Update ChangeLog for v23.06.0 release

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
.github: Introducing the Infix Release General
2026-07-27 11:13:02 +02:00 · 2023-06-23 14:22:13 +02:00 · 2023-06-22 23:16:33 +02:00 · 2023-06-22 23:12:10 +02:00 · 2023-06-22 19:16:41 +02:00 · 2023-06-22 13:55:16 +02:00
297 changed files with 17891 additions and 9725 deletions
@@ -1,63 +1,78 @@
 name: Bob the Builder

-#on:
-#  push:
-#    branches:
-#      - '*'
-#  pull_request:
-#    branches:
-#      - '*'
 on:
  pull_request:
+    branches:
+      - main
+    types:
+      - closed
  workflow_dispatch:

 jobs:
  build:
-    name: Build ${{ matrix.platform }}
+    if: ${{github.ref == 'refs/heads/main' && github.event_name == 'push'}} || github.event_name == 'workflow_dispatch'
+    name: Build ${{ matrix.platform }} ${{ matrix.variant }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        platform: [aarch64, amd64]
+        platform: [aarch64, x86_64]
+        variant: [netconf, classic]
      fail-fast: false
    steps:
      - uses: actions/checkout@v3
      - name: Set Build Variables
        id: vars
        run: |
-          echo "dir=infix-${{ matrix.platform }}"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-${{ matrix.platform }}.tar.gz" >> $GITHUB_OUTPUT
+          if [ "${{ matrix.variant }}" = "netconf" ]; then
+              target=${{ matrix.platform }}
+          else
+              target=${{ matrix.platform }}-${{ matrix.variant }}
+          fi
+          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
      - name: Restore Cache of dl/
        uses: actions/cache@v3
        with:
          path: dl/
-          key: dl-${{ matrix.platform }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          key: dl-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
+            dl-${{ matrix.platform }}-${{ matrix.variant }}-
            dl-${{ matrix.platform }}-
            dl-
      - name: Restore Cache of .ccache/
        uses: actions/cache@v3
        with:
-          path: .buildroot-ccache/
-          key: ccache-${{ matrix.board }}-os-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          path: .ccache/
+          key: ccache-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
          restore-keys: |
-            ccache-${{ matrix.board }}-os-
-            ccache-${{ matrix.board }}-
-            ccache--os-
+            ccache-${{ matrix.platform }}-${{ matrix.variant }}-
+            ccache-${{ matrix.platform }}-
+            ccache-
      - name: Configure & Build
        run: |
-          make ${{ matrix.platform }}_defconfig
+          if [ "${{ matrix.variant }}" = "netconf" ]; then
+              target=${{ matrix.platform }}_defconfig
+          else
+              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
+          fi
+          echo "Buildring $target ..."
+          make $target
          make
      - name: Prepare Artifact
        run: |
          cd output
          mv images ${{ steps.vars.outputs.dir }}
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
-          ls -l
-          ls -l ${{ steps.vars.outputs.dir }}
+          ln -s ${{ steps.vars.outputs.dir }} images
+          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+      - name: Test
+        if: matrix.platform == 'x86_64' && matrix.variant == 'netconf'
+        run: |
+          make test-qeneth
      - uses: actions/upload-artifact@v3
        with:
          path: output/${{ steps.vars.outputs.tgz }}
  release:
+    if: github.repository == 'kernelkit/infix' && github.ref == 'refs/heads/main'
    name: Upload Latest Build
    needs: build
    runs-on: ubuntu-latest
@@ -0,0 +1,64 @@
+name: Reggie Regression
+
+on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches:
+      - '*'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Regression Testing
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set Build Variables
+        id: vars
+        run: |
+          target=x86_64-minimal
+          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+      - name: Restore Cache of dl/
+        uses: actions/cache@v3
+        with:
+          path: dl/
+          key: dl-x86_64-netconf-${{ hashFiles('.git/modules/buildroot/refs/heads/master', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-x86_64-netconf-
+            dl-x86_64-
+            dl-
+      - name: Restore Cache of .ccache/
+        uses: actions/cache@v3
+        with:
+          path: .ccache/
+          key: ccache-x86_64-netconf-${{ hashFiles('.git/modules/buildroot/refs/head/master', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-x86_64-netconf-
+            ccache-x86_64-
+            ccache-
+      - name: Configure Minimal NETCONF
+        run: |
+          make x86_64_minimal_defconfig
+      - name: Build
+        run: |
+          make
+      - name: Prepare Artifact
+        run: |
+          cd output
+          mv images ${{ steps.vars.outputs.dir }}
+          ln -s ${{ steps.vars.outputs.dir }} images
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v3
+        with:
+          path: output/${{ steps.vars.outputs.tgz }}
+      - name: Regression Test
+        run: |
+          make test-qeneth
@@ -0,0 +1,100 @@
+name: Release General
+
+on:
+  push:
+    tags:
+      - 'v[0-9]*.*'
+
+jobs:
+  build:
+    if: github.repository == 'kernelkit/infix' && startsWith(github.ref, 'refs/tags/')
+    name: Build Infix ${{ github.ref_name }} [${{ matrix.platform }}-${{ matrix.variant }}]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        platform: [aarch64, x86_64]
+        variant: [netconf, classic]
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set Release Variables
+        id: build
+        run: |
+          ver=${GITHUB_REF#refs/tags/v}
+          echo "ver=${ver}" >> $GITHUB_OUTPUT
+          if echo $ver | grep -qE '[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
+            echo "pre=true"  >> $GITHUB_OUTPUT
+          else
+            echo "pre=false" >> $GITHUB_OUTPUT
+          fi
+          if [ "${{ matrix.variant }}" = "netconf" ]; then
+              target=${{ matrix.platform }}-${ver}
+          else
+              target=${{ matrix.platform }}-${{ matrix.variant }}-${ver}
+          fi
+          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+      - name: Restore Cache of dl/
+        uses: actions/cache@v3
+        with:
+          path: dl/
+          key: dl-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-${{ matrix.platform }}-${{ matrix.variant }}-
+            dl-${{ matrix.platform }}-
+            dl-
+      - name: Restore Cache of .ccache/
+        uses: actions/cache@v3
+        with:
+          path: .ccache/
+          key: ccache-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-${{ matrix.platform }}-${{ matrix.variant }}-
+            ccache-${{ matrix.platform }}-
+            ccache-
+      - name: Configure & Build
+        env:
+          INFIX_RELEASE: ${{ steps.build.outputs.ver }}
+        run: |
+          if [ "${{ matrix.variant }}" = "netconf" ]; then
+              target=${{ matrix.platform }}_defconfig
+          else
+              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
+          fi
+          echo "Buildring $target ..."
+          make $target
+          make
+      - name: Prepare Artifact
+        run: |
+          cd output
+          mv images ${{ steps.build.outputs.dir }}
+          ln -s ${{ steps.build.outputs.dir }} images
+          tar chfz ${{ steps.build.outputs.tgz }} ${{ steps.build.outputs.dir }}
+      - uses: actions/upload-artifact@v3
+        with:
+          path: output/${{ steps.build.outputs.tgz }}
+  release:
+    name: Release Infix ${{ github.ref_name }}
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v3
+      - name: Extract ChangeLog entry ...
+        run: |
+          awk '/-----*/{if (x == 1) exit; x=1;next}x' ChangeLog.md \
+              |head -n -1 > release.md
+          cat release.md
+      - uses: ncipollo/release-action@v1
+        with:
+          name: Infix ${{ github.ref_name }}
+          prerelease: ${{ needs.build.outputs.pre }}
+          bodyFile:  release.md
+          artifacts: artifact/*
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Infix ${{ github.ref_name }} Released! :rocket:
+          
+          For the public download links of this release, please see:
+           <https://github.com/kernelkit/infix/releases/tag/${{ github.ref_name }}>
+          EOF
@@ -3,4 +3,5 @@
 /.ccache
 /dl
 /output*
+/test/.venv
 /local.mk
@@ -1,3 +1,9 @@
 [submodule "buildroot"]
 	path = buildroot
 	url = ../buildroot.git
+[submodule "9pm"]
+	path = 9pm
+	url = ../9pm
+[submodule "qeneth"]
+	path = qeneth
+	url = ../qeneth.git
@@ -0,0 +1,58 @@
+Change Log
+==========
+
+All notable changes to the project are documented in this file.
+
+
+[v23.06.0][] - 2023-06-23
+-------------------------
+
+Midsummer release.  The first official Infix release, based on [Buildroot
+2023.02.2][br2023.02.2], with NETCONF support using the [sysrepo][] and
+[netopeer2][].
+
+Supported YANG models in addition to those used by sysrepo and netopeer:
+
+ - [ietf-system][]
+   - Everything except radius authentication and timezone-utc-offset
+   - Augmented with MotD (Message of the Day), Infix YANG model
+ - [ietf-interfaces][]
+   - [ietf-ip][] augmented with IPv4LL similar to standardized IPv6LL
+   - [ietf-if-vlan-encapsulation][], Linux VLAN interfaces, e.g. `eth0.10`
+   - Linux bridge interfaces with native VLAN support, Infix YANG model
+   - Linux VETH pairs, Infix YANG model
+
+> **DISCLAIMER:** the [Infix YANG models for Linux][yang23.06], are
+> still under heavy development.  New revisions are expected which may
+> not be backwards compatible.  When upgrading to a new release, test on
+> a GNS3 staging environment first, or start over from a factory reset.
+
+[br2023.02.2]:     https://git.busybox.net/buildroot/tag/?h=2023.02.2
+[ietf-system]:     https://www.rfc-editor.org/rfc/rfc7317.html
+[ietf-interfaces]: https://www.rfc-editor.org/rfc/rfc7223.html
+[ietf-ip]:         https://www.rfc-editor.org/rfc/rfc8344.html
+[ietf-if-vlan-encapsulation]: https://www.ietf.org/id/draft-ietf-netmod-sub-intf-vlan-model-08.html
+[yang23.06]:       https://github.com/kernelkit/infix/blob/aea74842e0475441d8df834f2dcd8cbc21fa253d/src/confd/yang/infix-interfaces%402023-06-05.yang
+
+### Changes
+
+ - Bump sysrepo to v2.2.73
+   - Backport support for initializing factory-default data store with
+     default config data also for sysrepo internal modules.
+   - Add support for `sysrepocfg -Cfactory -d running`, for testing
+ - Bump netopeer2 to v2.1.62
+ - Bump libyang to v2.1.80
+ - Add klish, a CLI for sysrepo
+ - Add podman for container support, backported from upstream Buildroot
+ - Add conmon for container support, backported from upstream Buildroot
+ - Backport cni-plugins support for host-local and static plugins
+
+### Fixes
+
+ - N/A
+
+[buildroot]:  https://buildroot.org/
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v23.06.0...HEAD
+[v23.06.0]:   https://github.com/kernelkit/infix/compare/BASE...v23.06.0
+[sysrepo]:    https://www.sysrepo.org/
+[netopeer2]:  https://github.com/CESNET/netopeer2
@@ -1,13 +1,35 @@
+# For /etc/os-release, uses CondtionArchitechture= from systemd.unit(5)
+config INFIX_ARCH
+	string
+	default "arm"     if BR2_arm
+	default "arm64"   if BR2_aarch64
+	default "mips64"  if BR2_mips64
+	default "riscv64" if BR2_riscv
+	default "x86_64"  if BR2_x86_64
+
+# For /etc/os-release, VARIANT & VARIANT_ID used, e.g., in mnt script
+choice
+	prompt "Select variant/flavor"
+	default INFIX_VARIANT_NETCONF
+
+config INFIX_VARIANT_NETCONF
+	bool "NETCONF"
+	help
+	  Managed NETCONF mode, /etc is a ramdisk, all configuration is
+	  generated by sysrepo plugins using NETCONF (xml) or RESTCONF.
+
+config INFIX_VARIANT_CLASSIC
+	bool "Classic /etc mode"
+	help
+	  User managed mode, read-write configuration files in /etc that
+	  is saved across reboots.
+
+endchoice
+
 menu "Packages"

 source "$BR2_EXTERNAL_INFIX_PATH/package/Config.in"

 endmenu

-menu "QEMU Virtualization"
-
-source "$BR2_EXTERNAL_INFIX_PATH/qemu/Config.in"
-
-endmenu
-
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/Config.in"
@@ -1,6 +1,10 @@
 <img align="right" src="doc/text3134.png" alt="Infix Linux Networking Made Easy">

 * [Introduction](#introduction)
+* [NETCONF Mode](#netconf-mode)
+  * [NETCONF Mode](#netconf-mode)
+  * [Classic Mode](#classic-mode)
+  * [Hybrid Mode](#hybrid-mode)
 * [Hardware](#hardware)
 * [Qemu](#qemu)
 * [GNS3](#gns3)
@@ -12,16 +16,93 @@ Introduction
 ------------

 Infix is an embedded Linux Network Operating System (NOS) based on
-[Buildroot][1], [Finit][2], [ifupdown-ng][3], and [Clixon][6].
+[Buildroot][1], [Finit][2], [ifupdown-ng][3], and [sysrepo][6].
 Providing an easy-to-maintain and easy-to-port Open Source base for
 networked equipment.

-See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
-page for out pre-built images.  The *Latest Build* has the bleeding edge
-images, if possible we recommend using a versioned release.
+> See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
+> page for out pre-built images.  The *Latest Build* has the bleeding edge
+> images, if possible we recommend using a versioned release.
+>
+> For customer specific builds of Infix, see your respective repository.

-> Login with user 'root', no password by default on plain builds.  See
-> the online `help` command for an introduction to the system.
+Infix has two main *flavors*, or defconfigs:
+
+ - **NETCONF:** the default, managed using, e.g., the `cli` tool
+ - **Classic:** built from `$ARCH_classic_defconfig`, more below
+
+Both flavors have an `admin` user, which is allowed to log in from
+remote, password `admin` on standard builds.  It is the recommended
+account to use for managing Infix.  (The `root` account is currently
+also available, but will soon become a non-login account used only for
+running system services.)
+
+
+### NETCONF Mode
+
+NETCONF is the primary reason Infix exists.  Configuration of an Infix
+device can be done either remotely, using tools like [netconf-client][]
+or [netopeer2-cli][], or locally using the [`cli` tool](doc/cli.md).
+
+Infix use [sysrepo][6] as the data store for NETCONF.  A set of plugins
+configure the network, using iproute2, generate configuration files in
+`/etc`, and control the system daemons, e.g., enable DHCP client on an
+interface.
+
+
+### Classic Mode
+
+Here it is up to the administrator to modify configuration files in
+`/etc` and control the system daemons using the `initctl` tool.
+
+See the online `help` command for an introduction to the system.
+
+
+### Hybrid Mode
+
+Since Infix is under heavy development, it does not yet have all bells
+and whistles in place, in particular in the default build.  To that end
+it is possible to manually manage certain services that are not yet
+possible to configure using NETCONF.
+
+At bootstrap Finit can start user scripts from a [run-parts(8)][] like
+directory: `/cfg/start.d`.  For example, the following starts OSPF:
+
+```sh
+root@infix:~$ mkdir /cfg/start.d
+root@infix:~$ cd /cfg/start.d
+root@infix:/cfg/start.d$ cat <<EOF >10-enable-ospf.sh
+#!/bin/sh
+# Use vtysh to modify the OSPF configuration
+rm /etc/frr/frr.conf
+ln -s /cfg/frr/frr.conf /etc/frr/
+initctl enable zebra
+initctl enable ospfd
+initctl enable bfdd
+exit 0
+EOF
+root@infix:/cfg/start.d$ chmod +x 10-enable-ospf.sh
+```
+
+> **Note:** Neither [Frr](https://frrouting.org) (Zebra/OSPF/BFD) or
+> [podman](https://podman.io) are enabled in default Infix builds.
+> Please use customer specific builds, or enable it yourself in Infix by
+> using `make menuconfig` followed by rebuilding the image.
+
+This is also the way to start containers (provided the images have been
+downloaded with `podman pull` first):
+
+```
+root@infix:/cfg/start.d$ cat <<EOF >20-enable-container.sh
+#!/bin/sh
+podman-service -e -d "Nginx container" -p "-p 80:80" nginx:alpine
+exit 0
+EOF
+root@infix:/cfg/start.d$ chmod +x 20-enable-container.sh
+```
+
+Reboot to activate the changes.  To activate the changes without
+rebooting, run the script and call `initctl reload`.


 Hardware
@@ -39,7 +120,7 @@ may enable additional boards in the config, of course):
 See the aarch64 specific [documentation](board/aarch64/README.md) for more
 information.

-### amd64
+### x86_64

 Primarily intended to be run under [QEMU][] for development & test as
 well as evaluation, demo and [training][] purposes, e.g. using [GNS3][]
@@ -59,10 +140,12 @@ under `External options -> QEMU virtualization`.
 GNS3
 ----

-Download the [latest build][0] of amd64, unpack in a dedicated directory
-and use ["Import Appliance"][9] to install the `.gns3a` file into GNS3.
-Infix will show up in the "Router" category, it has 10 interfaces
-available by default for use as switch ports or routing.
+Download the [latest build][0] of the `x86_64`, or `x86_64_classic`
+flavor.  Unpack in a dedicated directory and use ["Import Appliance"][9]
+to install the `.gns3a` file into GNS3.  Infix (`x86_64`) is in the
+"Router" category, it has 10 interfaces available by default for use as
+switch ports or routing.  The *classic* build only has one interface by
+default, geared more towards acting as an end device.


