sh"
-
-# shellcheck disable=SC1091
-. "$TARGET_DIR/etc/os-release"
-
-# The INFIX_* variables may be composed from BR2_* variables,
-# so we source them last.
-load_cfg BR2_ARCH
-load_cfg BR2_DEFCONFIG
-load_cfg BR2_EXTERNAL_INFIX_PATH
-load_cfg BR2_TARGET_ROOTFS
-load_cfg INFIX_ID
-load_cfg INFIX_COMPATIBLE
-
-# The default IMAGE_ID is infix-$BR2_ARCH but can be overridden
-# for imaage names, and compat strings, like infix-r2s
-if [ -n "$IMAGE_ID" ]; then
-    NAME="$IMAGE_ID"
-else
-    NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
-fi
-diskimg=disk.qcow2
-
-ver()
-{
-    if [ -n "$INFIX_RELEASE" ]; then
-	printf -- "-%s" "${INFIX_RELEASE#v}"
-	return
-    fi
-}
-
-load_cfg SIGN_ENABLED
-if [ "$SIGN_ENABLED" = "y" ]; then
-    load_cfg BR2_ARCH
-    load_cfg SIGN_KEY
-
-    ixmsg "Signing SquashFS Image"
-    $common/sign.sh $BR2_ARCH $SIGN_KEY
-
-    ixmsg "Creating RAUC Update Bundle"
-    $common/mkrauc.sh "$NAME$(ver)" $INFIX_COMPATIBLE $SIGN_KEY
-fi
-
-load_cfg DISK_IMAGE
-if [ "$DISK_IMAGE" = "y" ]; then
-    ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk$(ver).qcow2"
-    bootcfg=
-    if [ "$DISK_IMAGE_BOOT_DATA" ]; then
-	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
-    fi
-
-    if [ "$BR2_TARGET_ROOTFS_SQUASHFS" != "y" ] && \
-       [ ! -f "$BINARIES_DIR/rootfs.squashfs" ]; then
-	ixmsg "  Injecting $DISK_IMAGE_RELEASE_URL"
-	archive="$BINARIES_DIR/$(basename $DISK_IMAGE_RELEASE_URL)"
-	[ -f "$archive" ] || wget -O"$archive" "$DISK_IMAGE_RELEASE_URL"
-	tar -xa --strip-components=1 -C "$BINARIES_DIR" -f "$archive"
-    fi
-
-    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
-    $common/mkdisk.sh -a $BR2_ARCH -n $diskimg -s $DISK_IMAGE_SIZE $bootcfg
-fi
-
-load_cfg SDCARD_AUX
-if [ "$SDCARD_AUX" = "y" ]; then
-    ixmsg "Creating initial rauc.status"
-    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
-    ixmsg "Creating aux.ext4 for sdcard.img"
-    $common/mkaux.sh
-fi
-
-load_cfg GNS3_APPLIANCE
-if [ "$GNS3_APPLIANCE" = "y" ]; then
-    ixmsg "Creating GNS3 Appliance, $GNS3_APPLIANCE_RAM MiB with $GNS3_APPLIANCE_IFNUM ports"
-    $common/mkgns3a.sh $BR2_ARCH $NAME $diskimg $GNS3_APPLIANCE_RAM $GNS3_APPLIANCE_IFNUM
-fi
-
-load_cfg FIT_IMAGE
-if [ "$FIT_IMAGE" = "y" ]; then
-    ixmsg "Creating Traditional FIT Image"
-    $common/mkfit.sh
-fi
-
-# Only for regular builds, not bootloader-only builds
-if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
-    rel=$(ver)
-    ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
-    if [ -n "$rel" ]; then
-	ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
-    fi
-
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
-
-    # Menuconfig support for modifying Qemu args in release tarballs
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
-    sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
-	-e "s/@DISK_IMG@/$diskimg/"   \
-	< "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in.in" \
-	> "$BINARIES_DIR/Config.in"
-    rm -f "$BINARIES_DIR/qemu.cfg"
-    CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
-	   "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
-    rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
-
-    # Quick intro for beginners, with links to more information
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"
-fi

board/common/qemu/Config.in.in

@@ -78,7 +78,7 @@ endchoice
 config QEMU_MACHINE
 	string "Select emulated machine"
 	default "qemu-system-arm     -M virt,accel=kvm:tcg -cpu max" if QEMU_arm
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu cortex-a53" if QEMU_aarch64
 	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
@@ -99,20 +99,20 @@ config QEMU_MACHINE_RAM
 config QEMU_KERNEL
 	string
 	depends on QEMU_LOADER_KERNEL
-	default "zImage"  if QEMU_arm
-	default "Image"   if QEMU_aarch64
-	default "bzImage" if QEMU_x86_64
+	default "../zImage"  if QEMU_arm
+	default "../Image"   if QEMU_aarch64
+	default "../bzImage" if QEMU_x86_64
 
 config QEMU_BIOS
 	string
 	depends on !QEMU_LOADER_KERNEL
-	default "u-boot.bin" if QEMU_LOADER_UBOOT
-	default "OVMF.fd"    if QEMU_LOADER_OVMF
+	default "../u-boot.bin" if QEMU_LOADER_UBOOT
+	default "../OVMF.fd"    if QEMU_LOADER_OVMF
 
 config QEMU_ROOTFS
 	string
 	default "@DISK_IMG@" if !QEMU_ROOTFS_INITRD
-	default "rootfs.squashfs" if QEMU_ROOTFS_INITRD
+	default "../rootfs.squashfs" if QEMU_ROOTFS_INITRD
 
