board/common: tune kernel memory settings

Add vm.conf with sysctl parameters optimized for embedded network devices 512MB-8GB of memory. Focus on fast recovery and determinism. - Panic on OOM - Aggressive dirty page writeback - Increased watermark scale factor for proactive reclaim Includes tuning guide documentation for alternative scenarios. Signed-off-by: Richard Alpe <richard@bit42.se>
2026-07-26 18:53:01 +02:00 · 2025-12-08 15:54:45 +01:00
526 changed files with 8604 additions and 39389 deletions
@@ -12,6 +12,10 @@ on:
          - bananapi-bpi-r3
          - friendlyarm-nanopi-r2s
        default: 'raspberrypi-rpi64'
+      use_latest_release:
+        description: 'Use latest release artifacts instead of workflow artifacts'
+        type: boolean
+        default: false

 jobs:
  create-image:
@@ -50,19 +54,19 @@ jobs:
        run: |
          case "${{ inputs.board }}" in
            raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=false" >> $GITHUB_ENV
              ;;
            bananapi-bpi-r3)
-              echo "BOOTLOADER_SD=bpi-r3-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r3-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER_SD=bpi_r3_sd_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi_r3_emmc_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=true" >> $GITHUB_ENV
              ;;
            friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=false" >> $GITHUB_ENV
              ;;
            *)
@@ -70,7 +74,7 @@ jobs:
              exit 1
              ;;
          esac
-          echo "Arch: $ARCH for board: ${{ inputs.board }}"
+          echo "Target: $TARGET for board: ${{ inputs.board }}"
          if [ "$BUILD_EMMC" = "true" ]; then
            echo "Building both SD and eMMC images"
            echo "SD Bootloader: $BOOTLOADER_SD"
@@ -81,12 +85,16 @@ jobs:
          fi

      - name: Download bootloader artifacts
+        if: ${{ !inputs.use_latest_release }}
        run: |
-          # Download bootloader from latest-boot release tag
+          # Download from latest bootloader build workflow on main branch
+          gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
+          BOOT_RUN_ID=$(cat latest_boot_run_id)
+
          if [ "$BUILD_EMMC" = "true" ]; then
            # Download both SD and eMMC bootloaders for boards that support both
            echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_SD} --dir temp_bootloader_sd/
            mkdir -p output_sd/images
            cd temp_bootloader_sd/
            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -94,7 +102,7 @@ jobs:
            rm -rf temp_bootloader_sd/

            echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_EMMC} --dir temp_bootloader_emmc/
            mkdir -p output_emmc/images
            cd temp_bootloader_emmc/
            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
@@ -107,7 +115,7 @@ jobs:
            ls -la output_emmc/images/
          else
            # Single bootloader for boards that only support SD
-            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/

            # Extract bootloader directly to output/images
            cd temp_bootloader/
@@ -122,6 +130,7 @@ jobs:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Infix artifacts
+        if: ${{ !inputs.use_latest_release }}
        run: |
          # Download from latest Kernelkit Trigger workflow for main branch
          gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
@@ -129,7 +138,7 @@ jobs:

          if [ "$BUILD_EMMC" = "true" ]; then
            # Copy Infix artifacts to both SD and eMMC output directories
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/

            cd temp_infix/
            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -143,7 +152,7 @@ jobs:
            ls -la output_emmc/images/
          else
            # Single output directory for SD-only boards
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/

            # Extract Infix directly to output/images
            cd temp_infix/
@@ -157,6 +166,58 @@ jobs:
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

+      - name: Download from latest releases
+        if: ${{ inputs.use_latest_release }}
+        run: |
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Download both SD and eMMC bootloaders
+            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            mkdir -p output_sd/images
+            cd temp_bootloader_sd/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            cd ../
+            rm -rf temp_bootloader_sd/
+
+            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            mkdir -p output_emmc/images
+            cd temp_bootloader_emmc/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_bootloader_emmc/
+
+            # Download Infix once and extract to both directories
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "SD files extracted to output_sd/images:"
+            ls -la output_sd/images/
+            echo "eMMC files extracted to output_emmc/images:"
+            ls -la output_emmc/images/
+          else
+            # Download latest bootloader release
+            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            cd temp_bootloader/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_bootloader/
+
+            # Download latest Infix release
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "All files extracted to output/images:"
+            ls -la output/images/
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Verify extracted files
        run: |
          if [ "$BUILD_EMMC" = "true" ]; then
@@ -188,7 +249,7 @@ jobs:
            export BR2_EXTERNAL_INFIX_PATH=$PWD
            export RELEASE=""
            export INFIX_ID="infix"
-            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
+            ./utils/mkimage.sh ${{ inputs.board }}
          fi

      - name: Create eMMC image
@@ -286,11 +347,10 @@ jobs:
          # SD Card & eMMC Image Build Complete! 🚀

          **Board:** ${{ inputs.board }}
-          **Arch:** ${{ env.ARCH }}
+          **Target:** ${{ env.TARGET }}
          **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
          **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
-          **Bootloader Source:** latest-boot release
-          **Infix Source:** Latest workflow run on main
+          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}

          ## Created Images
          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
@@ -303,10 +363,9 @@ jobs:
          # SD Card Image Build Complete! 🚀

          **Board:** ${{ inputs.board }}
-          **Arch:** ${{ env.ARCH }}
+          **Target:** ${{ env.TARGET }}
          **Bootloader:** ${{ env.BOOTLOADER }}
-          **Bootloader Source:** latest-boot release
-          **Infix Source:** Latest workflow run on main
+          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}

          ## Created Images
          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
@@ -1,4 +1,4 @@
-name: Check Kernel 6.18 Release
+name: Check Kernel 6.12 Release

 on:
  schedule:
@@ -17,12 +17,12 @@ jobs:
          fetch-depth: 0
          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}

-      - name: Fetch kernel.org and check for 6.18 release
+      - name: Fetch kernel.org and check for 6.12 release
        id: check
        run: |
          set -e -o pipefail
-          # Fetch the kernel.org frontpage and extract 6.18 version
-          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.18\.\d+' | head -n1)
+          # Fetch the kernel.org frontpage and extract 6.12 version
+          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)

          if [ -z "$CURRENT_VERSION" ]; then
            echo "Failed to fetch kernel version"
@@ -30,7 +30,7 @@ jobs:
          fi

          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          echo "Current 6.18 kernel version: $CURRENT_VERSION"
+          echo "Current 6.12 kernel version: $CURRENT_VERSION"

          # Get the version from infix defconfig
          INFIX_VERSION=$(grep 'BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=' configs/aarch64_defconfig | cut -d'"' -f2)
@@ -47,7 +47,7 @@ jobs:
              echo "PR already exists for kernel $CURRENT_VERSION, skipping"
            else
              echo "new_release=true" >> $GITHUB_OUTPUT
-              echo "🎉 New 6.18 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
+              echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
            fi
          else
            echo "new_release=false" >> $GITHUB_OUTPUT
@@ -99,7 +99,7 @@ jobs:
          BRANCH_NAME: ${{ steps.branch.outputs.name }}
        run: |
          set -e -o pipefail
-          ./utils/kernel-upgrade.sh linux 6.18 "$BRANCH_NAME"
+          ./utils/kernel-upgrade.sh linux "$BRANCH_NAME"

      - name: Create pull request
        if: steps.check.outputs.new_release == 'true'
@@ -104,7 +104,11 @@ jobs:

      - name: Extract ChangeLog entry ...
        run: |
-          cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
+          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
+              |head -n -1 > release.md
+          echo "" >> release.md
+          echo "> [!TIP]" >> release.md
+          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
          cat release.md

      - uses: ncipollo/release-action@v1
@@ -1,7 +1,6 @@
 *~
 .claude
 .gdb_history
-.claude
 /.backup
 /.ccache
 /dl
@@ -11,4 +10,3 @@
 /test/.log
 /local.mk
 /test/spec/Readme.adoc
-
@@ -16,12 +16,10 @@ if something goes wrong.  Deploy once, trust forever.

 **🤝 Friendly**  
 Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit <kbd>?</kbd> or
-<kbd>TAB</kbd> for context-aware assistance.
-
-Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
-mean you're never stuck.  Whether you're learning networking or managing
-enterprise infrastructure.
+with built-in help for every command — just hit `?` or TAB for
+context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
+[comprehensive documentation][4] mean you're never stuck.  Whether
+you're learning networking or managing enterprise infrastructure.

 **🛡️ Secure**  
 Built with security as a foundation, not an afterthought.  Minimal
@@ -55,24 +53,27 @@ your device, your rules.
   Consistent tooling from development to production deployment.  
   How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!

-## Quick Example
+## See It In Action

 Configure an interface in seconds - the CLI guides you with built-in help:

-<pre><code>admin@infix-12-34-56:/> <b>configure</b>
-admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
-admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4</b> <kbd>TAB</kbd>
-      address     autoconf      bind-ni-name     dhcp 
-      enabled     forwarding    mtu              neighbor
-admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4 address 192.168.2.200 prefix-length 24</b>
-admin@infix-12-34-56:/config/interface/eth0/> <b>show</b>
+<details><summary><b>Click Here for an example CLI Session</b></summary>
+
+```bash
+admin@infix-12-34-56:/> configure
+admin@infix-12-34-56:/config/> edit interface eth0
+admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
+      address     autoconf bind-ni-name      enabled
+      forwarding  mtu      neighbor
+admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
+admin@infix-12-34-56:/config/interface/eth0/> show
 type ethernet;
 ipv4 {
  address 192.168.2.200 {
    prefix-length 24;
  }
 }
-admin@infix-12-34-56:/config/interface/eth0/> <b>diff</b>
+admin@infix-12-34-56:/config/interface/eth0/> diff
 interfaces {
  interface eth0 {
 +    ipv4 {
@@ -82,23 +83,25 @@ interfaces {
 +    }
  }
 }
-admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
-admin@infix-12-34-56:/> <b>show interfaces</b>
-<u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
+admin@infix-12-34-56:/config/interface/eth0/> leave
+admin@infix-12-34-56:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
 eth0            ethernet   UP          52:54:00:12:34:56
                ipv4                   192.168.2.200/24 (static)
                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                ipv4                   127.0.0.1/8 (static)
                ipv6                   ::1/128 (static)
-admin@infix-12-34-56:/> <b>copy running startup</b>
-</code></pre>
+admin@infix-12-34-56:/> copy running-config startup-config
+```

-Notice how <kbd>TAB</kbd> completion shows available options, `show`
-displays current config, and `diff` shows exactly what changed before
-you commit your changes with the `leave` command.
+Notice how TAB completion shows available options, `show` displays
+current config, and `diff` shows exactly what changed before you
+commit your changes with the `leave` command.

-For more information, see [CLI documentation][3].
+</details>
+
+> [Full CLI documentation →][3]

 ## Get Started

@@ -108,7 +111,7 @@ containers for any custom functionality you need.

 ### Supported Platforms

- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
+- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
 - **Banana Pi-R3** - Your next home router and gateway
 - **NanoPi R2S** - Compact dual-port router in a tiny package
 - **x86_64** - Run in VMs or on mini PCs for development and testing
@@ -1,6 +1,6 @@
 menu "Board Support"

-source "$BR2_EXTERNAL_INFIX_PATH/board/arm/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"
@@ -1,18 +0,0 @@
-Board Support
-=============
-
-The board support for an architecture always starts with Qemu support,
-this is what each `linux_defconfig` at the very least sets up.  Then
-each `$BR2_ARCH` has additional BSPs, e.g., Banana Pi BPI-R3.
-
-The `board/` directory is matched with the `configs/*_defconfigs` and
-the only execption is `board/common/`, which holds all shared files for
-Infix builds.
-
-Each `board/$BR2_ARCH/` can then have vendor/product sub-directories
-for the BSPs which may contain "fixups" to the base kernel config and
-any additional device tree files that should be included as well.
-
-To rebuild a board-specific package, e.g. NanoPi R2S:
-
-    make friendlyarm-nanopi-r2s-rebuild all
@@ -0,0 +1,5 @@
+if BR2_arm
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/raspberrypi-rpi2/Config.in"
+
+endif
@@ -1,5 +1,5 @@
-Arm 32-bit
-==========
+aarch32
+=======

 Board Specific Documentation
 ----------------------------
@@ -0,0 +1 @@
+
@@ -31,11 +31,14 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
+CONFIG_KEXEC=y
 CONFIG_ARCH_MULTI_V6=y
+CONFIG_ARCH_MULTI_V7=y
 CONFIG_ARCH_VIRT=y
 CONFIG_ARCH_BCM=y
 CONFIG_ARCH_BCM2835=y
 CONFIG_SMP=y
+CONFIG_NR_CPUS=4
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
@@ -44,6 +47,7 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPUFREQ_DT=y
 CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_AEABI=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -74,6 +78,7 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -89,31 +94,12 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
-CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -122,22 +108,15 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -154,58 +133,29 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_SET=y
-CONFIG_IP_SET_BITMAP_IP=y
-CONFIG_IP_SET_BITMAP_IPMAC=y
-CONFIG_IP_SET_BITMAP_PORT=y
-CONFIG_IP_SET_HASH_IP=y
-CONFIG_IP_SET_HASH_IPMARK=y
-CONFIG_IP_SET_HASH_IPPORT=y
-CONFIG_IP_SET_HASH_IPPORTIP=y
-CONFIG_IP_SET_HASH_IPPORTNET=y
-CONFIG_IP_SET_HASH_IPMAC=y
-CONFIG_IP_SET_HASH_MAC=y
-CONFIG_IP_SET_HASH_NETPORTNET=y
-CONFIG_IP_SET_HASH_NET=y
-CONFIG_IP_SET_HASH_NETNET=y
-CONFIG_IP_SET_HASH_NETPORT=y
-CONFIG_IP_SET_HASH_NETIFACE=y
-CONFIG_IP_SET_LIST_SET=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_SYNPROXY=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -244,16 +194,16 @@ CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_PKTGEN=y
-CONFIG_CFG80211=m
-CONFIG_MAC80211=m
-CONFIG_RFKILL=y
+# CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
+CONFIG_PCI_AARDVARK=y
 CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_ARMADA_8K=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -271,6 +221,7 @@ CONFIG_BLK_DEV_NVME=y
 CONFIG_SRAM=y
 CONFIG_EEPROM_AT24=y
 # CONFIG_SCSI_PROC_FS is not set
+CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_SAS_LIBSAS=y
 CONFIG_SCSI_SAS_ATA=y
@@ -279,6 +230,7 @@ CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_MVEBU=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
@@ -306,6 +258,8 @@ CONFIG_SMSC911X=y
 CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
 CONFIG_USB_NET_SMSC95XX=y
+CONFIG_BRCMFMAC=m
+CONFIG_ZD1211RW=m
 CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
 CONFIG_INPUT_TOUCHSCREEN=y
@@ -319,19 +273,22 @@ CONFIG_SERIAL_8250_BCM2835AUX=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
+CONFIG_TTY_PRINTK=y
+CONFIG_HVC_DRIVER=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
 CONFIG_SPI_BCM2835=y
 CONFIG_SPI_BCM2835AUX=y
+CONFIG_GPIO_SYSFS=y
 CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
 CONFIG_BCM2711_THERMAL=y
 CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
-CONFIG_I6300ESB_WDT=y
 CONFIG_BCM2835_WDT=y
+CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -339,12 +296,12 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
 CONFIG_DRM=y
 CONFIG_DRM_LOAD_EDID_FIRMWARE=y
-CONFIG_DRM_SIMPLEDRM=y
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_TOSHIBA_TC358762=m
 CONFIG_DRM_V3D=m
 CONFIG_DRM_VC4=m
 CONFIG_DRM_VC4_HDMI_CEC=y
+CONFIG_DRM_SIMPLEDRM=y
 CONFIG_FB=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_SOUND=y
@@ -353,7 +310,6 @@ CONFIG_SND_SOC=y
 CONFIG_SND_BCM2835_SOC_I2S=y
 CONFIG_HID_GENERIC=m
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC2=y
@@ -387,6 +343,7 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_STAGING=y
 CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
 CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
@@ -395,8 +352,7 @@ CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_POSIX_ACL=y
-CONFIG_EXT4_FS=y
+CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -415,13 +371,13 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
-CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_ISO8859_15=y
 CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_CCM=y
 CONFIG_CRYPTO_GCM=y
+# CONFIG_XZ_DEC_ARM is not set
+# CONFIG_XZ_DEC_ARMTHUMB is not set
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
@@ -431,13 +387,9 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
-CONFIG_TEST_LOCKUP=m
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
+# CONFIG_STRICT_DEVMEM is not set
 CONFIG_MEMTEST=y
@@ -5,10 +5,11 @@ config BR2_PACKAGE_RASPBERRYPI_RPI2
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+
 	help
 	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
 	  (SBC) with BCM2836 quad-core Cortex-A7 processor.

-	  This was the only Raspberry Pi model with the BCM2836 and the rare
-	  RPi 2B board revision v1.2 actually got an underclocked BCM2837,
-	  which is the saem Cortex-A53 as the RPi3, but w/o wifi.
+	  This was the only Raspberry Pi model with the BCM2836 and the 2B
+	  actually got a BCM2837 (Cortex-A53) underclocked an w/o wifi in
+	  the v1.2 board revision.
@@ -21,8 +21,9 @@ The board features:
 How to Build
 ------------

-Since there are no pre-built images for ARM 32-bit, you need to build both
-Infix and the bootloader from source.
+Since there are no pre-built images for ARM32, you need to build both Infix
+and the bootloader from source.
+

 1. Clone the repository

@@ -36,12 +37,12 @@ Infix and the bootloader from source.

 3. Build Infix (in another tree)

-        make O=x-arm arm_defconfig
-        make O=x-arm
+        make O=x-arm32 aarch32_defconfig
+        make O=x-arm32

 4. Create the SD card image

-        ./utils/mkimage.sh -b x-boot -r x-arm raspberrypi-rpi2
+        ./utils/mkimage.sh -b x-boot -r x-arm32 raspberrypi-rpi2

 The resulting image can be found in `x-boot/images/infix-arm-sdcard.img`

@@ -41,31 +41,14 @@
        "ietf-ip:ipv4": {
          "infix-dhcp-client:dhcp": {
            "option": [
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Raspberry Pi 2 Model B"
-              }
+              {"id": "netmask"},
+              {"id": "broadcast"},
+              {"id": "router"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "ntp-server"},
+              {"id": "vendor-class", "value": "Raspberry Pi 2 Model B"}
            ]
          }
        }
@@ -88,9 +71,6 @@
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -98,14 +78,6 @@
          "user-name": [
            "admin"
          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
        }
      ]
    },
@@ -125,37 +97,6 @@
          }
        ]
      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
      {
        "name": "default-deny-all",
        "group": [
@@ -163,25 +104,11 @@
        ],
        "rule": [
          {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
          }
        ]
      }
@@ -195,11 +122,7 @@
            "name": "default-ssh",
            "ssh": {
              "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
              },
              "ssh-server-parameters": {
                "server-identity": {
@@ -245,7 +168,7 @@
    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
  },
  "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -34,10 +34,6 @@ Infix comes preconfigured with:

 The easiest way to get started is using an SD card:

-> [!NOTE]
-> SD card boot works but we have observed stability issues. For production
-> use or long-term reliability, we recommend installing to eMMC (see below).
-
 1. **Download the SD card image:** [infix-bpi-r3-sdcard.img][2]
 2. **Flash the image to an SD card:** see [this guide][0]
 3. **Set boot switches:**
@@ -57,8 +53,8 @@ The BPI-R3 has a 4-position DIP switch that controls boot media:

 | Position | Mode        | Description                           |
 |----------|-------------|---------------------------------------|
-| 0000     | SD card     | Boot from microSD card                |
-| 0110     | eMMC        | Boot from internal eMMC (recommended) |
+| 0000     | SD card     | Boot from microSD card (recommended)  |
+| 0110     | eMMC        | Boot from internal eMMC storage       |
 | 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |

 > [!NOTE]
@@ -71,16 +67,10 @@ For production deployments or better performance, you can install Infix
 to the internal eMMC storage. This is more complex but provides faster
 boot times and eliminates the external SD card.

-> [!IMPORTANT]
-> While Infix boots on both SD card and eMMC, we have observed stability
-> issues with SD cards on this platform. **eMMC is recommended** for
-> reliable operation.
-
 ### Why Use eMMC?

