doc: add information on ospf debug settings

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

.github/workflows/build-image.yml

@@ -12,6 +12,10 @@ on:
           - bananapi-bpi-r3
           - friendlyarm-nanopi-r2s
         default: 'raspberrypi-rpi64'
+      use_latest_release:
+        description: 'Use latest release artifacts instead of workflow artifacts'
+        type: boolean
+        default: false
 
 jobs:
   create-image:
@@ -50,19 +54,19 @@ jobs:
         run: |
           case "${{ inputs.board }}" in
             raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
             bananapi-bpi-r3)
-              echo "BOOTLOADER_SD=bpi-r3-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r3-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER_SD=bpi_r3_sd_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi_r3_emmc_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=true" >> $GITHUB_ENV
               ;;
             friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
               echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
             *)
@@ -70,7 +74,7 @@ jobs:
               exit 1
               ;;
           esac
-          echo "Arch: $ARCH for board: ${{ inputs.board }}"
+          echo "Target: $TARGET for board: ${{ inputs.board }}"
           if [ "$BUILD_EMMC" = "true" ]; then
             echo "Building both SD and eMMC images"
             echo "SD Bootloader: $BOOTLOADER_SD"
@@ -81,12 +85,16 @@ jobs:
           fi
 
       - name: Download bootloader artifacts
+        if: ${{ !inputs.use_latest_release }}
         run: |
-          # Download bootloader from latest-boot release tag
+          # Download from latest bootloader build workflow on main branch
+          gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
+          BOOT_RUN_ID=$(cat latest_boot_run_id)
+
           if [ "$BUILD_EMMC" = "true" ]; then
             # Download both SD and eMMC bootloaders for boards that support both
             echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_SD} --dir temp_bootloader_sd/
             mkdir -p output_sd/images
             cd temp_bootloader_sd/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -94,7 +102,7 @@ jobs:
             rm -rf temp_bootloader_sd/
 
             echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_EMMC} --dir temp_bootloader_emmc/
             mkdir -p output_emmc/images
             cd temp_bootloader_emmc/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
@@ -107,7 +115,7 @@ jobs:
             ls -la output_emmc/images/
           else
             # Single bootloader for boards that only support SD
-            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
 
             # Extract bootloader directly to output/images
             cd temp_bootloader/
@@ -122,6 +130,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download Infix artifacts
+        if: ${{ !inputs.use_latest_release }}
         run: |
           # Download from latest Kernelkit Trigger workflow for main branch
           gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
@@ -129,7 +138,7 @@ jobs:
 
           if [ "$BUILD_EMMC" = "true" ]; then
             # Copy Infix artifacts to both SD and eMMC output directories
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
 
             cd temp_infix/
             tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
@@ -143,7 +152,7 @@ jobs:
             ls -la output_emmc/images/
           else
             # Single output directory for SD-only boards
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
 
             # Extract Infix directly to output/images
             cd temp_infix/
@@ -157,6 +166,58 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Download from latest releases
+        if: ${{ inputs.use_latest_release }}
+        run: |
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Download both SD and eMMC bootloaders
+            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            mkdir -p output_sd/images
+            cd temp_bootloader_sd/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            cd ../
+            rm -rf temp_bootloader_sd/
+
+            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            mkdir -p output_emmc/images
+            cd temp_bootloader_emmc/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_bootloader_emmc/
+
+            # Download Infix once and extract to both directories
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "SD files extracted to output_sd/images:"
+            ls -la output_sd/images/
+            echo "eMMC files extracted to output_emmc/images:"
+            ls -la output_emmc/images/
+          else
+            # Download latest bootloader release
+            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            cd temp_bootloader/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_bootloader/
+
+            # Download latest Infix release
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "All files extracted to output/images:"
+            ls -la output/images/
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Verify extracted files
         run: |
           if [ "$BUILD_EMMC" = "true" ]; then
@@ -188,7 +249,7 @@ jobs:
             export BR2_EXTERNAL_INFIX_PATH=$PWD
             export RELEASE=""
             export INFIX_ID="infix"
-            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
+            ./utils/mkimage.sh ${{ inputs.board }}
           fi
 
       - name: Create eMMC image
@@ -286,11 +347,10 @@ jobs:
           # SD Card & eMMC Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
-          **Arch:** ${{ env.ARCH }}
+          **Target:** ${{ env.TARGET }}
           **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
           **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
-          **Bootloader Source:** latest-boot release
-          **Infix Source:** Latest workflow run on main
+          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
 
           ## Created Images
           $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
@@ -303,10 +363,9 @@ jobs:
           # SD Card Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
-          **Arch:** ${{ env.ARCH }}
+          **Target:** ${{ env.TARGET }}
           **Bootloader:** ${{ env.BOOTLOADER }}
-          **Bootloader Source:** latest-boot release
-          **Infix Source:** Latest workflow run on main
+          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
 
           ## Created Images
           $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")

.github/workflows/check-kernel-release.yml

@@ -1,4 +1,4 @@
-name: Check Kernel 6.18 Release
+name: Check Kernel 6.12 Release
 
 on:
   schedule:
@@ -17,12 +17,12 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
 
-      - name: Fetch kernel.org and check for 6.18 release
+      - name: Fetch kernel.org and check for 6.12 release
         id: check
         run: |
           set -e -o pipefail
-          # Fetch the kernel.org frontpage and extract 6.18 version
-          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.18\.\d+' | head -n1)
+          # Fetch the kernel.org frontpage and extract 6.12 version
+          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)
 
           if [ -z "$CURRENT_VERSION" ]; then
             echo "Failed to fetch kernel version"
@@ -30,7 +30,7 @@ jobs:
           fi
 
           echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          echo "Current 6.18 kernel version: $CURRENT_VERSION"
+          echo "Current 6.12 kernel version: $CURRENT_VERSION"
 
           # Get the version from infix defconfig
           INFIX_VERSION=$(grep 'BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=' configs/aarch64_defconfig | cut -d'"' -f2)
@@ -47,7 +47,7 @@ jobs:
               echo "PR already exists for kernel $CURRENT_VERSION, skipping"
             else
               echo "new_release=true" >> $GITHUB_OUTPUT
-              echo "🎉 New 6.18 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
+              echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
             fi
           else
             echo "new_release=false" >> $GITHUB_OUTPUT
@@ -99,7 +99,7 @@ jobs:
           BRANCH_NAME: ${{ steps.branch.outputs.name }}
         run: |
           set -e -o pipefail
-          ./utils/kernel-upgrade.sh linux 6.18 "$BRANCH_NAME"
+          ./utils/kernel-upgrade.sh linux "$BRANCH_NAME"
 
       - name: Create pull request
         if: steps.check.outputs.new_release == 'true'

.github/workflows/release.yml

@@ -104,7 +104,11 @@ jobs:
 
       - name: Extract ChangeLog entry ...
         run: |
-          cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
+          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
+              |head -n -1 > release.md
+          echo "" >> release.md
+          echo "> [!TIP]" >> release.md
+          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
           cat release.md
 
       - uses: ncipollo/release-action@v1

.gitignore

@@ -1,7 +1,5 @@
 *~
-.claude
 .gdb_history
-.claude
 /.backup
 /.ccache
 /dl
@@ -11,4 +9,3 @@
 /test/.log
 /local.mk
 /test/spec/Readme.adoc
-

README.md

@@ -16,12 +16,10 @@ if something goes wrong.  Deploy once, trust forever.
 
 **🤝 Friendly**  
 Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit <kbd>?</kbd> or
-<kbd>TAB</kbd> for context-aware assistance.
-
-Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
-mean you're never stuck.  Whether you're learning networking or managing
-enterprise infrastructure.
+with built-in help for every command — just hit `?` or TAB for
+context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
+[comprehensive documentation][4] mean you're never stuck.  Whether
+you're learning networking or managing enterprise infrastructure.
 
 **🛡️ Secure**  
 Built with security as a foundation, not an afterthought.  Minimal
@@ -55,24 +53,27 @@ your device, your rules.
    Consistent tooling from development to production deployment.  
    How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
 
-## Quick Example
+## See It In Action
 
 Configure an interface in seconds - the CLI guides you with built-in help:
 
-<pre><code>admin@infix-12-34-56:/> <b>configure</b>
-admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
-admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4</b> <kbd>TAB</kbd>
-      address     autoconf      bind-ni-name     dhcp 
-      enabled     forwarding    mtu              neighbor
-admin@infix-12-34-56:/config/interface/eth0/> <b>set ipv4 address 192.168.2.200 prefix-length 24</b>
-admin@infix-12-34-56:/config/interface/eth0/> <b>show</b>
+<details><summary><b>Click Here for an example CLI Session</b></summary>
+
+```bash
+admin@infix-12-34-56:/> configure
+admin@infix-12-34-56:/config/> edit interface eth0
+admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
+      address     autoconf bind-ni-name      enabled
+      forwarding  mtu      neighbor
+admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
+admin@infix-12-34-56:/config/interface/eth0/> show
 type ethernet;
 ipv4 {
   address 192.168.2.200 {
     prefix-length 24;
   }
 }
-admin@infix-12-34-56:/config/interface/eth0/> <b>diff</b>
+admin@infix-12-34-56:/config/interface/eth0/> diff
 interfaces {
   interface eth0 {
 +    ipv4 {
@@ -82,23 +83,25 @@ interfaces {
 +    }
   }
 }
-admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
-admin@infix-12-34-56:/> <b>show interfaces</b>
-<u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
+admin@infix-12-34-56:/config/interface/eth0/> leave
+admin@infix-12-34-56:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
 eth0            ethernet   UP          52:54:00:12:34:56
                 ipv4                   192.168.2.200/24 (static)
                 ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                 ipv4                   127.0.0.1/8 (static)
                 ipv6                   ::1/128 (static)
-admin@infix-12-34-56:/> <b>copy running startup</b>
-</code></pre>
+admin@infix-12-34-56:/> copy running-config startup-config
+```
 
-Notice how <kbd>TAB</kbd> completion shows available options, `show`
-displays current config, and `diff` shows exactly what changed before
-you commit your changes with the `leave` command.
+Notice how TAB completion shows available options, `show` displays
+current config, and `diff` shows exactly what changed before you
+commit your changes with the `leave` command.
 
-For more information, see [CLI documentation][3].
+</details>
+
+> [Full CLI documentation →][3]
 
 ## Get Started
 
@@ -108,7 +111,7 @@ containers for any custom functionality you need.
 
 ### Supported Platforms
 
-- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
+- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
 - **Banana Pi-R3** - Your next home router and gateway
 - **NanoPi R2S** - Compact dual-port router in a tiny package
 - **x86_64** - Run in VMs or on mini PCs for development and testing

board/Config.in

@@ -1,6 +1,6 @@
 menu "Board Support"
 
-source "$BR2_EXTERNAL_INFIX_PATH/board/arm/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"

board/README.md

@@ -1,18 +0,0 @@
-Board Support
-=============
-
-The board support for an architecture always starts with Qemu support,
-this is what each `linux_defconfig` at the very least sets up.  Then
-each `$BR2_ARCH` has additional BSPs, e.g., Banana Pi BPI-R3.
-
-The `board/` directory is matched with the `configs/*_defconfigs` and
-the only execption is `board/common/`, which holds all shared files for
-Infix builds.
-
-Each `board/$BR2_ARCH/` can then have vendor/product sub-directories
-for the BSPs which may contain "fixups" to the base kernel config and
-any additional device tree files that should be included as well.
-
-To rebuild a board-specific package, e.g. NanoPi R2S:
-
-    make friendlyarm-nanopi-r2s-rebuild all

board/aarch32/Config.in

@@ -0,0 +1,5 @@
+if BR2_arm
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/raspberrypi-rpi2/Config.in"
+
+endif

