make tftpboot work on devices with old u-boot

Some devices have a U-boot variant that does not accept a third parameter on the "bootm" command, meaning we can't override the dtb in the bootloader so have to smush it back into the kernel image This is WIP because - still hardcodes MIPS - doesn't work in QEMU Based on https://gti.telent.net/raboof/liminix/src/branch/tftp-old-uboot Co-authored-by: Arnout Engelen <arnout@bzzt.net>
2024-02-15 20:12:03 +00:00
45 changed files with 232 additions and 2078 deletions
--- a/22
+++ b/22
@ -34,17 +34,13 @@ Upstream changes that have led to incompatible Liminix changes are:
 2024-01-30

 New port! Thanks to Arnout Engelen <arnout@bzzt.net>, Liminix
-now runs on the TP-Link Archer AX23.
+now runs on the TP-Link Archer AX23

 2024-02-12

-* We now build wifi drivers (mac80211) from the same kernel source as
+* we now build wifi drivers (mac80211) from the same kernel source as
 the running kernel, instead of using drivers from the linux-backports
-project.  This may be a regression on some devices that depend on
-OpenWrt patches for wireless functionality: if you have a device that
-used to work and now doesn't, refer to OpenWrt
-package/kernel/mac80211/patches/ to see if there's something in there
-that needs to be applied.
+project.

 * in general, we build kernel modules (e.g. for nftables) at the same
 time as the kernel itself instead of expecting to be able to build
@ -72,15 +68,3 @@ the old location to the new one before rebooting into the new system

 The `output`, `mkoutputs` functions defined by ${serviceFns}
 have been updated for the new location.
-
-2024-02-16
-
-New (or at least, previously unreported) port! Liminix now runs on the
-Turris Omnia and has been serving my family's internet needs for most
-of this week.  Thanks to NGI0 Entrust and the NLnet Foundation for
-sponsoring this development (and funding the hardware)
-
-2024-02-21
-
-New port! Thanks to Raito Bezarius, Liminix now runs on the Zyxel NWA50AX,
-an MT7621 (MIPS EL) dual radio WiFi AP. 
--- a/THOUGHTS.txt
+++ b/THOUGHTS.txt
@ -4077,215 +4077,3 @@ TODO items not to lose track of
 - finish belkin
 - install sniproxy
 - is there something simple we can do to make it reboot again?
- turn rotuer,extneder examples into "profiles" that don't embed
-  hardware specifics
-
-Thu Feb 15 11:50:56 GMT 2024
-
-1) to make tftpboot work with old bootm implementations we need
-
- compressed root
- uncompressed root
- kernel with dtb
- dtb needs to know where uncompressed rootfs is and how big
-
-2) if the image is a zImage (arm32) or an Image (arm64) we have to stick
-with the three-arg bootz, and the dtb has to be lower in ram than the kernel
-
-Fri Feb 16 15:43:32 GMT 2024
-
-DHCP6c refresh is still wrong. We get updates for an address that
-hasn't changed prefix or length, when the expiry times have changed,
-and we can't action that by remove;add because remove will wipe out
-any routes through the interface but add won't put them back
-
-We can use "change" for both adds and changes, but we need to know that
-a change is not a delete
-
-The "identity" of an address is the address itself: kernel won't
-let you add the same address with two different prefixes.
-
-Keeping it simple, we could call "change" on every address in the
-new-addresses list and "del" on every address in old-addresses
-that is no longer in new-addresses
-
-If the upstream has changed length, "ip addr change" is ignored,
-so it needs to be in deleted as well as added/changed
-
-Fri Feb 16 19:37:08 GMT 2024
-
-[    3.839775] cfg80211: module verification failed: signature and/or required key missing - tainting kernel
-[    4.156952] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
-[    4.165756] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
-[    4.399285] ath10k_pci 0000:00:00.0: qca9887 hw1.0 target 0x4100016d chip_id 0x004000ff sub 0000:0000
-[    4.408906] ath10k_pci 0000:00:00.0: kconfig debug 1 debugfs 0 tracing 0 dfs 0 testmode 0
-[    4.420096] ath10k_pci 0000:00:00.0: firmware ver 10.2.4-1.0-00047 api 5 features no-p2p,ignore-otp,ski
-p-clock-init,mfp,allows-mesh-bcast crc32 62f7565f
-[    4.467443] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 546cca0d
-[    5.472096] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 5 htt-op 2 cal file max-sta 128 raw 0 hwcrypto
-[    5.585796] ath: EEPROM regdomain: 0x0
-[    5.589712] ath: EEPROM indicates default country code should be used
-[    5.596364] ath: doing EEPROM country->regdmn map search
-[    5.601875] ath: country maps to regdmn code: 0x3a
-[    5.606831] ath: Country alpha2 being used: US
-[    5.611425] ath: Regpair used: 0x3a
-[    6.742365] ath10k_pci 0000:00:00.0: pdev param 0 not supported by firmware
-[    6.903389] random: hostapd: uninitialized urandom read (1027 bytes read)
-[    8.169901] ath10k_pci 0000:00:00.0: pdev param 0 not supported by firmware
-[   14.450193] ath10k_pci 0000:00:00.0: pdev param 0 not supported by firmware
-[   15.518682] random: hostapd: uninitialized urandom read (1027 bytes read)
-[   16.762697] ath10k_pci 0000:00:00.0: pdev param 0 not supported by firmware
-[   23.030622] ath10k_pci 0000:00:00.0: pdev param 0 not supported by firmware
-[
-
-
-Tue Feb 27 23:16:27 GMT 2024
-
-We made it a full week with rotuer running internet chez nous and no
-need for an intervention, so I am happy to call it "production". There are
-still things that need fixing but they're mostly within scope for
-a services refresh
-
-I have embarked on "profiles" by creating a wap.nix
-
-I think we could have a service module for resolvconf
-
-It would be good to build a wap.nix example for the belkin and we
-could start looking at ubifs
-
-I've lost a chunk of notes about using events to drive desired service
-state. There is probably only going to be one udev listener, so
-what if we have udev as a config key thusly
-
-udev.rules = [
-{
-  match = {
-   SUBSYSTEM = "rpmsg";
-    ATTR.name = "DATA5_CNTL";
-  };
-
-  service = longrun {
-    name = "lte-modem";
-    run = "blah blah blah";
-  };
-}
-
-# this one would be provided by the bridge module instead of
-# adding bridge member services to the default target
-
-{
-  match = {
-    SUBSYSTEM="net";
-    ID_PATH="pci-0000:04:00.0";
-    ATTR.operstate = "up";
-  };
-
-  service = oneshot {
-    up = "ip link set dev $dev master $(output ${primary} ifname)";
-    down = "ip link set dev $(output ${member} ifname) nomaster";
-  }
-}
-]
-
-This works for udev/sysfs, but we want a similar architecture(sic) for
-user-generated target state so we could have services that run on e.g.
-"is the ppp0 service healthy" or not. Probably there isn't a top-level
-config key for each service though
-
-services.wan = svc.ppoe.build   { .... };
-services.lte = watcher.build {
-  watching = services.wan;
-  match =  {
-    # an expression matching the outputs of the service
-    # to be watched
-    health = "failing";
-  };
-  service = oneshot {
-    run = "start_lte_blah";
-  };
-}
-
-thing is, we could use this syntax also for sysfs watches, but not vice versa
-
-... but it's not quite the same because here we're doing static matches
-on contents of files, whereas the udev one is a query expression on the
-sysfs database. we might need that flexibiity to implement "mount the
-backup drive no matter _which_ damn sda_n_ device it appears as". I don't
-know if there's the same need for service outputs - postulate the
-existence of a collection of services which are all similar enough that
-some other service can watch them all and do $something when one of
-the changes state. Or a single service with very complicated outputs.
-For example, something could watch the snmp database and update service
-status depending on what it finds. Or something something mqtt...
-
-we find that the "match" needs to be interpreted differently according
-to the thing being watched. perhaps the service being watched needs to
-provide a "watch me" interface somehow which accepts match criteria and
-outputs a true/false. Something else then needs to
-
-
-services.addmember = services.udev.watch {
-  match = {
-    SUBSYSTEM = "net";
-    ID_PATH = "pci-0000:04:00.0";
-    ATTR.operstate = "up";
-  };
-
-  service = oneshot {
-    up = "ip link set dev $dev master $(output ${primary} ifname)";
-    down = "ip link set dev $(output ${member} ifname) nomaster";
-  };
-}
-
-Sat Mar  2 15:37:29 GMT 2024
-
-Simply put, what I think it boils down to is that we want a service
-which acts as an actuator or control switch for another service,
-and will start/stop that controlled service according to some
-criteria.
-
-services.addmember = svc.network.ifwatch.build {
-  interface = config.hardware.networkInterfaces.lan1;
-
-  # this should be part of the definition not the params
-  service = oneshot {
-    name = "member-${bridge}-${interface}";
-    up = "ip link set dev $dev master $(output ${primary} ifname)";
-    down = "ip link set dev $(output ${member} ifname) nomaster";
-  };
-}
-
-we could start by writing this. we need to adapt ifwait
-
-Sun Mar  3 17:09:21 GMT 2024
-
-this is annoyingly hard to test. the tests we'd like to write are
-
-1) when it gets events that don't match the requirement, nothing happens
-2) when it gets an event that should start the service, the
-  service starts
-3) when stop should stop
-4) when start and already started, nothing happens
-5) when stop and already stopped, nothing happens
-
-what do we do if service fails to start? s6-rc will eventually reset it
-to "down", I think: do we need to take action?
-
-Mon Mar  4 20:46:55 GMT 2024
-
-# relevant but not correct for this model: https://www.forked.net/forums/viewtopic.php?f=13&t=3490
-
-# power on port 5
-snmpset -v 1 -c private  192.168.5.14 .1.3.6.1.4.1.318.1.1.4.4.2.1.3.5 integer 1
-
-# power off port 5
-snmpset -v 1 -c private  192.168.5.14 .1.3.6.1.4.1.318.1.1.4.4.2.1.3.5 integer 2
-
-# toggle off/on port 5
-snmpset -v 1 -c private  192.168.5.14 .1.3.6.1.4.1.318.1.1.4.4.2.1.3.5 integer 3
-
-Wed Mar  6 18:24:29 GMT 2024
-
-What happens when we attempt to start the service but it fails?  We
-assume the start was successful so we won't try and restart it again
-next time we get an event that should cause it to start.
--- a/ci.nix
+++ b/ci.nix
@ -9,14 +9,9 @@ let
  borderVmConf =  ./bordervm.conf-example.nix;
  inherit (pkgs.lib.attrsets) genAttrs;
  devices = [
-    "gl-ar750"
-    "gl-mt300a"
-    "gl-mt300n-v2"
-    "qemu"
-    "qemu-aarch64"
-    "qemu-armv7l"
+    "gl-ar750" "gl-mt300n-v2" "gl-mt300a"
+    "qemu" "qemu-aarch64" "qemu-armv7l"
    "tp-archer-ax23"
-    "zyxel-nwa50ax"
  ];
  vanilla = ./vanilla-configuration.nix;
  for-device = name:
--- a/default.nix
+++ b/default.nix
@ -3,7 +3,6 @@
 , liminix-config ? <liminix-config>
 , nixpkgs ? <nixpkgs>
 , borderVmConf ? ./bordervm.conf.nix
-, imageType ? "primary"
 }:

 let
@ -31,9 +30,6 @@ let
      ./modules/s6
      ./modules/users.nix
      ./modules/outputs.nix
-      {
-        boot.imageType = imageType;
-      }
    ];
  };
  config = eval.config;
--- a/devices/belkin-rt3200/default.nix
+++ b/devices/belkin-rt3200/default.nix
@ -73,7 +73,7 @@
        MTK_INFRACFG = "y";

        MTK_PMIC_WRAP = "y";
-        NVMEM_MTK_EFUSE="y";
+        MTK_EFUSE="y";
        # MTK_HSDMA="y";
        MTK_SCPSYS="y";
        MTK_SCPSYS_PM_DOMAINS="y";
@ -92,6 +92,7 @@