 config QEMU_DTB_EXTEND
 	bool

board/common/qemu/qemu.mk

@@ -0,0 +1,45 @@
+################################################################################
+#
+# qemu-scripts
+#
+################################################################################
+
+QEMU_SCRIPTS_DIR := $(pkgdir)
+qemu-kconfig = \
+	CONFIG_="CONFIG_" \
+	BR2_CONFIG="$(BINARIES_DIR)/qemu/.config" \
+	$(BUILD_DIR)/buildroot-config/$(1) $(2) "$(BINARIES_DIR)/qemu/Config.in"
+
+ifeq ($(QEMU_SCRIPTS),y)
+
+.PHONY: run
+run:
+	@$(BINARIES_DIR)/qemu/run.sh
+
+.PHONY: run-menuconfig
+run-menuconfig: $(BUILD_DIR)/buildroot-config/mconf
+	@$(call qemu-kconfig,mconf)
+
+qemu-scripts: \
+		$(BINARIES_DIR)/qemu/run.sh \
+		$(BINARIES_DIR)/qemu/Config.in \
+		$(BINARIES_DIR)/qemu/.config
+
+$(BINARIES_DIR)/qemu/run.sh: $(QEMU_SCRIPTS_DIR)/run.sh
+	@$(call IXMSG,"Installing QEMU scripts")
+	@mkdir -p $(dir $@)
+	@cp $< $@
+
+$(BINARIES_DIR)/qemu/Config.in: $(QEMU_SCRIPTS_DIR)/Config.in.in
+	@mkdir -p $(dir $@)
+	@sed \
+		-e "s:@ARCH@:QEMU_$(BR2_ARCH):" \
+		-e "s:@DISK_IMG@:../$(INFIX_ARTIFACT).qcow2:" \
+	< $< >$@
+
+$(BINARIES_DIR)/qemu/.config: $(BINARIES_DIR)/qemu/Config.in
+	@$(call qemu-kconfig,conf,--olddefconfig)
+	@rm -f $@.old
+
+TARGETS_ROOTFS += qemu-scripts
+endif

board/common/qemu/run.sh

@@ -19,8 +19,8 @@
 #
 # shellcheck disable=SC3037
 
-# Local variables
-imgdir=$(readlink -f "$(dirname "$0")")
+qdir=$(dirname "$(readlink -f "$0")")
+imgdir=$(readlink -f "${qdir}/..")
 prognm=$(basename "$0")
 
 usage()
@@ -56,12 +56,8 @@ die()
 
 load_qemucfg()
 {
-    tmp=$(mktemp -p /tmp)
-
-    grep ^CONFIG_QEMU_ "$1" >"$tmp"
     # shellcheck disable=SC1090
-    .  "$tmp"
-    rm "$tmp"
+    .  "./.config"
 
     [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
     [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
@@ -247,7 +243,7 @@ rocker_port_args()
 net_args()
 {
     # Infix will pick up this file via fwcfg and install it to /etc
-    mactab=${imgdir}/mactab
+    mactab=${qdir}/mactab
     :> "$mactab"
     echo -n "-fw_cfg name=opt/mactab,file=$mactab "
 
@@ -286,7 +282,7 @@ vpd_args()
 {
     [ "$CONFIG_QEMU_VPD" = "y" ] || return
 
-    vpd_file="${imgdir}/vpd"
+    vpd_file="${qdir}/vpd"
 
     if ! [ -f "$vpd_file" ]; then
 	onieprom="${imgdir}/onieprom"
@@ -430,7 +426,7 @@ dtb_args()
 
 	# Extend it with the environment and signing information in
 	# u-boot.dtb.
-	echo "qemu.dtb u-boot.dtb" | \
+	echo "qemu.dtb ../u-boot.dtb" | \
 	    xargs -n 1 dtc -I dtb -O dts | \
 	    { echo "/dts-v1/;"; sed  -e 's:/dts-v[0-9]\+/;::'; } | \
 	    dtc >qemu-extended.dtb 2>/dev/null
@@ -439,7 +435,7 @@ dtb_args()
 	echo -n "-dtb qemu-extended.dtb "
     else
 	# Otherwise we just use the unmodified one
-	echo -n "-dtb u-boot.dtb "
+	echo -n "-dtb ../u-boot.dtb "
     fi
 }
 
@@ -485,13 +481,12 @@ EOF
 
 menuconfig()
 {
-    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the output/images directory"
+    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the $$O/images/qemu directory"
     command -v kconfig-mconf >/dev/null || die "$prognm: cannot find kconfig-mconf for menuconfig"
     exec kconfig-mconf Config.in
 }
 
-scriptdir=$(dirname "$(readlink -f "$0")")
-cd "$scriptdir" || (echo "Failed cd to $scriptdir"; exit 1)
+cd "$qdir" || (echo "Failed cd to $qdir"; exit 1)
 
 while [ "$1" != "" ]; do
     case $1 in
@@ -510,13 +505,7 @@ while [ "$1" != "" ]; do
     shift
 done
 
-if [ -f .config ]; then
-    # Customized settings from 'qemu.sh -c'
-    load_qemucfg .config
-else
-    # Shipped defaults from release tarball
-    load_qemucfg qemu.cfg
-fi
+load_qemucfg
 
 if [ -z "$QEMU_EXTRA_APPEND" ]; then
     QEMU_EXTRA_APPEND="$*"

board/common/rootfs.its

@@ -1,28 +0,0 @@
-/dts-v1/;
-
-/ {
-	description = "Infix";
-	creator = "infix";
-	#address-cells = <0x1>;
-
-	images {
-		rootfs {
-			description = "Infix";
-			type = "ramdisk";
-			os = "linux";
-			compression = "none";
-			data = /incbin/("rootfs.squashfs");
-			signature-1 {
-				algo = "sha256,rsa4096";
-				key-name-hint = "infix";
-			};
-		};
-	};
-
-	configurations {
-		default = "verity";
-		verity {
-			ramdisk = "rootfs";
-		};
-	};
-};

board/common/rootfs/etc/sysctl.d/vm.conf

@@ -0,0 +1,23 @@
+# Memory and OOM tuning for embedded network devices
+# Optimized for systems with 512MB-4GB RAM
+# Target: Fast and deterministic OOM behavior
+
+# OOM Behavior
+# Panic on OOM for fast system reset and recovery
+vm.panic_on_oom=1
+
+# Dirty Page Writeback
+# Limit dirty pages to 10% of RAM before blocking writers
+# Start background writeback at 5% to prevent accumulation
+vm.dirty_ratio=10
+vm.dirty_background_ratio=5
+
+# Writeback Timing
+# Expire dirty pages after 10 seconds (1000 centiseconds)
+# Ensures quick flushing on limited-memory systems
+vm.dirty_expire_centisecs=1000
+
+# Memory Watermarks
+# Increase distance between low/high watermarks for earlier reclaim
+# Maintains larger free memory buffer proactively (default: 10)
+vm.watermark_scale_factor=150