 Building
@@ -70,9 +153,10 @@ Building

 Buildroot is almost stand-alone, but need a few locally installed tools
 to bootstrap itself.  For details, see the [excellent manual][manual].
+
 Briefly, to build an Infix image; select the target and then make:

-    make amd64_defconfig
+    make x86_64_defconfig
    make

 Online help is available:
@@ -120,10 +204,14 @@ any GPL[^1] licensed library.
 [3]: https://github.com/ifupdown-ng/ifupdown-ng
 [4]: https://en.wikipedia.org/wiki/GNU_Lesser_General_Public_License
 [5]: https://lwn.net/Articles/117972/
-[6]: https://github.com/clicon/clixon
+[6]: https://www.sysrepo.org/
 [7]: https://github.com/wkz/qeneth
+[8]: https://addiva-elektronik.github.io/2023/05/12/using-netconf-client-and-server-to-update-switch-configuration/
 [9]: https://docs.gns3.com/docs/using-gns3/beginners/import-gns3-appliance/
 [QEMU]: https://www.qemu.org/
 [GNS3]: https://gns3.com/
 [training]: https://addiva-elektronik.github.io/
 [manual]: https://buildroot.org/downloads/manual/manual.html
+[run-parts(8)]: https://manpages.ubuntu.com/manpages/trusty/man8/run-parts.8.html
+[netconf-client]: https://pypi.org/project/netconf-client/
+[netopeer2-cli]: https://github.com/CESNET/netopeer2
@@ -26,6 +26,7 @@ CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
@@ -67,28 +68,32 @@ CONFIG_CMA=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=y
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
 CONFIG_IP_MULTIPLE_TABLES=y
 CONFIG_IP_ROUTE_MULTIPATH=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-CONFIG_NET_IPIP=y
-CONFIG_NET_IPGRE_DEMUX=y
-CONFIG_NET_IPGRE=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
 CONFIG_NET_IPGRE_BROADCAST=y
 CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_NET_IPVTI=y
+CONFIG_SYN_COOKIES=y
+CONFIG_NET_IPVTI=m
+CONFIG_NET_FOU_IP_TUNNELS=y
+CONFIG_IPV6_SIT=m
+CONFIG_IPV6_GRE=m
 CONFIG_IPV6_MULTIPLE_TABLES=y
 CONFIG_IPV6_SUBTREES=y
 CONFIG_IPV6_MROUTE=y
 CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETWORK_PHY_TIMESTAMPING=y
 CONFIG_NETFILTER=y
 CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
@@ -98,17 +103,80 @@ CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NF_CONNTRACK_FTP=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_CT=m
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_OBJREF=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_XFRM=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_REJECT_NETDEV=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CGROUP=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
 CONFIG_IP_NF_MANGLE=m
-CONFIG_NF_LOG_IPV6=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
+CONFIG_NFT_BRIDGE_META=m
+CONFIG_NF_CONNTRACK_BRIDGE=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BPFILTER=y
 CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_BRIDGE_MRP=y
@@ -117,9 +185,22 @@ CONFIG_NET_DSA=y
 CONFIG_VLAN_8021Q=y
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
-CONFIG_NET_L3_MASTER_DEV=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBQ=y
+CONFIG_NET_CLS_BASIC=y
+CONFIG_NET_CLS_TCINDEX=y
+CONFIG_NET_CLS_BPF=y
+CONFIG_NET_CLS_FLOWER=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_MPLS=y
+CONFIG_NET_MPLS_GSO=y
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
+CONFIG_NET_PKTGEN=y
+# CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
+CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
@@ -141,7 +222,6 @@ CONFIG_MTD_SPI_NOR=y
 CONFIG_OF_OVERLAY=y
 CONFIG_BLK_DEV_NULL_BLK=y
 CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_NBD=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_NVME=y
@@ -164,21 +244,21 @@ CONFIG_DM_INIT=y
 CONFIG_DM_VERITY=y
 CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
-CONFIG_BONDING=y
-CONFIG_DUMMY=y
-CONFIG_NET_TEAM=y
-CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=y
-CONFIG_NET_TEAM_MODE_LOADBALANCE=y
-CONFIG_MACVLAN=y
-CONFIG_MACVTAP=y
-CONFIG_IPVLAN=y
-CONFIG_IPVTAP=y
-CONFIG_VXLAN=y
-CONFIG_GENEVE=y
-CONFIG_BAREUDP=y
-CONFIG_MACSEC=y
-CONFIG_TUN=y
-CONFIG_VETH=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_NET_TEAM=m
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
+CONFIG_NET_TEAM_MODE_LOADBALANCE=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
+CONFIG_VXLAN=m
+CONFIG_GENEVE=m
+CONFIG_BAREUDP=m
+CONFIG_MACSEC=m
+CONFIG_TUN=m
+CONFIG_VETH=m
 CONFIG_VIRTIO_NET=y
 CONFIG_NLMON=y
 CONFIG_NET_VRF=y
@@ -312,6 +392,7 @@ CONFIG_SENSORS_SPARX5=y
 CONFIG_SENSORS_JC42=y
 CONFIG_SENSORS_LM90=m
 CONFIG_SENSORS_INA2XX=m
+CONFIG_CPU_THERMAL=y
 CONFIG_THERMAL_EMULATION=y
 CONFIG_ARMADA_THERMAL=y
 CONFIG_WATCHDOG=y
@@ -422,6 +503,9 @@ CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS=y
+CONFIG_BTRFS_FS=y
+CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FANOTIFY=y
 CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA=y
@@ -1,29 +0,0 @@
-set timeout="1"
-
-set default="primary"
-set log="loglevel=4"
-
-load_env ORDER DEBUG
-
-for slot in $ORDER; do
-    set default="$slot"
-    break
-done
-
-if [ "$DEBUG" ]; then
-    set log="debug"
-fi
-
-submenu "primary" "$log" {
-	set slot="$1"
-	set append="$2"
-	set root=(hd0,gpt3)
-	source /boot/grub/grub.cfg
-}
-
-submenu "secondary" "$log"  {
-	set slot="$1"
-	set append="$2"
-	set root=(hd0,gpt4)
-	source /boot/grub/grub.cfg
-}
@@ -1,3 +0,0 @@
-menuentry "Infix" --id infix {
-	linux /boot/bzImage root=PARTLABEL=$slot rauc.slot=$slot console=ttyS0 $append nokaslr
-}
@@ -0,0 +1,8 @@
+#!/bin/sh
+. "$BR2_CONFIG"
+
+# Prevent regen of host key at every boot, /etc is saved across reboots
+if [ -L "$TARGET_DIR/etc/dropbear" ]; then
+	rm    "$TARGET_DIR/etc/dropbear"
+	mkdir "$TARGET_DIR/etc/dropbear"
+fi
@@ -0,0 +1,3 @@
+#!/bin/sh
+pdmenu
+clear
@@ -215,10 +215,10 @@ system()
 {
 	h1 "SYSTEM INFORMATION"
 	echo "System Name        : $(uname -n)"
-	echo "System Boot Mode   : $(cat /tmp/.boot_mode)"
+	echo "System Variant     : $VARIANT"
 	echo "System Description : $PRETTY_NAME"
 	echo "System Contact     : $HOME_URL"
-	echo "System Timezone    : $TZ"
+	echo "System Timezone    : $(cat /etc/timezone)"
 	echo "System Type        : $NAME"
 	echo "System Version     : $(cat /etc/version)"
 	echo "System Arch        : $(uname -m)"
@@ -0,0 +1 @@
+run [S] /lib/infix/swup --
@@ -60,8 +60,7 @@ menu:system:System:System Settings
 	exec:_Enable service:edit:initctl enable ~Enter name of service (filename) to enable:~
 	exec:_Disable service:edit:initctl disable ~Enter name of service (filename) to disable:~
 	nop
-	exec:_Change Operating Mode::chom
-	exec:_Factory Reset::yorn "Reboot and factory reset device, are you sure?" factory -y
+	exec:_Factory Reset::yorn "Factory reset device (reboots), are you sure?" factory -y
 	nop
 	exit:_Main menu..

@@ -0,0 +1,62 @@
+#!/bin/sh
+# Factory default:
+#  1) all switch ports in VLAN 1 of br0
+#  2) no switch ports => DHCP on eth0
+#  3) no eth0
+
+create_bridge()
+{
+    nm=$1
+    shift
+    ports=$@
+
+    touch "/etc/network/interfaces.d/$nm"
+    for port in $ports; do
+	cat <<-EOF >>"/etc/network/interfaces.d/$nm"
+		iface $port
+		    bridge-access 1
+		    post-up ip link set $port group port
+		EOF
+    done
+    cat <<-EOF >> "/etc/network/interfaces.d/$nm"
+
+	auto $nm
+	iface $nm
+	    bridge-ports $ports
+	    bridge-vlan-aware yes
+	    bridge-stp on
+	    bridge-vids 1
+
+	auto vlan1
+	iface vlan1 inet dhcp
+	    vlan-id 1
+	    vlan-raw-device $nm
+	    post-up ip link set vlan1 group iface
+	EOF
+    ip link set vlan1 group iface
+}
+
+# Check if already set up
+[ -z "$(ls -A /etc/network/interfaces.d/)" ] || exit 0
+
+# Check for custom hostname from Qemu/Qeneth
+nm=$(cat /sys/firmware/qemu_fw_cfg/by_name/opt/hostname/raw)
+if [ -n "$nm" ]; then
+    hostnm "$nm"
+fi
+
+# need to check for 'length > 0' because ip command
+# outputs empty json objects for non-port group ifs
+ports=$(ip -json link show group port | jq -r '.[].ifname | select(length > 0)' | tr "\n" " ")
+if [ -n "$ports" ]; then
+    create_bridge br0 $ports
+else
+    ifaces=$(ip -json addr show  |jq -r '.[] | select(.link_type=="ether").ifname')
+    for iface in $ifaces; do
+	cat  <<-EOF > "/etc/network/interfaces.d/$iface"
+		auto $iface
+		iface $iface inet dhcp
+		    pre-up ip link set $iface group iface
+		EOF
+    done
+fi
@@ -1,7 +1,10 @@
-comment "Image Signing"
+menuconfig SIGN_ENABLED
+	bool "Image Signing"
+	default y

 choice
 	prompt "Signing key source"
+	depends on SIGN_ENABLED
 	default SIGN_SRC_DIR

 config SIGN_SRC_DIR
@@ -14,19 +17,9 @@ endchoice

 config SIGN_KEY
 	string "Signing key"
+	depends on SIGN_ENABLED
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/dev-key" if SIGN_SRC_DIR

-comment "Additional Artifacts"
-
-# For /etc/os-release, uses CondtionArchitechture= from systemd.unit(5)
-config INFIX_ARCH
-	string
-	default "arm"     if BR2_arm
-	default "arm64"   if BR2_aarch64
-	default "mips64"  if BR2_mips64
-	default "riscv64" if BR2_riscv
-	default "x86_64"  if BR2_x86_64
-
 menuconfig DISK_IMAGE
 	bool "Disk image"
 	help
@@ -43,13 +36,15 @@ config DISK_IMAGE_SIZE
 	depends on DISK_IMAGE
 	default "512M"
 	help
-	  Create a disk image of this size. Suffixes like K/M/G may be
-	  used to multiply by powers of 1024. Suffixes like KB/MB/GB may
-	  be used to multiply by powers of 1000.
+	  Create a disk image of this size.  A K/M/G suffix may be used
+	  to multiply by powers of 1024.  Suffixes like KB/MB/GB may be
+	  used to multiply by powers of 1000.  The image will be split
+	  proportionally to fit the two rootfs, a kernel, a writable
+	  /cfg and /var partiotions.

 	  Minimum supported size is 512M.

-config GNS3_APPLIANCE
+menuconfig GNS3_APPLIANCE
 	bool "GNS3 Appliance"
 	select DISK_IMAGE
 	default y if BR2_x86_64
@@ -57,6 +52,22 @@ config GNS3_APPLIANCE
 	  Create a GNS3 appliance description that, together with the
 	  disk image, can be imported into GNS3.

+config GNS3_APPLIANCE_RAM
+	int "Reserved RAM (MiB)"
+	depends on GNS3_APPLIANCE
+	default "192"
+	help
+	  Amount of host RAM reserved for an appliance instance.
+
+	  Minimum supported size is 192M.
+
+config GNS3_APPLIANCE_IFNUM
+	int "Number of interfaces"
+	depends on GNS3_APPLIANCE
+	default "1"
+	help
+	  Number of Ethernet interfaces to create for an appliance instance.
+
 menuconfig FIT_IMAGE
 	bool "Traditional FIT image"
 	help
@@ -17,7 +17,6 @@ size2int()

 dimension()
 {
-
    if [ $total -ge $((4 << G)) ]; then
 	bootsize=$(( 8 << M))
 	auxsize=$((  8 << M))
@@ -161,24 +160,24 @@ cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh

 case "$arch" in
    aarch64)
-	mkenvimage -s 0x4000 -o $root/aux/uboot.env \
-		   $BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt
+	mkenvimage -s 0x4000 -o "$root/aux/uboot.env" \
+		   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
 	;;
    x86_64)
-	mkdir -p $root/aux/grub
-	cp -f $BR2_EXTERNAL_INFIX_PATH/board/amd64/grub.cfg \
-	      $BR2_EXTERNAL_INFIX_PATH/board/amd64/grubenv  \
-	   $root/aux/grub/
+	mkdir -p "$root/aux/grub"
+	cp -f "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grub.cfg" \
+	      "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grubenv"  \
+	      "$root/aux/grub/"
 	;;
    *)
 	;;
 esac

-rm -rf $tmp
+rm -rf "$tmp"

 genimage \
-    --rootpath $root \
-    --tmppath  $tmp \
-    --inputpath $BINARIES_DIR \
-    --outputpath $BINARIES_DIR \
-    --config $root/genimage.cfg
+    --rootpath "$root" \
+    --tmppath  "$tmp" \
+    --inputpath "$BINARIES_DIR" \
+    --outputpath "$BINARIES_DIR" \
+    --config "$root/genimage.cfg"
@@ -1,8 +1,16 @@
 #!/bin/sh

-cat <<EOF >"$BINARIES_DIR/infix.gns3a"
+if [ -n "$INFIX_RELEASE" ]; then
+    rel="-${INFIX_RELEASE}"
+fi
+
+NM="${1:-custom}${rel}"
+RAM=${2:-512}
+IFNUM=${3:-1}
+
+cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
 {
-    "name": "infix",
+    "name": "$NM",
    "category": "router",
    "description": "Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling.",
    "vendor_name": "KernelKit",
@@ -12,13 +20,13 @@ cat <<EOF >"$BINARIES_DIR/infix.gns3a"
    "status": "stable",
    "maintainer": "KernelKit",
    "maintainer_email": "kernelkit@googlegroups.com",
-    "usage": "Default login is 'root', no password.\n\nType 'help' for an overview of commands and relevant configuration files.\n\nThe /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address  eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
+    "usage": "Default console login is 'root', no password.  For remote login, default user/pass: admin/admin also works.\n\nType 'help' for an overview of commands and relevant configuration files.\n\nThe /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address  eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
    "port_name_format": "eth{0}",
    "linked_clone": true,
    "qemu": {
        "adapter_type": "virtio-net-pci",
-        "adapters": 10,
-        "ram": 512,
+        "adapters": ${IFNUM},
+        "ram": ${RAM},
        "cpus": 1,
        "hda_disk_interface": "virtio",
        "arch": "x86_64",
@@ -3,9 +3,13 @@
 set -e

 GIT_VERSION=$(git -C $BR2_EXTERNAL_INFIX_PATH describe --always --dirty --tags)
+if [ -n "$INFIX_RELEASE" ]; then
+    rel="-${INFIX_RELEASE}"
+fi

-arch=$1
-sign=$2
+name=$1${rel}
+arch=$2
+sign=$3

 crt=$(ls $sign/*.crt)
 key=$(ls $sign/*.key)
@@ -38,7 +42,7 @@ filename=rootfs.img
 hooks=post-install
 EOF

-rm -f $BINARIES_DIR/infix-$arch.pkg
+rm -f $BINARIES_DIR/$name.pkg

 rauc --cert=$crt --key=$key \
-    bundle $work $BINARIES_DIR/infix-$arch.pkg
+    bundle $work $BINARIES_DIR/$name.pkg
@@ -1,29 +1,53 @@
 #!/bin/sh
-. "$BR2_CONFIG"
+# shellcheck disable=SC1090,SC1091
+. "$BR2_CONFIG" 2>/dev/null
 . "$TARGET_DIR/usr/lib/os-release"
+
 if [ -n "${ID_LIKE}" ]; then
    ID="${ID} ${ID_LIKE}"
 fi

-GIT_VERSION=$(git -C $BR2_EXTERNAL_INFIX_PATH describe --always --dirty --tags)
+GIT_VERSION=$(git -C "$BR2_EXTERNAL_INFIX_PATH" describe --always --dirty --tags)

 # This is a symlink to /usr/lib/os-release, so we remove this to keep
 # original Buildroot information.
-rm "$TARGET_DIR/etc/os-release"
+rm -f "$TARGET_DIR/etc/os-release"
 {
-	echo "NAME=\"Infix\""
-	echo "VERSION=${GIT_VERSION}"
-	echo "ID=infix"
-	echo "ID_LIKE=\"${ID}\""
-	echo "VERSION_ID=${GIT_VERSION}"
-	echo "BUILD_ID=\"${NAME} ${VERSION}\""
-	echo "PRETTY_NAME=\"Infix by KernelKit\""
-	echo "ARCHITECTURE=\"${INFIX_ARCH}\""
-	echo "HOME_URL=https://github.com/KernelKit"
+    echo "NAME=\"Infix\""
+    echo "VERSION=${GIT_VERSION}"
+    echo "ID=infix"
+    echo "ID_LIKE=\"${ID}\""
+    echo "VERSION_ID=${GIT_VERSION}"
+    echo "BUILD_ID=\"${NAME} ${VERSION}\""
+    echo "PRETTY_NAME=\"Infix by KernelKit\""
+    if [ "$INFIX_VARIANT_NETCONF" = "y" ]; then
+	echo "VARIANT=\"Managed NETCONF\""
+	echo "VARIANT_ID=netconf"
+    else
+	echo "VARIANT=\"Classic, writable /etc\""
+	echo "VARIANT_ID=classic"
+    fi
+    echo "ARCHITECTURE=\"${INFIX_ARCH}\""
+    echo "HOME_URL=https://github.com/KernelKit"
 } > "$TARGET_DIR/etc/os-release"

+
 echo "Infix by KernelKit $GIT_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"

-# Allow pdmenu (setup) to be a login shell
+# Allow pdmenu (setup) and bash to be a login shells, bash
+# is added automatically when selected in menuyconfig, but
+# not when BusyBox provides a symlink (for ash).
 grep -qsE '^/usr/bin/pdmenu$$' "$TARGET_DIR/etc/shells" \
        || echo "/usr/bin/pdmenu" >> "$TARGET_DIR/etc/shells"
+grep -qsE '^/bin/bash$$' "$TARGET_DIR/etc/shells" \
+        || echo "/bin/bash" >> "$TARGET_DIR/etc/shells"
+
+# Menuconfig support for modifying Qemu args in release tarballs
+cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
+sed "s/default QEMU_aarch64/default QEMU_$BR2_ARCH/" \
+    < "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in" \
+    > "$BINARIES_DIR/Config.in"
+rm -f "$BINARIES_DIR/qemu.cfg"
+CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
+       "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
+rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
@@ -1,29 +1,44 @@
 #!/bin/sh
-
 common=$(dirname "$(readlink -f "$0")")
 . $common/lib.sh

+load_cfg BR2_DEFCONFIG
 load_cfg BR2_EXTERNAL_INFIX_PATH
+NAME=infix-$(basename "$BR2_DEFCONFIG" _defconfig | tr _ - | sed 's/x86-64/x86_64/')

-load_cfg BR2_ARCH
-load_cfg SIGN_KEY
+ver()
+{
+    if [ -n "$INFIX_RELEASE" ]; then
+	printf -- "-%s" "$INFIX_RELEASE"
+	return
+    fi
+}

-ixmsg "Signing SquashFS Image"
-$common/sign.sh $BR2_ARCH $SIGN_KEY
+load_cfg SIGN_ENABLED
+if [ "$SIGN_ENABLED" = "y" ]; then
+    load_cfg BR2_ARCH
+    load_cfg SIGN_KEY