 **Advantages:**

- More reliable than SD card (stability issues observed with SD cards)
 - Faster boot and better performance
 - No external SD card to manage
 - More robust for industrial/embedded deployments
@@ -6,7 +6,7 @@ define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_GPIO,y)
 	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_WATCHDOG)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
@@ -17,25 +17,7 @@
        "state": {
          "admin-state": "unlocked"
        }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-	  "band": "2.4GHz",
-	  "channel": "auto"
-	 }
-     },
-     {
-	"name": "radio1",
-	"class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-          "band": "5GHz",
-          "channel": "auto"
      }
-    }
    ]
  },
  "ietf-interfaces:interfaces": {
@@ -120,115 +102,54 @@
        "ietf-ip:ipv4": {
          "infix-dhcp-client:dhcp": {
            "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Banana Pi BPI-R3"
-              }
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"},
+              {"id": "vendor-class", "value": "Banana Pi BPI-R3"}
            ]
          }
        },
        "ietf-ip:ipv6": {
          "infix-dhcpv6-client:dhcp": {
            "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "client-fqdn"
-              },
-              {
-                "id": "domain-search"
-              },
-              {
-                "id": "dns-server"
-              }
+              {"id": "ntp-server"},
+              {"id": "client-fqdn"},
+              {"id": "domain-search"},
+              {"id": "dns-server"}
            ]
          }
        }
      },
      {
-        "name": "wifi0-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0",
-          "access-point": {
-            "ssid": "Infix",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-	"infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
+        "name": "wifi0",
+        "type": "infix-if-type:wifi"
      },
      {
-        "name": "wifi1-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio1",
-          "access-point": {
-            "ssid": "Infix5Ghz",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-       "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
+        "name": "wifi1",
+        "type": "infix-if-type:wifi"
      }
    ]
  },
  "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
+        "asymmetric-keys": {
+            "asymmetric-key": [
+                {
+                    "name": "genkey",
+                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+                    "public-key": "",
+                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+                    "cleartext-private-key": "",
+                    "certificates": {}
+                }
+            ]
        }
-      ]
-    },
-    "symmetric-keys": {
-      "symmetric-key": [
-        {
-          "name": "wifi",
-          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
-          "key-format": "infix-crypto-types:passphrase-key-format"
-        }
-      ]
-    }
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -236,14 +157,6 @@
          "user-name": [
            "admin"
          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
        }
      ]
    },
@@ -263,37 +176,6 @@
          }
        ]
      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
      {
        "name": "default-deny-all",
        "group": [
@@ -301,25 +183,11 @@
        ],
        "rule": [
          {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
          }
        ]
      }
@@ -333,11 +201,7 @@
            "name": "default-ssh",
            "ssh": {
              "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
              },
              "ssh-server-parameters": {
                "server-identity": {
@@ -429,7 +293,7 @@
    "policy": [
      {
        "name": "lan-to-wan",
-        "action": "accept",
+	"action": "accept",
        "ingress": [
          "lan"
        ],
@@ -441,7 +305,7 @@
    ]
  },
  "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -477,3 +341,4 @@
    }
  }
 }
+
@@ -1,11 +0,0 @@
-{
-    "sfp1": {
-	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
-	"broken-autoneg": true
-    },
-    "sfp2": {
-	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
-	"broken-autoneg": true
-    }
-
-}
@@ -4,7 +4,6 @@ config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
 	select SDCARD_AUX
 	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
-	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	help
 	  FriendlyElec NanoPi R2S is a compact router board based on
 	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.
@@ -4,9 +4,6 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
-	# TODO: for some reason this just locks up the device
-	#       so we'll have to rely on the softdog :-(
-	# $(call KCONFIG_ENABLE_OPT,CONFIG_DW_WATCHDOG)

 	# PHY drivers
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
@@ -54,10 +51,6 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)

-	# Input layer
-	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MISC)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
-
 	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)
@@ -61,49 +61,24 @@
        "ietf-ip:ipv4": {
          "infix-dhcp-client:dhcp": {
            "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "vendor-class",
-                "value": "NanoPi R2S"
-              }
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"},
+              {"id": "vendor-class", "value": "NanoPi R2S"}
            ]
          }
        },
        "ietf-ip:ipv6": {
          "infix-dhcpv6-client:dhcp": {
            "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "client-fqdn"
-              },
-              {
-                "id": "domain-search"
-              },
-              {
-                "id": "dns-server"
-              }
+              {"id": "ntp-server"},
+              {"id": "client-fqdn"},
+              {"id": "domain-search"},
+              {"id": "dns-server"}
            ]
          }
        }
@@ -111,24 +86,21 @@
    ]
  },
  "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
+        "asymmetric-keys": {
+            "asymmetric-key": [
+                {
+                    "name": "genkey",
+                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+                    "public-key": "",
+                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+                    "cleartext-private-key": "",
+                    "certificates": {}
+                }
+            ]
        }
-      ]
-    }
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -136,14 +108,6 @@
          "user-name": [
            "admin"
          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
        }
      ]
    },
@@ -163,37 +127,6 @@
          }
        ]
      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
      {
        "name": "default-deny-all",
        "group": [
@@ -201,25 +134,11 @@
        ],
        "rule": [
          {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
          }
        ]
      }
@@ -233,11 +152,7 @@
            "name": "default-ssh",
            "ssh": {
              "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
              },
              "ssh-server-parameters": {
                "server-identity": {
@@ -329,7 +244,7 @@
    "policy": [
      {
        "name": "lan-to-wan",
-        "action": "accept",
+	"action": "accept",
        "ingress": [
          "lan"
        ],
@@ -341,7 +256,7 @@
    ]
  },
  "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -20,7 +20,6 @@ cleanup()
 {
    rm -f "$LED_FILE"
    rm -f "$PID_FILE"
-    kill %% 2>/dev/null
    exit 0
 }

@@ -32,13 +31,11 @@ remaining_time=$((1800 - $(awk '{print int($1)}' /proc/uptime)))

 while [ "$remaining_time" -gt 0 ]; do
    check_wan
-    sleep 1 &
-    wait $!
+    sleep 1
    remaining_time=$((remaining_time - 1))
 done

 while :; do
    check_wan
-    sleep 5 &
-    wait $!
+    sleep 5
 done
@@ -39,6 +39,7 @@ CONFIG_ARM64_ERRATUM_1286807=y
 CONFIG_ARM64_ERRATUM_1542419=y
 CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
+CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
 CONFIG_COMPAT=y
 # CONFIG_SUSPEND is not set
@@ -51,6 +52,7 @@ CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_ARMADA_8K_CPUFREQ=y
 CONFIG_ACPI=y
 CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -77,6 +79,7 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -92,31 +95,12 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
-CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -125,23 +109,15 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
-CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -158,69 +134,29 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_SET=y
-CONFIG_IP_SET_BITMAP_IP=y
-CONFIG_IP_SET_BITMAP_IPMAC=y
-CONFIG_IP_SET_BITMAP_PORT=y
-CONFIG_IP_SET_HASH_IP=y
-CONFIG_IP_SET_HASH_IPMARK=y
-CONFIG_IP_SET_HASH_IPPORT=y
-CONFIG_IP_SET_HASH_IPPORTIP=y
-CONFIG_IP_SET_HASH_IPPORTNET=y
-CONFIG_IP_SET_HASH_IPMAC=y
-CONFIG_IP_SET_HASH_MAC=y
-CONFIG_IP_SET_HASH_NETPORTNET=y
-CONFIG_IP_SET_HASH_NET=y
-CONFIG_IP_SET_HASH_NETNET=y
-CONFIG_IP_SET_HASH_NETPORT=y
-CONFIG_IP_SET_HASH_NETIFACE=y
-CONFIG_IP_SET_LIST_SET=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
-CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -308,7 +244,6 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
-CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -472,10 +407,10 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_GPIO_WATCHDOG=y
-CONFIG_ARM_SBSA_WATCHDOG=y
 CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_MAX77620=y
+CONFIG_MFD_SEC_CORE=y
 CONFIG_MFD_ROHM_BD718XX=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -484,6 +419,7 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_MAX77620=y
 CONFIG_REGULATOR_PCA9450=y
 CONFIG_REGULATOR_QCOM_SPMI=y
+CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_A4TECH is not set
 # CONFIG_HID_APPLE is not set
@@ -493,11 +429,11 @@ CONFIG_REGULATOR_QCOM_SPMI=y
 # CONFIG_HID_CYPRESS is not set
 # CONFIG_HID_EZKEY is not set
 # CONFIG_HID_KENSINGTON is not set
+# CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
 CONFIG_USB_ULPI_BUS=y
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
@@ -515,6 +451,7 @@ CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
 CONFIG_USB_HSIC_USB3503=m
+CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_SNP_UDC_PLAT=y
@@ -548,6 +485,7 @@ CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
 CONFIG_RTC_DRV_PCF8523=y
+CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
 CONFIG_RTC_DRV_PL031=y
@@ -562,6 +500,7 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 # CONFIG_SURFACE_PLATFORMS is not set
 CONFIG_COMMON_CLK_CS2000_CP=y
+CONFIG_COMMON_CLK_S2MPS11=y
 CONFIG_COMMON_CLK_XGENE=y
 CONFIG_COMMON_CLK_BD718XX=y
 CONFIG_MAILBOX=y
@@ -578,8 +517,7 @@ CONFIG_PHY_SAMSUNG_USB2=y
 CONFIG_NVMEM_LAYOUT_ONIE_TLV=y
 CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_POSIX_ACL=y
-CONFIG_EXT4_FS=y
+CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -598,17 +536,16 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
-CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_ISO8859_15=y
-CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
@@ -620,13 +557,8 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
-CONFIG_TEST_LOCKUP=m
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
 # CONFIG_STRICT_DEVMEM is not set
@@ -5,7 +5,7 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
-	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
+
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
 	  of single-board computers (SBC), RPi 3B and later, including the
@@ -107,10 +107,8 @@ To configure WiFi as a client, first store your WiFi password in the keystore:
 ```
 admin@infix:/> configure
 admin@infix:/config/> edit keystore symmetric-key mywifi
-admin@infix:/config/keystore/…/mywifi/> set key-format passphrase-key-format
-admin@infix:/config/keystore/…/mywifi/> change cleartext-symmetric-key
-Passphrase: ************
-Retype passphrase: ************
+admin@infix:/config/keystore/…/mywifi/> set key-format wifi-preshared-key-format
+admin@infix:/config/keystore/…/mywifi/> set cleartext-key YourWiFiPassword
 admin@infix:/config/keystore/…/mywifi/> leave
 ```

@@ -1,4 +0,0 @@
-#!/bin/sh
-# Workaround for: https://github.com/kernelkit/infix/issues/1357
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add
@@ -10,13 +10,6 @@
        "state": {
          "admin-state": "unlocked"
        }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "00"
-        }
      }
    ]
  },
@@ -45,45 +38,24 @@
      {
        "name": "eth0",
        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
        "ietf-ip:ipv4": {
          "infix-dhcp-client:dhcp": {
            "option": [
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Raspberry Pi 4 Model B"
-              }
+              {"id": "netmask"},
+              {"id": "broadcast"},
+              {"id": "router"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "ntp-server"},
+              {"id": "vendor-class", "value": "Raspberry Pi 4 Model B"}
            ]
          }
        }
      },
      {
        "name": "wifi0",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0"
-        }
+        "type": "infix-if-type:wifi"
      }
    ]
  },
@@ -103,9 +75,6 @@
  },
  "ietf-netconf-acm:nacm": {
    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
    "groups": {
      "group": [
        {
@@ -113,14 +82,6 @@
          "user-name": [
            "admin"
          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
        }
      ]
    },
@@ -140,37 +101,6 @@
          }
        ]
      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
      {
        "name": "default-deny-all",
        "group": [
@@ -178,25 +108,11 @@
        ],
        "rule": [
          {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
          }
        ]
      }
@@ -210,11 +126,7 @@
            "name": "default-ssh",
            "ssh": {
              "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
              },
              "ssh-server-parameters": {
                "server-identity": {
@@ -260,7 +172,7 @@
    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
  },
  "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -1,4 +0,0 @@
-#!/bin/sh
-# Workaround for: https://github.com/kernelkit/infix/issues/1357
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add
@@ -12,15 +12,6 @@
 			boot_targets = "mmc0";
 			ethprime = "eth0";

-			/* Memory layout for kernel boot:
-			 *   0x00200000: Kernel relocation address
-			 *   0x04000000: FDT (64MB, gives enough space for kernels up to ~60MB)
-			 *   0x10000000: Ramdisk (Memsize - 256MB)
-			 */
-			kernel_addr_r = "0x00200000";
-			fdt_addr_r = "0x04000000";
-			ramdisk_addr_r = "0x10000000";
-
 			stdout = "serial";
 			stderr = "serial";
 			stdin = "serial";
@@ -1,26 +0,0 @@
-#!/bin/sh
-
-set -e
-
-ecc_stat()
-{
-    local chan=
-    local base=
-
-    for chan in 0 1; do
-        base=$((0xf0020360 + 0x200 * chan))
-
-        echo "DRAM Channel $chan ECC Status"
-        echo -n "  Log config: "; devmem $((base + 0x0)) 32
-        echo -n "  1b errors:  "; devmem $((base + 0x4)) 32
-        echo -n "  Info 0:     "; devmem $((base + 0x8)) 32
-        echo -n "  Info 1:     "; devmem $((base + 0xc)) 32
-        echo
-    done
-}
-
-[ -n "$1" ] || { echo "usage: $0 OUT-DIR"; exit 1; }
-work="$1"/marvell-cn913x
-mkdir -p "${work}"
-
-ecc_stat >"${work}"/ecc-stat
@@ -59,9 +59,3 @@
 		XSWP(a, "e13", 13, &sfp0);
 	};
 };
-
-&cp0_spi1 {
-	spi-flash@0 {
-		broken-flash-reset;
-	};
-};
@@ -1,5 +0,0 @@
-if BR2_arm
-
-source "$BR2_EXTERNAL_INFIX_PATH/board/arm/raspberrypi-rpi2/Config.in"
-
-endif
@@ -1 +0,0 @@
-include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/arm/*/*.mk))
@@ -1016,7 +1016,12 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
-# CONFIG_UDHCPC6 is not set
+CONFIG_UDHCPC6_DEFAULT_SCRIPT="/usr/share/udhcpc/default6.script"
+CONFIG_UDHCPC6=y
+CONFIG_FEATURE_UDHCPC6_RFC3646=y
+CONFIG_FEATURE_UDHCPC6_RFC4704=y
+CONFIG_FEATURE_UDHCPC6_RFC4833=y
+CONFIG_FEATURE_UDHCPC6_RFC5970=y

 #
 # Common options for DHCP applets
@@ -34,7 +34,7 @@ Depending on how your Linux installation is set up, the following may
 require being run with superuser privileges, i.e., you may need to
 repend the command with 'sudo'.

-    $ ./qemu/run.sh
+    $ ./qemu.sh

 You should now see the Infix init system booting up.  When the final
 "Please press Enter to activate this console." is shown, press Enter
@@ -75,13 +75,13 @@ interface, which requires the following extra package:

 We can now enter the configuration:

-    $ ./qemu/run.sh -c
+    $ ./qemu.sh -c

 Go down to *Networking*, select *TAP*, now you can change the *Number of
 TAPs*, e.g. to 10.  Exit and save the configuration, then you can start
 Qemu again:

-    $ ./qemu/run.sh
+   ./qemu.sh

 > Make sure to do a factory reset from the CLI, otherwise you will be
 > stuck with that single interface from before.
@@ -231,7 +231,7 @@ config QEMU_NET_MODEL
 	  if you want to play with low-level stuff like ethtool, you
 	  might want to test the Intel 82545EM driver, e1000.

-	  Note: ARM 32-bit uses virtio-net-device (MMIO) by default.
+	  Note: ARM32 uses virtio-net-device (MMIO) by default.

 config QEMU_NET_BRIDGE_DEV
 	string "Bridge device"
@@ -10,18 +10,15 @@
 #
 # and then call this script with:
 #
-#    ./run.sh -c
+#    ./qemu.sh -c
 #
 # To bring up a menuconfig dialog.  Select `Exit` and save the changes.
 # For more help, see:_
 #
-#    ./run.sh -h
+#    ./qemu.sh -h
 #
 # shellcheck disable=SC3037

-# Add /sbin to PATH for mkfs.ext4 and such (not default in debian)
-export PATH="/sbin:/usr/sbin:$PATH"
-
 qdir=$(dirname "$(readlink -f "$0")")
 imgdir=$(readlink -f "${qdir}/..")
 prognm=$(basename "$0")
@@ -43,7 +40,7 @@ usage()
    echo "         Also, qemu.cfg has QEMU_APPEND which can affect this."
    echo
    echo "Example:"
-    echo "  $prognm -- finit.debug"
+    echo "  qemu.sh -- finit.debug"
    echo "___________________________________________________________________"
    echo "Note: 'kconfig-frontends' package (Debian/Ubuntu) must be installed"
    echo "      for -c to work: sudo apt install kconfig-frontents"
@@ -83,7 +80,7 @@ loader_args()

 append_args()
 {
-    # ARM 32-bit doesn't support virtio console properly, always use serial
+    # ARM32 doesn't support virtio console properly, always use serial
    if [ "$CONFIG_QEMU_arm" ]; then
 	echo -n "console=ttyAMA0 "
    elif [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
@@ -122,7 +119,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	# ARM 32-bit virt machine uses MMIO virtio devices, not PCI
+	# ARM32 virt machine uses MMIO virtio devices, not PCI
 	if [ "$CONFIG_QEMU_arm" ]; then
 	    echo -n "-drive file=qemu.qcow2,if=none,format=qcow2,id=rootfs "
 	    echo -n "-device virtio-blk-device,drive=rootfs "
@@ -177,8 +174,6 @@ rw_args()
 {
    [ "$CONFIG_QEMU_RW" ] ||  return

-    command -v mkfs.ext4 >/dev/null || die "$prognm: cannot find mkfs.ext4"
-
    if ! [ -f "aux.ext4" ]; then
 	dd if=/dev/zero of="aux.ext4" bs=1M count=1 >/dev/null 2>&1
 	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
@@ -189,7 +184,7 @@ rw_args()
 	mkfs.ext4 -L cfg "$CONFIG_QEMU_RW" >/dev/null 2>&1
    fi

-    # ARM 32-bit virt machine uses MMIO virtio devices, not PCI
+    # ARM32 virt machine uses MMIO virtio devices, not PCI
    if [ "$CONFIG_QEMU_arm" ]; then
 	echo -n "-drive file=aux.ext4,if=none,format=raw,id=aux "
 	echo -n "-device virtio-blk-device,drive=aux "
@@ -358,12 +353,13 @@ extract_squashfs()
 run_qemu()
 {
    # Auto-extract rootfs.squashfs from rootfs.itb if needed for initrd mode
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ] && [ ! -f "$CONFIG_QEMU_ROOTFS" ]; then
-	itb="${CONFIG_QEMU_ROOTFS%.squashfs}.itb"
-	if [ -f "$itb" ]; then
-	    extract_squashfs "$itb" "$CONFIG_QEMU_ROOTFS"
-	else
-	    die "Missing $CONFIG_QEMU_ROOTFS and cannot find $itb to extract it from"
+    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
+	if [ "$CONFIG_QEMU_ROOTFS" = "rootfs.squashfs" ] && [ ! -f "rootfs.squashfs" ]; then
+	    if [ -f "rootfs.itb" ]; then
+		extract_squashfs "rootfs.itb" "rootfs.squashfs"
+	    else
+		die "Missing rootfs.squashfs and cannot find rootfs.itb to extract it from"
+	    fi
 	fi
    fi

@@ -40,12 +40,11 @@ log()
    less +G -r "$fn"
 }

-follow ()
+follow()
 {
    local fn="/var/log/syslog"
    [ -n "$1" ] && fn="/var/log/$1"
-
-    tail -F -n +1 "$fn"
+    less +F -r "$fn"
 }

 _logfile_completions()
@@ -1,2 +1,2 @@
 # --log-level debug
-ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog --log-level err"
+ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog "
@@ -5,5 +5,4 @@
 # 'podman load', must not have a timeout.
 sysv    log:prio:local1,tag:%i kill:30 pid:!/run/container:%i.pid \
 	pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container   \
-	cgroup.system,delegate					  \
 	[2345] <!> :%i container -n %i -- container %i
@@ -1,3 +0,0 @@
-service <!> name:hostapd :%i \
-	[2345] hostapd -P/var/run/hostapd-%i.pid  /etc/hostapd-%i.conf \
-	-- Wi-Fi Access Point @%i
@@ -1,3 +1,3 @@
-service name:rousette notify:none log:null <pid/confd> env:/etc/default/confd \
+service name:rousette notify:none log <pid/confd> env:/etc/default/confd \
 	[12345] rousette --syslog -t $CONFD_TIMEOUT \
 	-- RESTCONF server
@@ -1,3 +1,5 @@
 service name:wpa_supplicant :%i \
-	[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
-	-- Wi-Fi Station @%i
+			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+			       -- WPA supplicant @%i
+
+task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i
@@ -1,15 +1,23 @@
 # Virtual filesystems
-tmpfs		/run		  tmpfs		mode=0755,nosuid,nodev	0	0
-tmpfs		/media		  tmpfs		mode=1755,nosuid,nodev	0	0
-debugfs		/sys/kernel/debug debugfs	nofail			0	0
-cfgfs		/config		  configfs	nofail,noauto		0	0
+devtmpfs	/dev		devtmpfs	defaults		0	0
+mkdir#-p	/dev/pts	helper		none			0	0
+devpts		/dev/pts	devpts		mode=620,ptmxmode=0666	0	0
+mkdir#-p	/dev/shm	helper		none			0	0
+tmpfs		/dev/shm	tmpfs		mode=0777		0	0
+proc		/proc		proc		defaults		0	0
+tmpfs		/tmp		tmpfs		mode=1777,nosuid,nodev	0	0
+tmpfs		/run		tmpfs		mode=0755,nosuid,nodev	0	0
+tmpfs		/media		tmpfs		mode=1755,nosuid,nodev	0	0
+sysfs		/sys		sysfs		defaults		0	0
+debugfs	/sys/kernel/debug	debugfs		nofail			0	0
+cfgfs		/config		configfs	nofail,noauto		0	0

 # The chosen backing storage for the overlays placed on /cfg, /etc,
 # /home, /root, and /var, are determined dynamically by /usr/libexec/infix/mnt
 # depending on the available devices.
 mnttmp		/mnt/tmp	tmpfs	defaults					0	0
-LABEL=aux	/mnt/aux	auto	noatime,nodiratime,noauto			0	0
-LABEL=var	/mnt/var	ext4	noatime,nodiratime,noauto			0	0
-LABEL=cfg	/mnt/cfg	ext4	noatime,nodiratime,noauto			0	0
+LABEL=aux	/mnt/aux	auto	noatime,nodiratime,noauto,errors=remount-ro	0	0
+LABEL=var	/mnt/var	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
+LABEL=cfg	/mnt/cfg	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
 hostfs		/mnt/host	9p	cache=none,msize=16384,noauto			0	0
 /usr/libexec/infix/mnt#	/cfg	helper	none						0	0
@@ -19,14 +19,6 @@ http {

    include /etc/nginx/enabled/*.conf;

-    # Skip 2xx and 3xx
-    # Skip 400 (e.g., rrousette syntax errors)
-    map $status $loggable {
-    	~^[23]  0;
-	400 	0;
-	default 1;
-    }
-
-    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=warn combined if=$loggable;
-    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 warn;
+    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=info;
+    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 info;
 }
@@ -4,14 +4,14 @@ alias ll='ls -alF'
 alias ls='ls --color=auto'

 export LANG=C.UTF-8
-export EDITOR=/usr/bin/editor
-export VISUAL=/usr/bin/editor
+export EDITOR=/usr/bin/edit
+export VISUAL=/usr/bin/edit
 export LESS="-P %f (press h for help or q to quit)"
 export LESSOPEN="|/usr/bin/lesspipe.sh %s"
 alias vim='vi'
 alias view='vi -R'
 alias emacs='mg'
-alias sensible-editor=editor
+alias sensible-editor=edit
 alias sensible-pager=pager
 alias hd="hexdump -C"

@@ -0,0 +1,23 @@
+# Memory and OOM tuning for embedded network devices
+# Optimized for systems with 512MB-4GB RAM
+# Target: Fast and deterministic OOM behavior
+
+# OOM Behavior
+# Panic on OOM for fast system reset and recovery
+vm.panic_on_oom=1
+
+# Dirty Page Writeback
+# Limit dirty pages to 10% of RAM before blocking writers
+# Start background writeback at 5% to prevent accumulation
+vm.dirty_ratio=10
+vm.dirty_background_ratio=5
+
+# Writeback Timing
+# Expire dirty pages after 10 seconds (1000 centiseconds)
+# Ensures quick flushing on limited-memory systems
+vm.dirty_expire_centisecs=1000
+
+# Memory Watermarks
+# Increase distance between low/high watermarks for earlier reclaim
+# Maintains larger free memory buffer proactively (default: 10)
+vm.watermark_scale_factor=150
@@ -1,3 +0,0 @@
-# Rename WiFi PHY devices from phy0 to radio0 to avoid name clashes
-SUBSYSTEM=="ieee80211", ACTION=="add", KERNEL=="phy*", \
-  RUN+="/bin/sh -c '/usr/sbin/iw phy %k set name radio%n'"
@@ -1,7 +0,0 @@
-# Remove kernel-created WiFi interfaces
-# All WiFi interfaces are now virtual interfaces created by confd
-SUBSYSTEM=="net", ACTION=="add", KERNEL=="wlan*", \
-  TEST=="/sys/class/net/$name/phy80211/name", \
-  PROGRAM="/bin/cat /sys/class/net/%k/phy80211/name", \
-  TEST!="/run/wifi-cleaned-%c", \
-  RUN+="/bin/sh -c '/usr/sbin/iw dev %k del && touch /run/wifi-cleaned-%c'"
@@ -0,0 +1 @@
+SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"
@@ -90,9 +90,9 @@ reset-reason {