        MEDIATEK_GE_PHY = "y";
        # MEDIATEK_MT6577_AUXADC = "y";
+        # MEDIATEK_WATCHDOG = "y";
        NET_MEDIATEK_SOC = "y";
        NET_MEDIATEK_SOC_WED = "y";
        NET_MEDIATEK_STAR_EMAC = "y"; # this enables REGMAP_MMIO
--- a/devices/gl-ar750/default.nix
+++ b/devices/gl-ar750/default.nix
@ -74,7 +74,6 @@
      mac80211 = pkgs.kmodloader.override {
        targets = ["ath9k" "ath10k_pci"];
        inherit (config.system.outputs) kernel;
-        dependencies = [ ath10k_cal_data ];
      };
      ath10k_cal_data =
        let
@ -133,7 +132,7 @@
            };
            wlan5 = link.build {
              ifname = "wlan1";
-              dependencies = [ ath10k_cal_data mac80211  ];
+              dependencies = [ mac80211 ath10k_cal_data ];
            };
          };
      };
@ -162,8 +161,6 @@
        # OpenWrt kernel patches
        extraPatchPhase = ''
          ${openwrt.applyPatches.ath79}
-          sed -i.bak -e '\,include <linux/hw_random.h>,a #include <linux/gpio/driver.h>'  drivers/net/wireless/ath/ath9k/ath9k.h # context reqd for next patch
-          patch -p1 <  ${openwrt.src}/package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
        '';