-ixmsg "Creating RAUC Update Bundle"
-$common/mkrauc.sh $BR2_ARCH $SIGN_KEY
+    ixmsg "Signing SquashFS Image"
+    $common/sign.sh $BR2_ARCH $SIGN_KEY
+
+    ixmsg "Creating RAUC Update Bundle"
+    $common/mkrauc.sh $NAME $BR2_ARCH $SIGN_KEY
+fi

 load_cfg DISK_IMAGE
+load_cfg DISK_IMAGE_SIZE
 if [ "$DISK_IMAGE" = "y" ]; then
    ixmsg "Creating Disk Image"
-    $common/mkdisk.sh -a $BR2_ARCH
+    $common/mkdisk.sh -a $BR2_ARCH -s $DISK_IMAGE_SIZE
 fi

 load_cfg GNS3_APPLIANCE
 if [ "$GNS3_APPLIANCE" = "y" ]; then
-    ixmsg "Creating GNS3 Appliance"
-    $common/mkgns3a.sh
+    load_cfg GNS3_APPLIANCE_RAM
+    load_cfg GNS3_APPLIANCE_IFNUM
+    ixmsg "Creating GNS3 Appliance, $GNS3_APPLIANCE_RAM MiB with $GNS3_APPLIANCE_IFNUM ports"
+    $common/mkgns3a.sh $NAME $GNS3_APPLIANCE_RAM $GNS3_APPLIANCE_IFNUM
 fi

 load_cfg FIT_IMAGE
@@ -31,3 +46,13 @@ if [ "$FIT_IMAGE" = "y" ]; then
    ixmsg "Creating Traditional FIT Image"
    $common/mkfit.sh
 fi
+
+if [ -z "${NAME##*minimal*}" ]; then
+    NAME=$(echo "$NAME" | sed 's/-minimal//')
+fi
+
+rel=$(ver)
+ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
+if [ -n "$rel" ]; then
+    ln -sf "$BINARIES_DIR/${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
+fi
@@ -1,4 +1,18 @@
-comment "System setup"
+mainmenu "QEMU Virtualization"
+
+choice
+	prompt "Target Architecture"
+	default QEMU_aarch64
+
+config QEMU_x86_64
+	bool "x86_64"
+	select QEMU_ARCH_IS_64
+
+config QEMU_aarch64
+	bool "AArch64 (little endian)"
+	select QEMU_ARCH_IS_64
+
+endchoice

 choice
 	prompt "Loader"
@@ -9,11 +23,11 @@ config QEMU_LOADER_KERNEL

 config QEMU_LOADER_UBOOT
 	bool "U-Boot"
-	depends on BR2_aarch64
+	depends on QEMU_aarch64

 config QEMU_LOADER_OVMF
 	bool "OVMF (UEFI)"
-	depends on BR2_x86_64
+	depends on QEMU_x86_64

 endchoice

@@ -34,45 +48,55 @@ endchoice

 config QEMU_MACHINE
 	string
-	default "qemu-system-aarch64 -M virt -cpu cortex-a72 -m 256M"   if BR2_aarch64
-	default "qemu-system-x86_64 -M q35,accel=kvm -cpu host -m 512M" if BR2_x86_64
+	default "qemu-system-aarch64 -M virt -cpu cortex-a72 -m 256M"   if QEMU_aarch64
+	default "qemu-system-x86_64 -M q35,accel=kvm -cpu host -m 512M" if QEMU_x86_64

 config QEMU_KERNEL
 	string
 	depends on QEMU_LOADER_KERNEL
-	default "images/Image"   if BR2_aarch64
-	default "images/bzImage" if BR2_x86_64
+	default "Image"   if QEMU_aarch64
+	default "bzImage" if QEMU_x86_64

 config QEMU_BIOS
 	string
 	depends on !QEMU_LOADER_KERNEL
-	default "images/u-boot.bin" if QEMU_LOADER_UBOOT
-	default "images/OVMF.fd"    if QEMU_LOADER_OVMF
+	default "u-boot.bin" if QEMU_LOADER_UBOOT
+	default "OVMF.fd"    if QEMU_LOADER_OVMF

 config QEMU_ROOTFS
 	string
-	default "images/disk.img"        if !QEMU_ROOTFS_INITRD
-	default "images/rootfs.squashfs" if QEMU_ROOTFS_INITRD
+	default "disk.img"        if !QEMU_ROOTFS_INITRD
+	default "rootfs.squashfs" if QEMU_ROOTFS_INITRD

 config QEMU_CONSOLE
 	string
 	depends on !QEMU_ROOTFS_MMC
-	default "ttyAMA0" if BR2_aarch64
-	default "ttyS0"   if BR2_x86_64
+	default "ttyAMA0" if QEMU_aarch64
+	default "ttyS0"   if QEMU_x86_64

 config QEMU_DTB_EXTEND
 	bool
 	depends on QEMU_LOADER_UBOOT
-	default y if BR2_aarch64
+	default y if QEMU_aarch64

 config QEMU_RW
-	string "Writable layer"
+	string "Writable /cfg layer"
 	depends on QEMU_ROOTFS_INITRD
-	default "images/cfg.ext4"
+	default "cfg.ext4"
+
+config QEMU_RW_VAR_OPT
+	bool "Separate writable /var (256MB)"
+
+if QEMU_RW_VAR_OPT
+
+config QEMU_RW_VAR
+	string "Writable /var layer"
+	default "var.ext4"
+endif

 config QEMU_HOST
 	string "Export host filesystem path"
-	default "images"
+	default "/tmp"

 config QEMU_APPEND
 	string "Extra kernel options"
@@ -120,5 +144,3 @@ config QEMU_NET_TAP_N
 	int "Number of TAPs"
 	depends on QEMU_NET_TAP
 	default 1
-
-
@@ -0,0 +1,294 @@
+#!/bin/sh
+# This script can be used to start an Infix OS image in Qemu.  It reads
+# either a .config, generated from Config.in, or qemu.cfg from a release
+# tarball, for the required configuration data.
+#
+# Debian/Ubuntu users can change the configuration post-release, install
+# the kconfig-frontends package:
+#
+#    sudo apt install kconfig-frontends
+#
+# and then call this script with:
+#
+#    ./qemu.sh -c
+#
+# To bring up a menuconfig dialog.  Select `Exit` and save the changes.
+# For more help, see:_
+#
+#    ./qemu.sh -h
+#
+
+# Local variables
+prognm=$(basename "$0")
+
+usage()
+{
+    echo "usage: $prognm [opts]"
+    echo
+    echo " -c    Run menuconfig to change Qemu settings"
+    echo " -h    This help text"
+    echo
+    echo "Note: 'kconfig-frontends' package (Debian/Ubuntu) must be installed"
+    echo "      for -c to work: sudo apt install kconfig-frontents"
+
+    exit 1
+}
+
+die()
+{
+    echo "$@" >&2
+    exit 1
+}
+
+load_qemucfg()
+{
+    local tmp=$(mktemp -p /tmp)
+
+    grep ^CONFIG_QEMU_ $1 >$tmp
+    .  $tmp
+    rm $tmp
+
+    [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
+    [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
+
+    [ "$CONFIG_QEMU_KERNEL" -a "$CONFIG_QEMU_BIOS" ] \
+	&& die "QEMU_KERNEL conflicts with QEMU_BIOS"
+
+    [ ! "$CONFIG_QEMU_KERNEL" -a ! "$CONFIG_QEMU_BIOS" ] \
+	&& die "QEMU_KERNEL or QEMU_BIOS must be set"
+}
+
+loader_args()
+{
+    if [ "$CONFIG_QEMU_BIOS" ]; then
+	echo -n "-bios $CONFIG_QEMU_BIOS "
+    elif [ "$CONFIG_QEMU_KERNEL" ]; then
+	echo -n "-kernel $CONFIG_QEMU_KERNEL "
+    fi
+}
+
+append_args()
+{
+# Disabled, not needed anymore with virtconsole (hvc0)
+#    [ "$CONFIG_QEMU_CONSOLE" ] && echo -n "console=$CONFIG_QEMU_CONSOLE "
+
+    echo -n "console=hvc0 "
+    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
+	# Size of initrd, rounded up to nearest kb
+	local size=$((($(stat -c %s $CONFIG_QEMU_ROOTFS) + 1023) >> 10))
+	echo -n "root=/dev/ram ramdisk_size=${size} "
+    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
+	echo -n "root=PARTLABEL=primary "
+    fi
+
+    if [ "$V" != "1" ]; then
+	echo -n "quiet "
+    else
+	echo -n "debug "
+    fi
+
+    echo -n "${QEMU_APPEND} ${QEMU_EXTRA_APPEND} "
+}
+
+rootfs_args()
+{
+    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
+	echo -n "-initrd $CONFIG_QEMU_ROOTFS "
+    elif [ "$CONFIG_QEMU_ROOTFS_MMC" = "y" ]; then
+	echo -n "-device sdhci-pci "
+	echo -n "-device sd-card,drive=mmc "
+	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
+    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
+	echo -n "-drive file=$CONFIG_QEMU_ROOTFS,if=virtio,format=raw,bus=0,unit=0 "
+    fi
+}
+
+rw_args()
+{
+    [ "$CONFIG_QEMU_RW" ] || return
+
+    if ! [ -f "$CONFIG_QEMU_RW" ]; then
+	dd if=/dev/zero of="$CONFIG_QEMU_RW" bs=16M count=1 >/dev/null 2>&1
+	mkfs.ext4 -L cfg "$CONFIG_QEMU_RW" >/dev/null 2>&1
+    fi
+
+    echo -n "-drive file=$CONFIG_QEMU_RW,if=virtio,format=raw,bus=0,unit=1 "
+
+    if [ "$CONFIG_QEMU_RW_VAR_OPT" ]; then
+	if ! [ -f "$CONFIG_QEMU_RW_VAR" ]; then
+	    dd if=/dev/zero of="$CONFIG_QEMU_RW_VAR" bs=256M count=1 >/dev/null 2>&1
+	    mkfs.ext4 -L var "$CONFIG_QEMU_RW_VAR" >/dev/null 2>&1
+	fi
+
+	echo -n "-drive file=$CONFIG_QEMU_RW_VAR,if=virtio,format=raw,bus=0,unit=2 "
+    fi
+}
+
+host_args()
+{
+    [ "${QEMU_HOST}" ] || return
+
+    echo -n "-virtfs local,path=${QEMU_HOST},security_model=none,writeout=immediate,mount_tag=hostfs "
+}
+
+net_args()
+{
+    QEMU_NET_MODEL=${QEMU_NET_MODEL:-virtio}
+
+    if [ "$CONFIG_QEMU_NET_BRIDGE" = "y" ]; then
+	QEMU_NET_BRIDGE_DEV=${QEMU_NET_BRIDGE_DEV:-virbr0}
+	echo -n "-nic bridge,br=$CONFIG_QEMU_NET_BRIDGE_DEV,model=$CONFIG_QEMU_NET_MODEL "
+    elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
+	QEMU_NET_TAP_N=${QEMU_NET_TAP_N:-1}
+	mactab=$(dirname "$CONFIG_QEMU_ROOTFS")/mactab
+	rm -f "$mactab"
+	for i in $(seq 0 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
+	    printf "e$i	52:54:00:12:34:%02x\n" $((0x56 + i)) >>"$mactab"
+	    echo -n "-netdev tap,id=nd$i,ifname=qtap$i -device e1000,netdev=nd$i "
+	done
+	echo -n "-fw_cfg name=opt/mactab,file=$mactab "
+    elif [ "$CONFIG_QEMU_NET_USER" = "y" ]; then
+	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && QEMU_NET_USER_OPTS="$CONFIG_QEMU_NET_USER_OPTS,"
+
+	echo -n "-nic user,${QEMU_NET_USER_OPTS}model=$CONFIG_QEMU_NET_MODEL "
+    else
+	echo -n "-nic none"
+    fi
+}
+
+wdt_args()
+{
+    echo -n "-device i6300esb -rtc clock=host"
+}
+
+run_qemu()
+{
+    local qemu
+    read qemu <<EOF
+	$CONFIG_QEMU_MACHINE \
+	  -display none -rtc base=utc,clock=vm \
+	  -device virtio-serial -chardev stdio,mux=on,id=console0 \
+	  -device virtconsole,chardev=console0 -mon chardev=console0 \
+	  -chardev socket,id=gdbserver,path=gdbserver.sock,server=on,wait=off \
+	  -device virtconsole,name=console1,chardev=gdbserver \
+	  $(loader_args) \
+	  $(rootfs_args) \
+	  $(rw_args) \
+	  $(host_args) \
+	  $(net_args) \
+	  $(wdt_args) \
+	  $CONFIG_QEMU_EXTRA
+EOF
+
+    if [ "$CONFIG_QEMU_KERNEL" ]; then
+	$qemu -append "$(append_args)" "$@"
+    else
+	$qemu "$@"
+    fi
+}
+
+dtb_args()
+{
+    [ "$CONFIG_QEMU_LOADER_UBOOT" ] || return
+
+    if [ "$CONFIG_QEMU_DTB_EXTEND" ]; then
+	# On the current architecture, QEMU will generate an internal
+	# DT based on the system configuration.
+
+	# So we extract a copy of that
+	run_qemu -M dumpdtb=qemu.dtb >/dev/null 2>&1
+
+	# Extend it with the environment and signing information in
+	# u-boot.dtb.
+	echo "qemu.dtb u-boot.dtb" | \
+	    xargs -n 1 dtc -I dtb -O dts | \
+	    { echo "/dts-v1/;"; sed  -e 's:/dts-v[0-9]\+/;::'; } | \
+	    dtc >qemu-extended.dtb 2>/dev/null
+
+	# And use the combined result to start the instance
+	echo -n "-dtb qemu-extended.dtb "
+    else
+	# Otherwise we just use the unmodified one
+	echo -n "-dtb u-boot.dtb "
+    fi
+}
+
+generate_dot()
+{
+    [ "$CONFIG_QEMU_NET_TAP" = "y" ] || return
+
+    hostports="<qtap0> qtap0"
+    targetports="<e0> e0"
+    edges="host:qtap0 -- target:e0;"
+    for tap in $(seq 1 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
+	hostports="$hostports | <qtap$tap> qtap$tap "
+	targetports="$targetports | <e$tap> e$tap "
+	edges="$edges host:qtap$tap -- target:e$tap;"
+    done
+    cat >qemu.dot <<EOF
+graph "qemu" {
+	layout="neato";
+	overlap="false";
+	esep="+20";
+
+        node [shape=record, fontname="monospace"];
+	edge [color="cornflowerblue", penwidth="2"];
+
+	host [
+	    label="host | { $hostports }"
+	    pos="0,0!",
+
+	    kind="controller",
+	];
+
+        target [
+	    label="{ $targetports } | target",
+	    pos="10,0!",
+
+	    kind="infix",
+	];
+
+	$edges
+}
+EOF
+}
+
+menuconfig()
+{
+    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the output/images directory"
+    command -v kconfig-mconf >/dev/null || die "$prognm: cannot find kconfig-mconf for menuconfig"
+    exec kconfig-mconf Config.in
+}
+
+cd $(dirname $(readlink -f "$0"))
+
+while [ "$1" != "" ]; do
+    case $1 in
+	-c)
+	    menuconfig
+	    ;;
+	-h)
+	    usage
+	    ;;
+	*)
+	    break
+    esac
+    shift
+done
+
+if [ -f .config ]; then
+    # Customized settings from 'qemu.sh -c'
+    load_qemucfg .config
+else
+    # Shipped defaults from release tarball
+    load_qemucfg qemu.cfg
+fi
+
+generate_dot
+
+echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
+line=$(stty -g)
+stty raw
+run_qemu $(dtb_args)
+stty "$line"
+
@@ -1,116 +0,0 @@
-#!/bin/sh
-#set -x
-
-mode=/mnt/cfg/infix/.use_etc
-boot=/tmp/.boot_mode
-if [ -f $boot ]; then
-    current=$(cat $boot)
-else
-    current="unknown"
-fi
-m=on
-n=off
-p=off
-
-select_mode()
-{
-    if [ -f $mode ]; then
-	m=off
-	if grep -qi profinet $boot; then
-	    n=off
-	    p=on
-	else
-	    n=on
-	    p=off
-	fi
-    fi
-
-    exec 3>&1
-    selection=$(dialog --erase-on-exit --no-tags \
-		    --hline "Arrow keys + space to select, enter to confirm" \
-		    --backtitle "Select Operating Mode" \
-		    --title "Select Operating Mode" \
-		    --radiolist "System currently runs in: $current mode" 13 60 1 \
-		    "1" "Managed NETCONF, XML datastore" "$m" \
-		    "2" "Native Linux, /etc datastore"   "$n" \
-		    "3" "PROFINET, /etc variant"         "$p" \
-		    2>&1 1>&3)
-    exit_status=$?
-    exec 3>&-
-    case $exit_status in
-	1)			# cancel
-	    exit 0
-	    ;;
-	255)			# escape
-	    exit 1
-	    ;;
-    esac
-}
-
-usage()
-{
-    cat <<EOF
-usage:
-  chom [-h] [etc | netconf]
-
-options:
-  -h            Show this help text
-
-arguments:
-  etc           Change to Linux native mode, /etc
-  netconf       Change to NETCONF mode, XML
-  profinet      Change to PROFINET mode, /etc variant
-
-EOF
-}
-
-case $1 in
-    -h)
-	usage
-	exit 0
-	;;
-    net* | xml)
-	selection=1
-	;;
-    nat* | etc*)
-	selection=2
-	;;
-    profinet)
-	selection=3
-	;;
-    *)
-	;;
-esac
-
-if [ -z "$selection" ]; then
-    use_dialog=1
-    select_mode
-fi
-
-case $selection in
-    1)
-	rm -f $mode 2>/dev/null
-	grep -qi netconf $boot 2>/dev/null && exit 0
-	result="Manageed NETCONF"
-	;;
-    2)
-	echo "native /etc" > $mode
-	grep -qi native $boot  2>/dev/null && exit 0
-	result="Native Linux, /etc"
-	;;
-    3)
-	echo "PROFINET" > $mode
-	grep -qi profinet $boot  2>/dev/null && exit 0
-	result="PROFINET"
-	;;
-esac
-
-if [ -n "$use_dialog" ]; then
-    dialog --erase-on-exit --cr-wrap --title "Activate Mode Change?" --yesno "\n   Reboot to $result mode now?" 8 50
-    if [ $? -eq 0 ]; then
-	reboot
-    fi
-fi
-
-echo "Remember to reboot later to activate the change."
-exit 0
@@ -0,0 +1,5 @@
+{
+    "ietf-system:system": {
+	"hostname": "infix"
+    }
+}
@@ -3,6 +3,13 @@
 # If not running interactively, don't do anything
 [ -z "$PS1" ] && return