 # Monitors file descriptor leaks based on /proc/sys/fs/file-nr
 filenr {
-    enabled = true
-    interval = 3600
-    logmark  = true
+#    enabled = true
+    interval = 300
+    logmark  = false
    warning  = 0.9
    critical = 1.0
 #    script = "/path/to/alt-reboot-action.sh"
@@ -102,42 +102,33 @@ filenr {
 # The script is called with fsmon as the first argument and there
 # are two environment variables FSMON_NAME, for the monitored path,
 # and FSMON_TYPE indicating either 'blocks' or 'inodes'.
-fsmon /var {
-    enabled = true
-    interval = 3600
-    logmark  = true
-    warning  = 0.95
-    critical = 1.0
-#    script = "/path/to/alt-reboot-action.sh"
-}
-
-fsmon /tmp {
-    enabled = true
-    interval = 3600
-    logmark  = true
-    warning  = 0.95
-    critical = 1.0
-#    script = "/path/to/alt-reboot-action.sh"
-}
-
-# Monitors load average based on sysinfo() from /proc/loadavg
-# The level is composed from the average of the 1 and 5 min marks.
-#loadavg {
+#fsmon /var {
 #    enabled = true
 #    interval = 300
-#    logmark  = true
-#    warning  = 1.0
-#    critical = 2.0
+#    logmark  = false
+#    warning  = 0.95
+#    critical = 1.0
 #    script = "/path/to/alt-reboot-action.sh"
 #}

+# Monitors load average based on sysinfo() from /proc/loadavg
+# The level is composed from the average of the 1 and 5 min marks.
+loadavg {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 1.0
+    critical = 2.0
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
 # Monitors free RAM based on data from /proc/meminfo
 meminfo {
-    enabled = true
-    interval = 3600
-    logmark  = true
+#    enabled = true
+    interval = 300
+    logmark  = false
    warning  = 0.9
-    critical = 0.97
+    critical = 0.95
 #    script = "/path/to/alt-reboot-action.sh"
 }

@@ -1,49 +1,23 @@
 #!/bin/sh
-# Prompt for a secret with confirmation, then encode and output it.
-#
-# Default mode: hash with mkpasswd (for system passwords)
-#    askpass [OUTPUT]
-#
-# Base64 mode (-b): base64-encode (for keystore passphrases)
-#    askpass -b [OUTPUT]
-#
-# If OUTPUT is given, result is written to the file.
-# If omitted, result is written to stdout.
 # shellcheck disable=SC3045

-LABEL="New password"
-MODE=hash
-if [ "$1" = "-b" ]; then
-    LABEL="Passphrase"
-    MODE=base64
-    shift
-fi
 OUTPUT=$1

-read -r -s -p "$LABEL: " secret
+read -r -s -p "New password: " password
 >&2 echo
-read -r -s -p "Retype $LABEL: " secret_again
+read -r -s -p "Retype password: " password_again
 >&2 echo

-if [ "$secret" != "$secret_again" ]; then
-    echo "${LABEL}s do not match, try again."
+if [ "$password" != "$password_again" ]; then
+    echo "Passwords do not match, try again."
    exit 1
 fi

-if [ -z "$secret" ]; then
-    echo "Empty $LABEL, try again."
-    exit 1
-fi
-
-if [ "$MODE" = "base64" ]; then
-    encoded=$(printf '%s' "$secret" | base64 -w 0)
-else
-    encoded=$(printf '%s\n' "$secret" | mkpasswd -s)
+if [ -z "$OUTPUT" ]; then
+    echo "$password"
+    exit 0
 fi

 umask 0177
-if [ -z "$OUTPUT" ]; then
-    echo "$encoded"
-else
-    printf '%s' "$encoded" > "$OUTPUT"
-fi
+echo "$password" | mkpasswd -s > "$OUTPUT"
+exit 0
@@ -0,0 +1,58 @@
+#!/bin/sh
+# User-friendly wrapper for sysrepocfg
+# TODO: add import/export, copy, ...
+
+# Edit YANG binary types using sysrepo, base64, and duct tape.
+edit()
+{
+    xpath=$1
+    if [ -z "$xpath" ]; then
+	echo "Usage: cfg edit \"/full/xpath/to/binary/leaf\""
+	exit 1
+    fi
+
+    if tmp=$(sysrepocfg -G "$xpath"); then
+	file=$(mktemp)
+
+	echo "$tmp" | base64 -d > "$file"
+	if /usr/bin/editor "$file"; then
+	    tmp=$(base64 -w0 < "$file")
+	    sysrepocfg -S "$xpath" -u "$tmp"
+	fi
+
+	rm -f "$file"
+    else
+	echo "Failed to retrieve value for $xpath"
+	exit 1
+    fi
+}
+
+usage()
+{
+    echo "Usage:"
+    echo "    cfg CMD [ARG]"
+    echo
+    echo "Command:"
+    echo "    edit XPATH   Edit YANG binary type"
+    echo "    help         This help text"
+    echo
+    echo "As a backwards compatible fallback, this script forwards"
+    echo "all other commands as options to sysrepocfg."
+    echo
+
+    exit 0
+}
+
+cmd=$1; shift
+case $cmd in
+    edit)
+	edit "$1"
+	;;
+    help)
+	usage
+	;;
+    *)
+	set -- "$cmd" "$@"
+	exec sysrepocfg -f json "$@"
+	;;
+esac
@@ -0,0 +1 @@
+/etc/alternatives/editor
@@ -91,7 +91,7 @@ EOF

 is_dhcp_running()
 {
-    copy operational -x /infix-dhcp-server:dhcp-server | jq -r '
+    sysrepocfg -X -f json -m infix-dhcp-server | jq -r '
        ."infix-dhcp-server:dhcp-server".enabled as $global |
        if ."infix-dhcp-server:dhcp-server".subnet? then
                (."infix-dhcp-server:dhcp-server".subnet[] |
@@ -110,15 +110,15 @@ dhcp()

    case $1 in
 	detail)
-	    copy operational -x /infix-dhcp-server:dhcp-server | \
+	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
 		jq -C .
 	    ;;
 	stat*)
-	    copy operational -x /infix-dhcp-server:dhcp-server | \
+	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
 		/usr/libexec/statd/cli-pretty "show-dhcp-server" -s
 	    ;;
 	*)
-	    copy operational -x /infix-dhcp-server:dhcp-server | \
+	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
 		/usr/libexec/statd/cli-pretty "show-dhcp-server"
 	    ;;
    esac
@@ -182,13 +182,13 @@ ifaces()
    else
 	if [ $# -gt 0 ]; then
 	    for iface in $*; do
-		copy operational -x \
+		sysrepocfg -f json -X -d operational -x \
 			   "/ietf-interfaces:interfaces/interface[name='$iface']" | \
 		    /usr/libexec/statd/cli-pretty "show-interfaces" -n "$iface"
 	    done
 	    return
 	fi
-        copy operational -x /ietf-interfaces:interfaces | \
+        sysrepocfg -f json -X -d operational -m ietf-interfaces | \
          /usr/libexec/statd/cli-pretty "show-interfaces"
    fi
 }
@@ -227,7 +227,7 @@ rstp()

 stp()
 {
-    copy operational -x /ietf-interfaces:interfaces | \
+    sysrepocfg -f json -X -d operational -m ietf-interfaces | \
        /usr/libexec/statd/cli-pretty "show-bridge-stp"
 }

@@ -248,7 +248,7 @@ routes()
    else
 	arg="-i ipv4"
    fi
-    copy operational -x /ietf-routing:routing/ribs | \
+    sysrepocfg -f json -X -d operational -x "/ietf-routing:routing/ribs" | \
 	/usr/libexec/statd/cli-pretty "show-routing-table" $arg
 }