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -1,13 +1,13 @@
 #!/usr/bin/env python3
-import importlib.machinery
+
 import json
+import onieprom
 import os
 import shutil
 import struct
 import subprocess
 import sys
 
-onieprom = importlib.machinery.SourceFileLoader("onieprom", "/bin/onieprom").load_module()
 SYSTEM_JSON = "/run/system.json"
 KKIT_IANA_PEM = 61046
 

board/common/sign.sh

@@ -1,13 +0,0 @@
-#!/bin/sh
-
-set -e
-
-common=$(dirname $(readlink -f "$0"))
-
-cd $BINARIES_DIR
-cp $common/rootfs.its .
-
-mkimage -E -p 0x1000 -B 0x1000 -k $2 -f rootfs.its rootfs.itb
-
-cp rootfs.itb rootfs.itbh
-truncate -s $((0x1000)) rootfs.itbh

board/riscv64/board.mk

@@ -0,0 +1 @@
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/*/*.mk))

configs/aarch32_defconfig

@@ -98,17 +98,14 @@ BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
@@ -135,11 +132,13 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
-GNS3_APPLIANCE_RAM=512
-GNS3_APPLIANCE_IFNUM=10

configs/aarch32_minimal_defconfig

@@ -98,17 +98,14 @@ BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
@@ -135,11 +132,13 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
-GNS3_APPLIANCE_RAM=512
-GNS3_APPLIANCE_IFNUM=10

configs/aarch64_defconfig

@@ -25,10 +25,9 @@ BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.61"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -123,16 +122,12 @@ BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_GO_BIN=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
@@ -171,6 +166,7 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_NETBROWSE=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
@@ -180,8 +176,9 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
-GNS3_APPLIANCE_RAM=512
-GNS3_APPLIANCE_IFNUM=10

configs/aarch64_minimal_defconfig

@@ -24,10 +24,9 @@ BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.61"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -101,15 +100,11 @@ BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
@@ -144,13 +139,15 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
-DISK_IMAGE_BOOT_BIN=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-GNS3_APPLIANCE_RAM=512
-GNS3_APPLIANCE_IFNUM=10

configs/aarch64_qemu_boot_defconfig

@@ -11,7 +11,6 @@ BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
 BR2_SSP_NONE=y
 BR2_INIT_NONE=y
 BR2_SYSTEM_BIN_SH_NONE=y
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 # BR2_PACKAGE_BUSYBOX is not set
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 # BR2_TARGET_ROOTFS_TAR is not set
@@ -22,9 +21,8 @@ BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2023.07.02"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="qemu_arm64"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/qemu-uboot/extras.config"
 BR2_TARGET_UBOOT_FORMAT_DTB=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-# GNS3_APPLIANCE is not set
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y

configs/bpi_r3_emmc_boot_defconfig

@@ -39,6 +39,3 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
-DISK_IMAGE_BOOT_DATA="${BINARIES_DIR}/flash-image.bin"
-DISK_IMAGE_BOOT_OFFSET=0x00200000

configs/bpi_r3_sd_boot_defconfig

@@ -39,6 +39,3 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
-DISK_IMAGE_BOOT_DATA="${BINARIES_DIR}/flash-image.bin"
-DISK_IMAGE_BOOT_OFFSET=0x00200000

configs/cn9130_crb_boot_defconfig

@@ -11,7 +11,6 @@ BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
 BR2_SSP_NONE=y
 BR2_INIT_NONE=y
 BR2_SYSTEM_BIN_SH_NONE=y
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 # BR2_PACKAGE_BUSYBOX is not set
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 # BR2_TARGET_ROOTFS_TAR is not set
@@ -38,4 +37,5 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-# GNS3_APPLIANCE is not set
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y

configs/fireant_boot_defconfig

@@ -22,4 +22,4 @@ BR2_TARGET_UBOOT_CUSTOM_REPO_VERSION="c3d9cdcc7d9e3eb490d4036f5eece3fb91a2485c"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mscc_fireant_pcb135_emmc"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config"
 BR2_TARGET_UBOOT_NEEDS_DTC=y
-# GNS3_APPLIANCE is not set
+

configs/riscv64_defconfig

@@ -23,7 +23,7 @@ BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/riscv64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/common/post-image.sh support/scripts/genimage.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="support/scripts/genimage.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
@@ -139,7 +139,6 @@ BR2_TARGET_ROOTFS_EXT2_4=y
 BR2_TARGET_ROOTFS_EXT2_SIZE="512M"
 BR2_TARGET_ROOTFS_EXT2_INODE_SIZE=0
 BR2_TARGET_ROOTFS_EXT2_MKFS_OPTIONS="-O ^64bit,large_file,ext_attr"
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_OPENSBI=y
 BR2_TARGET_OPENSBI_CUSTOM_VERSION=y
@@ -165,9 +164,6 @@ BR2_TARGET_UBOOT_SPL=y
 BR2_TARGET_UBOOT_SPL_NAME="spl/u-boot-spl.bin.normal.out"
 BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/uboot/visionfive2-env.dtsi"
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
@@ -195,6 +191,7 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_NETBROWSE=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
@@ -204,7 +201,9 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-# GNS3_APPLIANCE is not set
-SDCARD_AUX=y

configs/rpi2_boot_defconfig

@@ -31,4 +31,3 @@ BR2_TARGET_BAREBOX_IMAGE_FILE="images/barebox-raspberry-pi-2.img"
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_RAUC=y
-# GNS3_APPLIANCE is not set

configs/rpi64_boot_defconfig

@@ -10,7 +10,6 @@ BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
 BR2_SSP_NONE=y
 BR2_INIT_NONE=y
 BR2_SYSTEM_BIN_SH_NONE=y
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 # BR2_PACKAGE_BUSYBOX is not set
 BR2_PACKAGE_RPI_FIRMWARE=y
 BR2_PACKAGE_RPI_FIRMWARE_BOOTCODE_BIN=y
@@ -40,4 +39,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_BOOTLOADER_SPLASHSCREEN=y
-# GNS3_APPLIANCE is not set
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y

configs/x86_64_defconfig

@@ -24,10 +24,9 @@ BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.61"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -119,7 +118,6 @@ BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_EDK2=y
 BR2_TARGET_GRUB2=y
@@ -131,11 +129,8 @@ BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
@@ -168,6 +163,7 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_NETBROWSE=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
@@ -177,7 +173,9 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-GNS3_APPLIANCE_RAM=512
-GNS3_APPLIANCE_IFNUM=10