+# Reevaluate for each line, in case hostname changes
+function prompt_command
+{
+    PS1="\u@$(hostname):\w\$ "
+}
+export PROMPT_COMMAND=prompt_command
+
 # check the window size after each command and, if necessary,
 # update the values of LINES and COLUMNS.
 shopt -s checkwinsize
@@ -0,0 +1,77 @@
+# For more information on this configuration file, see containers-registries.conf(5).
+#
+# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES
+# We recommend always using fully qualified image names including the registry
+# server (full dns name), namespace, image name, and tag
+# (e.g., registry.redhat.io/ubi8/ubi:latest). Pulling by digest (i.e.,
+# quay.io/repository/name@digest) further eliminates the ambiguity of tags.
+# When using short names, there is always an inherent risk that the image being
+# pulled could be spoofed. For example, a user wants to pull an image named
+# `foobar` from a registry and expects it to come from myregistry.com. If
+# myregistry.com is not first in the search list, an attacker could place a
+# different `foobar` image at a registry earlier in the search list. The user
+# would accidentally pull and run the attacker's image and code rather than the
+# intended content. We recommend only adding registries which are completely
+# trusted (i.e., registries which don't allow unknown or anonymous users to
+# create accounts with arbitrary names). This will prevent an image from being
+# spoofed, squatted or otherwise made insecure.  If it is necessary to use one
+# of these registries, it should be added at the end of the list.
+#
+# # An array of host[:port] registries to try when pulling an unqualified image, in order.
+# unqualified-search-registries = ["example.com"]
+#
+# [[registry]]
+# # The "prefix" field is used to choose the relevant [[registry]] TOML table;
+# # (only) the TOML table with the longest match for the input image name
+# # (taking into account namespace/repo/tag/digest separators) is used.
+# # 
+# # The prefix can also be of the form: *.example.com for wildcard subdomain
+# # matching.
+# #
+# # If the prefix field is missing, it defaults to be the same as the "location" field.
+# prefix = "example.com/foo"
+#
+# # If true, unencrypted HTTP as well as TLS connections with untrusted
+# # certificates are allowed.
+# insecure = false
+#
+# # If true, pulling images with matching names is forbidden.
+# blocked = false
+#
+# # The physical location of the "prefix"-rooted namespace.
+# #
+# # By default, this is equal to "prefix" (in which case "prefix" can be omitted
+# # and the [[registry]] TOML table can only specify "location").
+# #
+# # Example: Given
+# #   prefix = "example.com/foo"
+# #   location = "internal-registry-for-example.net/bar"
+# # requests for the image example.com/foo/myimage:latest will actually work with the
+# # internal-registry-for-example.net/bar/myimage:latest image.
+#
+# # The location can be empty iff prefix is in a
+# # wildcarded format: "*.example.com". In this case, the input reference will
+# # be used as-is without any rewrite.
+# location = internal-registry-for-example.com/bar"
+#
+# # (Possibly-partial) mirrors for the "prefix"-rooted namespace.
+# #
+# # The mirrors are attempted in the specified order; the first one that can be
+# # contacted and contains the image will be used (and if none of the mirrors contains the image,
+# # the primary location specified by the "registry.location" field, or using the unmodified
+# # user-specified reference, is tried last).
+# #
+# # Each TOML table in the "mirror" array can contain the following fields, with the same semantics
+# # as if specified in the [[registry]] TOML table directly:
+# # - location
+# # - insecure
+# [[registry.mirror]]
+# location = "example-mirror-0.local/mirror-for-foo"
+# [[registry.mirror]]
+# location = "example-mirror-1.local/mirrors/foo"
+# insecure = true
+# # Given the above, a pull of example.com/foo/image:latest will try:
+# # 1. example-mirror-0.local/mirror-for-foo/image:latest
+# # 2. example-mirror-1.local/mirrors/foo/image:latest
+# # 3. internal-registry-for-example.net/bar/image:latest
+# # in order, and use the first one that exists.
@@ -0,0 +1,78 @@
+[aliases]
+  # almalinux
+  "almalinux" = "docker.io/library/almalinux"
+  "almalinux-minimal" = "docker.io/library/almalinux-minimal"
+  # centos
+  "centos" = "quay.io/centos/centos"
+  # containers
+  "skopeo" = "quay.io/skopeo/stable"
+  "buildah" = "quay.io/buildah/stable"
+  "podman" = "quay.io/podman/stable"
+  # docker
+  "alpine" = "docker.io/library/alpine"
+  "docker" = "docker.io/library/docker"
+  "registry" = "docker.io/library/registry"
+  "hello-world" = "docker.io/library/hello-world"
+  "swarm" = "docker.io/library/swarm"
+  # Fedora
+  "fedora-minimal" = "registry.fedoraproject.org/fedora-minimal"
+  "fedora" = "registry.fedoraproject.org/fedora"
+  # openSUSE
+  "opensuse/tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed"
+  "opensuse/tumbleweed-dnf" = "registry.opensuse.org/opensuse/tumbleweed-dnf"
+  "opensuse/tumbleweed-microdnf" = "registry.opensuse.org/opensuse/tumbleweed-microdnf"
+  "opensuse/leap" = "registry.opensuse.org/opensuse/leap"
+  "opensuse/busybox" = "registry.opensuse.org/opensuse/busybox"
+  "tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed"
+  "tumbleweed-dnf" = "registry.opensuse.org/opensuse/tumbleweed-dnf"
+  "tumbleweed-microdnf" = "registry.opensuse.org/opensuse/tumbleweed-microdnf"
+  "leap" = "registry.opensuse.org/opensuse/leap"
+  "leap-dnf" = "registry.opensuse.org/opensuse/leap-dnf"
+  "leap-microdnf" = "registry.opensuse.org/opensuse/leap-microdnf"
+  "tw-busybox" = "registry.opensuse.org/opensuse/busybox"
+  # SUSE
+  "suse/sle15" = "registry.suse.com/suse/sle15"
+  "suse/sles12sp5" = "registry.suse.com/suse/sles12sp5"
+  "suse/sles12sp4" = "registry.suse.com/suse/sles12sp4"
+  "suse/sles12sp3" = "registry.suse.com/suse/sles12sp3"
+  "sle15" = "registry.suse.com/suse/sle15"
+  "sles12sp5" = "registry.suse.com/suse/sles12sp5"
+  "sles12sp4" = "registry.suse.com/suse/sles12sp4"
+  "sles12sp3" = "registry.suse.com/suse/sles12sp3"
+  # Red Hat Enterprise Linux
+  "rhel" = "registry.access.redhat.com/rhel"
+  "rhel6" = "registry.access.redhat.com/rhel6"
+  "rhel7" = "registry.access.redhat.com/rhel7"
+  "ubi7" = "registry.access.redhat.com/ubi7"
+  "ubi7-init" = "registry.access.redhat.com/ubi7-init"
+  "ubi7-minimal" = "registry.access.redhat.com/ubi7-minimal"
+  "ubi8" = "registry.access.redhat.com/ubi8"
+  "ubi8-minimal" = "registry.access.redhat.com/ubi8-minimal"
+  "ubi8-init" = "registry.access.redhat.com/ubi8-init"
+  "ubi8-micro" = "registry.access.redhat.com/ubi8-micro"
+  "ubi8/ubi" = "registry.access.redhat.com/ubi8/ubi"
+  "ubi8/ubi-minimal" = "registry.access.redhat.com/ubi8-minimal"
+  "ubi8/ubi-init" = "registry.access.redhat.com/ubi8-init"
+  "ubi8/ubi-micro" = "registry.access.redhat.com/ubi8-micro"
+  # Rocky Linux
+  "rockylinux" = "docker.io/library/rockylinux"
+  # Debian
+  "debian" = "docker.io/library/debian"
+  # Kali Linux
+  "kali-bleeding-edge" = "docker.io/kalilinux/kali-bleeding-edge"
+  "kali-dev" = "docker.io/kalilinux/kali-dev"
+  "kali-experimental" = "docker.io/kalilinux/kali-experimental"
+  "kali-last-release" = "docker.io/kalilinux/kali-last-release"
+  "kali-rolling" = "docker.io/kalilinux/kali-rolling"
+  # Ubuntu
+  "ubuntu" = "docker.io/library/ubuntu"
+  # Oracle Linux
+  "oraclelinux" = "container-registry.oracle.com/os/oraclelinux"
+  # busybox
+  "busybox" = "docker.io/library/busybox"
+  # php
+  "php" = "docker.io/library/php"
+  # python
+  "python" = "docker.io/library/python"
+  # node
+  "node" = "docker.io/library/node"
@@ -1 +1,2 @@
 set COLORTERM=yes
+runparts /cfg/start.d
@@ -1,2 +1,2 @@
+run [S] /lib/infix/sysctl-sync-ip-conf --
 run [S] /lib/infix/nameif -- Probing network interfaces
-run if:<!boot/netconf> [S] /lib/infix/swup --
@@ -0,0 +1,2 @@
+options bonding max_bonds=0
+
@@ -0,0 +1,2 @@
+options dummy numdummies=0
+
@@ -45,13 +45,8 @@ http {
            index  index.html index.htm;
        }

-	location /.well-known/host-meta {
-            fastcgi_pass unix:/run/sysrest.sock;
-            include fastcgi_params;
-        }
-
        location /restconf/ {
-            fastcgi_pass unix:/run/sysrest.sock;
+            fastcgi_pass unix:/var/run/clixon/restconf.sock;
            include fastcgi_params;
        }

@@ -15,5 +15,6 @@ alias ipb='ip -br'
 alias ipaddr='ip addr'
 alias iplink='ip link'
 alias bridge='bridge --color=auto'
-alias setup='pdmenu; clear'
-alias cli='clixon_cli'
+alias cli='klish'
+
+alias docker=podman
@@ -1 +1 @@
-Subsystem cli /usr/bin/clixon_cli
+Subsystem cli /usr/bin/klish
@@ -0,0 +1,4 @@
+# https://addiva-elektronik.github.io/2023/03/29/bridge-firewalling/
+net.bridge.bridge-nf-call-ip6tables = 0
+net.bridge.bridge-nf-call-iptables  = 0
+net.bridge.bridge-nf-call-arptables = 0
@@ -0,0 +1,2 @@
+net.ipv4.ip_forward=1
+net.ipv6.conf.all.forwarding=1
@@ -0,0 +1 @@
+net.core.fb_tunnels_only_for_init_net=2
@@ -0,0 +1,31 @@
+#!/bin/sh
+set -e
+
+PATH=/lib/infix/factory:$PATH
+
+[ "$FACTORY_D" ] || FACTORY_D=/etc/auto-factory.d
+[ "$CFG_D" ]     || CFG_D=/cfg
+[ "$GENCFG_D" ]  || GENCFG_D=/cfg/factory.d
+mkdir -p $GENCFG_D
+
+gen-hostname   >$FACTORY_D/20-auto-hostname.json
+gen-interfaces >$FACTORY_D/20-auto-interfaces.json
+
+[ -s $GENCFG_D/20-auto-hostkey.json ] || gen-hostkeys >$GENCFG_D/20-auto-hostkey.json
+
+# shellcheck disable=SC2046
+jq -s 'reduce .[] as $item ({}; . * $item)' \
+   $(find $FACTORY_D -name '*.json') \
+   $(find $GENCFG_D  -name '*.json') \
+    >$CFG_D/auto-factory-config.cfg
+
+# TODO: Look for statically defined factory-config, based on the
+# system's product ID.
+
+# If we haven't found a better one, settle for auto-factory-config as
+# the system's factory-config.
+[ -h $CFG_D/factory-config.cfg ] || \
+    ln -sf auto-factory-config.cfg $CFG_D/factory-config.cfg
+
+# Bootstrap sysrepo db with all modules required by confd
+sysrepo-bootstrap.sh $CFG_D/factory-config.cfg $CFG_D/startup-config.cfg
@@ -0,0 +1,30 @@
+#!/bin/sh
+
+# generate a new key
+PRIVPEM=$(openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -outform PEM 2>/dev/null)
+# remove header/footer and newlines
+PRIVKEY=$(echo "$PRIVPEM" | grep -v -- "-----" | tr -d "\n")
+
+# get public key
+PUBPEM=$(echo "$PRIVPEM" | openssl rsa -pubout 2>/dev/null)
+# remove header/footer and newlines
+PUBKEY=$(echo "$PUBPEM" | grep -v -- "-----" | tr -d "\n")
+
+# generate edit config
+cat <<EOF
+{
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "algorithm": "rsa2048",
+          "public-key": "$PUBKEY",
+          "private-key": "$PRIVKEY",
+          "certificates": {}
+        }
+      ]
+    }
+  }
+}
+EOF
@@ -0,0 +1,42 @@
+#!/bin/sh
+
+set -e
+
+base_mac_lowest_physical()
+{
+    ip -d -j link show | jq -r '
+         .[] |
+         select(.link_type == "ether") |
+         select(has("linkinfo") | not) | .address' \
+    | sort | head -n 1
+}
+
+source_base_mac()
+{
+    # TODO: Source the base MAC from the vital product data memory, if
+    # available.
+    # base_mac=$(base_mac_vpd)
+    # [ "$base_mac" ] && return
+
+    base_mac=$(base_mac_lowest_physical)
+    [ "$base_mac" ] && return
+
+    base_mac=00:00:00:00:00:00
+}
+
+if [ "$1" ]; then
+    sysname="$1"
+else
+    sysname="$(cat /etc/hostname)"
+fi
+
+source_base_mac
+sysname="${sysname}-$(echo $base_mac | tail -c 9 | tr ':' '-')"
+
+cat <<EOF
+{
+  "ietf-system:system": {
+    "hostname": "${sysname}"
+  }
+}
+EOF
@@ -0,0 +1,47 @@
+#!/bin/sh
+
+set -e
+
+gen_interface()
+{
+    cat <<EOF
+      ,{
+        "name": "$1",
+        "type": "iana-if-type:ethernetCsmacd",
+        "ietf-ip:ipv6": {
+	  "enabled": true,
+	  "forwarding": false,
+	  "dup-addr-detect-transmits": 1,
+	  "autoconf": {
+	    "create-global-addresses": true
+	  }
+	}
+      }
+EOF
+}
+
+phys_ifaces=$(ip -d -j link show | jq -r '
+	 .[] |
+	 select(.link_type == "ether") |
+	 select(has("linkinfo") | not) |
+	 .ifname')
+
+cat <<EOF
+{
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "lo",
+        "type": "iana-if-type:softwareLoopback",
+        "ietf-ip:ipv4": {
+          "address": [{ "ip": "127.0.0.1", "prefix-length": 8 }]
+        },
+        "ietf-ip:ipv6": {
+          "address": [{ "ip": "::1", "prefix-length": 128 }]
+        }
+      }
+$(for iface in $phys_ifaces; do gen_interface $iface; done)
+    ]
+  }
+}
+EOF
@@ -1,12 +1,11 @@
 #!/bin/sh
-
 # Called from /etc/fstab to ensure we have something writable mounted
 # at /cfg, /etc, /home, /root, and /var.
 #
 # /mnt/cfg is used to store device modifications made to /etc, /home,
 # /root.
 #
-# /mnt/var is used as the backins store for /var. If /mnt/var is not
+# /mnt/var is used as the backing store for /var.  If /mnt/var isn't
 # available, /mnt/cfg will still be be used to persist /var/lib.
 #
 # If a disk partiion with the corresponding label ("cfg"/"var") is
@@ -14,6 +13,7 @@
 # directories. Otherwise fall back to a tmpfs based RAM disk. This
 # effectively brings up the system with the default configuration, but
 # obviously any subsequent configuration is ephemeral.
+. /etc/os-release

 set -e

@@ -32,6 +32,21 @@ mount_rw()
    return 1
 }

+# Bind mount /var or /var/lib to ensure applications like podman can set
+# up overlay mounts for containers.  Overlays cannot sit on top of other
+# overlays.  We always copy the contents of /var or /var/lib from the
+# rootfs to get updates, e.g., new packages added in an upgrade.
+mount_bind()
+{
+    src="$1"
+    dst="$2"
+
+    mkdir -p "$src"
+    cp -af "$dst/." "$src/" ||:
+
+    mount -o bind "$src" "$dst"
+}
+
 # mkdir -p -m 0755 only applies to the deepest directory
 # shellcheck disable=SC2174
 mount_overlay()
@@ -64,7 +79,11 @@ if ! mount_rw var >/dev/null 2>&1; then
    logger $opt -p user.warn -t "$nm" \
 	   "No persistent storage found for /var, only /var/lib is persisted."
    varsrc=/mnt/tmp
-    vlibsrc=/mnt/cfg
+    vlibsrc=/mnt/cfg/vlib
+else
+    mount_bind "$varsrc" /var
+    varsrc=
+    vlibsrc=
 fi

 cfgsrc=/mnt/cfg
@@ -88,7 +107,8 @@ else
 	sync
    fi

-    if /lib/infix/use-etc; then
+    # Check build: NETCONF or Classic
+    if [ "$VARIANT_ID" != "netconf" ]; then
 	etcsrc=/mnt/cfg
    fi

@@ -101,9 +121,9 @@ mount_overlay cfg  $cfgsrc /cfg
 mount_overlay etc  $etcsrc /etc
 mount_overlay home $cfgsrc /home
 mount_overlay root $cfgsrc /root
-mount_overlay var  $varsrc /var

-[ "$vlibsrc" ] && mount_overlay vlib "$vlibsrc" /var/lib
+[ "$varsrc" ]  && mount_overlay var "$varsrc"  /var
+[ "$vlibsrc" ] && mount_bind        "$vlibsrc" /var/lib