@@ -1,600 +0,0 @@
-#!/usr/bin/env python3
-"""
-iw command wrapper that returns structured JSON data
-
-Usage:
-    iw.py list                  - List all PHY devices
-    iw.py dev                   - List all interfaces grouped by PHY
-    iw.py info <device>         - Get PHY or interface information
-    iw.py survey <interface>    - Get channel survey data
-"""
-
-import sys
-import json
-import subprocess
-import re
-def decode_iw_ssid(ssid):
-    """Decode iw escaped SSID (\\xHH) to UTF-8, stripping non-printable chars."""
-    try:
-        ssid = ssid.encode().decode('unicode_escape').encode('latin-1').decode('utf-8')
-    except (UnicodeDecodeError, UnicodeEncodeError):
-        return ssid
-    return ''.join(c for c in ssid if c.isprintable())
-
-
-def run_iw(*args):
-    """Run iw command and return output"""
-    try:
-        result = subprocess.run(
-            ['iw'] + list(args),
-            capture_output=True,
-            text=True,
-            timeout=5
-        )
-        if result.returncode == 0:
-            return result.stdout
-        return None
-    except Exception:
-        return None
-
-
-def normalize_phy_name(name):
-    """
-    Convert radioN to phyN or vice versa based on what exists in sysfs.
-    Returns the actual phy name that exists.
-    """
-    import os
-
-    # Try the name as-is first
-    if os.path.exists(f'/sys/class/ieee80211/{name}'):
-        return name
-
-    # Try converting radioN <-> phyN
-    if name.startswith('radio'):
-        phy_name = 'phy' + name[5:]
-        if os.path.exists(f'/sys/class/ieee80211/{phy_name}'):
-            return phy_name
-    elif name.startswith('phy'):
-        radio_name = 'radio' + name[3:]
-        if os.path.exists(f'/sys/class/ieee80211/{radio_name}'):
-            return radio_name
-
-    # Return original if nothing found
-    return name
-
-
-def parse_phy_info(phy_name):
-    """
-    Parse 'iw phy <name> info' output or 'iw <name> info' output
-    Returns: {bands, driver, manufacturer, max_txpower, num_virtual_interfaces, interface_combinations}
-    """
-    # Normalize the phy name
-    actual_phy = normalize_phy_name(phy_name)
-
-    # Try 'iw phy <name> info' first
-    output = run_iw('phy', actual_phy, 'info')
-
-    # If that fails, try 'iw <name> info' (some systems support this)
-    if not output:
-        output = run_iw(actual_phy, 'info')
-
-    if not output:
-        return {}
-
-    result = {
-        'name': phy_name,
-        'bands': [],
-        'driver': None,
-        'manufacturer': None,
-        'max_txpower': None,
-        'num_virtual_interfaces': 0,
-        'interface_combinations': []
-    }
-
-    current_band = None
-    band_num = 0
-    in_combinations = False
-    max_power = None
-
-    for line in output.splitlines():
-        stripped = line.strip()
-
-        # Detect band sections
-        if stripped.startswith('Band '):
-            if current_band and current_band.get('frequencies'):
-                result['bands'].append(current_band)
-            band_num += 1
-            current_band = {
-                'band': band_num,
-                'frequencies': [],
-                'name': None,
-                'ht_capable': False,
-                'vht_capable': False,
-                'he_capable': False
-            }
-            in_combinations = False
-
-        # Parse frequencies (handle both "2412 MHz" and "2412.0 MHz" formats)
-        elif current_band and not in_combinations:
-            freq_match = re.match(r'\* ([0-9.]+) MHz.*?\(([0-9.]+) dBm\)', stripped)
-            if freq_match:
-                freq = int(float(freq_match.group(1)))  # Convert "2412.0" to 2412
-                power = float(freq_match.group(2))
-
-                current_band['frequencies'].append(freq)
-
-                # Track max power
-                if max_power is None or power > max_power:
-                    max_power = power
-
-            # Check capabilities
-            if 'HT ' in stripped or 'High Throughput' in stripped:
-                current_band['ht_capable'] = True
-            if 'VHT' in stripped or 'Very High Throughput' in stripped:
-                current_band['vht_capable'] = True
-            if 'HE ' in stripped or 'High Efficiency' in stripped:
-                current_band['he_capable'] = True
-
-        # Detect interface combinations section
-        if 'valid interface combinations:' in stripped.lower():
-            in_combinations = True
-            continue
-
-        # Parse interface combinations
-        if in_combinations:
-            if stripped.startswith('*'):
-                # Parse combination line
-                comb_info = {'limits': []}
-
-                # Parse limits: #{ type } <= max
-                limit_matches = re.findall(r'#\{\s*([^}]+)\s*\}\s*<=\s*(\d+)', stripped)
-                for types_str, max_val in limit_matches:
-                    types = [t.strip() for t in types_str.split(',')]
-                    comb_info['limits'].append({
-                        'max': int(max_val),
-                        'types': types
-                    })
-
-                # Parse total
-                total_match = re.search(r'total\s*<=\s*(\d+)', stripped)
-                if total_match:
-                    comb_info['max_total'] = int(total_match.group(1))
-
-                # Parse channels
-                channels_match = re.search(r'#channels\s*<=\s*(\d+)', stripped)
-                if channels_match:
-                    comb_info['num_channels'] = int(channels_match.group(1))
-
-                if comb_info.get('limits') or comb_info.get('max_total'):
-                    result['interface_combinations'].append(comb_info)
-
-            elif not stripped.startswith('#') and ':' in stripped and not stripped.startswith('*'):
-                # End of combinations section
-                in_combinations = False
-
-    # Add last band
-    if current_band and current_band.get('frequencies'):
-        result['bands'].append(current_band)
-
-    # Determine band names and assign band numbers
-    for band in result['bands']:
-        if band['frequencies']:
-            freq = band['frequencies'][0]
-            if 2400 <= freq <= 2500:
-                band['name'] = '2.4GHz'
-                band['band'] = 1
-            elif 5150 <= freq <= 5900:
-                band['name'] = '5GHz'
-                band['band'] = 2
-            elif 5955 <= freq <= 7115:
-                band['name'] = '6GHz'
-                band['band'] = 3
-
-    # Set max TX power
-    if max_power is not None:
-        result['max_txpower'] = int(max_power)
-
-    # Get driver and manufacturer from sysfs
-    try:
-        driver_link = subprocess.run(
-            ['readlink', '-f', f'/sys/class/ieee80211/{actual_phy}/device/driver'],
-            capture_output=True, text=True, timeout=1
-        ).stdout.strip()
-
-        if driver_link:
-            driver_name = driver_link.split('/')[-1]
-            result['driver'] = driver_name
-
-            # Map driver to manufacturer
-            driver_lower = driver_name.lower()
-            if 'mt' in driver_lower or 'mediatek' in driver_lower:
-                result['manufacturer'] = 'MediaTek Inc.'
-            elif 'rtw' in driver_lower or 'realtek' in driver_lower:
-                result['manufacturer'] = 'Realtek Semiconductor Corp.'
-            elif 'ath' in driver_lower or 'qca' in driver_lower:
-                result['manufacturer'] = 'Qualcomm Atheros'
-            elif 'iwl' in driver_lower or 'intel' in driver_lower:
-                result['manufacturer'] = 'Intel Corporation'
-            elif 'brcm' in driver_lower or 'broadcom' in driver_lower:
-                result['manufacturer'] = 'Broadcom Inc.'
-    except Exception:
-        pass
-
-    # Count virtual interfaces
-    dev_output = run_iw('dev')
-    if dev_output:
-        # Extract phy number from actual phy name
-        phy_num = None
-        if actual_phy.startswith('radio'):
-            phy_num = actual_phy[5:]
-        elif actual_phy.startswith('phy'):
-            phy_num = actual_phy[3:]
-
-        if phy_num:
-            count = 0
-            current_phy = None
-            for line in dev_output.splitlines():
-                if line.startswith('phy#'):
-                    current_phy = line.replace('phy#', '').strip()
-                elif current_phy == phy_num and 'Interface' in line:
-                    count += 1
-            result['num_virtual_interfaces'] = count
-
-    return result
-
-
-def parse_interface_info(ifname):
-    """
-    Parse 'iw dev <name> info' output
-    Returns: {ifname, iftype, mac, ssid, frequency, channel, txpower, channel_width}
-    """
-    output = run_iw('dev', ifname, 'info')
-    if not output:
-        return {}
-
-    result = {'ifname': ifname}
-
-    for line in output.splitlines():
-        stripped = line.strip()
-
-        # Interface type
-        if stripped.startswith('type '):
-            result['iftype'] = stripped.split()[1]
-
-        # MAC address
-        elif stripped.startswith('addr '):
-            result['mac'] = stripped.split()[1]
-
-        # SSID
-        elif stripped.startswith('ssid '):
-            result['ssid'] = decode_iw_ssid(' '.join(stripped.split()[1:]))
-
-        # Channel/frequency
-        elif stripped.startswith('channel '):
-            parts = stripped.split()
-            if len(parts) >= 2:
-                result['channel'] = int(parts[1])
-            if 'MHz' in stripped:
-                freq_match = re.search(r'\((\d+) MHz', stripped)
-                if freq_match:
-                    result['frequency'] = int(freq_match.group(1))
-            # Channel width
-            if 'width:' in stripped:
-                width_match = re.search(r'width:\s*(\d+)\s*MHz', stripped)
-                if width_match:
-                    result['channel_width'] = f"{width_match.group(1)} MHz"
-
-        # TX power
-        elif stripped.startswith('txpower '):
-            power_match = re.search(r'([0-9.]+) dBm', stripped)
-            if power_match:
-                result['txpower'] = float(power_match.group(1))
-
-    return result
-
-
-def parse_stations(ifname):
-    """
-    Parse 'iw dev <name> station dump' output
-    Returns: list of connected stations with stats
-    """
-    output = run_iw('dev', ifname, 'station', 'dump')
-    if not output:
-        return []
-
-    stations = []
-    current = None
-
-    for line in output.splitlines():
-        stripped = line.strip()
-
-        # New station entry: "Station aa:bb:cc:dd:ee:ff (on wifiX)"
-        if stripped.startswith('Station '):
-            if current:
-                stations.append(current)
-            parts = stripped.split()
-            if len(parts) >= 2:
-                current = {'mac-address': parts[1].lower()}
-            else:
-                current = None
-            continue
-
-        if not current or ':' not in stripped:
-            continue
-
-        key, _, value = stripped.partition(':')
-        key = key.strip()
-        value = value.strip()
-
-        try:
-            if key == 'signal':
-                # Format: "-42 dBm" or "-42 [-44, -45] dBm"
-                current['signal-strength'] = int(value.split()[0])
-            elif key == 'connected time':
-                # Format: "123 seconds"
-                current['connected-time'] = int(value.split()[0])
-            elif key == 'rx bytes':
-                current['rx-bytes'] = value  # counter64: string-encoded
-            elif key == 'tx bytes':
-                current['tx-bytes'] = value  # counter64: string-encoded
-            elif key == 'rx packets':
-                current['rx-packets'] = value  # counter64: string-encoded
-            elif key == 'tx packets':
-                current['tx-packets'] = value  # counter64: string-encoded
-            elif key == 'tx bitrate':
-                # Format: "866.7 MBit/s ..." - convert to 100kbit/s units
-                speed_mbps = float(value.split()[0])
-                current['tx-speed'] = int(speed_mbps * 10)
-            elif key == 'rx bitrate':
-                speed_mbps = float(value.split()[0])
-                current['rx-speed'] = int(speed_mbps * 10)
-            elif key == 'inactive time':
-                # Format: "1234 ms"
-                current['inactive-time'] = int(value.split()[0])
-        except (ValueError, IndexError):
-            continue
-
-    if current:
-        stations.append(current)
-
-    return stations
-
-
-def parse_survey(ifname):
-    """
-    Parse 'iw dev <name> survey dump' output
-    Returns: list of {frequency, in_use, noise, active_time, busy_time, receive_time, transmit_time}
-    """
-    output = run_iw('dev', ifname, 'survey', 'dump')
-    if not output:
-        return []
-
-    channels = []
-    current_channel = None
-
-    for line in output.splitlines():
-        stripped = line.strip()
-
-        # New survey entry
-        if stripped.startswith('Survey data from'):
-            if current_channel:
-                channels.append(current_channel)
-            current_channel = None
-
-        # Frequency
-        elif stripped.startswith('frequency:'):
-            parts = stripped.split()
-            if len(parts) >= 2:
-                freq = int(parts[1])
-                in_use = '[in use]' in stripped
-                current_channel = {
-                    'frequency': freq,
-                    'in_use': in_use
-                }
-
-        # Channel metrics
-        elif current_channel:
-            if stripped.startswith('noise:'):
-                noise_match = re.search(r'(-?\d+) dBm', stripped)
-                if noise_match:
-                    current_channel['noise'] = int(noise_match.group(1))
-
-            elif stripped.startswith('channel active time:'):
-                time_match = re.search(r'(\d+) ms', stripped)
-                if time_match:
-                    current_channel['active_time'] = int(time_match.group(1))
-
-            elif stripped.startswith('channel busy time:'):
-                time_match = re.search(r'(\d+) ms', stripped)
-                if time_match:
-                    current_channel['busy_time'] = int(time_match.group(1))
-
-            elif stripped.startswith('channel receive time:'):
-                time_match = re.search(r'(\d+) ms', stripped)
-                if time_match:
-                    current_channel['receive_time'] = int(time_match.group(1))
-
-            elif stripped.startswith('channel transmit time:'):
-                time_match = re.search(r'(\d+) ms', stripped)
-                if time_match:
-                    current_channel['transmit_time'] = int(time_match.group(1))
-
-    # Add last channel
-    if current_channel:
-        channels.append(current_channel)
-
-    return channels
-
-
-def parse_list():
-    """
-    Parse 'iw list' output
-    Returns: list of PHY names
-    """
-    output = run_iw('list')
-    if not output:
-        return []
-
-    phys = []
-    for line in output.splitlines():
-        match = re.match(r'Wiphy (phy\d+|radio\d+)', line)
-        if match:
-            phys.append(match.group(1))
-
-    return phys
-
-
-def parse_dev():
-    """
-    Parse 'iw dev' output
-    Returns: dict mapping PHY numbers to list of interfaces
-    """
-    output = run_iw('dev')
-    if not output:
-        return {}
-
-    result = {}
-    current_phy = None
-
-    for line in output.splitlines():
-        # PHY line: "phy#0" or "phy#1"
-        if line.startswith('phy#'):
-            current_phy = line.replace('phy#', '').strip()
-            if current_phy not in result:
-                result[current_phy] = []
-        # Interface line: "    Interface wlan0"
-        elif current_phy and 'Interface' in line:
-            ifname = line.split('Interface')[1].strip()
-            result[current_phy].append(ifname)
-
-    return result
-
-
-def parse_link(ifname):
-    """
-    Parse 'iw dev <name> link' output for station mode
-    Returns: {connected, bssid, ssid, frequency, signal, tx_bitrate, rx_bitrate}
-    """
-    output = run_iw('dev', ifname, 'link')
-    if not output:
-        return {'connected': False}
-
-    if 'Not connected' in output:
-        return {'connected': False}
-
-    result = {'connected': True}
-
-    for line in output.splitlines():
-        stripped = line.strip()
-
-        # Connected to aa:bb:cc:dd:ee:ff
-        if stripped.startswith('Connected to '):
-            parts = stripped.split()
-            if len(parts) >= 3:
-                result['bssid'] = parts[2].lower()
-
-        # SSID: NetworkName
-        elif stripped.startswith('SSID: '):
-            result['ssid'] = decode_iw_ssid(stripped[6:])
-
-        # freq: 5180
-        elif stripped.startswith('freq: '):
-            try:
-                result['frequency'] = int(stripped[6:])
-            except ValueError:
-                pass
-
-        # signal: -42 dBm
-        elif stripped.startswith('signal: '):
-            try:
-                result['signal-strength'] = int(stripped.split()[1])
-            except (ValueError, IndexError):
-                pass
-
-        # tx bitrate: 866.7 MBit/s ...
-        elif stripped.startswith('tx bitrate: '):
-            try:
-                speed = float(stripped.split()[2])
-                result['tx-speed'] = int(speed * 10)  # 100kbit/s units
-            except (ValueError, IndexError):
-                pass
-
-        # rx bitrate: 780.0 MBit/s ...
-        elif stripped.startswith('rx bitrate: '):
-            try:
-                speed = float(stripped.split()[2])
-                result['rx-speed'] = int(speed * 10)
-            except (ValueError, IndexError):
-                pass
-
-    return result
-
-
-def main():
-    if len(sys.argv) < 2:
-        print(json.dumps({
-            'error': 'Usage: iw.py <command> [device]',
-            'commands': {
-                'list': 'List all PHY devices',
-                'dev': 'List all interfaces grouped by PHY',
-                'info': 'Get PHY or interface information (requires device)',
-                'survey': 'Get channel survey data (requires interface)',
-                'station': 'Get connected stations in AP mode (requires interface)',
-                'link': 'Get link info in station mode (requires interface)'
-            },
-            'examples': [
-                'iw.py list',
-                'iw.py dev',
-                'iw.py info radio0',
-                'iw.py info wlan0',
-                'iw.py station wifi0',
-                'iw.py link wlan0',
-                'iw.py survey wlan0'
-            ]
-        }, indent=2))
-        sys.exit(1)
-
-    command = sys.argv[1]
-
-    try:
-        if command == 'list':
-            data = parse_list()
-        elif command == 'dev':
-            data = parse_dev()
-        elif command == 'info':
-            if len(sys.argv) < 3:
-                data = {'error': 'info command requires device argument'}
-            else:
-                device = sys.argv[2]
-                # Auto-detect if device is a PHY (phy*/radio*) or interface
-                if device.startswith('phy') or device.startswith('radio'):
-                    data = parse_phy_info(device)
-                else:
-                    data = parse_interface_info(device)
-        elif command == 'station':
-            if len(sys.argv) < 3:
-                data = {'error': 'station command requires interface argument'}
-            else:
-                data = parse_stations(sys.argv[2])
-        elif command == 'link':
-            if len(sys.argv) < 3:
-                data = {'error': 'link command requires interface argument'}
-            else:
-                data = parse_link(sys.argv[2])
-        elif command == 'survey':
-            if len(sys.argv) < 3:
-                data = {'error': 'survey command requires interface argument'}
-            else:
-                data = parse_survey(sys.argv[2])
-        else:
-            data = {'error': f'Unknown command: {command}'}
-
-        print(json.dumps(data, indent=2, ensure_ascii=False))
-
-    except Exception as e:
-        print(json.dumps({'error': str(e)}))
-        sys.exit(1)
-
-
-if __name__ == '__main__':
-    main()
@@ -1,724 +0,0 @@
-#!/usr/bin/env python3
-"""
-WiFi Channel Visualization Tool
-Shows graphical representation of WiFi channel overlap and utilization
-"""
-
-import sys
-import json
-import argparse
-
-
-class Colors:
-    """ANSI color codes for terminal output"""
-    RESET = '\033[0m'
-    BOLD = '\033[1m'
-    RED = '\033[91m'
-    GREEN = '\033[92m'
-    YELLOW = '\033[93m'
-    BLUE = '\033[94m'
-    MAGENTA = '\033[95m'
-    CYAN = '\033[96m'
-    GRAY = '\033[90m'
-    BG_RED = '\033[101m'
-    BG_GREEN = '\033[102m'
-    BG_YELLOW = '\033[103m'
-    BG_BLUE = '\033[104m'
-    BG_GRAY = '\033[100m'
-
-
-def freq_to_channel(freq):
-    """Convert frequency (MHz) to WiFi channel number"""
-    # 2.4 GHz band
-    if 2412 <= freq <= 2484:
-        if freq == 2484:
-            return 14
-        return (freq - 2412) // 5 + 1
-    # 5 GHz band
-    elif 5170 <= freq <= 5825:
-        return (freq - 5000) // 5
-    # 6 GHz band
-    elif 5955 <= freq <= 7115:
-        return (freq - 5950) // 5
-    return None
-
-
-def get_channel_frequency(channel, band='2.4'):
-    """Get center frequency for a channel"""
-    if band == '2.4':
-        if channel == 14:
-            return 2484
-        return 2412 + (channel - 1) * 5
-    elif band == '5':
-        return 5000 + channel * 5
-    return None
-
-
-def get_busy_percentage(channel_data):
-    """Calculate channel busy percentage"""
-    active = channel_data.get('active-time', 0)
-    busy = channel_data.get('busy-time', 0)
-    if active > 0:
-        return (busy / active) * 100
-    return 0
-
-
-def get_utilization_color(busy_pct):
-    """Get color based on channel utilization"""
-    if busy_pct >= 50:
-        return Colors.RED
-    elif busy_pct >= 25:
-        return Colors.YELLOW
-    elif busy_pct >= 10:
-        return Colors.CYAN
-    else:
-        return Colors.GREEN
-
-
-def draw_channel_graph_2_4ghz(survey_data):
-    """Draw channel overlap graph for 2.4 GHz band"""
-    # Parse survey data
-    channels = {}
-    in_use_channel = None
-
-    for ch_data in survey_data:
-        freq = ch_data.get('frequency')
-        ch_num = freq_to_channel(freq)
-        if ch_num and 1 <= ch_num <= 14:
-            busy_pct = get_busy_percentage(ch_data)
-            channels[ch_num] = {
-                'freq': freq,
-                'noise': ch_data.get('noise', -100),
-                'busy': busy_pct,
-                'in_use': ch_data.get('in-use', False),
-                'active_time': ch_data.get('active-time', 0),
-                'busy_time': ch_data.get('busy-time', 0)
-            }
-            if ch_data.get('in-use'):
-                in_use_channel = ch_num
-
-    if not channels:
-        print("No 2.4 GHz channel data available")
-        return
-
-    print(f"\n{Colors.BOLD}2.4 GHz WiFi Channel Overlap Visualization{Colors.RESET}")
-    print("=" * 80)
-    print(f"Channel width: 20 MHz | Channel spacing: 5 MHz")
-    print(f"Non-overlapping channels: 1, 6, 11 (shown in {Colors.GREEN}green{Colors.RESET})")
-    print()
-
-    # Draw frequency scale
-    print("Frequency (MHz):")
-    print("2400        2420        2440        2460        2480")
-    print("|-----------|-----------|-----------|-----------|")
-
-    # Draw each channel as a bar showing its 20 MHz width
-    # Each channel occupies ~4 adjacent channels worth of space
-    for ch in range(1, 14):
-        if ch not in channels:
-            continue
-
-        data = channels[ch]
-        busy_pct = data['busy']
-        is_in_use = data['in_use']
-        noise = data['noise']
-
-        # Determine color based on status
-        if is_in_use:
-            color = Colors.BG_BLUE
-            marker = '█'
-        elif busy_pct >= 50:
-            color = Colors.RED
-            marker = '▓'
-        elif busy_pct >= 25:
-            color = Colors.YELLOW
-            marker = '▒'
-        elif busy_pct > 0:
-            color = Colors.CYAN
-            marker = '░'
-        else:
-            color = Colors.GRAY
-            marker = '·'
-
-        # Non-overlapping channels get green color
-        if ch in [1, 6, 11] and not is_in_use and busy_pct < 10:
-            color = Colors.GREEN
-
-        # Calculate position (each channel is offset by 5 MHz = 1 position)
-        # Channel 1 is at 2412 MHz, base is 2400
-        offset = ((data['freq'] - 2400) // 5)
-
-        # Draw channel bar (20 MHz = 4 positions wide)
-        line = ' ' * 80
-        line_arr = list(line)
-
-        # Mark the channel span (20 MHz width)
-        for i in range(4):
-            pos = offset + i - 2  # Center the 20 MHz around channel
-            if 0 <= pos < len(line_arr):
-                line_arr[pos] = marker
-
-        # Add channel label
-        label_pos = offset
-        if 0 <= label_pos < len(line_arr) - 5:
-            # Clear space for label
-            for i in range(5):
-                if label_pos + i < len(line_arr):
-                    line_arr[label_pos + i] = ' '
-
-        line = ''.join(line_arr)
-
-        # Status indicators
-        status = ""
-        if is_in_use:
-            status = f" {Colors.BOLD}[IN USE]{Colors.RESET}"
-
-        busy_color = get_utilization_color(busy_pct)
-
-        print(f"{color}Ch{ch:2d}{Colors.RESET} {color}{line}{Colors.RESET} "
-              f"{busy_color}{busy_pct:5.1f}%{Colors.RESET} "
-              f"{noise:4d}dBm{status}")
-
-    print("\n" + "=" * 80)
-    print(f"\n{Colors.BOLD}Legend:{Colors.RESET}")
-    print(f"  {Colors.BG_BLUE}██{Colors.RESET} In use (your network)")
-    print(f"  {Colors.RED}▓▓{Colors.RESET} High usage (>50%)")
-    print(f"  {Colors.YELLOW}▒▒{Colors.RESET} Medium usage (25-50%)")
-    print(f"  {Colors.CYAN}░░{Colors.RESET} Low usage (1-25%)")
-    print(f"  {Colors.GRAY}··{Colors.RESET} Idle (<1%)")
-    print()
-
-
-def draw_channel_list(survey_data):
-    """Draw a simple channel list with utilization bars"""
-    print(f"\n{Colors.BOLD}Channel Utilization{Colors.RESET}")
-    print("=" * 80)
-    print(f"{'Ch':<4} {'Freq':<6} {'Noise':<8} {'Busy%':<8} {'Utilization Bar':<40}")
-    print("-" * 80)
-
-    for ch_data in sorted(survey_data, key=lambda x: x.get('frequency', 0)):
-        freq = ch_data.get('frequency')
-        ch_num = freq_to_channel(freq)
-        if not ch_num:
-            continue
-
-        noise = ch_data.get('noise', -100)
-        busy_pct = get_busy_percentage(ch_data)
-        is_in_use = ch_data.get('in-use', False)
-
-        # Create utilization bar (40 chars wide = 100%)
-        bar_length = int(busy_pct * 40 / 100)
-        bar_color = get_utilization_color(busy_pct)
-
-        if is_in_use:
-            bar = f"{Colors.BG_BLUE}{'█' * bar_length}{Colors.RESET}"
-            marker = f" {Colors.BOLD}◀ IN USE{Colors.RESET}"
-        else:
-            bar = f"{bar_color}{'█' * bar_length}{Colors.RESET}"
-            marker = ""
-
-        empty = '░' * (40 - bar_length)
-
-        print(f"{ch_num:<4} {freq:<6} {noise:<8} {busy_pct:5.1f}%  {bar}{Colors.GRAY}{empty}{Colors.RESET}{marker}")
-
-    print()
-
-
-def draw_overlap_pie(survey_data):
-    """Draw a pie-style visualization of channel group utilization"""
-    # Parse channel data into 3 non-overlapping groups
-    # Group 1: channels 1-5 (centered on ch 1)
-    # Group 2: channels 4-8 (centered on ch 6)
-    # Group 3: channels 9-13 (centered on ch 11)
-
-    channels = {}
-    in_use_channel = None
-
-    for ch_data in survey_data:
-        freq = ch_data.get('frequency')
-        ch_num = freq_to_channel(freq)
-        if ch_num and 1 <= ch_num <= 13:
-            busy_pct = get_busy_percentage(ch_data)
-            channels[ch_num] = {
-                'busy': busy_pct,
-                'noise': ch_data.get('noise', -100),
-                'in_use': ch_data.get('in-use', False)
-            }
-            if ch_data.get('in-use'):
-                in_use_channel = ch_num
-
-    if not channels:
-        return
-
-    # Calculate group utilization (average of channels in each group)
-    groups = [
-        {'name': 'Ch 1', 'channels': [1, 2, 3, 4, 5], 'center': 1},
-        {'name': 'Ch 6', 'channels': [4, 5, 6, 7, 8], 'center': 6},
-        {'name': 'Ch 11', 'channels': [9, 10, 11, 12, 13], 'center': 11},
-    ]
-
-    for group in groups:
-        busy_values = [channels.get(ch, {}).get('busy', 0) for ch in group['channels'] if ch in channels]
-        group['avg_busy'] = sum(busy_values) / len(busy_values) if busy_values else 0
-        group['center_busy'] = channels.get(group['center'], {}).get('busy', 0)
-        group['in_use'] = in_use_channel in group['channels'] if in_use_channel else False
-
-    total_busy = sum(g['avg_busy'] for g in groups)
-
-    print(f"\n{Colors.BOLD}Channel Group Utilization (2.4 GHz){Colors.RESET}")
-    print("=" * 60)
-    print("Non-overlapping channel groups with their overlap zones:\n")
-
-    # Draw ASCII donut/pie
-    pie_width = 50
-
-    # Calculate proportions
-    if total_busy > 0:
-        for group in groups:
-            group['proportion'] = group['avg_busy'] / total_busy
-            group['width'] = max(1, int(group['proportion'] * pie_width))
-    else:
-        for group in groups:
-            group['proportion'] = 1/3
-            group['width'] = pie_width // 3
-
-    # Adjust to exactly fill pie_width
-    total_width = sum(g['width'] for g in groups)
-    if total_width < pie_width:
-        groups[0]['width'] += pie_width - total_width
-
-    # Draw the pie bar
-    pie_chars = ['█', '▓', '░']
-    colors = [Colors.GREEN, Colors.YELLOW, Colors.CYAN]
-
-    pie_line = ""
-    for i, group in enumerate(groups):
-        if group['in_use']:
-            color = Colors.BG_BLUE
-        elif group['avg_busy'] >= 50:
-            color = Colors.RED
-        elif group['avg_busy'] >= 25:
-            color = Colors.YELLOW
-        else:
-            color = Colors.GREEN
-
-        char = pie_chars[i % len(pie_chars)]
-        pie_line += f"{color}{char * group['width']}{Colors.RESET}"
-
-    # Draw centered pie
-    print(f"    ┌{'─' * pie_width}┐")
-    print(f"    │{pie_line}│")
-    print(f"    └{'─' * pie_width}┘")
-
-    # Legend with percentages
-    print()
-    for i, group in enumerate(groups):
-        char = pie_chars[i % len(pie_chars)]
-
-        if group['in_use']:
-            color = Colors.BG_BLUE
-            marker = " ◀ IN USE"
-        elif group['avg_busy'] >= 50:
-            color = Colors.RED
-            marker = ""
-        elif group['avg_busy'] >= 25:
-            color = Colors.YELLOW
-            marker = ""
-        else:
-            color = Colors.GREEN
-            marker = ""
-
-        pct_of_total = group['proportion'] * 100
-        print(f"    {color}{char * 3}{Colors.RESET} {group['name']:>5}: "
-              f"{group['center_busy']:5.1f}% busy (center), "
-              f"{group['avg_busy']:5.1f}% avg in overlap zone, "
-              f"{pct_of_total:4.1f}% of total{marker}")
-
-    # Draw overlap diagram
-    print(f"\n{Colors.BOLD}Channel Overlap Diagram:{Colors.RESET}")
-    print("    Ch:  1   2   3   4   5   6   7   8   9  10  11  12  13")
-    print("        ╔═══════════════════╗")
-    print("    G1: ║ 1 ─ 2 ─ 3 ─ 4 ─ 5 ║         (centered on ch 1)")
-    print("        ╚═══════╦═══════════╝")
-    print("                ╔═══════════════════╗")
-    print("    G2:         ║ 4 ─ 5 ─ 6 ─ 7 ─ 8 ║ (centered on ch 6)")
-    print("                ╚═══════════╦═══════╝")
-    print("                        ╔═══════════════════════╗")
-    print("    G3:                 ║ 9 ─10 ─11 ─12 ─13 ║   (centered on ch 11)")
-    print("                        ╚═══════════════════════╝")
-    print()
-
-
-def generate_svg(survey_data, output_file=None):
-    """Generate SVG image(s) showing channel overlap and utilization for both bands"""
-    # Separate channels by band
-    channels_2_4 = {}
-    channels_5 = {}
-    in_use_2_4 = None
-    in_use_5 = None
-
-    for ch_data in survey_data:
-        freq = ch_data.get('frequency')
-        ch_num = freq_to_channel(freq)
-        if not ch_num:
-            continue
-
-        busy_pct = get_busy_percentage(ch_data)
-        ch_info = {
-            'freq': freq,
-            'busy': busy_pct,
-            'noise': ch_data.get('noise', -100),
-            'in_use': ch_data.get('in-use', False)
-        }
-
-        if 2400 <= freq <= 2500:
-            channels_2_4[ch_num] = ch_info
-            if ch_info['in_use']:
-                in_use_2_4 = ch_num
-        elif 5100 <= freq <= 5900:
-            channels_5[ch_num] = ch_info
-            if ch_info['in_use']:
-                in_use_5 = ch_num
-
-    def busy_to_color(busy_pct, is_in_use=False):
-        if is_in_use:
-            return "#3b82f6"  # Blue
-        elif busy_pct >= 50:
-            return "#ef4444"  # Red
-        elif busy_pct >= 25:
-            return "#f59e0b"  # Yellow/Orange
-        elif busy_pct >= 10:
-            return "#06b6d4"  # Cyan
-        else:
-            return "#22c55e"  # Green
-
-    def generate_band_svg(channels, band, freq_min, freq_max, title, non_overlap_channels=None):
-        if not channels:
-            return None
-
-        width = 900
-        height = 400
-        margin_left = 60
-        margin_right = 40
-        margin_top = 60
-        margin_bottom = 80
-        chart_width = width - margin_left - margin_right
-        chart_height = height - margin_top - margin_bottom
-
-        def freq_to_x(freq):
-            return margin_left + (freq - freq_min) / (freq_max - freq_min) * chart_width
-
-        def busy_to_height(busy_pct):
-            return (busy_pct / 100) * chart_height
-
-        svg_parts = []
-
-        # SVG header
-        svg_parts.append(f'''<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 {width} {height}">
-  <defs>
-    <style>
-      .title {{ font: bold 18px sans-serif; fill: #333; }}
-      .label {{ font: 12px sans-serif; fill: #666; }}
-      .axis {{ font: 10px sans-serif; fill: #333; }}
-      .channel-label {{ font: bold 10px sans-serif; fill: #333; }}
-      .legend {{ font: 12px sans-serif; fill: #333; }}
-    </style>
-  </defs>
-
-  <!-- Background -->
-  <rect width="{width}" height="{height}" fill="#fafafa"/>
-
-  <!-- Title -->
-  <text x="{width/2}" y="30" text-anchor="middle" class="title">{title}</text>
-
-  <!-- Chart area -->
-  <rect x="{margin_left}" y="{margin_top}" width="{chart_width}" height="{chart_height}" fill="#fff" stroke="#ddd"/>
-''')
-
-        # Draw grid lines
-        for pct in [25, 50, 75, 100]:
-            y = margin_top + chart_height - busy_to_height(pct)
-            svg_parts.append(f'  <line x1="{margin_left}" y1="{y}" x2="{margin_left + chart_width}" y2="{y}" stroke="#eee" stroke-dasharray="4,4"/>')
-            svg_parts.append(f'  <text x="{margin_left - 5}" y="{y + 4}" text-anchor="end" class="axis">{pct}%</text>')
-
-        # Y-axis label
-        svg_parts.append(f'  <text x="15" y="{margin_top + chart_height/2}" text-anchor="middle" transform="rotate(-90, 15, {margin_top + chart_height/2})" class="label">Channel Busy %</text>')
-
-        # Draw channels as bars
-        for ch_num, data in sorted(channels.items()):
-            center_freq = data['freq']
-            busy_pct = data['busy']
-            is_in_use = data['in_use']
-
-            # 20 MHz width: ±10 MHz from center
-            x1 = freq_to_x(center_freq - 10)
-            x2 = freq_to_x(center_freq + 10)
-            bar_width = x2 - x1
-            bar_height = busy_to_height(busy_pct)
-            bar_y = margin_top + chart_height - bar_height
-
-            color = busy_to_color(busy_pct, is_in_use)
-            opacity = 0.6 if not is_in_use else 0.8
-
-            # Draw the channel bar
-            svg_parts.append(f'  <rect x="{x1}" y="{bar_y}" width="{bar_width}" height="{bar_height}" fill="{color}" opacity="{opacity}" stroke="{color}" stroke-width="1"/>')
-
-            # Channel label at bottom
-            label_x = freq_to_x(center_freq)
-            svg_parts.append(f'  <text x="{label_x}" y="{margin_top + chart_height + 15}" text-anchor="middle" class="channel-label">{ch_num}</text>')
-
-            # Frequency label (only for some channels to avoid clutter)
-            if band == '2.4' or ch_num in [36, 52, 100, 149, 165]:
-                svg_parts.append(f'  <text x="{label_x}" y="{margin_top + chart_height + 28}" text-anchor="middle" class="axis">{center_freq}</text>')
-
-            # Busy percentage on top of bar (if tall enough)
-            if bar_height > 20:
-                svg_parts.append(f'  <text x="{label_x}" y="{bar_y + 15}" text-anchor="middle" class="channel-label" fill="white">{busy_pct:.0f}%</text>')
-
-        # X-axis labels
-        svg_parts.append(f'  <text x="{margin_left + chart_width/2}" y="{height - 15}" text-anchor="middle" class="label">Channel (Center Frequency MHz)</text>')
-
-        # Legend
-        legend_y = margin_top + 10
-        legend_x = margin_left + chart_width - 150
-        legend_items = [
-            ("#3b82f6", "In Use"),
-            ("#ef4444", "High (>50%)"),
-            ("#f59e0b", "Medium (25-50%)"),
-            ("#06b6d4", "Low (10-25%)"),
-            ("#22c55e", "Idle (<10%)"),
-        ]
-
-        svg_parts.append(f'  <rect x="{legend_x - 10}" y="{legend_y - 5}" width="160" height="{len(legend_items) * 18 + 10}" fill="white" stroke="#ddd" rx="4"/>')
-
-        for i, (color, label) in enumerate(legend_items):
-            y = legend_y + 10 + i * 18
-            svg_parts.append(f'  <rect x="{legend_x}" y="{y - 8}" width="12" height="12" fill="{color}" opacity="0.7"/>')
-            svg_parts.append(f'  <text x="{legend_x + 18}" y="{y + 2}" class="legend">{label}</text>')
-
-        # Non-overlapping channels note (for 2.4 GHz)
-        if non_overlap_channels:
-            svg_parts.append(f'  <text x="{margin_left + 5}" y="{margin_top + chart_height + 50}" class="label">Non-overlapping: Ch {", ".join(map(str, non_overlap_channels))}</text>')
-            for ch in non_overlap_channels:
-                if ch in channels:
-                    center_freq = channels[ch]['freq']
-                    x = freq_to_x(center_freq)
-                    svg_parts.append(f'  <circle cx="{x}" cy="{margin_top + chart_height + 40}" r="8" fill="none" stroke="#22c55e" stroke-width="2"/>')
-                    svg_parts.append(f'  <text x="{x}" y="{margin_top + chart_height + 44}" text-anchor="middle" class="channel-label" fill="#22c55e">{ch}</text>')
-        else:
-            svg_parts.append(f'  <text x="{margin_left + 5}" y="{margin_top + chart_height + 50}" class="label">All channels non-overlapping (20 MHz spacing)</text>')
-
-        svg_parts.append('</svg>')
-        return '\n'.join(svg_parts)
-
-    # Generate SVGs for each band
-    svg_2_4 = generate_band_svg(channels_2_4, '2.4', 2400, 2485,
-                                 "2.4 GHz WiFi Channel Overlap &amp; Utilization",
-                                 [1, 6, 11])
-    svg_5 = generate_band_svg(channels_5, '5', 5150, 5850,
-                               "5 GHz WiFi Channel Utilization",
-                               None)
-
-    # Combine or output separately
-    if svg_2_4 and svg_5:
-        # Combine into one SVG with both bands stacked
-        combined = f'''<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 820">
-  <g transform="translate(0, 0)">
-{svg_2_4.replace('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 400">', '').replace('</svg>', '')}
-  </g>
-  <g transform="translate(0, 410)">
-{svg_5.replace('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 400">', '').replace('</svg>', '')}
-  </g>
-</svg>'''
-        svg_content = combined
-    elif svg_2_4:
-        svg_content = svg_2_4
-    elif svg_5:
-        svg_content = svg_5
-    else:
-        return None
-
-    if output_file:
-        with open(output_file, 'w') as f:
-            f.write(svg_content)
-        print(f"SVG written to: {output_file}")
-    else:
-        print(svg_content)
-
-    return svg_content
-
-
-def draw_recommendations(survey_data, json_output=False):
-    """Analyze channels and provide recommendations"""
-    # Parse channel data
-    channels = {}
-    in_use_channel = None
-
-    for ch_data in survey_data:
-        freq = ch_data.get('frequency')
-        ch_num = freq_to_channel(freq)
-        if ch_num:
-            busy_pct = get_busy_percentage(ch_data)
-            channels[ch_num] = {
-                'busy': busy_pct,
-                'noise': ch_data.get('noise', -100),
-                'in_use': ch_data.get('in-use', False)
-            }
-            if ch_data.get('in-use'):
-                in_use_channel = ch_num
-
-    # Find least congested non-overlapping channels
-    best_channels = []
-    for ch in [1, 6, 11]:
-        if ch in channels:
-            best_channels.append((ch, channels[ch]['busy']))
-
-    best_channels.sort(key=lambda x: x[1])
-
-    # JSON output
-    if json_output:
-        output = {
-            "recommended_channels": [
-                {"channel": ch, "busy_percent": round(busy, 1)}
-                for ch, busy in best_channels
-            ]
-        }
-        if in_use_channel:
-            output["current_channel"] = in_use_channel
-            output["current_busy_percent"] = round(channels.get(in_use_channel, {}).get('busy', 0), 1)
-
-        print(json.dumps(output, indent=2))
-        return
-
-    # Text output
-    print(f"\n{Colors.BOLD}Channel Recommendations{Colors.RESET}")
-    print("=" * 80)
-
-    if in_use_channel:
-        print(f"Current channel: {Colors.BOLD}{in_use_channel}{Colors.RESET}")
-        current_busy = channels.get(in_use_channel, {}).get('busy', 0)
-        if current_busy > 50:
-            print(f"  {Colors.RED}⚠{Colors.RESET}  High congestion detected ({current_busy:.1f}% busy)")
-        elif current_busy > 25:
-            print(f"  {Colors.YELLOW}⚠{Colors.RESET}  Moderate congestion ({current_busy:.1f}% busy)")
-        else:
-            print(f"  {Colors.GREEN}✓{Colors.RESET}  Good channel utilization ({current_busy:.1f}% busy)")
-
-    print(f"\nRecommended non-overlapping channels (2.4 GHz):")
-    for i, (ch, busy) in enumerate(best_channels[:3], 1):
-        color = get_utilization_color(busy)
-        marker = "★" if i == 1 else " "
-        print(f"  {marker} Channel {ch:2d}: {color}{busy:5.1f}% busy{Colors.RESET}")
-
-    print()
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description='Visualize WiFi channel overlap and utilization',
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog='''
-Examples:
-  # Read from yanger output (show all sections)
-  yanger -x "ixll -A ssh host sudo" ietf-hardware | %(prog)s
-
-  # Read from file
-  %(prog)s survey_data.json
-
-  # Show only list view
-  %(prog)s --list survey_data.json
-
-  # Show only specific sections
-  %(prog)s --overlap survey_data.json
-  %(prog)s --pie survey_data.json
-  %(prog)s --utilization survey_data.json
-  %(prog)s --recommendations survey_data.json
-  %(prog)s --overlap --pie survey_data.json
-
-  # Output recommendations as JSON
-  %(prog)s --recommendations --json survey_data.json
-
-  # Generate SVG image
-  %(prog)s --svg /tmp/wifi-channels.svg survey_data.json
-  %(prog)s --svg - survey_data.json > output.svg
-        '''
-    )
-    parser.add_argument('file', nargs='?', help='JSON file with hardware data (default: stdin)')
-    parser.add_argument('--list', action='store_true', help='Show simple list view instead of overlap graph')
-    parser.add_argument('--no-color', action='store_true', help='Disable colors')
-    parser.add_argument('--json', action='store_true', help='Output recommendations in JSON format')
-    parser.add_argument('--svg', metavar='FILE', help='Generate SVG image to FILE (use - for stdout)')
-
-    # Section filters
-    parser.add_argument('--overlap', action='store_true', help='Show only channel overlap visualization (2.4 GHz)')
-    parser.add_argument('--pie', action='store_true', help='Show only channel group pie chart (2.4 GHz)')
-    parser.add_argument('--utilization', action='store_true', help='Show only channel utilization list')
-    parser.add_argument('--recommendations', action='store_true', help='Show only channel recommendations')
-
-    args = parser.parse_args()
-
-    # Disable colors if requested
-    if args.no_color:
-        for attr in dir(Colors):
-            if not attr.startswith('_'):
-                setattr(Colors, attr, '')
-
-    # Read input
-    if args.file:
-        with open(args.file, 'r') as f:
-            data = json.load(f)
-    else:
-        data = json.load(sys.stdin)
-
-    # Extract survey data from hardware components
-    survey_data = []
-    hardware = data.get('ietf-hardware:hardware', {})
-    components = hardware.get('component', [])
-
-    for component in components:
-        if component.get('class') == 'infix-hardware:wifi':
-            wifi_radio = component.get('infix-hardware:wifi-radio', {})
-            survey = wifi_radio.get('survey', {})
-            channels = survey.get('channel', [])
-            if channels:
-                survey_data.extend(channels)
-
-    if not survey_data:
-        print("No WiFi survey data found in input", file=sys.stderr)
-        print("Expected format: yanger ietf-hardware output with wifi-radio survey data", file=sys.stderr)
-        sys.exit(1)
-
-    # Generate SVG if requested (exclusive mode)
-    if args.svg:
-        output_file = None if args.svg == '-' else args.svg
-        generate_svg(survey_data, output_file)
-        return
-
-    # Determine which sections to show
-    # If no section flags are set, show all sections
-    show_all = not (args.overlap or args.pie or args.utilization or args.recommendations)
-
-    show_overlap = show_all or args.overlap
-    show_pie = show_all or args.pie
-    show_utilization = show_all or args.utilization
-    show_recommendations_section = show_all or args.recommendations
-
-    # Draw visualization
-    freqs = [ch.get('frequency', 0) for ch in survey_data]
-    has_2_4ghz = any(2400 <= f <= 2500 for f in freqs)
-
-    if show_overlap and has_2_4ghz and not args.list:
-        draw_channel_graph_2_4ghz(survey_data)
-
-    if show_pie and has_2_4ghz:
-        draw_overlap_pie(survey_data)
-
-    if show_utilization:
-        draw_channel_list(survey_data)
-
-    if show_recommendations_section:
-        draw_recommendations(survey_data, json_output=args.json)
-
-
-if __name__ == '__main__':
-    main()
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+if [ $# -ne 1 ]; then
+	echo "usage: $0 <ifname>"
+	exit 1
+fi
+ifname=$1
+
+TIMEOUT=300
+status=$(wpa_cli -i $ifname scan)
+while [ "$status" != "OK" ]; do
+	status=$(wpa_cli -i $ifname scan)
+	TIMEOUT=$((TIMEOUT-1))
+	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
+	sleep 0.5
+done
@@ -1,242 +0,0 @@
-#!/bin/sh
-# DHCPv6 client state update script for odhcp6c
-# This script expects a system with resolvconf (openresolv) and iproute2
-
-[ -z "$1" ] && echo "Error: should be called from odhcp6c" && exit 1
-
-interface="$1"
-state="$2"
-RESOLV_CONF="/run/resolvconf/interfaces/${interface}-ipv6.conf"
-NTPFILE="/run/chrony/dhcp-sources.d/${interface}-ipv6.sources"
-
-[ -n "$metric" ] || metric=5
-
-log()
-{
-	logger -I $$ -t odhcp6c -p user.notice "${interface}: $*"
-}
-
-dbg()
-{
-	logger -I $$ -t odhcp6c -p user.debug "${interface}: $*"
-}
-
-err()
-{
-	logger -I $$ -t odhcp6c -p user.err "${interface}: $*"
-}
-
-teardown_interface()
-{
-	ip -6 route flush dev "$interface"
-	ip -6 address flush dev "$interface" scope global
-}
-
-setup_interface()
-{
-	# Merge RA addresses with DHCP addresses
-	for entry in $RA_ADDRESSES; do
-		duplicate=0
-		addr="${entry%%/*}"
-		for dentry in $ADDRESSES; do
-			daddr="${dentry%%/*}"
-			[ "$addr" = "$daddr" ] && duplicate=1
-		done
-		[ "$duplicate" = "0" ] && ADDRESSES="$ADDRESSES $entry"
-	done
-
-	# Add addresses
-	for entry in $ADDRESSES; do
-		addr="${entry%%,*}"
-		entry="${entry#*,}"
-		preferred="${entry%%,*}"
-		entry="${entry#*,}"
-		valid="${entry%%,*}"
-
-		ip -6 address add "$addr" dev "$interface" preferred_lft "$preferred" valid_lft "$valid" proto dhcp
-		log "assigned address $addr (preferred=$preferred, valid=$valid)"
-	done
-
-	# Add routes from RA
-	for entry in $RA_ROUTES; do
-		addr="${entry%%,*}"
-		entry="${entry#*,}"
-		gw="${entry%%,*}"
-		entry="${entry#*,}"
-		valid="${entry%%,*}"
-		entry="${entry#*,}"
-		metric="${entry%%,*}"
-
-		if [ -n "$gw" ]; then
-			ip -6 route add "$addr" via "$gw" metric "$metric" dev "$interface" from "::/128"
-		else
-			ip -6 route add "$addr" metric "$metric" dev "$interface"
-		fi
-
-		# Add routes for delegated prefixes
-		for prefix in $PREFIXES; do
-			paddr="${prefix%%,*}"
-			[ -n "$gw" ] && ip -6 route add "$addr" via "$gw" metric "$metric" dev "$interface" from "$paddr"
-		done
-	done
-}
-
-handle_prefixes()
-{
-	# $PREFIXES format: "prefix/len,preferred,valid[,class=N][,excluded=...] ..."
-	for entry in $PREFIXES; do
-		addr="${entry%%,*}"
-		entry="${entry#*,}"
-		preferred="${entry%%,*}"
-		entry="${entry#*,}"
-		valid="${entry%%,*}"
-
-		log "received delegated prefix $addr (preferred=$preferred, valid=$valid)"
-
-		# Add unreachable route to prevent routing loops
-		ip -6 route add unreachable "$addr" 2>/dev/null
-
-		# Future: Distribute to downstream interfaces
-	done
-}
-
-handle_dns()
-{
-	truncate -s 0 "$RESOLV_CONF"
-
-	# Combine DHCPv6 DNS ($RDNSS) and RA DNS ($RA_DNS), deduplicating
-	all_dns=""
-	for server in $RDNSS $RA_DNS; do
-		# Simple deduplication: only add if not already in list
-		case " $all_dns " in
-			*" $server "*) ;;
-			*) all_dns="$all_dns $server" ;;
-		esac
-	done
-
-	# Domain search list (DHCPv6 option 24)
-	if [ -n "$DOMAINS" ]; then
-		dbg "adding search domains: $DOMAINS"
-		echo "search $DOMAINS # $interface" >> "$RESOLV_CONF"
-	fi
-
-	# DNS servers
-	for server in $all_dns; do
-		[ -z "$server" ] && continue
-		dbg "adding dns $server"
-		echo "nameserver $server # $interface" >> "$RESOLV_CONF"
-	done
-
-	if [ -n "$all_dns" ]; then
-		resolvconf -u
-	fi
-}
-
-handle_ntp()
-{
-	# DHCPv6 option 56 (NTP server) is provided as $OPTION_56 in hex format
-	# Format: sub-option-code (2 bytes) + length (2 bytes) + data
-	# Sub-option 1 = NTP server address (16 bytes IPv6)
-	#
-	# This is complex to parse in shell. For now, we attempt basic parsing
-	# and fall back to logging a warning if the format is unexpected.
-
-	if [ -n "$OPTION_56" ]; then
-		# Remove all non-hex characters (spaces, colons, etc.) and convert to lowercase
-		hex=$(echo "$OPTION_56" | tr -d '[:space:]:-' | tr '[:upper:]' '[:lower:]')
-
-		truncate -s 0 "$NTPFILE"
-		ntp_found=0
-
-		# Parse option 56: iterate through sub-options
-		# Each sub-option: 2 bytes code + 2 bytes length + data
-		pos=0
-		while [ $pos -lt ${#hex} ]; do
-			# Need at least 4 hex chars (2 bytes) for sub-option code
-			[ $((${#hex} - pos)) -lt 4 ] && break
-
-			# Extract sub-option code (2 bytes = 4 hex chars)
-			subopt_code=$(echo "$hex" | cut -c $((pos+1))-$((pos+4)))
-			pos=$((pos + 4))
-
-			# Need 4 more hex chars for length
-			[ $((${#hex} - pos)) -lt 4 ] && break
-
-			# Extract length (2 bytes = 4 hex chars)
-			subopt_len_hex=$(echo "$hex" | cut -c $((pos+1))-$((pos+4)))
-			subopt_len=$(printf "%d" "0x$subopt_len_hex")
-			pos=$((pos + 4))
-
-			# Sub-option 1 = NTP server address (should be 16 bytes for IPv6)
-			if [ "$subopt_code" = "0001" ] && [ "$subopt_len" -eq 16 ]; then
-				# Extract 16 bytes (32 hex chars) for IPv6 address
-				addr_hex=$(echo "$hex" | cut -c $((pos+1))-$((pos+32)))
-
-				# Convert hex to IPv6 address format
-				# Format: 0123456789abcdef0123456789abcdef -> 0123:4567:89ab:cdef:0123:4567:89ab:cdef
-				ipv6=$(echo "$addr_hex" | sed 's/\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)\(....\)/\1:\2:\3:\4:\5:\6:\7:\8/')
-
-				dbg "got NTP server $ipv6"
-				echo "server $ipv6 iburst" >> "$NTPFILE"
-				ntp_found=1
-			fi
-
-			# Skip this sub-option's data
-			pos=$((pos + subopt_len * 2))
-		done
-
-		if [ "$ntp_found" -eq 1 ]; then
-			chronyc reload sources >/dev/null 2>&1
-		else
-			dbg "option 56 received but no NTP server addresses found (consider using option 31/SNTP)"
-		fi
-	fi
-}
-
-log "state: $state"
-
-(
-	flock 9
-	case "$state" in
-		started)
-			# Initial state - clean up any stale config
-			teardown_interface
-			;;
-
-		bound)
-			# Fresh lease - tear down and set up from scratch
-			teardown_interface
-			setup_interface
-			handle_prefixes
-			handle_dns
-			handle_ntp
-			;;
-
-		informed|updated|rebound|ra-updated)
-			# Update existing configuration
-			setup_interface
-			[ -n "$PREFIXES" ] && handle_prefixes
-			handle_dns
-			handle_ntp
-			;;
-
-		unbound|stopped)
-			# Lost server or client stopped
-			teardown_interface
-			rm -f "$RESOLV_CONF"
-			rm -f "$NTPFILE"
-			resolvconf -u
-			chronyc reload sources >/dev/null 2>&1
-			;;
-	esac
-) 9>/tmp/odhcp6c.lock.${interface}
-rm -f /tmp/odhcp6c.lock.${interface}
-
-# Run hooks
-HOOK_DIR="/usr/libexec/odhcp6c.d"
-for hook in "${HOOK_DIR}/"*; do
-	[ -f "${hook}" -a -x "${hook}" ] || continue
-	"${hook}" "$interface" "$state"
-done
-
-exit 0
@@ -63,21 +63,6 @@ calc_sha()
    sha256sum "$1" 2>/dev/null | awk '{print $1}'
 }