board/aarch32/README.md

@@ -1,5 +1,5 @@
-Arm 32-bit
-==========
+aarch32
+=======
 
 Board Specific Documentation
 ----------------------------

board/aarch32/board.mk

@@ -0,0 +1 @@
+

board/aarch32/linux_defconfig

@@ -31,11 +31,14 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
+CONFIG_KEXEC=y
 CONFIG_ARCH_MULTI_V6=y
+CONFIG_ARCH_MULTI_V7=y
 CONFIG_ARCH_VIRT=y
 CONFIG_ARCH_BCM=y
 CONFIG_ARCH_BCM2835=y
 CONFIG_SMP=y
+CONFIG_NR_CPUS=4
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
@@ -44,6 +47,7 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPUFREQ_DT=y
 CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_AEABI=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -74,6 +78,7 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -89,31 +94,12 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
-CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -122,22 +108,15 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -154,58 +133,29 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_SET=y
-CONFIG_IP_SET_BITMAP_IP=y
-CONFIG_IP_SET_BITMAP_IPMAC=y
-CONFIG_IP_SET_BITMAP_PORT=y
-CONFIG_IP_SET_HASH_IP=y
-CONFIG_IP_SET_HASH_IPMARK=y
-CONFIG_IP_SET_HASH_IPPORT=y
-CONFIG_IP_SET_HASH_IPPORTIP=y
-CONFIG_IP_SET_HASH_IPPORTNET=y
-CONFIG_IP_SET_HASH_IPMAC=y
-CONFIG_IP_SET_HASH_MAC=y
-CONFIG_IP_SET_HASH_NETPORTNET=y
-CONFIG_IP_SET_HASH_NET=y
-CONFIG_IP_SET_HASH_NETNET=y
-CONFIG_IP_SET_HASH_NETPORT=y
-CONFIG_IP_SET_HASH_NETIFACE=y
-CONFIG_IP_SET_LIST_SET=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_SYNPROXY=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -244,16 +194,16 @@ CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_PKTGEN=y
-CONFIG_CFG80211=m
-CONFIG_MAC80211=m
-CONFIG_RFKILL=y
+# CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
+CONFIG_PCI_AARDVARK=y
 CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_ARMADA_8K=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -271,6 +221,7 @@ CONFIG_BLK_DEV_NVME=y
 CONFIG_SRAM=y
 CONFIG_EEPROM_AT24=y
 # CONFIG_SCSI_PROC_FS is not set
+CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_SAS_LIBSAS=y
 CONFIG_SCSI_SAS_ATA=y
@@ -279,6 +230,7 @@ CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_MVEBU=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
@@ -306,6 +258,8 @@ CONFIG_SMSC911X=y
 CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
 CONFIG_USB_NET_SMSC95XX=y
+CONFIG_BRCMFMAC=m
+CONFIG_ZD1211RW=m
 CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
 CONFIG_INPUT_TOUCHSCREEN=y
@@ -319,19 +273,22 @@ CONFIG_SERIAL_8250_BCM2835AUX=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
+CONFIG_TTY_PRINTK=y
+CONFIG_HVC_DRIVER=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
 CONFIG_SPI_BCM2835=y
 CONFIG_SPI_BCM2835AUX=y
+CONFIG_GPIO_SYSFS=y
 CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
 CONFIG_BCM2711_THERMAL=y
 CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
-CONFIG_I6300ESB_WDT=y
 CONFIG_BCM2835_WDT=y
+CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -339,12 +296,12 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
 CONFIG_DRM=y
 CONFIG_DRM_LOAD_EDID_FIRMWARE=y
-CONFIG_DRM_SIMPLEDRM=y
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_TOSHIBA_TC358762=m
 CONFIG_DRM_V3D=m
 CONFIG_DRM_VC4=m
 CONFIG_DRM_VC4_HDMI_CEC=y
+CONFIG_DRM_SIMPLEDRM=y
 CONFIG_FB=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_SOUND=y
@@ -353,7 +310,6 @@ CONFIG_SND_SOC=y
 CONFIG_SND_BCM2835_SOC_I2S=y
 CONFIG_HID_GENERIC=m
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC2=y
@@ -387,6 +343,7 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_STAGING=y
 CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
 CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
@@ -395,8 +352,7 @@ CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_POSIX_ACL=y
-CONFIG_EXT4_FS=y
+CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -415,13 +371,13 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
-CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_ISO8859_15=y
 CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_CCM=y
 CONFIG_CRYPTO_GCM=y
+# CONFIG_XZ_DEC_ARM is not set
+# CONFIG_XZ_DEC_ARMTHUMB is not set
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
@@ -431,13 +387,9 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
-CONFIG_TEST_LOCKUP=m
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
+# CONFIG_STRICT_DEVMEM is not set
 CONFIG_MEMTEST=y

board/aarch32/raspberrypi-rpi2/Config.in

@@ -5,10 +5,11 @@ config BR2_PACKAGE_RASPBERRYPI_RPI2
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+
 	help
 	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
 	  (SBC) with BCM2836 quad-core Cortex-A7 processor.
 
-	  This was the only Raspberry Pi model with the BCM2836 and the rare
-	  RPi 2B board revision v1.2 actually got an underclocked BCM2837,
-	  which is the saem Cortex-A53 as the RPi3, but w/o wifi.
+	  This was the only Raspberry Pi model with the BCM2836 and the 2B
+	  actually got a BCM2837 (Cortex-A53) underclocked an w/o wifi in
+	  the v1.2 board revision.

board/aarch32/raspberrypi-rpi2/README.md

@@ -21,8 +21,9 @@ The board features:
 How to Build
 ------------
 
-Since there are no pre-built images for ARM 32-bit, you need to build both
-Infix and the bootloader from source.
+Since there are no pre-built images for ARM32, you need to build both Infix
+and the bootloader from source.
+
 
 1. Clone the repository
 
@@ -36,12 +37,12 @@ Infix and the bootloader from source.
 
 3. Build Infix (in another tree)
 
-        make O=x-arm arm_defconfig
-        make O=x-arm
+        make O=x-arm32 aarch32_defconfig
+        make O=x-arm32
 
 4. Create the SD card image
 
-        ./utils/mkimage.sh -b x-boot -r x-arm raspberrypi-rpi2
+        ./utils/mkimage.sh -b x-boot -r x-arm32 raspberrypi-rpi2
 
 The resulting image can be found in `x-boot/images/infix-arm-sdcard.img`
 

board/aarch32/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg

@@ -41,31 +41,14 @@
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Raspberry Pi 2 Model B"
-              }
+              {"id": "netmask"},
+              {"id": "broadcast"},
+              {"id": "router"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "ntp-server"},
+              {"id": "vendor-class", "value": "Raspberry Pi 2 Model B"}
             ]
           }
         }
@@ -88,9 +71,6 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -98,14 +78,6 @@
           "user-name": [
             "admin"
           ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
         }
       ]
     },
@@ -125,37 +97,6 @@
           }
         ]
       },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
       {
         "name": "default-deny-all",
         "group": [
@@ -163,25 +104,11 @@
         ],
         "rule": [
           {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
           }
         ]
       }
@@ -195,11 +122,7 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -245,7 +168,7 @@
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
   "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/bananapi-bpi-r3/README.md

@@ -34,10 +34,6 @@ Infix comes preconfigured with:
 
 The easiest way to get started is using an SD card:
 
-> [!NOTE]
-> SD card boot works but we have observed stability issues. For production
-> use or long-term reliability, we recommend installing to eMMC (see below).
-
 1. **Download the SD card image:** [infix-bpi-r3-sdcard.img][2]
 2. **Flash the image to an SD card:** see [this guide][0]
 3. **Set boot switches:**
@@ -57,8 +53,8 @@ The BPI-R3 has a 4-position DIP switch that controls boot media:
 
 | Position | Mode        | Description                           |
 |----------|-------------|---------------------------------------|
-| 0000     | SD card     | Boot from microSD card                |
-| 0110     | eMMC        | Boot from internal eMMC (recommended) |
+| 0000     | SD card     | Boot from microSD card (recommended)  |
+| 0110     | eMMC        | Boot from internal eMMC storage       |
 | 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |
 
 > [!NOTE]
@@ -71,16 +67,10 @@ For production deployments or better performance, you can install Infix
 to the internal eMMC storage. This is more complex but provides faster
 boot times and eliminates the external SD card.
 
-> [!IMPORTANT]
-> While Infix boots on both SD card and eMMC, we have observed stability
-> issues with SD cards on this platform. **eMMC is recommended** for
-> reliable operation.
-
 ### Why Use eMMC?
 
 **Advantages:**
 
-- More reliable than SD card (stability issues observed with SD cards)
 - Faster boot and better performance
 - No external SD card to manage
 - More robust for industrial/embedded deployments

board/aarch64/bananapi-bpi-r3/bananapi-bpi-r3.mk

@@ -6,7 +6,7 @@ define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_GPIO,y)
 	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_WATCHDOG)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg

@@ -17,25 +17,7 @@
         "state": {
           "admin-state": "unlocked"
         }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-	  "band": "2.4GHz",
-	  "channel": "auto"
-	 }
-     },
-     {
-	"name": "radio1",
-	"class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-          "band": "5GHz",
-          "channel": "auto"
       }
-    }
     ]
   },
   "ietf-interfaces:interfaces": {
@@ -117,118 +99,58 @@
       {
         "name": "wan",
         "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Banana Pi BPI-R3"
-              }
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"},
+              {"id": "vendor-class", "value": "Banana Pi BPI-R3"}
             ]
           }
         },
         "ietf-ip:ipv6": {
           "infix-dhcpv6-client:dhcp": {
             "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "client-fqdn"
-              },
-              {
-                "id": "domain-search"
-              },
-              {
-                "id": "dns-server"
-              }
+              {"id": "ntp-server"},
+              {"id": "client-fqdn"},
+              {"id": "domain-search"},
+              {"id": "dns-server"}
             ]
           }
         }
       },
       {
-        "name": "wifi0-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0",
-          "access-point": {
-            "ssid": "Infix",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-	"infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
+        "name": "wifi0",
+        "type": "infix-if-type:wifi"
       },
       {
-        "name": "wifi1-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio1",
-          "access-point": {
-            "ssid": "Infix5Ghz",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-       "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
+        "name": "wifi1",
+        "type": "infix-if-type:wifi"
       }
     ]
   },
   "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
+        "asymmetric-keys": {
+            "asymmetric-key": [
+                {
+                    "name": "genkey",
+                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+                    "public-key": "",
+                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+                    "cleartext-private-key": "",
+                    "certificates": {}
+                }
+            ]
         }
-      ]
-    },
-    "symmetric-keys": {
-      "symmetric-key": [
-        {
-          "name": "wifi",
-          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
-          "key-format": "infix-crypto-types:passphrase-key-format"
-        }
-      ]
-    }
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -236,14 +158,6 @@
           "user-name": [
             "admin"
           ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
         }
       ]
     },
@@ -263,37 +177,6 @@
           }
         ]
       },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
       {
         "name": "default-deny-all",
         "group": [
@@ -301,25 +184,11 @@
         ],
         "rule": [
           {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
           }
         ]
       }
@@ -333,11 +202,7 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -429,7 +294,7 @@
     "policy": [
       {
         "name": "lan-to-wan",
-        "action": "accept",
+	"action": "accept",
         "ingress": [
           "lan"
         ],
@@ -441,7 +306,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true
@@ -477,3 +342,4 @@
     }
   }
 }
+

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/product/interface-quirks.json

@@ -1,11 +0,0 @@
-{
-    "sfp1": {
-	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
-	"broken-autoneg": true
-    },
-    "sfp2": {
-	"comment": "Reports it supports autoneg, but if setting it, dagger crashes",
-	"broken-autoneg": true
-    }
-
-}

board/aarch64/board.mk

@@ -1,4 +1,3 @@
-include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/*/*.mk))
 
 .PHONY: board-enable-qemu-uboot
 board-enable-qemu-uboot:
@@ -20,6 +19,13 @@ board-enable-qemu-uboot:
 			'$$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config' \
 		--enable TARGET_UBOOT_FORMAT_DTB
 
+.PHONY: board-enable-sparx-fit
+board-enable-sparx-fit:
+	@$(call IXMSG,"Enabling SparX-5i compatible FIT options")
+	@BR2_PREFIX= ./utils/config --file $(BR2_CONFIG) \
+	 	--enable FIT_IMAGE \
+	 	--set-str FIT_KERNEL_LOAD_ADDR "0x7 0x00000000"
+
 .PHONY: board-sparx-flash-uboot
 board-sparx-flash-uboot: $(BINARIES_DIR)/u-boot.bin
 	@grep -q 'BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mscc_fireant_pcb135_emmc"' $(BR2_CONFIG) || \

board/aarch64/friendlyarm-nanopi-r2s/Config.in

@@ -4,7 +4,6 @@ config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
 	select SDCARD_AUX
 	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
-	select BR2_PACKAGE_INPUT_EVENT_DAEMON
 	help
 	  FriendlyElec NanoPi R2S is a compact router board based on
 	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.

board/aarch64/friendlyarm-nanopi-r2s/friendlyarm-nanopi-r2s.mk

@@ -4,9 +4,6 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
-	# TODO: for some reason this just locks up the device
-	#       so we'll have to rely on the softdog :-(
-	# $(call KCONFIG_ENABLE_OPT,CONFIG_DW_WATCHDOG)
 
 	# PHY drivers
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
@@ -54,10 +51,6 @@ define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
 	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)
 
-	# Input layer
-	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MISC)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
-
 	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg

@@ -58,52 +58,28 @@
       {
         "name": "wan",
         "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "vendor-class",
-                "value": "NanoPi R2S"
-              }
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"},
+              {"id": "vendor-class", "value": "NanoPi R2S"}
             ]
           }
         },
         "ietf-ip:ipv6": {
           "infix-dhcpv6-client:dhcp": {
             "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "client-fqdn"
-              },
-              {
-                "id": "domain-search"
-              },
-              {
-                "id": "dns-server"
-              }
+              {"id": "ntp-server"},
+              {"id": "client-fqdn"},
+              {"id": "domain-search"},
+              {"id": "dns-server"}
             ]
           }
         }
@@ -111,24 +87,21 @@
     ]
   },
   "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
+        "asymmetric-keys": {
+            "asymmetric-key": [
+                {
+                    "name": "genkey",
+                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+                    "public-key": "",
+                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+                    "cleartext-private-key": "",
+                    "certificates": {}
+                }
+            ]
         }
-      ]
-    }
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -136,14 +109,6 @@
           "user-name": [
             "admin"
           ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
         }
       ]
     },
@@ -163,37 +128,6 @@
           }
         ]
       },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
       {
         "name": "default-deny-all",
         "group": [
@@ -201,25 +135,11 @@
         ],
         "rule": [
           {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
           }
         ]
       }
@@ -233,11 +153,7 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -329,7 +245,7 @@
     "policy": [
       {
         "name": "lan-to-wan",
-        "action": "accept",
+	"action": "accept",
         "ingress": [
           "lan"
         ],
@@ -341,7 +257,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/usr/sbin/wan-monitor.sh

@@ -20,7 +20,6 @@ cleanup()
 {
     rm -f "$LED_FILE"
     rm -f "$PID_FILE"
-    kill %% 2>/dev/null
     exit 0
 }
 
@@ -32,13 +31,11 @@ remaining_time=$((1800 - $(awk '{print int($1)}' /proc/uptime)))
 
 while [ "$remaining_time" -gt 0 ]; do
     check_wan
-    sleep 1 &
-    wait $!
+    sleep 1
     remaining_time=$((remaining_time - 1))
 done
 
 while :; do
     check_wan
-    sleep 5 &
-    wait $!
+    sleep 5
 done

board/aarch64/linux_defconfig

@@ -39,6 +39,7 @@ CONFIG_ARM64_ERRATUM_1286807=y
 CONFIG_ARM64_ERRATUM_1542419=y
 CONFIG_ARM64_ERRATUM_2441009=y
 CONFIG_ARM64_VA_BITS_48=y
+CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=64
 CONFIG_COMPAT=y
 # CONFIG_SUSPEND is not set
@@ -51,6 +52,7 @@ CONFIG_ARM_ARMADA_37XX_CPUFREQ=y
 CONFIG_ARM_ARMADA_8K_CPUFREQ=y
 CONFIG_ACPI=y
 CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -77,6 +79,7 @@ CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_IPV6_SIT=m
@@ -92,31 +95,12 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_PROCFS=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
-CONFIG_NETFILTER_NETLINK_GLUE_CT=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
 CONFIG_NFT_CT=m
-CONFIG_NFT_FLOW_OFFLOAD=y
 CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -125,23 +109,15 @@ CONFIG_NFT_REDIR=m
 CONFIG_NFT_NAT=m
 CONFIG_NFT_TUNNEL=m
 CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=y
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
-CONFIG_NFT_FIB_INET=y
 CONFIG_NFT_XFRM=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_FIB_NETDEV=y
 CONFIG_NFT_REJECT_NETDEV=m
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
-CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
@@ -158,69 +134,29 @@ CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_IP_SET=y
-CONFIG_IP_SET_BITMAP_IP=y
-CONFIG_IP_SET_BITMAP_IPMAC=y
-CONFIG_IP_SET_BITMAP_PORT=y
-CONFIG_IP_SET_HASH_IP=y
-CONFIG_IP_SET_HASH_IPMARK=y
-CONFIG_IP_SET_HASH_IPPORT=y
-CONFIG_IP_SET_HASH_IPPORTIP=y
-CONFIG_IP_SET_HASH_IPPORTNET=y
-CONFIG_IP_SET_HASH_IPMAC=y
-CONFIG_IP_SET_HASH_MAC=y
-CONFIG_IP_SET_HASH_NETPORTNET=y
-CONFIG_IP_SET_HASH_NET=y
-CONFIG_IP_SET_HASH_NETNET=y
-CONFIG_IP_SET_HASH_NETPORT=y
-CONFIG_IP_SET_HASH_NETIFACE=y
-CONFIG_IP_SET_LIST_SET=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_IP_NF_MANGLE=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
-CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NFT_BRIDGE_META=m
-CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
 CONFIG_BRIDGE_EBT_802_3=m
 CONFIG_BRIDGE_EBT_ARP=m
 CONFIG_BRIDGE_EBT_IP=m
@@ -308,7 +244,6 @@ CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
-CONFIG_WIREGUARD=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
@@ -472,10 +407,10 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_GPIO_WATCHDOG=y
-CONFIG_ARM_SBSA_WATCHDOG=y
 CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
 CONFIG_MFD_MAX77620=y
+CONFIG_MFD_SEC_CORE=y
 CONFIG_MFD_ROHM_BD718XX=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -484,6 +419,7 @@ CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_MAX77620=y
 CONFIG_REGULATOR_PCA9450=y
 CONFIG_REGULATOR_QCOM_SPMI=y
+CONFIG_REGULATOR_S2MPS11=y
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_A4TECH is not set
 # CONFIG_HID_APPLE is not set
@@ -493,11 +429,11 @@ CONFIG_REGULATOR_QCOM_SPMI=y
 # CONFIG_HID_CYPRESS is not set
 # CONFIG_HID_EZKEY is not set
 # CONFIG_HID_KENSINGTON is not set
+# CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
 CONFIG_USB_ULPI_BUS=y
 CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
@@ -515,6 +451,7 @@ CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
 CONFIG_USB_HSIC_USB3503=m
+CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_SNP_UDC_PLAT=y
@@ -548,6 +485,7 @@ CONFIG_LEDS_TRIGGER_NETDEV=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
 CONFIG_RTC_DRV_PCF8523=y
+CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
 CONFIG_RTC_DRV_PL031=y
@@ -562,6 +500,7 @@ CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 # CONFIG_SURFACE_PLATFORMS is not set
 CONFIG_COMMON_CLK_CS2000_CP=y
+CONFIG_COMMON_CLK_S2MPS11=y
 CONFIG_COMMON_CLK_XGENE=y
 CONFIG_COMMON_CLK_BD718XX=y
 CONFIG_MAILBOX=y
@@ -578,8 +517,7 @@ CONFIG_PHY_SAMSUNG_USB2=y
 CONFIG_NVMEM_LAYOUT_ONIE_TLV=y
 CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_POSIX_ACL=y
-CONFIG_EXT4_FS=y
+CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -598,17 +536,16 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
-CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_ISO8859_15=y
-CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
@@ -620,13 +557,8 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
-CONFIG_HARDLOCKUP_DETECTOR=y
-CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
-CONFIG_TEST_LOCKUP=m
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
 # CONFIG_STRICT_DEVMEM is not set

board/aarch64/raspberrypi-rpi64/Config.in

@@ -5,7 +5,7 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
-	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
+
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
 	  of single-board computers (SBC), RPi 3B and later, including the

board/aarch64/raspberrypi-rpi64/README.md

@@ -107,10 +107,8 @@ To configure WiFi as a client, first store your WiFi password in the keystore:
 ```
 admin@infix:/> configure
 admin@infix:/config/> edit keystore symmetric-key mywifi
-admin@infix:/config/keystore/…/mywifi/> set key-format passphrase-key-format
-admin@infix:/config/keystore/…/mywifi/> change cleartext-symmetric-key
-Passphrase: ************
-Retype passphrase: ************
+admin@infix:/config/keystore/…/mywifi/> set key-format wifi-preshared-key-format
+admin@infix:/config/keystore/…/mywifi/> set cleartext-key YourWiFiPassword
 admin@infix:/config/keystore/…/mywifi/> leave
 ```
 

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-compute-module/etc/product/init.d/S01-trigger-udev.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-# Workaround for: https://github.com/kernelkit/infix/issues/1357
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg

@@ -10,13 +10,6 @@
         "state": {
           "admin-state": "unlocked"
         }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "00"
-        }
       }
     ]
   },
@@ -45,45 +38,24 @@
       {
         "name": "eth0",
         "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
         "ietf-ip:ipv4": {
           "infix-dhcp-client:dhcp": {
             "option": [
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Raspberry Pi 4 Model B"
-              }
+              {"id": "netmask"},
+              {"id": "broadcast"},
+              {"id": "router"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "ntp-server"},
+              {"id": "vendor-class", "value": "Raspberry Pi 4 Model B"}
             ]
           }
         }
       },
       {
         "name": "wifi0",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0"
-        }
+        "type": "infix-if-type:wifi"
       }
     ]
   },
@@ -103,9 +75,6 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -113,14 +82,6 @@
           "user-name": [
             "admin"
           ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
         }
       ]
     },
@@ -140,37 +101,6 @@
           }
         ]
       },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
       {
         "name": "default-deny-all",
         "group": [
@@ -178,25 +108,11 @@
         ],
         "rule": [
           {
-            "name": "deny-password-access",
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
+            "action": "deny"
           }
         ]
       }
@@ -210,11 +126,7 @@
             "name": "default-ssh",
             "ssh": {
               "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
+                "local-address": "::"
               },
               "ssh-server-parameters": {
                 "server-identity": {
@@ -260,7 +172,7 @@
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
   "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/product/init.d/S01-trigger-udev.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-# Workaround for: https://github.com/kernelkit/infix/issues/1357
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add

board/aarch64/raspberrypi-rpi64/uboot/rpi-env.dtso

@@ -12,15 +12,6 @@
 			boot_targets = "mmc0";
 			ethprime = "eth0";
 
-			/* Memory layout for kernel boot:
-			 *   0x00200000: Kernel relocation address
-			 *   0x04000000: FDT (64MB, gives enough space for kernels up to ~60MB)
-			 *   0x10000000: Ramdisk (Memsize - 256MB)
-			 */
-			kernel_addr_r = "0x00200000";
-			fdt_addr_r = "0x04000000";
-			ramdisk_addr_r = "0x10000000";
-
 			stdout = "serial";
 			stderr = "serial";
 			stdin = "serial";

board/aarch64/rootfs/usr/share/product/marvell,armada-ap807/etc/support.d/50-marvell-cn913x.sh

@@ -1,26 +0,0 @@
-#!/bin/sh
-
-set -e
-
-ecc_stat()
-{
-    local chan=
-    local base=
-
-    for chan in 0 1; do
-        base=$((0xf0020360 + 0x200 * chan))
-
-        echo "DRAM Channel $chan ECC Status"
-        echo -n "  Log config: "; devmem $((base + 0x0)) 32
-        echo -n "  1b errors:  "; devmem $((base + 0x4)) 32
-        echo -n "  Info 0:     "; devmem $((base + 0x8)) 32
-        echo -n "  Info 1:     "; devmem $((base + 0xc)) 32
-        echo
-    done
-}
-
-[ -n "$1" ] || { echo "usage: $0 OUT-DIR"; exit 1; }
-work="$1"/marvell-cn913x
-mkdir -p "${work}"
-
-ecc_stat >"${work}"/ecc-stat

board/aarch64/styx-dcp-sc-28p/dts/styx/dcp-sc-28p-a.dts

@@ -59,9 +59,3 @@
 		XSWP(a, "e13", 13, &sfp0);
 	};
 };
-
-&cp0_spi1 {
-	spi-flash@0 {
-		broken-flash-reset;
-	};
-};

board/arm/Config.in

@@ -1,5 +0,0 @@
-if BR2_arm
-
-source "$BR2_EXTERNAL_INFIX_PATH/board/arm/raspberrypi-rpi2/Config.in"
-
-endif

board/arm/board.mk

@@ -1 +0,0 @@
-include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/arm/*/*.mk))

board/board.mk

@@ -1,3 +1,2 @@
-include $(BR2_EXTERNAL_INFIX_PATH)/board/common/common.mk
 include $(BR2_EXTERNAL_INFIX_PATH)/board/ix-board.mk
--include $(BR2_EXTERNAL_INFIX_PATH)/board/$(patsubst "%",%,$(BR2_ARCH))/board.mk
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/*/*/*.mk))

board/common/Config.in

@@ -1,28 +1,32 @@
-menu "Images"
-
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rootfs/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-qcow/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"
-
-endmenu
-
-config QEMU_SCRIPTS
-	bool "QEMU scripts"
+menuconfig SIGN_ENABLED
+	bool "Image Signing"
 	default y
-	help
-	  Install QEMU scripts and related files in the images
-	  directory, which can be used to launch virtual Infix
-	  instances.
+
+choice
+	prompt "Signing key source"
+	depends on SIGN_ENABLED
+	default SIGN_SRC_DIR
+
+config SIGN_SRC_DIR
+	bool "Directory"
+
+config SIGN_SRC_PKCS11
+	bool "PKCS#11 URL"
+
+endchoice
+
+config SIGN_KEY
+	string "Signing key"
+	depends on SIGN_ENABLED
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development"  if SIGN_SRC_DIR
 
 menuconfig TRUSTED_KEYS
 	bool "Trusted keys for image"
+	depends on SIGN_ENABLED
 	help
 	 Keys that will be accepted for this image
 