configs/x86_64_minimal_defconfig

@@ -24,10 +24,9 @@ BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.61"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -97,7 +96,6 @@ BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_EDK2=y
 BR2_TARGET_GRUB2=y
@@ -109,10 +107,7 @@ BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
@@ -139,10 +134,13 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-GNS3_APPLIANCE_RAM=512
-GNS3_APPLIANCE_IFNUM=10

doc/ChangeLog.md

@@ -3,6 +3,26 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
+[v26.01.0][UNRELEASED]
+-------------------------
+
+### Changes
+
+- Upgrade Linux kernel to 6.12.61 (LTS)
+- Add RIPv2 routing support, issue #582
+- Add support for configurable OSPF debug logging, issue #1281. Debug options
+  can now be enabled per category (bfd, packet, ism, nsm, default-information,
+  nssa). All debug options are disabled by default to prevent log flooding in
+  production environments. See the documentation for usage examples
+- Add support for "routing interfaces", issue #647.  Lists interfaces with IP
+  forwarding.  Inspect from CLI using `show interface`, look for `⇅` flag
+- Add memory tuning configuration for embedded network devices with aggressive
+  dirty page writeback and OOM panic for deterministic recovery
+
+### Fixes
+
+N/A
+
 [v25.11.0][] - 2025-12-02
 -------------------------
 

doc/developers-guide.md

@@ -217,7 +217,7 @@ gathers data from local linux services and feeds it into sysrepo.
 
 To apply changes, rebuild the image:
 
-    make python-statd-rebuild statd-rebuild all
+    make statd-rebuild all
 
 Rebuilding the image and testing on target for every change during
 development process can be tedious. Instead, `yanger` allows remote

doc/networking.md

@@ -1339,6 +1339,7 @@ Currently supported YANG models:
 | ietf-ipv4-unicast-routing | Static IPv4 unicast routing     |
 | ietf-ipv6-unicast-routing | Static IPv6 unicast routing     |
 | ietf-ospf                 | OSPF routing                    |
+| ietf-rip                  | RIP routing                     |
 | infix-routing             | Infix deviations and extensions |
 
 The base model, ietf-routing, is where all the other models hook in.  It
@@ -1502,6 +1503,163 @@ routes`.
 
     admin@example:/>
 
+For more detailed troubleshooting, OSPF debug logging can be enabled to
+capture specific protocol events. Debug messages are written to the
+routing log file (`/var/log/routing`).
+
+> [!CAUTION]
+> Debug logging significantly increases log output and may impact
+> performance. Only enable debug categories needed for troubleshooting,
+> and disable them when done.
+
+To enable specific OSPF debug categories:
+
+    admin@example:/> configure
+    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf debug
+    admin@example:/config/routing/…/ospf/debug/> set bfd true
+    admin@example:/config/routing/…/ospf/debug/> set nsm true
+    admin@example:/config/routing/…/ospf/debug/> leave
+    admin@example:/>
+
+Available debug categories include:
+
+- `bfd`: BFD (Bidirectional Forwarding Detection) events
+- `packet`: Detailed packet debugging (all OSPF packets)
+- `ism`: Interface State Machine events
+- `nsm`: Neighbor State Machine events
+- `default-information`: Default route origination
+- `nssa`: Not-So-Stubby Area events
+
+All debug options are disabled by default. Refer to the `infix-routing`
+YANG model for the complete list of available debug options.
+
+To view current debug settings:
+
+    admin@example:/> show running-config routing control-plane-protocol
+
+To disable all debug logging, simply delete the debug settings or set
+all options back to `false`:
+
+    admin@example:/> configure
+    admin@example:/config/> delete routing control-plane-protocol ospfv2 name default ospf debug
+    admin@example:/config/> leave
+    admin@example:/>
+
+
+### RIP Routing
+
+The system supports RIP dynamic routing for IPv4, i.e., RIPv2.  To enable
+RIP and set active interfaces:
+
+    admin@example:/config/> edit routing control-plane-protocol ripv2 name default rip
+    admin@example:/config/routing/…/rip/> set interfaces interface e0
+    admin@example:/config/routing/…/rip/> set interfaces interface e1
+    admin@example:/config/routing/…/rip/> leave
+    admin@example:/>
+
+> [!TIP]
+> Remember to enable [IPv4 forwarding](#ipv4-forwarding) for all the
+> interfaces you want to route between.
+
+
+#### RIP interface settings
+
+By default, interfaces send and receive RIPv2 packets.  To control the
+RIP version per interface:
+
+    admin@example:/config/routing/…/rip/> edit interfaces interface e0
+    admin@example:/config/routing/…/rip/interfaces/interface/e0/> set send-version 1
+    admin@example:/config/routing/…/rip/interfaces/interface/e0/> set receive-version 1-2
+    admin@example:/config/routing/…/rip/interfaces/interface/e0/> leave
+    admin@example:/>
+
+Valid version values are `1`, `2`, or `1-2` (both versions).
+
+To configure a passive interface (advertise network but don't send/receive
+RIP updates):
+
+    admin@example:/config/routing/…/rip/> edit interfaces interface e0
+    admin@example:/config/routing/…/rip/interfaces/interface/e0/> set passive
+    admin@example:/config/routing/…/rip/interfaces/interface/e0/> leave
+    admin@example:/>
+
+
+#### RIP global settings
+
+RIP supports redistribution of connected and static routes:
+
+    admin@example:/config/routing/…/rip/> set redistribute connected
+    admin@example:/config/routing/…/rip/> set redistribute static
+    admin@example:/config/routing/…/rip/> leave
+    admin@example:/>
+
+
+#### Debug RIPv2
+
+The CLI provides various RIP status commands:
+
+    admin@example:/> show ip rip
+
+    Default version control: send version 2, receive version 2
+      Interface        Send  Recv   Key-chain
+      e0               2     2
+      e1               2     2
+
+    Routing for Networks:
+      e0
+      e1
+
+    Routing Information Sources:
+      Gateway          BadPackets BadRoutes  Distance Last Update
+      10.0.1.2                  0         0       120   00:00:16
+    Distance: (default is 120)
+
+    admin@example:/> show ip rip neighbor
+
+    ADDRESS          BAD-PACKETS    BAD-ROUTES
+    10.0.1.2         0              0
+
+    admin@example:/>
+
+For more detailed troubleshooting, RIP debug logging can be enabled to
+capture specific protocol events. Debug messages are written to the
+routing log file (`/var/log/routing`).
+
+> [!CAUTION]
+> Debug logging significantly increases log output and may impact
+> performance. Only enable debug categories needed for troubleshooting,
+> and disable them when done.
+
+To enable specific RIP debug categories:
+
+    admin@example:/> configure
+    admin@example:/config/> edit routing control-plane-protocol ripv2 name default rip debug
+    admin@example:/config/routing/…/rip/debug/> set events true
+    admin@example:/config/routing/…/rip/debug/> set packet true
+    admin@example:/config/routing/…/rip/debug/> leave
+    admin@example:/>
+
+Available debug categories include:
+
+- `events`: RIP events (sending/receiving packets, timers, interface changes)
+- `packet`: Detailed packet debugging (packet dumps with origin and port)
+- `kernel`: Kernel routing table updates (route add/delete, interface updates)
+
+All debug options are disabled by default. Refer to the `infix-routing`
+YANG model for the complete list of available debug options.
+
+To view current debug settings:
+
+    admin@example:/> show running-config routing control-plane-protocol
+
+To disable all debug logging, simply delete the debug settings or set
+all options back to `false`:
+
+    admin@example:/> configure
+    admin@example:/config/> delete routing control-plane-protocol ripv2 name default rip debug
+    admin@example:/config/> leave
+    admin@example:/>
+
 