        config = {
--- a/devices/zyxel-nwa50ax/a_image/mt7621_zyxel_nwa-ax-for-ab.dtsi
+++ b/devices/zyxel-nwa50ax/a_image/mt7621_zyxel_nwa-ax-for-ab.dtsi
@ -1,155 +0,0 @@
-#include "mt7621.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-
-/ {
-	aliases {
-		label-mac-device = &gmac0;
-	};
-};
-
-&nand {
-	status = "okay";
-
-	mediatek,nmbm;
-	mediatek,bmt-max-ratio = <15>;
-	mediatek,bmt-max-reserved-blocks = <64>;
-	mediatek,bmt-remap-range =
-		<0x0 0x980000>,
-		<0x2980000 0x7800000>;
-
-	partitions {
-		compatible = "fixed-partitions";
-		#address-cells = <1>;
-		#size-cells = <1>;
-
-		partition@0 {
-			label = "u-boot";
-			reg = <0x0 0x80000>;
-			read-only;
-		};
-
-		partition@80000 {
-			label = "u-boot-env";
-			reg = <0x80000 0x80000>;
-			read-only;
-		};
-
-		factory: partition@100000 {
-			label = "factory";
-			reg = <0x100000 0x80000>;
-			read-only;
-		};
-
-		partition@180000 {
-			label = "firmware_a";
-			reg = <0x180000 0x2800000>;
-
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "kernel_a";
-				reg = <0x0 0x800000>;
-			};
-
-			partition@400000 {
-				label = "ubi";
-				reg = <0x800000 0x2000000>;
-			};
-		};
-
-		partition@2980000 {
-			label = "firmware_b";
-			reg = <0x2980000 0x2800000>;
-
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "kernel_b";
-				reg = <0x0 0x800000>;
-			};
-
-			partition@400000 {
-				label = "ubi_b";
-				reg = <0x800000 0x2000000>;
-			};
-		};
-
-		partition@5180000 {
-			label = "rootfs_data";
-			reg = <0x5180000 0x1400000>;
-		};
-
-		partition@6580000 {
-			label = "logs";
-			reg = <0x6580000 0xd00000>;
-		};
-
-		partition@7280000 {
-			label = "vendor-myzyxel";
-			reg = <0x7280000 0x480000>;
-			read-only;
-		};
-
-		partition@7700000 {
-			label = "bootconfig";
-			reg = <0x7700000 0x80000>;
-		};
-
-		mrd: partition@7780000 {
-			label = "mrd";
-			reg = <0x7780000 0x80000>;
-			read-only;
-
-			nvmem-layout {
-				compatible = "fixed-layout";
-				#address-cells = <1>;
-				#size-cells = <1>;
-
-				macaddr_mrd_1fff8: macaddr@1fff8 {
-					reg = <0x1fff8 0x6>;
-				};
-			};
-		};
-	};
-};
-
-&pcie {
-	status = "okay";
-};
-
-&pcie1 {
-	wlan_5g: wifi@0,0 {
-		reg = <0x0 0 0 0 0>;
-		compatible = "mediatek,mt76";
-
-		mediatek,mtd-eeprom = <&factory 0x0>;
-		/* MAC-Address set in userspace */
-	};
-};
-
-&gmac0 {
-	nvmem-cells = <&macaddr_mrd_1fff8>;
-	nvmem-cell-names = "mac-address";
-};
-
-&switch0 {
-	ports {
-		port@4 {
-			status = "okay";
-			label = "lan";
-		};
-	};
-};
-
-&state_default {
-	gpio {
-		groups = "uart3";
-		function = "gpio";
-	};
-};
--- a/devices/zyxel-nwa50ax/b_image/mt7621_zyxel_nwa-ax-for-ab.dtsi
+++ b/devices/zyxel-nwa50ax/b_image/mt7621_zyxel_nwa-ax-for-ab.dtsi
@ -1,155 +0,0 @@
-#include "mt7621.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-
-/ {
-	aliases {
-		label-mac-device = &gmac0;
-	};
-};
-
-&nand {
-	status = "okay";
-
-	mediatek,nmbm;
-	mediatek,bmt-max-ratio = <15>;
-	mediatek,bmt-max-reserved-blocks = <64>;
-	mediatek,bmt-remap-range =
-		<0x0 0x980000>,
-		<0x2980000 0x7800000>;
-
-	partitions {
-		compatible = "fixed-partitions";
-		#address-cells = <1>;
-		#size-cells = <1>;
-
-		partition@0 {
-			label = "u-boot";
-			reg = <0x0 0x80000>;
-			read-only;
-		};
-
-		partition@80000 {
-			label = "u-boot-env";
-			reg = <0x80000 0x80000>;
-			read-only;
-		};
-
-		factory: partition@100000 {
-			label = "factory";
-			reg = <0x100000 0x80000>;
-			read-only;
-		};
-
-		partition@2980000 {
-			label = "firmware_b";
-			reg = <0x2980000 0x2800000>;
-
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "kernel_b";
-				reg = <0x0 0x800000>;
-			};
-
-			partition@400000 {
-				label = "ubi";
-				reg = <0x800000 0x2000000>;
-			};
-		};
-
-		partition@180000 {
-			label = "firmware_a";
-			reg = <0x180000 0x2800000>;
-
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "kernel_a";
-				reg = <0x0 0x800000>;
-			};
-
-			partition@400000 {
-				label = "ubi_a";
-				reg = <0x800000 0x2000000>;
-			};
-		};
-
-		partition@5180000 {
-			label = "rootfs_data";
-			reg = <0x5180000 0x1400000>;
-		};
-
-		partition@6580000 {
-			label = "logs";
-			reg = <0x6580000 0xd00000>;
-		};
-
-		partition@7280000 {
-			label = "vendor-myzyxel";
-			reg = <0x7280000 0x480000>;
-			read-only;
-		};
-
-		partition@7700000 {
-			label = "bootconfig";
-			reg = <0x7700000 0x80000>;
-		};
-
-		mrd: partition@7780000 {
-			label = "mrd";
-			reg = <0x7780000 0x80000>;
-			read-only;
-
-			nvmem-layout {
-				compatible = "fixed-layout";
-				#address-cells = <1>;
-				#size-cells = <1>;
-
-				macaddr_mrd_1fff8: macaddr@1fff8 {
-					reg = <0x1fff8 0x6>;
-				};
-			};
-		};
-	};
-};
-
-&pcie {
-	status = "okay";
-};
-
-&pcie1 {
-	wlan_5g: wifi@0,0 {
-		reg = <0x0 0 0 0 0>;
-		compatible = "mediatek,mt76";
-
-		mediatek,mtd-eeprom = <&factory 0x0>;
-		/* MAC-Address set in userspace */
-	};
-};
-
-&gmac0 {
-	nvmem-cells = <&macaddr_mrd_1fff8>;
-	nvmem-cell-names = "mac-address";
-};
-
-&switch0 {
-	ports {
-		port@4 {
-			status = "okay";
-			label = "lan";
-		};
-	};
-};
-
-&state_default {
-	gpio {
-		groups = "uart3";
-		function = "gpio";
-	};
-};
--- a/devices/zyxel-nwa50ax/default.nix
+++ b/devices/zyxel-nwa50ax/default.nix
@ -1,367 +0,0 @@
-{
-  system = {
-    crossSystem = {
-      config = "mipsel-unknown-linux-musl";
-      gcc = {
-        abi = "32";
-        arch = "mips32";          # mips32r2?
-      };
-    };
-  };
-
-  description = ''
-    Zyxel NWA50AX
-    ********************
-
-    Zyxel NWA50AX is quite close to the GL-MT300N-v2 "Mango" device, but it is based on the MT7621
-    chipset instead of the MT7628.
-
-    Installation
-    ============
-
-    This device is pretty, but, due to its A/B capabilities, can be a bit hard
-    to use completely.
-
-    The stock vendor firmware is a downstream fork of U-Boot: <https://github.com/RaitoBezarius/uboot-nwa50ax>
-    with restricted boot commands. Fortunately, OpenWrt folks figured out trivial command injections,
-    so you can use most of the OpenWrt commands without trouble by just command injecting
-    atns, atna or atnf, e.g. atns "; $real_command".
-
-    From factory web UI, you can upload the result of the zyxel-nwa-fit output.
-    From another operating system, you need to `dumpimage -T flat_dt -p 0 $zyxel-nwa-fit -o firmware.bin`,
-    `flash_erase $(mtd partition of the target partition firmware or zy_firmware) 0 0`, then you complete by
-    `nandwrite -p $(mtd partition of the target partition firmware or zy_firmware) firmware.bin`.
-
-    How to put the firmware.bin on the machine is left to you as an exercise, e.g. SSH, TFTP, whatever.
-
-    From serial, you have two choices:
-
-    - Flash this system via U-Boot:
-      same reasoning as from an existing Linux system, two choices:
-      - ymodem the binary, perform the write manually, you can inspire yourself
-      from the `script` contained in the vendor firmware, those are just a FIT containing a script.
-      - prepare a FIT containing a script executing your commands, tftpboot this.
-
-    - boot from an existing Liminix system, e.g. TFTPBOOT image.
-    - boot from an OpenWrt system, i.e. follow OpenWrt steps.
-
-    Once you are in a Linux system, understand that this device has A/B boot.
-
-    OpenWrt provides you with `zyxel-bootconfig` to set/unset the image status and choice.
-
-    The kernel is booted with `bootImage=<number>` which tells you which slot are you on.
-
-    You should find yourself with 10ish MTD partitions, the most interesting ones are two:
-
-    - firmware: 40MB
-    - firmware_1: 40MB
-
-    In the current setup, they are split further into kernel (8MB) and ubi (32MB).
-
-    Once you are done with first installation, note that if you want to use the A/B feature,
-    you need to write a _secondary_ image on the slot B. There is no proper flashing code
-    that will set the being-updated slot to `new` and boot on it to verify if it's working.
-    This is a WIP.
-
-    Upgrading your system can be achieved via:
-
-    - `liminix-rebuild` for the userspace.
-    - `flash_erase` + `nandwrite` for the kernelspace to the other slot than the one you are booted on,
-      note that you can just nandwrite the mtd partition corresponding to the *kernel* and not the whole firmware.
-
-    If you soft-bricked your AP, i.e. you cannot boot anything in U-Boot, no worries, just plug the serial console,
-    prepare a TFTP server (via `tufted` for example), download vendor firmware, set up `atns`, `atnf`, etc. and run `atnz`.
-
-    This will reflash everything back to normal via TFTP.
-
-    If you hard-bricked your AP, i.e. U-Boot is telling you to transfer a valid bootloader via ymodem, just extract
-    a U-Boot from the vendor OS, send it via ymodem and use the previous operations to perform a full flash this time
-    of all partitions.
-
-    Note that if you erased your MRD partition, you lost your serial and MAC address. There's no way to recover the original one
-    except by reading the physical label on your… device!
-
-    If you super-hard-bricked your AP, i.e. no output on serial console, congratulations, you reached one of the rare state
-    of this device. You need an external NAND flasher to repair it and write the first stage from Mediatek to continue the previous
-    recovery operations.
-
-    Development TODO list:
-
-    - Better support for upgrade automation w.r.t. to A/B, e.g. automagic scripts.
-    - Mount the logs partition, mount / as overlayfs of firmware ? rootfs and rootfs_data for extended data.
-    - Jitter-based entropy injection? Device can be slow to initialize its CRNG and hostapd will reject few clients at the start because of that.
-    - Defaults for hostapd based on MT7915 capabilities? See the example for one possible list.
-    - Remove primary/secondary hack and put it in preinit.
-    - Offer ways to reflash the *bootloader* itself to support direct boot via UBI and kernel upgrades via filesystem rewrite.
-
-    Vendor web page: https://www.zyxel.com/fr/fr/products/wireless/ax1800-wifi-6-dual-radio-nebulaflex-access-point-nwa50ax
-
-    OpenWrt web page: https://openwrt.org/inbox/toh/zyxel/nwa50ax
-    OpenWrt tech data: https://openwrt.org/toh/hwdata/zyxel/zyxel_nwa50ax
-
-  '';
-
-  module = { pkgs, config, lib, lim, ...}:
-    let
-      inherit (pkgs.liminix.networking) interface;
-      inherit (pkgs.liminix.services) oneshot;
-      inherit (pkgs.pseudofile) dir symlink;
-      inherit (pkgs) openwrt;
-
-      mac80211 = pkgs.mac80211.override {
-        drivers = [ "mt7915e" ];
-        klibBuild = config.system.outputs.kernel.modulesupport;
-      };
-      # v204520220929
-      wlan_firmware = pkgs.fetchurl {
-        url = "https://github.com/openwrt/mt76/raw/1b88dd07f153b202e57fe29734806744ed006b0e/firmware/mt7915_wa.bin";
-        hash = "sha256-wooyefzb0i8640+lwq3vNhcBXRFCtGuo+jiL7afZaKA=";
-      };
-      wlan_firmware' = pkgs.fetchurl {
-        url = "https://github.com/openwrt/mt76/raw/1b88dd07f153b202e57fe29734806744ed006b0e/firmware/mt7915_wm.bin";
-        hash = "sha256-k62nQewRuKjBLd5R3RxU4F74YKnQx5zr6gqMMImqVQw=";
-      };
-      wlan_firmware'' = pkgs.fetchurl {
-        url = "https://github.com/openwrt/mt76/raw/1b88dd07f153b202e57fe29734806744ed006b0e/firmware/mt7915_rom_patch.bin";
-        hash = "sha256-ifriAjWzFACrxVWCANZpUaEZgB/0pdbhnTVQytx6ddg=";
-      };
-    in {
-      imports = [ 
-        # We include it to ensure the bridge functionality
-        # is available on the target kernel.
-        ../../modules/bridge
-        ../../modules/arch/mipsel.nix
-        ../../modules/outputs/tftpboot.nix
-        ../../modules/outputs/zyxel-nwa-fit.nix
-        ../../modules/zyxel-dual-image
-      ];
-
-      filesystem = dir {
-        lib = dir {
-          firmware = dir {
-            mediatek = dir {
-              "mt7915_wa.bin" = symlink wlan_firmware;
-              "mt7915_wm.bin" = symlink wlan_firmware';
-              "mt7915_rom_patch.bin" = symlink wlan_firmware'';
-            };
-          };
-        };
-      };
-
-      rootfsType = "ubifs";
-      hardware = {
-        # Taken from OpenWRT
-        # root@OpenWrt:/# ubinfo /dev/ubi0
-        # ubi0
-        # Volumes count:                           2
-        # Logical eraseblock size:                 126976 bytes, 124.0 KiB
-        # Total amount of logical eraseblocks:     256 (32505856 bytes, 31.0 MiB)
-        # Amount of available logical eraseblocks: 0 (0 bytes)
-        # Maximum count of volumes                 128
-        # Count of bad physical eraseblocks:       0
-        # Count of reserved physical eraseblocks:  19
-        # Current maximum erase counter value:     2
-        # Minimum input/output unit size:          2048 bytes
-        # Character device major/minor:            250:0
-        # Present volumes:                         0, 1
-        ubi = {
-          minIOSize = "2048";
-          logicalEraseBlockSize = "126976";
-          physicalEraseBlockSize = "128KiB";
-          maxLEBcount = "256";
-        };
-
-        # This is a FIT containing a kernel padded and
-        # a UBI volume rootfs.
-        defaultOutput = "zyxel-nwa-fit";
-
-        loadAddress = lim.parseInt "0x80001000";
-        entryPoint = lim.parseInt "0x80001000";
-        # Aligned on 2kb.
-        alignment = 2048;
-
-        rootDevice = "ubi:rootfs";
-
-        dts = {
-          # Actually, this is not what we want.
-          # This DTS is insufficient.
-          src = ./mt7621_zyxel_nwa50ax.dtsi;
-          includes = [
-            # Here's one weird trick to make `ubi` detection
-            # out of the box.
-            # We will write ubi on /dev/firmware_a:rootfs location
-            # and same for /dev/firmware_b:rootfs.
-            # How do we distinguish both?
-            # We can just use the DTS to point ubi at A or B.
-            # This, unfortunately, means that we have "two images".
-            # But they are really just 1 image with 2 different DTS.
-            # TODO: improve this hack in preinit?
-            (if config.boot.imageType == "primary" then "${./a_image}" else "${./b_image}")
-            "${openwrt.src}/target/linux/ramips/dts"
-          ];
-        };
-        networkInterfaces =
-          let
-            inherit (config.system.service.network) link;
-          in {
-            eth = link.build { ifname = "eth0"; };
-            lan = link.build { ifname = "lan"; };
-            wlan0 = link.build {
-              ifname = "wlan0";
-              dependencies = [ mac80211 ];
-            };
-            wlan1 = link.build {
-              ifname = "wlan1";
-              dependencies = [ mac80211 ];
-            };
-          };
-      };
-
-      boot = {
-        # Critical because NWA50AX will extend your cmdline with the image number booted.
-        # and some bootloader version.
-        # You don't want to find yourself being overridden.
-        commandLineDtbNode = "bootargs-override";
-
-        imageFormat = "fit";
-        tftp = {
-          # 5MB is nice.
-          freeSpaceBytes = 5 * 1024 * 1024;
-          loadAddress = lim.parseInt "0x2000000";
-        };
-      };
-
-      # Dual image management service in userspace.
-      services.zyxel-dual-image = config.boot.zyxel-dual-image.build {
-        ensureActiveImage = "primary";
-        # TODO: use mtd names rather…
-        # primary and secondary are always /dev/mtd3 by virtue of the 
-        # dtb being not too wrong…
-        # TODO: remove this hack.
-        primaryMtdPartition = "/dev/mtd3";
-        secondaryMtdPartition = "/dev/mtd3";
-        bootConfigurationMtdPartition = "/dev/mtd12";
-      };
-
-      #  DEVICE_VENDOR := ZyXEL
-      #  KERNEL_SIZE := 8192k
-      #  DEVICE_PACKAGES := kmod-mt7915-firmware zyxel-bootconfig
-      #  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
-      #  IMAGES += factory.bin ramboot-factory.bin
-      #  IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | zyxel-nwa-fit
-      #  IMAGE/ramboot-factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi
-
-      kernel = {
-        src = pkgs.fetchurl {
-          name = "linux.tar.gz";
-          url = "https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.137.tar.gz";
-          hash = "sha256-PkdzUKZ0IpBiWe/RS70J76JKnBFzRblWcKlaIFNxnHQ=";
-        };
-        extraPatchPhase = ''
-          ${openwrt.applyPatches.ramips}
-
-        '';
-        config = {
-
-          RALINK = "y";
-          PCI = "y";
-          PHY_MT7621_PCI = "y";
-          PCIE_MT7621 = "y";
-          SOC_MT7621 = "y";
-          CLK_MT7621 = "y";
-          CLOCKSOURCE_WATCHDOG = "y";
-
-          SERIAL_8250_CONSOLE = "y";
-          SERIAL_8250 = "y";
-          SERIAL_CORE_CONSOLE = "y";
-          SERIAL_OF_PLATFORM = "y";
-          SERIAL_8250_NR_UARTS = "3";
-          SERIAL_8250_RUNTIME_UARTS = "3";
-          SERIAL_MCTRL_GPIO = "y";
-
-          CONSOLE_LOGLEVEL_DEFAULT = "8";
-          CONSOLE_LOGLEVEL_QUIET = "4";
-
-          # MTD_UBI_BEB_LIMIT = "20";
-          # MTD_UBI_WL_THRESHOLD = "4096";
-
-          MTD = "y";
-          MTD_BLOCK = "y";          # fix undefined ref to register_mtd_blktrans_dev
-          MTD_RAW_NAND = "y";
-          MTD_NAND_MT7621 = "y";
-          MTD_NAND_MTK_BMT = "y";      # Bad-block Management Table
-          MTD_NAND_ECC_SW_HAMMING= "y";
-          MTD_SPI_NAND= "y";
-          MTD_OF_PARTS = "y";
-          MTD_NAND_CORE= "y";
-          MTD_SPLIT_FIRMWARE= "y";
-          MTD_SPLIT_FIT_FW= "y";
-
-          PINCTRL = "y";
-          PINCTRL_MT7621 = "y";
-
-          I2C = "y";
-          I2C_MT7621 = "y";
-
-          SPI = "y";
-          MTD_SPI_NOR = "y";
-          SPI_MT7621 = "y";
-          SPI_MASTER = "y";
-          SPI_MEM = "y";
-
-          REGULATOR = "y";
-          REGULATOR_FIXED_VOLTAGE = "y";
-          RESET_CONTROLLER = "y";
-          POWER_RESET = "y";
-          POWER_RESET_GPIO = "y";
-          POWER_SUPPLY = "y";
-          LED_TRIGGER_PHY = "y";
-
-          PCI_DISABLE_COMMON_QUIRKS = "y";
-          PCI_DOMAINS = "y";
-          PCI_DOMAINS_GENERIC = "y";
-          PCI_DRIVERS_GENERIC = "y";
-          PCS_MTK_LYNXI = "y";
-
-          SOC_BUS = "y";
-
-          NET = "y";
-          ETHERNET = "y";
-          WLAN = "y";
-
-          PHYLIB = "y";
-          AT803X_PHY = "y";
-          FIXED_PHY = "y";
-          GENERIC_PHY = "y";
-          NET_DSA = "y";
-          NET_DSA_MT7530 = "y";
-          NET_DSA_MT7530_MDIO = "y";
-          NET_DSA_TAG_MTK = "y";
-          NET_MEDIATEK_SOC = "y";
-          NET_SWITCHDEV = "y";
-          NET_VENDOR_MEDIATEK = "y";
-
-          SWPHY = "y";
-
-          GPIOLIB = "y";
-          GPIO_MT7621 = "y";
-          OF_GPIO = "y";
-
-          EARLY_PRINTK = "y";
-
-          NEW_LEDS = "y";
-          LEDS_TRIGGERS = "y";
-          LEDS_CLASS = "y";         # required by rt2x00lib
-          LEDS_CLASS_MULTICOLOR = "y";
-          LEDS_BRIGHTNESS_HW_CHANGED = "y";
-
-          PRINTK_TIME = "y";
-        } // lib.optionalAttrs (config.system.service ? vlan) {
-          SWCONFIG = "y";
-        } // lib.optionalAttrs (config.system.service ? watchdog) {
-          RALINK_WDT = "y";  # watchdog
-          MT7621_WDT = "y";  # or it might be this one
-        };
-      };
-    };
-}
--- a/devices/zyxel-nwa50ax/mt7621_zyxel_nwa50ax.dtsi
+++ b/devices/zyxel-nwa50ax/mt7621_zyxel_nwa50ax.dtsi
@ -1,56 +0,0 @@
-#include "mt7621_zyxel_nwa-ax-for-ab.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-
-/ {
-	compatible = "zyxel,nwa50ax", "mediatek,mt7621-soc";
-	model = "ZyXEL NWA50AX";
-
-	aliases {
-		led-boot = &led_system_green;
-		led-failsafe = &led_system_red;
-		led-running = &led_system_green;
-		led-upgrade = &led_system_red;
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led_system_red: system_red {
-			label = "red:system";
-			gpios = <&gpio 6 GPIO_ACTIVE_HIGH>;
-		};
-
-		led_system_green: system_green {
-			label = "green:system";
-			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
-		};
-
-		system_blue {
-			label = "blue:system";
-			gpios = <&gpio 8 GPIO_ACTIVE_HIGH>;
-		};
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			gpios = <&gpio 30 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-		};
-	};
-};
-
-&ethernet {
-	pinctrl-0 = <&mdio_pins>, <&rgmii1_pins>;
-};
-
-&state_default {
-	gpio {
-		groups = "uart3", "rgmii2";
-		function = "gpio";
-	};
-};
--- a/examples/extneder.nix
+++ b/examples/extneder.nix
@ -11,6 +11,10 @@
  ...
 }: let
  secrets = import ./extneder-secrets.nix;
+  inherit (pkgs.liminix.services) oneshot longrun bundle target;
+  inherit (pkgs.pseudofile) dir symlink;
+  inherit (pkgs) dropbear ifwait serviceFns;
+  svc = config.system.service;
 in rec {
  boot = {
    tftp = {
@ -20,8 +24,12 @@ in rec {
  };