-# Calculate a combined SHA256 over the container script and its
-# optional env file.  Environment variables are stored separately
-# from the script, so both must be included in the checksum to
-# detect configuration changes such as added/changed env vars.
-calc_config_sha()
-{
-    _envfile="/run/containers/args/${name}.env"
-
-    if [ -f "$_envfile" ]; then
-	cat "$1" "$_envfile" | sha256sum | awk '{print $1}'
-    else
-	calc_sha "$1"
-    fi
-}
-
 # Check image transport, return 0 if remote, 1 if local
 is_remote()
 {
@@ -139,7 +124,7 @@ is_uptodate()
 		    # If SHA matches, check container instance
 		    if [ "$stored_sha" = "$current_sha" ]; then
 			if podman container exists "$name"; then
-			    config_sha=$(calc_config_sha "$script")
+			    config_sha=$(calc_sha "$script")
 			    container_sha=$(podman inspect "$name" --format '{{index .Config.Labels "config-sha256"}}' 2>/dev/null)
 			    container_img_sha=$(podman inspect "$name" --format '{{index .Config.Labels "meta-image-sha256"}}' 2>/dev/null)

@@ -158,7 +143,7 @@ is_uptodate()
    else
 	# Remote image optimization: check config-sha256 only
 	if podman container exists "$name"; then
-	    config_sha=$(calc_config_sha "$script")
+	    config_sha=$(calc_sha "$script")
 	    container_sha=$(podman inspect "$name" --format '{{index .Config.Labels "config-sha256"}}' 2>/dev/null)

 	    if [ "$container_sha" = "$config_sha" ]; then
@@ -426,20 +411,10 @@ create()
 	logging="--log-driver syslog"
    fi

-    # Build resource limit arguments
-    resource=""
-    if [ -n "$memory" ]; then
-	resource="$resource --memory=$memory"
-    fi
-    if [ -n "$cpu_limit" ]; then
-	resource="$resource --cpu-quota=$cpu_limit"
-    fi
-
    # When we get here we've already fetched, or pulled, the image
-    args="$args --read-only --replace --quiet $caps"
-    args="$args --cgroups=enabled --cgroupns=host --cgroup-parent=system/container@$name"
+    args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
    args="$args --restart=$restart --systemd=false --tz=local $privileged"
-    args="$args $vol $mount $hostname $entrypoint $env $port $logging $resource"
+    args="$args $vol $mount $hostname $entrypoint $env $port $logging"
    pidfile=/run/container:${name}.pid

    [ -n "$quiet" ] || log "---------------------------------------"
@@ -474,7 +449,7 @@ create()
 	fi

 	# Add config checksum label
-	args="$args --label config-sha256=$(calc_config_sha "$script")"
+	args="$args --label config-sha256=$(calc_sha "$script")"
    fi