 ### View routing table
 

doc/support.md

@@ -0,0 +1,91 @@
+# Support Data Collection
+
+When troubleshooting issues or seeking support, the `support` command
+provides a convenient way to collect comprehensive system diagnostics.
+This command gathers configuration files, logs, network state, and other
+system information into a single compressed archive.
+
+## Collecting Support Data
+
+To collect support data and save it to a file:
+
+```bash
+admin@host:~$ support collect > support-data.tar.gz
+(admin@host) Password: ***********
+Starting support data collection from host...
+This may take up to a minute. Please wait...
+Tailing /var/log/messages for 30 seconds (please wait)...
+Log tail complete.
+Collection complete. Creating archive...
+admin@host:~$ ls -l support-data.tar.gz
+-rw-rw-r-- 1 admin admin 508362 nov 30 13:05 support-data.tar.gz
+```
+
+The command can also be run remotely via SSH from your workstation:
+
+```bash
+$ ssh admin@host support collect > support-data.tar.gz
+...
+```
+
+The collection process may take up to a minute depending on system load
+and the amount of logging data. Progress messages are shown during the
+collection process.
+
+## Encrypted Collection
+
+For secure transmission of support data, the archive can be encrypted
+with GPG using a password:
+
+```bash
+admin@host:~$ support collect -p mypassword > support-data.tar.gz.gpg
+Starting support data collection from host...
+This may take up to a minute. Please wait...
+...
+Collection complete. Creating archive...
+Encrypting with GPG...
+```
+
+The `support collect` command even supports omitting `mypassword` and
+will then prompt interactively for the password.  This works over SSH too,
+but the local ssh client may then echo the password.
+
+> [!TIP]
+> To hide the encryption password for an SSH session, the script supports
+> reading from stdin:  
+> `echo "$MYSECRET" | ssh user@device support collect -p >
+> file.tar.gz.gpg`
+
+After transferring the resulting file to your workstation, decrypt it
+with the password:
+
+```bash
+$ gpg -d support-data.tar.gz.gpg > support-data.tar.gz
+$ tar xzf support-data.tar.gz
+...
+```
+
+or
+
+```bash
+$ gpg -d support-data.tar.gz.gpg | tar xz
+...
+```
+
+> [!IMPORTANT]
+> Make sure to share `mypassword` out-of-band from the encrypted data
+> with the recipient of the data.  I.e., avoid sending both in the same
+> plain-text email for example.
+
+## What is Collected
+
+The support archive includes:
+
+- System identification (hostname, uptime, kernel version)
+- Running and operational configuration (sysrepo datastores)
+- System logs (`/var/log` directory and live tail of messages log)
+- Network configuration and state (interfaces, routes, neighbors, bridges)
+- FRRouting information (OSPF, BFD status)
+- Container information (podman containers and their configuration)
+- System resource usage (CPU, memory, disk, processes)
+- Hardware information (PCI, USB devices, network interfaces)

doc/system-tuning.md

@@ -0,0 +1,32 @@
+# System Tuning Guide
+
+## Memory
+
+Default memory tuning is defined in `/etc/sysctl.d/vm.conf`, optimized for embedded network devices with 512MB-4GB RAM.
+
+### For Systems with 4GB+ Memory
+
+Systems with more memory can afford to be less aggressive with cache reclaim.
+
+```conf
+# Allow more dirty pages before writeback
+vm.dirty_ratio=15
+vm.dirty_background_ratio=10
+
+# Less aggressive watermark (memory pressure less critical)
+vm.watermark_scale_factor=100
+```
+
+### For Systems with Heavy Filesystem Activity
+
+Unusual for network equipment, but may occur on systems with extensive logging or storage features.
+
+```conf
+# Allow more dirty pages for better write batching
+vm.dirty_ratio=20
+vm.dirty_background_ratio=10
+
+# Longer dirty page expiration for write coalescing
+vm.dirty_expire_centisecs=3000
+```
+

doc/system.md

@@ -323,94 +323,6 @@ reference ID, stratum, time offsets, frequency, and root delay.
 > The system uses `chronyd` Network Time Protocol (NTP) daemon.  The
 > output shown here is best explained in the [Chrony documentation][4].
 
