Initial plan

Merge pull request #1374 from kernelkit/logit
Silence libyang warnings leaking to console
2026-07-27 03:03:02 +02:00 · 2026-01-29 20:01:17 +00:00 · 2026-01-28 11:22:28 +01:00 · 2026-01-28 09:50:17 +01:00 · 2026-01-27 14:33:14 +01:00 · 2026-01-27 11:09:54 +01:00
592 changed files with 44087 additions and 9259 deletions
@@ -12,10 +12,6 @@ on:
          - bananapi-bpi-r3
          - friendlyarm-nanopi-r2s
        default: 'raspberrypi-rpi64'
-      use_latest_release:
-        description: 'Use latest release artifacts instead of workflow artifacts'
-        type: boolean
-        default: false

 jobs:
  create-image:
@@ -54,19 +50,19 @@ jobs:
        run: |
          case "${{ inputs.board }}" in
            raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=false" >> $GITHUB_ENV
              ;;
            bananapi-bpi-r3)
-              echo "BOOTLOADER_SD=bpi_r3_sd_boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi_r3_emmc_boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER_SD=bpi-r3-sd-boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi-r3-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=true" >> $GITHUB_ENV
              ;;
            friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
-              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=false" >> $GITHUB_ENV
              ;;
            *)
@@ -74,7 +70,7 @@ jobs:
              exit 1
              ;;
          esac
-          echo "Target: $TARGET for board: ${{ inputs.board }}"
+          echo "Arch: $ARCH for board: ${{ inputs.board }}"
          if [ "$BUILD_EMMC" = "true" ]; then
            echo "Building both SD and eMMC images"
            echo "SD Bootloader: $BOOTLOADER_SD"
@@ -85,16 +81,12 @@ jobs:
          fi

      - name: Download bootloader artifacts
-        if: ${{ !inputs.use_latest_release }}
        run: |
-          # Download from latest bootloader build workflow on main branch
-          gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
-          BOOT_RUN_ID=$(cat latest_boot_run_id)
-
+          # Download bootloader from latest-boot release tag
          if [ "$BUILD_EMMC" = "true" ]; then
            # Download both SD and eMMC bootloaders for boards that support both
            echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
-            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_SD} --dir temp_bootloader_sd/
+            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
            mkdir -p output_sd/images
            cd temp_bootloader_sd/
            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -102,7 +94,7 @@ jobs:
            rm -rf temp_bootloader_sd/

            echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
-            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_EMMC} --dir temp_bootloader_emmc/
+            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
            mkdir -p output_emmc/images
            cd temp_bootloader_emmc/
            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
@@ -115,7 +107,7 @@ jobs:
            ls -la output_emmc/images/
          else
            # Single bootloader for boards that only support SD
-            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
+            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/

            # Extract bootloader directly to output/images
            cd temp_bootloader/
@@ -130,7 +122,6 @@ jobs:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Infix artifacts
-        if: ${{ !inputs.use_latest_release }}
        run: |
          # Download from latest Kernelkit Trigger workflow for main branch
          gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
@@ -138,7 +129,7 @@ jobs:

          if [ "$BUILD_EMMC" = "true" ]; then
            # Copy Infix artifacts to both SD and eMMC output directories
-            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/

            cd temp_infix/
            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -152,7 +143,7 @@ jobs:
            ls -la output_emmc/images/
          else
            # Single output directory for SD-only boards
-            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/

            # Extract Infix directly to output/images
            cd temp_infix/
@@ -166,58 +157,6 @@ jobs:
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

-      - name: Download from latest releases
-        if: ${{ inputs.use_latest_release }}
-        run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            # Download both SD and eMMC bootloaders
-            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
-            mkdir -p output_sd/images
-            cd temp_bootloader_sd/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-            cd ../
-            rm -rf temp_bootloader_sd/
-
-            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
-            mkdir -p output_emmc/images
-            cd temp_bootloader_emmc/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-            cd ../
-            rm -rf temp_bootloader_emmc/
-
-            # Download Infix once and extract to both directories
-            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
-            cd temp_infix/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-            cd ../
-            rm -rf temp_infix/
-
-            echo "SD files extracted to output_sd/images:"
-            ls -la output_sd/images/
-            echo "eMMC files extracted to output_emmc/images:"
-            ls -la output_emmc/images/
-          else
-            # Download latest bootloader release
-            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
-            cd temp_bootloader/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-            cd ../
-            rm -rf temp_bootloader/
-
-            # Download latest Infix release
-            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
-            cd temp_infix/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-            cd ../
-            rm -rf temp_infix/
-
-            echo "All files extracted to output/images:"
-            ls -la output/images/
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
      - name: Verify extracted files
        run: |
          if [ "$BUILD_EMMC" = "true" ]; then
@@ -249,7 +188,7 @@ jobs:
            export BR2_EXTERNAL_INFIX_PATH=$PWD
            export RELEASE=""
            export INFIX_ID="infix"
-            ./utils/mkimage.sh ${{ inputs.board }}
+            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
          fi

      - name: Create eMMC image
@@ -347,10 +286,11 @@ jobs:
          # SD Card & eMMC Image Build Complete! 🚀

          **Board:** ${{ inputs.board }}
-          **Target:** ${{ env.TARGET }}
+          **Arch:** ${{ env.ARCH }}
          **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
          **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
-          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
+          **Bootloader Source:** latest-boot release
+          **Infix Source:** Latest workflow run on main

          ## Created Images
          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
@@ -363,9 +303,10 @@ jobs:
          # SD Card Image Build Complete! 🚀

          **Board:** ${{ inputs.board }}
-          **Target:** ${{ env.TARGET }}
+          **Arch:** ${{ env.ARCH }}
          **Bootloader:** ${{ env.BOOTLOADER }}
-          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
+          **Bootloader Source:** latest-boot release
+          **Infix Source:** Latest workflow run on main

          ## Created Images
          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
@@ -1,4 +1,4 @@
-name: Check Kernel 6.12 Release
+name: Check Kernel 6.18 Release

 on:
  schedule:
@@ -17,12 +17,12 @@ jobs:
          fetch-depth: 0
          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}

-      - name: Fetch kernel.org and check for 6.12 release
+      - name: Fetch kernel.org and check for 6.18 release
        id: check
        run: |
          set -e -o pipefail
-          # Fetch the kernel.org frontpage and extract 6.12 version
-          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)
+          # Fetch the kernel.org frontpage and extract 6.18 version
+          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.18\.\d+' | head -n1)

          if [ -z "$CURRENT_VERSION" ]; then
            echo "Failed to fetch kernel version"
@@ -30,7 +30,7 @@ jobs:
          fi

          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          echo "Current 6.12 kernel version: $CURRENT_VERSION"
+          echo "Current 6.18 kernel version: $CURRENT_VERSION"

          # Get the version from infix defconfig
          INFIX_VERSION=$(grep 'BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=' configs/aarch64_defconfig | cut -d'"' -f2)
@@ -47,7 +47,7 @@ jobs:
              echo "PR already exists for kernel $CURRENT_VERSION, skipping"
            else
              echo "new_release=true" >> $GITHUB_OUTPUT
-              echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
+              echo "🎉 New 6.18 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
            fi
          else
            echo "new_release=false" >> $GITHUB_OUTPUT
@@ -99,7 +99,7 @@ jobs:
          BRANCH_NAME: ${{ steps.branch.outputs.name }}
        run: |
          set -e -o pipefail
-          ./utils/kernel-upgrade.sh linux "$BRANCH_NAME"
+          ./utils/kernel-upgrade.sh linux 6.18 "$BRANCH_NAME"

      - name: Create pull request
        if: steps.check.outputs.new_release == 'true'
@@ -104,11 +104,7 @@ jobs:

      - name: Extract ChangeLog entry ...
        run: |
-          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
-              |head -n -1 > release.md
-          echo "" >> release.md
-          echo "> [!TIP]" >> release.md
-          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
+          cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
          cat release.md

      - uses: ncipollo/release-action@v1
@@ -1,5 +1,7 @@
 *~
+.claude
 .gdb_history
+.claude
 /.backup
 /.ccache
 /dl
@@ -9,3 +11,4 @@
 /test/.log
 /local.mk
 /test/spec/Readme.adoc
+
@@ -16,10 +16,12 @@ if something goes wrong.  Deploy once, trust forever.

 **🤝 Friendly**  
 Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit `?` or TAB for
-context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
-[comprehensive documentation][4] mean you're never stuck.  Whether
-you're learning networking or managing enterprise infrastructure.
+with built-in help for every command — just hit <kbd>?</kbd> or
+<kbd>TAB</kbd> for context-aware assistance.
+
+Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
+mean you're never stuck.  Whether you're learning networking or managing
+enterprise infrastructure.

 **🛡️ Secure**  
 Built with security as a foundation, not an afterthought.  Minimal
@@ -53,27 +55,24 @@ your device, your rules.
   Consistent tooling from development to production deployment.  
   How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!

-## See It In Action
+## Quick Example

 Configure an interface in seconds - the CLI guides you with built-in help:

-<details><summary><b>Click Here for an example CLI Session</b></summary>
-
-```bash
-admin@infix-12-34-56:/> configure
-admin@infix-12-34-56:/config/> edit interface eth0
-admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
-      address     autoconf bind-ni-name      enabled
-      forwarding  mtu      neighbor
-admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
-admin@infix-12-34-56:/config/interface/eth0/> show
+<pre><code>admin@infix-12-34-56:/> <b>configure</b>
+admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
+admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4</b> <kbd>TAB</kbd>
+      address     autoconf      bind-ni-name     dhcp 
+      enabled     forwarding    mtu              neighbor
+admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4 address 192.168.2.200 prefix-length 24</b>
+admin@infix-12-34-56:/config/interface/eth0/> <b>show</b>
 type ethernet;
 ipv4 {
  address 192.168.2.200 {
    prefix-length 24;
  }
 }
-admin@infix-12-34-56:/config/interface/eth0/> diff
+admin@infix-12-34-56:/config/interface/eth0/> <b>diff</b>
 interfaces {
  interface eth0 {
 +    ipv4 {
@@ -83,25 +82,23 @@ interfaces {
 +    }
  }
 }
-admin@infix-12-34-56:/config/interface/eth0/> leave
-admin@infix-12-34-56:/> show interfaces
-INTERFACE       PROTOCOL   STATE       DATA
+admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
+admin@infix-12-34-56:/> <b>show interfaces</b>
+<u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
 eth0            ethernet   UP          52:54:00:12:34:56
                ipv4                   192.168.2.200/24 (static)
                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                ipv4                   127.0.0.1/8 (static)
                ipv6                   ::1/128 (static)
-admin@infix-12-34-56:/> copy running-config startup-config
-```
+admin@infix-12-34-56:/> <b>copy running startup</b>
+</code></pre>

-Notice how TAB completion shows available options, `show` displays
-current config, and `diff` shows exactly what changed before you
-commit your changes with the `leave` command.
+Notice how <kbd>TAB</kbd> completion shows available options, `show`
+displays current config, and `diff` shows exactly what changed before
+you commit your changes with the `leave` command.

-</details>
-
-> [Full CLI documentation →][3]
+For more information, see [CLI documentation][3].

 ## Get Started

@@ -111,7 +108,7 @@ containers for any custom functionality you need.

 ### Supported Platforms

- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
+- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
 - **Banana Pi-R3** - Your next home router and gateway
 - **NanoPi R2S** - Compact dual-port router in a tiny package
 - **x86_64** - Run in VMs or on mini PCs for development and testing
@@ -0,0 +1,18 @@
+Board Support
+=============
+
+The board support for an architecture always starts with Qemu support,
+this is what each `linux_defconfig` at the very least sets up.  Then
+each `$BR2_ARCH` has additional BSPs, e.g., Banana Pi BPI-R3.
+
+The `board/` directory is matched with the `configs/*_defconfigs` and
+the only execption is `board/common/`, which holds all shared files for
+Infix builds.
+
+Each `board/$BR2_ARCH/` can then have vendor/product sub-directories
+for the BSPs which may contain "fixups" to the base kernel config and
+any additional device tree files that should be included as well.
+
+To rebuild a board-specific package, e.g. NanoPi R2S:
+
+    make friendlyarm-nanopi-r2s-rebuild all
@@ -31,14 +31,11 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
-CONFIG_KEXEC=y
 CONFIG_ARCH_MULTI_V6=y
-CONFIG_ARCH_MULTI_V7=y
 CONFIG_ARCH_VIRT=y
 CONFIG_ARCH_BCM=y
 CONFIG_ARCH_BCM2835=y
 CONFIG_SMP=y
-CONFIG_NR_CPUS=4
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
@@ -47,7 +44,6 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPUFREQ_DT=y
 CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
-CONFIG_AEABI=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -78,7 +74,6 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -94,12 +89,31 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -108,15 +122,22 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -133,29 +154,58 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_IPMAC=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_MATCH_SRH=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_RAW=m
-CONFIG_IP6_NF_NAT=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -194,16 +244,16 @@ CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_PKTGEN=y
-# CONFIG_WIRELESS is not set
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
-CONFIG_PCI_AARDVARK=y
 CONFIG_PCI_HOST_GENERIC=y
-CONFIG_PCIE_ARMADA_8K=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -221,7 +271,6 @@ CONFIG_BLK_DEV_NVME=y
 CONFIG_SRAM=y
 CONFIG_EEPROM_AT24=y
 # CONFIG_SCSI_PROC_FS is not set
-CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_SAS_LIBSAS=y
 CONFIG_SCSI_SAS_ATA=y
@@ -230,7 +279,6 @@ CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
-CONFIG_AHCI_MVEBU=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
@@ -258,8 +306,6 @@ CONFIG_SMSC911X=y
 CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
 CONFIG_USB_NET_SMSC95XX=y
-CONFIG_BRCMFMAC=m
-CONFIG_ZD1211RW=m
 CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
 CONFIG_INPUT_TOUCHSCREEN=y
@@ -273,22 +319,19 @@ CONFIG_SERIAL_8250_BCM2835AUX=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
-CONFIG_TTY_PRINTK=y
-CONFIG_HVC_DRIVER=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
 CONFIG_SPI_BCM2835=y
 CONFIG_SPI_BCM2835AUX=y
-CONFIG_GPIO_SYSFS=y
 CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
 CONFIG_BCM2711_THERMAL=y
 CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
-CONFIG_BCM2835_WDT=y
 CONFIG_I6300ESB_WDT=y
+CONFIG_BCM2835_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -296,12 +339,12 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
 CONFIG_DRM=y
 CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_SIMPLEDRM=y
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_TOSHIBA_TC358762=m
 CONFIG_DRM_V3D=m
 CONFIG_DRM_VC4=m
 CONFIG_DRM_VC4_HDMI_CEC=y
-CONFIG_DRM_SIMPLEDRM=y
 CONFIG_FB=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_SOUND=y
@@ -310,6 +353,7 @@ CONFIG_SND_SOC=y
 CONFIG_SND_BCM2835_SOC_I2S=y
 CONFIG_HID_GENERIC=m
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC2=y
@@ -343,7 +387,6 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_STAGING=y
 CONFIG_SND_BCM2835=m
-CONFIG_VIDEO_BCM2835=m
 CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
@@ -352,8 +395,6 @@ CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FANOTIFY=y
@@ -376,8 +417,6 @@ CONFIG_NLS_ISO8859_1=y
 CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_CCM=y
 CONFIG_CRYPTO_GCM=y
-# CONFIG_XZ_DEC_ARM is not set
-# CONFIG_XZ_DEC_ARMTHUMB is not set
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
@@ -387,9 +426,13 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_DETECT_HUNG_TASK=y
-# CONFIG_SCHED_DEBUG is not set
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_WQ_WATCHDOG=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
+CONFIG_TEST_LOCKUP=m
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
-# CONFIG_STRICT_DEVMEM is not set
 CONFIG_MEMTEST=y
@@ -41,14 +41,31 @@
        "ietf-ip:ipv4": {
          "infix-dhcp-client:dhcp": {
            "option": [
-              {"id": "netmask"},
-              {"id": "broadcast"},
-              {"id": "router"},
-              {"id": "domain"},
-              {"id": "hostname"},
-              {"id": "dns-server"},
-              {"id": "ntp-server"},
-              {"id": "vendor-class", "value": "Raspberry Pi 2 Model B"}
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Raspberry Pi 2 Model B"
+              }
            ]
          }
        }
@@ -71,6 +88,9 @@
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -78,6 +98,14 @@
          "user-name": [
            "admin"
          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
        }
      ]
    },
@@ -97,6 +125,37 @@
          }
        ]
      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
      {
        "name": "default-deny-all",
        "group": [
@@ -104,11 +163,25 @@
        ],
        "rule": [
          {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
          }
        ]
      }
@@ -122,7 +195,11 @@
            "name": "default-ssh",
            "ssh": {
              "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
              },
              "ssh-server-parameters": {
                "server-identity": {
@@ -168,7 +245,7 @@
    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
  },
  "infix-meta:meta": {
-    "version": "1.6"
+    "version": "1.7"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -6,7 +6,7 @@ define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_GPIO,y)
 	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
@@ -17,7 +17,25 @@
        "state": {
          "admin-state": "unlocked"
        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+	  "band": "2.4GHz",
+	  "channel": "auto"
+	 }
+     },
+     {
+	"name": "radio1",
+	"class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+          "band": "5GHz",
+          "channel": "auto"
      }
+    }
    ]
  },
  "ietf-interfaces:interfaces": {
@@ -99,58 +117,118 @@
      {
        "name": "wan",
        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
        "ietf-ip:ipv4": {
          "infix-dhcp-client:dhcp": {
            "option": [
-              {"id": "ntp-server"},
-              {"id": "broadcast"},
-              {"id": "domain"},
-              {"id": "hostname"},
-              {"id": "dns-server"},
-              {"id": "router"},
-              {"id": "netmask"},
-              {"id": "vendor-class", "value": "Banana Pi BPI-R3"}
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R3"
+              }
            ]
          }
        },
        "ietf-ip:ipv6": {
          "infix-dhcpv6-client:dhcp": {
            "option": [
-              {"id": "ntp-server"},
-              {"id": "client-fqdn"},
-              {"id": "domain-search"},
-              {"id": "dns-server"}
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
            ]
          }
        }
      },
      {
-        "name": "wifi0",
-        "type": "infix-if-type:wifi"
+        "name": "wifi0-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+	"infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
      },
      {
-        "name": "wifi1",
-        "type": "infix-if-type:wifi"
+        "name": "wifi1-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio1",
+          "access-point": {
+            "ssid": "Infix5Ghz",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+       "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
      }
    ]
  },
  "ietf-keystore:keystore": {
-        "asymmetric-keys": {
-            "asymmetric-key": [
-                {
-                    "name": "genkey",
-                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
-                    "public-key": "",
-                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
-                    "cleartext-private-key": "",
-                    "certificates": {}
-                }
-            ]
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
        }
+      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "infix-keystore:symmetric-key": "infixinfix",
+          "infix-keystore:key-format": "infix-crypto-types:wifi-preshared-key-format"
+        }
+      ]
+    }
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -158,6 +236,14 @@
          "user-name": [
            "admin"
          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
        }
      ]
    },
@@ -177,6 +263,37 @@
          }
        ]
      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
      {
        "name": "default-deny-all",
        "group": [
@@ -184,11 +301,25 @@
        ],
        "rule": [
          {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
          }
        ]
      }
@@ -202,7 +333,11 @@
            "name": "default-ssh",
            "ssh": {
              "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
              },
              "ssh-server-parameters": {
                "server-identity": {
@@ -294,7 +429,7 @@
    "policy": [
      {
        "name": "lan-to-wan",
-	"action": "accept",
+        "action": "accept",
        "ingress": [
          "lan"
        ],
@@ -306,7 +441,7 @@
    ]
  },
  "infix-meta:meta": {
-    "version": "1.6"
+    "version": "1.7"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -342,4 +477,3 @@
    }
  }
 }
-
@@ -0,0 +1,11 @@
+{
+    "sfp1": {
+	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
+	"broken-autoneg": true
+    },
+    "sfp2": {
+	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
+	"broken-autoneg": true
+    }
+
+}
@@ -1,3 +1,4 @@
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/*/*.mk))

 .PHONY: board-enable-qemu-uboot
 board-enable-qemu-uboot:
@@ -19,13 +20,6 @@ board-enable-qemu-uboot:
 			'$$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config' \
 		--enable TARGET_UBOOT_FORMAT_DTB

-.PHONY: board-enable-sparx-fit
-board-enable-sparx-fit:
-	@$(call IXMSG,"Enabling SparX-5i compatible FIT options")
-	@BR2_PREFIX= ./utils/config --file $(BR2_CONFIG) \
-	 	--enable FIT_IMAGE \
-	 	--set-str FIT_KERNEL_LOAD_ADDR "0x7 0x00000000"
-
 .PHONY: board-sparx-flash-uboot
 board-sparx-flash-uboot: $(BINARIES_DIR)/u-boot.bin
 	@grep -q 'BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mscc_fireant_pcb135_emmc"' $(BR2_CONFIG) || \
@@ -4,6 +4,7 @@ config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
 	select SDCARD_AUX
 	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
+	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	help
 	  FriendlyElec NanoPi R2S is a compact router board based on
 	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.
@@ -4,6 +4,9 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
+	# TODO: for some reason this just locks up the device
+	#       so we'll have to rely on the softdog :-(
+	# $(call KCONFIG_ENABLE_OPT,CONFIG_DW_WATCHDOG)