  imports = [
-    ../modules/profiles/wap.nix
+    ../modules/wlan.nix
    ../modules/vlan
+    ../modules/network
+    ../modules/hostapd
+    ../modules/bridge
+    ../modules/ssh
  ];

  hostname = "extneder";
@ -61,24 +69,68 @@ in rec {
    };
  };

-  profile.wap = {
-    interfaces =  with config.hardware.networkInterfaces; [
+  services.hostap = svc.hostapd.build {
+    interface = config.hardware.networkInterfaces.wlan;
+    params = {
+      country_code = "GB";
+      hw_mode = "g";
+      wmm_enabled = 1;
+      ieee80211n = 1;
+      inherit (secrets) ssid channel wpa_passphrase;
+      auth_algs = 1; # 1=wpa2, 2=wep, 3=both
+      wpa = 2; # 1=wpa, 2=wpa2, 3=both
+      wpa_key_mgmt = "WPA-PSK";
+      wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
+      rsn_pairwise = "CCMP"; # auth for wpa2
+    };
+  };
+
+  services.int = svc.bridge.primary.build {
+    ifname = "int";
+  };
+
+  services.dhcpc = svc.network.dhcp.client.build {
+    interface = services.int;
+    dependencies = [ config.services.hostname ];
+  };
+
+  services.bridge = svc.bridge.members.build {
+    primary = services.int;
+    members = with config.hardware.networkInterfaces; [
      lan
      wlan
    ];
+  };

-    wireless = {
-      networks.${secrets.ssid} = {
-        interface = config.hardware.networkInterfaces.wlan;
-        inherit (secrets) channel wpa_passphrase;
-        country_code = "GB";
-        hw_mode = "g";
-        wmm_enabled = 1;
-        ieee80211n = 1;
-      };
+  services.sshd = svc.ssh.build {};
+
+  services.resolvconf = oneshot rec {
+    dependencies = [ services.dhcpc ];
+    name = "resolvconf";
+    # CHECK: https://udhcp.busybox.net/README.udhcpc says
+    # 'A list of DNS server' but doesn't say what separates the
+    # list members. Assuming it's a space or other IFS character
+    up = ''
+      . ${serviceFns}
+      ( in_outputs ${name}
+      for i in $(output ${services.dhcpc} dns); do
+        echo "nameserver $i" > resolv.conf
+      done
+      )
+    '';
+  };
+  filesystem = dir {
+    etc = dir {
+      "resolv.conf" = symlink "${services.resolvconf}/.outputs/resolv.conf";
    };
  };

+  services.defaultroute4 = svc.network.route.build {
+    via = "$(output ${services.dhcpc} router)";
+    target = "default";
+    dependencies = [services.dhcpc];
+  };
+
  users.root.passwd = lib.mkForce secrets.root.passwd;
  defaultProfile.packages = with pkgs; [nftables strace tcpdump swconfig];
 }
--- a/examples/nwa50ax-ap.nix
+++ b/examples/nwa50ax-ap.nix
@ -1,120 +0,0 @@
-{ config, pkgs, ... } :
-let
-  inherit (pkgs.liminix.services) oneshot longrun bundle target;
-  inherit (pkgs) writeText;
-  svc = config.system.service;
-  secrets-1 = {
-    ssid = "Zyxel 2G (N)";
-    wpa_passphrase = "diamond dogs";
-  };
-  secrets-2 = {
-    ssid = "Zyxel 5G (AX)";
-    wpa_passphrase = "diamond dogs";
-  };
-  baseParams = {
-    country_code = "FR";
-    hw_mode = "g";
-    channel = 6;
-    wmm_enabled = 1;
-    ieee80211n = 1;
-    ht_capab = "[LDPC][GF][HT40-][HT40+][SHORT-GI-40][MAX-AMSDU-7935][TX-STBC]";
-    auth_algs = 1;
-    wpa = 2;
-    wpa_key_mgmt = "WPA-PSK";
-    wpa_pairwise = "TKIP CCMP";
-    rsn_pairwise = "CCMP";
-  };
-
-  modernParams = {
-    hw_mode = "a";
-    he_su_beamformer = 1;
-    he_su_beamformee = 1;
-    he_mu_beamformer = 1;
-    preamble = 1;
-    # Allow radar detection.
-    ieee80211d = 1;
-    ieee80211h = 1;
-    ieee80211ac = 1;
-    ieee80211ax = 1;
-    vht_capab = "[MAX-MPDU-7991][SU-BEAMFORMEE][SU-BEAMFORMER][RXLDPC][SHORT-GI-80][MAX-A-MPDU-LEN-EXP3][RX-ANTENNA-PATTERN][TX-ANTENNA-PATTERN][TX-STBC-2BY1][RX-STBC-1][MU-BEAMFORMER]";
-    vht_oper_chwidth = 1;
-    he_oper_chwidth = 1;
-    channel = 36;
-    vht_oper_centr_freq_seg0_idx = 42;
-    he_oper_centr_freq_seg0_idx = 42;
-    require_vht = 1;
-  };
-  mkWifiSta = params: interface: secrets: svc.hostapd.build {
-    inherit interface;
-      params = params // {
-        inherit (secrets) ssid wpa_passphrase;
-      };
-  };
-in rec {
-  imports = [
-    ../modules/wlan.nix
-    ../modules/network
-    ../modules/hostapd
-    ../modules/ssh
-    ../modules/ntp
-    ../modules/vlan
-    ../modules/bridge
-  ];
-
-  hostname = "zyxel";
-
-  users.root = {
-    # EDIT: choose a root password and then use
-    # "mkpasswd -m sha512crypt" to determine the hash.
-    # It should start wirh $6$.
-    passwd = "$y$j9T$f8GhLiqYmr3lc58eKhgyD0$z7P/7S9u.kq/cANZExxhS98bze/6i7aBxU6tbl7RMi.";
-    openssh.authorizedKeys.keys = [
-      # EDIT: you can add your ssh pubkey here
-      # "ssh-rsa AAAAB3NzaC1....H6hKd user@example.com";
-    ];
-  };
-
-  services.int = svc.bridge.primary.build {
-    ifname = "int";
-  };
-
-  services.bridge = svc.bridge.members.build {
-    primary = services.int;
-    members = with config.hardware.networkInterfaces; [
-      lan
-      wlan0
-      wlan1
-    ];
-  };
-
-  services.dhcpv4 =
-    let iface = services.int;
-    in svc.network.dhcp.client.build { interface = iface; };
-
-  services.defaultroute4 = svc.network.route.build {
-    via = "$(output ${services.dhcpv4} address)";
-    target = "default";
-    dependencies = [ services.dhcpv4 ];
-  };
-
-  services.packet_forwarding = svc.network.forward.build { };
-  services.sshd = svc.ssh.build {
-    allowRoot = true;
-  };
-
-  services.ntp = config.system.service.ntp.build {
-    pools = { "pool.ntp.org" = ["iburst"] ; };
-  };
-
-  boot.tftp = {
-    serverip = "192.0.2.10";
-    ipaddr = "192.0.2.12";
-  };
-
-  # wlan0 is the 2.4GHz interface.
-  services.hostap-1 = mkWifiSta baseParams config.hardware.networkInterfaces.wlan0 secrets-1;
-  # wlan1 is the 5GHz interface, e.g. AX capable.
-  services.hostap-2 = mkWifiSta (baseParams // modernParams) config.hardware.networkInterfaces.wlan1 secrets-2;
-
-  defaultProfile.packages = with pkgs; [ zyxel-bootconfig iw min-collect-garbage mtdutils ];
-}
--- a/examples/rotuer.nix
+++ b/examples/rotuer.nix
@ -200,15 +200,9 @@ in rec {
    nftables
    strace
    tcpdump
-    s6
  ];