-## Support Data Collection
-
-When troubleshooting issues or seeking support, the `support` command
-provides a convenient way to collect comprehensive system diagnostics.
-This command gathers configuration files, logs, network state, and other
-system information into a single compressed archive.
-
-### Collecting Support Data
-
-To collect support data and save it to a file:
-
-```bash
-admin@host:~$ support collect > support-data.tar.gz
-(admin@host) Password: ***********
-Starting support data collection from host...
-This may take up to a minute. Please wait...
-Tailing /var/log/messages for 30 seconds (please wait)...
-Log tail complete.
-Collection complete. Creating archive...
-admin@host:~$ ls -l support-data.tar.gz
--rw-rw-r-- 1 admin admin 508362 nov 30 13:05 support-data.tar.gz
-```
-
-The command can also be run remotely via SSH from your workstation:
-
-```bash
-$ ssh admin@host support collect > support-data.tar.gz
-...
-```
-
-The collection process may take up to a minute depending on system load
-and the amount of logging data. Progress messages are shown during the
-collection process.
-
-### Encrypted Collection
-
-For secure transmission of support data, the archive can be encrypted
-with GPG using a password:
-
-```bash
-admin@host:~$ support collect -p mypassword > support-data.tar.gz.gpg
-Starting support data collection from host...
-This may take up to a minute. Please wait...
-...
-Collection complete. Creating archive...
-Encrypting with GPG...
-```
-
-The `support collect` command even supports omitting `mypassword` and
-will then prompt interactively for the password.  This works over SSH too,
-but the local ssh client may then echo the password.
-
-> [!TIP]
-> To hide the encryption password for an SSH session, the script supports reading from stdin:  
-> `echo "$MYSECRET" | ssh user@device support collect -p > file.tar.gz.gpg`
-
-After transferring the resulting file to your workstation, decrypt it
-with the password:
-
-```bash
-$ gpg -d support-data.tar.gz.gpg > support-data.tar.gz
-$ tar xzf support-data.tar.gz
-```
-
-or
-
-```bash
-$ gpg -d support-data.tar.gz.gpg | tar xz
-```
-
-> [!IMPORTANT]
-> Make sure to share `mypassword` out-of-band from the encrypted data
-> with the recipient of the data.  I.e., avoid sending both in the same
-> plain-text email for example.
-
-### What is Collected
-
-The support archive includes:
-
- - System identification (hostname, uptime, kernel version)
- - Running and operational configuration (sysrepo datastores)
- - System logs (`/var/log` directory and live tail of messages log)
- - Network configuration and state (interfaces, routes, neighbors, bridges)
- - FRRouting information (OSPF, BFD status)
- - Container information (podman containers and their configuration)
- - System resource usage (CPU, memory, disk, processes)
- - Hardware information (PCI, USB devices, network interfaces)
-
 [1]: https://www.rfc-editor.org/rfc/rfc7317
 [2]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-system%402024-02-29.yang
 [3]: https://www.rfc-editor.org/rfc/rfc8341

external.mk

@@ -1,8 +1,6 @@
 include $(BR2_EXTERNAL_INFIX_PATH)/infix.mk
 include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/package/*/*.mk))
-include $(BR2_EXTERNAL_INFIX_PATH)/board/common/common.mk
 include $(BR2_EXTERNAL_INFIX_PATH)/board/board.mk
--include $(BR2_EXTERNAL_INFIX_PATH)/board/$(patsubst "%",%,$(BR2_ARCH))/board.mk
 include $(BR2_EXTERNAL_INFIX_PATH)/test/test.mk
 
 .PHONY: local.mk
@@ -10,15 +8,6 @@ local.mk:
 	@$(call IXMSG,"Installing local override for certain packages")
 	@(cd $O && ln -s $(BR2_EXTERNAL_INFIX_PATH)/local.mk .)
 
-.PHONY: run
-run:
-	@$(BINARIES_DIR)/qemu.sh
-
-.PHONY: run-menuconfig
-run-menuconfig: $(BUILD_DIR)/buildroot-config/mconf
-	CONFIG_="CONFIG_" BR2_CONFIG="$(BINARIES_DIR)/.config" \
-		$(BUILD_DIR)/buildroot-config/mconf $(BINARIES_DIR)/Config.in
-
 #
 # Buildroot package extensions
 #

infix.mk

@@ -8,5 +8,6 @@ INFIX_TOPDIR = $(if $(oem-dir),$(oem-dir),$(BR2_EXTERNAL_INFIX_PATH))
 # release is being built.
 export INFIX_BUILD_ID ?= $(shell git -C $(INFIX_TOPDIR) describe --dirty --always --tags)
 export INFIX_VERSION = $(if $(INFIX_RELEASE),$(INFIX_RELEASE),$(INFIX_BUILD_ID))
+export INFIX_ARTIFACT = $(call qstrip,$(INFIX_IMAGE_ID)$(if $(INFIX_RELEASE),-$(INFIX_RELEASE)))
 
 INFIX_CFLAGS:=-Wall -Werror -Wextra -Wno-unused-parameter -Wformat=2 -Wformat-overflow=2 -Winit-self -Wstrict-overflow=4 -Wno-format-truncation -Wno-format-nonliteral

mkdocs.yml

@@ -43,6 +43,7 @@ nav:
       - Hardware Info & Status: hardware.md
       - Management: management.md
       - Syslog Support: syslog.md
+      - Support Data: support.md
       - Upgrade: upgrade.md
   - Scripting:
       - Introduction: scripting.md
@@ -56,6 +57,7 @@ nav:
       - Developing with Buildroot: override-package.md
       - Netboot HowTo: netboot.md
       - Regression Testing: testing.md
+      - System Tuning Guide: system-tuning.md
       - Test System Architecture: test-arch.md
       - Virtual Environments: virtual.md
       - Vital Product Data (VPD): vpd.md

package/Config.in

@@ -29,9 +29,9 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/lowdown/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/mcd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/mdns-alias/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/netbrowse/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/onieprom/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/podman/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/python-libyang/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/python-statd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/python-yangdoc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/skeleton-init-finit/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/show/Config.in"

package/onieprom/Config.in

@@ -0,0 +1,15 @@
+menuconfig BR2_PACKAGE_ONIEPROM
+	bool "onieprom"
+	select BR2_PACKAGE_HOST_PYTHON3
+	help
+         ONIE EEPROM parser/generator
+
+config BR2_PACKAGE_ONIEPROM_INSTALL_IMAGES
+	bool "install onieprom in images"
+	depends on BR2_PACKAGE_ONIEPROM
+	default y
+	help
+         Install the onieprom script in the images direcory. Useful
+         when the release is destined for someone who will have to
+         create ONIE EEPROM binaries for deployment during
+         manufacturing.