 	# PHY drivers
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
@@ -51,6 +54,10 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)

+	# Input layer
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MISC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
+
 	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)
@@ -58,28 +58,52 @@
      {
        "name": "wan",
        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
        "ietf-ip:ipv4": {
          "infix-dhcp-client:dhcp": {
            "option": [
-              {"id": "ntp-server"},
-              {"id": "broadcast"},
-              {"id": "domain"},
-              {"id": "hostname"},
-              {"id": "dns-server"},
-              {"id": "router"},
-              {"id": "netmask"},
-              {"id": "vendor-class", "value": "NanoPi R2S"}
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "NanoPi R2S"
+              }
            ]
          }
        },
        "ietf-ip:ipv6": {
          "infix-dhcpv6-client:dhcp": {
            "option": [
-              {"id": "ntp-server"},
-              {"id": "client-fqdn"},
-              {"id": "domain-search"},
-              {"id": "dns-server"}
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
            ]
          }
        }
@@ -87,21 +111,24 @@
    ]
  },
  "ietf-keystore:keystore": {
-        "asymmetric-keys": {
-            "asymmetric-key": [
-                {
-                    "name": "genkey",
-                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
-                    "public-key": "",
-                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
-                    "cleartext-private-key": "",
-                    "certificates": {}
-                }
-            ]
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
        }
+      ]
+    }
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -109,6 +136,14 @@
          "user-name": [
            "admin"
          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
        }
      ]
    },
@@ -128,6 +163,37 @@
          }
        ]
      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
      {
        "name": "default-deny-all",
        "group": [
@@ -135,11 +201,25 @@
        ],
        "rule": [
          {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
          }
        ]
      }
@@ -153,7 +233,11 @@
            "name": "default-ssh",
            "ssh": {
              "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
              },
              "ssh-server-parameters": {
                "server-identity": {
@@ -245,7 +329,7 @@
    "policy": [
      {
        "name": "lan-to-wan",
-	"action": "accept",
+        "action": "accept",
        "ingress": [
          "lan"
        ],
@@ -257,7 +341,7 @@
    ]
  },
  "infix-meta:meta": {
-    "version": "1.6"
+    "version": "1.7"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -39,7 +39,6 @@ CONFIG_ARM64_ERRATUM_1286807=y
 CONFIG_ARM64_ERRATUM_1542419=y
 CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
-CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
 CONFIG_COMPAT=y
 # CONFIG_SUSPEND is not set
@@ -52,7 +51,6 @@ CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_ARMADA_8K_CPUFREQ=y
 CONFIG_ACPI=y
 CONFIG_KPROBES=y
-CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -79,7 +77,6 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -95,12 +92,31 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -109,15 +125,23 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
+CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -134,29 +158,69 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_IPMAC=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -244,6 +308,7 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
+CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -407,10 +472,10 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_GPIO_WATCHDOG=y
+CONFIG_ARM_SBSA_WATCHDOG=y
 CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_MAX77620=y
-CONFIG_MFD_SEC_CORE=y
 CONFIG_MFD_ROHM_BD718XX=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -419,7 +484,6 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_MAX77620=y
 CONFIG_REGULATOR_PCA9450=y
 CONFIG_REGULATOR_QCOM_SPMI=y
-CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_A4TECH is not set
 # CONFIG_HID_APPLE is not set
@@ -429,11 +493,11 @@ CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_CYPRESS is not set
 # CONFIG_HID_EZKEY is not set
 # CONFIG_HID_KENSINGTON is not set
-# CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
 CONFIG_USB_ULPI_BUS=y
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
@@ -451,7 +515,6 @@ CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
 CONFIG_USB_HSIC_USB3503=m
-CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_SNP_UDC_PLAT=y
@@ -485,7 +548,6 @@ CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
 CONFIG_RTC_DRV_PCF8523=y
-CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
 CONFIG_RTC_DRV_PL031=y
@@ -500,7 +562,6 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 # CONFIG_SURFACE_PLATFORMS is not set
 CONFIG_COMMON_CLK_CS2000_CP=y
-CONFIG_COMMON_CLK_S2MPS11=y
 CONFIG_COMMON_CLK_XGENE=y
 CONFIG_COMMON_CLK_BD718XX=y
 CONFIG_MAILBOX=y
@@ -517,7 +578,7 @@ CONFIG_PHY_SAMSUNG_USB2=y
 CONFIG_NVMEM_LAYOUT_ONIE_TLV=y
 CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -544,8 +605,6 @@ CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
-CONFIG_CRYPTO_SHA1_ARM64_CE=y
-CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
@@ -557,8 +616,13 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_DETECT_HUNG_TASK=y
-# CONFIG_SCHED_DEBUG is not set
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_WQ_WATCHDOG=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
+CONFIG_TEST_LOCKUP=m
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
 # CONFIG_STRICT_DEVMEM is not set
@@ -108,7 +108,7 @@ To configure WiFi as a client, first store your WiFi password in the keystore:
 admin@infix:/> configure
 admin@infix:/config/> edit keystore symmetric-key mywifi
 admin@infix:/config/keystore/…/mywifi/> set key-format wifi-preshared-key-format
-admin@infix:/config/keystore/…/mywifi/> set cleartext-key YourWiFiPassword
+admin@infix:/config/keystore/…/mywifi/> set symmetric-key YourWiFiPassword
 admin@infix:/config/keystore/…/mywifi/> leave
 ```

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Workaround for: https://github.com/kernelkit/infix/issues/1357
+udevadm control --reload-rules
+udevadm trigger --subsystem-match=net --action=add
@@ -10,6 +10,13 @@
        "state": {
          "admin-state": "unlocked"
        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "00"
+        }
      }
    ]
  },
@@ -38,24 +45,45 @@
      {
        "name": "eth0",
        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
        "ietf-ip:ipv4": {
          "infix-dhcp-client:dhcp": {
            "option": [
-              {"id": "netmask"},
-              {"id": "broadcast"},
-              {"id": "router"},
-              {"id": "domain"},
-              {"id": "hostname"},
-              {"id": "dns-server"},
-              {"id": "ntp-server"},
-              {"id": "vendor-class", "value": "Raspberry Pi 4 Model B"}
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Raspberry Pi 4 Model B"
+              }
            ]
          }
        }
      },
      {
        "name": "wifi0",
-        "type": "infix-if-type:wifi"
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0"
+        }
      }
    ]
  },
@@ -75,6 +103,9 @@
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -82,6 +113,14 @@
          "user-name": [
            "admin"
          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
        }
      ]
    },
@@ -101,6 +140,37 @@
          }
        ]
      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
      {
        "name": "default-deny-all",
        "group": [
@@ -108,11 +178,25 @@
        ],
        "rule": [
          {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
          }
        ]
      }
@@ -126,7 +210,11 @@
            "name": "default-ssh",
            "ssh": {
              "tcp-server-parameters": {
-                "local-address": "::"
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
              },
              "ssh-server-parameters": {
                "server-identity": {
@@ -172,7 +260,7 @@
    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
  },
  "infix-meta:meta": {
-    "version": "1.6"
+    "version": "1.7"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -0,0 +1,4 @@
+#!/bin/sh
+# Workaround for: https://github.com/kernelkit/infix/issues/1357
+udevadm control --reload-rules
+udevadm trigger --subsystem-match=net --action=add
@@ -12,6 +12,15 @@
 			boot_targets = "mmc0";
 			ethprime = "eth0";

+			/* Memory layout for kernel boot:
+			 *   0x00200000: Kernel relocation address
+			 *   0x04000000: FDT (64MB, gives enough space for kernels up to ~60MB)
+			 *   0x10000000: Ramdisk (Memsize - 256MB)
+			 */
+			kernel_addr_r = "0x00200000";
+			fdt_addr_r = "0x04000000";
+			ramdisk_addr_r = "0x10000000";
+
 			stdout = "serial";
 			stderr = "serial";
 			stdin = "serial";
@@ -20,6 +20,7 @@ cleanup()
 {
    rm -f "$LED_FILE"
    rm -f "$PID_FILE"
+    kill %% 2>/dev/null
    exit 0
 }

@@ -31,11 +32,13 @@ remaining_time=$((1800 - $(awk '{print int($1)}' /proc/uptime)))

 while [ "$remaining_time" -gt 0 ]; do
    check_wan
-    sleep 1
+    sleep 1 &
+    wait $!
    remaining_time=$((remaining_time - 1))
 done

 while :; do
    check_wan
-    sleep 5
+    sleep 5 &
+    wait $!
 done
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -e
+
+ecc_stat()
+{
+    local chan=
+    local base=
+
+    for chan in 0 1; do
+        base=$((0xf0020360 + 0x200 * chan))
+
+        echo "DRAM Channel $chan ECC Status"
+        echo -n "  Log config: "; devmem $((base + 0x0)) 32
+        echo -n "  1b errors:  "; devmem $((base + 0x4)) 32
+        echo -n "  Info 0:     "; devmem $((base + 0x8)) 32
+        echo -n "  Info 1:     "; devmem $((base + 0xc)) 32
+        echo
+    done
+}
+
+[ -n "$1" ] || { echo "usage: $0 OUT-DIR"; exit 1; }
+work="$1"/marvell-cn913x
+mkdir -p "${work}"
+
+ecc_stat >"${work}"/ecc-stat
@@ -59,3 +59,9 @@
 		XSWP(a, "e13", 13, &sfp0);
 	};
 };
+
+&cp0_spi1 {
+	spi-flash@0 {
+		broken-flash-reset;
+	};
+};
@@ -1,2 +1,3 @@
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/common.mk
 include $(BR2_EXTERNAL_INFIX_PATH)/board/ix-board.mk
-include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/*/*/*.mk))
+-include $(BR2_EXTERNAL_INFIX_PATH)/board/$(patsubst "%",%,$(BR2_ARCH))/board.mk
@@ -1,32 +1,28 @@
-menuconfig SIGN_ENABLED
-	bool "Image Signing"
+menu "Images"
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rootfs/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-qcow/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"
+
+endmenu
+
+config QEMU_SCRIPTS
+	bool "QEMU scripts"
 	default y
-
-choice
-	prompt "Signing key source"
-	depends on SIGN_ENABLED
-	default SIGN_SRC_DIR
-
-config SIGN_SRC_DIR
-	bool "Directory"
-
-config SIGN_SRC_PKCS11
-	bool "PKCS#11 URL"
-
-endchoice
-
-config SIGN_KEY
-	string "Signing key"
-	depends on SIGN_ENABLED
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development"  if SIGN_SRC_DIR
+	help
+	  Install QEMU scripts and related files in the images
+	  directory, which can be used to launch virtual Infix
+	  instances.

 menuconfig TRUSTED_KEYS
 	bool "Trusted keys for image"
-	depends on SIGN_ENABLED
 	help
 	 Keys that will be accepted for this image

-
 config TRUSTED_KEYS_DEVELOPMENT
 	bool "Development key"
 	depends on TRUSTED_KEYS
@@ -39,130 +35,3 @@ config TRUSTED_KEYS_DEVELOPMENT_PATH
 config TRUSTED_KEYS_EXTRA_PATH
 	string "Path to extra keys to include in image"
 	depends on TRUSTED_KEYS
-
-menuconfig DISK_IMAGE
-	bool "Disk image"
-	help
-	  Compose a full disk image with redundant Linux OS partitions,
-	  configuration partition, etc.
-
-	  This is useful when:
-	  - Bringing up a blank system during manufacturing
-	  - Creating a GNS3 appliance
-	  - Developing/debugging issues in the boot process in QEMU
-
-menuconfig DISK_IMAGE_SIZE
-	string "Image size"
-	depends on DISK_IMAGE
-	default "512M"
-	help
-	  Create a disk image of this size.  A K/M/G suffix may be used
-	  to multiply by powers of 1024.  Suffixes like KB/MB/GB may be
-	  used to multiply by powers of 1000.  The image will be split
-	  proportionally to fit the two rootfs, a kernel, a writable
-	  /cfg and /var partiotions.
-
-	  Minimum supported size is 512M.
-
-choice
-	prompt "Bootloader"
-	depends on DISK_IMAGE
-	default DISK_IMAGE_BOOT_EFI if BR2_x86_64
-	default DISK_IMAGE_BOOT_NONE
-
-config DISK_IMAGE_BOOT_NONE
-	bool "None"
-	help
-	  Do not create any bootloader partition in the disk image.
-
-config DISK_IMAGE_BOOT_EFI
-	bool "EFI"
-	help
-	  Create a boot partition from a directory containing an EFI
-	  boot application, e.g. GRUB.
-
-config DISK_IMAGE_BOOT_BIN
-	bool "Binary"
-	help
-	  Create a boot partition from a raw image containing the boot
-	  application, e.g. U-Boot.
-
-endchoice
-
-config DISK_IMAGE_BOOT_DATA
-	string "Bootloader data"
-	depends on DISK_IMAGE
-	depends on DISK_IMAGE_BOOT_EFI || DISK_IMAGE_BOOT_BIN
-	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
-	help
-	  Path to the directory or file holding the bootloader data.
-
-config DISK_IMAGE_BOOT_OFFSET
-	hex "Bootloader offset"
-	depends on DISK_IMAGE
-	depends on DISK_IMAGE_BOOT_EFI || DISK_IMAGE_BOOT_BIN
-	default 0x8000
-	help
-	  Offset at which the bootloader partition is placed. Remember
-	  to make sure that the GPT still fits at the start of the
-	  image.
-
-config DISK_IMAGE_RELEASE_URL
-	string "Infix URL"
-	depends on DISK_IMAGE
-	depends on !BR2_TARGET_ROOTFS_SQUASHFS
-	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
-	help
-	  In situations where Infix itself is not being built, but a
-	  disk image is, i.e. when building a bootloader: place this
-	  Infix release in the primary and secondary partitions.
-
-menuconfig GNS3_APPLIANCE
-	bool "GNS3 Appliance"
-	select DISK_IMAGE
-	default y
-	help
-	  Create a GNS3 appliance description that, together with the
-	  disk image, can be imported into GNS3.
-
-config GNS3_APPLIANCE_RAM
-	int "Reserved RAM (MiB)"
-	depends on GNS3_APPLIANCE
-	default "192"
-	help
-	  Amount of host RAM reserved for an appliance instance.
-
-	  Minimum supported size is 192M.
-
-config GNS3_APPLIANCE_IFNUM
-	int "Number of interfaces"
-	depends on GNS3_APPLIANCE
-	default "1"
-	help
-	  Number of Ethernet interfaces to create for an appliance instance.
-
-menuconfig FIT_IMAGE
-	bool "Traditional FIT image"
-	help
-	  Create a "regular" FIT image where the kernel and DTBs are
-	  stored in the FIT rather than inside the rootfs (like it
-	  normally is in Infix).
-
-	  This is useful when trying out Infix on targets whose
-	  bootloader might not be capable of booting a raw Squash, but
-	  is able to handle an FIT.
-
-config FIT_ARCH
-	string
-	depends on FIT_IMAGE
-	default "arm64" if BR2_aarch64
-
-config FIT_KERNEL_LOAD_ADDR
-	string "Kernel load address"
-	depends on FIT_IMAGE
-
-config SDCARD_AUX
-	bool "Create SD-card aux partition"
-	help
-	  Create and populate aux.ext4 with rootfs.itbh and rauc.status
-	  For use with a static genimage.cfg for, e.g., SD-cards.
@@ -1016,12 +1016,7 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
-CONFIG_UDHCPC6_DEFAULT_SCRIPT="/usr/share/udhcpc/default6.script"
-CONFIG_UDHCPC6=y
-CONFIG_FEATURE_UDHCPC6_RFC3646=y
-CONFIG_FEATURE_UDHCPC6_RFC4704=y
-CONFIG_FEATURE_UDHCPC6_RFC4833=y
-CONFIG_FEATURE_UDHCPC6_RFC5970=y
+# CONFIG_UDHCPC6 is not set

 #
 # Common options for DHCP applets
@@ -1,4 +1,7 @@
-ifeq ($(SIGN_ENABLED),y)
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/image.mk
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/qemu/qemu.mk
+
+ifeq ($(TRUSTED_KEYS),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk

 TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)
@@ -0,0 +1,10 @@
+config IMAGE_ITB_AUX
+	bool "aux partition"
+	depends on IMAGE_ITB_ROOTFS
+	select BR2_PACKAGE_HOST_UBOOT_TOOLS
+	select BR2_PACKAGE_HOST_GENIMAGE
+	help
+	  Create and populate auxiliary partition, aux.ext4, with
+	  metadata needed by U-Boot and RAUC to operate properly on
+	  systems using ITB images. This may then be included as a
+	  partition in a larger disk image.
@@ -0,0 +1,85 @@
+#!/bin/sh
+
+set -e
+
+boot="${1}"
+squash="${BINARIES_DIR}"/rootfs.squashfs
+itbh="${BINARIES_DIR}"/rootfs.itbh
+aux="${BINARIES_DIR}"/aux.ext4
+
+mkdir -p "${WORKDIR}"/aux
+rm -rf   "${WORKDIR}"/tmp
+mkdir -p "${WORKDIR}"/tmp
+
+cp -f "${itbh}" "${WORKDIR}"/aux/primary.itbh
+cp -f "${itbh}" "${WORKDIR}"/aux/secondary.itbh
+
+tstamp=$(date -u +%FT%TZ)
+rootsha=$(sha256sum "${squash}" | cut -d" " -f1)
+rootsize=$(stat -c %s "${squash}")
+cat <<EOF >"${WORKDIR}"/aux/rauc.status
+[slot.rootfs.0]
+bundle.compatible=${COMPATIBLE}
+bundle.version=${VERSION}
+status=ok
+sha256=${rootsha}
+size=${rootsize}
+installed.timestamp=$tstamp
+installed.count=1
+activated.timestamp=$tstamp
+activated.count=1
+
+[slot.rootfs.1]
+bundle.compatible=${COMPATIBLE}
+bundle.version=${VERSION}
+status=ok
+sha256=${rootsha}
+size=${rootsize}
+installed.timestamp=$tstamp
+installed.count=1
+activated.timestamp=$tstamp
+activated.count=1
+EOF
+
+case "${boot}" in
+    uboot)
+	cat <<EOF | mkenvimage -s 0x4000 -o "${WORKDIR}"/aux/uboot.env -
+BOOT_ORDER=primary secondary net
+BOOT_primary_LEFT=1
+BOOT_secondary_LEFT=1
+BOOT_net_LEFT=1
+EOF
+	;;
+    grub)
+	mkdir -p "${WORKDIR}"/aux/grub
+	cp -f "${PKGDIR}"/grub.cfg "${PKGDIR}"/grubenv "${WORKDIR}"/aux/grub
+	;;
+    *)
+	echo "UNSUPPORTED BOOTLOADER ${boot}" >&2
+	exit 1
+esac
+
+cat <<EOF >"${WORKDIR}"/genimage.cfg
+image $(basename ${aux}) {
+	mountpoint = "/"
+	size = 8M
+
+	ext4 {
+		label = "aux"
+		use-mke2fs = true
+		features = "^metadata_csum,^metadata_csum_seed,uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+# Silence genimage warnings
+config {}
+EOF
+
+genimage \
+    --loglevel 1 \
+    --tmppath    "${WORKDIR}"/tmp \
+    --rootpath   "${WORKDIR}"/aux \
+    --inputpath  "${WORKDIR}" \
+    --outputpath "$(dirname ${aux})" \
+    --config     "${WORKDIR}"/genimage.cfg
@@ -0,0 +1,80 @@
+set timeout="1"
+
+load_env ORDER DEBUG
+
+if [ -z "$ORDER" ]; then
+    set ORDER="primary secondary"
+fi
+
+set ORDER="$ORDER reboot"
+
+for slot in $ORDER; do
+    if [ -z "$default" ]; then
+        set default="$slot"
+    else
+        # Contrary to what the documentation says, GRUB (2.06) does
+        # not support using titles or IDs in the fallback variable, so