    # shellcheck disable=SC2048
@@ -741,8 +716,6 @@ options:
      --log-path PATH      Path for k8s-file log pipe
  -m, --mount HOST:DEST    Bind mount a read-only file inside a container
      --manual             Do not start container automatically after creation
-      --memory BYTES       Memory limit in bytes (supports K/M/G suffix)
-      --cpu-limit LIMIT    CPU limit in millicores (1000m = 100% of 1 core)
  -n, --name NAME          Alternative way of supplying name to start/stop/restart
      --privileged         Give container extended privileges
  -p, --publish PORT       Publish ports when creating container
@@ -863,14 +836,6 @@ while [ "$1" != "" ]; do
 	--manual)
 	    manual=true
 	    ;;
-	--memory)
-	    shift
-	    memory="$1"
-	    ;;
-	--cpu-limit)
-	    shift
-	    cpu_limit="$1"
-	    ;;
 	-n | --name)
 	    shift
 	    name="$1"
@@ -0,0 +1,111 @@
+#!/bin/sh
+# This script expects a system with resolvconf (openresolv) and iproute2
+
+[ -z "$1" ] && echo "Error: should be called from udhcpc6" && exit 1
+
+ACTION="$1"
+RESOLV_CONF="/run/resolvconf/interfaces/${interface}-ipv6.conf"
+NTPFILE="/run/chrony/dhcp-sources.d/${interface}-ipv6.sources"
+
+[ -n "$metric" ] || metric=5
+
+if [ -z "${IF_WAIT_DELAY}" ]; then
+	IF_WAIT_DELAY=10
+fi
+
+log()
+{
+    logger -I $$ -t udhcpc6 -p user.notice "${interface}: $*"
+}
+
+dbg()
+{
+    logger -I $$ -t udhcpc6 -p user.debug "${interface}: $*"
+}
+
+err()
+{
+    logger -I $$ -t udhcpc6 -p user.err "${interface}: $*"
+}
+
+clr_dhcpv6_addresses()
+{
+    addrs=$(ip -j addr show dev $interface \
+		| jq -c '.[0].addr_info[] | select(.family == "inet6") | select(.protocol == "dhcp")')
+
+    for addr in $addrs; do
+	ip="$(echo "$addr" | jq -r '."local"')"
+	prefix="$(echo "$addr" | jq -r '."prefixlen"')"
+	log "removing $ip/$prefix"
+	ip addr del "$ip/$prefix" dev "$interface"
+    done
+}
+
+log "action $ACTION"
+case "$ACTION" in
+    deconfig)
+	clr_dhcpv6_addresses
+
+	# drop info from this interface
+	rm -f "$RESOLV_CONF"
+	rm -f "$NTPFILE"
+	;;
+
+    leasefail|nak)
+	# DHCPv6 lease failed - log it
+	err "DHCPv6 lease failed"
+	;;
+
+    renew|bound)
+	# Add IPv6 address if provided (stateful DHCPv6)
+	if [ -n "$ipv6" ]; then
+	    if /bin/ip addr add dev $interface $ipv6 proto dhcp; then
+		log "assigned address $ipv6"
+	    fi
+	fi
+
+	# Handle delegated prefix (prefix delegation)
+	if [ -n "$ipv6prefix" ]; then
+	    log "received delegated prefix $ipv6prefix"
+	    # Prefix delegation handling could be added here
+	    # For now, just log it - actual routing/distribution
+	    # would need additional configuration
+	fi
+
+	# drop info from this interface
+	truncate -s 0 "$RESOLV_CONF"
+
+	# DHCPv6 domain search list (option 24)
+	if [ -n "$search" ]; then
+	    dbg "adding search $search"
+	    echo "search $search # $interface" >> $RESOLV_CONF
+	fi
+
+	# DHCPv6 DNS servers (option 23)
+	if [ -n "$dns" ]; then
+	    for i in $dns ; do
+		dbg "adding dns $i"
+		echo "nameserver $i # $interface" >> $RESOLV_CONF
+	    done
+	    resolvconf -u
+	fi
+
+	# NTP servers (option 56)
+	if [ -n "$ntpsrv" ]; then
+	    truncate -s 0 "$NTPFILE"
+	    for srv in $ntpsrv; do
+		dbg "got NTP server $srv"
+		echo "server $srv iburst" >> "$NTPFILE"
+	    done
+	    chronyc reload sources >/dev/null
+	fi
+	;;
+esac
+
+HOOK_DIR="$0.d"
+for hook in "${HOOK_DIR}/"*; do
+    [ -f "${hook}" -a -x "${hook}" ] || continue
+    "${hook}" "$ACTION"
+done
+
+exit 0
@@ -358,7 +358,6 @@ CONFIG_SND_SOC_JH7110_TDM=y
 CONFIG_SND_SOC_WM8960=y
 CONFIG_SND_SIMPLE_CARD=y
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
@@ -415,7 +414,6 @@ CONFIG_PHY_STARFIVE_JH7110_DPHY_RX=y
 CONFIG_PHY_STARFIVE_JH7110_PCIE=y
 CONFIG_PHY_STARFIVE_JH7110_USB=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
@@ -453,7 +451,6 @@ CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_NLS_ISO8859_15=y
-CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_LSM=""
 CONFIG_CRYPTO_CCM=m
@@ -475,16 +472,8 @@ CONFIG_DEBUG_FS=y
 # CONFIG_SLUB_DEBUG is not set
 CONFIG_DEBUG_RODATA_TEST=y
 CONFIG_DEBUG_WX=y
-CONFIG_PANIC_ON_OOPS=y
-CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY=y
-CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
-CONFIG_TEST_LOCKUP=m
 # CONFIG_SCHED_DEBUG is not set
 CONFIG_STACKTRACE=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
@@ -53,6 +53,7 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -68,31 +69,12 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
-CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -101,23 +83,15 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
-CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -134,69 +108,29 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_SET=y
-CONFIG_IP_SET_BITMAP_IP=y
-CONFIG_IP_SET_BITMAP_IPMAC=y
-CONFIG_IP_SET_BITMAP_PORT=y
-CONFIG_IP_SET_HASH_IP=y
-CONFIG_IP_SET_HASH_IPMARK=y
-CONFIG_IP_SET_HASH_IPPORT=y
-CONFIG_IP_SET_HASH_IPPORTIP=y
-CONFIG_IP_SET_HASH_IPPORTNET=y
-CONFIG_IP_SET_HASH_IPMAC=y
-CONFIG_IP_SET_HASH_MAC=y
-CONFIG_IP_SET_HASH_NETPORTNET=y
-CONFIG_IP_SET_HASH_NET=y
-CONFIG_IP_SET_HASH_NETNET=y
-CONFIG_IP_SET_HASH_NETPORT=y
-CONFIG_IP_SET_HASH_NETIFACE=y
-CONFIG_IP_SET_LIST_SET=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
-CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -257,7 +191,6 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
-CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -287,7 +220,6 @@ CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_EHCI_HCD=m
 CONFIG_USB_UHCI_HCD=m
@@ -306,10 +238,7 @@ CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT4_FS=y
-CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FUSE_FS=y
@@ -324,11 +253,8 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
-CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_ISO8859_15=y
-CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_AES=y
 CONFIG_CRYPTO_GCM=y
 CONFIG_DEBUG_KERNEL=y
@@ -337,13 +263,7 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY=y
-CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_DETECT_HUNG_TASK=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
-CONFIG_TEST_LOCKUP=m
 CONFIG_FUNCTION_TRACER=y
 CONFIG_UNWINDER_FRAME_POINTER=y
@@ -3,13 +3,13 @@ BR2_cortex_a7=y
 BR2_ARM_FPU_NEON_VFPV4=y
 BR2_TOOLCHAIN_EXTERNAL=y
 BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
 BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -24,13 +24,14 @@ BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/arm/rootfs"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.58"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
@@ -48,63 +49,42 @@ BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_LINUX_PAM=y
-BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
 BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
-BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FPING=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
-BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
-BR2_PACKAGE_NETCAT_OPENBSD=y
-BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_NMAP=y
-BR2_PACKAGE_NMAP_NCAT=y
-BR2_PACKAGE_NMAP_NMAP=y
-BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
-BR2_PACKAGE_TRACEROUTE=y
-BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
-BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
-BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_GETENT=y
-BR2_PACKAGE_HTOP=y
-BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
@@ -115,12 +95,6 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -132,17 +106,12 @@ BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
-BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
@@ -160,16 +129,13 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_ONIEPROM=y
-BR2_PACKAGE_TETRIS=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 IMAGE_ITB_AUX=y
 IMAGE_ITB_QCOW=y
 IMAGE_ITB_RAUC=y
@@ -3,13 +3,13 @@ BR2_cortex_a7=y
 BR2_ARM_FPU_NEON_VFPV4=y
 BR2_TOOLCHAIN_EXTERNAL=y
 BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
 BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -24,13 +24,14 @@ BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/arm/rootfs"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.58"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
@@ -48,7 +49,6 @@ BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
@@ -59,7 +59,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -77,13 +77,11 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_GETENT=y
@@ -97,12 +95,6 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -114,9 +106,6 @@ BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
@@ -144,6 +133,7 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 IMAGE_ITB_AUX=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.61"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -37,6 +37,8 @@ BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -51,6 +53,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
@@ -60,7 +63,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -71,6 +74,7 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPERF3=y
@@ -83,6 +87,7 @@ BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
+BR2_PACKAGE_NFTABLES=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
@@ -90,7 +95,6 @@ BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -98,7 +102,6 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
@@ -116,12 +119,6 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -133,7 +130,11 @@ BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
+INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
@@ -141,13 +142,7 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
-BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
@@ -163,7 +158,6 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -177,6 +171,7 @@ BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
@@ -8,14 +8,13 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -27,16 +26,19 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.61"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -51,13 +53,15 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
-BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -65,6 +69,7 @@ BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
@@ -75,16 +80,13 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
-BR2_PACKAGE_GETENT=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
@@ -95,12 +97,6 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -111,7 +107,11 @@ BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
+INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
@@ -119,15 +119,11 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -137,7 +133,6 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -145,8 +140,11 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 IMAGE_ITB_AUX=y
 IMAGE_ITB_QCOW=y
 IMAGE_ITB_RAUC=y
@@ -37,6 +37,5 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -37,6 +37,5 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -37,6 +37,5 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -43,7 +43,6 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_BOOTLOADER_SPLASHSCREEN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -1,6 +1,5 @@
 BR2_riscv=y
 BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
@@ -18,6 +17,7 @@ BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
+BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
@@ -36,17 +36,20 @@ BR2_LINUX_KERNEL_INTREE_DTS_NAME="starfive/jh7110-starfive-visionfive-2-v1.3b"
 BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
-BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_LINUX_FIRMWARE=y
 BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT61=y
 BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT73=y
 BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT2XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_81XX=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
@@ -57,10 +60,12 @@ BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
@@ -70,7 +75,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -81,6 +86,7 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPERF3=y
@@ -93,6 +99,7 @@ BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
+BR2_PACKAGE_NFTABLES=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
@@ -100,7 +107,6 @@ BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -108,7 +114,6 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
@@ -126,12 +131,6 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -167,15 +166,11 @@ BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visio
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_FEATURE_WIFI=y
-BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
-BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
@@ -188,7 +183,6 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -202,6 +196,7 @@ BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
@@ -17,16 +17,16 @@ BR2_SYSTEM_BIN_SH_NONE=y
 BR2_PACKAGE_RPI_FIRMWARE=y
 BR2_PACKAGE_RPI_FIRMWARE_BOOTCODE_BIN=y
 BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI=y
-BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/config.txt"
-BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/cmdline.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/config.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/cmdline.txt"
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_BAREBOX=y
 BR2_TARGET_BAREBOX_CUSTOM_VERSION=y
 BR2_TARGET_BAREBOX_CUSTOM_VERSION_VALUE="2025.06.0"
 BR2_TARGET_BAREBOX_BOARD_DEFCONFIG="rpi"
-BR2_TARGET_BAREBOX_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/barebox/extras.config"
-BR2_TARGET_BAREBOX_CUSTOM_EMBEDDED_ENV_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/barebox/env"
+BR2_TARGET_BAREBOX_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/barebox/extras.config"
+BR2_TARGET_BAREBOX_CUSTOM_EMBEDDED_ENV_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/barebox/env"
 BR2_TARGET_BAREBOX_IMAGE_FILE="images/barebox-raspberry-pi-2.img"
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
@@ -38,7 +38,6 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_BOOTLOADER_SPLASHSCREEN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.61"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -50,16 +50,16 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
-BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -70,6 +70,7 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPERF3=y
@@ -82,6 +83,7 @@ BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
+BR2_PACKAGE_NFTABLES=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
@@ -89,7 +91,6 @@ BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -97,7 +98,6 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
@@ -115,12 +115,6 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -139,15 +133,13 @@ BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_WIFI=y
-BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
-BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
@@ -163,7 +155,6 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -177,6 +168,7 @@ BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.61"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,9 +34,9 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
-BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -50,13 +50,13 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
-BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -64,6 +64,7 @@ BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
@@ -74,13 +75,11 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
 BR2_PACKAGE_GETENT=y
@@ -94,12 +93,6 @@ BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_WATCHDOGD_GENERIC=y
-BR2_PACKAGE_WATCHDOGD_LOADAVG=y
-BR2_PACKAGE_WATCHDOGD_FILENR=y
-BR2_PACKAGE_WATCHDOGD_MEMINFO=y
-BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -117,7 +110,6 @@ BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
@@ -136,7 +128,6 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -144,6 +135,7 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 IMAGE_ITB_AUX=y
@@ -3,92 +3,25 @@ Change Log

 All notable changes to the project are documented in this file.

-[v26.01.0][] - 2026-02-03
+[v26.01.0][UNRELEASED]
 -------------------------

-> [!IMPORTANT]
-> This release includes **breaking changes** to WiFi configuration that will
-> result in existing configuration being disabled:
->
-> - WiFi station/client configuration has been restructured. The `wifi` container
->   now requires a `radio` reference, and station configuration has moved under a
->   `wifi/station` container. Existing WiFi configurations must be manually updated
-> - WiFi radios are now configured via `ietf-hardware` instead of the interfaces module
->
-> Also, **Raspberry Pi users must upgrade the bootloader** before upgrading to
-> this release.  We recommend backing up your `startup-config.cfg` and reflash
-> the SD card with a new [sd card image][].
-
 ### Changes

-Noteworthy changes and additions in this release are marked below in bold text.
-
- **Upgrade Linux kernel from 6.12.65 to 6.18.8 (LTS)**
- Upgrade Buildroot to 2025.02.10 (LTS)
- Upgrade libyang to 4.2.2
- Upgrade sysrepo to 4.2.10
- Upgrade netopeer2 (NETCONF) to 2.7.0
- Add **RIPv2 routing support**, issue #582
- Add **NTP server support**, issue #904
- Migrate DHCPv6 client to odhcp6c for improved Router Advertisement
-  integration.  Adds support for hybrid RA+DHCPv6 deployments where SLAAC
-  assigns addresses and DHCPv6 provides DNS (common ISP scenario)
+- Upgrade Linux kernel to 6.12.61 (LTS)
+- Add RIPv2 routing support, issue #582
 - Add support for configurable OSPF debug logging, issue #1281. Debug options
  can now be enabled per category (bfd, packet, ism, nsm, default-information,
  nssa). All debug options are disabled by default to prevent log flooding in
  production environments. See the documentation for usage examples
- Add support for configurable container resource limits, memory and CPU.
-  Resource usage is available through the operational datastore, where the
-  currently active resource limits in the container runtime are also available
 - Add support for "routing interfaces", issue #647.  Lists interfaces with IP
  forwarding.  Inspect from CLI using `show interface`, look for `⇅` flag
- Add operational data journal to statd with hierarchical time-based retention
-  policy, keeping snapshots from every 5 minutes (recent) to yearly (historical)
- Add support data collection script, useful when troubleshooting issues on
-  deployed systems. Gathers system information, logs, and more.  Issue #1287
- Add **WiFi Access Point (AP) mode with multi-SSID support and WPA2/WPA3**
-  security.  **BREAKING:** WiFi architecture refactored with radios configured
-  via `ietf-hardware` and interfaces requiring `radio` reference. Station
-  config moved to `wifi/station` container.  Existing Wi-Fi interfaces will be
-  removed during upgrade (for the rest of the configuration to apply) and you
-  need to reconfigure them again.  See the [WiFi][] documentation for details
- Add support for **WireGuard VPN tunnels**.
- Updated CLI change command to support `cleartext-symmetric-key` (type binary).
-  Used by both WireGuard and WiFi, with application-specific `key-format` for
-  keys and passphrases
- New default NACM privilege levels (user levels) in `factory-config`:
-  `operator` (network & container manager) and `guest` (read-only).  For
-  details, see the updated system configuration documentation, as well as a
-  new dedicated NACM configuration guide
- New `show nacm` admin-exec command to inspect access control rules
- CLI now supports Ctrl-@ and Ctrl-w/Meta-w to mark and copy test regions
- CLI now uses `copy` and `rpc` tools instead of deprecated `sysrepocfg`.  The
-  latter now also require the use of `sudo` for `admin` level users
- Enhanced `copy` command with XPath filtering support
- Kernel now announces details of new USB devices
+- Add memory tuning configuration for embedded network devices with aggressive
+  dirty page writeback and OOM panic for deterministic recovery

 ### Fixes

- Fix #515: add per-interface IPv6 forwarding control using the Linux 6.17+
-  `force_forwarding` sysctl.  This provides true per-interface IPv6 forwarding
-  similar to IPv4, correctly mapping to the ietf-ip.yang model semantics
- Fix #1082: Wi-Fi interfaces always scanned, introduce a `scan-mode` to the
-  Wi-Fi concept in Infix
- Fix #1313: Container is not restarted if environment variable is changed
- Fix #1314: Raspberry Pi 4B with 1 or 8 GiB RAM does not boot.  This was due
-  newer EEPROM firmware in newer boards require a newer rpi-firmware package
- Fix #1345: firewall not updating when interfaces become bridge/lag ports
- Fix #1346: firewall complains in syslog, missing `/etc/firewalld/firewalld.conf`
- Fix Raspberry Pi 2B build, among other things, the `aarch32_defconfig` did
-  not include a dtb.  Please note, the platform has now been renamed to `arm`
- Fix default password hash in `do password encrypt` command.  New hash is the
-  same as the more commonly used `change password` command, *yescrypt*
- Prevent MOTD from showing on non-shell user login attempts
- Fix mDNS reflector.
-
-[wifi]: https://kernelkit.org/infix/latest/wifi/
-[sd card image]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
-
+N/A

 [v25.11.0][] - 2025-12-02
 -------------------------
@@ -1,284 +0,0 @@
-# Bridging
-
-This is the most central part of the system.  A bridge is a switch, and
-a switch is a bridge.  In Linux, setting up a bridge with ports
-connected to physical switch fabric, means you manage the actual switch
-fabric!
-
-## MAC Bridge
-
-In Infix ports are by default not switch ports, unless the customer
-specific factory config sets it up this way.  To enable switching, with
-offloading if you have a switch chipset, between ports you create a
-bridge and then add ports to that bridge.  Like this:
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit interface br0</b>
-admin@example:/config/interface/br0/> <b>up</b>
-admin@example:/config/> <b>set interface eth0 bridge-port bridge br0</b>
-admin@example:/config/> <b>set interface eth1 bridge-port bridge br0</b>
-admin@example:/config/> <b>leave</b>
-</code></pre>
-
-Here we add two ports to bridge `br0`: `eth0` and `eth1`.
-
-> [!TIP]
-> The CLI has several built-in helpers governed by convention.  E.g.,
-> naming bridges `brN`, where `N` is a number, the type is *inferred*
-> automatically and unlocks all bridge features.  Other conventions are
-> `vethNA`, where `N` is a number and `A` is a letter ('a' for access
-> port and 'b' for bridge side is common), and `ethN.M` for VLAN M on
-> top of `ethN`, or `dockerN` for a IP masquerading container bridge.
->
-> Note, this inference only works with the CLI, configuring networking
-> over NETCONF or RESTCONF requires setting the type explicitly.
-
-![A MAC bridge with two ports](img/mac-bridge.svg)
-
-It is possible to create multiple MAC bridges, however, it is
-currently[^1] _not recommended_ to use more than one MAC bridge on
-products with Marvell LinkStreet switching ASICs. A VLAN filtering
-bridge should be used instead.
-
-## VLAN Filtering Bridge
-
-By default bridges in Linux do not filter based on VLAN tags.  This can
-be enabled when creating a bridge by adding a port to a VLAN as a tagged
-or untagged member.  Use the port default VID (PVID) setting to control
-VLAN association for traffic ingressing a port untagged (default PVID:
-1).
-
-<pre class="cli"><code>admin@example:/config/> <b>edit interface br0</b>
-admin@example:/config/interface/br0/> <b>up</b>
-admin@example:/config/> <b>set interface eth0 bridge-port bridge br0</b>
-admin@example:/config/> <b>set interface eth0 bridge-port pvid 10</b>
-admin@example:/config/> <b>set interface eth1 bridge-port bridge br0</b>
-admin@example:/config/> <b>set interface eth1 bridge-port pvid 20</b>
-admin@example:/config/> <b>edit interface br0</b>
-admin@example:/config/interface/br0/> <b>set bridge vlans vlan 10 untagged eth0</b>
-admin@example:/config/interface/br0/> <b>set bridge vlans vlan 20 untagged eth1</b>
-</code></pre>
-
-This sets `eth0` as an untagged member of VLAN 10 and `eth1` as an
-untagged member of VLAN 20.  Switching between these ports is thus
-prohibited.
-
-![A VLAN bridge with two VLANs](img/vlan-bridge.svg)
-
-To terminate a VLAN in the switch itself, either for switch management
-or for routing, the bridge must become a (tagged) member of the VLAN.
-
-<pre class="cli"><code>admin@example:/config/interface/br0/> <b>set bridge vlans vlan 10 tagged br0</b>
-admin@example:/config/interface/br0/> <b>set bridge vlans vlan 20 tagged br0</b>
-</code></pre>
-
-To route or to manage via a VLAN, a VLAN interface needs to be created
-on top of the bridge, see section [VLAN Interfaces](ethernet.md#vlan-interfaces)
-for more on this topic.
-
-> [!NOTE]
-> In some use-cases only a single management VLAN on the bridge is used.
-> For the example above, if the bridge itself is an untagged member only
-> in VLAN 10, IP addresses can be set directly on the bridge without the
-> need for dedicated VLAN interfaces on top of the bridge.
-
-
-## Multicast Filtering and Snooping
-
-Multicast filtering in the bridge is handled by the bridge itself.  It
-can filter both IP multicast and MAC multicast.  For IP multicast it
-also supports "snooping", i.e., IGMP and MLD, to automatically reduce
-the broadcast effects of multicast.  See the next section for a summary
-of the [terminology used](#terminology-abbreviations).
-
-> [!IMPORTANT]
-> Currently there is no way to just enable multicast filtering without
-> also enabling snooping.  This may change in the future, in which case
-> a `filtering` enabled setting will be made available along with the
-> existing `snooping` setting.
-
-When creating your bridge you must decide if you need a VLAN filtering
-bridge or a plain bridge (see previous section).  Multicast filtering is
-supported for either, but take note that it must be enabled and set up
-per VLAN when VLAN filtering is enabled -- there are no global multicast
-settings in this operating mode.
-
-In the following example we have a regular 8-port bridge without VLAN
-filtering.  We focus on the multicast specific settings:
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit interface br0</b>
-admin@example:/config/interface/br0/> <b>set bridge multicast snooping</b>
-admin@example:/config/interface/br0/> <b>set ipv4 address 192.168.2.1 prefix-length 24</b>
-admin@example:/config/interface/br0/> <b>leave</b>
-admin@example:/> <b>copy running-config startup-config</b>
-</code></pre>
-
-Here we enable snooping and set a static IPv4 address so that the switch
-can take part in IGMP querier elections.  (MLD querier election
-currently not supported.)  We can inspect the current state:
-
-<pre class="cli"><code>admin@example:/> <b>show ip multicast</b>
-Multicast Overview
-Query Interval (default): 125 sec
-Router Timeout          : 255
-Fast Leave Ports        :
-Router Ports            :
-Flood Ports             : e0, e1, e2, e3, e4, e5, e6, e7
-
-<span class="header">Interface       VID  Querier                     State  Interval  Timeout  Ver</span>
-br0                  192.168.2.1                    Up       125     None    3
-
-<span class="header">Bridge          VID  Multicast Group       Ports                              </span>
-br0                  224.1.1.1             e3, e2
-br0                  ff02::6a              br0
-</code></pre>
-
-This is a rather small LAN, so our bridge has already become the elected
-IGMP querier.  We see it is ours because the timeout is `None`, and we
-recognize the IP address the system has detected, as ours.  We can also
-see two ports that have joined the same IPv4 multicast group, 224.1.1.1,
-and one join from the system itself for the IPv6 group ff02::6a.
-
-Now, let us see what happens when we add another bridge, this time with
-VLAN filtering enabled.  We skip the boring parts about how to move
-ports e4-e7 to `br1` and assign them to VLANs, and again, focus on the
-multicast bits only:
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit interface br1</b>
-admin@example:/config/interface/br1/> <b>set bridge vlans vlan 1 multicast snooping</b>
-admin@example:/config/interface/br1/> <b>set bridge vlans vlan 2 multicast snooping</b>
-admin@example:/config/interface/br1/> <b>leave</b>
-admin@example:/> <b>copy running-config startup-config</b>
-</code></pre>
-
-Let us see what we get:
-
-<pre class="cli"><code>admin@example:/> <b>show ip multicast</b>
-Multicast Overview
-Query Interval (default): 125 sec
-Router Timeout          : 255
-Fast Leave Ports        : e5
-Router Ports            : e1, e2, e5, e6, e7
-Flood Ports             : e1, e2, e3, e4, e5, e6, e7, e8
-
-<span class="header">Interface       VID  Querier                     State  Interval  Timeout  Ver</span>
-br0                  192.168.2.1                    Up       125     None    3
-br1               1  0.0.0.0                        Up       125     None    3
-br1               2  0.0.0.0                        Up       125     None    3
-
-<span class="header">Bridge          VID  Multicast Group       Ports                              </span>
-br0                  224.1.1.1             e2
-br0                  ff02::fb              br0
-br0                  ff02::6a              br0
-br0                  ff02::1:ff00:0        br0
-br1               1  224.1.1.1             e5
-br1               2  224.1.1.1             e7
-br1               1  ff02::fb              br1
-br1               1  ff02::1:ff00:0        br1
-</code></pre>
-
-In this setup we have a lot more going on.  Multiple multicast router
-ports have been detected, and behind the scenes someone has also added
-an IGMP/MLD fast-leave port.
-
-### Terminology & Abbreviations
-
- - **IGMP**: Internet Group Membership Protocol, multicast subscription
-   for IPv4, for details see [RFC3376][]
- - **MLD**: Multicast Listener Discovery (Protocol), multicast
-   subscription for IPv6, for details see [RFC3810][]
- - **Unknown/Unregistered multicast**: multicast groups that are *not*
-   in the multicast forwarding database (MDB)
- - **Known/Registered multicast**: multicast groups that *are* in the
-   multicast forwarding database (MDB)
- - **MDB**: the multicast forwarding database, consists of filters for
-   multicast groups, directing where multicast is allowed to egress.  A
-   filter entry consists of a group and a port list.  The bridge filters
-   with a unique database per VLAN, in the same was as the unicast FDB
- - **Join/Leave**: the terminology used in earlier versions of the two
-   protocols to subscribe and unsubscribe to a multicast group.  For
-   more information, see *Membership Report*
- - **Membership Report** A membership report is sent by end-devices and
-   forwarded by switches to the elected querier on the LAN.  They
-   consist of multiple "join" and "leave" operations on groups.  They
-   can also, per group, list which senders to allow or block.  Switches
-   usually only support the group subscription, and even more common
-   also only support filtering on the MAC level[^2]
- - **Querier election**: the process of determining who is the elected
-   IGMP/MLD querier on a LAN.  Lowest numerical IP address wins, the
-   special address 0.0.0.0 (proxy querier) never wins
- - **Proxy querier**: when no better querier exists on a LAN, one or
-   more devices can send proxy queries with source address 0.0.0.0 (or
-   :: for IPv6).  See **Query Interval**, below, why this is a good
-   thing
- - **Query interval**: the time in seconds between two queries from an
-   IGMP/MLD querier.  It is not uncommon that end-devices do not send
-   their membership reports unless they first hear a query
- - **Fast Leave**: set on a bridge port to ensure multicast is pruned as
-   quickly as possible when a "leave" membership report is received.  In
-   effect, this option marks the port as directly connected to an
-   end-device.  When not set (default), a query with timeout is first
-   sent to ensure no unintentional loss of multicast is incurred
- - **Router port**: can be both configured statically and detected at
-   runtime based on connected devices, usually multicast routers.  On
-   a router port *all* multicast is forwarded, both known and unknown
- - **Flood port**: set on a bridge port (default: enabled) to ensure
-   all *unknown* multicast is forwarded
- - **Router timeout**: the time in seconds until a querier is deemed to
-   have been lost and another device (switch/router) takes over.  In the
-   tables shown above, a *None* timeout is declared when the current
-   device is the active querier
-
-> [!TIP]
-> The reason why multicast flooding is enabled by default is to ensure
-> safe co-existence with MAC multicast, which is common in industrial
-> networks.  It also allows end devices that do not know of IGMP/MLD to
-> communicate over multicast as long as the group they have chosen is
-> not used by other IGMP/MLD aware devices on the LAN.
->
-> As soon as an IGMP/MLD membership report to "join" a group is received
-> the group is added to the kernel MDB and forwarding to other ports
-> stop.  The only exception to this rule is multicast router ports.
->
-> If your MAC multicast forwarding is not working properly, it may be
-> because an IP multicast group maps to the same MAC address.  Please
-> see [RFC 1112][RFC1112] for details.  Use static multicast router
-> ports, or static multicast MAC filters, to mitigate.
-
-[RFC1112]: https://www.rfc-editor.org/rfc/rfc1112.html
-[RFC3376]: https://www.rfc-editor.org/rfc/rfc3376.html
-[RFC3810]: https://www.rfc-editor.org/rfc/rfc3810.html
-
-## Forwarding of IEEE Reserved Group Addresses
-
-Addresses in the range `01:80:C2:00:00:0X` are used by various bridge
-signaling protocols, and are not forwarded by default.  Still, it is
-sometimes useful to let the bridge forward such packets, this can be
-done by specifying protocol names or the last address *nibble* as
-decimal value `0..15`:
-
-<pre class="cli"><code>admin@example:/config/> <b>edit interface br0 bridge</b>
-admin@example:/config/interface/br0/bridge/> <b>set ieee-group-forward</b>     # Tap the ? key for alternatives
-  [0..15]  List of IEEE link-local protocols to forward, e.g., STP, LLDP
-  dot1x    802.1X Port-Based Network Access Control.
-  lacp     802.3 Slow Protocols, e.g., LACP.
-  lldp     802.1AB Link Layer Discovery Protocol (LLDP).
-  stp      Spanning Tree (STP/RSPT/MSTP).
-admin@example:/config/interface/br0/bridge/> <b>set ieee-group-forward</b>
-</code></pre>
-
-The following example configures bridge *br0* to forward LLDP packets.
-
-<pre class="cli"><code>admin@example:/config/interface/br0/bridge/> <b>set ieee-group-forward lldp</b>
-admin@example:/config/interface/br0/bridge/>
-</code></pre>
-
-[^1]: MAC bridges on Marvell Linkstreet devices are currently limited to
-    a single MAC database, this may be a problem if the same MAC address
-    appears in different MAC bridges.
-[^2]: For example, IPv4 groups are mapped to MAC multicast addresses by
-    mapping the low-order 23-bits of the IP address in the low-order 23
-    bits of the Ethernet address 01:00:5E:00:00:00.  Meaning, more than
-    one IP multicast group maps to the same MAC multicast group.
@@ -16,22 +16,16 @@ CLI has several keybindings, most significant first:
 | Meta-b  | Ctrl-Left      | Move cursor back one word                        |
 | Ctrl-e  | End            | Move cursor to end of line                       |
 | Ctrl-a  | Home           | Move cursor to beginning of line                 |
-| Ctrl-@  | Ctrl-Space     | Mark current position for region operations      |
-| Meta w  |                | Copy region to kill buffer without deleting      |
 | Ctrl-k  |                | Kill (cut) text from cursor to end of line       |
 | Ctrl-u  |                | Delete (cut) entire line                         |
 | Ctrl-y  |                | Yank (paste) from kill buffer to cursor          |
 | Meta-.  |                | Yank (paste) last argument from previous line    |
-| Ctrl-w  |                | Kill region if mark set, else kill word backward |
-|         | Meta-Backspace | Delete (cut) word to the left                    |
+| Ctrl-w  | Meta-Backspace | Delete (cut) word to the left                    |
 |         | Meta-Delete    | Delete (cut) word to the right                   |
 | Ctrl-l  |                | Clear screen and refresh current line            |
 | Ctrl-p  | Up arrow       | History, previous command                        |
 | Ctrl-n  | Down arrow     | History, next command                            |
-| Ctrl-q  | Ctrl-v         | Insert next character literally                  |
 | Ctrl-r  |                | History, reversed interactive search (i-search)  |
-| Ctrl-t  |                | Transpose/Swap characters before and at cursor   |
-| Meta-#  | Alt-Shift-3    | Prepend # to current line and submit to history  |