package/onieprom/onieprom

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+PYTHONPATH=$(readlink -f $(dirname $0)/..) \
+   exec python3 -m onieprom "$@"

package/onieprom/onieprom.mk

@@ -0,0 +1,15 @@
+ONIEPROM_VERSION = 1.0
+ONIEPROM_SITE_METHOD = local
+ONIEPROM_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/onieprom
+ONIEPROM_LICENSE = GPLv2
+ONIEPROM_LICENSE_FILES = COPYING
+ONIEPROM_DEPENDENCIES = host-python3 python3 host-python-poetry-core
+ONIEPROM_SETUP_TYPE = pep517 # poetry
+ONIEPROM_INSTALL_IMAGES = $(if $(BR2_PACKAGE_ONIEPROM_INSTALL_IMAGES),YES,NO)
+
+define ONIEPROM_INSTALL_IMAGES_CMDS
+	@cp -a $(@D)/onieprom $(BINARIES_DIR)/onieprom
+	@cp $(ONIEPROM_PKGDIR)/onieprom $(BINARIES_DIR)/onieprom/
+endef
+
+$(eval $(python-package))

package/python-statd/Config.in

@@ -1,6 +0,0 @@
-config BR2_PACKAGE_PYTHON_STATD
-	bool "python-statd"
-	select BR2_PACKAGE_HOST_PYTHON3
-	select BR2_PACKAGE_DBUS_PYTHON
-	help
-         Python helpers for statd.

package/python-statd/python-statd.hash

@@ -1 +0,0 @@
-sha256  360336cbf0f228b12b7ca0996b33e442d97f496edcf2ec31b655e63631e7f96f  LICENSE

package/python-statd/python-statd.mk

@@ -1,16 +0,0 @@
-PYTHON_STATD_VERSION = 1.0
-PYTHON_STATD_SITE_METHOD = local
-PYTHON_STATD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/statd/python
-PYTHON_STATD_LICENSE = BSD-3-Clause
-PYTHON_STATD_LICENSE_FILES = LICENSE
-PYTHON_STATD_DEPENDENCIES = host-python3 python3 host-python-poetry-core dbus-python
-PYTHON_STATD_SETUP_TYPE = pep517 # poetry
-
-define PYTHON_STATD_MOVE_BINARIES
-	mkdir -p $(TARGET_DIR)/usr/libexec/statd
-	mv $(TARGET_DIR)/usr/bin/yanger $(TARGET_DIR)/usr/libexec/statd/
-	mv $(TARGET_DIR)/usr/bin/cli-pretty $(TARGET_DIR)/usr/libexec/statd/
-	mv $(TARGET_DIR)/usr/bin/ospf-status $(TARGET_DIR)/usr/libexec/statd/
-endef
-PYTHON_STATD_POST_INSTALL_TARGET_HOOKS += PYTHON_STATD_MOVE_BINARIES
- $(eval $(python-package))

package/skeleton-init-finit/skeleton/etc/default/ripd

@@ -0,0 +1,2 @@
+# --log-level debug
+RIPD_ARGS="-A 127.0.0.1 -u frr -g frr -f /etc/frr/ripd.conf --log syslog"

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/ripd.conf

@@ -1 +1,2 @@
-service [2345] log:null <pid/zebra> ripd -A 127.0.0.1 -u frr -g frr -- RIP daemon
+service <pid/zebra> env:-/etc/default/ripd \
+	[2345] ripd $RIPD_ARGS -- RIP daemon

package/statd/Config.in

@@ -5,7 +5,8 @@ config BR2_PACKAGE_STATD
 	select BR2_PACKAGE_SYSREPO
 	select BR2_PACKAGE_LIBSRX
 	select BR2_PACKAGE_LIBITE
-	select BR2_PACKAGE_PYTHON_STATD
+	select BR2_PACKAGE_HOST_PYTHON3
+	select BR2_PACKAGE_DBUS_PYTHON
 	help
 	  Operational Status Daemon. Responsible for handling sysrepo
 	  operational run-time info. Such as interface state and address.

package/statd/statd.mk

@@ -10,7 +10,9 @@ STATD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/statd
 STATD_LICENSE = BSD-3-Clause
 STATD_LICENSE_FILES = LICENSE
 STATD_REDISTRIBUTE = NO
-STATD_DEPENDENCIES = sysrepo libev libsrx jansson python-statd libyang libite
+STATD_DEPENDENCIES = sysrepo libev libsrx jansson libyang libite \
+	host-python3 python3 host-python-pypa-build host-python-installer \
+	host-python-poetry-core dbus-python
 STATD_AUTORECONF = YES
 
 define STATD_CONF_ENV
@@ -25,6 +27,22 @@ else
 STATD_CONF_OPTS += --disable-containers
 endif
 
+define STATD_BUILD_PYTHON
+	cd $(STATD_SITE)/python && \
+		$(PKG_PYTHON_PEP517_ENV) $(HOST_DIR)/bin/python3 $(PKG_PYTHON_PEP517_BUILD_CMD) -o $(@D)/python/dist
+	mkdir -p $(TARGET_DIR)/usr/libexec/statd
+	cd $(@D)/python && \
+		$(HOST_DIR)/bin/python3 $(TOPDIR)/support/scripts/pyinstaller.py \
+			dist/*.whl \
+			--interpreter=/usr/bin/python3 \
+			--script-kind=posix \
+			--purelib=$(TARGET_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages \
+			--headers=$(TARGET_DIR)/usr/include/python$(PYTHON3_VERSION_MAJOR) \
+			--scripts=$(TARGET_DIR)/usr/libexec/statd \
+			--data=$(TARGET_DIR)
+endef
+STATD_POST_INSTALL_TARGET_HOOKS += STATD_BUILD_PYTHON
+
 define STATD_INSTALL_EXTRA
 	cp $(STATD_PKGDIR)/statd.conf  $(FINIT_D)/available/
 	ln -sf ../available/statd.conf $(FINIT_D)/enabled/statd.conf

patches/linux/6.12.61/0001-FIX-net-dsa-mv88e6xxx-Fix-timeout-on-waiting-for-PPU.patch

@@ -1,4 +1,4 @@
-From 83cd7a46ae0346e1cbf2872ff251e9c72bf5dc7f Mon Sep 17 00:00:00 2001
+From 8c982a391f0b2e21e25552d7daa592b12368c76b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 01/30] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for

patches/linux/6.12.61/0002-net-dsa-mv88e6xxx-Improve-indirect-register-access-p.patch