+        # we translate to indices.
+        if [ "$slot" = "primary" ]; then
+            set fallback="$fallback 0"
+        elif [ "$slot" = "secondary" ]; then
+            set fallback="$fallback 1"
+        elif [ "$slot" = "net" ]; then
+            set fallback="$fallback 2"
+        elif [ "$slot" = "reboot" ]; then
+            set fallback="$fallback 3"
+	fi
+    fi
+done
+
+if [ "$DEBUG" ]; then
+    set log="debug"
+else
+    set log="loglevel=4"
+fi
+
+# From board/common/rootfs/etc/partition-uuid
+search -p 107ae911-a97b-4380-975c-7ce1a2dde1e0 --set primary
+search -p 352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02 --set secondary
+
+export primary
+export secondary
+
+submenu "primary" "$log" {
+    set slot="$1"
+    set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
+    set root="($primary)"
+    source /boot/grub/grub.cfg
+}
+
+submenu "secondary" "$log"  {
+    set slot="$1"
+    set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
+    set root="($secondary)"
+    source /boot/grub/grub.cfg
+}
+
+submenu "net" "$log"  {
+    net_dhcp
+
+    if [ "$net_efinet0_dhcp_next_server" -a "$net_efinet0_dhcp_boot_file" ]; then
+	set initrd=(tftp,$net_efinet0_dhcp_next_server)/$net_efinet0_dhcp_boot_file
+	loopback initrd $initrd
+	set root=(initrd)
+
+	set slot="$1"
+	set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 qroot=/dev/ram0 ramdisk_size=65536 $2"
+	source /boot/grub/grub.cfg
+    else
+	if [ -z "$net_efinet0_dhcp_next_server" ]; then
+	    echo "No TFTP server supplied in DHCP response"
+	fi
+	if [ -z "$net_efinet0_dhcp_boot_file" ]; then
+	    echo "No bootfile supplied in DHCP response"
+	fi
+    fi
+}
+
+submenu "reboot" {
+    reboot
+}
@@ -0,0 +1,10 @@
+# GRUB Environment Block
+# WARNING: Do not edit this file by tools other than grub-editenv!!!
+ORDER=primary secondary net
+primary_OK=1
+secondary_OK=1
+net_OK=1
+primary_TRY=0
+secondary_TRY=0
+net_TRY=0
+#########################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################
@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-itb-aux
+#
+################################################################################
+
+IMAGE_ITB_AUX_DEPENDENCIES := host-uboot-tools host-genimage image-itb-rootfs
+IMAGE_ITB_AUX_OPTS := $(if $(BR2_TARGET_GRUB2),grub,uboot)
+
+$(eval $(ix-image))
@@ -0,0 +1,15 @@
+menuconfig IMAGE_ITB_DL_RELEASE
+	bool "Download existing release"
+	depends on !BR2_TARGET_ROOTFS_SQUASHFS
+	help
+	  This is primarily used by target specific builds, where the
+	  bootloader artifact needs to be combined with an existing
+	  Infix image, to create a full disk image that can be
+	  provisioned to an SD-card or eMMC.
+
+config IMAGE_ITB_DL_RELEASE_URL
+	string "URL"
+	depends on IMAGE_ITB_DL_RELEASE
+	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
+	help
+	  URL to release tarball.
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+set -e
+
+squash="${BINARIES_DIR}"/rootfs.squashfs
+aux="${BINARIES_DIR}"/aux.ext4
+
+[ -f "${squash}" ] && [ -f "${aux}" ] && exit 0
+
+archive="${WORKDIR}/$(basename ${URL})"
+[ -f "${archive}" ] || wget -O"${archive}" "${URL}"
+
+echo "Unpacking..."
+tar -xa --strip-components=1 -C "${BINARIES_DIR}" -f "${archive}"
+
+auxsize=$(stat -c %s "${aux}")
+if [ "${auxsize}" -gt $((8 << 20)) ]; then
+    # In older releases, 16M aux.ext4 images were generated. In order
+    # to keep the image-itb-qcow logic simpler, trim it 8M, which we
+    # always generate nowadays.
+    echo "WARNING: Auxiliary partition is unexpectedly large. Resizing..."
+    resize2fs "${aux}" 8M
+    truncate -s 8M "${aux}"
+    tune2fs -l "${aux}"
+fi
@@ -0,0 +1,9 @@
+################################################################################
+#
+# image-itb-dl-release
+#
+################################################################################
+
+IMAGE_ITB_DL_RELEASE_CONFIG_VARS := URL
+
+$(eval $(ix-image))
@@ -0,0 +1,23 @@
+menuconfig IMAGE_ITB_GNS3A
+	bool "GNS3 Appliance (ITB)"
+	depends on BR2_x86_64
+	select IMAGE_ITB_QCOW
+	help
+	  Create a GNS3 appliance description that, together with the
+	  disk image, can be imported into GNS3.
+
+config IMAGE_ITB_GNS3A_RAM
+	int "Reserved RAM (MiB)"
+	depends on IMAGE_ITB_GNS3A
+	default "192"
+	help
+	  Amount of host RAM reserved for an appliance instance.
+
+	  Minimum supported size is 192M.
+
+config IMAGE_ITB_GNS3A_IFNUM
+	int "Number of interfaces"
+	depends on IMAGE_ITB_GNS3A
+	default "1"
+	help
+	  Number of Ethernet interfaces to create for an appliance instance.
@@ -0,0 +1,59 @@
+#!/bin/sh
+
+set -e
+
+bios="${BINARIES_DIR}"/OVMF.fd
+qcow="${BINARIES_DIR}"/"${ARTIFACT}".qcow2
+gns3a="${BINARIES_DIR}"/"${ARTIFACT}".gns3a
+
+cat <<EOF >"${gns3a}"
+{
+    "name": "${ARTIFACT} devel",
+    "category": "router",
+    "description": "${ARTIFACT} development appliance",
+    "vendor_name": "Kernelkit",
+    "vendor_url": "https://kernelkit.org",
+    "product_name": "${ARTIFACT} devel",
+    "registry_version": 6,
+    "status": "experimental",
+    "maintainer": "Kernelkit",
+    "maintainer_email": "null@kernelkit.org",
+    "usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
+    "port_name_format": "eth{0}",
+    "linked_clone": true,
+    "qemu": {
+        "adapter_type": "virtio-net-pci",
+        "adapters": ${IFNUM},
+        "ram": ${RAM},
+        "cpus": 1,
+        "hda_disk_interface": "virtio",
+        "arch": "x86_64",
+        "console_type": "telnet",
+        "bios_image": "$(basename ${bios})",
+        "kvm": "allow"
+    },
+    "images": [
+        {
+            "filename": "$(basename "${bios}")",
+            "filesize": $(stat --printf='%s' "${bios}"),
+            "md5sum": "$(md5sum "${bios}" | awk '{print $1}')",
+            "version": "0.0"
+        },
+        {
+            "filename": "$(basename "${qcow}")",
+            "filesize": $(stat --printf='%s' "${qcow}"),
+            "md5sum": "$(md5sum "${qcow}" | awk '{print $1}')",
+            "version": "${VERSION}"
+        }
+    ],
+    "versions": [
+        {
+            "name": "${VERSION}",
+            "images": {
+                "bios_image": "$(basename ${bios})",
+                "hda_disk_image": "$(basename ${qcow})"
+            }
+        }
+    ]
+}
+EOF
@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-itb-gns3a
+#
+################################################################################
+
+IMAGE_ITB_GNS3A_DEPENDENCIES := image-itb-qcow
+IMAGE_ITB_GNS3A_CONFIG_VARS  := IFNUM RAM
+
+$(eval $(ix-image))
@@ -0,0 +1,68 @@
+menuconfig IMAGE_ITB_QCOW
+	bool "QEMU disk image (ITB)"
+	depends on (IMAGE_ITB_ROOTFS && IMAGE_ITB_AUX) || IMAGE_ITB_DL_RELEASE
+	select BR2_PACKAGE_HOST_GENIMAGE
+	help
+	  Compose a full disk image with redundant Linux OS partitions,
+	  configuration partition, etc., for systems using ITB images.
+
+	  This is useful when:
+	  - Bringing up a blank system during manufacturing
+	  - Creating a GNS3 appliance
+	  - Developing/debugging issues in the boot process in QEMU
+
+menuconfig IMAGE_ITB_QCOW_SIZE
+	string "Image size"
+	depends on IMAGE_ITB_QCOW
+	default "512M"
+	help
+	  Create a disk image of this size.  A K/M/G suffix may be used
+	  to multiply by powers of 1024.  Suffixes like KB/MB/GB may be
+	  used to multiply by powers of 1000.  The image will be split
+	  proportionally to fit the two rootfs, a kernel, a writable
+	  /cfg and /var partiotions.
+
+	  Minimum supported size is 512M.
+
+choice
+	prompt "Bootloader"
+	depends on IMAGE_ITB_QCOW
+	default IMAGE_ITB_QCOW_BOOT_EFI if BR2_x86_64
+	default IMAGE_ITB_QCOW_BOOT_NONE
+
+config IMAGE_ITB_QCOW_BOOT_NONE
+	bool "None"
+	help
+	  Do not create any bootloader partition in the disk image.
+
+config IMAGE_ITB_QCOW_BOOT_EFI
+	bool "EFI"
+	help
+	  Create a boot partition from a directory containing an EFI
+	  boot application, e.g. GRUB.
+
+config IMAGE_ITB_QCOW_BOOT_BIN
+	bool "Binary"
+	help
+	  Create a boot partition from a raw image containing the boot
+	  application, e.g. U-Boot.
+
+endchoice
+
+config IMAGE_ITB_QCOW_BOOT_DATA
+	string "Bootloader data"
+	depends on IMAGE_ITB_QCOW
+	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
+	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
+	help
+	  Path to the directory or file holding the bootloader data.
+
+config IMAGE_ITB_QCOW_BOOT_OFFSET
+	hex "Bootloader offset"
+	depends on IMAGE_ITB_QCOW
+	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
+	default 0x8000
+	help
+	  Offset at which the bootloader partition is placed. Remember
+	  to make sure that the GPT still fits at the start of the
+	  image.
@@ -1,8 +1,6 @@
 #!/bin/sh
 set -e

-. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
-
 K=10
 M=20
 G=30
@@ -47,43 +45,32 @@ dimension()
 	exit 1
    fi

-    # Size var to fit whatever is left over. Also reserve another 32K
-    # at the end to make room for the backup GPT.
-    varsize=$(($total - $auxsize - 2 * $imgsize - $cfgsize))
-    if [ "$bootoffs" ]; then
-	varsize=$(($varsize - $bootsize))
-    fi
-    varsize=$(($varsize - (32 << K)))
+    # Place aux right after the GPT...
+    auxoffs=$((32 << K))

    if [ "$bootoffs" ]; then
-	# Align the end of the boot partition to an even MiB. E.g. if
-	# boot was dimensioned to 4M, and bootoffs is 32K, then the
-	# final bootsize becomes 4M - 32K, meaning aux will start on
-	# exactly 4M.
-	auxoffs=$bootsize
-	bootsize=$(($bootsize - $bootoffs))
-    else
-	# No bootloader, place aux after GPT, resize it to end on an
-	# even MiB (as is done for boot above).
-	auxoffs=$((32 << K))
-	auxsize=$(($auxsize - $auxoffs))
-    fi
-}
+	if [ $((bootoffs)) -lt $((32 << K)) ]; then
+	    echo "Boot partition collides with GPT"
+	    exit 1
+	fi

-probeboot()
-{
-    # If we have built an EFI app, typically grub, make sure to
-    # include it.
-    if [ -d $BINARIES_DIR/efi-part/EFI ]; then
-	bootoffs=$((32 << K))
+	# ...unless we have a boot partition, in which case we place
+	# it after that.
+	auxoffs=$((auxoffs + bootsize))
    fi
+
+    # Finally, size var to fit whatever is left over by subtracting
+    # all other images, plus another 32K at the end for the backup
+    # GPT.
+    varsize=$((total - auxoffs - auxsize - 2 * imgsize - cfgsize - (32 << K)))
 }

 genboot()
 {
    if [ -d "$bootdata" ]; then
 	bootimg=$(cat <<EOF
-image $BINARIES_DIR/efi-part.vfat {
+image efi-part.vfat {
+	temporary = true
 	size = $bootsize
 	vfat {
 		file EFI {
@@ -98,7 +85,7 @@ EOF
 		offset = $bootoffs
 		partition-type-uuid = U
 		bootable = true
-		image = $BINARIES_DIR/efi-part.vfat
+		image = efi-part.vfat
 	}
 EOF
 		  )
@@ -117,44 +104,29 @@ EOF
    fi
 }

-common=$(dirname $(readlink -f "$0"))
-root=$BUILD_DIR/genimage.root
-tmp=$BUILD_DIR/genimage.tmp
+mkdir -p "${WORKDIR}"/root
+rm -rf   "${WORKDIR}"/tmp
+mkdir -p "${WORKDIR}"/tmp

-total=$((512 << M))
-bootoffs=$((32 << K))
-bootdata=
-diskimg=disk.img
+qcowimg="${ARTIFACT}.qcow2"
+total=$(size2int $SIZE)
+bootoffs=
+bootdata=$BOOT_DATA
 bootimg=
 bootpart=
-tmpimage=$(mktemp)
-while getopts "a:b:B:n:s:" opt; do
-    case ${opt} in
-	a)
-	    arch=$OPTARG
-	    ;;
-	b)
-	    bootdata=$OPTARG
-	    ;;
-	B)
-	    bootoffs=$(($OPTARG))
-	    ;;
-	n)
-	    diskimg=${OPTARG}
-	    ;;
-	s)
-	    total=$(size2int $OPTARG)
-	    ;;
-    esac
-done
-shift $((OPTIND - 1))

-mkdir -p $root
+if [ -n "${BOOT_OFFSET}" ]; then
+    bootoffs=$(($BOOT_OFFSET))
+fi

-probeboot
 dimension
 genboot

+. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
+[ -n "${AUX_UUID}" ]
+[ -n "${PRIMARY_UUID}" ]
+[ -n "${SECONDARY_UUID}" ]
+
 # Use awk over sed because replacement text may contain newlines,
 # which sed does not approve of.
 awk \
@@ -166,7 +138,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vdiskimg=$tmpimage \
+	  -vqcowimg=$qcowimg \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -175,7 +147,7 @@ awk \
 		sub(/@IMGSIZE@/, imgsize);
 		sub(/@CFGSIZE@/, cfgsize);
 		sub(/@VARSIZE@/, varsize);
-		sub(/@DISKIMG@/, diskimg);
+		sub(/@QCOWIMG@/, qcowimg);
 		sub(/@BOOTIMG@/, bootimg);
 		sub(/@BOOTPART@/, bootpart);
 		sub(/@AUXUUID@/, auxuuid);
@@ -183,35 +155,11 @@ awk \
 		sub(/@SECONDARYUUID@/, secondaryuuid);

 	  }1' \
-	      < $common/genimage.cfg.in >$root/genimage.cfg
-
-mkdir -p $root/aux
-cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
-cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
-cp -f $BINARIES_DIR/rauc.status $root/aux/rauc.status
-
-case "$arch" in
-    aarch64)
-	mkenvimage -s 0x4000 -o "$root/aux/uboot.env" \
-		   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
-	;;
-    x86_64)
-	mkdir -p "$root/aux/grub"
-	cp -f "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grub.cfg" \
-	      "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grubenv"  \
-	      "$root/aux/grub/"
-	;;
-    *)
-	;;
-esac
-
-rm -rf "$tmp"
+	      < $PKGDIR/genimage.cfg.in >$WORKDIR/genimage.cfg

 genimage \
-    --rootpath "$root" \
-    --tmppath  "$tmp" \
-    --inputpath "$BINARIES_DIR" \
-    --config "$root/genimage.cfg"
-
-qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
-rm "$tmpimage"
+    --tmppath    "${WORKDIR}"/tmp  \
+    --rootpath   "${WORKDIR}"/root \
+    --inputpath  "$BINARIES_DIR"   \
+    --outputpath "$BINARIES_DIR"   \
+    --config "${WORKDIR}"/genimage.cfg
@@ -1,16 +1,5 @@
@BOOTIMG@

-image aux.ext4 {
-	mountpoint = "/aux"
-	temporary = true
-	size = @AUXSIZE@
-
-	ext4 {
-		label = "aux"
-		use-mke2fs = true
-	}
-}
-
 image cfg.ext4 {
 	empty = true
 	temporary = true
@@ -33,7 +22,8 @@ image var.ext4 {
 	}
 }

-image @DISKIMG@ {
+image disk.img {
+	temporary = true
 	size = @TOTALSIZE@
 	hdimage {
 		partition-table-type = "gpt"
@@ -68,5 +58,15 @@ image @DISKIMG@ {
 	}
 }

+image @QCOWIMG@ {
+	qemu {
+		format = "qcow2"
+	}
+
+	partition disk {
+		image = "disk.img"
+	}
+}
+
 # Silence genimage warnings
 config {}
@@ -0,0 +1,15 @@
+################################################################################
+#
+# image-itb-qcow
+#
+################################################################################
+
+# We can source the rootfs+aux from a local build, or from a
+# downloaded release; so adjust our dependencies accordingly.
+IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_ROOTFS)     := image-itb-rootfs image-itb-aux
+IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_DL_RELEASE) := image-itb-dl-release
+
+IMAGE_ITB_QCOW_DEPENDENCIES := host-genimage $(IMAGE_ITB_QCOW_SRC-y)
+IMAGE_ITB_QCOW_CONFIG_VARS := BOOT_DATA BOOT_OFFSET SIZE
+
+$(eval $(ix-image))
@@ -0,0 +1,27 @@
+menuconfig IMAGE_ITB_RAUC
+	bool "RAUC upgrade bundle (ITB)"
+	select IMAGE_ITB_ROOTFS
+	select BR2_PACKAGE_HOST_RAUC
+	help
+	  Create RAUC upgrade bundle, for targets using ITB images,
+	  that can be used to upgrade a running system to this version
+	  of Infix.
+
+config IMAGE_ITB_RAUC_KEY
+	string "signing key"
+	depends on IMAGE_ITB_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private key, in PKCS#8 format, used to sign
+	  the RAUC bundle; or a PKCS#11 URI.
+
+config IMAGE_ITB_RAUC_CERT
+	string "signing certificate"
+	depends on IMAGE_ITB_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+	help
+	  Path to the X509 certificate which will be associated with
+	  the bundle signature.
+
+	  NOTE: This cert MUST be included in the trust store of the
+	        system on which this bundle is to be installed.
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+
+squash="${BINARIES_DIR}"/rootfs.squashfs
+itbh="${BINARIES_DIR}"/rootfs.itbh
+pkg="${BINARIES_DIR}"/"${ARTIFACT}.pkg"
+
+cp -f "${PKGDIR}"/hooks.sh "${WORKDIR}"/hooks.sh
+
+# RAUC internally uses the file extension to find a suitable install
+# handler, hence the name must be .img
+cp -f "${squash}" "${WORKDIR}"/rootfs.img
+cp -f "${itbh}"   "${WORKDIR}"/rootfs.itbh
+
+cat >"${WORKDIR}"/manifest.raucm <<EOF
+[update]
+compatible=${COMPATIBLE}
+version=${VERSION}
+
+[bundle]
+format=verity
+
+[hooks]
+filename=hooks.sh
+
+[image.rootfs]
+filename=rootfs.img
+hooks=post-install
+EOF
+
+rauc --cert="${CERT}" --key="${KEY}" \
+     bundle "${WORKDIR}" "${pkg}.next"
+
+mv "${pkg}.next" "${pkg}"
@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-itb-rauc
+#
+################################################################################
+
+IMAGE_ITB_RAUC_DEPENDENCIES := host-rauc image-itb-rootfs
+IMAGE_ITB_RAUC_CONFIG_VARS := KEY CERT
+
+$(eval $(ix-image))
@@ -0,0 +1,20 @@
+menuconfig IMAGE_ITB_ROOTFS
+	bool "rootfs.itb+.itbh"
+	select BR2_TARGET_ROOTFS_SQUASHFS
+	select BR2_PACKAGE_HOST_UBOOT_TOOLS
+	help
+	  Create a signed ITB image containing a SquashFS of rootfs
+	  and extract detached header (.itbh) for U-Boot based
+	  targets.
+
+config IMAGE_ITB_ROOTFS_KEY
+	string "signing key"
+	depends on IMAGE_ITB_ROOTFS
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private RSA key, in PKCS#8 format, used to sign
+	  the root filesystem.
+
+	  If the path is prefixed with "<hint>:", then that used as
+	  the "key-name-hint" in the resulting ITB, otherwise the
+	  basename of the path, with any extension removed, is used.
@@ -0,0 +1,71 @@
+#!/bin/sh
+
+set -e
+
+squash="${BINARIES_DIR}"/rootfs.squashfs
+
+itb="${BINARIES_DIR}"/rootfs.itb
+itbh_size=0x1000
+
+IFS=:
+set ${KEY}
+case $# in
+    1)
+	keyfile="$1"
+	hint=$(basename ${keyfile%.*})
+	;;
+    2)
+	keyfile="$2"
+	hint="$1"
+	;;
+    *)
+	echo "INVALID KEY" >&2
+	exit 1
+	;;
+esac
+
+rsanibbles=$(openssl rsa -in "${KEY}" -noout -modulus | \
+		 sed -e 's/^Modulus=//' | tr -d '\n' | wc -c)
+if [ "${rsanibbles}" -le 0 ]; then
+    echo "ONLY RSA KEYS ARE SUPPORTED" >&2
+    exit 1
+fi
+
+cat >"${WORKDIR}"/rootfs.its <<EOF
+/dts-v1/;
+
+/ {
+	description = "${ARTIFACT}";
+	creator = "infix";
+	#address-cells = <0x1>;
+
+	images {
+		rootfs {
+			description = "rootfs";
+			type = "ramdisk";
+			os = "linux";
+			compression = "none";
+			data = /incbin/("${squash}");
+			signature-1 {
+				algo = "sha256,rsa$((rsanibbles << 2))";
+				key-name-hint = "${hint}";
+			};
+		};
+	};
+
+	configurations {
+		default = "verity";
+		verity {
+			ramdisk = "rootfs";
+		};
+	};
+};
+
+EOF
+
+mkimage -E -p $itbh_size -B $itbh_size \
+	-f "${WORKDIR}"/rootfs.its \
+	-g "${hint}" -G "${keyfile}" \
+	"${itb}"
+
+dd if="${itb}" bs=$((itbh_size)) count=1 of="${itb}h" status=none
@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-itb-rootfs
+#
+################################################################################
+
+IMAGE_ITB_ROOTFS_DEPENDENCIES := rootfs-squashfs
+IMAGE_ITB_ROOTFS_CONFIG_VARS := KEY
+
+$(eval $(ix-image))
@@ -0,0 +1,6 @@
+config IMAGE_README
+	bool "Install README.md in images"
+	help
+	  Install a README.md with useful information about getting