+
 config TRUSTED_KEYS_DEVELOPMENT
 	bool "Development key"
 	depends on TRUSTED_KEYS
@@ -35,3 +39,130 @@ config TRUSTED_KEYS_DEVELOPMENT_PATH
 config TRUSTED_KEYS_EXTRA_PATH
 	string "Path to extra keys to include in image"
 	depends on TRUSTED_KEYS
+
+menuconfig DISK_IMAGE
+	bool "Disk image"
+	help
+	  Compose a full disk image with redundant Linux OS partitions,
+	  configuration partition, etc.
+
+	  This is useful when:
+	  - Bringing up a blank system during manufacturing
+	  - Creating a GNS3 appliance
+	  - Developing/debugging issues in the boot process in QEMU
+
+menuconfig DISK_IMAGE_SIZE
+	string "Image size"
+	depends on DISK_IMAGE
+	default "512M"
+	help
+	  Create a disk image of this size.  A K/M/G suffix may be used
+	  to multiply by powers of 1024.  Suffixes like KB/MB/GB may be
+	  used to multiply by powers of 1000.  The image will be split
+	  proportionally to fit the two rootfs, a kernel, a writable
+	  /cfg and /var partiotions.
+
+	  Minimum supported size is 512M.
+
+choice
+	prompt "Bootloader"
+	depends on DISK_IMAGE
+	default DISK_IMAGE_BOOT_EFI if BR2_x86_64
+	default DISK_IMAGE_BOOT_NONE
+
+config DISK_IMAGE_BOOT_NONE
+	bool "None"
+	help
+	  Do not create any bootloader partition in the disk image.
+
+config DISK_IMAGE_BOOT_EFI
+	bool "EFI"
+	help
+	  Create a boot partition from a directory containing an EFI
+	  boot application, e.g. GRUB.
+
+config DISK_IMAGE_BOOT_BIN
+	bool "Binary"
+	help
+	  Create a boot partition from a raw image containing the boot
+	  application, e.g. U-Boot.
+
+endchoice
+
+config DISK_IMAGE_BOOT_DATA
+	string "Bootloader data"
+	depends on DISK_IMAGE
+	depends on DISK_IMAGE_BOOT_EFI || DISK_IMAGE_BOOT_BIN
+	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
+	help
+	  Path to the directory or file holding the bootloader data.
+
+config DISK_IMAGE_BOOT_OFFSET
+	hex "Bootloader offset"
+	depends on DISK_IMAGE
+	depends on DISK_IMAGE_BOOT_EFI || DISK_IMAGE_BOOT_BIN
+	default 0x8000
+	help
+	  Offset at which the bootloader partition is placed. Remember
+	  to make sure that the GPT still fits at the start of the
+	  image.
+
+config DISK_IMAGE_RELEASE_URL
+	string "Infix URL"
+	depends on DISK_IMAGE
+	depends on !BR2_TARGET_ROOTFS_SQUASHFS
+	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
+	help
+	  In situations where Infix itself is not being built, but a
+	  disk image is, i.e. when building a bootloader: place this
+	  Infix release in the primary and secondary partitions.
+
+menuconfig GNS3_APPLIANCE
+	bool "GNS3 Appliance"
+	select DISK_IMAGE
+	default y
+	help
+	  Create a GNS3 appliance description that, together with the
+	  disk image, can be imported into GNS3.
+
+config GNS3_APPLIANCE_RAM
+	int "Reserved RAM (MiB)"
+	depends on GNS3_APPLIANCE
+	default "192"
+	help
+	  Amount of host RAM reserved for an appliance instance.
+
+	  Minimum supported size is 192M.
+
+config GNS3_APPLIANCE_IFNUM
+	int "Number of interfaces"
+	depends on GNS3_APPLIANCE
+	default "1"
+	help
+	  Number of Ethernet interfaces to create for an appliance instance.
+
+menuconfig FIT_IMAGE
+	bool "Traditional FIT image"
+	help
+	  Create a "regular" FIT image where the kernel and DTBs are
+	  stored in the FIT rather than inside the rootfs (like it
+	  normally is in Infix).
+
+	  This is useful when trying out Infix on targets whose
+	  bootloader might not be capable of booting a raw Squash, but
+	  is able to handle an FIT.
+
+config FIT_ARCH
+	string
+	depends on FIT_IMAGE
+	default "arm64" if BR2_aarch64
+
+config FIT_KERNEL_LOAD_ADDR
+	string "Kernel load address"
+	depends on FIT_IMAGE
+
+config SDCARD_AUX
+	bool "Create SD-card aux partition"
+	help
+	  Create and populate aux.ext4 with rootfs.itbh and rauc.status
+	  For use with a static genimage.cfg for, e.g., SD-cards.

board/common/README.txt

@@ -34,7 +34,7 @@ Depending on how your Linux installation is set up, the following may
 require being run with superuser privileges, i.e., you may need to
 repend the command with 'sudo'.
 
-    $ ./qemu/run.sh
+    $ ./qemu.sh
 
 You should now see the Infix init system booting up.  When the final
 "Please press Enter to activate this console." is shown, press Enter
@@ -75,13 +75,13 @@ interface, which requires the following extra package:
 
 We can now enter the configuration:
 
-    $ ./qemu/run.sh -c
+    $ ./qemu.sh -c
 
 Go down to *Networking*, select *TAP*, now you can change the *Number of
 TAPs*, e.g. to 10.  Exit and save the configuration, then you can start
 Qemu again:
 
-    $ ./qemu/run.sh
+   ./qemu.sh
 
 > Make sure to do a factory reset from the CLI, otherwise you will be
 > stuck with that single interface from before.

board/common/busybox_defconfig

@@ -1016,7 +1016,12 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
-# CONFIG_UDHCPC6 is not set
+CONFIG_UDHCPC6_DEFAULT_SCRIPT="/usr/share/udhcpc/default6.script"
+CONFIG_UDHCPC6=y
+CONFIG_FEATURE_UDHCPC6_RFC3646=y
+CONFIG_FEATURE_UDHCPC6_RFC4704=y
+CONFIG_FEATURE_UDHCPC6_RFC4833=y
+CONFIG_FEATURE_UDHCPC6_RFC5970=y
 
 #
 # Common options for DHCP applets

board/common/common.mk

@@ -1,7 +1,4 @@
-include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/image.mk
-include $(BR2_EXTERNAL_INFIX_PATH)/board/common/qemu/qemu.mk
-
-ifeq ($(TRUSTED_KEYS),y)
+ifeq ($(SIGN_ENABLED),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk
 
 TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)

board/common/genimage.cfg.in

@@ -1,5 +1,16 @@
 @BOOTIMG@
 
+image aux.ext4 {
+	mountpoint = "/aux"
+	temporary = true
+	size = @AUXSIZE@
+
+	ext4 {
+		label = "aux"
+		use-mke2fs = true
+	}
+}
+
 image cfg.ext4 {
 	empty = true
 	temporary = true
@@ -22,8 +33,7 @@ image var.ext4 {
 	}
 }
 
-image disk.img {
-	temporary = true
+image @DISKIMG@ {
 	size = @TOTALSIZE@
 	hdimage {
 		partition-table-type = "gpt"
@@ -58,15 +68,5 @@ image disk.img {
 	}
 }
 
-image @QCOWIMG@ {
-	qemu {
-		format = "qcow2"
-	}
-
-	partition disk {
-		image = "disk.img"
-	}
-}
-
 # Silence genimage warnings
 config {}

board/common/image/image-itb-aux/Config.in

@@ -1,10 +0,0 @@
-config IMAGE_ITB_AUX
-	bool "aux partition"
-	depends on IMAGE_ITB_ROOTFS
-	select BR2_PACKAGE_HOST_UBOOT_TOOLS
-	select BR2_PACKAGE_HOST_GENIMAGE
-	help
-	  Create and populate auxiliary partition, aux.ext4, with
-	  metadata needed by U-Boot and RAUC to operate properly on
-	  systems using ITB images. This may then be included as a
-	  partition in a larger disk image.

board/common/image/image-itb-aux/generate.sh

@@ -1,85 +0,0 @@
-#!/bin/sh
-
-set -e
-
-boot="${1}"
-squash="${BINARIES_DIR}"/rootfs.squashfs
-itbh="${BINARIES_DIR}"/rootfs.itbh
-aux="${BINARIES_DIR}"/aux.ext4
-
-mkdir -p "${WORKDIR}"/aux
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp
-
-cp -f "${itbh}" "${WORKDIR}"/aux/primary.itbh
-cp -f "${itbh}" "${WORKDIR}"/aux/secondary.itbh
-
-tstamp=$(date -u +%FT%TZ)
-rootsha=$(sha256sum "${squash}" | cut -d" " -f1)
-rootsize=$(stat -c %s "${squash}")
-cat <<EOF >"${WORKDIR}"/aux/rauc.status
-[slot.rootfs.0]
-bundle.compatible=${COMPATIBLE}
-bundle.version=${VERSION}
-status=ok
-sha256=${rootsha}
-size=${rootsize}
-installed.timestamp=$tstamp
-installed.count=1
-activated.timestamp=$tstamp
-activated.count=1
-
-[slot.rootfs.1]
-bundle.compatible=${COMPATIBLE}
-bundle.version=${VERSION}
-status=ok
-sha256=${rootsha}
-size=${rootsize}
-installed.timestamp=$tstamp
-installed.count=1
-activated.timestamp=$tstamp
-activated.count=1
-EOF
-
-case "${boot}" in
-    uboot)
-	cat <<EOF | mkenvimage -s 0x4000 -o "${WORKDIR}"/aux/uboot.env -
-BOOT_ORDER=primary secondary net
-BOOT_primary_LEFT=1
-BOOT_secondary_LEFT=1
-BOOT_net_LEFT=1
-EOF
-	;;
-    grub)
-	mkdir -p "${WORKDIR}"/aux/grub
-	cp -f "${PKGDIR}"/grub.cfg "${PKGDIR}"/grubenv "${WORKDIR}"/aux/grub
-	;;
-    *)
-	echo "UNSUPPORTED BOOTLOADER ${boot}" >&2
-	exit 1
-esac
-
-cat <<EOF >"${WORKDIR}"/genimage.cfg
-image $(basename ${aux}) {
-	mountpoint = "/"
-	size = 8M
-
-	ext4 {
-		label = "aux"
-		use-mke2fs = true
-		features = "^metadata_csum,^metadata_csum_seed,uninit_bg"
-                extraargs = "-m 0 -i 4096"
-	}
-}
-
-# Silence genimage warnings
-config {}
-EOF
-
-genimage \
-    --loglevel 1 \
-    --tmppath    "${WORKDIR}"/tmp \
-    --rootpath   "${WORKDIR}"/aux \
-    --inputpath  "${WORKDIR}" \
-    --outputpath "$(dirname ${aux})" \
-    --config     "${WORKDIR}"/genimage.cfg

board/common/image/image-itb-aux/grub.cfg

@@ -1,80 +0,0 @@
-set timeout="1"
-
-load_env ORDER DEBUG
-
-if [ -z "$ORDER" ]; then
-    set ORDER="primary secondary"
-fi
-
-set ORDER="$ORDER reboot"
-
-for slot in $ORDER; do
-    if [ -z "$default" ]; then
-        set default="$slot"
-    else
-        # Contrary to what the documentation says, GRUB (2.06) does
-        # not support using titles or IDs in the fallback variable, so
-        # we translate to indices.
-        if [ "$slot" = "primary" ]; then
-            set fallback="$fallback 0"
-        elif [ "$slot" = "secondary" ]; then
-            set fallback="$fallback 1"
-        elif [ "$slot" = "net" ]; then
-            set fallback="$fallback 2"
-        elif [ "$slot" = "reboot" ]; then
-            set fallback="$fallback 3"
-	fi
-    fi
-done
-
-if [ "$DEBUG" ]; then
-    set log="debug"
-else
-    set log="loglevel=4"
-fi
-
-# From board/common/rootfs/etc/partition-uuid
-search -p 107ae911-a97b-4380-975c-7ce1a2dde1e0 --set primary
-search -p 352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02 --set secondary
-
-export primary
-export secondary
-
-submenu "primary" "$log" {
-    set slot="$1"
-    set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
-    set root="($primary)"
-    source /boot/grub/grub.cfg
-}
-
-submenu "secondary" "$log"  {
-    set slot="$1"
-    set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
-    set root="($secondary)"
-    source /boot/grub/grub.cfg
-}
-
-submenu "net" "$log"  {
-    net_dhcp
-
-    if [ "$net_efinet0_dhcp_next_server" -a "$net_efinet0_dhcp_boot_file" ]; then
-	set initrd=(tftp,$net_efinet0_dhcp_next_server)/$net_efinet0_dhcp_boot_file
-	loopback initrd $initrd
-	set root=(initrd)
-
-	set slot="$1"
-	set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 qroot=/dev/ram0 ramdisk_size=65536 $2"
-	source /boot/grub/grub.cfg
-    else
-	if [ -z "$net_efinet0_dhcp_next_server" ]; then
-	    echo "No TFTP server supplied in DHCP response"
-	fi
-	if [ -z "$net_efinet0_dhcp_boot_file" ]; then
-	    echo "No bootfile supplied in DHCP response"
-	fi
-    fi
-}
-
-submenu "reboot" {
-    reboot
-}

board/common/image/image-itb-aux/grubenv

@@ -1,10 +0,0 @@
-# GRUB Environment Block
-# WARNING: Do not edit this file by tools other than grub-editenv!!!
-ORDER=primary secondary net
-primary_OK=1
-secondary_OK=1
-net_OK=1
-primary_TRY=0
-secondary_TRY=0
-net_TRY=0
-#########################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################

board/common/image/image-itb-aux/image-itb-aux.mk

@@ -1,10 +0,0 @@
-################################################################################
-#
-# image-itb-aux
-#
-################################################################################
-
-IMAGE_ITB_AUX_DEPENDENCIES := host-uboot-tools host-genimage image-itb-rootfs
-IMAGE_ITB_AUX_OPTS := $(if $(BR2_TARGET_GRUB2),grub,uboot)
-
-$(eval $(ix-image))

board/common/image/image-itb-dl-release/Config.in

@@ -1,15 +0,0 @@
-menuconfig IMAGE_ITB_DL_RELEASE
-	bool "Download existing release"
-	depends on !BR2_TARGET_ROOTFS_SQUASHFS
-	help
-	  This is primarily used by target specific builds, where the
-	  bootloader artifact needs to be combined with an existing
-	  Infix image, to create a full disk image that can be
-	  provisioned to an SD-card or eMMC.
-
-config IMAGE_ITB_DL_RELEASE_URL
-	string "URL"
-	depends on IMAGE_ITB_DL_RELEASE
-	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
-	help
-	  URL to release tarball.