 # Keep transient configs in a ramdisk and symlink out to /cfg for
 # startup.
@@ -1,38 +0,0 @@
-#!/bin/sh
-# Only runs in native /etc and PROFINET nodes.
-
-if initctl cond get boot/profinet; then
-    initctl enable snmpd
-    initctl disable lldpd
-fi
-
-# Factory default: all switch ports in VLAN 1 of br0
-# need to check for 'length > 0' because ip command
-# outputs empty json objects for non-port group ifs
-ports=$(ip -json link show group port | jq -r '.[].ifname | select(length > 0)' | tr "\n" " ")
-[ -f /etc/network/interfaces.d/br0 ] || [ -z "$ports" ] && exit 0
-
-touch /etc/network/interfaces.d/br0
-for port in $ports; do
-    cat <<-EOF >>/etc/network/interfaces.d/br0
-		iface $port
-		    bridge-access 1
-		    post-up ip link set $port group port
-	EOF
-done
-cat <<-EOF >>/etc/network/interfaces.d/br0
-
-	auto br0
-	iface br0
-	    bridge-ports $ports
-	    bridge-vlan-aware yes
-	    bridge-stp on
-	    bridge-vids 1
-
-	auto vlan1
-	iface vlan1 inet dhcp
-	    vlan-id 1
-	    vlan-raw-device br0
-	    post-up ip link set vlan1 group iface
-EOF
-ip link set vlan1 group iface
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+# When changing default IPv4/6 settings, this does not apply to
+# existing interfaces. This syncs the default settings to all known
+# interfaces at boot, such that physical interfaces will start from
+# the same point as virtual ones.
+
+sysctl net.ipv4.conf.default  >/tmp/sysctl-ip-default
+sysctl net.ipv6.conf.default >>/tmp/sysctl-ip-default
+
+for iface in $(ip -j link show | jq -r .[].ifname); do
+    sed -e "s/.default./.${iface}./g" /tmp/sysctl-ip-default \
+	| sysctl -p -
+done
@@ -1,21 +0,0 @@
-#!/bin/sh
-
-if [ -f /mnt/cfg/infix/.use_etc ]; then
-    exit 0
-fi
-
-# Finit's condition system may not yet be bootstrapped when this script
-# is called, e.g., when /etc/fstab is parsed, so we have to manually
-# check for the boot/etc condition.
-awk '
-    $0 == "finit.cond" {
-	cond=1;
-	next;
-    }
-    cond == 1 {
-	use_etc = index($0, "etc") != 0;
-    }
-    END {
-    	exit(use_etc ? 0 : 1);
-    }
-' /proc/1/cmdline
@@ -1,26 +0,0 @@
-#!/bin/sh
-# Override boot mode based on user input from setup tool
-
-set_cond()
-{
-    mkdir -p /run/finit/cond/boot
-    ln -s /run/finit/cond/reconf "/run/finit/cond/boot/$1"
-}
-
-# Report to the setup and show tools the current boot mode
-if /lib/infix/use-etc; then
-    if [ -f /mnt/cfg/infix/.use_etc ]; then
-	cat /mnt/cfg/infix/.use_etc > /tmp/.boot_mode
-	if grep -qi profinet /mnt/cfg/infix/.use_etc; then
-	    set_cond profinet
-	else
-	    set_cond etc
-	fi
-    else
-	echo "native /etc"  > /tmp/.boot_mode
-	set_cond etc
-    fi
-else
-    echo "NETCONF" > /tmp/.boot_mode
-    set_cond netconf
-fi
@@ -0,0 +1,181 @@
+#!/bin/sh
+
+set -e
+
+inform()
+{
+    local level="$1"
+    shift
+
+    logger -p "daemon.$level" -t dagger -c $LOGGER_STDOUT "$@"
+}
+
+abort()
+{
+    inform err "Aborting: $*"
+    exit 1
+}
+
+generate_order()
+{
+    [ -f "$1/bottom-up-order" ] && [ -f "$1/top-down-order" ] && return
+
+    # The bottom-up order corresponds to a DFS through the DAG, with
+    # duplicates removed
+    find -L "$1/dag" -depth -mindepth 1 -exec basename {} \; \
+	| awk '!seen[$0]++' \
+	      >"$1/bottom-up-order"
+
+    # The reverse is a valid top-down order
+    sed '1!G;h;$!d' "$1/bottom-up-order" >"$1/top-down-order"
+}
+
+action_exec()
+{
+    local actdir="$2/action/$1"
+    local orderfile="$actdir/order"
+    local code=0
+
+    generate_order "$2"
+
+    if [ ! -r "$orderfile" ]; then
+	orderfile="$2/bottom-up-order"
+	inform warn "No order defined for $actdir, falling back to bottom-up"
+    fi
+
+    local order=$(cat "$orderfile")
+
+    [ -d "$actdir/@pre"  ] && order="@pre $order"
+    [ -d "$actdir/@post" ] && order="$order @post"
+
+    for node in $order; do
+	for work in $(find "$actdir/$node" -type f -executable 2>/dev/null | sort); do
+	    $work >>"$work.log" 2>&1 || code=$?
+	    echo "[exit:$code]" >>"$work.log"
+
+	    [ $code -eq 0 ] || abort "$work failed with exitcode $code"
+	done
+    done
+}
+
+do_exec()
+{
+    local action="$1"
+    local current=
+
+    current=$([ -f "$basedir/current" ] && cat "$basedir/current")
+    [ "$current" ] && [ -d "$basedir/$current" ] \
+	|| abort "Current generation does not exist"
+
+    action_exec "$1" "$basedir/$current"
+}
+
+do_abandon()
+{
+    local next=
+
+    next=$([ -f "$basedir/next" ] && cat "$basedir/next" || true)
+    [ "$next" ] && [ -d "$basedir/$next" ] \
+	|| abort "Next generation does not exist"
+
+    mv "$basedir/$next" "$basedir/$next-ABANDONED-$(date +%F-%T)"
+    rm "$basedir/next"
+    inform info "Abandoned generation $next"
+}
+
+do_evolve()
+{
+    local current=
+    local next=
+
+    current=$([ -f "$basedir/current" ] && cat "$basedir/current" || true)
+    [ ! "$current" ] || [ -d "$basedir/$current" ] \
+	|| abort "Current generation does not exist"
+
+    next=$([ -f "$basedir/next" ] && cat "$basedir/next" || true)
+    [ "$next" ] && [ -d "$basedir/$next" ] \
+	|| abort "Next generation does not exist"
+
+    [ "$current" ] && action_exec exit "$basedir/$current"
+
+    action_exec init "$basedir/$next"
+
+    mv "$basedir/next" "$basedir/current"
+    inform info "Evolved to generation $next"
+}
+
+usage()
+{
+    cat <<EOF
+usage: dagger [-d] [-C <root>] <command> [<args>]
+
+Directed Acyclic Graph Generational Execution Runner
+
+Global options:
+
+  -d
+    In addition to the system log, also log messages to stderr.
+
+  -C <root>
+    Instead of the current working directory, use <root> as the dagger
+    root directory.
+
+Commands:
+
+  abandon
+    Abandon a prepared, but not yet applied, next generation.
+
+  evolve
+    Run the exit action of the current generation, followed by the
+    init action of the next generation.
+
+  exec <action>
+    Run the specified action of the current generation.
+
+  help
+    Show this message.
+
+EOF
+}
+
+basedir=$(pwd)
+
+# Global options
+while getopts "dC:" opt; do
+    case $opt in
+	d)
+	    LOGGER_STDOUT=-s
+	    ;;
+	C)
+	    basedir=$OPTARG
+	    ;;
+	*)
+	    usage && exit 1
+    esac
+done
+shift $((OPTIND - 1))
+
+if [ $# -lt 1 ]; then
+    usage && exit 1
+fi
+
+cmd=$1
+shift
+
+case $cmd in
+    "help")
+	usage && exit 0
+	;;
+    "abandon")
+	do_abandon
+	;;
+    "evolve")
+	do_evolve
+	;;
+    "exec")
+	do_exec "$@"
+	;;
+
+    *)
+	usage && exit 1
+esac
@@ -1,3 +0,0 @@
-clicon   -1 clicon   -1 *      - -             wheel Clixon backend
-factory  -1 wheel    -1 =reset - /sbin/factory - Reset to factory defaults
-www-data -1 www-data -1 *      - -             clicon www-data
@@ -0,0 +1,9 @@
+#!/bin/sh
+# shellcheck disable=SC1090
+. "$BR2_CONFIG" 2>/dev/null
+
+# Drop Buildroot default symlink to /tmp
+if [ -L "$TARGET_DIR/var/lib/avahi-autoipd" ]; then
+	rm    "$TARGET_DIR/var/lib/avahi-autoipd"
+	mkdir "$TARGET_DIR/var/lib/avahi-autoipd"
+fi
@@ -0,0 +1,12 @@
+{
+  "ietf-system:system": {
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$6$bKPp6xu45L1cmp70$fcwDhGZct4q8LxwPASf9iVHyWqnklcdjeYi/SupLo1K9nb.aAQUz48.3qTcW38XL6gQzfHyGoyeDG2orjPUwm1"
+        }
+      ]
+    }
+  }
+}
@@ -0,0 +1,68 @@
+{
+    "ietf-netconf-acm:nacm": {
+	"groups": {
+	    "group": [
+		{
+		    "name": "admin",
+		    "user-name": [
+			"admin"
+		    ]
+		}
+	    ]
+	},
+	"rule-list": [
+	    {
+		"name": "guest-acl",
+		"group": [
+		    "guest"
+		],
+		"rule": [
+		    {
+			"name": "deny-ncm",
+			"module-name": "ietf-netconf-monitoring",
+			"access-operations": "*",
+			"action": "deny",
+			"comment": "Disallow guests access to any NETCONF monitoring information."
+		    }
+		]
+	    },
+	    {
+		"name": "limited-acl",
+		"group": [
+		    "limited"
+		],
+		"rule": [
+		    {
+			"name": "permit-ncm",
+			"module-name": "ietf-netconf-monitoring",
+			"access-operations": "read",
+			"action": "permit",
+			"comment": "Allow read access to the NETCONF monitoring information."
+		    },
+		    {
+			"name": "permit-exec",
+			"module-name": "*",
+			"access-operations": "exec",
+			"action": "permit",
+			"comment": "Allow invocation of the supported server operations."
+		    }
+		]
+	    },
+	    {
+		"name": "admin-acl",
+		"group": [
+		    "admin"
+		],
+		"rule": [
+		    {
+			"name": "permit-all",
+			"module-name": "*",
+			"access-operations": "*",
+			"action": "permit",
+			"comment": "Allow 'admin' group complete access to all operations and data."
+		    }
+		]
+	    }
+	]
+    }
+}
@@ -0,0 +1,34 @@
+{
+    "ietf-netconf-server:netconf-server": {
+	"listen": {
+	    "endpoint": [
+		{
+		    "name": "default-ssh",
+		    "ssh": {
+			"tcp-server-parameters": {
+			    "local-address": "::"
+			},
+			"ssh-server-parameters": {
+                            "server-identity": {
+				"host-key": [
+                                    {
+					"name": "default-key",
+					"public-key": {
+					    "keystore-reference": "genkey"
+					}
+				    }
+				]
+                            },
+			    "client-authentication": {
+				"supported-authentication-methods": {
+				    "publickey": [null],
+				    "passsword": [null]
+				}
+			    }
+			}
+		    }
+		}
+	    ]
+	}
+    }
+}
@@ -0,0 +1 @@
+AuthorizedKeysFile /var/run/sshd/%u.keys
@@ -0,0 +1 @@
+net.ipv4.conf.all.forwarding=0
@@ -0,0 +1,4 @@
+net.ipv6.conf.all.forwarding=0
+net.ipv6.conf.all.autoconf=0
+net.ipv6.conf.default.autoconf=0
+net.ipv6.conf.default.keep_addr_on_down=1
@@ -0,0 +1 @@
+/var/lib/avahi-autoipd  d 0755 avahi avahi - - - - -
@@ -0,0 +1,28 @@
+test-dir := $(BR2_EXTERNAL_INFIX_PATH)/test
+INFIX_TESTS ?= $(test-dir)/case/all.yaml
+
+test-env = $(test-dir)/env \
+	-f $(BINARIES_DIR)/infix-x86_64.img \
+	$(1) $(2)
+
+test-env-qeneth = $(call test-env,-q $(test-dir)/virt/dual,$(1))
+test-env-run    = $(call test-env,-C -t $(BINARIES_DIR)/qemu.dot,$(1))
+
+.PHONY: test-%
+
+test-qeneth:
+	$(call test-env-qeneth,\
+		$(BR2_EXTERNAL_INFIX_PATH)/9pm/9pm.py \
+			$(INFIX_TESTS))
+test-qeneth-sh:
+	$(call test-env-qeneth,/bin/sh)
+
+test-run: | ~/.infix-test-venv
+	$(call test-env-run,\
+		$(BR2_EXTERNAL_INFIX_PATH)/9pm/9pm.py \
+			$(INFIX_TESTS))
+test-run-sh:
+	$(call test-env-run,/bin/sh)
+
+~/.infix-test-venv:
+	$(test-dir)/docker/init-venv.sh $(test-dir)/docker/pip-requirements.txt
@@ -0,0 +1,73 @@
+set timeout="1"
+
+load_env ORDER DEBUG
+
+if [ -z "$ORDER" ]; then
+    set ORDER="primary secondary"
+fi
+
+set ORDER="$ORDER reboot"
+
+for slot in $ORDER; do
+    if [ -z "$default" ]; then
+        set default="$slot"
+    else
+        # Contrary to what the documentation says, GRUB (2.06) does
+        # not support using titles or IDs in the fallback variable, so
+        # we translate to indices.
+        if [ "$slot" = "primary" ]; then
+            set fallback="$fallback 0"
+        elif [ "$slot" = "secondary" ]; then
+            set fallback="$fallback 1"
+        elif [ "$slot" = "net" ]; then
+            set fallback="$fallback 2"
+        elif [ "$slot" = "reboot" ]; then
+            set fallback="$fallback 3"
+	fi
+    fi
+done
+
+if [ "$DEBUG" ]; then
+    set log="debug"
+else
+    set log="loglevel=4"
+fi
+
+submenu "primary" "$log" {
+    set slot="$1"
+    set append="console=ttyS0 root=PARTLABEL=$slot $2"
+    set root=(hd0,gpt3)
+    source /boot/grub/grub.cfg
+}
+
+submenu "secondary" "$log"  {
+    set slot="$1"
+    set append="console=ttyS0 root=PARTLABEL=$slot $2"
+    set root=(hd0,gpt4)
+    source /boot/grub/grub.cfg
+}
+
+submenu "net" "$log"  {
+    net_dhcp
+
+    if [ "$net_efinet0_dhcp_next_server" -a "$net_efinet0_dhcp_boot_file" ]; then
+	set initrd=(tftp,$net_efinet0_dhcp_next_server)/$net_efinet0_dhcp_boot_file
+	loopback initrd $initrd
+	set root=(initrd)
+
+	set slot="$1"
+	set append="console=ttyS0 root=/dev/ram ramdisk_size=65536 $2"
+	source /boot/grub/grub.cfg
+    else
+	if [ -z "$net_efinet0_dhcp_next_server" ]; then
+	    echo "No TFTP server supplied in DHCP response"
+	fi
+	if [ -z "$net_efinet0_dhcp_boot_file" ]; then
+	    echo "No bootfile supplied in DHCP response"
+	fi
+    fi
+}
+
+submenu "reboot" {
+    reboot
+}
@@ -1,8 +1,10 @@
 # GRUB Environment Block
 # WARNING: Do not edit this file by tools other than grub-editenv!!!
-ORDER=primary secondary
+ORDER=primary secondary net
 primary_OK=1
 secondary_OK=1
+net_OK=1
 primary_TRY=0
 secondary_TRY=0
-################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################
+net_TRY=0
+#########################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################
@@ -25,6 +25,7 @@ CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
@@ -38,25 +39,32 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=y
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
 CONFIG_IP_MULTIPLE_TABLES=y
 CONFIG_IP_ROUTE_MULTIPATH=y
-CONFIG_NET_IPIP=y
-CONFIG_NET_IPGRE_DEMUX=y
-CONFIG_NET_IPGRE=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
 CONFIG_NET_IPGRE_BROADCAST=y
 CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_NET_IPVTI=y
+CONFIG_SYN_COOKIES=y
+CONFIG_NET_IPVTI=m
+CONFIG_NET_FOU_IP_TUNNELS=y
+CONFIG_IPV6_SIT=m
+CONFIG_IPV6_GRE=m
 CONFIG_IPV6_MULTIPLE_TABLES=y
 CONFIG_IPV6_SUBTREES=y
 CONFIG_IPV6_MROUTE=y
 CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETWORK_PHY_TIMESTAMPING=y
 CONFIG_NETFILTER=y
 CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
@@ -66,17 +74,80 @@ CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NF_CONNTRACK_FTP=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_CT=m
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_OBJREF=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_XFRM=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_REJECT_NETDEV=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CGROUP=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
 CONFIG_IP_NF_MANGLE=m
-CONFIG_NF_LOG_IPV6=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
+CONFIG_NFT_BRIDGE_META=m
+CONFIG_NF_CONNTRACK_BRIDGE=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BPFILTER=y
 CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_BRIDGE_MRP=y
@@ -84,8 +155,22 @@ CONFIG_BRIDGE_CFM=y
 CONFIG_VLAN_8021Q=y
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBQ=y
+CONFIG_NET_CLS_BASIC=y
+CONFIG_NET_CLS_TCINDEX=y
+CONFIG_NET_CLS_BPF=y
+CONFIG_NET_CLS_FLOWER=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_MPLS=y
+CONFIG_NET_MPLS_GSO=y
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
+CONFIG_NET_PKTGEN=y
+# CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
+CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
@@ -95,7 +180,6 @@ CONFIG_FW_CFG_SYSFS=y
 CONFIG_FW_CFG_SYSFS_CMDLINE=y
 CONFIG_BLK_DEV_NULL_BLK=y
 CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_NBD=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_SD=y
@@ -108,21 +192,21 @@ CONFIG_BLK_DEV_DM=y
 CONFIG_DM_VERITY=y
 CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
-CONFIG_BONDING=y
-CONFIG_DUMMY=y
-CONFIG_NET_TEAM=y
-CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=y
-CONFIG_NET_TEAM_MODE_LOADBALANCE=y
-CONFIG_MACVLAN=y
-CONFIG_MACVTAP=y
-CONFIG_IPVLAN=y
-CONFIG_IPVTAP=y
-CONFIG_VXLAN=y
-CONFIG_GENEVE=y
-CONFIG_BAREUDP=y
-CONFIG_MACSEC=y
-CONFIG_TUN=y
-CONFIG_VETH=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_NET_TEAM=m
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
+CONFIG_NET_TEAM_MODE_LOADBALANCE=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
+CONFIG_VXLAN=m
+CONFIG_GENEVE=m
+CONFIG_BAREUDP=m
+CONFIG_MACSEC=m
+CONFIG_TUN=m
+CONFIG_VETH=m
 CONFIG_VIRTIO_NET=y
 CONFIG_NLMON=y
 CONFIG_NET_VRF=y
@@ -135,30 +219,26 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_HW_RANDOM_VIRTIO=m
+CONFIG_I2C=y
 CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
-CONFIG_DRM=y
-CONFIG_DRM_QXL=y
-CONFIG_DRM_VIRTIO_GPU=y
-CONFIG_DRM_BOCHS=y
-CONFIG_SOUND=y
-CONFIG_SND=y
-CONFIG_SND_HDA_INTEL=y
-CONFIG_SND_HDA_GENERIC=y
 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_UHCI_HCD=y
 CONFIG_USB_STORAGE=y
 CONFIG_RTC_CLASS=y
+CONFIG_SYNC_FILE=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
 CONFIG_EXT4_FS=y
+CONFIG_BTRFS_FS=y
+CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_AUTOFS4_FS=y
 CONFIG_FUSE_FS=y
 CONFIG_VIRTIO_FS=y
@@ -173,7 +253,8 @@ CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_GCM=y
+CONFIG_CRYPTO_AES=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
@@ -0,0 +1,6 @@
+menuentry "Infix" --id infix {
+	linux /boot/bzImage rauc.slot=$slot nokaslr $append
+	if [ "$initrd" ]; then
+	   initrd $initrd
+	fi
+}
@@ -16,3 +16,7 @@ bootname=primary
 [slot.rootfs.1]
 device=/dev/disk/by-partlabel/secondary
 bootname=secondary
+
+[slot.net.0]
+device=/dev/ram
+bootname=net
@@ -0,0 +1,110 @@
+BR2_aarch64=y
+BR2_ARM_FPU_VFPV4=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_TARGET_GENERIC_HOSTNAME="infix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_TARGET_GENERIC_GETTY_TERM="linux"
+BR2_SYSTEM_DHCP="eth0"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
+BR2_GENERATE_LOCALE="en_US en_CA"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/classic/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/classic/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.19.17"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B sparx5_pcb135_emmc_no_psci"
+BR2_LINUX_KERNEL_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts/microchip/sparx5_pcb135_emmc_no_psci.dts"
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI=y
+# BR2_PACKAGE_AVAHI_AUTOIPD is not set
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_DHCPCD=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
+BR2_PACKAGE_DROPBEAR_WTMP=y
+BR2_PACKAGE_DROPBEAR_LASTLOG=y
+BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FPING=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPTABLES=y
+BR2_PACKAGE_IPTABLES_NFTABLES=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_LYNX=y
+BR2_PACKAGE_MTR=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NMAP=y
+BR2_PACKAGE_NMAP_NMAP=y
+BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_SSDP_RESPONDER=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_TRACEROUTE=y
+BR2_PACKAGE_DIALOG=y
+BR2_PACKAGE_PDMENU=y
+BR2_PACKAGE_IRQBALANCE=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_MOST=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_PACKAGE_HOST_E2FSPROGS=y
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+INFIX_VARIANT_CLASSIC=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_SULOGIN=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_MODPROBE=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IFUPDOWN_NG=y
+BR2_PACKAGE_TETRIS=y
@@ -12,16 +12,15 @@ BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_TERM="linux"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
 BR2_GENERATE_LOCALE="en_US en_CA"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_USERS_TABLES="${BR2_EXTERNAL_INFIX_PATH}/board/common/users"
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
@@ -33,6 +32,7 @@ BR2_LINUX_KERNEL_INTREE_DTS_NAME="marvell/armada-3720-espressobin marvell/armada
 BR2_LINUX_KERNEL_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts/microchip/sparx5_pcb135_emmc_no_psci.dts"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -47,68 +47,50 @@ BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI=y
-# BR2_PACKAGE_AVAHI_AUTOIPD is not set
 BR2_PACKAGE_AVAHI_DAEMON=y
 BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
 BR2_PACKAGE_CONNTRACK_TOOLS=y
-BR2_PACKAGE_DHCPCD=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_LYNX=y
-BR2_PACKAGE_MRP=y
-BR2_PACKAGE_MSTPD=y
-BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NFTABLES=y
-BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_GUNZIP_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_AUTH_REQUEST_MODULE=y
 BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
-BR2_PACKAGE_SMCROUTE=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_SSDP_RESPONDER=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_BASH_COMPLETION=y
-BR2_PACKAGE_DIALOG=y
-BR2_PACKAGE_NEOFETCH=y
-BR2_PACKAGE_PDMENU=y
-BR2_PACKAGE_TMUX=y
-BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_STREAMING=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_MG=y
-BR2_PACKAGE_MOST=y
 BR2_PACKAGE_NANO=y
 BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
@@ -130,13 +112,9 @@ BR2_PACKAGE_FINIT_PLUGIN_MODPROBE=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_IFUPDOWN_NG=y
 BR2_PACKAGE_KLINFIX=y
-BR2_PACKAGE_KLISH=y
-BR2_PACKAGE_KLISH_PLUGIN_SYSREPO=y
-BR2_PACKAGE_P_NET=y
-BR2_PACKAGE_P_NET_MAX_SUBSLOTS=12
-BR2_PACKAGE_P_NET_MAX_PHYSICAL_PORTS=10
-BR2_PACKAGE_PROFETH=y
+BR2_PACKAGE_NET=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_QUERIERD=y
+GNS3_APPLIANCE_RAM=512
+GNS3_APPLIANCE_IFNUM=10
@@ -24,3 +24,6 @@ BR2_TARGET_BINARIES_MARVELL=y
 BR2_TARGET_MV_DDR_MARVELL=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mvebu_crb_cn9130"
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
@@ -0,0 +1,114 @@
+BR2_x86_64=y
+BR2_x86_corei7=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_TARGET_GENERIC_HOSTNAME="infix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_TARGET_GENERIC_GETTY_TERM="linux"
+BR2_SYSTEM_DHCP="eth0"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
+BR2_GENERATE_LOCALE="en_US en_CA"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/classic/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/classic/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.19.17"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
+BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI=y
+# BR2_PACKAGE_AVAHI_AUTOIPD is not set
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_DHCPCD=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
+BR2_PACKAGE_DROPBEAR_WTMP=y
+BR2_PACKAGE_DROPBEAR_LASTLOG=y
+BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FPING=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPTABLES=y
+BR2_PACKAGE_IPTABLES_NFTABLES=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_LYNX=y
+BR2_PACKAGE_MTR=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NMAP=y
+BR2_PACKAGE_NMAP_NMAP=y
+BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_SSDP_RESPONDER=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_TRACEROUTE=y
+BR2_PACKAGE_DIALOG=y
+BR2_PACKAGE_PDMENU=y
+BR2_PACKAGE_IRQBALANCE=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_MOST=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_EDK2=y
+BR2_TARGET_GRUB2=y
+BR2_TARGET_GRUB2_X86_64_EFI=y
+BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 fat squash4 part_gpt normal efi_gop configfile loadenv test terminfo terminal echo"
+BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
+BR2_TARGET_GRUB2_INSTALL_TOOLS=y
+BR2_PACKAGE_HOST_DOSFSTOOLS=y
+BR2_PACKAGE_HOST_E2FSPROGS=y
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+INFIX_VARIANT_CLASSIC=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_SULOGIN=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_MODPROBE=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IFUPDOWN_NG=y
+BR2_PACKAGE_TETRIS=y
@@ -11,25 +11,25 @@ BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_TERM="linux"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
 BR2_GENERATE_LOCALE="en_US en_CA"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_USERS_TABLES="${BR2_EXTERNAL_INFIX_PATH}/board/common/users"
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/amd64/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.19.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/amd64/linux_defconfig"
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -44,81 +44,65 @@ BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI=y
-# BR2_PACKAGE_AVAHI_AUTOIPD is not set
 BR2_PACKAGE_AVAHI_DAEMON=y
 BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
 BR2_PACKAGE_CONNTRACK_TOOLS=y
-BR2_PACKAGE_DHCPCD=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_LYNX=y
-BR2_PACKAGE_MRP=y
-BR2_PACKAGE_MSTPD=y
-BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NFTABLES=y
-BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_GUNZIP_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_AUTH_REQUEST_MODULE=y
 BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
-BR2_PACKAGE_SMCROUTE=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_SSDP_RESPONDER=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_BASH_COMPLETION=y
-BR2_PACKAGE_DIALOG=y
-BR2_PACKAGE_NEOFETCH=y
-BR2_PACKAGE_PDMENU=y
-BR2_PACKAGE_TMUX=y
-BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_STREAMING=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
 BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_MG=y
-BR2_PACKAGE_MOST=y
 BR2_PACKAGE_NANO=y
 BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_EDK2=y
 BR2_TARGET_GRUB2=y
 BR2_TARGET_GRUB2_X86_64_EFI=y
-BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 fat squash4 part_gpt normal efi_gop configfile loadenv test terminfo terminal echo"
-BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/amd64/grub-embed.cfg"
+BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback"
+BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
 BR2_TARGET_GRUB2_INSTALL_TOOLS=y
+BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
@@ -133,13 +117,9 @@ BR2_PACKAGE_FINIT_PLUGIN_MODPROBE=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_IFUPDOWN_NG=y
 BR2_PACKAGE_KLINFIX=y
-BR2_PACKAGE_KLISH=y
-BR2_PACKAGE_KLISH_PLUGIN_SYSREPO=y
-BR2_PACKAGE_P_NET=y
-BR2_PACKAGE_P_NET_MAX_SUBSLOTS=12
-BR2_PACKAGE_P_NET_MAX_PHYSICAL_PORTS=10
-BR2_PACKAGE_PROFETH=y
+BR2_PACKAGE_NET=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_QUERIERD=y
+GNS3_APPLIANCE_RAM=512
+GNS3_APPLIANCE_IFNUM=10
@@ -0,0 +1,74 @@
+BR2_x86_64=y
+BR2_x86_corei7=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_TARGET_GENERIC_HOSTNAME="infix"
+BR2_TARGET_GENERIC_ISSUE="Minfix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_TERM="linux"
+BR2_SYSTEM_DHCP="eth0"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
+BR2_GENERATE_LOCALE="en_US en_CA"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.19.17"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
+BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SSDP_RESPONDER=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_SULOGIN=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_MODPROBE=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_KLINFIX=y
+BR2_PACKAGE_NET=y
+# SIGN_ENABLED is not set
+# GNS3_APPLIANCE is not set
@@ -329,11 +329,10 @@ rollbacks when upgrading to a new version.
 | Size      | >= 16 MiB       |
 | Format    | EXT4 filesystem |