+	  started with Infix in the images directory (thereby also
+	  including it in the resulting release tarball).
@@ -34,7 +34,7 @@ Depending on how your Linux installation is set up, the following may
 require being run with superuser privileges, i.e., you may need to
 repend the command with 'sudo'.

-    $ ./qemu.sh
+    $ ./qemu/run.sh

 You should now see the Infix init system booting up.  When the final
 "Please press Enter to activate this console." is shown, press Enter
@@ -75,13 +75,13 @@ interface, which requires the following extra package:

 We can now enter the configuration:

-    $ ./qemu.sh -c
+    $ ./qemu/run.sh -c

 Go down to *Networking*, select *TAP*, now you can change the *Number of
 TAPs*, e.g. to 10.  Exit and save the configuration, then you can start
 Qemu again:

-   ./qemu.sh
+    $ ./qemu/run.sh

 > Make sure to do a factory reset from the CLI, otherwise you will be
 > stuck with that single interface from before.
@@ -0,0 +1,18 @@
+################################################################################
+#
+# image-readme
+#
+################################################################################
+
+IMAGE_README_DIR := $(pkgdir)
+
+image-readme: $(BINARIES_DIR)/README.md
+
+$(BINARIES_DIR)/README.md: $(IMAGE_README_DIR)/README.md
+	@$(call IXMSG,"Installing README.md")
+	@mkdir -p $(BINARIES_DIR)
+	@cp $< $@
+
+ifeq ($(IMAGE_README),y)
+TARGETS_ROOTFS += image-readme
+endif
@@ -0,0 +1,2 @@
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/ix-image.mk
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/*/*.mk))
@@ -0,0 +1,26 @@
+define inner-ix-image
+
+$(2)_DIR := $$(pkgdir)
+
+$(1): $$($(2)_DEPENDENCIES)
+	@$$(call IXMSG,"$$(if $$($(2)_MESSAGE),$$($(2)_MESSAGE),Creating $(1))")
+	@mkdir -p $$(BUILD_DIR)/$(1)
+	@ \
+	PATH=$$(BR_PATH) \
+	PKGDIR=$$($(2)_DIR) \
+	WORKDIR=$$(BUILD_DIR)/$(1) \
+	BINARIES_DIR=$$(BINARIES_DIR) \
+	BR2_EXTERNAL_INFIX_PATH=$$(BR2_EXTERNAL_INFIX_PATH) \
+	ARTIFACT=$$(INFIX_ARTIFACT) \
+	COMPATIBLE=$$(INFIX_COMPATIBLE) \
+	VERSION=$$(INFIX_VERSION) \
+	$$(foreach var,$$($(2)_CONFIG_VARS),$$(var)=$$($(2)_$$(var)) ) \
+	$$($(2)_DIR)/generate.sh $$($(2)_OPTS)
+
+ifeq ($$($(2)),y)
+TARGETS_ROOTFS += $(1)
+endif
+
+endef
+
+ix-image = $(call inner-ix-image,$(pkgname),$(call UPPERCASE,$(pkgname)))
@@ -1,40 +0,0 @@
-#!/bin/sh
-
-rootdir=$BUILD_DIR/genimage.root
-tempdir=$BUILD_DIR/genimage.tmp
-
-cat <<EOF > /tmp/mkaux.cfg
-image aux.ext4 {
-	mountpoint = "/aux"
-	size = 16M
-
-	ext4 {
-		label = "aux"
-		use-mke2fs = true
-		features = "^metadata_csum,^metadata_csum_seed,uninit_bg"
-                extraargs = "-m 0 -i 4096"
-	}
-}
-
-# Silence genimage warnings
-config {}
-EOF
-
-rm -rf   "$rootdir/aux"
-mkdir -p "$rootdir/aux"
-cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/primary.itbh"
-cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/secondary.itbh"
-cp -f "$BINARIES_DIR/rauc.status" "$rootdir/aux/rauc.status"
-
-mkenvimage -s 0x4000 -o "$rootdir/aux/uboot.env" \
-	   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
-
-rm -rf "$BINARIES_DIR/aux.ext4"
-rm -rf "$tempdir"
-
-genimage \
-    --rootpath   "$rootdir" \
-    --tmppath    "$tempdir" \
-    --inputpath  "$BINARIES_DIR" \
-    --outputpath "$BINARIES_DIR" \
-    --config "/tmp/mkaux.cfg"
@@ -1,118 +0,0 @@
-#!/bin/sh
-
-die()
-{
-    echo "$@" >&2
-    exit 1
-}
-
-load_cfg()
-{
-    local tmp=$(mktemp -p /tmp)
-
-    grep ^FIT_ $BR2_CONFIG >$tmp
-    .  $tmp
-    rm $tmp
-}
-
-load_cfg
-[ "$FIT_IMAGE" = "y" ] || exit 0
-
-work=$BUILD_DIR/fit-image-local
-dtbs=$(find $BINARIES_DIR -name '*.dtb')
-kernel=$(find $BINARIES_DIR -name '*Image' | head -n1)
-squash=$BINARIES_DIR/rootfs.squashfs
-
-mkdir -p $work
-gzip <$kernel >$work/Image.gz
-kernel=$work/Image.gz
-
-rm -rf $work/rootfs
-unsquashfs -f -d $work/rootfs $squash
-rm -f $work/rootfs/boot/*Image
-
-squash=$work/rootfs-no-kernel.squashfs
-rm -f $squash
-mksquashfs $work/rootfs $squash
-
-# mkimage will only align images to 4 bytes, but U-Boot will leave
-# both DTB and ramdisk in place when starting the kernel. So we pad
-# all components up to a 4k boundary.
-truncate -s %4k $kernel $dtbs
-
-: >$work/dtbs.itsi
-: >$work/cfgs.itsi
-for dtb in $dtbs; do
-    name=$(basename $dtb .dtb)
-
-    cat <<EOF >>$work/dtbs.itsi
-		$name-dtb {
-			description = "$name";
-			type = "flat_dt";
-			arch = "$FIT_ARCH";
-			compression = "none";
-			data = /incbin/("$dtb");
-		};
-EOF
-    cat <<EOF >>$work/cfgs.itsi
-		$name {
-			description = "$name";
-			kernel = "kernel";
-			ramdisk = "ramdisk";
-			fdt = "$name-dtb";
-		};
-EOF
-done
-
-: >$work/kernel-load.itsi
-if [ "$FIT_KERNEL_LOAD_ADDR" ]; then
-    cat <<EOF >$work/kernel-load.itsi
-			load = <$FIT_KERNEL_LOAD_ADDR>;
-			entry = <$FIT_KERNEL_LOAD_ADDR>;
-EOF
-fi
-
-cat <<EOF >$work/infix.its
-/dts-v1/;
-
-/ {
-	timestamp = <$(date +%s)>;
-	description = "Infix ($FIT_ARCH)";
-	creator = "infix";
-	#address-cells = <0x1>;
-
-	images {
-
-		kernel {
-			description = "Linux";
-			type = "kernel";
-			arch = "$FIT_ARCH";
-			os = "linux";
-$(cat $work/kernel-load.itsi)
-			compression = "gzip";
-			data = /incbin/("$kernel");
-		};
-
-		ramdisk {
-			description = "Infix";
-			type = "ramdisk";
-			os = "linux";
-			arch = "$FIT_ARCH";
-			compression = "none";
-			data = /incbin/("$squash");
-		};
-
-$(cat $work/dtbs.itsi)
-
-	};
-
-	configurations {
-$(cat $work/cfgs.itsi)
-	};
-};
-EOF
-
-mkimage \
-    -E -p 0x1000 \
-    -f $work/infix.its $BINARIES_DIR/infix.itb \
-    || die "Unable to create FIT image"
@@ -1,103 +0,0 @@
-#!/bin/sh
-# shellcheck disable=SC1091
-. "$TARGET_DIR/etc/os-release"
-
-if [ -n "$INFIX_RELEASE" ]; then
-    rel="-${INFIX_RELEASE}"
-fi
-
-ARCH=$1
-NM="${2:-custom}${rel}"
-DISK=$3
-RAM=${4:-512}
-IFNUM=${5:-1}
-
-# The aarch64 build currently has no "loader" but instead starts Linux
-# directly, so we need to add a basic cmdline.
-loader_args()
-{
-    if [ "$ARCH" = "aarch64" ]; then
-	cat <<EOF
-"kernel_command_line": "console=ttyAMA0 root=PARTLABEL=primary quiet",
-EOF
-    fi
-}
-
-loader_img()
-{
-    if [ "$ARCH" = "x86_64" ]; then
-	cat <<EOF
-"bios_image": "$loader",
-EOF
-    else
-	cat <<EOF
-"kernel_image": "$loader",
-EOF
-    fi
-}
-
-if [ "$ARCH" = "x86_64" ]; then
-    loader=OVMF.fd
-    accel=allow
-    opts=
-else
-    loader=Image
-    accel=disable
-    opts="-M virt -cpu cortex-a72"
-fi
-
-echo ">> Disk image MD5: $(md5sum "$BINARIES_DIR/$DISK" | awk '{print $1}')"
-
-cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
-{
-    "name": "$NM",
-    "category": "router",
-    "description": "$INFIX_DESC",
-    "vendor_name": "$VENDOR_NAME",
-    "vendor_url": "$VENDOR_HOME",
-    "product_name": "$NAME",
-    "registry_version": 6,
-    "status": "stable",
-    "maintainer": "$VENDOR_NAME",
-    "maintainer_email": "${SUPPORT_URL#mailto:}",
-    "usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
-    "port_name_format": "eth{0}",
-    "linked_clone": true,
-    "qemu": {
-        "adapter_type": "virtio-net-pci",
-        "adapters": ${IFNUM},
-        "ram": ${RAM},
-        "cpus": 1,
-        "hda_disk_interface": "virtio",
-        "arch": "$ARCH",
-        "console_type": "telnet",
-        $(loader_img)
-        $(loader_args)
-        "kvm": "$accel",
-	"options": "$opts"
-    },
-    "images": [
-        {
-            "filename": "$loader",
-            "filesize": $(stat --printf='%s' "$BINARIES_DIR/$loader"),
-            "md5sum": "$(md5sum "$BINARIES_DIR/$loader" | awk '{print $1}')",
-            "version": "0.0"
-        },
-        {
-            "filename": "$DISK",
-            "filesize": $(stat --printf='%s' "$BINARIES_DIR/$DISK"),
-            "md5sum": "$(md5sum "$BINARIES_DIR/$DISK" | awk '{print $1}')",
-            "version": "0.0"
-        }
-    ],
-    "versions": [
-        {
-            "name": "0.0",
-            "images": {
-                $(loader_img)
-                "hda_disk_image": "$DISK"
-            }
-        }
-    ]
-}
-EOF
@@ -1,22 +0,0 @@
-#!/bin/sh
-
-set -e
-
-common=$(dirname $(readlink -f "$0"))
-root=$BUILD_DIR/genimage.root
-tmp=$BUILD_DIR/genimage.tmp
-
-
-mkdir -p $root/aux
-cp -f $BINARIES_DIR/uboot-env.bin $root/aux/uboot.env
-cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
-cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
-
-rm -rf $tmp
-
-genimage \
-    --rootpath $root \
-    --tmppath  $tmp \
-    --inputpath $BINARIES_DIR \
-    --outputpath $BINARIES_DIR \
-    --config $common/genimage.cfg
@@ -1,35 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# Bootstrap a RAUC status file showing the newly created image
-# installed to both the primary and secondary slots. This then bundled
-# in the aux partition in mkdisk.sh, so that RAUC (on the target) can
-# always report the installed versions.
-rauc info --no-verify --output-format=shell $1 >/tmp/rauc-$$.info
-. /tmp/rauc-$$.info
-rm /tmp/rauc-$$.info
-tstamp=$(date -u +%FT%TZ)
-cat <<EOF
-[slot.rootfs.0]
-bundle.compatible=$RAUC_MF_COMPATIBLE
-bundle.version=$RAUC_MF_VERSION
-status=ok
-sha256=$RAUC_IMAGE_DIGEST_0
-size=$RAUC_IMAGE_SIZE_0
-installed.timestamp=$tstamp
-installed.count=1
-activated.timestamp=$tstamp
-activated.count=1
-
-[slot.rootfs.1]
-bundle.compatible=$RAUC_MF_COMPATIBLE
-bundle.version=$RAUC_MF_VERSION
-status=ok
-sha256=$RAUC_IMAGE_DIGEST_0
-size=$RAUC_IMAGE_SIZE_0
-installed.timestamp=$tstamp
-installed.count=1
-activated.timestamp=$tstamp
-activated.count=1
-EOF
@@ -1,43 +0,0 @@
-#!/bin/sh
-
-set -e
-
-name=$1
-compat=$2
-sign=$3
-
-crt=$(ls $sign/*.crt)
-key=$(ls $sign/*.key)
-
-common=$(dirname "$(readlink -f "$0")")
-
-work=$BUILD_DIR/mkrauc
-mkdir -p "$work"
-
-cp -f "$common/rauc-hooks.sh" "$work/hooks.sh"
-
-# RAUC internally uses the file extension to find a suitable install
-# handler, hence the name must be .img
-cp -f "$BINARIES_DIR/rootfs.squashfs" "$work/rootfs.img"
-cp -f "$BINARIES_DIR/rootfs.itbh"     "$work/rootfs.itbh"
-
-cat >"$work/manifest.raucm" <<EOF
-[update]
-compatible=${compat}
-version=${INFIX_VERSION}
-
-[bundle]
-format=verity
-
-[hooks]
-filename=hooks.sh
-
-[image.rootfs]
-filename=rootfs.img
-hooks=post-install
-EOF
-
-rm -f "$BINARIES_DIR/$name.pkg"
-
-rauc --cert="$crt" --key="$key" \
-     bundle "$work" "$BINARIES_DIR/$name.pkg"
@@ -1,112 +0,0 @@
-#!/bin/sh
-# shellcheck disable=SC2086
-
-common=$(dirname "$(readlink -f "$0")")
-. "$common/lib.sh"
-
-# shellcheck disable=SC1091
-. "$TARGET_DIR/etc/os-release"
-
-# The INFIX_* variables may be composed from BR2_* variables,
-# so we source them last.
-load_cfg BR2_ARCH
-load_cfg BR2_DEFCONFIG
-load_cfg BR2_EXTERNAL_INFIX_PATH
-load_cfg BR2_TARGET_ROOTFS
-load_cfg INFIX_ID
-load_cfg INFIX_COMPATIBLE
-
-# The default IMAGE_ID is infix-$BR2_ARCH but can be overridden
-# for imaage names, and compat strings, like infix-r2s
-if [ -n "$IMAGE_ID" ]; then
-    NAME="$IMAGE_ID"
-else
-    NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
-fi
-diskimg=disk.qcow2
-
-ver()
-{
-    if [ -n "$INFIX_RELEASE" ]; then
-	printf -- "-%s" "${INFIX_RELEASE#v}"
-	return
-    fi
-}
-
-load_cfg SIGN_ENABLED
-if [ "$SIGN_ENABLED" = "y" ]; then
-    load_cfg BR2_ARCH
-    load_cfg SIGN_KEY
-
-    ixmsg "Signing SquashFS Image"
-    $common/sign.sh $BR2_ARCH $SIGN_KEY
-
-    ixmsg "Creating RAUC Update Bundle"
-    $common/mkrauc.sh "$NAME$(ver)" $INFIX_COMPATIBLE $SIGN_KEY
-fi
-
-load_cfg DISK_IMAGE
-if [ "$DISK_IMAGE" = "y" ]; then
-    ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk$(ver).qcow2"
-    bootcfg=
-    if [ "$DISK_IMAGE_BOOT_DATA" ]; then
-	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
-    fi
-
-    if [ "$BR2_TARGET_ROOTFS_SQUASHFS" != "y" ] && \
-       [ ! -f "$BINARIES_DIR/rootfs.squashfs" ]; then
-	ixmsg "  Injecting $DISK_IMAGE_RELEASE_URL"
-	archive="$BINARIES_DIR/$(basename $DISK_IMAGE_RELEASE_URL)"
-	[ -f "$archive" ] || wget -O"$archive" "$DISK_IMAGE_RELEASE_URL"
-	tar -xa --strip-components=1 -C "$BINARIES_DIR" -f "$archive"
-    fi
-
-    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
-    $common/mkdisk.sh -a $BR2_ARCH -n $diskimg -s $DISK_IMAGE_SIZE $bootcfg
-fi
-
-load_cfg SDCARD_AUX
-if [ "$SDCARD_AUX" = "y" ]; then
-    ixmsg "Creating initial rauc.status"
-    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
-    ixmsg "Creating aux.ext4 for sdcard.img"
-    $common/mkaux.sh
-fi
-
-load_cfg GNS3_APPLIANCE
-if [ "$GNS3_APPLIANCE" = "y" ]; then
-    ixmsg "Creating GNS3 Appliance, $GNS3_APPLIANCE_RAM MiB with $GNS3_APPLIANCE_IFNUM ports"
-    $common/mkgns3a.sh $BR2_ARCH $NAME $diskimg $GNS3_APPLIANCE_RAM $GNS3_APPLIANCE_IFNUM
-fi
-
-load_cfg FIT_IMAGE
-if [ "$FIT_IMAGE" = "y" ]; then
-    ixmsg "Creating Traditional FIT Image"
-    $common/mkfit.sh
-fi
-
-# Only for regular builds, not bootloader-only builds
-if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
-    rel=$(ver)
-    ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
-    if [ -n "$rel" ]; then
-	ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
-    fi
-
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
-
-    # Menuconfig support for modifying Qemu args in release tarballs
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
-    sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
-	-e "s/@DISK_IMG@/$diskimg/"   \
-	< "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in.in" \
-	> "$BINARIES_DIR/Config.in"
-    rm -f "$BINARIES_DIR/qemu.cfg"
-    CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
-	   "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
-    rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
-
-    # Quick intro for beginners, with links to more information
-    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"
-fi
@@ -78,7 +78,7 @@ endchoice
 config QEMU_MACHINE
 	string "Select emulated machine"
 	default "qemu-system-arm     -M virt,accel=kvm:tcg -cpu max" if QEMU_arm
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu cortex-a53" if QEMU_aarch64
 	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
@@ -99,20 +99,20 @@ config QEMU_MACHINE_RAM
 config QEMU_KERNEL
 	string
 	depends on QEMU_LOADER_KERNEL
-	default "zImage"  if QEMU_arm
-	default "Image"   if QEMU_aarch64
-	default "bzImage" if QEMU_x86_64
+	default "../zImage"  if QEMU_arm
+	default "../Image"   if QEMU_aarch64
+	default "../bzImage" if QEMU_x86_64

 config QEMU_BIOS
 	string
 	depends on !QEMU_LOADER_KERNEL
-	default "u-boot.bin" if QEMU_LOADER_UBOOT
-	default "OVMF.fd"    if QEMU_LOADER_OVMF
+	default "../u-boot.bin" if QEMU_LOADER_UBOOT
+	default "../OVMF.fd"    if QEMU_LOADER_OVMF

 config QEMU_ROOTFS
 	string
 	default "@DISK_IMG@" if !QEMU_ROOTFS_INITRD
-	default "rootfs.squashfs" if QEMU_ROOTFS_INITRD
+	default "../rootfs.squashfs" if QEMU_ROOTFS_INITRD

 config QEMU_DTB_EXTEND
 	bool
@@ -0,0 +1,45 @@
+################################################################################
+#
+# qemu-scripts
+#
+################################################################################
+
+QEMU_SCRIPTS_DIR := $(pkgdir)
+qemu-kconfig = \
+	CONFIG_="CONFIG_" \
+	BR2_CONFIG="$(BINARIES_DIR)/qemu/.config" \
+	$(BUILD_DIR)/buildroot-config/$(1) $(2) "$(BINARIES_DIR)/qemu/Config.in"
+
+ifeq ($(QEMU_SCRIPTS),y)
+
+.PHONY: run
+run:
+	@$(BINARIES_DIR)/qemu/run.sh
+
+.PHONY: run-menuconfig
+run-menuconfig: $(BUILD_DIR)/buildroot-config/mconf
+	@$(call qemu-kconfig,mconf)
+
+qemu-scripts: \
+		$(BINARIES_DIR)/qemu/run.sh \
+		$(BINARIES_DIR)/qemu/Config.in \
+		$(BINARIES_DIR)/qemu/.config
+
+$(BINARIES_DIR)/qemu/run.sh: $(QEMU_SCRIPTS_DIR)/run.sh
+	@$(call IXMSG,"Installing QEMU scripts")
+	@mkdir -p $(dir $@)
+	@cp $< $@
+
+$(BINARIES_DIR)/qemu/Config.in: $(QEMU_SCRIPTS_DIR)/Config.in.in
+	@mkdir -p $(dir $@)
+	@sed \
+		-e "s:@ARCH@:QEMU_$(BR2_ARCH):" \
+		-e "s:@DISK_IMG@:../$(INFIX_ARTIFACT).qcow2:" \
+	< $< >$@
+
+$(BINARIES_DIR)/qemu/.config: $(BINARIES_DIR)/qemu/Config.in
+	@$(call qemu-kconfig,conf,--olddefconfig)
+	@rm -f $@.old
+
+TARGETS_ROOTFS += qemu-scripts
+endif
@@ -10,17 +10,20 @@
 #
 # and then call this script with:
 #
-#    ./qemu.sh -c
+#    ./run.sh -c
 #
 # To bring up a menuconfig dialog.  Select `Exit` and save the changes.
 # For more help, see:_
 #
-#    ./qemu.sh -h
+#    ./run.sh -h
 #
 # shellcheck disable=SC3037

-# Local variables
-imgdir=$(readlink -f "$(dirname "$0")")
+# Add /sbin to PATH for mkfs.ext4 and such (not default in debian)
+export PATH="/sbin:/usr/sbin:$PATH"
+
+qdir=$(dirname "$(readlink -f "$0")")
+imgdir=$(readlink -f "${qdir}/..")
 prognm=$(basename "$0")

 usage()
@@ -40,7 +43,7 @@ usage()
    echo "         Also, qemu.cfg has QEMU_APPEND which can affect this."
    echo
    echo "Example:"
-    echo "  qemu.sh -- finit.debug"
+    echo "  $prognm -- finit.debug"
    echo "___________________________________________________________________"
    echo "Note: 'kconfig-frontends' package (Debian/Ubuntu) must be installed"
    echo "      for -c to work: sudo apt install kconfig-frontents"
@@ -56,12 +59,8 @@ die()

 load_qemucfg()
 {
-    tmp=$(mktemp -p /tmp)
-
-    grep ^CONFIG_QEMU_ "$1" >"$tmp"
    # shellcheck disable=SC1090
-    .  "$tmp"
-    rm "$tmp"
+    .  "./.config"

    [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
    [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
@@ -178,6 +177,8 @@ rw_args()
 {
    [ "$CONFIG_QEMU_RW" ] ||  return

+    command -v mkfs.ext4 >/dev/null || die "$prognm: cannot find mkfs.ext4"
+
    if ! [ -f "aux.ext4" ]; then
 	dd if=/dev/zero of="aux.ext4" bs=1M count=1 >/dev/null 2>&1
 	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
@@ -247,7 +248,7 @@ rocker_port_args()
 net_args()
 {
    # Infix will pick up this file via fwcfg and install it to /etc
-    mactab=${imgdir}/mactab
+    mactab=${qdir}/mactab
    :> "$mactab"
    echo -n "-fw_cfg name=opt/mactab,file=$mactab "

@@ -286,7 +287,7 @@ vpd_args()
 {
    [ "$CONFIG_QEMU_VPD" = "y" ] || return

-    vpd_file="${imgdir}/vpd"
+    vpd_file="${qdir}/vpd"

    if ! [ -f "$vpd_file" ]; then
 	onieprom="${imgdir}/onieprom"
@@ -430,7 +431,7 @@ dtb_args()

 	# Extend it with the environment and signing information in
 	# u-boot.dtb.
-	echo "qemu.dtb u-boot.dtb" | \
+	echo "qemu.dtb ../u-boot.dtb" | \
 	    xargs -n 1 dtc -I dtb -O dts | \
 	    { echo "/dts-v1/;"; sed  -e 's:/dts-v[0-9]\+/;::'; } | \
 	    dtc >qemu-extended.dtb 2>/dev/null
@@ -439,7 +440,7 @@ dtb_args()
 	echo -n "-dtb qemu-extended.dtb "
    else
 	# Otherwise we just use the unmodified one
-	echo -n "-dtb u-boot.dtb "
+	echo -n "-dtb ../u-boot.dtb "
    fi
 }

@@ -485,13 +486,12 @@ EOF

 menuconfig()
 {
-    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the output/images directory"