board/common/image/image-itb-dl-release/generate.sh

@@ -1,25 +0,0 @@
-#!/bin/sh
-
-set -e
-
-squash="${BINARIES_DIR}"/rootfs.squashfs
-aux="${BINARIES_DIR}"/aux.ext4
-
-[ -f "${squash}" ] && [ -f "${aux}" ] && exit 0
-
-archive="${WORKDIR}/$(basename ${URL})"
-[ -f "${archive}" ] || wget -O"${archive}" "${URL}"
-
-echo "Unpacking..."
-tar -xa --strip-components=1 -C "${BINARIES_DIR}" -f "${archive}"
-
-auxsize=$(stat -c %s "${aux}")
-if [ "${auxsize}" -gt $((8 << 20)) ]; then
-    # In older releases, 16M aux.ext4 images were generated. In order
-    # to keep the image-itb-qcow logic simpler, trim it 8M, which we
-    # always generate nowadays.
-    echo "WARNING: Auxiliary partition is unexpectedly large. Resizing..."
-    resize2fs "${aux}" 8M
-    truncate -s 8M "${aux}"
-    tune2fs -l "${aux}"
-fi

board/common/image/image-itb-dl-release/image-itb-dl-release.mk

@@ -1,9 +0,0 @@
-################################################################################
-#
-# image-itb-dl-release
-#
-################################################################################
-
-IMAGE_ITB_DL_RELEASE_CONFIG_VARS := URL
-
-$(eval $(ix-image))

board/common/image/image-itb-gns3a/Config.in

@@ -1,23 +0,0 @@
-menuconfig IMAGE_ITB_GNS3A
-	bool "GNS3 Appliance (ITB)"
-	depends on BR2_x86_64
-	select IMAGE_ITB_QCOW
-	help
-	  Create a GNS3 appliance description that, together with the
-	  disk image, can be imported into GNS3.
-
-config IMAGE_ITB_GNS3A_RAM
-	int "Reserved RAM (MiB)"
-	depends on IMAGE_ITB_GNS3A
-	default "192"
-	help
-	  Amount of host RAM reserved for an appliance instance.
-
-	  Minimum supported size is 192M.
-
-config IMAGE_ITB_GNS3A_IFNUM
-	int "Number of interfaces"
-	depends on IMAGE_ITB_GNS3A
-	default "1"
-	help
-	  Number of Ethernet interfaces to create for an appliance instance.

board/common/image/image-itb-gns3a/generate.sh

@@ -1,59 +0,0 @@
-#!/bin/sh
-
-set -e
-
-bios="${BINARIES_DIR}"/OVMF.fd
-qcow="${BINARIES_DIR}"/"${ARTIFACT}".qcow2
-gns3a="${BINARIES_DIR}"/"${ARTIFACT}".gns3a
-
-cat <<EOF >"${gns3a}"
-{
-    "name": "${ARTIFACT} devel",
-    "category": "router",
-    "description": "${ARTIFACT} development appliance",
-    "vendor_name": "Kernelkit",
-    "vendor_url": "https://kernelkit.org",
-    "product_name": "${ARTIFACT} devel",
-    "registry_version": 6,
-    "status": "experimental",
-    "maintainer": "Kernelkit",
-    "maintainer_email": "null@kernelkit.org",
-    "usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
-    "port_name_format": "eth{0}",
-    "linked_clone": true,
-    "qemu": {
-        "adapter_type": "virtio-net-pci",
-        "adapters": ${IFNUM},
-        "ram": ${RAM},
-        "cpus": 1,
-        "hda_disk_interface": "virtio",
-        "arch": "x86_64",
-        "console_type": "telnet",
-        "bios_image": "$(basename ${bios})",
-        "kvm": "allow"
-    },
-    "images": [
-        {
-            "filename": "$(basename "${bios}")",
-            "filesize": $(stat --printf='%s' "${bios}"),
-            "md5sum": "$(md5sum "${bios}" | awk '{print $1}')",
-            "version": "0.0"
-        },
-        {
-            "filename": "$(basename "${qcow}")",
-            "filesize": $(stat --printf='%s' "${qcow}"),
-            "md5sum": "$(md5sum "${qcow}" | awk '{print $1}')",
-            "version": "${VERSION}"
-        }
-    ],
-    "versions": [
-        {
-            "name": "${VERSION}",
-            "images": {
-                "bios_image": "$(basename ${bios})",
-                "hda_disk_image": "$(basename ${qcow})"
-            }
-        }
-    ]
-}
-EOF

board/common/image/image-itb-gns3a/image-itb-gns3a.mk

@@ -1,10 +0,0 @@
-################################################################################
-#
-# image-itb-gns3a
-#
-################################################################################
-
-IMAGE_ITB_GNS3A_DEPENDENCIES := image-itb-qcow
-IMAGE_ITB_GNS3A_CONFIG_VARS  := IFNUM RAM
-
-$(eval $(ix-image))

board/common/image/image-itb-qcow/Config.in

@@ -1,68 +0,0 @@
-menuconfig IMAGE_ITB_QCOW
-	bool "QEMU disk image (ITB)"
-	depends on (IMAGE_ITB_ROOTFS && IMAGE_ITB_AUX) || IMAGE_ITB_DL_RELEASE
-	select BR2_PACKAGE_HOST_GENIMAGE
-	help
-	  Compose a full disk image with redundant Linux OS partitions,
-	  configuration partition, etc., for systems using ITB images.
-
-	  This is useful when:
-	  - Bringing up a blank system during manufacturing
-	  - Creating a GNS3 appliance
-	  - Developing/debugging issues in the boot process in QEMU
-
-menuconfig IMAGE_ITB_QCOW_SIZE
-	string "Image size"
-	depends on IMAGE_ITB_QCOW
-	default "512M"
-	help
-	  Create a disk image of this size.  A K/M/G suffix may be used
-	  to multiply by powers of 1024.  Suffixes like KB/MB/GB may be
-	  used to multiply by powers of 1000.  The image will be split
-	  proportionally to fit the two rootfs, a kernel, a writable
-	  /cfg and /var partiotions.
-
-	  Minimum supported size is 512M.
-
-choice
-	prompt "Bootloader"
-	depends on IMAGE_ITB_QCOW
-	default IMAGE_ITB_QCOW_BOOT_EFI if BR2_x86_64
-	default IMAGE_ITB_QCOW_BOOT_NONE
-
-config IMAGE_ITB_QCOW_BOOT_NONE
-	bool "None"
-	help
-	  Do not create any bootloader partition in the disk image.
-
-config IMAGE_ITB_QCOW_BOOT_EFI
-	bool "EFI"
-	help
-	  Create a boot partition from a directory containing an EFI
-	  boot application, e.g. GRUB.
-
-config IMAGE_ITB_QCOW_BOOT_BIN
-	bool "Binary"
-	help
-	  Create a boot partition from a raw image containing the boot
-	  application, e.g. U-Boot.
-
-endchoice
-
-config IMAGE_ITB_QCOW_BOOT_DATA
-	string "Bootloader data"
-	depends on IMAGE_ITB_QCOW
-	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
-	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
-	help
-	  Path to the directory or file holding the bootloader data.
-
-config IMAGE_ITB_QCOW_BOOT_OFFSET
-	hex "Bootloader offset"
-	depends on IMAGE_ITB_QCOW
-	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
-	default 0x8000
-	help
-	  Offset at which the bootloader partition is placed. Remember
-	  to make sure that the GPT still fits at the start of the
-	  image.

board/common/image/image-itb-qcow/image-itb-qcow.mk

@@ -1,15 +0,0 @@
-################################################################################
-#
-# image-itb-qcow
-#
-################################################################################
-
-# We can source the rootfs+aux from a local build, or from a
-# downloaded release; so adjust our dependencies accordingly.
-IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_ROOTFS)     := image-itb-rootfs image-itb-aux
-IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_DL_RELEASE) := image-itb-dl-release
-
-IMAGE_ITB_QCOW_DEPENDENCIES := host-genimage $(IMAGE_ITB_QCOW_SRC-y)
-IMAGE_ITB_QCOW_CONFIG_VARS := BOOT_DATA BOOT_OFFSET SIZE
-
-$(eval $(ix-image))

board/common/image/image-itb-rauc/Config.in

@@ -1,27 +0,0 @@
-menuconfig IMAGE_ITB_RAUC
-	bool "RAUC upgrade bundle (ITB)"
-	select IMAGE_ITB_ROOTFS
-	select BR2_PACKAGE_HOST_RAUC
-	help
-	  Create RAUC upgrade bundle, for targets using ITB images,
-	  that can be used to upgrade a running system to this version
-	  of Infix.
-
-config IMAGE_ITB_RAUC_KEY
-	string "signing key"
-	depends on IMAGE_ITB_RAUC
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
-	help
-	  Path to the private key, in PKCS#8 format, used to sign
-	  the RAUC bundle; or a PKCS#11 URI.
-
-config IMAGE_ITB_RAUC_CERT
-	string "signing certificate"
-	depends on IMAGE_ITB_RAUC
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
-	help
-	  Path to the X509 certificate which will be associated with
-	  the bundle signature.
-
-	  NOTE: This cert MUST be included in the trust store of the
-	        system on which this bundle is to be installed.

board/common/image/image-itb-rauc/generate.sh

@@ -1,35 +0,0 @@
-#!/bin/sh
-
-set -e
-
-squash="${BINARIES_DIR}"/rootfs.squashfs
-itbh="${BINARIES_DIR}"/rootfs.itbh
-pkg="${BINARIES_DIR}"/"${ARTIFACT}.pkg"
-
-cp -f "${PKGDIR}"/hooks.sh "${WORKDIR}"/hooks.sh
-
-# RAUC internally uses the file extension to find a suitable install
-# handler, hence the name must be .img
-cp -f "${squash}" "${WORKDIR}"/rootfs.img
-cp -f "${itbh}"   "${WORKDIR}"/rootfs.itbh
-
-cat >"${WORKDIR}"/manifest.raucm <<EOF
-[update]
-compatible=${COMPATIBLE}
-version=${VERSION}
-
-[bundle]
-format=verity
-
-[hooks]
-filename=hooks.sh
-
-[image.rootfs]
-filename=rootfs.img
-hooks=post-install
-EOF
-
-rauc --cert="${CERT}" --key="${KEY}" \
-     bundle "${WORKDIR}" "${pkg}.next"
-
-mv "${pkg}.next" "${pkg}"

board/common/image/image-itb-rauc/image-itb-rauc.mk

@@ -1,10 +0,0 @@
-################################################################################
-#
-# image-itb-rauc
-#
-################################################################################
-
-IMAGE_ITB_RAUC_DEPENDENCIES := host-rauc image-itb-rootfs
-IMAGE_ITB_RAUC_CONFIG_VARS := KEY CERT
-
-$(eval $(ix-image))

board/common/image/image-itb-rootfs/Config.in

@@ -1,20 +0,0 @@
-menuconfig IMAGE_ITB_ROOTFS
-	bool "rootfs.itb+.itbh"
-	select BR2_TARGET_ROOTFS_SQUASHFS
-	select BR2_PACKAGE_HOST_UBOOT_TOOLS
-	help
-	  Create a signed ITB image containing a SquashFS of rootfs
-	  and extract detached header (.itbh) for U-Boot based
-	  targets.
-
-config IMAGE_ITB_ROOTFS_KEY
-	string "signing key"
-	depends on IMAGE_ITB_ROOTFS
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
-	help
-	  Path to the private RSA key, in PKCS#8 format, used to sign
-	  the root filesystem.
-
-	  If the path is prefixed with "<hint>:", then that used as
-	  the "key-name-hint" in the resulting ITB, otherwise the
-	  basename of the path, with any extension removed, is used.