-  programs.busybox = {
-    applets = [
-      "fdisk" "sfdisk"
-    ];
-    options = {
-      FEATURE_FANCY_TAIL = "y";
-    };
-  };
+  programs.busybox.applets = [
+    "fdisk" "sfdisk"
+  ];
 }
--- a/modules/all-modules.nix
+++ b/modules/all-modules.nix
@ -31,7 +31,6 @@
   ./ssh
   ./outputs/tftpboot.nix
   ./outputs/ubifs.nix
-   ./ubinize.nix
   ./users.nix
   ./vlan
   ./watchdog
--- a/modules/base.nix
+++ b/modules/base.nix
@ -58,15 +58,6 @@ in {
        default = [];
        description = "Kernel command line";
      };
-      commandLineDtbNode = mkOption {
-        type = types.enum [ "bootargs" "bootargs-override" ];
-        default = "bootargs";
-        description = "Kernel command line's devicetree node";
-      };
-      imageType = mkOption {
-        type = types.enum [ "primary" "secondary" ];
-        default = "primary";
-      };
      imageFormat = mkOption {
        type = types.enum ["fit" "uimage"];
        default = "uimage";
--- a/modules/busybox.nix
+++ b/modules/busybox.nix
@ -32,21 +32,23 @@ let
    (a: symlink "${busybox}/bin/busybox");
  minimalApplets = [
    # this is probably less minimal than it could be
-    "arch" "ash" "base64" "basename" "bc" "brctl" "bunzip2" "bzcat" "bzip2"
-    "cal" "cat" "chattr" "chgrp" "chmod" "chown" "chpst" "chroot" "clear" "cmp"
-    "comm" "cp" "cpio" "cut" "date" "dhcprelay" "dd" "df" "dirname" "dmesg"
-    "du" "echo" "egrep" "env" "expand" "expr" "false" "fdisk" "fgrep" "find"
-    "free" "fuser" "grep" "gunzip" "gzip" "head" "hexdump" "hostname" "hwclock"
-    "ifconfig" "ip" "ipaddr" "iplink" "ipneigh" "iproute" "iprule" "kill"
-    "killall" "killall5" "less" "ln" "ls" "lsattr" "lsof" "md5sum" "mkdir"
-    "mknod" "mktemp" "mount" "mv" "nc" "netstat" "nohup" "od" "pgrep" "pidof"
-    "ping" "ping6" "pkill" "pmap" "printenv" "printf" "ps" "pwd" "readlink"
-    "realpath" "reset" "rm" "rmdir" "route" "sed" "seq" "setsid" "sha1sum"
-    "sha256sum" "sha512sum" "sleep" "sort" "stat" "strings" "stty" "su" "sum"
-    "swapoff" "swapon" "sync" "tail" "tee" "test" "time" "touch" "tr"
-    "traceroute" "traceroute6" "true" "truncate" "tty" "udhcpc" "umount"
-    "uname" "unexpand" "uniq" "unlink" "unlzma" "unxz" "unzip" "uptime" "watch"
-    "wc" "whoami" "xargs" "xxd" "xz" "xzcat" "yes" "zcat"
+    "arch" "ash" "base64" "basename" "bc" "brctl" "bunzip2" "bzcat"
+    "bzip2" "cal" "cat" "chattr" "chgrp" "chmod" "chown" "chpst"
+    "chroot" "clear" "cmp" "comm" "cp" "cpio" "cut" "date" "dd" "df"
+    "dirname" "dmesg" "du" "echo" "egrep" "env" "expand" "expr"
+    "false" "fdisk" "fgrep" "find" "free" "fuser" "grep" "gunzip"
+    "gzip" "head" "hexdump" "hostname" "hwclock" "ifconfig" "ip"
+    "ipaddr" "iplink" "ipneigh" "iproute" "iprule" "kill" "killall"
+    "killall5" "less" "ln" "ls" "lsattr" "lsof" "md5sum" "mkdir"
+    "mknod" "mktemp" "mount" "mv" "nc" "netstat" "nohup" "od" "pgrep"
+    "pidof" "ping" "ping6" "pkill" "pmap" "printenv" "printf" "ps"
+    "pwd" "readlink" "realpath" "reset" "rm" "rmdir" "route" "sed"
+    "seq" "setsid" "sha1sum" "sha256sum" "sha512sum" "sleep" "sort"
+    "stat" "strings" "stty" "su" "sum" "swapoff" "swapon" "sync"
+    "tail" "tee" "test" "time" "touch" "tr" "traceroute" "traceroute6"
+    "true" "truncate" "tty" "udhcpc" "umount" "uname"
+    "unexpand" "uniq" "unlink" "unlzma" "unxz" "unzip" "uptime"
+    "watch" "wc" "whoami" "xargs" "xxd" "xz" "xzcat" "yes" "zcat"
  ];
 in {
  options = {
--- a/modules/dhcp6c/acquire-delegated-prefix.fnl
+++ b/modules/dhcp6c/acquire-delegated-prefix.fnl
@ -1,32 +1,40 @@
 (local { : system } (require :anoia))
 (local svc (require :anoia.svc))

-(fn deletions [old-addresses new-addresses]
-  (let [deleted {}]
+(fn changes [old-addresses new-addresses]
+  (let [added {}
+        deleted {}]
+    (each [n address (pairs new-addresses)]
+      (if (not (. old-addresses n))
+          (table.insert added address)))
    (each [n address (pairs old-addresses)]
-      (let [now (. new-addresses n)]
-        (if (or (not now) (not (= now.len address.len)))
-            (table.insert deleted address))))
-    deleted))
+      (if (not (. new-addresses n))
+          (table.insert deleted address)))
+    (values added deleted)))

-(fn update-prefixes [wan-device addresses new-addresses exec]
-  (each [_ p (ipairs (deletions addresses new-addresses))]
-    (exec
-     (.. "ip address del " p.address "1/" p.len " dev " wan-device)))
-  (each [_ p (pairs new-addresses)]
-    (exec
-     (.. "ip address change " p.address "1/" p.len
-         " dev " wan-device
-         " valid_lft " p.valid
-         " preferred_lft " p.preferred
-         )))
-  new-addresses)
+(fn update-prefixes [device prefixes new-prefixes]
+  (let [(added deleted) (changes prefixes new-prefixes)]
+    ;; if some address has changed (e.g. preferred/valid lifetime)
+    ;; then we don't want to delete it before re-adding it because
+    ;; the kernel will drop any routes that go through it. On the
+    ;; other hand, we can't add it _before_ deleting it as we'll
+    ;; get an error that it already exists. Therefore, use "change"
+    ;; instead of "add", it works a bit more like an upsert
+    (each [_ p (ipairs added)]
+      (system
+       (.. "ip address change " p.address "1/" p.len " dev " device
+           " valid_lft " p.valid
+           " preferred_lft " p.preferred
+           )))
+    (each [_ p (ipairs deleted)]
+      (system
+       (.. "ip address del " p.address "1/" p.len " dev " device)))))

 (fn run []
  (let [[state-directory lan-device] arg
        dir (svc.open state-directory)]
    (accumulate [addresses []
                 v (dir:events)]
-      (update-prefixes lan-device addresses (v:output "prefix") system))))
+      (update-prefixes lan-device addresses (v:output "prefix")))))

 { : changes : run }
--- a/modules/dhcp6c/acquire-wan-address-test.fnl
+++ b/modules/dhcp6c/acquire-wan-address-test.fnl
@ -5,45 +5,23 @@

 (local a1
       {
-        "2001-ab-cd-ef" {
-                      	 :address "2001:ab:cd:ef"
-                         :len "64"
-                         :preferred "3600"
-                         :valid "7200"
-                         }
-        }
-       )
-
-(local a156
-       {
-        "2001-ab-cd-ef" {
-                      	 :address "2001:ab:cd:ef"
-                         :len "56"
-                         :preferred "3600"
-                         :valid "7200"
-                         }
+        "2001-ab-cd-ef_hjgKHGhKJH" {
+                                    :address "2001:ab:cd:ef"
+                                    :len "64"
+                                    :preferred "200"
+                                    :valid "200"
+                                    }
        }
       )

 (local a2
       {
-        "2001-0-1-2-3" {
-                        :address "2001:0:1:2:3"
-                        :len "64"
-                        :preferred "3600"
-                        :valid "7200"
-                        }
-        }
-       )
-
-(local a21
-       {
-        "2001-0-1-2-3" {
-                        :address "2001:0:1:2:3"
-                        :len "64"
-                        :preferred "1800"
-                        :valid "5400"
-                        }
+        "2001-0-1-2-3_aNteBnb" {
+                                :address "2001:0:1:2:3"
+                                :len "64"
+                                :preferred "200"
+                                :valid "200"
+                                }
        }
       )

@ -52,85 +30,39 @@
    `(when (not ,assertion)
       (assert false ,msg))))

-(macro expect= [actual expected]
-  `(let [ve# (view ,expected)
-         va# (view ,actual)]
-     (when (not (= ve# va#))
-       (assert false
-               (.. "\nexpected " ve# "\ngot " va#)
-               ))))
-
 (fn first-address []
-  (let [deleted
-        (subject.deletions
+  (let [(add del)
+        (subject.changes
         { }
         a1
         )]
-    (expect= deleted [])))
+    (expect (= (# del) 0))
+    (expect (= (# add) 1))
+    (let [[first] add]
+      (expect (= first.address "2001:ab:cd:ef")))))

 (fn second-address []
-  (let [del
-        (subject.deletions
+  (let [(add del)
+        (subject.changes
         a1
         (merge (dup a1) a2)
         )]
-    (expect= del [])))
+    (expect (= (# del) 0))
+    (expect (= (# add) 1))
+    (let [[first] add] (expect (= first.address  "2001:0:1:2:3")))))

-(fn old-address-is-deleted []
-  (let [del
-        (subject.deletions
+(fn less-address []1
+  (let [(add del)
+        (subject.changes
         (merge (dup a1) a2)
         a1
         )]
-    (expect= (. del 1) (. a2 "2001-0-1-2-3"))
-    ))
+    (expect (= (# add) 0))
+    (expect (= (# del) 1))

-(fn changed-lifetime-not-deleted []
-  (let [del
-        (subject.deletions
-         (merge (dup a1) a2)
-         (merge (dup a1) a21)
-         )]
-    ;; when an address lifetime changes, "ip address change"
-    ;; will update that so it need not (should not) be deleted
-    (expect= del [])))
+    (let [[first] del] (expect (= first.address  "2001:0:1:2:3")))))

-(fn changed-prefix-is-deleted []
-  (let [del
-        (subject.deletions a1 a156)]
-    ;; when an address prefix changes, "ip address change"
-    ;; ignores that cjhange, so we have to remove the
-    ;; address before reinstating it
-    (expect= del [(. a1 "2001-ab-cd-ef")])))

 (first-address)
 (second-address)
-(old-address-is-deleted)
-(changed-lifetime-not-deleted)
-(changed-prefix-is-deleted)
-
-(let [cmds []]
-  (subject.update-addresses
-   "ppp0" a1 (merge (dup a1) a2)
-   (fn [a] (table.insert cmds a)))
-  (expect=
-   (doto cmds table.sort)
-   [
-    ;; order of changes is unimportant
-    "ip address change 2001:0:1:2:3/64 dev ppp0 valid_lft 7200 preferred_lft 3600"
-    "ip address change 2001:ab:cd:ef/64 dev ppp0 valid_lft 7200 preferred_lft 3600"
-    ]))
-
-(let [cmds []]
-  (subject.update-addresses
-   "ppp0" (merge (dup a1) a2) a1
-   (fn [a] (table.insert cmds a)))
-  (expect=
-   cmds
-   [
-    ;; deletes are executed before changes
-    "ip address del 2001:0:1:2:3/64 dev ppp0"
-    "ip address change 2001:ab:cd:ef/64 dev ppp0 valid_lft 7200 preferred_lft 3600"
-    ]))
-
-(print "OK")
+(less-address)
--- a/modules/dhcp6c/acquire-wan-address.fnl
+++ b/modules/dhcp6c/acquire-wan-address.fnl
@ -1,32 +1,40 @@
 (local { : system } (require :anoia))
 (local svc (require :anoia.svc))

-(fn deletions [old-addresses new-addresses]
-  (let [deleted {}]
-    (each [n address (pairs old-addresses)]
-      (let [now (. new-addresses n)]
-        (if (or (not now) (not (= now.len address.len)))
-            (table.insert deleted address))))
-    deleted))
+;; acquire-delegated-prefix has very similar code: we'd like to move
+;; this to anoia.svc when we see what the general form would look like

-(fn update-addresses [wan-device addresses new-addresses exec]
-  (each [_ p (ipairs (deletions addresses new-addresses))]
-    (exec
-     (.. "ip address del " p.address "/" p.len " dev " wan-device)))
-  (each [_ p (pairs new-addresses)]
-    (exec
-     (.. "ip address change " p.address "/" p.len
-         " dev " wan-device
-         " valid_lft " p.valid
-         " preferred_lft " p.preferred
-         )))
-  new-addresses)
+(fn changes [old-addresses new-addresses]
+  (let [added {}
+        deleted {}]
+    (each [n address (pairs new-addresses)]
+      (if (not (. old-addresses n))
+          (table.insert added address)))
+    (each [n address (pairs old-addresses)]
+      (if (not (. new-addresses n))
+          (table.insert deleted address)))
+    (values added deleted)))
+
+(fn update-addresses [wan-device addresses new-addresses]
+  (let [(added deleted) (changes addresses new-addresses)]
+    ;; see comment in acquire-delegated-prefix.fnl
+    (each [_ p (ipairs added)]
+      (system
+       (.. "ip address change " p.address "/" p.len
+           " dev " wan-device
+           " valid_lft " p.valid
+           " preferred_lft " p.preferred
+           )))
+    (each [_ p (ipairs deleted)]
+      (system
+       (.. "ip address del " p.address "/" p.len " dev " wan-device)))
+    new-addresses))