@@ -1,4 +1,4 @@
-From b9e507bb66c93910a1ee2576b6073e807d0dee2e Mon Sep 17 00:00:00 2001
+From dad4553127023de69d13565a34a8f32c14013da6 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 02/30] net: dsa: mv88e6xxx: Improve indirect register access

patches/linux/6.12.61/0003-net-dsa-mv88e6xxx-Honor-ports-being-managed-via-in-b.patch

@@ -1,4 +1,4 @@
-From a08a351c076eb52d49caa8e73335fe9b402bd460 Mon Sep 17 00:00:00 2001
+From a0829c84c0eb2e4bc4758ef5e2be5d267fa7626e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 03/30] net: dsa: mv88e6xxx: Honor ports being managed via

patches/linux/6.12.61/0004-net-dsa-mv88e6xxx-Limit-rsvd2cpu-policy-to-user-port.patch

@@ -1,4 +1,4 @@
-From 5250f7348511e6f8e6b0cd30581968fc8ea0e9af Mon Sep 17 00:00:00 2001
+From e32883eed619bc3eab8ad848c085fc29bafaf83a Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 04/30] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user

patches/linux/6.12.61/0005-net-dsa-mv88e6xxx-Add-LED-infrastructure.patch

@@ -1,4 +1,4 @@
-From 8fb81be5838aacbfb32f2c947826a8917a14f673 Mon Sep 17 00:00:00 2001
+From 764be1a05c3411b8e369d089d4302f7b670602e8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 19:44:32 +0100
 Subject: [PATCH 05/30] net: dsa: mv88e6xxx: Add LED infrastructure

patches/linux/6.12.61/0006-net-dsa-mv88e6xxx-Add-LED-support-for-6393X.patch

@@ -1,4 +1,4 @@
-From 66ba1069835332449dd3783a65335c9133e47843 Mon Sep 17 00:00:00 2001
+From 4f0d8d9b78a77b54c105924baa2cafd39975b441 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 21:59:35 +0100
 Subject: [PATCH 06/30] net: dsa: mv88e6xxx: Add LED support for 6393X

patches/linux/6.12.61/0007-net-dsa-tag_dsa-Use-tag-priority-as-initial-skb-prio.patch

@@ -1,4 +1,4 @@
-From 4238e29e3da648643ee0ad39e2b240710c8a38f3 Mon Sep 17 00:00:00 2001
+From 31a489323cebfad92eff259ecff8ce310293014c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 07/30] net: dsa: tag_dsa: Use tag priority as initial

patches/linux/6.12.61/0008-net-dsa-Support-MDB-memberships-whose-L2-addresses-o.patch

@@ -1,4 +1,4 @@
-From fc24a53ab2703e39b375e9db1a6c4db25829d4fe Mon Sep 17 00:00:00 2001
+From b211cdae4873a2c62620db6860e05d52550755e7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 08/30] net: dsa: Support MDB memberships whose L2 addresses

patches/linux/6.12.61/0009-net-dsa-Support-EtherType-based-priority-overrides.patch

@@ -1,4 +1,4 @@
-From a259544cacf9b42ead2dfee701de868c64ed81fd Mon Sep 17 00:00:00 2001
+From 83383696c1fe9c37117efbcee7d4f4721aac2638 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 09/30] net: dsa: Support EtherType based priority overrides

patches/linux/6.12.61/0010-net-dsa-mv88e6xxx-Support-EtherType-based-priority-o.patch

@@ -1,4 +1,4 @@
-From ee4ba2578a895c45c694a6452493effde153ae49 Mon Sep 17 00:00:00 2001
+From 09581c0d64996b39baa728613b59960427d79316 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 10/30] net: dsa: mv88e6xxx: Support EtherType based priority

patches/linux/6.12.61/0011-net-dsa-mv88e6xxx-Add-mqprio-qdisc-support.patch

@@ -1,4 +1,4 @@
-From 072f8e821cb51fa26b71e7c24ecce44e64b48dec Mon Sep 17 00:00:00 2001
+From 0e335e786f2d7308d99bf2b7e22994ded3eea444 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 11/30] net: dsa: mv88e6xxx: Add mqprio qdisc support

patches/linux/6.12.61/0012-net-dsa-mv88e6xxx-Use-VLAN-prio-over-IP-when-both-ar.patch

@@ -1,4 +1,4 @@
-From e4d64051709df94a47af188bf93b6318d0c4d792 Mon Sep 17 00:00:00 2001
+From 402c582ea987df39ed467952cc104ae7cfbf5a92 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 12/30] net: dsa: mv88e6xxx: Use VLAN prio over IP when both

patches/linux/6.12.61/0013-FIX-net-dsa-mv88e6xxx-Trap-locally-terminated-VLANs.patch

@@ -1,4 +1,4 @@
-From 8db8ad9ac3c0677004baeeae045bc028cf7f88ea Mon Sep 17 00:00:00 2001
+From d12f21e3545b86390ebf45ba133092917e07949d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 13/30] [FIX] net: dsa: mv88e6xxx: Trap locally terminated

patches/linux/6.12.61/0014-net-phy-marvell10g-Support-firmware-loading-on-88X33.patch

@@ -1,4 +1,4 @@
-From 66dd1a6bfd3d73ecb02e3c4607a1ac57f40feb4c Mon Sep 17 00:00:00 2001
+From c40fcdcf31abafc742d17efac25f02e730332b5a Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 14/30] net: phy: marvell10g: Support firmware loading on

patches/linux/6.12.61/0015-net-phy-marvell10g-Fix-power-up-when-strapped-to-sta.patch

@@ -1,4 +1,4 @@
-From 940b131a27b10ea8b6fef431aa51621acc496ffc Mon Sep 17 00:00:00 2001
+From f0d3d8ff5eaee0ff1ea6af33f4233fa457e37ba8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 15/30] net: phy: marvell10g: Fix power-up when strapped to

patches/linux/6.12.61/0016-net-phy-marvell10g-Add-LED-support-for-88X3310.patch

@@ -1,4 +1,4 @@
-From 61043fb8e9510cd5a753a9cfc06087c037a412e6 Mon Sep 17 00:00:00 2001
+From 4a16bff8847a34016af92186fbdb85ea2b8688b3 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 16/30] net: phy: marvell10g: Add LED support for 88X3310