board/common/image/image-itb-rootfs/generate.sh

@@ -1,71 +0,0 @@
-#!/bin/sh
-
-set -e
-
-squash="${BINARIES_DIR}"/rootfs.squashfs
-
-itb="${BINARIES_DIR}"/rootfs.itb
-itbh_size=0x1000
-
-IFS=:
-set ${KEY}
-case $# in
-    1)
-	keyfile="$1"
-	hint=$(basename ${keyfile%.*})
-	;;
-    2)
-	keyfile="$2"
-	hint="$1"
-	;;
-    *)
-	echo "INVALID KEY" >&2
-	exit 1
-	;;
-esac
-
-rsanibbles=$(openssl rsa -in "${KEY}" -noout -modulus | \
-		 sed -e 's/^Modulus=//' | tr -d '\n' | wc -c)
-if [ "${rsanibbles}" -le 0 ]; then
-    echo "ONLY RSA KEYS ARE SUPPORTED" >&2
-    exit 1
-fi
-
-cat >"${WORKDIR}"/rootfs.its <<EOF
-/dts-v1/;
-
-/ {
-	description = "${ARTIFACT}";
-	creator = "infix";
-	#address-cells = <0x1>;
-
-	images {
-		rootfs {
-			description = "rootfs";
-			type = "ramdisk";
-			os = "linux";
-			compression = "none";
-			data = /incbin/("${squash}");
-			signature-1 {
-				algo = "sha256,rsa$((rsanibbles << 2))";
-				key-name-hint = "${hint}";
-			};
-		};
-	};
-
-	configurations {
-		default = "verity";
-		verity {
-			ramdisk = "rootfs";
-		};
-	};
-};
-
-EOF
-
-mkimage -E -p $itbh_size -B $itbh_size \
-	-f "${WORKDIR}"/rootfs.its \
-	-g "${hint}" -G "${keyfile}" \
-	"${itb}"
-
-dd if="${itb}" bs=$((itbh_size)) count=1 of="${itb}h" status=none

board/common/image/image-itb-rootfs/image-itb-rootfs.mk

@@ -1,10 +0,0 @@
-################################################################################
-#
-# image-itb-rootfs
-#
-################################################################################
-
-IMAGE_ITB_ROOTFS_DEPENDENCIES := rootfs-squashfs
-IMAGE_ITB_ROOTFS_CONFIG_VARS := KEY
-
-$(eval $(ix-image))

board/common/image/image-readme/Config.in

@@ -1,6 +0,0 @@
-config IMAGE_README
-	bool "Install README.md in images"
-	help
-	  Install a README.md with useful information about getting
-	  started with Infix in the images directory (thereby also
-	  including it in the resulting release tarball).

board/common/image/image-readme/image-readme.mk

@@ -1,18 +0,0 @@
-################################################################################
-#
-# image-readme
-#
-################################################################################
-
-IMAGE_README_DIR := $(pkgdir)
-
-image-readme: $(BINARIES_DIR)/README.md
-
-$(BINARIES_DIR)/README.md: $(IMAGE_README_DIR)/README.md
-	@$(call IXMSG,"Installing README.md")
-	@mkdir -p $(BINARIES_DIR)
-	@cp $< $@
-
-ifeq ($(IMAGE_README),y)
-TARGETS_ROOTFS += image-readme
-endif

board/common/image/image.mk

@@ -1,2 +0,0 @@
-include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/ix-image.mk
-include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/*/*.mk))

board/common/image/ix-image.mk

@@ -1,26 +0,0 @@
-define inner-ix-image
-
-$(2)_DIR := $$(pkgdir)
-
-$(1): $$($(2)_DEPENDENCIES)
-	@$$(call IXMSG,"$$(if $$($(2)_MESSAGE),$$($(2)_MESSAGE),Creating $(1))")
-	@mkdir -p $$(BUILD_DIR)/$(1)
-	@ \
-	PATH=$$(BR_PATH) \
-	PKGDIR=$$($(2)_DIR) \
-	WORKDIR=$$(BUILD_DIR)/$(1) \
-	BINARIES_DIR=$$(BINARIES_DIR) \
-	BR2_EXTERNAL_INFIX_PATH=$$(BR2_EXTERNAL_INFIX_PATH) \
-	ARTIFACT=$$(INFIX_ARTIFACT) \
-	COMPATIBLE=$$(INFIX_COMPATIBLE) \
-	VERSION=$$(INFIX_VERSION) \
-	$$(foreach var,$$($(2)_CONFIG_VARS),$$(var)=$$($(2)_$$(var)) ) \
-	$$($(2)_DIR)/generate.sh $$($(2)_OPTS)
-
-ifeq ($$($(2)),y)
-TARGETS_ROOTFS += $(1)
-endif
-
-endef
-
-ix-image = $(call inner-ix-image,$(pkgname),$(call UPPERCASE,$(pkgname)))

board/common/mkaux.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+
+rootdir=$BUILD_DIR/genimage.root
+tempdir=$BUILD_DIR/genimage.tmp
+
+cat <<EOF > /tmp/mkaux.cfg
+image aux.ext4 {
+	mountpoint = "/aux"
+	size = 16M
+
+	ext4 {
+		label = "aux"
+		use-mke2fs = true
+		features = "^metadata_csum,^metadata_csum_seed,uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+# Silence genimage warnings
+config {}
+EOF
+
+rm -rf   "$rootdir/aux"
+mkdir -p "$rootdir/aux"
+cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/primary.itbh"
+cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/secondary.itbh"
+cp -f "$BINARIES_DIR/rauc.status" "$rootdir/aux/rauc.status"
+
+mkenvimage -s 0x4000 -o "$rootdir/aux/uboot.env" \
+	   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
+
+rm -rf "$BINARIES_DIR/aux.ext4"
+rm -rf "$tempdir"
+
+genimage \
+    --rootpath   "$rootdir" \
+    --tmppath    "$tempdir" \
+    --inputpath  "$BINARIES_DIR" \
+    --outputpath "$BINARIES_DIR" \
+    --config "/tmp/mkaux.cfg"

board/common/mkdisk.sh

@@ -1,6 +1,8 @@
 #!/bin/sh
 set -e
 
+. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
+
 K=10
 M=20
 G=30
@@ -45,32 +47,43 @@ dimension()
 	exit 1
     fi
 
-    # Place aux right after the GPT...
-    auxoffs=$((32 << K))
+    # Size var to fit whatever is left over. Also reserve another 32K
+    # at the end to make room for the backup GPT.
+    varsize=$(($total - $auxsize - 2 * $imgsize - $cfgsize))
+    if [ "$bootoffs" ]; then
+	varsize=$(($varsize - $bootsize))
+    fi
+    varsize=$(($varsize - (32 << K)))
 
     if [ "$bootoffs" ]; then
-	if [ $((bootoffs)) -lt $((32 << K)) ]; then
-	    echo "Boot partition collides with GPT"
-	    exit 1
-	fi
-
-	# ...unless we have a boot partition, in which case we place
-	# it after that.
-	auxoffs=$((auxoffs + bootsize))
+	# Align the end of the boot partition to an even MiB. E.g. if
+	# boot was dimensioned to 4M, and bootoffs is 32K, then the
+	# final bootsize becomes 4M - 32K, meaning aux will start on
+	# exactly 4M.
+	auxoffs=$bootsize
+	bootsize=$(($bootsize - $bootoffs))
+    else
+	# No bootloader, place aux after GPT, resize it to end on an
+	# even MiB (as is done for boot above).
+	auxoffs=$((32 << K))
+	auxsize=$(($auxsize - $auxoffs))
     fi
+}
 
-    # Finally, size var to fit whatever is left over by subtracting
-    # all other images, plus another 32K at the end for the backup
-    # GPT.
-    varsize=$((total - auxoffs - auxsize - 2 * imgsize - cfgsize - (32 << K)))
+probeboot()
+{
+    # If we have built an EFI app, typically grub, make sure to
+    # include it.
+    if [ -d $BINARIES_DIR/efi-part/EFI ]; then
+	bootoffs=$((32 << K))
+    fi
 }
 
 genboot()
 {
     if [ -d "$bootdata" ]; then
 	bootimg=$(cat <<EOF
-image efi-part.vfat {
-	temporary = true
+image $BINARIES_DIR/efi-part.vfat {
 	size = $bootsize
 	vfat {
 		file EFI {
@@ -85,7 +98,7 @@ EOF
 		offset = $bootoffs
 		partition-type-uuid = U
 		bootable = true
-		image = efi-part.vfat
+		image = $BINARIES_DIR/efi-part.vfat
 	}
 EOF
 		  )
@@ -104,29 +117,44 @@ EOF
     fi
 }
 
-mkdir -p "${WORKDIR}"/root
-rm -rf   "${WORKDIR}"/tmp
-mkdir -p "${WORKDIR}"/tmp
+common=$(dirname $(readlink -f "$0"))
+root=$BUILD_DIR/genimage.root
+tmp=$BUILD_DIR/genimage.tmp
 
-qcowimg="${ARTIFACT}.qcow2"
-total=$(size2int $SIZE)
-bootoffs=
-bootdata=$BOOT_DATA
+total=$((512 << M))
+bootoffs=$((32 << K))
+bootdata=
+diskimg=disk.img
 bootimg=
 bootpart=
+tmpimage=$(mktemp)
+while getopts "a:b:B:n:s:" opt; do
+    case ${opt} in
+	a)
+	    arch=$OPTARG
+	    ;;
+	b)
+	    bootdata=$OPTARG
+	    ;;
+	B)
+	    bootoffs=$(($OPTARG))
+	    ;;
+	n)
+	    diskimg=${OPTARG}
+	    ;;
+	s)
+	    total=$(size2int $OPTARG)
+	    ;;
+    esac
+done
+shift $((OPTIND - 1))
 
-if [ -n "${BOOT_OFFSET}" ]; then
-    bootoffs=$(($BOOT_OFFSET))
-fi
+mkdir -p $root
 
+probeboot
 dimension
 genboot
 
-. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
-[ -n "${AUX_UUID}" ]
-[ -n "${PRIMARY_UUID}" ]
-[ -n "${SECONDARY_UUID}" ]
-
 # Use awk over sed because replacement text may contain newlines,
 # which sed does not approve of.
 awk \
@@ -138,7 +166,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vqcowimg=$qcowimg \
+	  -vdiskimg=$tmpimage \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -147,7 +175,7 @@ awk \
 		sub(/@IMGSIZE@/, imgsize);
 		sub(/@CFGSIZE@/, cfgsize);
 		sub(/@VARSIZE@/, varsize);
-		sub(/@QCOWIMG@/, qcowimg);
+		sub(/@DISKIMG@/, diskimg);
 		sub(/@BOOTIMG@/, bootimg);
 		sub(/@BOOTPART@/, bootpart);
 		sub(/@AUXUUID@/, auxuuid);
@@ -155,11 +183,35 @@ awk \
 		sub(/@SECONDARYUUID@/, secondaryuuid);
 