 (fn run []
  (let [[state-directory wan-device] arg
        dir (svc.open state-directory)]
    (accumulate [addresses []
                 v (dir:events)]
-      (update-addresses wan-device addresses (v:output "address") system))))
+      (update-addresses wan-device addresses (v:output "address")))))

-{ : update-addresses : deletions : run }
+{ : update-addresses : changes : run }
--- a/modules/dnsmasq/service.nix
+++ b/modules/dnsmasq/service.nix
@ -41,11 +41,10 @@ longrun {
    --no-hosts \
    --log-dhcp \
    --enable-ra \
+    --log-debug \
+    --log-queries \
    --log-facility=- \
    --dhcp-leasefile=$(mkstate ${name})/leases \
    --pid-file=/run/${name}.pid
  '';
-    # --log-debug \
-    # --log-queries \
-
 }
--- a/modules/hardware.nix
+++ b/modules/hardware.nix
@ -67,7 +67,6 @@ in {
      };
      loadAddress = mkOption { type = types.ints.unsigned; default = null; };
      entryPoint = mkOption { type = types.ints.unsigned; };
-      alignment = mkOption { type = types.nullOr  types.ints.unsigned; default = null; description = "Alignment passed to `mkimage` for FIT"; };
      radios = mkOption {
        description = ''
          Kernel modules (from mac80211 package) required for the
--- a/modules/outputs.nix
+++ b/modules/outputs.nix
@ -111,8 +111,7 @@ in
      };
      uimage = liminix.builders.uimage {
        commandLine = concatStringsSep " " config.boot.commandLine;
-        inherit (config.boot) commandLineDtbNode;
-        inherit (config.hardware) loadAddress entryPoint alignment;
+        inherit (config.hardware) loadAddress entryPoint;
        inherit (config.boot) imageFormat;
        inherit (o) kernel dtb;
      };
--- a/modules/outputs/tftpboot.nix
+++ b/modules/outputs/tftpboot.nix
@ -8,7 +8,6 @@ let
  inherit (lib) mkOption types concatStringsSep;
  cfg = config.boot.tftp;
  hw = config.hardware;
-  arch = pkgs.stdenv.hostPlatform.linuxArch;
 in {
  imports = [ ../ramdisk.nix ];
  options.boot.tftp = {
@ -132,7 +131,8 @@ in {
              cat ${o.kernel} > vmlinux.elf
              ${objcopy} --update-section .appended_dtb=dtb vmlinux.elf
              ${stripAndZip}
-              mkimage -A ${arch} -O linux -T kernel -C lzma -a $(hex ${toString hw.loadAddress}) -e $(hex ${toString hw.entryPoint}) -n '${lib.toUpper arch} Liminix Linux tftpboot' -d vmlinux.bin.lzma image
+              # TODO don't hardcode mips, entryPoint, loadAddress, name
+              mkimage -A mips -O linux -T kernel -C lzma -a $(hex ${toString hw.loadAddress}) -e $(hex ${toString hw.entryPoint}) -n 'MIPS Liminix Linux' -d vmlinux.bin.lzma image
              # dtc -I dtb -O dts -o /dev/stdout dtb | grep -A10 chosen ; exit 1
              tftpcmd="tftpboot $(hex $imageStart) result/image "
              bootcmd="bootm $(hex $imageStart)"
--- a/modules/outputs/ubifs.nix
+++ b/modules/outputs/ubifs.nix
@ -12,16 +12,9 @@ in
  imports = [
    ./initramfs.nix
  ];
-
-  options.system.outputs.rootubifs = mkOption {
-    type = types.package;
-    internal = true;
-  };
-
  options.hardware.ubi = {
    minIOSize = mkOption { type = types.str; };
-    logicalEraseBlockSize = mkOption { type = types.str; }; # LEB
-    physicalEraseBlockSize = mkOption { type = types.str; }; # PEB
+    eraseBlockSize = mkOption { type = types.str; }; # LEB
    maxLEBcount = mkOption { type = types.str; }; # LEB
  };

@ -33,7 +26,7 @@ in
    };
    boot.initramfs.enable = true;
    system.outputs = {
-      rootubifs =
+      rootfs =
        let
          inherit (pkgs.pkgsBuildBuild) runCommand mtdutils;
          cfg = config.hardware.ubi;
@ -42,7 +35,7 @@ in
        } ''
          mkdir tmp
          tree=${o.bootablerootdir}
-          mkfs.ubifs -x favor_lzo -c ${cfg.maxLEBcount} -m ${cfg.minIOSize} -e ${cfg.logicalEraseBlockSize}  -y -r $tree --output $out  --squash-uids -o $out
+          mkfs.ubifs -x favor_lzo -c ${cfg.maxLEBcount} -m ${cfg.minIOSize} -e ${cfg.eraseBlockSize}  -y -r $tree --output $out  --squash-uids -o $out
        '';
    };
  };
--- a/modules/outputs/ubivolume.nix
+++ b/modules/outputs/ubivolume.nix
@ -1,91 +0,0 @@
-{
-  config
-, pkgs
-, lib
-, ...
-}:
-let
-  inherit (pkgs) liminix;
-  inherit (lib) mkIf mkOption types concatStringsSep optionalString;
-in
-  {
-    imports = [
-      ./initramfs.nix
-      ./ubifs.nix
-    ];
-
-    options.hardware.ubi = {
-      minIOSize = mkOption { type = types.str; };
-      eraseBlockSize = mkOption { type = types.str; }; # LEB
-      maxLEBcount = mkOption { type = types.str; }; # LEB
-    };
-
-    config = mkIf (config.rootfsType == "ubifs") {
-      kernel.config = {
-        MTD_UBI="y";
-
-        UBIFS_FS = "y";
-        UBIFS_FS_SECURITY = "n";
-      };
-      boot.initramfs.enable = true;
-
-      system.outputs.rootfs =
-      let
-        inherit (pkgs.pkgsBuildBuild) runCommand;
-        ubiVolume = ({ name, volumeId, image, flags ? [] }:
-        ''
-          [${name}]
-          mode=ubi
-          vol_id=${toString volumeId}
-          vol_type=dynamic
-          vol_name=${name}
-          vol_alignment=1
-          ${optionalString (image != null) ''
-            image=${image}
-          ''}
-          ${optionalString (image == null) ''
-            vol_size=1MiB
-          ''}
-          ${optionalString (flags != []) ''
-            vol_flags=${concatStringsSep "," flags}
-          ''}
-        '');
-
-        ubiImage = (volumes:
-        let
-          ubinizeConfig = pkgs.writeText "ubinize.conf" (concatStringsSep "\n" volumes);
-          inherit (pkgs.pkgsBuildBuild) mtdutils;
-        in
-        runCommand "ubinize" {
-          depsBuildBuild = [ mtdutils ];
-          # block size := 128kb
-          # page size := 2048
-          # ubninize opts := -E 5
-        } ''
-          ubinize -Q "$SOURCE_DATE_EPOCH" -o $out \
-            -p ${config.hardware.ubi.physicalEraseBlockSize} -m ${config.hardware.ubi.minIOSize} \
-            -e ${config.hardware.ubi.logicalEraseBlockSize} \
-            ${ubinizeConfig}
-        '');
-
-        ubiDisk = ({ initramfs }:
-        let
-          initramfsUbi = ubiVolume {
-            name = "rootfs";
-            volumeId = 0;
-            image = initramfs;
-            flags = [ "autoresize" ];
-          };
-        in
-          ubiImage [
-            initramfsUbi
-          ]);
-
-        disk = ubiDisk {
-          initramfs = config.system.outputs.rootubifs; # liminix.builders.squashfs config.filesystem.contents; #           # assert this is a proper FIT.
-        };
-
-      in
-        disk;
-  };
-}
--- a/modules/outputs/zyxel-nwa-fit.nix
+++ b/modules/outputs/zyxel-nwa-fit.nix
@ -1,71 +0,0 @@
-{
-  config
-, pkgs
-, lib
-, ...
-}:
-let
-  inherit (lib) mkIf mkEnableOption mkOption types concatStringsSep;
-  models = "6b e1 6f e1 ff ff ff ff ff ff";
-in {
-  options.system.outputs = {
-    zyxel-nwa-fit = mkOption {
-      type = types.package;
-      description = ''
-zyxel-nwa-fit
-*************
-
-This output provides a FIT image for Zyxel NWA series
-containing a kernel image and an UBIFS rootfs.
-
-It can usually be used as a factory image to install Liminix
-on a system with pre-existing firmware and OS.
-      '';
-    };
-  };
-
-  imports = [
-    ./ubivolume.nix
-  ];
-
-  config = mkIf (config.rootfsType == "ubifs") {
-
-    system.outputs.zyxel-nwa-fit =
-      let 
-        o = config.system.outputs;
-        # 8129kb padding.
-        paddedKernel = pkgs.runCommand "padded-kernel" {} ''
-          cp --no-preserve=mode ${o.uimage} $out
-          dd if=/dev/zero of=$out bs=1 count=1 seek=8388607
-        '';
-        firmwareImage = pkgs.runCommand "firmware-image" {} ''
-          cat ${paddedKernel} ${o.rootfs} > $out
-        '';
-        dts = pkgs.writeText "image.its" ''
-        /dts-v1/;
-
-        / {
-          description = "Zyxel FIT (Flattened Image Tree)";
-          compat-models = [${models}];
-          #address-cells = <1>;
-
-          images {
-            firmware {
-              data = /incbin/("${firmwareImage}");
-              type = "firmware";
-              compression = "none";
-              hash@1 {
-                algo = "sha1";
-              };
-            };
-          };
-        };
-      '';
-      in
-      pkgs.runCommand "zyxel-nwa-fit-${config.boot.imageType}" {
-        nativeBuildInputs = [ pkgs.pkgsBuildBuild.ubootTools pkgs.pkgsBuildBuild.dtc ];
-      } ''
-        mkimage -f ${dts} $out
-      '';
-  };
-}
--- a/modules/profiles/wap.nix
+++ b/modules/profiles/wap.nix
@ -1,100 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  inherit (pkgs) liminix;
-  inherit (lib) mkEnableOption mkOption types isDerivation hasAttr ;
-
-  inherit (pkgs.liminix.services) oneshot longrun bundle target;
-  inherit (pkgs.pseudofile) dir symlink;
-  inherit (pkgs) serviceFns;
-  svc = config.system.service;
-  cfg = config.profile.wap;
-
-  hostaps =
-    let
-      defaults = {
-        auth_algs = 1; # 1=wpa2, 2=wep, 3=both
-        wpa = 2; # 1=wpa, 2=wpa2, 3=both
-        wpa_key_mgmt = "WPA-PSK";
-        wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
-        rsn_pairwise = "CCMP"; # auth for wpa2
-      };
-    in lib.mapAttrs'
-      (name : value :
-        let
-          attrs = defaults // { ssid = name; } // value;
-        in lib.nameValuePair
-          "hostap-${name}"
-          (svc.hostapd.build {
-            interface = attrs.interface;
-            params = lib.filterAttrs (k: v: k != "interface") attrs;
-          }))
-      cfg.wireless.networks;
-
-in {
-  imports = [
-    ../wlan.nix
-    ../network
-    ../hostapd
-    ../bridge
-    ../ssh
-    { config.services = hostaps; }
-  ];
-
-  options.profile.wap = {
-    interfaces = mkOption {
-      type = types.listOf liminix.lib.types.interface;
-      default = [];
-    };
-    wireless = mkOption {
-      type = types.attrsOf types.anything;
-    };
-  };
-  config = {
-    services.sshd = svc.ssh.build {};
-
-    services.int = svc.bridge.primary.build {
-      ifname = "int";
-    };
-
-    services.bridge = svc.bridge.members.build {
-      primary = config.services.int;
-      members = cfg.interfaces;
-    };
-
-    services.dhcpc = svc.network.dhcp.client.build {
-      interface = config.services.int;
-      dependencies = [ config.services.hostname ];
-    };
-
-    services.defaultroute4 = svc.network.route.build {
-      via = "$(output ${config.services.dhcpc} router)";
-      target = "default";
-      dependencies = [config.services.dhcpc];
-    };
-
-    services.resolvconf = oneshot rec {
-      dependencies = [ config.services.dhcpc ];
-      name = "resolvconf";
-      # CHECK: https://udhcp.busybox.net/README.udhcpc says
-      # 'A list of DNS server' but doesn't say what separates the
-      # list members. Assuming it's a space or other IFS character
-      up = ''
-        . ${serviceFns}
-        ( in_outputs ${name}
-        for i in $(output ${config.services.dhcpc} dns); do
-          echo "nameserver $i" > resolv.conf
-        done
-        )
-      '';
-    };
-    filesystem = dir {
-      etc = dir {
-        "resolv.conf" = symlink "${config.services.resolvconf}/.outputs/resolv.conf";
-      };
-    };
-  };
-}
--- a/modules/zyxel-dual-image/default.nix
+++ b/modules/zyxel-dual-image/default.nix
@ -1,60 +0,0 @@
-## Boot blessing via Zyxel
-## =======================
-## Boot blessing is the process to bless a particular boot configuration
-## It is commonly encountered in devices with redundant partitions
-## for automatic recovery of broken upgrades.
-## This is also known as A/B schemas, where A represents the primary partition
-## and B the secondary partition used for recovery.
-## To use boot blessing on Liminix, you need to have the support of
-## your bootloader to help you boot on the secondary partition in case of
-## failure on the primary partition. The exact details are specifics to your device.
-## See the Zyxel NWA50AX for an example.
-## TODO: generalize this module.
-{ config, lib, pkgs, ... }:
-let
-  inherit (lib) mkOption types;
-  inherit (pkgs) liminix;
-in
-{
-  options.boot.zyxel-dual-image = mkOption {
-    type = liminix.lib.types.serviceDefn;
-  };
-
-  config.boot.zyxel-dual-image = liminix.callService ./service.nix {
-    ensureActiveImage = mkOption {
-      type = types.enum [ "primary" "secondary" ];
-      default = "primary";
-      description = ''At boot, ensure that the active image is the one specified.
-
-        If you are already on a broken image, you need to manually boot
-        into the right image via `atgo <image index>` in U-Boot.
-      '';
-    };
-
-    kernelCommandLineSource = mkOption {
-      type = types.enum [ "/proc/cmdline" "/proc/device-tree/chosen/bootargs" ];
-      default = "/proc/device-tree/chosen/bootargs";
-      description = ''Kernel command line arguments source file.
-        On MIPS, Liminix embeds the kernel command line in /proc/device-tree/chosen/bootargs-override.
-
-        In this instance, it does not get concatenated with `/proc/cmdline`.
-        Therefore you may prefer to source it from another place, like `/proc/device-tree/chosen/bootargs`.
-      '';
-    };
-
-    primaryMtdPartition = mkOption {
-      type = types.str;
-      description = "Primary MTD partition device node, i.e. for image 0.";
-    };
-
-    secondaryMtdPartition = mkOption {
-      type = types.str;
-      description = "Secondary MTD partition device node, i.e. for image 1.";
-    };
-
-    bootConfigurationMtdPartition = mkOption {
-      type = types.str;
-      description = "Boot configuration MTD partition device node.";
-    };
-  };
-}
--- a/modules/zyxel-dual-image/service.nix
+++ b/modules/zyxel-dual-image/service.nix
@ -1,33 +0,0 @@
-{
-  liminix
-, lib
-, zyxel-bootconfig
-}:
-{ ensureActiveImage, primaryMtdPartition, secondaryMtdPartition, bootConfigurationMtdPartition, kernelCommandLineSource }:
-let
-  inherit (liminix.services) oneshot;
-  activeImageIndex = if ensureActiveImage == "primary" then 0 else 1;
-in oneshot {
-  name = "zyxel-boot-configure";
-  up = ''
-    set -- $(cat /proc/device-tree/chosen/bootargs)
-    for x in "$@"; do
-        case "$x" in
-            bootImage=*)
-            BOOT_IMAGE="''${x#bootImage=}"
-            echo "Current boot image is $BOOT_IMAGE."
-            ;;
-        esac
-    done
-
-    if test -z "$BOOT_IMAGE"; then
-      echo "No valid image was provided in the kernel command line."
-      exit 1
-    else
-      ${lib.getExe zyxel-bootconfig} ${bootConfigurationMtdPartition} set-image-status "$BOOT_IMAGE" valid
-      ${lib.getExe zyxel-bootconfig} ${bootConfigurationMtdPartition} set-active-image ${toString activeImageIndex}
-
-      echo "Active image is now ${ensureActiveImage}"
-    fi
-  '';
-}
--- a/overlay.nix
+++ b/overlay.nix
@ -104,7 +104,6 @@ extraPkgs // {
        "CONFIG_DRIVER_NL80211=y"
        "CONFIG_IAPP=y"
        "CONFIG_IEEE80211AC=y"
-        "CONFIG_IEEE80211AX=y"
        "CONFIG_IEEE80211N=y"
        "CONFIG_IEEE80211W=y"
        "CONFIG_INTERNAL_LIBTOMMATH=y"
--- a/pkgs/anoia/init.fnl
+++ b/pkgs/anoia/init.fnl
@ -1,7 +1,3 @@
-(fn assoc [tbl k v]
-  (tset tbl k v)
-  tbl)
-
 (fn merge [table1 table2]
  (collect [k v (pairs table2) &into table1]
    k v))
@ -20,7 +16,7 @@