+    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the $$O/images/qemu directory"
    command -v kconfig-mconf >/dev/null || die "$prognm: cannot find kconfig-mconf for menuconfig"
    exec kconfig-mconf Config.in
 }

-scriptdir=$(dirname "$(readlink -f "$0")")
-cd "$scriptdir" || (echo "Failed cd to $scriptdir"; exit 1)
+cd "$qdir" || (echo "Failed cd to $qdir"; exit 1)

 while [ "$1" != "" ]; do
    case $1 in
@@ -510,13 +510,7 @@ while [ "$1" != "" ]; do
    shift
 done

-if [ -f .config ]; then
-    # Customized settings from 'qemu.sh -c'
-    load_qemucfg .config
-else
-    # Shipped defaults from release tarball
-    load_qemucfg qemu.cfg
-fi
+load_qemucfg

 if [ -z "$QEMU_EXTRA_APPEND" ]; then
    QEMU_EXTRA_APPEND="$*"
@@ -1,28 +0,0 @@
-/dts-v1/;
-
-/ {
-	description = "Infix";
-	creator = "infix";
-	#address-cells = <0x1>;
-
-	images {
-		rootfs {
-			description = "Infix";
-			type = "ramdisk";
-			os = "linux";
-			compression = "none";
-			data = /incbin/("rootfs.squashfs");
-			signature-1 {
-				algo = "sha256,rsa4096";
-				key-name-hint = "infix";
-			};
-		};
-	};
-
-	configurations {
-		default = "verity";
-		verity {
-			ramdisk = "rootfs";
-		};
-	};
-};
@@ -40,11 +40,12 @@ log()
    less +G -r "$fn"
 }

-follow()
+follow ()
 {
    local fn="/var/log/syslog"
    [ -n "$1" ] && fn="/var/log/$1"
-    less +F -r "$fn"
+
+    tail -F -n +1 "$fn"
 }

 _logfile_completions()
@@ -1,2 +1,2 @@
 # --log-level debug
-ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog "
+ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog --log-level err"
@@ -5,4 +5,5 @@
 # 'podman load', must not have a timeout.
 sysv    log:prio:local1,tag:%i kill:30 pid:!/run/container:%i.pid \
 	pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container   \
+	cgroup.system,delegate					  \
 	[2345] <!> :%i container -n %i -- container %i
@@ -0,0 +1,3 @@
+service <!> name:hostapd :%i \
+	[2345] hostapd -P/var/run/hostapd-%i.pid  /etc/hostapd-%i.conf \
+	-- Wi-Fi Access Point @%i
@@ -1,3 +1,3 @@
-service name:rousette notify:none log <pid/confd> env:/etc/default/confd \
+service name:rousette notify:none log:null <pid/confd> env:/etc/default/confd \
 	[12345] rousette --syslog -t $CONFD_TIMEOUT \
 	-- RESTCONF server
@@ -1,5 +1,3 @@
 service name:wpa_supplicant :%i \
-			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
-			       -- WPA supplicant @%i
-
-task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i
+	[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+	-- Wi-Fi Station @%i
@@ -1,23 +1,15 @@
 # Virtual filesystems
-devtmpfs	/dev		devtmpfs	defaults		0	0
-mkdir#-p	/dev/pts	helper		none			0	0
-devpts		/dev/pts	devpts		mode=620,ptmxmode=0666	0	0
-mkdir#-p	/dev/shm	helper		none			0	0
-tmpfs		/dev/shm	tmpfs		mode=0777		0	0
-proc		/proc		proc		defaults		0	0
-tmpfs		/tmp		tmpfs		mode=1777,nosuid,nodev	0	0
-tmpfs		/run		tmpfs		mode=0755,nosuid,nodev	0	0
-tmpfs		/media		tmpfs		mode=1755,nosuid,nodev	0	0
-sysfs		/sys		sysfs		defaults		0	0
-debugfs	/sys/kernel/debug	debugfs		nofail			0	0
-cfgfs		/config		configfs	nofail,noauto		0	0
+tmpfs		/run		  tmpfs		mode=0755,nosuid,nodev	0	0
+tmpfs		/media		  tmpfs		mode=1755,nosuid,nodev	0	0
+debugfs		/sys/kernel/debug debugfs	nofail			0	0
+cfgfs		/config		  configfs	nofail,noauto		0	0

 # The chosen backing storage for the overlays placed on /cfg, /etc,
 # /home, /root, and /var, are determined dynamically by /usr/libexec/infix/mnt
 # depending on the available devices.
 mnttmp		/mnt/tmp	tmpfs	defaults					0	0
-LABEL=aux	/mnt/aux	auto	noatime,nodiratime,noauto,errors=remount-ro	0	0
-LABEL=var	/mnt/var	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
-LABEL=cfg	/mnt/cfg	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
+LABEL=aux	/mnt/aux	auto	noatime,nodiratime,noauto			0	0
+LABEL=var	/mnt/var	ext4	noatime,nodiratime,noauto			0	0
+LABEL=cfg	/mnt/cfg	ext4	noatime,nodiratime,noauto			0	0
 hostfs		/mnt/host	9p	cache=none,msize=16384,noauto			0	0
 /usr/libexec/infix/mnt#	/cfg	helper	none						0	0
@@ -19,6 +19,14 @@ http {

    include /etc/nginx/enabled/*.conf;

-    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=info;
-    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 info;
+    # Skip 2xx and 3xx
+    # Skip 400 (e.g., rrousette syntax errors)
+    map $status $loggable {
+    	~^[23]  0;
+	400 	0;
+	default 1;
+    }
+
+    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=warn combined if=$loggable;
+    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 warn;
 }
@@ -4,14 +4,14 @@ alias ll='ls -alF'
 alias ls='ls --color=auto'

 export LANG=C.UTF-8
-export EDITOR=/usr/bin/edit
-export VISUAL=/usr/bin/edit
+export EDITOR=/usr/bin/editor
+export VISUAL=/usr/bin/editor
 export LESS="-P %f (press h for help or q to quit)"
 export LESSOPEN="|/usr/bin/lesspipe.sh %s"
 alias vim='vi'
 alias view='vi -R'
 alias emacs='mg'
-alias sensible-editor=edit
+alias sensible-editor=editor
 alias sensible-pager=pager
 alias hd="hexdump -C"

@@ -0,0 +1,3 @@
+# Rename WiFi PHY devices from phy0 to radio0 to avoid name clashes
+SUBSYSTEM=="ieee80211", ACTION=="add", KERNEL=="phy*", \
+  RUN+="/bin/sh -c '/usr/sbin/iw phy %k set name radio%n'"
@@ -0,0 +1,7 @@
+# Remove kernel-created WiFi interfaces
+# All WiFi interfaces are now virtual interfaces created by confd
+SUBSYSTEM=="net", ACTION=="add", KERNEL=="wlan*", \
+  TEST=="/sys/class/net/$name/phy80211/name", \
+  PROGRAM="/bin/cat /sys/class/net/%k/phy80211/name", \
+  TEST!="/run/wifi-cleaned-%c", \
+  RUN+="/bin/sh -c '/usr/sbin/iw dev %k del && touch /run/wifi-cleaned-%c'"
@@ -1 +0,0 @@
-SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"
@@ -90,9 +90,9 @@ reset-reason {

 # Monitors file descriptor leaks based on /proc/sys/fs/file-nr
 filenr {
-#    enabled = true
-    interval = 300
-    logmark  = false
+    enabled = true
+    interval = 3600
+    logmark  = true
    warning  = 0.9
    critical = 1.0
 #    script = "/path/to/alt-reboot-action.sh"
@@ -102,33 +102,42 @@ filenr {
 # The script is called with fsmon as the first argument and there
 # are two environment variables FSMON_NAME, for the monitored path,
 # and FSMON_TYPE indicating either 'blocks' or 'inodes'.
-#fsmon /var {
-#    enabled = true
-#    interval = 300
-#    logmark  = false
-#    warning  = 0.95
-#    critical = 1.0
-#    script = "/path/to/alt-reboot-action.sh"
-#}
-
-# Monitors load average based on sysinfo() from /proc/loadavg
-# The level is composed from the average of the 1 and 5 min marks.
-loadavg {
-#    enabled = true
-    interval = 300
-    logmark  = false
-    warning  = 1.0
-    critical = 2.0
+fsmon /var {
+    enabled = true
+    interval = 3600
+    logmark  = true
+    warning  = 0.95
+    critical = 1.0
 #    script = "/path/to/alt-reboot-action.sh"
 }

+fsmon /tmp {
+    enabled = true
+    interval = 3600
+    logmark  = true
+    warning  = 0.95
+    critical = 1.0
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
+# Monitors load average based on sysinfo() from /proc/loadavg
+# The level is composed from the average of the 1 and 5 min marks.
+#loadavg {
+#    enabled = true
+#    interval = 300
+#    logmark  = true
+#    warning  = 1.0
+#    critical = 2.0
+#    script = "/path/to/alt-reboot-action.sh"
+#}
+
 # Monitors free RAM based on data from /proc/meminfo
 meminfo {
-#    enabled = true
-    interval = 300
-    logmark  = false
+    enabled = true
+    interval = 3600
+    logmark  = true
    warning  = 0.9
-    critical = 0.95
+    critical = 0.97
 #    script = "/path/to/alt-reboot-action.sh"
 }

@@ -1,58 +0,0 @@
-#!/bin/sh
-# User-friendly wrapper for sysrepocfg
-# TODO: add import/export, copy, ...
-
-# Edit YANG binary types using sysrepo, base64, and duct tape.
-edit()
-{
-    xpath=$1
-    if [ -z "$xpath" ]; then
-	echo "Usage: cfg edit \"/full/xpath/to/binary/leaf\""
-	exit 1
-    fi
-
-    if tmp=$(sysrepocfg -G "$xpath"); then
-	file=$(mktemp)
-
-	echo "$tmp" | base64 -d > "$file"
-	if /usr/bin/editor "$file"; then
-	    tmp=$(base64 -w0 < "$file")
-	    sysrepocfg -S "$xpath" -u "$tmp"
-	fi
-
-	rm -f "$file"
-    else
-	echo "Failed to retrieve value for $xpath"
-	exit 1
-    fi
-}
-
-usage()
-{
-    echo "Usage:"
-    echo "    cfg CMD [ARG]"
-    echo
-    echo "Command:"
-    echo "    edit XPATH   Edit YANG binary type"
-    echo "    help         This help text"
-    echo
-    echo "As a backwards compatible fallback, this script forwards"
-    echo "all other commands as options to sysrepocfg."
-    echo
-
-    exit 0
-}
-
-cmd=$1; shift
-case $cmd in
-    edit)
-	edit "$1"
-	;;
-    help)
-	usage
-	;;
-    *)
-	set -- "$cmd" "$@"
-	exec sysrepocfg -f json "$@"
-	;;
-esac
@@ -1 +0,0 @@
-/etc/alternatives/editor
@@ -91,7 +91,7 @@ EOF

 is_dhcp_running()
 {
-    sysrepocfg -X -f json -m infix-dhcp-server | jq -r '
+    copy operational -x /infix-dhcp-server:dhcp-server | jq -r '
        ."infix-dhcp-server:dhcp-server".enabled as $global |
        if ."infix-dhcp-server:dhcp-server".subnet? then
                (."infix-dhcp-server:dhcp-server".subnet[] |
@@ -110,15 +110,15 @@ dhcp()

    case $1 in
 	detail)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
+	    copy operational -x /infix-dhcp-server:dhcp-server | \
 		jq -C .
 	    ;;
 	stat*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
+	    copy operational -x /infix-dhcp-server:dhcp-server | \
 		/usr/libexec/statd/cli-pretty "show-dhcp-server" -s
 	    ;;
 	*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
+	    copy operational -x /infix-dhcp-server:dhcp-server | \
 		/usr/libexec/statd/cli-pretty "show-dhcp-server"
 	    ;;
    esac
@@ -182,13 +182,13 @@ ifaces()
    else
 	if [ $# -gt 0 ]; then
 	    for iface in $*; do
-		sysrepocfg -f json -X -d operational -x \
+		copy operational -x \
 			   "/ietf-interfaces:interfaces/interface[name='$iface']" | \
 		    /usr/libexec/statd/cli-pretty "show-interfaces" -n "$iface"
 	    done
 	    return
 	fi
-        sysrepocfg -f json -X -d operational -m ietf-interfaces | \
+        copy operational -x /ietf-interfaces:interfaces | \
          /usr/libexec/statd/cli-pretty "show-interfaces"
    fi
 }
@@ -227,7 +227,7 @@ rstp()

 stp()
 {
-    sysrepocfg -f json -X -d operational -m ietf-interfaces | \
+    copy operational -x /ietf-interfaces:interfaces | \
        /usr/libexec/statd/cli-pretty "show-bridge-stp"
 }

@@ -248,7 +248,7 @@ routes()
    else
 	arg="-i ipv4"
    fi
-    sysrepocfg -f json -X -d operational -x "/ietf-routing:routing/ribs" | \
+    copy operational -x /ietf-routing:routing/ribs | \
 	/usr/libexec/statd/cli-pretty "show-routing-table" $arg
 }

@@ -1,13 +1,13 @@
 #!/usr/bin/env python3
-import importlib.machinery
+
 import json
+import onieprom
 import os
 import shutil
 import struct
 import subprocess
 import sys

-onieprom = importlib.machinery.SourceFileLoader("onieprom", "/bin/onieprom").load_module()
 SYSTEM_JSON = "/run/system.json"
 KKIT_IANA_PEM = 61046

@@ -0,0 +1,600 @@
+#!/usr/bin/env python3
+"""
+iw command wrapper that returns structured JSON data
+
+Usage:
+    iw.py list                  - List all PHY devices
+    iw.py dev                   - List all interfaces grouped by PHY
+    iw.py info <device>         - Get PHY or interface information
+    iw.py survey <interface>    - Get channel survey data
+"""
+
+import sys
+import json
+import subprocess
+import re
+def decode_iw_ssid(ssid):
+    """Decode iw escaped SSID (\\xHH) to UTF-8, stripping non-printable chars."""
+    try:
+        ssid = ssid.encode().decode('unicode_escape').encode('latin-1').decode('utf-8')
+    except (UnicodeDecodeError, UnicodeEncodeError):
+        return ssid
+    return ''.join(c for c in ssid if c.isprintable())
+
+
+def run_iw(*args):
+    """Run iw command and return output"""
+    try:
+        result = subprocess.run(
+            ['iw'] + list(args),
+            capture_output=True,
+            text=True,
+            timeout=5
+        )
+        if result.returncode == 0:
+            return result.stdout
+        return None
+    except Exception:
+        return None
+
+
+def normalize_phy_name(name):
+    """
+    Convert radioN to phyN or vice versa based on what exists in sysfs.
+    Returns the actual phy name that exists.
+    """
+    import os
+
+    # Try the name as-is first
+    if os.path.exists(f'/sys/class/ieee80211/{name}'):
+        return name
+
+    # Try converting radioN <-> phyN
+    if name.startswith('radio'):
+        phy_name = 'phy' + name[5:]
+        if os.path.exists(f'/sys/class/ieee80211/{phy_name}'):
+            return phy_name
+    elif name.startswith('phy'):
+        radio_name = 'radio' + name[3:]
+        if os.path.exists(f'/sys/class/ieee80211/{radio_name}'):
+            return radio_name
+
+    # Return original if nothing found
+    return name
+
+
+def parse_phy_info(phy_name):
+    """
+    Parse 'iw phy <name> info' output or 'iw <name> info' output
+    Returns: {bands, driver, manufacturer, max_txpower, num_virtual_interfaces, interface_combinations}
+    """
+    # Normalize the phy name
+    actual_phy = normalize_phy_name(phy_name)
+
+    # Try 'iw phy <name> info' first
+    output = run_iw('phy', actual_phy, 'info')
+
+    # If that fails, try 'iw <name> info' (some systems support this)
+    if not output:
+        output = run_iw(actual_phy, 'info')
+
+    if not output:
+        return {}
+
+    result = {
+        'name': phy_name,
+        'bands': [],
+        'driver': None,
+        'manufacturer': None,
+        'max_txpower': None,
+        'num_virtual_interfaces': 0,
+        'interface_combinations': []
+    }
+
+    current_band = None
+    band_num = 0
+    in_combinations = False
+    max_power = None
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # Detect band sections
+        if stripped.startswith('Band '):
+            if current_band and current_band.get('frequencies'):
+                result['bands'].append(current_band)
+            band_num += 1
+            current_band = {
+                'band': band_num,
+                'frequencies': [],
+                'name': None,
+                'ht_capable': False,
+                'vht_capable': False,
+                'he_capable': False
+            }
+            in_combinations = False
+
+        # Parse frequencies (handle both "2412 MHz" and "2412.0 MHz" formats)
+        elif current_band and not in_combinations:
+            freq_match = re.match(r'\* ([0-9.]+) MHz.*?\(([0-9.]+) dBm\)', stripped)
+            if freq_match:
+                freq = int(float(freq_match.group(1)))  # Convert "2412.0" to 2412
+                power = float(freq_match.group(2))
+
+                current_band['frequencies'].append(freq)
+
+                # Track max power
+                if max_power is None or power > max_power:
+                    max_power = power
+
+            # Check capabilities
+            if 'HT ' in stripped or 'High Throughput' in stripped:
+                current_band['ht_capable'] = True
+            if 'VHT' in stripped or 'Very High Throughput' in stripped:
+                current_band['vht_capable'] = True
+            if 'HE ' in stripped or 'High Efficiency' in stripped:
+                current_band['he_capable'] = True
+
+        # Detect interface combinations section
+        if 'valid interface combinations:' in stripped.lower():
+            in_combinations = True
+            continue
+
+        # Parse interface combinations
+        if in_combinations:
+            if stripped.startswith('*'):
+                # Parse combination line
+                comb_info = {'limits': []}
+
+                # Parse limits: #{ type } <= max
+                limit_matches = re.findall(r'#\{\s*([^}]+)\s*\}\s*<=\s*(\d+)', stripped)
+                for types_str, max_val in limit_matches:
+                    types = [t.strip() for t in types_str.split(',')]
+                    comb_info['limits'].append({
+                        'max': int(max_val),
+                        'types': types
+                    })
+
+                # Parse total
+                total_match = re.search(r'total\s*<=\s*(\d+)', stripped)
+                if total_match:
+                    comb_info['max_total'] = int(total_match.group(1))
+
+                # Parse channels
+                channels_match = re.search(r'#channels\s*<=\s*(\d+)', stripped)
+                if channels_match:
+                    comb_info['num_channels'] = int(channels_match.group(1))
+
+                if comb_info.get('limits') or comb_info.get('max_total'):
+                    result['interface_combinations'].append(comb_info)
+
+            elif not stripped.startswith('#') and ':' in stripped and not stripped.startswith('*'):
+                # End of combinations section
+                in_combinations = False
+
+    # Add last band
+    if current_band and current_band.get('frequencies'):
+        result['bands'].append(current_band)
+
+    # Determine band names and assign band numbers
+    for band in result['bands']:
+        if band['frequencies']:
+            freq = band['frequencies'][0]
+            if 2400 <= freq <= 2500:
+                band['name'] = '2.4GHz'
+                band['band'] = 1
+            elif 5150 <= freq <= 5900:
+                band['name'] = '5GHz'
+                band['band'] = 2
+            elif 5955 <= freq <= 7115:
+                band['name'] = '6GHz'
+                band['band'] = 3
+
+    # Set max TX power
+    if max_power is not None:
+        result['max_txpower'] = int(max_power)
+
+    # Get driver and manufacturer from sysfs
+    try:
+        driver_link = subprocess.run(
+            ['readlink', '-f', f'/sys/class/ieee80211/{actual_phy}/device/driver'],
+            capture_output=True, text=True, timeout=1
+        ).stdout.strip()
+
+        if driver_link:
+            driver_name = driver_link.split('/')[-1]
+            result['driver'] = driver_name
+
+            # Map driver to manufacturer
+            driver_lower = driver_name.lower()
+            if 'mt' in driver_lower or 'mediatek' in driver_lower:
+                result['manufacturer'] = 'MediaTek Inc.'
+            elif 'rtw' in driver_lower or 'realtek' in driver_lower:
+                result['manufacturer'] = 'Realtek Semiconductor Corp.'
+            elif 'ath' in driver_lower or 'qca' in driver_lower:
+                result['manufacturer'] = 'Qualcomm Atheros'
+            elif 'iwl' in driver_lower or 'intel' in driver_lower:
+                result['manufacturer'] = 'Intel Corporation'
+            elif 'brcm' in driver_lower or 'broadcom' in driver_lower:
+                result['manufacturer'] = 'Broadcom Inc.'
+    except Exception:
+        pass
+
+    # Count virtual interfaces