 	  }1' \
-	      < $PKGDIR/genimage.cfg.in >$WORKDIR/genimage.cfg
+	      < $common/genimage.cfg.in >$root/genimage.cfg
+
+mkdir -p $root/aux
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
+cp -f $BINARIES_DIR/rauc.status $root/aux/rauc.status
+
+case "$arch" in
+    aarch64)
+	mkenvimage -s 0x4000 -o "$root/aux/uboot.env" \
+		   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
+	;;
+    x86_64)
+	mkdir -p "$root/aux/grub"
+	cp -f "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grub.cfg" \
+	      "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grubenv"  \
+	      "$root/aux/grub/"
+	;;
+    *)
+	;;
+esac
+
+rm -rf "$tmp"
 
 genimage \
-    --tmppath    "${WORKDIR}"/tmp  \
-    --rootpath   "${WORKDIR}"/root \
-    --inputpath  "$BINARIES_DIR"   \
-    --outputpath "$BINARIES_DIR"   \
-    --config "${WORKDIR}"/genimage.cfg
+    --rootpath "$root" \
+    --tmppath  "$tmp" \
+    --inputpath "$BINARIES_DIR" \
+    --config "$root/genimage.cfg"
+
+qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
+rm "$tmpimage"

board/common/mkfit.sh

@@ -0,0 +1,118 @@
+#!/bin/sh
+
+die()
+{
+    echo "$@" >&2
+    exit 1
+}
+
+load_cfg()
+{
+    local tmp=$(mktemp -p /tmp)
+
+    grep ^FIT_ $BR2_CONFIG >$tmp
+    .  $tmp
+    rm $tmp
+}
+
+load_cfg
+[ "$FIT_IMAGE" = "y" ] || exit 0
+
+work=$BUILD_DIR/fit-image-local
+dtbs=$(find $BINARIES_DIR -name '*.dtb')
+kernel=$(find $BINARIES_DIR -name '*Image' | head -n1)
+squash=$BINARIES_DIR/rootfs.squashfs
+
+mkdir -p $work
+gzip <$kernel >$work/Image.gz
+kernel=$work/Image.gz
+
+rm -rf $work/rootfs
+unsquashfs -f -d $work/rootfs $squash
+rm -f $work/rootfs/boot/*Image
+
+squash=$work/rootfs-no-kernel.squashfs
+rm -f $squash
+mksquashfs $work/rootfs $squash
+
+# mkimage will only align images to 4 bytes, but U-Boot will leave
+# both DTB and ramdisk in place when starting the kernel. So we pad
+# all components up to a 4k boundary.
+truncate -s %4k $kernel $dtbs
+
+: >$work/dtbs.itsi
+: >$work/cfgs.itsi
+for dtb in $dtbs; do
+    name=$(basename $dtb .dtb)
+
+    cat <<EOF >>$work/dtbs.itsi
+		$name-dtb {
+			description = "$name";
+			type = "flat_dt";
+			arch = "$FIT_ARCH";
+			compression = "none";
+			data = /incbin/("$dtb");
+		};
+EOF
+    cat <<EOF >>$work/cfgs.itsi
+		$name {
+			description = "$name";
+			kernel = "kernel";
+			ramdisk = "ramdisk";
+			fdt = "$name-dtb";
+		};
+EOF
+done
+
+: >$work/kernel-load.itsi
+if [ "$FIT_KERNEL_LOAD_ADDR" ]; then
+    cat <<EOF >$work/kernel-load.itsi
+			load = <$FIT_KERNEL_LOAD_ADDR>;
+			entry = <$FIT_KERNEL_LOAD_ADDR>;
+EOF
+fi
+
+cat <<EOF >$work/infix.its
+/dts-v1/;
+
+/ {
+	timestamp = <$(date +%s)>;
+	description = "Infix ($FIT_ARCH)";
+	creator = "infix";
+	#address-cells = <0x1>;
+
+	images {
+
+		kernel {
+			description = "Linux";
+			type = "kernel";
+			arch = "$FIT_ARCH";
+			os = "linux";
+$(cat $work/kernel-load.itsi)
+			compression = "gzip";
+			data = /incbin/("$kernel");
+		};
+
+		ramdisk {
+			description = "Infix";
+			type = "ramdisk";
+			os = "linux";
+			arch = "$FIT_ARCH";
+			compression = "none";
+			data = /incbin/("$squash");
+		};
+
+$(cat $work/dtbs.itsi)
+
+	};
+
+	configurations {
+$(cat $work/cfgs.itsi)
+	};
+};
+EOF
+
+mkimage \
+    -E -p 0x1000 \
+    -f $work/infix.its $BINARIES_DIR/infix.itb \
+    || die "Unable to create FIT image"

board/common/mkgns3a.sh

@@ -0,0 +1,103 @@
+#!/bin/sh
+# shellcheck disable=SC1091
+. "$TARGET_DIR/etc/os-release"
+
+if [ -n "$INFIX_RELEASE" ]; then
+    rel="-${INFIX_RELEASE}"
+fi
+
+ARCH=$1
+NM="${2:-custom}${rel}"
+DISK=$3
+RAM=${4:-512}
+IFNUM=${5:-1}
+
+# The aarch64 build currently has no "loader" but instead starts Linux
+# directly, so we need to add a basic cmdline.
+loader_args()
+{
+    if [ "$ARCH" = "aarch64" ]; then
+	cat <<EOF
+"kernel_command_line": "console=ttyAMA0 root=PARTLABEL=primary quiet",
+EOF
+    fi
+}
+
+loader_img()
+{
+    if [ "$ARCH" = "x86_64" ]; then
+	cat <<EOF
+"bios_image": "$loader",
+EOF
+    else
+	cat <<EOF
+"kernel_image": "$loader",
+EOF
+    fi
+}
+
+if [ "$ARCH" = "x86_64" ]; then
+    loader=OVMF.fd
+    accel=allow
+    opts=
+else
+    loader=Image
+    accel=disable
+    opts="-M virt -cpu cortex-a72"
+fi
+
+echo ">> Disk image MD5: $(md5sum "$BINARIES_DIR/$DISK" | awk '{print $1}')"
+
+cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
+{
+    "name": "$NM",
+    "category": "router",
+    "description": "$INFIX_DESC",
+    "vendor_name": "$VENDOR_NAME",
+    "vendor_url": "$VENDOR_HOME",
+    "product_name": "$NAME",
+    "registry_version": 6,
+    "status": "stable",
+    "maintainer": "$VENDOR_NAME",
+    "maintainer_email": "${SUPPORT_URL#mailto:}",
+    "usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
+    "port_name_format": "eth{0}",
+    "linked_clone": true,
+    "qemu": {
+        "adapter_type": "virtio-net-pci",
+        "adapters": ${IFNUM},
+        "ram": ${RAM},
+        "cpus": 1,
+        "hda_disk_interface": "virtio",
+        "arch": "$ARCH",
+        "console_type": "telnet",
+        $(loader_img)
+        $(loader_args)
+        "kvm": "$accel",
+	"options": "$opts"
+    },
+    "images": [
+        {
+            "filename": "$loader",
+            "filesize": $(stat --printf='%s' "$BINARIES_DIR/$loader"),
+            "md5sum": "$(md5sum "$BINARIES_DIR/$loader" | awk '{print $1}')",
+            "version": "0.0"
+        },
+        {
+            "filename": "$DISK",
+            "filesize": $(stat --printf='%s' "$BINARIES_DIR/$DISK"),
+            "md5sum": "$(md5sum "$BINARIES_DIR/$DISK" | awk '{print $1}')",
+            "version": "0.0"
+        }
+    ],
+    "versions": [
+        {
+            "name": "0.0",
+            "images": {
+                $(loader_img)
+                "hda_disk_image": "$DISK"
+            }
+        }
+    ]
+}
+EOF

board/common/mkmmc.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -e
+
+common=$(dirname $(readlink -f "$0"))
+root=$BUILD_DIR/genimage.root
+tmp=$BUILD_DIR/genimage.tmp
+
+
+mkdir -p $root/aux
+cp -f $BINARIES_DIR/uboot-env.bin $root/aux/uboot.env
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
+cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
+
+rm -rf $tmp
+
+genimage \
+    --rootpath $root \
+    --tmppath  $tmp \
+    --inputpath $BINARIES_DIR \
+    --outputpath $BINARIES_DIR \
+    --config $common/genimage.cfg

board/common/mkrauc-status.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+
+# Bootstrap a RAUC status file showing the newly created image
+# installed to both the primary and secondary slots. This then bundled
+# in the aux partition in mkdisk.sh, so that RAUC (on the target) can
+# always report the installed versions.
+rauc info --no-verify --output-format=shell $1 >/tmp/rauc-$$.info
+. /tmp/rauc-$$.info
+rm /tmp/rauc-$$.info
+tstamp=$(date -u +%FT%TZ)
+cat <<EOF
+[slot.rootfs.0]
+bundle.compatible=$RAUC_MF_COMPATIBLE
+bundle.version=$RAUC_MF_VERSION
+status=ok
+sha256=$RAUC_IMAGE_DIGEST_0
+size=$RAUC_IMAGE_SIZE_0
+installed.timestamp=$tstamp
+installed.count=1
+activated.timestamp=$tstamp
+activated.count=1
+
+[slot.rootfs.1]
+bundle.compatible=$RAUC_MF_COMPATIBLE
+bundle.version=$RAUC_MF_VERSION
+status=ok
+sha256=$RAUC_IMAGE_DIGEST_0
+size=$RAUC_IMAGE_SIZE_0
+installed.timestamp=$tstamp
+installed.count=1
+activated.timestamp=$tstamp
+activated.count=1
+EOF

board/common/mkrauc.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+set -e
+
+name=$1
+compat=$2
+sign=$3
+
+crt=$(ls $sign/*.crt)
+key=$(ls $sign/*.key)
+
+common=$(dirname "$(readlink -f "$0")")
+
+work=$BUILD_DIR/mkrauc
+mkdir -p "$work"
+
+cp -f "$common/rauc-hooks.sh" "$work/hooks.sh"
+
+# RAUC internally uses the file extension to find a suitable install
+# handler, hence the name must be .img
+cp -f "$BINARIES_DIR/rootfs.squashfs" "$work/rootfs.img"
+cp -f "$BINARIES_DIR/rootfs.itbh"     "$work/rootfs.itbh"
+
+cat >"$work/manifest.raucm" <<EOF
+[update]
+compatible=${compat}
+version=${INFIX_VERSION}
+
+[bundle]
+format=verity
+
+[hooks]
+filename=hooks.sh
+
+[image.rootfs]
+filename=rootfs.img
+hooks=post-install
+EOF
+
+rm -f "$BINARIES_DIR/$name.pkg"
+
+rauc --cert="$crt" --key="$key" \
+     bundle "$work" "$BINARIES_DIR/$name.pkg"

board/common/post-image.sh

@@ -0,0 +1,112 @@
+#!/bin/sh
+# shellcheck disable=SC2086
+
+common=$(dirname "$(readlink -f "$0")")
+. "$common/lib.sh"
+
+# shellcheck disable=SC1091
+. "$TARGET_DIR/etc/os-release"
+
+# The INFIX_* variables may be composed from BR2_* variables,
+# so we source them last.
+load_cfg BR2_ARCH
+load_cfg BR2_DEFCONFIG
+load_cfg BR2_EXTERNAL_INFIX_PATH
+load_cfg BR2_TARGET_ROOTFS
+load_cfg INFIX_ID
+load_cfg INFIX_COMPATIBLE
+
+# The default IMAGE_ID is infix-$BR2_ARCH but can be overridden
+# for imaage names, and compat strings, like infix-r2s
+if [ -n "$IMAGE_ID" ]; then
+    NAME="$IMAGE_ID"
+else
+    NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
+fi
+diskimg=disk.qcow2
+
+ver()
+{
+    if [ -n "$INFIX_RELEASE" ]; then
+	printf -- "-%s" "${INFIX_RELEASE#v}"
+	return
+    fi
+}
+
+load_cfg SIGN_ENABLED
+if [ "$SIGN_ENABLED" = "y" ]; then
+    load_cfg BR2_ARCH
+    load_cfg SIGN_KEY
+
+    ixmsg "Signing SquashFS Image"
+    $common/sign.sh $BR2_ARCH $SIGN_KEY
+
+    ixmsg "Creating RAUC Update Bundle"
+    $common/mkrauc.sh "$NAME$(ver)" $INFIX_COMPATIBLE $SIGN_KEY
+fi
+
+load_cfg DISK_IMAGE
+if [ "$DISK_IMAGE" = "y" ]; then
+    ixmsg "Creating Disk Image"
+    diskimg="${NAME}-disk$(ver).qcow2"
+    bootcfg=
+    if [ "$DISK_IMAGE_BOOT_DATA" ]; then
+	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
+    fi
+
+    if [ "$BR2_TARGET_ROOTFS_SQUASHFS" != "y" ] && \
+       [ ! -f "$BINARIES_DIR/rootfs.squashfs" ]; then
+	ixmsg "  Injecting $DISK_IMAGE_RELEASE_URL"
+	archive="$BINARIES_DIR/$(basename $DISK_IMAGE_RELEASE_URL)"
+	[ -f "$archive" ] || wget -O"$archive" "$DISK_IMAGE_RELEASE_URL"
+	tar -xa --strip-components=1 -C "$BINARIES_DIR" -f "$archive"
+    fi
+
+    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
+    $common/mkdisk.sh -a $BR2_ARCH -n $diskimg -s $DISK_IMAGE_SIZE $bootcfg
+fi
+
+load_cfg SDCARD_AUX
+if [ "$SDCARD_AUX" = "y" ]; then
+    ixmsg "Creating initial rauc.status"
+    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
+    ixmsg "Creating aux.ext4 for sdcard.img"
+    $common/mkaux.sh
+fi
+
+load_cfg GNS3_APPLIANCE
+if [ "$GNS3_APPLIANCE" = "y" ]; then
+    ixmsg "Creating GNS3 Appliance, $GNS3_APPLIANCE_RAM MiB with $GNS3_APPLIANCE_IFNUM ports"
+    $common/mkgns3a.sh $BR2_ARCH $NAME $diskimg $GNS3_APPLIANCE_RAM $GNS3_APPLIANCE_IFNUM
+fi
+
+load_cfg FIT_IMAGE
+if [ "$FIT_IMAGE" = "y" ]; then
+    ixmsg "Creating Traditional FIT Image"
+    $common/mkfit.sh
+fi
+
+# Only for regular builds, not bootloader-only builds
+if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
+    rel=$(ver)
+    ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
+    if [ -n "$rel" ]; then
+	ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
+    fi
+
+    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
+
+    # Menuconfig support for modifying Qemu args in release tarballs
+    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
+    sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
+	-e "s/@DISK_IMG@/$diskimg/"   \
+	< "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in.in" \
+	> "$BINARIES_DIR/Config.in"
+    rm -f "$BINARIES_DIR/qemu.cfg"
+    CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
+	   "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
+    rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
+
+    # Quick intro for beginners, with links to more information
+    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"
+fi

board/common/qemu/Config.in.in

@@ -78,7 +78,7 @@ endchoice
 config QEMU_MACHINE
 	string "Select emulated machine"
 	default "qemu-system-arm     -M virt,accel=kvm:tcg -cpu max" if QEMU_arm
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu cortex-a53" if QEMU_aarch64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
 	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
@@ -99,20 +99,20 @@ config QEMU_MACHINE_RAM
 config QEMU_KERNEL
 	string
 	depends on QEMU_LOADER_KERNEL
-	default "../zImage"  if QEMU_arm
-	default "../Image"   if QEMU_aarch64
-	default "../bzImage" if QEMU_x86_64
+	default "zImage"  if QEMU_arm
+	default "Image"   if QEMU_aarch64
+	default "bzImage" if QEMU_x86_64
 
 config QEMU_BIOS
 	string
 	depends on !QEMU_LOADER_KERNEL
-	default "../u-boot.bin" if QEMU_LOADER_UBOOT
-	default "../OVMF.fd"    if QEMU_LOADER_OVMF
+	default "u-boot.bin" if QEMU_LOADER_UBOOT
+	default "OVMF.fd"    if QEMU_LOADER_OVMF
 
 config QEMU_ROOTFS
 	string
 	default "@DISK_IMG@" if !QEMU_ROOTFS_INITRD
-	default "../rootfs.squashfs" if QEMU_ROOTFS_INITRD
+	default "rootfs.squashfs" if QEMU_ROOTFS_INITRD
 
 config QEMU_DTB_EXTEND
 	bool
@@ -231,7 +231,7 @@ config QEMU_NET_MODEL
 	  if you want to play with low-level stuff like ethtool, you
 	  might want to test the Intel 82545EM driver, e1000.
 