 ## What is Meta?

@@ -92,18 +92,17 @@ your container image and application to run.

 Classic Hello World:

-<pre class="cli"><code>admin@example:/> <b>container run docker://hello-world</b>
-Starting docker://hello-world :: use Ctrl-p Ctrl-q to detach
-Trying to pull docker.io/library/hello-world:latest...
-Getting image source signatures
-Copying blob c1ec31eb5944 done
-Copying config d2c94e258d done
-Writing manifest to image destination
-Storing signatures
+    admin@example:/> container run docker://hello-world
+    Starting docker://hello-world :: use Ctrl-p Ctrl-q to detach
+    Trying to pull docker.io/library/hello-world:latest...
+    Getting image source signatures
+    Copying blob c1ec31eb5944 done
+    Copying config d2c94e258d done
+    Writing manifest to image destination
+    Storing signatures

-Hello from Docker!
-This message shows that your installation appears to be working correctly.
-</code></pre>
+    Hello from Docker!
+    This message shows that your installation appears to be working correctly.

 ### Example: Web Server

@@ -111,24 +110,22 @@ A web server with [nginx][], using standard docker bridge.  Podman will
 automatically create a VETH pair for us, connecting the container to the
 `docker0` bridge:

-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit interface docker0</b>
-admin@example:/config/interface/docker0/> <b>set container-network</b>
-admin@example:/config/interface/docker0/> <b>end</b>
-admin@example:/config/> <b>edit container web</b>
-admin@example:/config/container/web/> <b>set image docker://nginx:alpine</b>
-admin@example:/config/container/web/> <b>set network publish 8080:80</b>
-admin@example:/config/container/web/> <b>set network interface docker0</b>
-admin@example:/config/container/web/> <b>set volume cache target /var/cache</b>
-admin@example:/config/container/web/> <b>leave</b>
-admin@example:/> <b>show container</b>
-</code></pre>
+    admin@example:/> configure
+    admin@example:/config/> edit interface docker0
+    admin@example:/config/interface/docker0/> set container-network
+    admin@example:/config/interface/docker0/> end
+    admin@example:/config/> edit container web
+    admin@example:/config/container/web/> set image docker://nginx:alpine
+    admin@example:/config/container/web/> set network publish 8080:80
+    admin@example:/config/container/web/> set network interface docker0
+    admin@example:/config/container/web/> set volume cache target /var/cache
+    admin@example:/config/container/web/> leave
+    admin@example:/> show container

 Exit to the shell and verify the service with curl, or try to attach
 to your device's IP address using your browser:

-<pre class="cli"><code>admin@example:~$ <b>curl http://localhost:8080</b>
-</code></pre>
+    admin@example:~$ curl http://localhost:8080

 or connect to port 8080 of your running Infix system with a browser.
 See the following sections for how to add more interfaces and manage
@@ -145,32 +142,31 @@ how to upgrade to a newer base image.

 The CLI help shows:

-<pre class="cli"><code>admin@example:/config/container/system/> <b>help image</b>
-<b>NAME</b>
-    image &lt;string&gt;
+    admin@example:/config/container/system/> help image
+    NAME
+        image <string>

-<b>DESCRIPTION</b>
-    Docker image for the container: [transport]name[:tag|@digest]
+    DESCRIPTION
+        Docker image for the container: [transport]name[:tag|@digest]

-    quay.io/username/myimage     -- Pull myimage:latest
-    docker://busybox             -- Pull busybox:latest from Docker Hub
-    docker://ghcr.io/usr/img     -- Pull img:latest from GitHub packages
-    dir:/media/usb/myimage:1.1   -- Use myimage v1.1 from USB media
-    docker-archive:/tmp/archive  -- Use archive:latest from tarball
-    oci-archive:/lib/oci/archive -- Use archive:latest from OCI archive
-                                    May be in .tar or .tar.gz format
+        quay.io/username/myimage     -- Pull myimage:latest
+        docker://busybox             -- Pull busybox:latest from Docker Hub
+        docker://ghcr.io/usr/img     -- Pull img:latest from GitHub packages
+        dir:/media/usb/myimage:1.1   -- Use myimage v1.1 from USB media
+        docker-archive:/tmp/archive  -- Use archive:latest from tarball
+        oci-archive:/lib/oci/archive -- Use archive:latest from OCI archive
+                                        May be in .tar or .tar.gz format

-    Additionally, the following URIs are also supported for setups
-    that do not use a HUB or similar.  Recommend using 'checksum'!
+        Additionally, the following URIs are also supported for setups
+        that do not use a HUB or similar.  Recommend using 'checksum'!

-    ftp://addr/path/to/archive   -- Downloaded using wget
-    http://addr/path/to/archive  -- Downloaded using curl
-    https://addr/path/to/archive -- Downloaded using curl
+        ftp://addr/path/to/archive   -- Downloaded using wget
+        http://addr/path/to/archive  -- Downloaded using curl
+        https://addr/path/to/archive -- Downloaded using curl

-    Note: if a remote repository cannot be reached, the creation of the
-          container will be put on a queue that retries pull every time
-          there is a route change in the host's system.
-</code></pre>
+        Note: if a remote repository cannot be reached, the creation of the
+              container will be put on a queue that retries pull every time
+              there is a route change in the host's system.

 > [!TIP]
 > The built-in help system in the CLI is generated from the YANG model,
@@ -202,28 +198,26 @@ mind.

 **Shell OCI Example:**

-<pre class="cli"><code>admin@example:~$ <b>cd /var/tmp/</b>
-admin@example:/var/tmp$ <b>sudo wget https://github.com/kernelkit/curiOS/releases/download/edge/curios-oci-amd64.tar.gz</b>
-Connecting to github.com (140.82.121.3:443)
-wget: note: TLS certificate validation not implemented
-Connecting to objects.githubusercontent.com (185.199.109.133:443)
-saving to 'curios-oci-amd64.tar.gz'
-curios-oci-amd64.tar 100% |*********************************| 7091k  0:00:00 ETA
-'curios-oci-amd64.tar.gz' saved
-admin@example:/var/tmp$ <b>ll</b>
-total 7104
-drwxr-xr-x    3 root     root          4096 Mar 27 14:22 ./
-drwxr-xr-x   14 root     root          4096 Mar 27 11:57 ../
-rw-r--r--    1 root     root       7261785 Mar 27 14:22 curios-oci-amd64.tar.gz
-drwx------    6 frr      frr           4096 Mar 27 11:57 frr/
-</code></pre>
+    admin@example:~$ cd /var/tmp/
+    admin@example:/var/tmp$ sudo wget https://github.com/kernelkit/curiOS/releases/download/edge/curios-oci-amd64.tar.gz
+    Connecting to github.com (140.82.121.3:443)
+    wget: note: TLS certificate validation not implemented
+    Connecting to objects.githubusercontent.com (185.199.109.133:443)
+    saving to 'curios-oci-amd64.tar.gz'
+    curios-oci-amd64.tar 100% |*********************************| 7091k  0:00:00 ETA
+    'curios-oci-amd64.tar.gz' saved
+    admin@example:/var/tmp$ ll
+    total 7104
+    drwxr-xr-x    3 root     root          4096 Mar 27 14:22 ./
+    drwxr-xr-x   14 root     root          4096 Mar 27 11:57 ../
+    -rw-r--r--    1 root     root       7261785 Mar 27 14:22 curios-oci-amd64.tar.gz
+    drwx------    6 frr      frr           4096 Mar 27 11:57 frr/

 Importing the image into Podman can be done either from the CLI
 admin-exec context ...

-<pre class="cli"><code>admin@example:/var/tmp$ <b>cli</b>
-admin@example:/> <b>container load /var/tmp/curios-oci-amd64.tar.gz name curios:edge</b>
-</code></pre>
+    admin@example:/var/tmp$ cli
+    admin@example:/> container load /var/tmp/curios-oci-amd64.tar.gz name curios:edge

 > [!TIP]
 > The `name curios:edge` is the tag you give the imported (raw) archive
@@ -233,33 +227,31 @@ admin@example:/> <b>container load /var/tmp/curios-oci-amd64.tar.gz name curios:
 ... or by giving the container configuration the full path to the OCI
 archive, which helps greatly with container upgrades (see below):

-<pre class="cli"><code>admin@example:/config/container/system/> <b>set image oci-archive:/var/tmp/curios-oci-amd64.tar.gz</b>
-</code></pre>
+    admin@example:/config/container/system/> set image oci-archive:/var/tmp/curios-oci-amd64.tar.gz

 **Checksum Example:**

-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit container sys</b>
-admin@example:/config/container/sys/> <b>set hostname sys</b>
-admin@example:/config/container/sys/> <b>set image ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz</b>
-admin@example:/config/container/sys/> <b>set checksum</b>
-    md5 sha256 sha512
-admin@example:/config/container/sys/> <b>set checksum sha256 4f01077036527498ed910f1a3e80645ae3eff629d10043cf80ebc6850c99c629</b>
-admin@example:/config/container/sys/> <b>leave</b>
-admin@example:/> <b>copy running-config startup-config</b>
-admin@example:/> <b>show container</b>
-<span class="header">NAME  STATUS         NETWORK  MEMORY (KiB)  CPU%</span>
-sys   Up 5 seconds                  72/512  0.02
+    admin@example:/> configure
+    admin@example:/config/> edit container sys
+    admin@example:/config/container/sys/> set hostname sys
+    admin@example:/config/container/sys/> set image ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
+    admin@example:/config/container/sys/> set checksum
+        md5 sha256 sha512
+    admin@example:/config/container/sys/> set checksum sha256 4f01077036527498ed910f1a3e80645ae3eff629d10043cf80ebc6850c99c629
+    admin@example:/config/container/sys/> leave
+    admin@example:/> copy running-config startup-config
+    admin@example:/> show container
+    CONTAINER ID  IMAGE                                             COMMAND               CREATED         STATUS        PORTS       NAMES
+    b02e945c43c9  localhost/curios-oci-amd64-v24.05.0:latest                              5 seconds ago   Up 5 seconds              sys

-admin@example:/> <b>show log</b>
-...
-Nov 20 07:24:56 example container[5040]: Fetching ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
-Nov 20 07:24:56 example container[5040]: curios-oci-amd64-v24.05.0.tar.gz downloaded successfully.
-Nov 20 07:24:56 example container[5040]: curios-oci-amd64-v24.05.0.tar.gz checksum verified OK.
-Nov 20 07:24:57 example container[5040]: Cleaning up extracted curios-oci-amd64-v24.05.0
-Nov 20 07:24:57 example container[5040]: podman create --name sys --conmon-pidfile=/run/container:sys.pid --read-only --replace --quiet --cgroup-parent=containers  --restart=always --systemd=false --tz=local --hostname sys --log-driver k8s-file --log-opt path=/run/containers/sys.fifo --network=none curios-oci-amd64-v24.05.0
-Nov 20 07:24:57 example container[3556]: b02e945c43c9bce2c4be88e31d6f63cfdb1a3c8bdd02179376eb059a49ae05e4
-</code></pre>
+    admin@example:/> show log
+    ...
+    Nov 20 07:24:56 example container[5040]: Fetching ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
+    Nov 20 07:24:56 example container[5040]: curios-oci-amd64-v24.05.0.tar.gz downloaded successfully.
+    Nov 20 07:24:56 example container[5040]: curios-oci-amd64-v24.05.0.tar.gz checksum verified OK.
+    Nov 20 07:24:57 example container[5040]: Cleaning up extracted curios-oci-amd64-v24.05.0
+    Nov 20 07:24:57 example container[5040]: podman create --name sys --conmon-pidfile=/run/container:sys.pid --read-only --replace --quiet --cgroup-parent=containers  --restart=always --systemd=false --tz=local --hostname sys --log-driver k8s-file --log-opt path=/run/containers/sys.fifo --network=none curios-oci-amd64-v24.05.0
+    Nov 20 07:24:57 example container[3556]: b02e945c43c9bce2c4be88e31d6f63cfdb1a3c8bdd02179376eb059a49ae05e4


 Understanding Image Tags
@@ -367,11 +359,12 @@ writable paths provided by Podman (`/dev`, `/dev/shm`, `/run`, `/tmp`,
 When using version-specific tags, you upgrade by explicitly changing the
 image reference in your configuration:

-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit container web</b>
-admin@example:/config/container/web/> <b>set image docker://nginx:1.25.3</b>
-admin@example:/config/container/web/> <b>leave</b>
-</code></pre>
+```
+admin@example:/> configure
+admin@example:/config/> edit container web
+admin@example:/config/container/web/> set image docker://nginx:1.25.3
+admin@example:/config/container/web/> leave
+```

 **What happens:**

@@ -382,27 +375,29 @@ admin@example:/config/container/web/> <b>leave</b>

 **Example:** Upgrading from one version to another:

-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit container system</b>
-admin@example:/config/container/system/> <b>show image</b>
+```
+admin@example:/> configure
+admin@example:/config/> edit container system
+admin@example:/config/container/system/> show image
 image ghcr.io/kernelkit/curios:v24.11.0;
-admin@example:/config/container/system/> <b>set image ghcr.io/kernelkit/curios:v24.12.0</b>
-admin@example:/config/container/system/> <b>leave</b>
-admin@example:/> <b>show log</b>
+admin@example:/config/container/system/> set image ghcr.io/kernelkit/curios:v24.12.0
+admin@example:/config/container/system/> leave
+admin@example:/> show log
 ...
 Dec 13 14:32:15 example container[1523]: Pulling ghcr.io/kernelkit/curios:v24.12.0...
 Dec 13 14:32:18 example container[1523]: Stopping old container instance...
 Dec 13 14:32:19 example container[1523]: Creating new container with updated image...
 Dec 13 14:32:20 example container[1523]: Container system started successfully
-</code></pre>
+```

 ### Method 2: Upgrading Mutable Tags

 For images using mutable tags like `:latest` or `:edge`, use the
 `container upgrade` command:

-<pre class="cli"><code>admin@example:/> <b>container upgrade NAME</b>
-</code></pre>
+```
+admin@example:/> container upgrade NAME
+```

 This command:

@@ -413,7 +408,8 @@ This command:

 **Example using registry:**

-<pre class="cli"><code>admin@example:/> <b>container upgrade system</b>
+```
+admin@example:/> container upgrade system
 system
 Trying to pull ghcr.io/kernelkit/curios:edge...
 Getting image source signatures
@@ -424,7 +420,7 @@ Storing signatures
 0cb6059c0f4111650ddbc7dbc4880c64ab8180d4bdbb7269c08034defc348f17
 system: not running.
 59618cc3c84bef341c1f5251a62be1592e459cc990f0b8864bc0f5be70e60719
-</code></pre>
+```

 **Example using local OCI archive:**

@@ -433,10 +429,11 @@ new archive onto the system (see Container Images section above), then,
 provided the `oci-archive:/path/to/archive` format is used in your
 configuration, call the upgrade command:

-<pre class="cli"><code>admin@example:/> <b>container upgrade system</b>
+```
+admin@example:/> container upgrade system
 Upgrading container system with local archive: oci-archive:/var/tmp/curios-oci-amd64.tar.gz ...
 7ab4a07ee0c6039837419b7afda4da1527a70f0c60c0f0ac21cafee05ba24b52
-</code></pre>
+```

 OCI archives can also be fetched from ftp/http/https URLs. In that case,
 the upgrade works the same way as a registry image — Infix downloads the
@@ -475,16 +472,15 @@ occasions where they are too restricted and users start looking for the

 For example, a system container from which `ping` does not work:

-<pre class="cli"><code>admin@example:/config/container/system/> <b>edit capabilities</b>
-admin@example:/config/container/system/capabilities/> <b>set add net_raw</b>
-admin@example:/config/container/system/capabilities/> <b>end</b>
-admin@infix-00-00-00:/config/container/system/> <b>show</b>
-...
-capabilities {
-  add net_raw;
-}
-...
-</code></pre>
+	admin@example:/config/container/system/> edit capabilities
+	admin@example:/config/container/system/capabilities/> set add net_raw
+	admin@example:/config/container/system/capabilities/> end
+	admin@infix-00-00-00:/config/container/system/> show
+	...
+	capabilities {
+	  add net_raw;
+	}
+	...