+    dev_output = run_iw('dev')
+    if dev_output:
+        # Extract phy number from actual phy name
+        phy_num = None
+        if actual_phy.startswith('radio'):
+            phy_num = actual_phy[5:]
+        elif actual_phy.startswith('phy'):
+            phy_num = actual_phy[3:]
+
+        if phy_num:
+            count = 0
+            current_phy = None
+            for line in dev_output.splitlines():
+                if line.startswith('phy#'):
+                    current_phy = line.replace('phy#', '').strip()
+                elif current_phy == phy_num and 'Interface' in line:
+                    count += 1
+            result['num_virtual_interfaces'] = count
+
+    return result
+
+
+def parse_interface_info(ifname):
+    """
+    Parse 'iw dev <name> info' output
+    Returns: {ifname, iftype, mac, ssid, frequency, channel, txpower, channel_width}
+    """
+    output = run_iw('dev', ifname, 'info')
+    if not output:
+        return {}
+
+    result = {'ifname': ifname}
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # Interface type
+        if stripped.startswith('type '):
+            result['iftype'] = stripped.split()[1]
+
+        # MAC address
+        elif stripped.startswith('addr '):
+            result['mac'] = stripped.split()[1]
+
+        # SSID
+        elif stripped.startswith('ssid '):
+            result['ssid'] = decode_iw_ssid(' '.join(stripped.split()[1:]))
+
+        # Channel/frequency
+        elif stripped.startswith('channel '):
+            parts = stripped.split()
+            if len(parts) >= 2:
+                result['channel'] = int(parts[1])
+            if 'MHz' in stripped:
+                freq_match = re.search(r'\((\d+) MHz', stripped)
+                if freq_match:
+                    result['frequency'] = int(freq_match.group(1))
+            # Channel width
+            if 'width:' in stripped:
+                width_match = re.search(r'width:\s*(\d+)\s*MHz', stripped)
+                if width_match:
+                    result['channel_width'] = f"{width_match.group(1)} MHz"
+
+        # TX power
+        elif stripped.startswith('txpower '):
+            power_match = re.search(r'([0-9.]+) dBm', stripped)
+            if power_match:
+                result['txpower'] = float(power_match.group(1))
+
+    return result
+
+
+def parse_stations(ifname):
+    """
+    Parse 'iw dev <name> station dump' output
+    Returns: list of connected stations with stats
+    """
+    output = run_iw('dev', ifname, 'station', 'dump')
+    if not output:
+        return []
+
+    stations = []
+    current = None
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # New station entry: "Station aa:bb:cc:dd:ee:ff (on wifiX)"
+        if stripped.startswith('Station '):
+            if current:
+                stations.append(current)
+            parts = stripped.split()
+            if len(parts) >= 2:
+                current = {'mac-address': parts[1].lower()}
+            else:
+                current = None
+            continue
+
+        if not current or ':' not in stripped:
+            continue
+
+        key, _, value = stripped.partition(':')
+        key = key.strip()
+        value = value.strip()
+
+        try:
+            if key == 'signal':
+                # Format: "-42 dBm" or "-42 [-44, -45] dBm"
+                current['signal-strength'] = int(value.split()[0])
+            elif key == 'connected time':
+                # Format: "123 seconds"
+                current['connected-time'] = int(value.split()[0])
+            elif key == 'rx bytes':
+                current['rx-bytes'] = value  # counter64: string-encoded
+            elif key == 'tx bytes':
+                current['tx-bytes'] = value  # counter64: string-encoded
+            elif key == 'rx packets':
+                current['rx-packets'] = value  # counter64: string-encoded
+            elif key == 'tx packets':
+                current['tx-packets'] = value  # counter64: string-encoded
+            elif key == 'tx bitrate':
+                # Format: "866.7 MBit/s ..." - convert to 100kbit/s units
+                speed_mbps = float(value.split()[0])
+                current['tx-speed'] = int(speed_mbps * 10)
+            elif key == 'rx bitrate':
+                speed_mbps = float(value.split()[0])
+                current['rx-speed'] = int(speed_mbps * 10)
+            elif key == 'inactive time':
+                # Format: "1234 ms"
+                current['inactive-time'] = int(value.split()[0])
+        except (ValueError, IndexError):
+            continue
+
+    if current:
+        stations.append(current)
+
+    return stations
+
+
+def parse_survey(ifname):
+    """
+    Parse 'iw dev <name> survey dump' output
+    Returns: list of {frequency, in_use, noise, active_time, busy_time, receive_time, transmit_time}
+    """
+    output = run_iw('dev', ifname, 'survey', 'dump')
+    if not output:
+        return []
+
+    channels = []
+    current_channel = None
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # New survey entry
+        if stripped.startswith('Survey data from'):
+            if current_channel:
+                channels.append(current_channel)
+            current_channel = None
+
+        # Frequency
+        elif stripped.startswith('frequency:'):
+            parts = stripped.split()
+            if len(parts) >= 2:
+                freq = int(parts[1])
+                in_use = '[in use]' in stripped
+                current_channel = {
+                    'frequency': freq,
+                    'in_use': in_use
+                }
+
+        # Channel metrics
+        elif current_channel:
+            if stripped.startswith('noise:'):
+                noise_match = re.search(r'(-?\d+) dBm', stripped)
+                if noise_match:
+                    current_channel['noise'] = int(noise_match.group(1))
+
+            elif stripped.startswith('channel active time:'):
+                time_match = re.search(r'(\d+) ms', stripped)
+                if time_match:
+                    current_channel['active_time'] = int(time_match.group(1))
+
+            elif stripped.startswith('channel busy time:'):
+                time_match = re.search(r'(\d+) ms', stripped)
+                if time_match:
+                    current_channel['busy_time'] = int(time_match.group(1))
+
+            elif stripped.startswith('channel receive time:'):
+                time_match = re.search(r'(\d+) ms', stripped)
+                if time_match:
+                    current_channel['receive_time'] = int(time_match.group(1))
+
+            elif stripped.startswith('channel transmit time:'):
+                time_match = re.search(r'(\d+) ms', stripped)
+                if time_match:
+                    current_channel['transmit_time'] = int(time_match.group(1))
+
+    # Add last channel
+    if current_channel:
+        channels.append(current_channel)
+
+    return channels
+
+
+def parse_list():
+    """
+    Parse 'iw list' output
+    Returns: list of PHY names
+    """
+    output = run_iw('list')
+    if not output:
+        return []
+
+    phys = []
+    for line in output.splitlines():
+        match = re.match(r'Wiphy (phy\d+|radio\d+)', line)
+        if match:
+            phys.append(match.group(1))
+
+    return phys
+
+
+def parse_dev():
+    """
+    Parse 'iw dev' output
+    Returns: dict mapping PHY numbers to list of interfaces
+    """
+    output = run_iw('dev')
+    if not output:
+        return {}
+
+    result = {}
+    current_phy = None
+
+    for line in output.splitlines():
+        # PHY line: "phy#0" or "phy#1"
+        if line.startswith('phy#'):
+            current_phy = line.replace('phy#', '').strip()
+            if current_phy not in result:
+                result[current_phy] = []
+        # Interface line: "    Interface wlan0"
+        elif current_phy and 'Interface' in line:
+            ifname = line.split('Interface')[1].strip()
+            result[current_phy].append(ifname)
+
+    return result
+
+
+def parse_link(ifname):
+    """
+    Parse 'iw dev <name> link' output for station mode
+    Returns: {connected, bssid, ssid, frequency, signal, tx_bitrate, rx_bitrate}
+    """
+    output = run_iw('dev', ifname, 'link')
+    if not output:
+        return {'connected': False}
+
+    if 'Not connected' in output:
+        return {'connected': False}
+
+    result = {'connected': True}
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # Connected to aa:bb:cc:dd:ee:ff
+        if stripped.startswith('Connected to '):
+            parts = stripped.split()
+            if len(parts) >= 3:
+                result['bssid'] = parts[2].lower()
+
+        # SSID: NetworkName
+        elif stripped.startswith('SSID: '):
+            result['ssid'] = decode_iw_ssid(stripped[6:])
+
+        # freq: 5180
+        elif stripped.startswith('freq: '):
+            try:
+                result['frequency'] = int(stripped[6:])
+            except ValueError:
+                pass
+
+        # signal: -42 dBm
+        elif stripped.startswith('signal: '):
+            try:
+                result['signal-strength'] = int(stripped.split()[1])
+            except (ValueError, IndexError):
+                pass
+
+        # tx bitrate: 866.7 MBit/s ...
+        elif stripped.startswith('tx bitrate: '):
+            try:
+                speed = float(stripped.split()[2])
+                result['tx-speed'] = int(speed * 10)  # 100kbit/s units
+            except (ValueError, IndexError):
+                pass
+
+        # rx bitrate: 780.0 MBit/s ...
+        elif stripped.startswith('rx bitrate: '):
+            try:
+                speed = float(stripped.split()[2])
+                result['rx-speed'] = int(speed * 10)
+            except (ValueError, IndexError):
+                pass
+
+    return result
+
+
+def main():
+    if len(sys.argv) < 2:
+        print(json.dumps({
+            'error': 'Usage: iw.py <command> [device]',
+            'commands': {
+                'list': 'List all PHY devices',
+                'dev': 'List all interfaces grouped by PHY',
+                'info': 'Get PHY or interface information (requires device)',
+                'survey': 'Get channel survey data (requires interface)',
+                'station': 'Get connected stations in AP mode (requires interface)',
+                'link': 'Get link info in station mode (requires interface)'
+            },
+            'examples': [
+                'iw.py list',
+                'iw.py dev',
+                'iw.py info radio0',
+                'iw.py info wlan0',
+                'iw.py station wifi0',
+                'iw.py link wlan0',
+                'iw.py survey wlan0'
+            ]
+        }, indent=2))
+        sys.exit(1)
+
+    command = sys.argv[1]
+
+    try:
+        if command == 'list':
+            data = parse_list()
+        elif command == 'dev':
+            data = parse_dev()
+        elif command == 'info':
+            if len(sys.argv) < 3:
+                data = {'error': 'info command requires device argument'}
+            else:
+                device = sys.argv[2]
+                # Auto-detect if device is a PHY (phy*/radio*) or interface
+                if device.startswith('phy') or device.startswith('radio'):
+                    data = parse_phy_info(device)
+                else:
+                    data = parse_interface_info(device)
+        elif command == 'station':
+            if len(sys.argv) < 3:
+                data = {'error': 'station command requires interface argument'}
+            else:
+                data = parse_stations(sys.argv[2])
+        elif command == 'link':
+            if len(sys.argv) < 3:
+                data = {'error': 'link command requires interface argument'}
+            else:
+                data = parse_link(sys.argv[2])
+        elif command == 'survey':
+            if len(sys.argv) < 3:
+                data = {'error': 'survey command requires interface argument'}
+            else:
+                data = parse_survey(sys.argv[2])
+        else:
+            data = {'error': f'Unknown command: {command}'}
+
+        print(json.dumps(data, indent=2, ensure_ascii=False))
+
+    except Exception as e:
+        print(json.dumps({'error': str(e)}))
+        sys.exit(1)
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,724 @@
+#!/usr/bin/env python3
+"""
+WiFi Channel Visualization Tool
+Shows graphical representation of WiFi channel overlap and utilization
+"""
+
+import sys
+import json
+import argparse
+
+
+class Colors:
+    """ANSI color codes for terminal output"""
+    RESET = '\033[0m'
+    BOLD = '\033[1m'
+    RED = '\033[91m'
+    GREEN = '\033[92m'
+    YELLOW = '\033[93m'
+    BLUE = '\033[94m'
+    MAGENTA = '\033[95m'
+    CYAN = '\033[96m'
+    GRAY = '\033[90m'
+    BG_RED = '\033[101m'
+    BG_GREEN = '\033[102m'
+    BG_YELLOW = '\033[103m'
+    BG_BLUE = '\033[104m'
+    BG_GRAY = '\033[100m'
+
+
+def freq_to_channel(freq):
+    """Convert frequency (MHz) to WiFi channel number"""
+    # 2.4 GHz band
+    if 2412 <= freq <= 2484:
+        if freq == 2484:
+            return 14
+        return (freq - 2412) // 5 + 1
+    # 5 GHz band
+    elif 5170 <= freq <= 5825:
+        return (freq - 5000) // 5
+    # 6 GHz band
+    elif 5955 <= freq <= 7115:
+        return (freq - 5950) // 5
+    return None
+
+
+def get_channel_frequency(channel, band='2.4'):
+    """Get center frequency for a channel"""
+    if band == '2.4':
+        if channel == 14:
+            return 2484
+        return 2412 + (channel - 1) * 5
+    elif band == '5':
+        return 5000 + channel * 5
+    return None
+
+
+def get_busy_percentage(channel_data):
+    """Calculate channel busy percentage"""
+    active = channel_data.get('active-time', 0)
+    busy = channel_data.get('busy-time', 0)
+    if active > 0:
+        return (busy / active) * 100
+    return 0
+
+
+def get_utilization_color(busy_pct):
+    """Get color based on channel utilization"""
+    if busy_pct >= 50:
+        return Colors.RED
+    elif busy_pct >= 25:
+        return Colors.YELLOW
+    elif busy_pct >= 10:
+        return Colors.CYAN
+    else:
+        return Colors.GREEN
+
+
+def draw_channel_graph_2_4ghz(survey_data):
+    """Draw channel overlap graph for 2.4 GHz band"""
+    # Parse survey data
+    channels = {}
+    in_use_channel = None
+
+    for ch_data in survey_data:
+        freq = ch_data.get('frequency')
+        ch_num = freq_to_channel(freq)
+        if ch_num and 1 <= ch_num <= 14:
+            busy_pct = get_busy_percentage(ch_data)
+            channels[ch_num] = {
+                'freq': freq,
+                'noise': ch_data.get('noise', -100),
+                'busy': busy_pct,
+                'in_use': ch_data.get('in-use', False),
+                'active_time': ch_data.get('active-time', 0),
+                'busy_time': ch_data.get('busy-time', 0)
+            }
+            if ch_data.get('in-use'):
+                in_use_channel = ch_num
+
+    if not channels:
+        print("No 2.4 GHz channel data available")
+        return
+
+    print(f"\n{Colors.BOLD}2.4 GHz WiFi Channel Overlap Visualization{Colors.RESET}")
+    print("=" * 80)
+    print(f"Channel width: 20 MHz | Channel spacing: 5 MHz")
+    print(f"Non-overlapping channels: 1, 6, 11 (shown in {Colors.GREEN}green{Colors.RESET})")
+    print()
+
+    # Draw frequency scale
+    print("Frequency (MHz):")
+    print("2400        2420        2440        2460        2480")
+    print("|-----------|-----------|-----------|-----------|")
+
+    # Draw each channel as a bar showing its 20 MHz width
+    # Each channel occupies ~4 adjacent channels worth of space
+    for ch in range(1, 14):
+        if ch not in channels:
+            continue
+
+        data = channels[ch]
+        busy_pct = data['busy']
+        is_in_use = data['in_use']
+        noise = data['noise']
+
+        # Determine color based on status
+        if is_in_use:
+            color = Colors.BG_BLUE
+            marker = '█'
+        elif busy_pct >= 50:
+            color = Colors.RED
+            marker = '▓'
+        elif busy_pct >= 25:
+            color = Colors.YELLOW
+            marker = '▒'
+        elif busy_pct > 0:
+            color = Colors.CYAN
+            marker = '░'
+        else:
+            color = Colors.GRAY
+            marker = '·'
+
+        # Non-overlapping channels get green color
+        if ch in [1, 6, 11] and not is_in_use and busy_pct < 10:
+            color = Colors.GREEN
+
+        # Calculate position (each channel is offset by 5 MHz = 1 position)
+        # Channel 1 is at 2412 MHz, base is 2400
+        offset = ((data['freq'] - 2400) // 5)
+
+        # Draw channel bar (20 MHz = 4 positions wide)
+        line = ' ' * 80
+        line_arr = list(line)
+
+        # Mark the channel span (20 MHz width)
+        for i in range(4):
+            pos = offset + i - 2  # Center the 20 MHz around channel
+            if 0 <= pos < len(line_arr):
+                line_arr[pos] = marker
+
+        # Add channel label
+        label_pos = offset
+        if 0 <= label_pos < len(line_arr) - 5:
+            # Clear space for label
+            for i in range(5):
+                if label_pos + i < len(line_arr):
+                    line_arr[label_pos + i] = ' '
+
+        line = ''.join(line_arr)
+
+        # Status indicators
+        status = ""
+        if is_in_use:
+            status = f" {Colors.BOLD}[IN USE]{Colors.RESET}"
+
+        busy_color = get_utilization_color(busy_pct)
+
+        print(f"{color}Ch{ch:2d}{Colors.RESET} {color}{line}{Colors.RESET} "
+              f"{busy_color}{busy_pct:5.1f}%{Colors.RESET} "
+              f"{noise:4d}dBm{status}")
+
+    print("\n" + "=" * 80)
+    print(f"\n{Colors.BOLD}Legend:{Colors.RESET}")
+    print(f"  {Colors.BG_BLUE}██{Colors.RESET} In use (your network)")
+    print(f"  {Colors.RED}▓▓{Colors.RESET} High usage (>50%)")
+    print(f"  {Colors.YELLOW}▒▒{Colors.RESET} Medium usage (25-50%)")
+    print(f"  {Colors.CYAN}░░{Colors.RESET} Low usage (1-25%)")
+    print(f"  {Colors.GRAY}··{Colors.RESET} Idle (<1%)")
+    print()
+
+
+def draw_channel_list(survey_data):
+    """Draw a simple channel list with utilization bars"""
+    print(f"\n{Colors.BOLD}Channel Utilization{Colors.RESET}")
+    print("=" * 80)
+    print(f"{'Ch':<4} {'Freq':<6} {'Noise':<8} {'Busy%':<8} {'Utilization Bar':<40}")
+    print("-" * 80)
+
+    for ch_data in sorted(survey_data, key=lambda x: x.get('frequency', 0)):
+        freq = ch_data.get('frequency')
+        ch_num = freq_to_channel(freq)
+        if not ch_num:
+            continue
+