-	  Note: ARM 32-bit uses virtio-net-device (MMIO) by default.
+	  Note: ARM32 uses virtio-net-device (MMIO) by default.
 
 config QEMU_NET_BRIDGE_DEV
 	string "Bridge device"

board/common/qemu/qemu.mk

@@ -1,45 +0,0 @@
-################################################################################
-#
-# qemu-scripts
-#
-################################################################################
-
-QEMU_SCRIPTS_DIR := $(pkgdir)
-qemu-kconfig = \
-	CONFIG_="CONFIG_" \
-	BR2_CONFIG="$(BINARIES_DIR)/qemu/.config" \
-	$(BUILD_DIR)/buildroot-config/$(1) $(2) "$(BINARIES_DIR)/qemu/Config.in"
-
-ifeq ($(QEMU_SCRIPTS),y)
-
-.PHONY: run
-run:
-	@$(BINARIES_DIR)/qemu/run.sh
-
-.PHONY: run-menuconfig
-run-menuconfig: $(BUILD_DIR)/buildroot-config/mconf
-	@$(call qemu-kconfig,mconf)
-
-qemu-scripts: \
-		$(BINARIES_DIR)/qemu/run.sh \
-		$(BINARIES_DIR)/qemu/Config.in \
-		$(BINARIES_DIR)/qemu/.config
-
-$(BINARIES_DIR)/qemu/run.sh: $(QEMU_SCRIPTS_DIR)/run.sh
-	@$(call IXMSG,"Installing QEMU scripts")
-	@mkdir -p $(dir $@)
-	@cp $< $@
-
-$(BINARIES_DIR)/qemu/Config.in: $(QEMU_SCRIPTS_DIR)/Config.in.in
-	@mkdir -p $(dir $@)
-	@sed \
-		-e "s:@ARCH@:QEMU_$(BR2_ARCH):" \
-		-e "s:@DISK_IMG@:../$(INFIX_ARTIFACT).qcow2:" \
-	< $< >$@
-
-$(BINARIES_DIR)/qemu/.config: $(BINARIES_DIR)/qemu/Config.in
-	@$(call qemu-kconfig,conf,--olddefconfig)
-	@rm -f $@.old
-
-TARGETS_ROOTFS += qemu-scripts
-endif

board/common/qemu/qemu.sh

@@ -10,20 +10,17 @@
 #
 # and then call this script with:
 #
-#    ./run.sh -c
+#    ./qemu.sh -c
 #
 # To bring up a menuconfig dialog.  Select `Exit` and save the changes.
 # For more help, see:_
 #
-#    ./run.sh -h
+#    ./qemu.sh -h
 #
 # shellcheck disable=SC3037
 
-# Add /sbin to PATH for mkfs.ext4 and such (not default in debian)
-export PATH="/sbin:/usr/sbin:$PATH"
-
-qdir=$(dirname "$(readlink -f "$0")")
-imgdir=$(readlink -f "${qdir}/..")
+# Local variables
+imgdir=$(readlink -f "$(dirname "$0")")
 prognm=$(basename "$0")
 
 usage()
@@ -43,7 +40,7 @@ usage()
     echo "         Also, qemu.cfg has QEMU_APPEND which can affect this."
     echo
     echo "Example:"
-    echo "  $prognm -- finit.debug"
+    echo "  qemu.sh -- finit.debug"
     echo "___________________________________________________________________"
     echo "Note: 'kconfig-frontends' package (Debian/Ubuntu) must be installed"
     echo "      for -c to work: sudo apt install kconfig-frontents"
@@ -59,8 +56,12 @@ die()
 
 load_qemucfg()
 {
+    tmp=$(mktemp -p /tmp)
+
+    grep ^CONFIG_QEMU_ "$1" >"$tmp"
     # shellcheck disable=SC1090
-    .  "./.config"
+    .  "$tmp"
+    rm "$tmp"
 
     [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
     [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
@@ -83,7 +84,7 @@ loader_args()
 
 append_args()
 {
-    # ARM 32-bit doesn't support virtio console properly, always use serial
+    # ARM32 doesn't support virtio console properly, always use serial
     if [ "$CONFIG_QEMU_arm" ]; then
 	echo -n "console=ttyAMA0 "
     elif [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
@@ -122,7 +123,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
     elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	# ARM 32-bit virt machine uses MMIO virtio devices, not PCI
+	# ARM32 virt machine uses MMIO virtio devices, not PCI
 	if [ "$CONFIG_QEMU_arm" ]; then
 	    echo -n "-drive file=qemu.qcow2,if=none,format=qcow2,id=rootfs "
 	    echo -n "-device virtio-blk-device,drive=rootfs "
@@ -177,8 +178,6 @@ rw_args()
 {
     [ "$CONFIG_QEMU_RW" ] ||  return
 
-    command -v mkfs.ext4 >/dev/null || die "$prognm: cannot find mkfs.ext4"
-
     if ! [ -f "aux.ext4" ]; then
 	dd if=/dev/zero of="aux.ext4" bs=1M count=1 >/dev/null 2>&1
 	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
@@ -189,7 +188,7 @@ rw_args()
 	mkfs.ext4 -L cfg "$CONFIG_QEMU_RW" >/dev/null 2>&1
     fi
 
-    # ARM 32-bit virt machine uses MMIO virtio devices, not PCI
+    # ARM32 virt machine uses MMIO virtio devices, not PCI
     if [ "$CONFIG_QEMU_arm" ]; then
 	echo -n "-drive file=aux.ext4,if=none,format=raw,id=aux "
 	echo -n "-device virtio-blk-device,drive=aux "
@@ -248,7 +247,7 @@ rocker_port_args()
 net_args()
 {
     # Infix will pick up this file via fwcfg and install it to /etc
-    mactab=${qdir}/mactab
+    mactab=${imgdir}/mactab
     :> "$mactab"
     echo -n "-fw_cfg name=opt/mactab,file=$mactab "
 
@@ -287,7 +286,7 @@ vpd_args()
 {
     [ "$CONFIG_QEMU_VPD" = "y" ] || return
 
-    vpd_file="${qdir}/vpd"
+    vpd_file="${imgdir}/vpd"
 
     if ! [ -f "$vpd_file" ]; then
 	onieprom="${imgdir}/onieprom"
@@ -358,12 +357,13 @@ extract_squashfs()
 run_qemu()
 {
     # Auto-extract rootfs.squashfs from rootfs.itb if needed for initrd mode
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ] && [ ! -f "$CONFIG_QEMU_ROOTFS" ]; then
-	itb="${CONFIG_QEMU_ROOTFS%.squashfs}.itb"
-	if [ -f "$itb" ]; then
-	    extract_squashfs "$itb" "$CONFIG_QEMU_ROOTFS"
-	else
-	    die "Missing $CONFIG_QEMU_ROOTFS and cannot find $itb to extract it from"
+    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
+	if [ "$CONFIG_QEMU_ROOTFS" = "rootfs.squashfs" ] && [ ! -f "rootfs.squashfs" ]; then
+	    if [ -f "rootfs.itb" ]; then
+		extract_squashfs "rootfs.itb" "rootfs.squashfs"
+	    else
+		die "Missing rootfs.squashfs and cannot find rootfs.itb to extract it from"
+	    fi
 	fi
     fi
 
@@ -430,7 +430,7 @@ dtb_args()
 
 	# Extend it with the environment and signing information in
 	# u-boot.dtb.
-	echo "qemu.dtb ../u-boot.dtb" | \
+	echo "qemu.dtb u-boot.dtb" | \
 	    xargs -n 1 dtc -I dtb -O dts | \
 	    { echo "/dts-v1/;"; sed  -e 's:/dts-v[0-9]\+/;::'; } | \
 	    dtc >qemu-extended.dtb 2>/dev/null
@@ -439,7 +439,7 @@ dtb_args()
 	echo -n "-dtb qemu-extended.dtb "
     else
 	# Otherwise we just use the unmodified one
-	echo -n "-dtb ../u-boot.dtb "
+	echo -n "-dtb u-boot.dtb "
     fi
 }
 
@@ -485,12 +485,13 @@ EOF
 
 menuconfig()
 {
-    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the $$O/images/qemu directory"
+    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the output/images directory"
     command -v kconfig-mconf >/dev/null || die "$prognm: cannot find kconfig-mconf for menuconfig"
     exec kconfig-mconf Config.in
 }
 
-cd "$qdir" || (echo "Failed cd to $qdir"; exit 1)
+scriptdir=$(dirname "$(readlink -f "$0")")
+cd "$scriptdir" || (echo "Failed cd to $scriptdir"; exit 1)
 
 while [ "$1" != "" ]; do
     case $1 in
@@ -509,7 +510,13 @@ while [ "$1" != "" ]; do
     shift
 done
 
-load_qemucfg
+if [ -f .config ]; then
+    # Customized settings from 'qemu.sh -c'
+    load_qemucfg .config
+else
+    # Shipped defaults from release tarball
+    load_qemucfg qemu.cfg
+fi
 
 if [ -z "$QEMU_EXTRA_APPEND" ]; then
     QEMU_EXTRA_APPEND="$*"

board/common/rootfs.its

@@ -0,0 +1,28 @@
+/dts-v1/;
+
+/ {
+	description = "Infix";
+	creator = "infix";
+	#address-cells = <0x1>;
+
+	images {
+		rootfs {
+			description = "Infix";
+			type = "ramdisk";
+			os = "linux";
+			compression = "none";
+			data = /incbin/("rootfs.squashfs");
+			signature-1 {
+				algo = "sha256,rsa4096";
+				key-name-hint = "infix";
+			};
+		};
+	};
+
+	configurations {
+		default = "verity";
+		verity {
+			ramdisk = "rootfs";
+		};
+	};
+};

board/common/rootfs/etc/bash.bashrc

@@ -40,12 +40,11 @@ log()
     less +G -r "$fn"
 }
 
-follow ()
+follow()
 {
     local fn="/var/log/syslog"
     [ -n "$1" ] && fn="/var/log/$1"
-
-    tail -F -n +1 "$fn"
+    less +F -r "$fn"
 }
 
 _logfile_completions()

board/common/rootfs/etc/default/zebra

@@ -1,2 +1,2 @@
 # --log-level debug
-ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog --log-level err"
+ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog "

board/common/rootfs/etc/finit.d/available/container@.conf

@@ -5,5 +5,4 @@
 # 'podman load', must not have a timeout.
 sysv    log:prio:local1,tag:%i kill:30 pid:!/run/container:%i.pid \
 	pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container   \
-	cgroup.system,delegate					  \
 	[2345] <!> :%i container -n %i -- container %i

board/common/rootfs/etc/finit.d/available/hostapd@.conf

@@ -1,3 +0,0 @@
-service <!> name:hostapd :%i \
-	[2345] hostapd -P/var/run/hostapd-%i.pid  /etc/hostapd-%i.conf \
-	-- Wi-Fi Access Point @%i

board/common/rootfs/etc/finit.d/available/restconf.conf

@@ -1,3 +1,3 @@
-service name:rousette notify:none log:null <pid/confd> env:/etc/default/confd \
+service name:rousette notify:none log <pid/confd> env:/etc/default/confd \
 	[12345] rousette --syslog -t $CONFD_TIMEOUT \
 	-- RESTCONF server