-Non-volatile storage of the system configuration and user
-data. Concretely, user data is everything stored under `/root` and
-`/home`. Depending on the operating mode, the configuration is either
-the NETCONF databases from `/cfg`, or the contents of `/etc` when
-operating in native mode.
+Non-volatile storage of the system configuration and user data.
+Concretely, user data is everything stored under `/root` and `/home`.
+Depending on the operating mode, the configuration is either the NETCONF
+databases from `/cfg`, or the contents of `/etc` in classic mode.


 ### `var` - Variable Data
@@ -0,0 +1,139 @@
+CLI User Guide
+==============
+
+The Infix CLI is built on the [klish project][1], which is a framework
+for implementing a CISCO, or Juniper Networs JunOS-like CLI on a UNIX
+systems.
+
+Currently, when the `admin` user logs in the default shell is Bash.  To
+access the CLI, type:
+
+    cli
+
+Key commands available in any context are:
+
+    help
+	show
+
+For each command it is also possible to press the `?` key and `TAB` to
+get more help and suggestions for completion.
+
+
+Admin Exec
+----------
+
+The top-level context after logging in and starting the CLI is the
+admin-exec or "main" context.  It is used for querying system status,
+managing configuration files/profiles and doing advanced debugging.
+
+Available commands can be seen by pressing `?` at the prompt:
+
+```
+root@infix-12-34-56:exec> 
+  configure  Create new candidate-config based on running-config
+  copy       Copy
+  exit       Exit
+  logout     Alias for exit
+  shell      Enter system shell
+  show       Show
+```
+
+Configure Context
+-----------------
+
+Enter the configure context from admin-exec by typing `configure`
+followed by Enter.  Available commands, press `?` at the prompt:
+
+```
+root@infix-12-34-56:configure> 
+  abort     Abandon candidate
+  check     Validate candidate
+  commit    Commit current candidate to running-config
+  delete    Delete configuration setting(s)
+  diff      Summarize uncommitted changes
+  do        Execute operational mode command
+  edit      Descend to the specified configuration node
+  exit      Ascend to the parent configuration node, or abort (from top)
+  leave     Finalize candidate and apply to running-config
+  no        Alias for delete
+  rollback  Restore candidate to running-config
+  set       Set configuration setting
+  show      Show configuration
+  top       Ascend to the configuration root
+  up        Ascend to the parent configuration node
+[edit]
+```
+
+The `edit` command lets you change to a sub-configure context, e.g.:
+
+```
+root@infix-12-34-56:configure> edit interfaces interface eth0 
+[edit interfaces interface eth0]
+```
+
+Notice the `[edit ...]` displayed, it shows your current location.
+Use `up` to go back to the previous context.
+
+```
+root@infix-12-34-56:configure> up
+[edit]
+```
+
+### Set IP Address on an Interface
+
+```
+root@infix-12-34-56:configure> 
+[edit]
+root@infix-12-34-56:configure> edit interfaces interface eth0 
+[edit interfaces interface eth0]
+root@infix-12-34-56:configure> set ipv4 address 192.168.2.200 prefix-length 24
+[edit interfaces interface eth0]
+```
+
+From anywhere in configure context you can see the changes you have
+made by typing `diff`:
+
+```
+root@infix-12-34-56:configure> diff
+interfaces {
+  interface eth0 {
+    ipv4 {
+      address 192.168.2.200 {
+        prefix-length 24;
+      }
+    }
+  }
+}
+```
+
+### Saving Changes
+
+Apply the changes (from candidate to running):
+
+```
+root@infix-12-34-56:configure> leave
+root@infix-12-34-56:exec> show running-config 
+interfaces {
+  interface eth0 {
+    type ethernetCsmacd;
+    ipv4 {
+      address 192.168.2.200 {
+        prefix-length 24;
+      }
+    }
+  }
+```
+
+Since we did not get any warnings we can save the running (RAM only)
+configuration to startup, so the changes are made persistent across
+reboots:
+
+```
+root@infix-12-34-56:exec> copy running-config startup-config 
+```
+
+> **Note:** most (all) commands need to be spelled out, no short forms
+> are allowed at the moment.  Use the `TAB` key to make this easier.
+
+
+[1]: https://src.libcode.org/pkun/klish
@@ -0,0 +1,109 @@
+Containers in Infix
+===================
+
+The default builds of Infix do not enable any container support.  This
+because it is not a common customer feature, and it extends build times
+due to bringing in a build-time dependency on Go.
+
+However,customer specific builds may have it, and you can also roll your
+own based on any of the available `defconfigs`.  For example:
+
+    cd infix/
+    make x86_64_defconfig
+
+
+Docker Containers with Podman
+-----------------------------
+
+Run menuconfig, search for `podman`, enable that and build:
+
+	make menuconfig
+	...
+	make
+
+Enabling [podman][] select `crun`, `conmon`, and all other dependencies.
+The build will take a while, but eventually you can:
+
+    make run
+
+> A convenience alias `docker=podman` is available, but remember, not
+> all features or syntax of docker is available in podman.
+
+Test it out with an example:
+
+    podman run -it --rm docker://hello-world
+
+or a little web server:
+
+    podman run -d --rm -p 80:80 docker://nginx:alpine
+
+In detached (`-d`) state you can check the status using `podman ps` or
+try to connect to the web server:
+
+    curl http://localhost
+
+or
+
+    lynx http://localhost
+
+
+### Multiple Networks
+
+It is also possible to start a container with multiple networks.  The
+approach shown here uses CNI profiles, which means the interfaces names
+inside the container will always be: `eth0`, `eth1`, etc.
+
+Pending VETH support in Infix/NETCONF, the following example sets up a
+VETH pair, then creates a CNI profile, and finally starts a container
+with two profiles, the default podman bridge and the VETH profile:
+
+     ip link add local1 type veth peer local1_peer
+     ip link set local1 up
+     ip addr add 192.168.0.1/24 dev local1
+     cni create host net1 local1_peer 192.168.0.42/24
+     podman run -d --rm --net=podman,net1 --privileged docker://troglobit/buildroot:latest
+
+The first profile (`podman`) is a the default bridged profile.  When a
+container is started with that (default behavior), podman dynamically
+creates a VETH pair which has one end attached as a bridge port in the
+`cni-podman0` bridge managed by podman, and the other end is brought up
+as `eth0` inside the container.
+
+The second profile is the one we created, it uses the `host-device`
+profile and does not create anything, it simply lifts the peer end of
+the pair into the container as `eth1`.  This CNI profile can also be
+used to hand over control of physical ports to a container.
+
+> **Note:** here we start the container in `--privileged` mode.  This
+> allows the container guest unfiltered access to the host system and it
+> might not be what you want for a production system.  For that at least
+> SECCOMP is recommended, which is out of scope for this tutorial.
+
+
+### NETCONF Build
+
+If you've followed this tutorial then you now have a NETCONF based Infix
+system running.  To run containers on it you need to leverage the Hybrid
+mode, described in the README but also repeated below.
+
+To start containers in *Hybrid Mode*, provided the images have been
+downloaded with `podman pull` first):
+
+```
+root@infix:/cfg/start.d$ cat <<EOF >20-enable-container.sh
+#!/bin/sh
+podman-service -e -d "Nginx container" -p "-p 80:80" nginx:alpine
+exit 0
+EOF
+root@infix:/cfg/start.d$ chmod +x 20-enable-container.sh
+```
+
+Reboot to activate the changes.  To activate the changes without
+rebooting, run the script and call `initctl reload`.
+
+> **Note:** the `/etc` directory is a `tmpfs` ramdisk and contents will
+> be lost on reboot, so to retain custom CNI profiles after reboot you
+> need to either save them and restore in the script above, or recreate
+> them on every boot.
+
+[podman]: https://podman.io
@@ -0,0 +1,201 @@
+Discover Infix Units
+====================
+
+```
+ .----.      Ethernet       .-------.
+ | PC +---------------------+ Infix |
+ '----' if1            eth0 '-------'
+```
+Figure 1: PC directly connected over Ethernet to Infix unit (here eth0).
+
+
+When you wish to discover the IP address of an Infix switch, the simplest
+way is probably to *ping the IPv6 all-hosts* address (ff02::1) over a
+directly connected Ethernet cable. The unit's link-local IPv6 address is
+seen in the response.
+
+In the example below, the PC is connected to Infix via interface *tap0*
+(*tap0* is *if1* in Figure 1) and Infix responds with address
+*fe80::ff:fe00:0*.
+
+```
+linux-pc:# ping -6 -L -c 3 ff02::1%tap0
+PING ff02::1%tap0(ff02::1%tap0) 56 data bytes
+64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=1 ttl=64 time=0.558 ms
+64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=2 ttl=64 time=0.419 ms
+64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=3 ttl=64 time=0.389 ms
+
+--- ff02::1%tap0 ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2043ms
+rtt min/avg/max/mdev = 0.389/0.455/0.558/0.073 ms
+linux-pc:# 
+```
+
+The PC could connect then connect to Infix, e.g., using SSH.
+
+```
+linux-pc:# ssh admin@fe80::ff:fe00:0%tap0
+admin@fe80::ff:fe00:0%tap0's password: admin
+admin@infix-00-00-00:~$ 
+```
+
+## Discovery mechanisms available in Infix
+
+Infix advertises its presence via the [mDNS](#mdns) and [SSDP](#ssdp) discovery
+protocols in addition to [LLDP](#lldp).
+
+### LLDP
+
+Infix supports LLDP (IEEE 802.1AB). For a unit with factory default
+settings, the PC can readout the link-local IPv6 address from the
+Management Address TLV using *tcpdump* or other sniffing tools[^1].
+```
+linux-pc:# tcpdump -i tap0 -Qin -v ether proto 0x88cc
+tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
+15:51:52.061071 LLDP, length 193
+    Chassis ID TLV (1), length 7
+      Subtype MAC address (4): 02:00:00:00:00:00 (oui Unknown)
+    Port ID TLV (2), length 7
+      Subtype MAC address (3): 02:00:00:00:00:00 (oui Unknown)
+    Time to Live TLV (3), length 2: TTL 120s
+    System Name TLV (5), length 14: infix-00-00-00
+    System Description TLV (6), length 91
+      Infix by KernelKit Linux 5.19.17 #1 SMP PREEMPT_DYNAMIC Wed Jun 7 08:47:23 CEST 2023 x86_64
+    System Capabilities TLV (7), length 4
+      System  Capabilities [Bridge, WLAN AP, Router, Station Only] (0x009c)
+      Enabled Capabilities [Station Only] (0x0080)
+    Management Address TLV (8), length 24
+      Management Address length 17, AFI IPv6 (2): fe80::ff:fe00:0
+      Interface Index Interface Numbering (2): 2
+    Port Description TLV (4), length 4: eth0
+    Organization specific TLV (127), length 9: OUI IEEE 802.3 Private (0x00120f)
+      Link aggregation Subtype (3)
+        aggregation status [supported], aggregation port ID 0
+    Organization specific TLV (127), length 9: OUI IEEE 802.3 Private (0x00120f)
+      MAC/PHY configuration/status Subtype (1)
+        autonegotiation [none] (0x00)
+        PMD autoneg capability [unknown] (0x8000)
+        MAU type Unknown (0x0000)
+    End TLV (0), length 0
+^C
+1 packet captured
+linux-pc:# 
+```
+
+If the unit has an IPv4 address assigned, it is shown in an additional
+Management Address TLV.
+
+> **Note** The Management Addresses shown by LLDP are not
+> necessarily associated with the port transmitting the LLDP message. 
+
+In the example below, the IPv4 address (10.0.1.1) happens to be
+assigned to *eth0*, while the IPv6 address (2001:db8::1) is not.
+
+```
+linux-pc:# sudo tcpdump -i tap0 -Qin -v ether proto 0x88cc
+tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
+15:46:07.908665 LLDP, length 207
+    Chassis ID TLV (1), length 7
+      Subtype MAC address (4): 02:00:00:00:00:00 (oui Unknown)
+    Port ID TLV (2), length 7
+      Subtype MAC address (3): 02:00:00:00:00:00 (oui Unknown)
+    Time to Live TLV (3), length 2: TTL 120s
+    System Name TLV (5), length 14: infix-00-00-00
+    System Description TLV (6), length 91
+      Infix by KernelKit Linux 5.19.17 #1 SMP PREEMPT_DYNAMIC Wed Jun 7 08:47:23 CEST 2023 x86_64
+    System Capabilities TLV (7), length 4
+      System  Capabilities [Bridge, WLAN AP, Router, Station Only] (0x009c)
+      Enabled Capabilities [Station Only] (0x0080)
+    Management Address TLV (8), length 12
+      Management Address length 5, AFI IPv4 (1): 10.0.1.1
+      Interface Index Interface Numbering (2): 2
+    Management Address TLV (8), length 24
+      Management Address length 17, AFI IPv6 (2): 2001:db8::1
+      Interface Index Interface Numbering (2): 3
+    Port Description TLV (4), length 4: eth0
+    Organization specific TLV (127), length 9: OUI IEEE 802.3 Private (0x00120f)
+      Link aggregation Subtype (3)
+        aggregation status [supported], aggregation port ID 0
+    Organization specific TLV (127), length 9: OUI IEEE 802.3 Private (0x00120f)
+      MAC/PHY configuration/status Subtype (1)
+        autonegotiation [none] (0x00)
+        PMD autoneg capability [unknown] (0x8000)
+        MAU type Unknown (0x0000)
+    End TLV (0), length 0
+^C
+1 packet captured
+2 packets received by filter
+0 packets dropped by kernel
+linux-pc:#
+```
+
+[^1]: [lldpd: implementation of IEEE 802.1ab
+    (LLDP)](https://github.com/lldp/lldpd) includes *lldpcli*, which
+    is handy to sniff and display LLDP packets.
+
+### mDNS
+
+DNS-SD/mDNS can be used to discover Infix units and services. Infix
+units present their IP addresses, services and hostname within the
+.local domain. This method has good client support in Apple and Linux
+systems. On Linux, tools such as *avahi-browse* or *mdns-scan*[^2] can
+be used to search for devices advertising their services via mDNS.
+
+```
+linux-pc:# avahi-browse -ar
+   tap0 IPv6 infix-00-00-00                                SFTP File Transfer   local
+   tap0 IPv4 infix-00-00-00                                SFTP File Transfer   local
+   tap0 IPv6 infix-00-00-00                                SSH Remote Terminal  local
+   tap0 IPv4 infix-00-00-00                                SSH Remote Terminal  local
+=   tap0 IPv4 infix-00-00-00                                SFTP File Transfer   local
+   hostname = [infix-00-00-00.local]
+   address = [10.0.1.1]
+   port = [22]
+   txt = []
+=   tap0 IPv4 infix-00-00-00                                SSH Remote Terminal  local
+   hostname = [infix-00-00-00.local]
+   address = [10.0.1.1]
+   port = [22]
+   txt = []
+=   tap0 IPv6 infix-00-00-00                                SFTP File Transfer   local
+   hostname = [infix-00-00-00.local]
+   address = [fe80::ff:fe00:0]
+   port = [22]
+   txt = []
+=   tap0 IPv6 infix-00-00-00                                SSH Remote Terminal  local
+   hostname = [infix-00-00-00.local]
+   address = [fe80::ff:fe00:0]
+   port = [22]
+   txt = []
+^C
+linux-pc:#
+```
+[^2]: [mdns-scan](http://0pointer.de/lennart/projects/mdns-scan/): a
+    tool for scanning for mDNS/DNS-SD published services on the local
+    network
+
+### SSDP
+
+For Windows clients, Infix advertises itself via the SSDP
+protocol. The Infix unit will appear as a *Network Infrastructure* 
+equipment icon in the *Network* tab of Windows Explorer.
+
+In Linux, the *ssdp-scan*[^3] tool can be used to find Infix units via
+SSDP.
+
+```
+linux-pc:# ssdp-scan tap0
+ infix-00-00-00                            http://10.0.1.1
+linux-pc:# 
+```
+
+> Note 1: Infix presents itself with a HTTP URL, however, currently no
+> Web server is running. Still, the IP address 10.0.1.1 is discovered
+> and can be used for SSH access, etc.
+
+> Note 2: SSDP is limited to IPv4. Thus, it is only valid as discovery
+> mechanism when Infix as well as the client PC has an IPv4 address
+> assigned.
+
+[^3]: [SSDP Responder for
+    Linux/UNIX](https://github.com/troglobit/ssdp-responder)
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+ "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<!-- Generated by graphviz version 2.43.0 (0)
+ -->
+<!-- Title: dhcp&#45;client&#45;server Pages: 1 -->
+<svg width="309pt" height="252pt"
+ viewBox="0.00 0.00 308.52 252.02" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 248.02)">
+<title>dhcp&#45;client&#45;server</title>
+<polygon fill="white" stroke="transparent" points="-4,4 -4,-248.02 304.52,-248.02 304.52,4 -4,4"/>
+<!-- host -->
+<g id="node1" class="node">
+<title>host</title>
+<polygon fill="none" stroke="grey" points="0,-87.51 0,-156.51 91,-156.51 91,-87.51 0,-87.51"/>
+<text text-anchor="middle" x="25" y="-118.31" font-family="monospace" font-size="14.00" fill="grey">host</text>
+<polyline fill="none" stroke="grey" points="50,-87.51 50,-156.51 "/>
+<text text-anchor="middle" x="70.5" y="-141.31" font-family="monospace" font-size="14.00" fill="grey">c1</text>
+<polyline fill="none" stroke="grey" points="50,-133.51 91,-133.51 "/>
+<text text-anchor="middle" x="70.5" y="-118.31" font-family="monospace" font-size="14.00" fill="grey">srv</text>
+<polyline fill="none" stroke="grey" points="50,-110.51 91,-110.51 "/>
+<text text-anchor="middle" x="70.5" y="-95.31" font-family="monospace" font-size="14.00" fill="grey">c2</text>
+</g>
+<!-- server -->
+<g id="node2" class="node">
+<title>server</title>
+<polygon fill="none" stroke="black" points="143.52,-99.01 143.52,-145.01 292.52,-145.01 292.52,-99.01 143.52,-99.01"/>
+<text text-anchor="middle" x="168.52" y="-118.31" font-family="monospace" font-size="14.00">mgmt</text>
+<polyline fill="none" stroke="black" points="193.52,-99.01 193.52,-145.01 "/>
+<text text-anchor="middle" x="226.52" y="-118.31" font-family="monospace" font-size="14.00">server</text>
+<polyline fill="none" stroke="black" points="259.52,-99.01 259.52,-145.01 "/>
+<text text-anchor="middle" x="276.02" y="-129.81" font-family="monospace" font-size="14.00">c1</text>
+<polyline fill="none" stroke="black" points="259.52,-122.01 292.52,-122.01 "/>
+<text text-anchor="middle" x="276.02" y="-106.81" font-family="monospace" font-size="14.00">c2</text>
+</g>
+<!-- host&#45;&#45;server -->
+<g id="edge1" class="edge">
+<title>host:srv&#45;&#45;server:mgmt</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-122.01C91.5,-122.01 143.02,-122.01 143.02,-122.01"/>
+</g>
+<!-- client1 -->
+<g id="node3" class="node">
+<title>client1</title>
+<polygon fill="none" stroke="black" points="135.52,-207.52 135.52,-243.52 300.52,-243.52 300.52,-207.52 135.52,-207.52"/>
+<text text-anchor="middle" x="160.52" y="-221.82" font-family="monospace" font-size="14.00">mgmt</text>
+<polyline fill="none" stroke="black" points="185.52,-207.52 185.52,-243.52 "/>
+<text text-anchor="middle" x="222.52" y="-221.82" font-family="monospace" font-size="14.00">client1</text>
+<polyline fill="none" stroke="black" points="259.52,-207.52 259.52,-243.52 "/>
+<text text-anchor="middle" x="280.02" y="-221.82" font-family="monospace" font-size="14.00">srv</text>
+</g>
+<!-- host&#45;&#45;client1 -->
+<g id="edge2" class="edge">
+<title>host:c1&#45;&#45;client1:mgmt</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-145.01C91.5,-145.01 135.02,-225.52 135.02,-225.52"/>
+</g>
+<!-- client2 -->
+<g id="node4" class="node">
+<title>client2</title>
+<polygon fill="none" stroke="black" points="135.52,-0.5 135.52,-36.5 300.52,-36.5 300.52,-0.5 135.52,-0.5"/>
+<text text-anchor="middle" x="160.52" y="-14.8" font-family="monospace" font-size="14.00">mgmt</text>
+<polyline fill="none" stroke="black" points="185.52,-0.5 185.52,-36.5 "/>
+<text text-anchor="middle" x="222.52" y="-14.8" font-family="monospace" font-size="14.00">client2</text>
+<polyline fill="none" stroke="black" points="259.52,-0.5 259.52,-36.5 "/>
+<text text-anchor="middle" x="280.02" y="-14.8" font-family="monospace" font-size="14.00">srv</text>
+</g>
+<!-- host&#45;&#45;client2 -->
+<g id="edge3" class="edge">
+<title>host:c2&#45;&#45;client2:mgmt</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-99.01C91.5,-99.01 135.02,-18.5 135.02,-18.5"/>
+</g>
+<!-- server&#45;&#45;client1 -->
+<g id="edge4" class="edge">
+<title>server:c1&#45;&#45;client1:srv</title>
+<path fill="none" stroke="cornflowerblue" stroke-width="2" d="M276.02,-145.01C276.02,-145.01 280.02,-207.52 280.02,-207.52"/>
+</g>
+<!-- server&#45;&#45;client2 -->
+<g id="edge5" class="edge">
+<title>server:c2&#45;&#45;client2:srv</title>
+<path fill="none" stroke="cornflowerblue" stroke-width="2" d="M276.02,-99.01C276.02,-99.01 280.02,-36.5 280.02,-36.5"/>
+</g>
+</g>
+</svg>
@@ -0,0 +1,187 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+ "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<!-- Generated by graphviz version 2.43.0 (0)
+ -->
+<!-- Title: quad&#45;ring Pages: 1 -->
+<svg width="347pt" height="438pt"
+ viewBox="0.00 0.00 346.65 438.04" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 434.04)">
+<title>quad&#45;ring</title>