+        noise = ch_data.get('noise', -100)
+        busy_pct = get_busy_percentage(ch_data)
+        is_in_use = ch_data.get('in-use', False)
+
+        # Create utilization bar (40 chars wide = 100%)
+        bar_length = int(busy_pct * 40 / 100)
+        bar_color = get_utilization_color(busy_pct)
+
+        if is_in_use:
+            bar = f"{Colors.BG_BLUE}{'█' * bar_length}{Colors.RESET}"
+            marker = f" {Colors.BOLD}◀ IN USE{Colors.RESET}"
+        else:
+            bar = f"{bar_color}{'█' * bar_length}{Colors.RESET}"
+            marker = ""
+
+        empty = '░' * (40 - bar_length)
+
+        print(f"{ch_num:<4} {freq:<6} {noise:<8} {busy_pct:5.1f}%  {bar}{Colors.GRAY}{empty}{Colors.RESET}{marker}")
+
+    print()
+
+
+def draw_overlap_pie(survey_data):
+    """Draw a pie-style visualization of channel group utilization"""
+    # Parse channel data into 3 non-overlapping groups
+    # Group 1: channels 1-5 (centered on ch 1)
+    # Group 2: channels 4-8 (centered on ch 6)
+    # Group 3: channels 9-13 (centered on ch 11)
+
+    channels = {}
+    in_use_channel = None
+
+    for ch_data in survey_data:
+        freq = ch_data.get('frequency')
+        ch_num = freq_to_channel(freq)
+        if ch_num and 1 <= ch_num <= 13:
+            busy_pct = get_busy_percentage(ch_data)
+            channels[ch_num] = {
+                'busy': busy_pct,
+                'noise': ch_data.get('noise', -100),
+                'in_use': ch_data.get('in-use', False)
+            }
+            if ch_data.get('in-use'):
+                in_use_channel = ch_num
+
+    if not channels:
+        return
+
+    # Calculate group utilization (average of channels in each group)
+    groups = [
+        {'name': 'Ch 1', 'channels': [1, 2, 3, 4, 5], 'center': 1},
+        {'name': 'Ch 6', 'channels': [4, 5, 6, 7, 8], 'center': 6},
+        {'name': 'Ch 11', 'channels': [9, 10, 11, 12, 13], 'center': 11},
+    ]
+
+    for group in groups:
+        busy_values = [channels.get(ch, {}).get('busy', 0) for ch in group['channels'] if ch in channels]
+        group['avg_busy'] = sum(busy_values) / len(busy_values) if busy_values else 0
+        group['center_busy'] = channels.get(group['center'], {}).get('busy', 0)
+        group['in_use'] = in_use_channel in group['channels'] if in_use_channel else False
+
+    total_busy = sum(g['avg_busy'] for g in groups)
+
+    print(f"\n{Colors.BOLD}Channel Group Utilization (2.4 GHz){Colors.RESET}")
+    print("=" * 60)
+    print("Non-overlapping channel groups with their overlap zones:\n")
+
+    # Draw ASCII donut/pie
+    pie_width = 50
+
+    # Calculate proportions
+    if total_busy > 0:
+        for group in groups:
+            group['proportion'] = group['avg_busy'] / total_busy
+            group['width'] = max(1, int(group['proportion'] * pie_width))
+    else:
+        for group in groups:
+            group['proportion'] = 1/3
+            group['width'] = pie_width // 3
+
+    # Adjust to exactly fill pie_width
+    total_width = sum(g['width'] for g in groups)
+    if total_width < pie_width:
+        groups[0]['width'] += pie_width - total_width
+
+    # Draw the pie bar
+    pie_chars = ['█', '▓', '░']
+    colors = [Colors.GREEN, Colors.YELLOW, Colors.CYAN]
+
+    pie_line = ""
+    for i, group in enumerate(groups):
+        if group['in_use']:
+            color = Colors.BG_BLUE
+        elif group['avg_busy'] >= 50:
+            color = Colors.RED
+        elif group['avg_busy'] >= 25:
+            color = Colors.YELLOW
+        else:
+            color = Colors.GREEN
+
+        char = pie_chars[i % len(pie_chars)]
+        pie_line += f"{color}{char * group['width']}{Colors.RESET}"
+
+    # Draw centered pie
+    print(f"    ┌{'─' * pie_width}┐")
+    print(f"    │{pie_line}│")
+    print(f"    └{'─' * pie_width}┘")
+
+    # Legend with percentages
+    print()
+    for i, group in enumerate(groups):
+        char = pie_chars[i % len(pie_chars)]
+
+        if group['in_use']:
+            color = Colors.BG_BLUE
+            marker = " ◀ IN USE"
+        elif group['avg_busy'] >= 50:
+            color = Colors.RED
+            marker = ""
+        elif group['avg_busy'] >= 25:
+            color = Colors.YELLOW
+            marker = ""
+        else:
+            color = Colors.GREEN
+            marker = ""
+
+        pct_of_total = group['proportion'] * 100
+        print(f"    {color}{char * 3}{Colors.RESET} {group['name']:>5}: "
+              f"{group['center_busy']:5.1f}% busy (center), "
+              f"{group['avg_busy']:5.1f}% avg in overlap zone, "
+              f"{pct_of_total:4.1f}% of total{marker}")
+
+    # Draw overlap diagram
+    print(f"\n{Colors.BOLD}Channel Overlap Diagram:{Colors.RESET}")
+    print("    Ch:  1   2   3   4   5   6   7   8   9  10  11  12  13")
+    print("        ╔═══════════════════╗")
+    print("    G1: ║ 1 ─ 2 ─ 3 ─ 4 ─ 5 ║         (centered on ch 1)")
+    print("        ╚═══════╦═══════════╝")
+    print("                ╔═══════════════════╗")
+    print("    G2:         ║ 4 ─ 5 ─ 6 ─ 7 ─ 8 ║ (centered on ch 6)")
+    print("                ╚═══════════╦═══════╝")
+    print("                        ╔═══════════════════════╗")
+    print("    G3:                 ║ 9 ─10 ─11 ─12 ─13 ║   (centered on ch 11)")
+    print("                        ╚═══════════════════════╝")
+    print()
+
+
+def generate_svg(survey_data, output_file=None):
+    """Generate SVG image(s) showing channel overlap and utilization for both bands"""
+    # Separate channels by band
+    channels_2_4 = {}
+    channels_5 = {}
+    in_use_2_4 = None
+    in_use_5 = None
+
+    for ch_data in survey_data:
+        freq = ch_data.get('frequency')
+        ch_num = freq_to_channel(freq)
+        if not ch_num:
+            continue
+
+        busy_pct = get_busy_percentage(ch_data)
+        ch_info = {
+            'freq': freq,
+            'busy': busy_pct,
+            'noise': ch_data.get('noise', -100),
+            'in_use': ch_data.get('in-use', False)
+        }
+
+        if 2400 <= freq <= 2500:
+            channels_2_4[ch_num] = ch_info
+            if ch_info['in_use']:
+                in_use_2_4 = ch_num
+        elif 5100 <= freq <= 5900:
+            channels_5[ch_num] = ch_info
+            if ch_info['in_use']:
+                in_use_5 = ch_num
+
+    def busy_to_color(busy_pct, is_in_use=False):
+        if is_in_use:
+            return "#3b82f6"  # Blue
+        elif busy_pct >= 50:
+            return "#ef4444"  # Red
+        elif busy_pct >= 25:
+            return "#f59e0b"  # Yellow/Orange
+        elif busy_pct >= 10:
+            return "#06b6d4"  # Cyan
+        else:
+            return "#22c55e"  # Green
+
+    def generate_band_svg(channels, band, freq_min, freq_max, title, non_overlap_channels=None):
+        if not channels:
+            return None
+
+        width = 900
+        height = 400
+        margin_left = 60
+        margin_right = 40
+        margin_top = 60
+        margin_bottom = 80
+        chart_width = width - margin_left - margin_right
+        chart_height = height - margin_top - margin_bottom
+
+        def freq_to_x(freq):
+            return margin_left + (freq - freq_min) / (freq_max - freq_min) * chart_width
+
+        def busy_to_height(busy_pct):
+            return (busy_pct / 100) * chart_height
+
+        svg_parts = []
+
+        # SVG header
+        svg_parts.append(f'''<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 {width} {height}">
+  <defs>
+    <style>
+      .title {{ font: bold 18px sans-serif; fill: #333; }}
+      .label {{ font: 12px sans-serif; fill: #666; }}
+      .axis {{ font: 10px sans-serif; fill: #333; }}
+      .channel-label {{ font: bold 10px sans-serif; fill: #333; }}
+      .legend {{ font: 12px sans-serif; fill: #333; }}
+    </style>
+  </defs>
+
+  <!-- Background -->
+  <rect width="{width}" height="{height}" fill="#fafafa"/>
+
+  <!-- Title -->
+  <text x="{width/2}" y="30" text-anchor="middle" class="title">{title}</text>
+
+  <!-- Chart area -->
+  <rect x="{margin_left}" y="{margin_top}" width="{chart_width}" height="{chart_height}" fill="#fff" stroke="#ddd"/>
+''')
+
+        # Draw grid lines
+        for pct in [25, 50, 75, 100]:
+            y = margin_top + chart_height - busy_to_height(pct)
+            svg_parts.append(f'  <line x1="{margin_left}" y1="{y}" x2="{margin_left + chart_width}" y2="{y}" stroke="#eee" stroke-dasharray="4,4"/>')
+            svg_parts.append(f'  <text x="{margin_left - 5}" y="{y + 4}" text-anchor="end" class="axis">{pct}%</text>')
+
+        # Y-axis label
+        svg_parts.append(f'  <text x="15" y="{margin_top + chart_height/2}" text-anchor="middle" transform="rotate(-90, 15, {margin_top + chart_height/2})" class="label">Channel Busy %</text>')
+
+        # Draw channels as bars
+        for ch_num, data in sorted(channels.items()):
+            center_freq = data['freq']
+            busy_pct = data['busy']
+            is_in_use = data['in_use']
+
+            # 20 MHz width: ±10 MHz from center
+            x1 = freq_to_x(center_freq - 10)
+            x2 = freq_to_x(center_freq + 10)
+            bar_width = x2 - x1
+            bar_height = busy_to_height(busy_pct)
+            bar_y = margin_top + chart_height - bar_height
+
+            color = busy_to_color(busy_pct, is_in_use)
+            opacity = 0.6 if not is_in_use else 0.8
+
+            # Draw the channel bar
+            svg_parts.append(f'  <rect x="{x1}" y="{bar_y}" width="{bar_width}" height="{bar_height}" fill="{color}" opacity="{opacity}" stroke="{color}" stroke-width="1"/>')
+
+            # Channel label at bottom
+            label_x = freq_to_x(center_freq)
+            svg_parts.append(f'  <text x="{label_x}" y="{margin_top + chart_height + 15}" text-anchor="middle" class="channel-label">{ch_num}</text>')
+
+            # Frequency label (only for some channels to avoid clutter)
+            if band == '2.4' or ch_num in [36, 52, 100, 149, 165]:
+                svg_parts.append(f'  <text x="{label_x}" y="{margin_top + chart_height + 28}" text-anchor="middle" class="axis">{center_freq}</text>')
+
+            # Busy percentage on top of bar (if tall enough)
+            if bar_height > 20:
+                svg_parts.append(f'  <text x="{label_x}" y="{bar_y + 15}" text-anchor="middle" class="channel-label" fill="white">{busy_pct:.0f}%</text>')
+
+        # X-axis labels
+        svg_parts.append(f'  <text x="{margin_left + chart_width/2}" y="{height - 15}" text-anchor="middle" class="label">Channel (Center Frequency MHz)</text>')
+
+        # Legend
+        legend_y = margin_top + 10
+        legend_x = margin_left + chart_width - 150
+        legend_items = [
+            ("#3b82f6", "In Use"),
+            ("#ef4444", "High (>50%)"),
+            ("#f59e0b", "Medium (25-50%)"),
+            ("#06b6d4", "Low (10-25%)"),
+            ("#22c55e", "Idle (<10%)"),
+        ]
+
+        svg_parts.append(f'  <rect x="{legend_x - 10}" y="{legend_y - 5}" width="160" height="{len(legend_items) * 18 + 10}" fill="white" stroke="#ddd" rx="4"/>')
+
+        for i, (color, label) in enumerate(legend_items):
+            y = legend_y + 10 + i * 18
+            svg_parts.append(f'  <rect x="{legend_x}" y="{y - 8}" width="12" height="12" fill="{color}" opacity="0.7"/>')
+            svg_parts.append(f'  <text x="{legend_x + 18}" y="{y + 2}" class="legend">{label}</text>')
+
+        # Non-overlapping channels note (for 2.4 GHz)
+        if non_overlap_channels:
+            svg_parts.append(f'  <text x="{margin_left + 5}" y="{margin_top + chart_height + 50}" class="label">Non-overlapping: Ch {", ".join(map(str, non_overlap_channels))}</text>')
+            for ch in non_overlap_channels:
+                if ch in channels:
+                    center_freq = channels[ch]['freq']
+                    x = freq_to_x(center_freq)
+                    svg_parts.append(f'  <circle cx="{x}" cy="{margin_top + chart_height + 40}" r="8" fill="none" stroke="#22c55e" stroke-width="2"/>')
+                    svg_parts.append(f'  <text x="{x}" y="{margin_top + chart_height + 44}" text-anchor="middle" class="channel-label" fill="#22c55e">{ch}</text>')
+        else:
+            svg_parts.append(f'  <text x="{margin_left + 5}" y="{margin_top + chart_height + 50}" class="label">All channels non-overlapping (20 MHz spacing)</text>')
+
+        svg_parts.append('</svg>')
+        return '\n'.join(svg_parts)
+
+    # Generate SVGs for each band
+    svg_2_4 = generate_band_svg(channels_2_4, '2.4', 2400, 2485,
+                                 "2.4 GHz WiFi Channel Overlap &amp; Utilization",
+                                 [1, 6, 11])
+    svg_5 = generate_band_svg(channels_5, '5', 5150, 5850,
+                               "5 GHz WiFi Channel Utilization",
+                               None)
+
+    # Combine or output separately
+    if svg_2_4 and svg_5:
+        # Combine into one SVG with both bands stacked
+        combined = f'''<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 820">
+  <g transform="translate(0, 0)">
+{svg_2_4.replace('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 400">', '').replace('</svg>', '')}
+  </g>
+  <g transform="translate(0, 410)">
+{svg_5.replace('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 400">', '').replace('</svg>', '')}
+  </g>
+</svg>'''
+        svg_content = combined
+    elif svg_2_4:
+        svg_content = svg_2_4
+    elif svg_5:
+        svg_content = svg_5
+    else:
+        return None
+
+    if output_file:
+        with open(output_file, 'w') as f:
+            f.write(svg_content)
+        print(f"SVG written to: {output_file}")
+    else:
+        print(svg_content)
+
+    return svg_content
+
+
+def draw_recommendations(survey_data, json_output=False):
+    """Analyze channels and provide recommendations"""
+    # Parse channel data
+    channels = {}
+    in_use_channel = None
+
+    for ch_data in survey_data:
+        freq = ch_data.get('frequency')
+        ch_num = freq_to_channel(freq)
+        if ch_num:
+            busy_pct = get_busy_percentage(ch_data)
+            channels[ch_num] = {
+                'busy': busy_pct,
+                'noise': ch_data.get('noise', -100),
+                'in_use': ch_data.get('in-use', False)
+            }
+            if ch_data.get('in-use'):
+                in_use_channel = ch_num
+
+    # Find least congested non-overlapping channels
+    best_channels = []
+    for ch in [1, 6, 11]:
+        if ch in channels:
+            best_channels.append((ch, channels[ch]['busy']))
+
+    best_channels.sort(key=lambda x: x[1])
+
+    # JSON output
+    if json_output:
+        output = {
+            "recommended_channels": [
+                {"channel": ch, "busy_percent": round(busy, 1)}
+                for ch, busy in best_channels
+            ]
+        }
+        if in_use_channel:
+            output["current_channel"] = in_use_channel
+            output["current_busy_percent"] = round(channels.get(in_use_channel, {}).get('busy', 0), 1)
+
+        print(json.dumps(output, indent=2))
+        return
+
+    # Text output
+    print(f"\n{Colors.BOLD}Channel Recommendations{Colors.RESET}")
+    print("=" * 80)
+
+    if in_use_channel:
+        print(f"Current channel: {Colors.BOLD}{in_use_channel}{Colors.RESET}")
+        current_busy = channels.get(in_use_channel, {}).get('busy', 0)
+        if current_busy > 50:
+            print(f"  {Colors.RED}⚠{Colors.RESET}  High congestion detected ({current_busy:.1f}% busy)")
+        elif current_busy > 25:
+            print(f"  {Colors.YELLOW}⚠{Colors.RESET}  Moderate congestion ({current_busy:.1f}% busy)")
+        else:
+            print(f"  {Colors.GREEN}✓{Colors.RESET}  Good channel utilization ({current_busy:.1f}% busy)")
+
+    print(f"\nRecommended non-overlapping channels (2.4 GHz):")
+    for i, (ch, busy) in enumerate(best_channels[:3], 1):
+        color = get_utilization_color(busy)
+        marker = "★" if i == 1 else " "
+        print(f"  {marker} Channel {ch:2d}: {color}{busy:5.1f}% busy{Colors.RESET}")
+
+    print()
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description='Visualize WiFi channel overlap and utilization',
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog='''
+Examples:
+  # Read from yanger output (show all sections)
+  yanger -x "ixll -A ssh host sudo" ietf-hardware | %(prog)s
+
+  # Read from file
+  %(prog)s survey_data.json
+
+  # Show only list view
+  %(prog)s --list survey_data.json
+
+  # Show only specific sections
+  %(prog)s --overlap survey_data.json
+  %(prog)s --pie survey_data.json
+  %(prog)s --utilization survey_data.json
+  %(prog)s --recommendations survey_data.json
+  %(prog)s --overlap --pie survey_data.json
+
+  # Output recommendations as JSON
+  %(prog)s --recommendations --json survey_data.json
+
+  # Generate SVG image
+  %(prog)s --svg /tmp/wifi-channels.svg survey_data.json
+  %(prog)s --svg - survey_data.json > output.svg
+        '''
+    )
+    parser.add_argument('file', nargs='?', help='JSON file with hardware data (default: stdin)')
+    parser.add_argument('--list', action='store_true', help='Show simple list view instead of overlap graph')
+    parser.add_argument('--no-color', action='store_true', help='Disable colors')
+    parser.add_argument('--json', action='store_true', help='Output recommendations in JSON format')
+    parser.add_argument('--svg', metavar='FILE', help='Generate SVG image to FILE (use - for stdout)')
+
+    # Section filters
+    parser.add_argument('--overlap', action='store_true', help='Show only channel overlap visualization (2.4 GHz)')
+    parser.add_argument('--pie', action='store_true', help='Show only channel group pie chart (2.4 GHz)')
+    parser.add_argument('--utilization', action='store_true', help='Show only channel utilization list')
+    parser.add_argument('--recommendations', action='store_true', help='Show only channel recommendations')
+
+    args = parser.parse_args()
+
+    # Disable colors if requested
+    if args.no_color:
+        for attr in dir(Colors):
+            if not attr.startswith('_'):
+                setattr(Colors, attr, '')
+
+    # Read input
+    if args.file:
+        with open(args.file, 'r') as f:
+            data = json.load(f)
+    else:
+        data = json.load(sys.stdin)
+
+    # Extract survey data from hardware components
+    survey_data = []
+    hardware = data.get('ietf-hardware:hardware', {})
+    components = hardware.get('component', [])
+
+    for component in components:
+        if component.get('class') == 'infix-hardware:wifi':
+            wifi_radio = component.get('infix-hardware:wifi-radio', {})