 (fn system [s]
  (match (os.execute s)
-    res (do (print (.. "Executed \"" s "\", exit code " (tostring res)))  res)
+    res res
    (nil err) (error (.. "Error executing \"" s "\" (" err ")"))))

 (fn hash [str]
@ -66,4 +62,4 @@
    (s:sub 1 (- (# s) pad))))


-{ : assoc : merge : split : file-exists? : system : hash : base64url : dup }
+{ : merge : split : file-exists? : system : hash : base64url : dup }
--- a/pkgs/anoia/nl.fnl
+++ b/pkgs/anoia/nl.fnl
@ -1,15 +0,0 @@
-(local netlink (require :netlink))
-
-(local { : view } (require :fennel))
-
-(fn events [groups]
-  (let [sock (netlink.socket)]
-    (coroutine.wrap
-     (fn []
-       (each [_ e (ipairs (sock:query groups))]
-         (coroutine.yield e))
-       (while (sock:poll)
-         (each [_ e (ipairs (sock:event))]
-           (coroutine.yield e)))))))
-
-{ : events }
--- a/pkgs/anoia/test-nl.fnl
+++ b/pkgs/anoia/test-nl.fnl
@ -1,7 +0,0 @@
-(local nl (require :anoia.nl))
-(local { : view } (require :fennel))
-
-(let [events (nl.events {:link true})]
-  (each [ev events]
-    (print "got one ")
-    (print (view ev))))
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@ -79,7 +79,6 @@ in {
  lzma = callPackage ./lzma {};

  mac80211 = callPackage ./mac80211 {};
-  zyxel-bootconfig = callPackage ./zyxel-bootconfig {};
  min-collect-garbage = callPackage ./min-collect-garbage {};
  min-copy-closure = callPackage ./min-copy-closure {};
  netlink-lua = callPackage ./netlink-lua {};
--- a/pkgs/fennelrepl/default.nix
+++ b/pkgs/fennelrepl/default.nix
@ -8,14 +8,12 @@
 , writeScriptBin
 , linotify
 , anoia
-, netlink-lua
 , fennel
 }:
 let packages = [
      linotify
      anoia
      fennel
-      netlink-lua
      lua.pkgs.luafilesystem
    ];
    join = ps: builtins.concatStringsSep ";" ps;
--- a/pkgs/ifwait/events-fixture
+++ b/pkgs/ifwait/events-fixture
@ -1,195 +0,0 @@
-{:event "newlink"
- :hwaddr "00:00:00:00:00:00"
- :index 1
- :mtu 65536
- :name "lo"
- :running "yes"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "50:3e:aa:08:df:52"
- :index 2
- :mtu 1500
- :name "enp1s0"
- :running "no"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "1c:1b:0d:9c:39:2d"
- :index 3
- :mtu 1500
- :name "enp0s31f6"
- :running "yes"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "da:4d:53:c3:54:43"
- :index 4
- :mtu 1500
- :name "vbridge0"
- :running "yes"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "00:28:f8:69:fa:14"
- :index 6
- :mtu 1500
- :name "wlp4s0"
- :running "no"
- :stamp 857161382
- :up "no"}
-{:event "newlink"
- :hwaddr "02:42:b1:e6:e5:bd"
- :index 7
- :mtu 1500
- :name "br-7ddfef4820c5"
- :running "no"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "02:42:8d:d4:36:34"
- :index 8
- :mtu 1500
- :name "br-95da8b40a7cc"
- :running "yes"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "02:42:bc:cf:a8:5e"
- :index 9
- :mtu 1500
- :name "docker0"
- :running "no"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "b6:66:50:69:33:a6"
- :index 11
- :mtu 1500
- :name "veth2ff6ec3"
- :running "yes"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "e6:94:c8:48:f3:97"
- :index 13
- :mtu 1500
- :name "veth0913974"
- :running "yes"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "9a:87:d8:f2:c6:96"
- :index 15
- :mtu 1500
- :name "veth0e74156"
- :running "yes"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "5e:d2:92:b9:5f:6d"
- :index 17
- :mtu 1500
- :name "veth89a36b3"
- :running "yes"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "ca:88:3f:09:bc:51"
- :index 19
- :mtu 1500
- :name "veth73c1e0b"
- :running "yes"
- :stamp 857161382
- :up "yes"}
-{:event "newlink"
- :hwaddr "b6:7d:5c:38:89:1d"
- :index 21
- :mtu 1500
- :name "dummy0"
- :running "no"
- :stamp 857161382
- :up "no"}
-{:event "newlink"
- :hwaddr "52:f0:46:da:0c:0c"
- :index 22
- :mtu 1500
- :name "dummy1"
- :running "yes"
- :stamp 857161382
- :up "yes"}
-{:event "newneigh"
- :hwaddr "00:22:61:3d:f7:54"
- :index 4
- :ip "192.168.8.140"
- :probes 1
- :stamp 857165355
- :state "stale"}
-{:event "delneigh"
- :hwaddr "5c:60:ba:58:34:93"
- :index 3
- :stamp 857166891
- :state "stale"}
-{:event "newneigh"
- :hwaddr "80:64:6f:9e:15:02"
- :index 4
- :ip "192.168.8.161"
- :probes 1
- :stamp 857172523
- :state "stale"}
-{:event "newneigh"
- :hwaddr "e4:95:6e:42:c2:6c"
- :index 3
- :stamp 857174763
- :state "reachable"}
-{:event "newneigh"
- :hwaddr "e4:b3:18:76:1b:23"
- :index 4
- :ip "2001:8b0:de3a:40de:4708:c700:4de2:9264"
- :probes 1
- :stamp 857175595
- :state "stale"}
-{:event "newneigh"
- :hwaddr "80:64:6f:9e:10:c6"
- :index 4
- :ip "192.168.8.53"
- :probes 1
- :stamp 857176619
- :state "stale"}
-{:event "newneigh"
- :hwaddr "80:64:6f:9e:15:02"
- :index 4
- :ip "192.168.8.161"
- :probes 1
- :stamp 857177643
- :state "probe"}
-{:event "newneigh"
- :hwaddr "80:64:6f:9e:15:02"
- :index 4
- :ip "192.168.8.161"
- :probes 1
- :stamp 857177644
- :state "reachable"}
-{:event "newlink"
- :hwaddr "b6:7d:5c:38:89:1d"
- :index 21
- :mtu 1500
- :name "dummy0"
- :running "yes"
- :stamp 857178258
- :up "yes"}
-{:event "newlink"
- :hwaddr "b6:7d:5c:38:89:1d"
- :index 21
- :mtu 1500
- :name "dummy0"
- :running "no"
- :stamp 857181661
- :up "no"}
-{:event "newneigh"
- :hwaddr "80:64:6f:9e:10:c6"
- :index 4
- :ip "192.168.8.53"
- :probes 1
- :stamp 857182251
- :state "probe"}
--- a/pkgs/ifwait/ifwait.fnl
+++ b/pkgs/ifwait/ifwait.fnl
@ -1,64 +1,52 @@
-(local nl (require :anoia.nl))
-(local { : assoc : system } (require :anoia))
+(local netlink (require :netlink))
+(local sock (netlink.socket))