+<polygon fill="white" stroke="transparent" points="-4,4 -4,-434.04 342.65,-434.04 342.65,4 -4,4"/>
+<!-- host -->
+<g id="node1" class="node">
+<title>host</title>
+<polygon fill="none" stroke="grey" points="0,-77.02 0,-353.02 91,-353.02 91,-77.02 0,-77.02"/>
+<text text-anchor="middle" x="25" y="-211.32" font-family="monospace" font-size="14.00" fill="grey">host</text>
+<polyline fill="none" stroke="grey" points="50,-77.02 50,-353.02 "/>
+<text text-anchor="middle" x="70.5" y="-337.82" font-family="monospace" font-size="14.00" fill="grey">d1a</text>
+<polyline fill="none" stroke="grey" points="50,-330.02 91,-330.02 "/>
+<text text-anchor="middle" x="70.5" y="-314.82" font-family="monospace" font-size="14.00" fill="grey">d1b</text>
+<polyline fill="none" stroke="grey" points="50,-307.02 91,-307.02 "/>
+<text text-anchor="middle" x="70.5" y="-291.82" font-family="monospace" font-size="14.00" fill="grey">d1c</text>
+<polyline fill="none" stroke="grey" points="50,-284.02 91,-284.02 "/>
+<text text-anchor="middle" x="70.5" y="-268.82" font-family="monospace" font-size="14.00" fill="grey">d2a</text>
+<polyline fill="none" stroke="grey" points="50,-261.02 91,-261.02 "/>
+<text text-anchor="middle" x="70.5" y="-245.82" font-family="monospace" font-size="14.00" fill="grey">d2b</text>
+<polyline fill="none" stroke="grey" points="50,-238.02 91,-238.02 "/>
+<text text-anchor="middle" x="70.5" y="-222.82" font-family="monospace" font-size="14.00" fill="grey">d2c</text>
+<polyline fill="none" stroke="grey" points="50,-215.02 91,-215.02 "/>
+<text text-anchor="middle" x="70.5" y="-199.82" font-family="monospace" font-size="14.00" fill="grey">d3a</text>
+<polyline fill="none" stroke="grey" points="50,-192.02 91,-192.02 "/>
+<text text-anchor="middle" x="70.5" y="-176.82" font-family="monospace" font-size="14.00" fill="grey">d3b</text>
+<polyline fill="none" stroke="grey" points="50,-169.02 91,-169.02 "/>
+<text text-anchor="middle" x="70.5" y="-153.82" font-family="monospace" font-size="14.00" fill="grey">d3c</text>
+<polyline fill="none" stroke="grey" points="50,-146.02 91,-146.02 "/>
+<text text-anchor="middle" x="70.5" y="-130.82" font-family="monospace" font-size="14.00" fill="grey">d4a</text>
+<polyline fill="none" stroke="grey" points="50,-123.02 91,-123.02 "/>
+<text text-anchor="middle" x="70.5" y="-107.82" font-family="monospace" font-size="14.00" fill="grey">d4b</text>
+<polyline fill="none" stroke="grey" points="50,-100.02 91,-100.02 "/>
+<text text-anchor="middle" x="70.5" y="-84.82" font-family="monospace" font-size="14.00" fill="grey">d4c</text>
+</g>
+<!-- dut1 -->
+<g id="node2" class="node">
+<title>dut1</title>
+<polygon fill="none" stroke="black" points="187.52,-360.54 187.52,-429.54 303.52,-429.54 303.52,-360.54 187.52,-360.54"/>
+<text text-anchor="middle" x="204.02" y="-414.34" font-family="monospace" font-size="14.00">e1</text>
+<polyline fill="none" stroke="black" points="187.52,-406.54 220.52,-406.54 "/>
+<text text-anchor="middle" x="204.02" y="-391.34" font-family="monospace" font-size="14.00">e2</text>
+<polyline fill="none" stroke="black" points="187.52,-383.54 220.52,-383.54 "/>
+<text text-anchor="middle" x="204.02" y="-368.34" font-family="monospace" font-size="14.00">e3</text>
+<polyline fill="none" stroke="black" points="220.52,-360.54 220.52,-429.54 "/>
+<text text-anchor="middle" x="245.52" y="-391.34" font-family="monospace" font-size="14.00">dut1</text>
+<polyline fill="none" stroke="black" points="270.52,-360.54 270.52,-429.54 "/>
+<text text-anchor="middle" x="287.02" y="-408.84" font-family="monospace" font-size="14.00">e4</text>
+<polyline fill="none" stroke="black" points="270.52,-395.54 303.52,-395.54 "/>
+<text text-anchor="middle" x="287.02" y="-374.34" font-family="monospace" font-size="14.00">e5</text>
+</g>
+<!-- host&#45;&#45;dut1 -->
+<g id="edge1" class="edge">
+<title>host:d1a&#45;&#45;dut1:e1</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-342.02C91.5,-342.02 187.52,-418.04 187.52,-418.04"/>
+</g>
+<!-- host&#45;&#45;dut1 -->
+<g id="edge5" class="edge">
+<title>host:d1b&#45;&#45;dut1:e2</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-319.02C91.5,-319.02 187.52,-395.04 187.52,-395.04"/>
+</g>
+<!-- host&#45;&#45;dut1 -->
+<g id="edge9" class="edge">
+<title>host:d1c&#45;&#45;dut1:e3</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-296.02C91.5,-296.02 187.52,-372.04 187.52,-372.04"/>
+</g>
+<!-- dut2 -->
+<g id="node3" class="node">
+<title>dut2</title>
+<polygon fill="none" stroke="black" points="187.52,-240.52 187.52,-309.52 303.52,-309.52 303.52,-240.52 187.52,-240.52"/>
+<text text-anchor="middle" x="204.02" y="-294.32" font-family="monospace" font-size="14.00">e1</text>
+<polyline fill="none" stroke="black" points="187.52,-286.52 220.52,-286.52 "/>
+<text text-anchor="middle" x="204.02" y="-271.32" font-family="monospace" font-size="14.00">e2</text>
+<polyline fill="none" stroke="black" points="187.52,-263.52 220.52,-263.52 "/>
+<text text-anchor="middle" x="204.02" y="-248.32" font-family="monospace" font-size="14.00">e3</text>
+<polyline fill="none" stroke="black" points="220.52,-240.52 220.52,-309.52 "/>
+<text text-anchor="middle" x="245.52" y="-271.32" font-family="monospace" font-size="14.00">dut2</text>
+<polyline fill="none" stroke="black" points="270.52,-240.52 270.52,-309.52 "/>
+<text text-anchor="middle" x="287.02" y="-288.82" font-family="monospace" font-size="14.00">e4</text>
+<polyline fill="none" stroke="black" points="270.52,-275.52 303.52,-275.52 "/>
+<text text-anchor="middle" x="287.02" y="-254.32" font-family="monospace" font-size="14.00">e5</text>
+</g>
+<!-- host&#45;&#45;dut2 -->
+<g id="edge2" class="edge">
+<title>host:d2a&#45;&#45;dut2:e1</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-273.02C91.5,-273.02 187.52,-298.02 187.52,-298.02"/>
+</g>
+<!-- host&#45;&#45;dut2 -->
+<g id="edge6" class="edge">
+<title>host:d2b&#45;&#45;dut2:e2</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-250.02C91.5,-250.02 187.52,-275.02 187.52,-275.02"/>
+</g>
+<!-- host&#45;&#45;dut2 -->
+<g id="edge10" class="edge">
+<title>host:d2c&#45;&#45;dut2:e3</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-227.02C91.5,-227.02 187.52,-252.02 187.52,-252.02"/>
+</g>
+<!-- dut3 -->
+<g id="node4" class="node">
+<title>dut3</title>
+<polygon fill="none" stroke="black" points="187.52,-120.51 187.52,-189.51 303.52,-189.51 303.52,-120.51 187.52,-120.51"/>
+<text text-anchor="middle" x="204.02" y="-174.31" font-family="monospace" font-size="14.00">e1</text>
+<polyline fill="none" stroke="black" points="187.52,-166.51 220.52,-166.51 "/>
+<text text-anchor="middle" x="204.02" y="-151.31" font-family="monospace" font-size="14.00">e2</text>
+<polyline fill="none" stroke="black" points="187.52,-143.51 220.52,-143.51 "/>
+<text text-anchor="middle" x="204.02" y="-128.31" font-family="monospace" font-size="14.00">e3</text>
+<polyline fill="none" stroke="black" points="220.52,-120.51 220.52,-189.51 "/>
+<text text-anchor="middle" x="245.52" y="-151.31" font-family="monospace" font-size="14.00">dut3</text>
+<polyline fill="none" stroke="black" points="270.52,-120.51 270.52,-189.51 "/>
+<text text-anchor="middle" x="287.02" y="-168.81" font-family="monospace" font-size="14.00">e4</text>
+<polyline fill="none" stroke="black" points="270.52,-155.51 303.52,-155.51 "/>
+<text text-anchor="middle" x="287.02" y="-134.31" font-family="monospace" font-size="14.00">e5</text>
+</g>
+<!-- host&#45;&#45;dut3 -->
+<g id="edge3" class="edge">
+<title>host:d3a&#45;&#45;dut3:e1</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-203.02C91.5,-203.02 187.52,-178.01 187.52,-178.01"/>
+</g>
+<!-- host&#45;&#45;dut3 -->
+<g id="edge7" class="edge">
+<title>host:d3b&#45;&#45;dut3:e2</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-180.02C91.5,-180.02 187.52,-155.01 187.52,-155.01"/>
+</g>
+<!-- host&#45;&#45;dut3 -->
+<g id="edge11" class="edge">
+<title>host:d3c&#45;&#45;dut3:e3</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-157.02C91.5,-157.02 187.52,-132.01 187.52,-132.01"/>
+</g>
+<!-- dut4 -->
+<g id="node5" class="node">
+<title>dut4</title>
+<polygon fill="none" stroke="black" points="187.52,-0.5 187.52,-69.5 303.52,-69.5 303.52,-0.5 187.52,-0.5"/>
+<text text-anchor="middle" x="204.02" y="-54.3" font-family="monospace" font-size="14.00">e1</text>
+<polyline fill="none" stroke="black" points="187.52,-46.5 220.52,-46.5 "/>
+<text text-anchor="middle" x="204.02" y="-31.3" font-family="monospace" font-size="14.00">e2</text>
+<polyline fill="none" stroke="black" points="187.52,-23.5 220.52,-23.5 "/>
+<text text-anchor="middle" x="204.02" y="-8.3" font-family="monospace" font-size="14.00">e3</text>
+<polyline fill="none" stroke="black" points="220.52,-0.5 220.52,-69.5 "/>
+<text text-anchor="middle" x="245.52" y="-31.3" font-family="monospace" font-size="14.00">dut4</text>
+<polyline fill="none" stroke="black" points="270.52,-0.5 270.52,-69.5 "/>
+<text text-anchor="middle" x="287.02" y="-48.8" font-family="monospace" font-size="14.00">e4</text>
+<polyline fill="none" stroke="black" points="270.52,-35.5 303.52,-35.5 "/>
+<text text-anchor="middle" x="287.02" y="-14.3" font-family="monospace" font-size="14.00">e5</text>
+</g>
+<!-- host&#45;&#45;dut4 -->
+<g id="edge4" class="edge">
+<title>host:d4a&#45;&#45;dut4:e1</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-134.02C91.5,-134.02 187.52,-58 187.52,-58"/>
+</g>
+<!-- host&#45;&#45;dut4 -->
+<g id="edge8" class="edge">
+<title>host:d4b&#45;&#45;dut4:e2</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-111.02C91.5,-111.02 187.52,-35 187.52,-35"/>
+</g>
+<!-- host&#45;&#45;dut4 -->
+<g id="edge12" class="edge">
+<title>host:d4c&#45;&#45;dut4:e3</title>
+<path fill="none" stroke="grey" stroke-width="2" d="M91.5,-88.02C91.5,-88.02 187.52,-12 187.52,-12"/>
+</g>
+<!-- dut1&#45;&#45;dut2 -->
+<g id="edge13" class="edge">
+<title>dut1:e5&#45;&#45;dut2:e4</title>
+<path fill="none" stroke="cornflowerblue" stroke-width="2" d="M287.52,-360.04C287.52,-360.04 287.52,-310.02 287.52,-310.02"/>
+</g>
+<!-- dut2&#45;&#45;dut3 -->
+<g id="edge14" class="edge">
+<title>dut2:e5&#45;&#45;dut3:e4</title>
+<path fill="none" stroke="cornflowerblue" stroke-width="2" d="M287.52,-240.02C287.52,-240.02 287.52,-190.01 287.52,-190.01"/>
+</g>
+<!-- dut3&#45;&#45;dut4 -->
+<g id="edge15" class="edge">
+<title>dut3:e5&#45;&#45;dut4:e4</title>
+<path fill="none" stroke="cornflowerblue" stroke-width="2" d="M287.52,-120.01C287.52,-120.01 287.52,-70 287.52,-70"/>
+</g>
+<!-- dut4&#45;&#45;dut1 -->
+<g id="edge16" class="edge">
+<title>dut4:e5&#45;&#45;dut1:e4</title>
+<path fill="none" stroke="cornflowerblue" stroke-width="2" d="M303.6,-18.06C303.6,-18.06 319.05,-56.84 323.52,-89.5 338.65,-200.04 338.45,-229.97 323.52,-340.54 319.05,-373.62 303.59,-412.97 303.59,-412.97"/>
+</g>
+</g>
+</svg>
@@ -0,0 +1,273 @@
+Testing
+=======
+
+Infix comes with a test suite that is intended to provide end-to-end
+verification of supported features.  Generally speaking, this means
+that one or more DUTs are configured over NETCONF; the resulting
+network is then black-box tested by injecting and inspecting network
+traffic at various points.
+
+
+TL;DR
+-----
+
+	make x86_64_defconfig
+	make
+    make test-qeneth
+
+Runs the test suite on a set of virtual Infix nodes.
+
+
+Tenets
+------
+
+- **Keep overhead to a minimum**.  Tests should be fast to both write
+  and run.  Ideally, the developer should _want_ to add tests early in
+  the development cycle because they instinctively feel that that is
+  the quickest route to arrive at a correct and robust implementation.
+
+- **Both physical and virtual hardware matters**.  Infix is primarily
+  deployed on physical hardware, so being able to run the test suite
+  on real devices is crucial to guarantee a high quality product.  At
+  the same time, there is much value in running the same suite on
+  virtual hardware, as it makes it easy to catch regressions early.
+  It is also much more practical and economical to build large virtual
+  networks than physical ones.
+
+- **Avoid CLI scipting & scraping**.  Reliably interacting with a DUT
+  over a serial line in a robust way is _very_ hard to get right.
+  Given that we have a proper API (RESTCONF), we should leverage that
+  when testing.  Front-ends can be tested by other means.
+
+
+Architectural Overview
+----------------------
+
+![Infix Testing Architecture](testing-overview.svg)
+
+The test system is made up of several independent components, which
+are typically used in concert to run a full test suite.
+
+### Test Cases
+
+A test case is an executable, receiving the physical topology as a
+positional argument, which produces [TAP][] compliant output on its
+`stdout`. I.e., it is executed in the following manner:
+
+    test-case [OPTS] <physical-topology>
+
+Test cases are typically written in Python, using the
+[Infamy](#infamy) library.  Ultimately though, it can be implemented
+in any language, as long as it matches the calling convention above.
+
+### Infamy
+
+Rather than having each test case come up with its own implementation
+of how to map topologies, how to push NETCONF data to a device, etc.,
+we provide a library of functions to take care of all that, dubbed
+"Infamy".  When adding a new test case, ask yourself if any parts of
+it might belong in Infamy as a generalized component that can be
+reused by other tests.
+
+Some of the core functions provided by Infamy are:
+
+- Mapping a logical topology to a physical one
+- Finding and attaching to a device over an Ethernet interface, using
+  NETCONF
+- Pushing/pulling NETCONF data to/from a device
+- Generating TAP compliant output
+
+### 9PM
+
+To run multiple tests, we employ [9PM][]. It let's us define test
+suites as simple YAML files. Suites can also be hierarchically
+structured, with a suite being made up of other suites, etc.
+
+It also validates the TAP output, making sure to catch early exits
+from a case, and produces a nice summary report.
+
+### `/test/env`
+
+A good way to ensure that nobody ever runs the test suite is to make
+it _really_ hard to do so.  `/test/env`'s job is instead to make it
+very _easy_ to create a reproducible environment in which tests can be
+executed.
+
+Several technologies are leveraged to accomplish this:
+
+- **Containers**: The entire execution is optionally done inside a
+  standardized container environment, using either `podman` or
+  `docker`.  This ensures that the software needed to run the test
+  suite is always available, no matter which distribution the user is
+  running on their machine.
+
+- **Python Virtual Environments**: To make sure that the expected
+  versions of all Python packages are available, the execution is
+  wrapped inside a `venv`.  This is true for containerized executions,
+  where the container comes with a pre-installed environment, but it
+  can also be sourced from the host system when running outside of the
+  container.
+
+- **Virtual Test Topology**: Using [Qeneth][], the environment can
+  optionally be started with a virtual topology of DUTs to run the
+  tests on.
+
+
+Interactive Usage
+-----------------
+
+Some tests only require a single DUT.  These can therefore be run
+against an Infix image started from `make run`. When the instance is
+running, you can open a separate terminal and run `make test-run`, to
+run the subset of the test suite that can be mapped to it.
+
+Both `test-qeneth` and `test-run` targets have a respective target
+with a `-sh` suffix.  These can be used to start an interactive
+session in the reproducible environment, which is usually much easier
+to work with during a debugging session.
+
+Inside of the reproducible environment, a wrapper for Qeneth is
+automatically created that will run it from the running network's
+directory.  E.g., running a plain `qeneth status` inside a `make
+test-qeneth-sh` environment will show the expected status information.
+
+
+Physical and Logical Topologies
+-------------------------------
+
+Imagine that we want to create a test with three DUTs; one acting as a
+DHCP server, and the other two as DHCP clients - with all three having
+a management connection to the host PC running the test.  In other
+words, the test requires a _logical_ topology like the one below.
+
+<img align="right" src="testing-log.dot.svg" alt="Example Logical Topology">
+
+    graph "dhcp-client-server" {
+        host [
+            label="host | { <c1> c1 | <srv> srv | <c2> c2 }",
+            kind="controller",
+        ];
+
+        server [
+            label="{ <mgmt> mgmt } | server | { <c1> c1 | <c2> c2 }",
+            kind="infix",
+        ];
+        client1 [
+            label="{ <mgmt> mgmt } | client1 | { <srv> srv }",
+            kind="infix",
+        ];
+        client2 [
+            label="{ <mgmt> mgmt } | client2 | { <srv> srv }",
+            kind="infix",
+        ];
+
+        host:srv -- server:mgmt
+        host:c1  -- client1:mgmt
+        host:c2  -- client2:mgmt
+
+        server:c1 -- client1:srv;
+        server:c2 -- client2:srv;
+    }
+
+When running in a virtualized environment, one could simply create a
+setup that matches the test's logical topology.  But in scenarios when
+devices are physical systems, connected by real copper cables, this is
+not possible (unless you have some wicked L1 relay matrix thingy).
+
+Instead, the test implementation does not concern itself with the
+exact nodes used to run the test, only that the _logical_ topology can
+be _mapped_ to some subset of the _physical_ topology.  In
+mathematical terms, the physical topology must contain a subgraph that
+is _isomorphic_ to the logical topology.
+
+Standing on the shoulders of giants (i.e. people with mathematics
+degrees), we can deploy well-known algorithms to find such subgraphs.
+Continuing our example, let's say we want to run our DHCP test on the
+_physical_ topology below.
+
+<img align="right" src="testing-phy.dot.svg" alt="Example Physical Topology">
+
+    graph "quad-ring" {
+        host [
+            label="host | { <d1a> d1a | <d1b> d1b | <d1c> d1c | <d2a> d2a | <d2b> d2b | <d2c> d2c | <d3a> d3a | <d3b> d3b | <d3c> d3c | <d4a> d4a | <d4b> d4b | <d4c> d4c }",
+            kind="controller",
+        ];
+
+        dut1 [
+            label="{ <e1> e1 | <e2> e2 | <e3> e3 } | dut1 | { <e4> e4 | <e5> e5 }",
+            kind="infix",
+        ];
+        dut2 [
+            label="{ <e1> e1 | <e2> e2 | <e3> e3 } | dut2 | { <e4> e4 | <e5> e5 }",
+            kind="infix",
+        ];
+        dut3 [
+            label="{ <e1> e1 | <e2> e2 | <e3> e3 } | dut3 | { <e4> e4 | <e5> e5 }",
+            kind="infix",
+        ];
+        dut4 [
+            label="{ <e1> e1 | <e2> e2 | <e3> e3 } | dut4 | { <e4> e4 | <e5> e5 }",
+            kind="infix",
+        ];
+
+        host:d1a -- dut1:e1
+        host:d1b -- dut1:e2
+        host:d1c -- dut1:e3
+
+        host:d2a -- dut2:e1
+        host:d2b -- dut2:e2
+        host:d2c -- dut2:e3
+
+        host:d3a -- dut3:e1
+        host:d3b -- dut3:e2
+        host:d3c -- dut3:e3
+
+        host:d4a -- dut4:e1
+        host:d4b -- dut4:e2
+        host:d4c -- dut4:e3
+
+        dut1:e5 -- dut2:e4
+        dut2:e5 -- dut3:e4
+        dut3:e5 -- dut4:e4
+        dut4:e5 -- dut1:e4
+    }
+
+Our test (in fact, all tests) receives the physical topology as an
+input parameter, and then maps the desired logical topology onto it,
+producing a mapping from logical nodes and ports to their physical
+counterparts.
+
+    {
+      "client1": "dut1",
+      "client1:mgmt": "dut1:e1",
+      "client1:srv": "dut1:e4",
+      "client2": "dut3",
+      "client2:mgmt": "dut3:e2",
+      "client2:srv": "dut3:e5",
+      "host": "host",
+      "host:c1": "host:d1a",
+      "host:c2": "host:d3b",
+      "host:srv": "host:d4c",
+      "server": "dut4",
+      "server:c1": "dut4:e5",
+      "server:c2": "dut4:e4",
+      "server:mgmt": "dut4:e3"
+    }
+
+With this information, the test knows that, in this particular
+environment, the server should be managed via the port called `d4c` on
+the node called `host`; that the port connected to the server on
+`client1` is `e4` on `dut1`, etc.  Thereby separating the
+implementation of the test from any specific physical setup.
+
+Testcases are not required to use a logical topology; they may choose
+to accept whatever physical topology its given, and dynamically
+determine the DUTs to use for testing.  As an example, an STP test
+could accept an arbitrary physical topology, run the STP algorithm on
+it offline, enable STP on all DUTs, and then verify that the resulting
+spanning tree matches the expected one.
+
+
+[9PM]:    https://github.com/rical/9pm
+[Qeneth]: https://github.com/wkz/qeneth
+[TAP]:    https://testanything.org/
@@ -11,6 +11,9 @@ local.mk:

 .PHONY: run
 run:
-	@$(BR2_EXTERNAL_INFIX_PATH)/qemu/qemu.sh $O
-
+	@$(BINARIES_DIR)/qemu.sh

+.PHONY: run-menuconfig
+run-menuconfig:
+	CONFIG_="CONFIG_" BR2_CONFIG="$(BINARIES_DIR)/.config" \
+		$(BUILD_DIR)/buildroot-config/mconf $(BINARIES_DIR)/Config.in
@@ -1,24 +1,18 @@
-source "$BR2_EXTERNAL_INFIX_PATH/package/cligen/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/clixon/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/confd/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/conmon/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/factory/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/faux/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/finit/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/ifupdown2/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/ifupdown-ng/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/klinfix/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/klish/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/klish-plugin-sysrepo/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/mdnsd/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/mech/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/net/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/osal/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/p-net/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/podman/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/profeth/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/python-templating/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/skeleton-init-finit/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-plugins-common/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-plugin-system/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/sysrest/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/tetris/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/umgmt/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/querierd/Config.in"
@@ -1,6 +0,0 @@
-config BR2_PACKAGE_CLIGEN
-	bool "cligen"
-	help
-	  CLIgen is a Command-Line Interface generator.
-
-	  https://github.com/clicon/cligen
@@ -1,2 +0,0 @@
-sha256  d56039f340a7a65db06b1f209df4e72503a9f9940a6901fa20aa43b33dea84f5  cligen-6.1.0.tar.gz
-sha256  dea515c12a123c00370347276a7e58f699c6861c1398f4c863a7facef2f86b23  LICENSE.md
@@ -1,14 +0,0 @@
-################################################################################
-#
-# cligen
-#
-################################################################################
-
-CLIGEN_VERSION = 6.1.0
-CLIGEN_SITE = $(call github,clicon,cligen,$(CLIGEN_VERSION))
-CLIGEN_LICENSE = Apache-2.0
-CLIGEN_LICENSE_FILES = LICENSE.md
-CLIGEN_INSTALL_STAGING = YES
-CLIGEN_CONF_OPTS = INSTALLFLAGS=" "
-
-$(eval $(autotools-package))
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`/var/lib/avahi-autoipd d 0755 avahi avahi - - - - -`