+            survey = wifi_radio.get('survey', {})
+            channels = survey.get('channel', [])
+            if channels:
+                survey_data.extend(channels)
+
+    if not survey_data:
+        print("No WiFi survey data found in input", file=sys.stderr)
+        print("Expected format: yanger ietf-hardware output with wifi-radio survey data", file=sys.stderr)
+        sys.exit(1)
+
+    # Generate SVG if requested (exclusive mode)
+    if args.svg:
+        output_file = None if args.svg == '-' else args.svg
+        generate_svg(survey_data, output_file)
+        return
+
+    # Determine which sections to show
+    # If no section flags are set, show all sections
+    show_all = not (args.overlap or args.pie or args.utilization or args.recommendations)
+
+    show_overlap = show_all or args.overlap
+    show_pie = show_all or args.pie
+    show_utilization = show_all or args.utilization
+    show_recommendations_section = show_all or args.recommendations
+
+    # Draw visualization
+    freqs = [ch.get('frequency', 0) for ch in survey_data]
+    has_2_4ghz = any(2400 <= f <= 2500 for f in freqs)
+
+    if show_overlap and has_2_4ghz and not args.list:
+        draw_channel_graph_2_4ghz(survey_data)
+
+    if show_pie and has_2_4ghz:
+        draw_overlap_pie(survey_data)
+
+    if show_utilization:
+        draw_channel_list(survey_data)
+
+    if show_recommendations_section:
+        draw_recommendations(survey_data, json_output=args.json)
+
+
+if __name__ == '__main__':
+    main()
@@ -1,16 +0,0 @@
-#!/bin/sh
-
-if [ $# -ne 1 ]; then
-	echo "usage: $0 <ifname>"
-	exit 1
-fi
-ifname=$1
-
-TIMEOUT=300
-status=$(wpa_cli -i $ifname scan)
-while [ "$status" != "OK" ]; do
-	status=$(wpa_cli -i $ifname scan)
-	TIMEOUT=$((TIMEOUT-1))
-	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
-	sleep 0.5
-done
@@ -0,0 +1,242 @@
+#!/bin/sh
+# DHCPv6 client state update script for odhcp6c
+# This script expects a system with resolvconf (openresolv) and iproute2
+
+[ -z "$1" ] && echo "Error: should be called from odhcp6c" && exit 1
+
+interface="$1"
+state="$2"
+RESOLV_CONF="/run/resolvconf/interfaces/${interface}-ipv6.conf"
+NTPFILE="/run/chrony/dhcp-sources.d/${interface}-ipv6.sources"
+
+[ -n "$metric" ] || metric=5
+
+log()
+{
+	logger -I $$ -t odhcp6c -p user.notice "${interface}: $*"
+}
+
+dbg()
+{
+	logger -I $$ -t odhcp6c -p user.debug "${interface}: $*"
+}
+
+err()
+{
+	logger -I $$ -t odhcp6c -p user.err "${interface}: $*"
+}
+
+teardown_interface()
+{
+	ip -6 route flush dev "$interface"
+	ip -6 address flush dev "$interface" scope global
+}
+
+setup_interface()
+{
+	# Merge RA addresses with DHCP addresses
+	for entry in $RA_ADDRESSES; do
+		duplicate=0
+		addr="${entry%%/*}"
+		for dentry in $ADDRESSES; do
+			daddr="${dentry%%/*}"
+			[ "$addr" = "$daddr" ] && duplicate=1
+		done
+		[ "$duplicate" = "0" ] && ADDRESSES="$ADDRESSES $entry"
+	done
+
+	# Add addresses
+	for entry in $ADDRESSES; do
+		addr="${entry%%,*}"
+		entry="${entry#*,}"
+		preferred="${entry%%,*}"
+		entry="${entry#*,}"
+		valid="${entry%%,*}"
+
+		ip -6 address add "$addr" dev "$interface" preferred_lft "$preferred" valid_lft "$valid" proto dhcp
+		log "assigned address $addr (preferred=$preferred, valid=$valid)"
+	done
+
+	# Add routes from RA
+	for entry in $RA_ROUTES; do
+		addr="${entry%%,*}"
+		entry="${entry#*,}"
+		gw="${entry%%,*}"
+		entry="${entry#*,}"
+		valid="${entry%%,*}"
+		entry="${entry#*,}"
+		metric="${entry%%,*}"
+
+		if [ -n "$gw" ]; then
+			ip -6 route add "$addr" via "$gw" metric "$metric" dev "$interface" from "::/128"
+		else
+			ip -6 route add "$addr" metric "$metric" dev "$interface"
+		fi
+
+		# Add routes for delegated prefixes
+		for prefix in $PREFIXES; do
+			paddr="${prefix%%,*}"
+			[ -n "$gw" ] && ip -6 route add "$addr" via "$gw" metric "$metric" dev "$interface" from "$paddr"
+		done
+	done
+}
+
+handle_prefixes()
+{
+	# $PREFIXES format: "prefix/len,preferred,valid[,class=N][,excluded=...] ..."
+	for entry in $PREFIXES; do
+		addr="${entry%%,*}"
+		entry="${entry#*,}"
+		preferred="${entry%%,*}"
+		entry="${entry#*,}"
+		valid="${entry%%,*}"
+
+		log "received delegated prefix $addr (preferred=$preferred, valid=$valid)"
+
+		# Add unreachable route to prevent routing loops
+		ip -6 route add unreachable "$addr" 2>/dev/null
+
+		# Future: Distribute to downstream interfaces
+	done
+}
+
+handle_dns()
+{
+	truncate -s 0 "$RESOLV_CONF"
+
+	# Combine DHCPv6 DNS ($RDNSS) and RA DNS ($RA_DNS), deduplicating
+	all_dns=""
+	for server in $RDNSS $RA_DNS; do
+		# Simple deduplication: only add if not already in list
+		case " $all_dns " in
+			*" $server "*) ;;
+			*) all_dns="$all_dns $server" ;;
+		esac
+	done
+
+	# Domain search list (DHCPv6 option 24)
+	if [ -n "$DOMAINS" ]; then
+		dbg "adding search domains: $DOMAINS"
+		echo "search $DOMAINS # $interface" >> "$RESOLV_CONF"
+	fi
+
+	# DNS servers
+	for server in $all_dns; do
+		[ -z "$server" ] && continue
+		dbg "adding dns $server"
+		echo "nameserver $server # $interface" >> "$RESOLV_CONF"
+	done
+
+	if [ -n "$all_dns" ]; then
+		resolvconf -u
+	fi
+}
+
+handle_ntp()
+{
+	# DHCPv6 option 56 (NTP server) is provided as $OPTION_56 in hex format
+	# Format: sub-option-code (2 bytes) + length (2 bytes) + data
+	# Sub-option 1 = NTP server address (16 bytes IPv6)
+	#
+	# This is complex to parse in shell. For now, we attempt basic parsing
+	# and fall back to logging a warning if the format is unexpected.
+
+	if [ -n "$OPTION_56" ]; then
+		# Remove all non-hex characters (spaces, colons, etc.) and convert to lowercase
+		hex=$(echo "$OPTION_56" | tr -d '[:space:]:-' | tr '[:upper:]' '[:lower:]')
+
+		truncate -s 0 "$NTPFILE"
+		ntp_found=0
+
+		# Parse option 56: iterate through sub-options
+		# Each sub-option: 2 bytes code + 2 bytes length + data
+		pos=0
+		while [ $pos -lt ${#hex} ]; do
+			# Need at least 4 hex chars (2 bytes) for sub-option code
+			[ $((${#hex} - pos)) -lt 4 ] && break
+
+			# Extract sub-option code (2 bytes = 4 hex chars)
+			subopt_code=$(echo "$hex" | cut -c $((pos+1))-$((pos+4)))
+			pos=$((pos + 4))
+
+			# Need 4 more hex chars for length
+			[ $((${#hex} - pos)) -lt 4 ] && break
+
+			# Extract length (2 bytes = 4 hex chars)
+			subopt_len_hex=$(echo "$hex" | cut -c $((pos+1))-$((pos+4)))
+			subopt_len=$(printf "%d" "0x$subopt_len_hex")
+			pos=$((pos + 4))
+
+			# Sub-option 1 = NTP server address (should be 16 bytes for IPv6)
+			if [ "$subopt_code" = "0001" ] && [ "$subopt_len" -eq 16 ]; then
+				# Extract 16 bytes (32 hex chars) for IPv6 address
+				addr_hex=$(echo "$hex" | cut -c $((pos+1))-$((pos+32)))
+
+				# Convert hex to IPv6 address format
+				# Format: 0123456789abcdef0123456789abcdef -> 0123:4567:89ab:cdef:0123:4567:89ab:cdef
+				ipv6=$(echo "$addr_hex" | sed 's/\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)/\1:\2:\3:\4:\5:\6:\7:\8/')
+
+				dbg "got NTP server $ipv6"
+				echo "server $ipv6 iburst" >> "$NTPFILE"
+				ntp_found=1
+			fi
+
+			# Skip this sub-option's data
+			pos=$((pos + subopt_len * 2))
+		done
+
+		if [ "$ntp_found" -eq 1 ]; then
+			chronyc reload sources >/dev/null 2>&1
+		else
+			dbg "option 56 received but no NTP server addresses found (consider using option 31/SNTP)"
+		fi
+	fi
+}
+
+log "state: $state"
+
+(
+	flock 9
+	case "$state" in
+		started)
+			# Initial state - clean up any stale config
+			teardown_interface
+			;;
+
+		bound)
+			# Fresh lease - tear down and set up from scratch
+			teardown_interface
+			setup_interface
+			handle_prefixes
+			handle_dns
+			handle_ntp
+			;;
+
+		informed|updated|rebound|ra-updated)
+			# Update existing configuration
+			setup_interface
+			[ -n "$PREFIXES" ] && handle_prefixes
+			handle_dns
+			handle_ntp
+			;;
+
+		unbound|stopped)
+			# Lost server or client stopped
+			teardown_interface
+			rm -f "$RESOLV_CONF"
+			rm -f "$NTPFILE"
+			resolvconf -u
+			chronyc reload sources >/dev/null 2>&1
+			;;
+	esac
+) 9>/tmp/odhcp6c.lock.${interface}
+rm -f /tmp/odhcp6c.lock.${interface}
+
+# Run hooks
+HOOK_DIR="/usr/libexec/odhcp6c.d"
+for hook in "${HOOK_DIR}/"*; do
+	[ -f "${hook}" -a -x "${hook}" ] || continue
+	"${hook}" "$interface" "$state"
+done
+
+exit 0
@@ -411,10 +411,20 @@ create()
 	logging="--log-driver syslog"
    fi

+    # Build resource limit arguments
+    resource=""
+    if [ -n "$memory" ]; then
+	resource="$resource --memory=$memory"
+    fi
+    if [ -n "$cpu_limit" ]; then
+	resource="$resource --cpu-quota=$cpu_limit"
+    fi
+
    # When we get here we've already fetched, or pulled, the image
-    args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
+    args="$args --read-only --replace --quiet $caps"
+    args="$args --cgroups=enabled --cgroupns=host --cgroup-parent=system/container@$name"
    args="$args --restart=$restart --systemd=false --tz=local $privileged"
-    args="$args $vol $mount $hostname $entrypoint $env $port $logging"
+    args="$args $vol $mount $hostname $entrypoint $env $port $logging $resource"
    pidfile=/run/container:${name}.pid

    [ -n "$quiet" ] || log "---------------------------------------"
@@ -716,6 +726,8 @@ options:
      --log-path PATH      Path for k8s-file log pipe
  -m, --mount HOST:DEST    Bind mount a read-only file inside a container
      --manual             Do not start container automatically after creation
+      --memory BYTES       Memory limit in bytes (supports K/M/G suffix)
+      --cpu-limit LIMIT    CPU limit in millicores (1000m = 100% of 1 core)
  -n, --name NAME          Alternative way of supplying name to start/stop/restart
      --privileged         Give container extended privileges
  -p, --publish PORT       Publish ports when creating container
@@ -836,6 +848,14 @@ while [ "$1" != "" ]; do
 	--manual)
 	    manual=true
 	    ;;
+	--memory)
+	    shift
+	    memory="$1"
+	    ;;
+	--cpu-limit)
+	    shift
+	    cpu_limit="$1"
+	    ;;
 	-n | --name)
 	    shift
 	    name="$1"
@@ -1,111 +0,0 @@
-#!/bin/sh
-# This script expects a system with resolvconf (openresolv) and iproute2
-
-[ -z "$1" ] && echo "Error: should be called from udhcpc6" && exit 1
-
-ACTION="$1"
-RESOLV_CONF="/run/resolvconf/interfaces/${interface}-ipv6.conf"
-NTPFILE="/run/chrony/dhcp-sources.d/${interface}-ipv6.sources"
-
-[ -n "$metric" ] || metric=5
-
-if [ -z "${IF_WAIT_DELAY}" ]; then
-	IF_WAIT_DELAY=10
-fi
-
-log()
-{
-    logger -I $$ -t udhcpc6 -p user.notice "${interface}: $*"
-}
-
-dbg()
-{
-    logger -I $$ -t udhcpc6 -p user.debug "${interface}: $*"
-}
-
-err()
-{
-    logger -I $$ -t udhcpc6 -p user.err "${interface}: $*"
-}
-
-clr_dhcpv6_addresses()
-{
-    addrs=$(ip -j addr show dev $interface \
-		| jq -c '.[0].addr_info[] | select(.family == "inet6") | select(.protocol == "dhcp")')
-
-    for addr in $addrs; do
-	ip="$(echo "$addr" | jq -r '."local"')"
-	prefix="$(echo "$addr" | jq -r '."prefixlen"')"
-	log "removing $ip/$prefix"
-	ip addr del "$ip/$prefix" dev "$interface"
-    done
-}
-
-log "action $ACTION"
-case "$ACTION" in
-    deconfig)
-	clr_dhcpv6_addresses
-
-	# drop info from this interface
-	rm -f "$RESOLV_CONF"
-	rm -f "$NTPFILE"
-	;;
-
-    leasefail|nak)
-	# DHCPv6 lease failed - log it
-	err "DHCPv6 lease failed"
-	;;
-
-    renew|bound)
-	# Add IPv6 address if provided (stateful DHCPv6)
-	if [ -n "$ipv6" ]; then
-	    if /bin/ip addr add dev $interface $ipv6 proto dhcp; then
-		log "assigned address $ipv6"
-	    fi
-	fi
-
-	# Handle delegated prefix (prefix delegation)
-	if [ -n "$ipv6prefix" ]; then
-	    log "received delegated prefix $ipv6prefix"
-	    # Prefix delegation handling could be added here
-	    # For now, just log it - actual routing/distribution
-	    # would need additional configuration
-	fi
-
-	# drop info from this interface
-	truncate -s 0 "$RESOLV_CONF"
-
-	# DHCPv6 domain search list (option 24)
-	if [ -n "$search" ]; then
-	    dbg "adding search $search"
-	    echo "search $search # $interface" >> $RESOLV_CONF
-	fi
-
-	# DHCPv6 DNS servers (option 23)
-	if [ -n "$dns" ]; then
-	    for i in $dns ; do
-		dbg "adding dns $i"
-		echo "nameserver $i # $interface" >> $RESOLV_CONF
-	    done
-	    resolvconf -u
-	fi
-
-	# NTP servers (option 56)
-	if [ -n "$ntpsrv" ]; then
-	    truncate -s 0 "$NTPFILE"
-	    for srv in $ntpsrv; do
-		dbg "got NTP server $srv"
-		echo "server $srv iburst" >> "$NTPFILE"
-	    done
-	    chronyc reload sources >/dev/null
-	fi
-	;;
-esac
-
-HOOK_DIR="$0.d"
-for hook in "${HOOK_DIR}/"*; do
-    [ -f "${hook}" -a -x "${hook}" ] || continue
-    "${hook}" "$ACTION"
-done
-
-exit 0
@@ -1,13 +0,0 @@
-#!/bin/sh
-
-set -e
-
-common=$(dirname $(readlink -f "$0"))
-
-cd $BINARIES_DIR
-cp $common/rootfs.its .
-
-mkimage -E -p 0x1000 -B 0x1000 -k $2 -f rootfs.its rootfs.itb
-
-cp rootfs.itb rootfs.itbh
-truncate -s $((0x1000)) rootfs.itbh
@@ -0,0 +1 @@
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/*/*.mk))
@@ -358,6 +358,7 @@ CONFIG_SND_SOC_JH7110_TDM=y
 CONFIG_SND_SOC_WM8960=y
 CONFIG_SND_SIMPLE_CARD=y
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
@@ -472,8 +473,16 @@ CONFIG_DEBUG_FS=y
 # CONFIG_SLUB_DEBUG is not set
 CONFIG_DEBUG_RODATA_TEST=y
 CONFIG_DEBUG_WX=y
-CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_TIMEOUT=20
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY=y
+CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 CONFIG_WQ_WATCHDOG=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
+CONFIG_TEST_LOCKUP=m
 # CONFIG_SCHED_DEBUG is not set
 CONFIG_STACKTRACE=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
@@ -53,7 +53,6 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -69,12 +68,31 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -83,15 +101,23 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
+CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -108,29 +134,69 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_IPMAC=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_FIB_IPV6=y
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
+CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -191,6 +257,7 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
+CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -220,6 +287,7 @@ CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_EHCI_HCD=m
 CONFIG_USB_UHCI_HCD=m
@@ -263,7 +331,13 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_DETECT_HUNG_TASK=y
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY=y
+CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_WQ_WATCHDOG=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
+CONFIG_TEST_LOCKUP=m
 CONFIG_FUNCTION_TRACER=y
 CONFIG_UNWINDER_FRAME_POINTER=y
@@ -29,12 +29,13 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.58"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -59,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -82,6 +83,7 @@ BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_GETENT=y
@@ -95,20 +97,23 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_WATCHDOGD_GENERIC=y
+BR2_PACKAGE_WATCHDOGD_LOADAVG=y
+BR2_PACKAGE_WATCHDOGD_FILENR=y
+BR2_PACKAGE_WATCHDOGD_MEMINFO=y
+BR2_PACKAGE_WATCHDOGD_FSMON=y
+BR2_PACKAGE_WATCHDOGD_TEMPMON
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
@@ -135,11 +140,12 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_SHOW=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
-GNS3_APPLIANCE_RAM=512
-GNS3_APPLIANCE_IFNUM=10
@@ -29,12 +29,13 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.58"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -59,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -82,6 +83,7 @@ BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_GETENT=y
@@ -95,20 +97,23 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_WATCHDOGD_GENERIC=y
+BR2_PACKAGE_WATCHDOGD_LOADAVG=y
+BR2_PACKAGE_WATCHDOGD_FILENR=y
+BR2_PACKAGE_WATCHDOGD_MEMINFO=y
+BR2_PACKAGE_WATCHDOGD_FSMON=y
+BR2_PACKAGE_WATCHDOGD_TEMPMON
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
@@ -135,11 +140,12 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_SHOW=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
-GNS3_APPLIANCE_RAM=512
-GNS3_APPLIANCE_IFNUM=10
@@ -25,20 +25,19 @@ BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
-BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
@@ -64,7 +63,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -103,6 +102,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
@@ -120,19 +120,21 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_WATCHDOGD_GENERIC=y
+BR2_PACKAGE_WATCHDOGD_LOADAVG=y
+BR2_PACKAGE_WATCHDOGD_FILENR=y
+BR2_PACKAGE_WATCHDOGD_MEMINFO=y
+BR2_PACKAGE_WATCHDOGD_FSMON=y
+BR2_PACKAGE_WATCHDOGD_TEMPMON
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_GO_BIN=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
@@ -147,7 +149,8 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
+BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
@@ -171,17 +174,18 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_NETBROWSE=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
-GNS3_APPLIANCE_RAM=512
-GNS3_APPLIANCE_IFNUM=10
@@ -24,22 +24,19 @@ BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
-BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
-BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -86,6 +83,7 @@ BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_KMOD_TOOLS=y
@@ -98,18 +96,20 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_WATCHDOGD_GENERIC=y
+BR2_PACKAGE_WATCHDOGD_LOADAVG=y
+BR2_PACKAGE_WATCHDOGD_FILENR=y
+BR2_PACKAGE_WATCHDOGD_MEMINFO=y
+BR2_PACKAGE_WATCHDOGD_FSMON=y
+BR2_PACKAGE_WATCHDOGD_TEMPMON
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
@@ -128,7 +128,6 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -144,13 +143,15 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
-DISK_IMAGE_BOOT_BIN=y
+IMAGE_ITB_AUX=y
+IMAGE_ITB_QCOW=y
+IMAGE_ITB_RAUC=y
+IMAGE_README=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
-GNS3_APPLIANCE_RAM=512
-GNS3_APPLIANCE_IFNUM=10
@@ -11,7 +11,6 @@ BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
 BR2_SSP_NONE=y
 BR2_INIT_NONE=y
 BR2_SYSTEM_BIN_SH_NONE=y
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 # BR2_PACKAGE_BUSYBOX is not set
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 # BR2_TARGET_ROOTFS_TAR is not set
@@ -22,9 +21,8 @@ BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2023.07.02"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="qemu_arm64"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/qemu-uboot/extras.config"
 BR2_TARGET_UBOOT_FORMAT_DTB=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-# GNS3_APPLIANCE is not set
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"`
				`@@ -0,0 +1 @@`
				`include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/riscv64//.mk))`