 Infix supports a subset of all [capabilities][6] that are relevant for
 containers.  Please note, that this is an advanced topic that require
@@ -492,48 +488,6 @@ time and analysis of your container application to figure out which
 capabilities you need.


-Resource Limits
---------------
-
-Containers can be configured with resource limits to control their memory
-and CPU usage. This helps prevent containers from consuming excessive system
-resources and ensures fair resource allocation across multiple containers.
-
-### Configuring Resource Limits
-
-Resource limits are set per container and include:
-
- - **Memory:** Maximum memory usage in kibibytes (KiB)
- - **CPU:** Maximum CPU usage in millicores (1000 millicores = 1 CPU core)
-
-Example configuration limiting a container to 512 MiB of memory and 1.5 CPU cores:
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit container web</b>
-admin@example:/config/container/web/> <b>edit resource-limit</b>
-admin@example:/config/container/web/resource-limit/> <b>set memory 524288</b>
-admin@example:/config/container/web/resource-limit/> <b>set cpu 1500</b>
-admin@example:/config/container/web/resource-limit/> <b>leave</b>
-</code></pre>
-
-Common CPU limit examples:
-
- - `500` = 0.5 cores (50% of one core)
- - `1000` = 1.0 cores (one full core)
- - `2000` = 2.0 cores (two full cores)
-
-### Monitoring Resource Usage
-
-Runtime resource usage statistics are available in the operational datastore:
-
-<pre class="cli"><code>admin@example:/> <b>show container web</b>
-...
-</code></pre>
-
-Use `show container usage` to see resource consumption across all containers,
-including memory, CPU, block I/O, network I/O, and process counts.
-
-
 Networking and Containers
 -------------------------

@@ -569,11 +523,10 @@ container use seem to be so simple.

 All interface configuration is done in configure context.

-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config> <b>edit interface docker0</b>
-admin@example:/config/interface/docker0/> <b>set container-network</b>
-admin@example:/config/interface/docker0/> <b>leave</b>
-</code></pre>
+    admin@example:/> configure
+    admin@example:/config> edit interface docker0
+    admin@example:/config/interface/docker0/> set container-network
+    admin@example:/config/interface/docker0/> leave

 There is more to this story.  When using the CLI, and sticking to common
 interface nomenclature, Infix helps you with some of the boring stuff.
@@ -581,9 +534,8 @@ E.g., creating a new interface with a name like `brN` or `dockerN`
 automatically *infers* the interface types, which you would otherwise
 have to set manually:

-<pre class="cli"><code>admin@example:/config/interface/docker0/> <b>set type bridge</b>
-admin@example:/config/interface/docker0/> <b>set container-network type bridge</b>
-</code></pre>
+    admin@example:/config/interface/docker0/> set type bridge
+    admin@example:/config/interface/docker0/> set container-network type bridge

 > [!IMPORTANT]
 > When configuring the system via an API such as NETCONF or RESTCONF, no
@@ -609,17 +561,16 @@ other networking parameters (DNS, default route) are set up.
 Some of the defaults of a container `bridge` can be changed, e.g.,
 instead of `set container-network type bridge`, above, do:

-<pre class="cli"><code>admin@example:/config/interface/docker0/> <b>edit container-network</b>
-admin@example:/config/…/container-network/> <b>set type bridge</b>
-admin@example:/config/…/container-network/> <b>edit subnet 192.168.0.0/16</b>
-admin@example:/config/…/subnet/192.168.0.0/16/> <b>set gateway 192.168.255.254</b>
-admin@example:/config/…/subnet/192.168.0.0/16/> <b>end</b>
-admin@example:/config/…/container-network/> <b>edit route 10.0.10.0/24</b>
-admin@example:/config/…/route/10.0.10.0/24/> <b>set gateway 192.168.10.254</b>
-admin@example:/config/…/route/10.0.10.0/24/> <b>end</b>
-admin@example:/config/…/container-network/> <b>end</b>
-admin@example:/config/interface/docker0/> <b>leave</b>
-</code></pre>
+    admin@example:/config/interface/docker0/> edit container-network
+    admin@example:/config/interface/docker0/container-network/> set type bridge
+    admin@example:/config/interface/docker0/container-network/> edit subnet 192.168.0.0/16
+    admin@example:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> set gateway 192.168.255.254
+    admin@example:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> end
+    admin@example:/config/interface/docker0/container-network/> edit route 10.0.10.0/24
+	admin@example:/config/interface/docker0/container-network/route/10.0.10.0/24/> set gateway 192.168.10.254
+	admin@example:/config/interface/docker0/container-network/route/10.0.10.0/24/> end
+	admin@example:/config/interface/docker0/container-network/> end
+    admin@example:/config/interface/docker0/> leave

 Other network settings, like DNS and domain, use built-in defaults, but
 can be overridden from each container.  Other common settings per
@@ -631,25 +582,24 @@ in a `bridge`.  Below an example of a system container calls `set
 network interface docker0`, here we show how to set options for that
 network:

-<pre class="cli"><code>admin@example:/config/container/ntpd/> <b>edit network interface docker0</b>
-admin@example:/config/…/network/interface/docker0/>
-admin@example:/config/…/network/interface/docker0/> <b>set option</b>
-&lt;string&gt;  Options for masquerading container bridges.
-admin@example:/config/…/network/interface/docker0/> <b>help option</b>
-NAME
-        option &lt;string&gt;
+    admin@example:/config/container/ntpd/> edit network interface docker0
+    admin@example:/config/container/ntpd/network/interface/docker0/>
+    admin@example:/config/container/ntpd/network/interface/docker0/> set option
+    <string>  Options for masquerading container bridges.
+    admin@example:/config/container/ntpd/network/interface/docker0/> help option
+    NAME
+            option <string>
+    
+    DESCRIPTION
+            Options for masquerading container bridges.

-DESCRIPTION
-        Options for masquerading container bridges.
-
-        Example: ip=1.2.3.4            -- request a specific IP (IPv4 or IPv6)
-                 mac=00:01:02:c0:ff:ee -- set fixed MAC address in container
-                 interface_name=foo0   -- set interface name inside container
-
-admin@example:/config/…/network/interface/docker0/> <b>set option ip=172.17.0.2</b>
-admin@example:/config/…/network/interface/docker0/> <b>set option interface_name=wan</b>
-admin@example:/config/…/network/interface/docker0/> <b>leave</b>
-</code></pre>
+            Example: ip=1.2.3.4            -- request a specific IP (IPv4 or IPv6)
+                     mac=00:01:02:c0:ff:ee -- set fixed MAC address in container
+                     interface_name=foo0   -- set interface name inside container
+    
+    admin@example:/config/container/ntpd/network/interface/docker0/> set option ip=172.17.0.2
+    admin@example:/config/container/ntpd/network/interface/docker0/> set option interface_name=wan
+    admin@example:/config/container/ntpd/network/interface/docker0/> leave


 ### Container Host Interface
@@ -684,15 +634,14 @@ container-end of pair `ntpd`.  This is just a convenience for us when
 reading the configuration later.  The *real action* happens on the last
 line where we declare the `ntpd` end as a container network interface:

-<pre class="cli"><code>admin@example:/config/> <b>edit interface veth0</b>
-admin@example:/config/interface/veth0/> <b>set veth peer ntpd</b>
-admin@example:/config/interface/veth0/> <b>set ipv4 address 192.168.0.1 prefix-length 24</b>
-admin@example:/config/interface/veth0/> <b>end</b>
-admin@example:/config/> <b>edit interface ntpd</b>
-admin@example:/config/interface/ntpd/> <b>set ipv4 address 192.168.0.2 prefix-length 24</b>
-admin@example:/config/interface/ntpd/> <b>set custom-phys-address static 00:c0:ff:ee:00:01</b>
-admin@example:/config/interface/ntpd/> <b>set container-network</b>
-</code></pre>
+    admin@example:/config/> edit interface veth0
+    admin@example:/config/interface/veth0/> set veth peer ntpd
+    admin@example:/config/interface/veth0/> set ipv4 address 192.168.0.1 prefix-length 24
+    admin@example:/config/interface/veth0/> end
+    admin@example:/config/> edit interface ntpd
+    admin@example:/config/interface/ntpd/> set ipv4 address 192.168.0.2 prefix-length 24
+    admin@example:/config/interface/ntpd/> set custom-phys-address static 00:c0:ff:ee:00:01
+    admin@example:/config/interface/ntpd/> set container-network

 > [!TIP]
 > Notice how you can also set a custom MAC address at the same time.
@@ -701,9 +650,8 @@ Adding the interface to the container is the same as before, but since
 everything for host interfaces is set up in the interfaces context, we
 can take a bit of a shortcut.

-<pre class="cli"><code>admin@example:/config/container/ntpd/> <b>set network interface ntpd</b>
-admin@example:/config/container/ntpd/> <b>leave</b>
-</code></pre>
+    admin@example:/config/container/ntpd/> set network interface ntpd
+    admin@example:/config/container/ntpd/> leave

 > [!TIP]
 > Use the `set network interface ntpd option interface_name=foo0` to set
@@ -724,10 +672,9 @@ pair to give our container two interfaces:

 We start by adding the second VETH pair:

-<pre class="cli"><code>admin@example:/config/> <b>edit interface veth1a</b>
-admin@example:/config/interface/veth1a/> <b>set veth peer veth1</b>
-admin@example:/config/interface/veth1a/> <b>set ipv4 address 192.168.1.2 prefix-length 24</b>
-</code></pre>
+    admin@example:/config/> edit interface veth1a
+    admin@example:/config/interface/veth1a/> set veth peer veth1
+    admin@example:/config/interface/veth1a/> set ipv4 address 192.168.1.2 prefix-length 24

 > [!NOTE]
 > The LAN bridge (br1) in this example has IP address 192.168.1.1.
@@ -736,21 +683,20 @@ When a container has multiple host interfaces it can often be useful to
 have a default route installed.  This can be added from the host with a
 `0.0.0.0/0` route on one of the interfaces:

-<pre class="cli"><code>admin@example:/config/interface/veth1a/> <b>set container-network route 0.0.0.0/0 gateway 192.168.1.1</b>
-admin@example:/config/interface/veth1a/> <b>show</b>
-type veth;
-container-network {
-  type host;
-  route 0.0.0.0/0 {
-    gateway 192.168.1.1;
-  }
-}
-veth {
-  peer veth1;
-}
-admin@example:/config/interface/veth1a/> <b>end</b>
-admin@example:/config/> <b>set interface veth1 bridge-port bridge br1</b>
-</code></pre>
+    admin@example:/config/interface/veth1a/> set container-network route 0.0.0.0/0 gateway 192.168.1.1
+    admin@example:/config/interface/veth1a/> show
+    type veth;
+	container-network {
+	  type host;
+	  route 0.0.0.0/0 {
+		gateway 192.168.1.1;
+	  }
+	}
+	veth {
+	  peer veth1;
+	}
+    admin@example:/config/interface/veth1a/> end
+    admin@example:/config/> set interface veth1 bridge-port bridge br1

 Please note, container network routes require the base interface also
 have a static IP address set.  Setting only the route, but no address,
@@ -776,12 +722,11 @@ It is possible to mount files, directories, and even files matching a
 glob, into a container.  This gives precise control over the container's
 file system:

-<pre class="cli"><code>admin@example:/config/container/system/> <b>edit mount leds</b>
-admin@example:/config/container/system/mount/leds> <b>set source /sys/class/leds</b>
-admin@example:/config/container/system/mount/leds> <b>set target /sys/class/leds</b>
-admin@example:/config/container/system/mount/leds> <b>end</b>
-admin@example:/config/container/system/>
-</code></pre>
+    admin@example:/config/container/system/> edit mount leds
+    admin@example:/config/container/system/mount/leds> set source /sys/class/leds
+    admin@example:/config/container/system/mount/leds> set target /sys/class/leds
+    admin@example:/config/container/system/mount/leds> end
+    admin@example:/config/container/system/>

 Any type of file can be *bind mounted* into the container, just watch
 out for permissions though.  In the example above, `/sys/class/leds` is
@@ -797,8 +742,7 @@ trigger a container restart.
 Other times *volumes* are a better fit.  A volume is an automatically
 created read-writable entity that follows the life of your container.

-<pre class="cli"><code>admin@example:/config/container/ntpd/> <b>set volume varlib target /var/lib</b>
-</code></pre>
+    admin@example:/config/container/ntpd/> set volume varlib target /var/lib

 Volumes are persistent across both reboots and upgrades of the base
 image.  They are created by Podman when the container first starts up,
@@ -828,15 +772,14 @@ where:
 To clean up unused volumes and reclaim disk space, use the admin-exec
 command:

-<pre class="cli"><code>admin@example:/> <b>container prune</b>
-Deleted Images
-...
-Deleted Volumes
-ntpd-varlib
-system-data
+    admin@example:/> container prune
+    Deleted Images
+    ...
+    Deleted Volumes
+    ntpd-varlib
+    system-data

-Total reclaimed space: 45.2MB
-</code></pre>
+    Total reclaimed space: 45.2MB

 The `container prune` command safely removes:

@@ -847,16 +790,14 @@ The `container prune` command safely removes:
 > [!TIP]
 > You can monitor container resource usage with the command:
 >
-> <pre class="cli"><code>admin@example:/> <b>show container usage</b>
-> </code></pre>
+>     admin@example:/> show container usage
 >
 > This displays disk space used by images, containers, and volumes,
 > helping you decide when to run the prune command.
 >
 > To see which volumes exist and which containers use them:
 >
-> <pre class="cli"><code>admin@example:/> <b>show container volumes</b>
-> </code></pre>
+>     admin@example:/> show container volumes

 ### Content Mounts

@@ -866,13 +807,12 @@ when deploying similar systems at multiple sites.  When the host loads
 its `startup-config` (or even `factory-config`) a temporary file is
 created using the decoded base64 data from the `content` node.

-<pre class="cli"><code>admin@example:/config/container/ntpd/> <b>edit mount ntpd.conf</b>
-admin@example:/config/container/ntpd/mount/ntpd.conf> <b>text-editor content</b>
-... interactive editor starts up ...
-admin@example:/config/container/ntpd/mount/ntpd.conf> <b>set target /etc/ntpd.conf</b>
-admin@example:/config/container/ntpd/mount/ntpd.conf> <b>end</b>
-admin@example:/config/container/ntpd/>
-</code></pre>
+    admin@example:/config/container/ntpd/> edit mount ntpd.conf
+    admin@example:/config/container/ntpd/mount/ntpd.conf> text-editor content
+    ... interactive editor starts up ...
+    admin@example:/config/container/ntpd/mount/ntpd.conf> set target /etc/ntpd.conf
+    admin@example:/config/container/ntpd/mount/ntpd.conf> end
+    admin@example:/config/container/ntpd/>

 The editor is a small [Emacs clone called Mg][2], see the built-in help
 text, or press Ctrl-x Ctrl-c to exit and save.  When the editor exits
@@ -896,13 +836,12 @@ Let's try out what we've learned by setting up a system container, a
 container providing multiple services, using the `docker0` interface
 we created previously:

-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config> <b>edit container system</b>
-admin@example:/config/container/system/> <b>set image ghcr.io/kernelkit/curios:edge</b>
-admin@example:/config/container/system/> <b>set network interface docker0</b>
-admin@example:/config/container/system/> <b>set publish 222:22</b>
-admin@example:/config/container/system/> <b>leave</b>
-</code></pre>
+    admin@example:/> configure
+    admin@example:/config> edit container system
+    admin@example:/config/container/system/> set image ghcr.io/kernelkit/curios:edge
+    admin@example:/config/container/system/> set network interface docker0
+    admin@example:/config/container/system/> set publish 222:22
+    admin@example:/config/container/system/> leave

 > [!NOTE]
 > Ensure you have a network connection to the registry.  If the image
@@ -917,29 +856,26 @@ container configuration context for the full syntax.)

 Available containers can be accessed from admin-exec:

-<pre class="cli"><code>admin@example:/> <b>show container</b>
-<span class="header">NAME     STATUS        NETWORK  MEMORY (KiB)  CPU%</span>
-system   Up 16 hours   docker0       136/512  0.02
-</code></pre>
+    admin@example:/> show container
+    CONTAINER ID  IMAGE                          COMMAND     CREATED       STATUS       PORTS                 NAMES
+    439af2917b44  ghcr.io/kernelkit/curios:edge              41 hours ago  Up 16 hours  0.0.0.0:222->222/tcp  system

 This is a system container, so you can "attach" to it by starting a
 shell (or logging in with SSH):

-<pre class="cli"><code>admin@example:/> <b>container shell system</b>
-root@439af2917b44:/#
-</code></pre>
+    admin@example:/> container shell system
+    root@439af2917b44:/#

 Notice how the hostname inside the container changes.  By default the
 container ID (hash) is used, but this can be easily changed:

-<pre class="cli"><code>root@439af2917b44:/# <b>exit</b>
-admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit container system</b>
-admin@example:/config/container/system/> <b>set hostname sys101</b>
-admin@example:/config/container/system/> <b>leave</b>
-admin@example:/> <b>container shell system</b>
-root@sys101:/#
-</code></pre>
+    root@439af2917b44:/# exit
+    admin@example:/> configure
+    admin@example:/config/> edit container system
+    admin@example:/config/container/system/> set hostname sys101
+    admin@example:/config/container/system/> leave
+    admin@example:/> container shell system
+    root@sys101:/#

 In fact, the container `hostname` setting supports the same format
 specifiers as the host's `hostname` setting:
@@ -964,17 +900,16 @@ Infix currently does not have a native firewall configuration, and even
 when it does it will never expose the full capabilities of `nftables`.
 For advanced setups, the following is an interesting alternative.

-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config> <b>edit container nftables</b>
-admin@example:/config/container/nftables/> <b>set image ghcr.io/kernelkit/curios-nftables:edge</b>
-admin@example:/config/container/nftables/> <b>set network host</b>
-admin@example:/config/container/nftables/> <b>set privileged</b>
-admin@example:/config/container/nftables/> <b>edit mount nftables.conf</b>
-admin@example:/config/…/mount/nftables.conf/> <b>set target /etc/nftables.conf</b>
-admin@example:/config/…/mount/nftables.conf/> <b>text-editor content</b>
-... interactive editor starts up where you can paste your rules ...
-admin@example:/config/…/mount/nftables.conf/> <b>leave</b>
-</code></pre>
+    admin@example:/> configure
+    admin@example:/config> edit container nftables
+    admin@example:/config/container/nftables/> set image ghcr.io/kernelkit/curios-nftables:edge
+    admin@example:/config/container/nftables/> set network host
+    admin@example:/config/container/nftables/> set privileged
+    admin@example:/config/container/nftables/> edit mount nftables.conf
+    admin@example:/config/container/nftables/mount/nftables.conf/> set target /etc/nftables.conf
+    admin@example:/config/container/nftables/mount/nftables.conf/> text-editor content
+    ... interactive editor starts up where you can paste your rules ...
+    admin@example:/config/container/nftables/mount/nftables.conf/> leave

 Notice how we `set network host`, so the container can see and act on
 all the host's interfaces, and that we also have to run the container
@@ -993,20 +928,19 @@ file system and store in the host's `startup-config`.  However, `ntpd`
 also saves clock drift information in `/var/lib/ntpd`, so we will also
 use volumes in this example.

-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config> <b>edit container ntpd</b>
-admin@example:/config/container/ntpd/> <b>set image ghcr.io/kernelkit/curios-ntpd:edge</b>
-admin@example:/config/container/ntpd/> <b>set network interface ntpd</b>    # From veth0 above
-admin@example:/config/container/ntpd/> <b>edit mount ntp.conf</b>
-admin@example:/config/container/ntpd/mount/ntp.conf/> <b>set target /etc/ntp.conf</b>
-admin@example:/config/container/ntpd/mount/ntp.conf/> <b>text-editor content</b>
-... interactive editor starts up where you can paste your rules ...
-admin@example:/config/container/ntpd/mount/ntp.conf/> <b>end</b>
-admin@example:/config/container/ntpd/> <b>edit volume varlib</b>
-admin@example:/config/container/ntpd/volume/varlib/> <b>set target /var/lib</b>
-admin@example:/config/container/ntpd/volume/varlib/> <b>leave</b>
-admin@example:/> <b>copy running-config startup-config</b>
-</code></pre>
+    admin@example:/> configure
+    admin@example:/config> edit container ntpd
+    admin@example:/config/container/ntpd/> set image ghcr.io/kernelkit/curios-ntpd:edge
+    admin@example:/config/container/ntpd/> set network interface ntpd    # From veth0 above
+    admin@example:/config/container/ntpd/> edit mount ntp.conf
+    admin@example:/config/container/ntpd/mount/ntp.conf/> set target /etc/ntp.conf
+    admin@example:/config/container/ntpd/mount/ntp.conf/> text-editor content
+    ... interactive editor starts up where you can paste your rules ...
+    admin@example:/config/container/ntpd/mount/ntp.conf/> end
+    admin@example:/config/container/ntpd/> edit volume varlib
+    admin@example:/config/container/ntpd/volume/varlib/> set target /var/lib
+    admin@example:/config/container/ntpd/volume/varlib/> leave
+    admin@example:/> copy running-config startup-config

 The `ntp.conf` file is stored in the host's `startup-config` and any
 state data in the container's `/var/lib` is retained between reboots
@@ -1041,28 +975,25 @@ First, enable *Privileged* mode, this unlocks the door and allows the
 container to manage resources on the host system.  An example is the
 `nftables` container mentioned previously.

-<pre class="cli"><code>admin@example:/config/container/system/> <b>set privileged</b>
-</code></pre>
+    admin@example:/config/container/system/> set privileged

 Second, mount the host's `/proc/1` directory to somewhere inside your
 container.  Here we pick `/1`:

-<pre class="cli"><code>admin@example:/config/container/system/> <b>edit mount host</b>
-admin@example:/config/container/system/mount/host/> <b>set source /proc/1</b>
-admin@example:/config/container/system/mount/host/> <b>set target /1</b>
-admin@example:/config/container/system/mount/host/> <b>leave</b>
-</code></pre>
+	admin@example:/config/container/system/> edit mount host
+	admin@example:/config/container/system/mount/host/> set source /proc/1
+	admin@example:/config/container/system/mount/host/> set target /1
+	admin@example:/config/container/system/mount/host/> leave

 Third, from inside the container, use the host's PID 1 namespaces with
 the `nsenter`[^2] command to slide through the container's walls.  Here
 we show two example calls to `hostname`, first the container's own name
 and then asking what the hostname is on the host:

-<pre class="cli"><code>root@sys101:/# <b>hostname</b>
-sys101
-root@sys101:/# <b>nsenter -m/1/ns/mnt -u/1/ns/uts -i/1/ns/ipc -n/1/ns/net hostname</b>
-example
-</code></pre>
+	root@sys101:/# hostname
+	sys101
+    root@sys101:/# nsenter -m/1/ns/mnt -u/1/ns/uts -i/1/ns/ipc -n/1/ns/net hostname
+	example

 One use-case for this method is when extending Infix with a management
 container that connects to other systems.  For some tips on how to
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/arm//.mk))`
				`@@ -0,0 +1 @@`
				`SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"`