 ; (local { : view} (require :fennel))

+(fn assoc [tbl k v]
+  (tset tbl k v)
+  tbl)
+
 (fn parse-args [args]
  (match args
    ["-v" & rest]  (assoc (parse-args rest) :verbose true)
    ["-t" timeout & rest] (assoc (parse-args rest) :timeout (tonumber timeout))
-    ["-s" service & rest] (assoc (parse-args rest) :service service)
    [linkname "up"] {:link linkname :expecting "up"}
    [linkname "running"] {:link linkname :expecting "running"}
    [linkname "present"] {:link linkname :expecting "present"}
    [linkname nil] {:link linkname :expecting "present"}
    _  nil))

-(fn event-matches? [params v]
-  (let [got
-        (match v
-          ;; - up: Reflects the administrative state of the interface (IFF_UP)
-          ;; - running: Reflects the operational state (IFF_RUNNING).
-          {:event "newlink" :name params.link :up :yes :running :yes}
-          {:present true :up true :running true}
+(local parameters
+       (or
+        (parse-args arg)
+        (assert false (.. "Usage: " (. arg 0) " [-v] ifname [present|up|running]"))))

-          {:event "newlink" :name params.link :up :yes}
-          {:present :true :up true}
+(fn run-events [evs]
+  (each [_ v (ipairs evs)]
+    (let [got
+          (match v
+            ;; - up: Reflects the administrative state of the interface (IFF_UP)
+            ;; - running: Reflects the operational state (IFF_RUNNING).
+            {:event "newlink" :name parameters.link :up :yes :running :yes}
+            {:present true :up true :running true}

-          {:event "newlink" :name params.link}
-          {:present true }
+            {:event "newlink" :name parameters.link :up :yes}
+            {:present :true :up true}

-          _
-          {})]
-    (not (not (. got params.expecting)))))
+            {:event "newlink" :name parameters.link}
+            {:present true }

-(var up :unknown)
-(fn toggle-service [service wanted?]
-  (when (not (= up wanted?))
-    (set up
-         (if wanted?
-             (pcall system (.. "s6-rc -u change " service))
-             (not (pcall system (.. "s6-rc -d change " service)))))
-    ))
+            _
+            {})]
+      (when (. got parameters.expecting)
+        (os.exit 0)))))

-(fn run [args event-fn]
-  (set up :unknown)
-  (let [parameters
-        (assert (parse-args args)
-                (.. "Usage: ifwait [-v] ifname [present|up|running]"))]
-    (when parameters.verbose
-      (print (.. "ifwait: waiting for "
-                 parameters.link " to be " parameters.expecting)))

-    (if parameters.service
-        (each [e (event-fn)]
-          (if (= e.name parameters.link)
-              (toggle-service parameters.service (event-matches? parameters e))))
-        (each [e (event-fn)
-               &until (event-matches? parameters e)]
-          true))))
+(when parameters.verbose
+  (print (.. (. arg 0) ": waiting for "
+             parameters.link " to be " parameters.expecting)))

-(when (not (= (. arg 0) "test"))
-  (run arg #(nl.events {:link true})))
+(run-events (sock:query {:link true}))

-{ : run  }
+(while (sock:poll) (run-events (sock:event)))
--- a/pkgs/ifwait/test-ifwait.fnl
+++ b/pkgs/ifwait/test-ifwait.fnl
@ -1,119 +0,0 @@
-(local { : view &as fennel } (require :fennel))
-(local anoia (require :anoia))
-
-(var fake-system (fn [s] (print "executing " s)))
-(tset anoia :system #(fake-system $1))
-
-(macro expect= [actual expected]
-  `(let [ve# (view ,expected)
-         va# (view ,actual)]
-     (when (not (= ve# va#))
-       (assert false
-               (.. "\nexpected " ve# "\ngot " va#)
-               ))))
-
-(fn event-generator [events]
-  (coroutine.wrap
-   (fn []
-     (each [_ e (ipairs events)] (coroutine.yield e)))))
-
-(fn file-events [path]
-  (let [data (with-open [e (io.open path "r")] (e:read "*a"))
-        parse (fennel.parser data)]
-    (icollect [_ ast parse]
-      ast)))
-
-(set _G.arg (doto [] (tset 0 "test")))
-(local ifwait (require :ifwait))
-
-(let [gen (event-generator (file-events "events-fixture"))]
-  (ifwait.run ["dummy0" "up"] #gen)
-  (match (pcall gen)
-    (true _) true
-    (false msg) (error "didn't detect dummy0 up event")))
-
-(var upsies [])
-(set fake-system
-     (fn [s]
-       (if (s:match "-u change addmember")
-           (table.insert upsies :u)
-           (s:match "-d change addmember")
-           (table.insert upsies :d))))
-
-(fn newlink [name up running]
-  {:event "newlink"
-   :hwaddr "b6:7d:5c:38:89:1d"
-   :index (string.unpack ">i2" name)
-   :mtu 1500
-   : name
-   : running
-   :stamp 857161382
-   : up })
-
-"when it gets events that don't match the interface, nothing happens"
-
-(let [gen (-> [(newlink "eth1" "no" "no")] event-generator)]
-  (set upsies [])
-  (ifwait.run [ "-s" "addmember" "dummy0" "up"] #gen)
-  (expect= upsies []))
-
-"when it gets an event that should start the service, the service starts"
-
-(let [gen (->
-           [(newlink "dummy0" "no" "no")
-            (newlink "dummy0" "yes" "no")
-            (newlink "eth1" "no" "no")]
-           event-generator)]
-  (set upsies [])
-  (ifwait.run ["-s" "addmember" "dummy0" "up"] #gen)
-  (expect= upsies [:d :u]))
-
-"when it gets an event that should stop the service, the service stops"
-
-(let [gen (->
-           [(newlink "dummy0" "no" "no")
-            (newlink "dummy0" "yes" "no")
-            (newlink "dummy0" "no" "no")
-            ]
-           event-generator)]
-  (set upsies [])
-  (ifwait.run ["-s" "addmember" "dummy0" "up"] #gen)
-  (expect= upsies [:d :u :d]))
-
-"it does not call s6-rc again if the service is already in required state"
-
-(let [gen (->
-           [(newlink "dummy0" "no" "no")
-            (newlink "dummy0" "yes" "no")
-            (newlink "dummy0" "yes" "yes")
-            (newlink "dummy0" "yes" "yes")
-            (newlink "dummy0" "yes" "no")
-            (newlink "dummy0" "no" "no")
-            ]
-           event-generator)]
-  (set upsies [])
-  (ifwait.run ["-s" "addmember" "dummy0" "up"] #gen)
-  (expect= upsies [:d :u :d]))
-
-"it handles an error return from s6-rc"
-
-(set fake-system
-     (fn [s]
-       (if (s:match "-u change addmember")
-           (table.insert upsies :u)
-           (s:match "-d change addmember")
-           (table.insert upsies :d))
-       (error "false")
-       ))
-
-(let [gen (->
-           [(newlink "dummy0" "yes" "no")
-            (newlink "dummy0" "yes" "yes")
-            (newlink "dummy0" "yes" "yes")
-            (newlink "dummy0" "yes" "no")
-            (newlink "dummy0" "no" "no")
-            ]
-           event-generator)]
-  (set upsies [])
-  (ifwait.run ["-s" "addmember" "dummy0" "up"] #gen)
-  (expect= upsies [:u :u :u :u]))
--- a/pkgs/kernel/uimage.nix
+++ b/pkgs/kernel/uimage.nix
@ -15,12 +15,10 @@ let
 in {
  kernel
 , commandLine
-, commandLineDtbNode ? "bootargs"
 , entryPoint
 , extraName ? ""                # e.g. socFamily
 , loadAddress
 , imageFormat
-, alignment ? null
 , dtb ? null
 } : stdenv.mkDerivation {
  name = "kernel.image";
@ -41,7 +39,7 @@ in {
  '';
  mungeDtbPhase = ''
    dtc -I dtb -O dts -o tmp.dts ${dtb}
-    echo '/{ chosen { ${commandLineDtbNode} = ${builtins.toJSON commandLine}; }; };'  >> tmp.dts
+    echo '/{ chosen { bootargs = ${builtins.toJSON commandLine}; }; };'  >> tmp.dts
    dtc -I dts -O dtb -o tmp.dtb tmp.dts
  '';

@ -71,7 +69,7 @@ in {
        };
    };
    _VARS
-    mkimage -f mkimage.its ${lib.optionalString (alignment != null) "-B 0x${lib.toHexString alignment}"} kernel.uimage
+    mkimage -f mkimage.its kernel.uimage
    mkimage -l kernel.uimage
  '';

--- a/pkgs/kmodloader/default.nix
+++ b/pkgs/kmodloader/default.nix
@ -5,7 +5,6 @@
 , kernel ? null
 , runCommand
 , pkgsBuildBuild
-, dependencies ? []
 } :
 let
  inherit (liminix.services) oneshot;
@ -39,5 +38,4 @@ in oneshot {
  name = "kmodloader-"  + (concatStringsSep "-" targets);
  up = "sh ${loader}/load.sh";
  down = "sh ${loader}/unload.sh";
-  inherit dependencies;
 }
--- a/pkgs/min-copy-closure/liminix-rebuild.sh
+++ b/pkgs/min-copy-closure/liminix-rebuild.sh
@ -20,7 +20,7 @@ if toplevel=$(nix-build "$@" -A outputs.systemConfiguration --no-out-link); then
    echo systemConfiguration $toplevel
    min-copy-closure $target_host $toplevel
    $ssh_command $target_host $toplevel/bin/install
-    $ssh_command  $target_host "sync; source /etc/profile; reboot -f"
+    $ssh_command  $target_host "sync; source /etc/profile; reboot"
 else
    echo Rebuild failed
 fi
--- a/pkgs/odhcp-script/odhcp6-script.fnl
+++ b/pkgs/odhcp-script/odhcp6-script.fnl
@ -30,11 +30,17 @@
  (each [_ a (ipairs (split " " addresses))]
    (let [address (parse-address a)
          suffix (base64url (string.pack "n" (hash a)))
+          ;; keydir should be a function of all the address
+          ;; attributes: we want it to change whenever anything changes
+          ;; so that clients can see which addresses are new without
+          ;; deep table comparisons
          keydir (..
                  prefix
                  (-> address.address
                      (: :gsub "::$" "")
-                      (: :gsub ":" "-")))]
+                      (: :gsub ":" "-"))
+                  "_"
+                  suffix)]
      (mktree (.. state-directory "/" keydir))
      (each [k v (pairs address)]
        (write-value (.. keydir "/" k) v)))))
--- a/pkgs/openwrt/default.nix
+++ b/pkgs/openwrt/default.nix
@ -14,7 +14,6 @@ let
    cp -av ${src}/target/linux/generic/files/* .
    chmod -R u+w .
    cp -av ${src}/target/linux/${family}/files/* .
-    chmod -R u+w .
    test -d ${src}/target/linux/${family}/files-5.15/ && cp -av ${src}/target/linux/${family}/files-5.15/* .
    chmod -R u+w .
    patches() {
--- a/pkgs/zyxel-bootconfig/default.nix
+++ b/pkgs/zyxel-bootconfig/default.nix
@ -1,16 +0,0 @@
-{
-  stdenv
-, openwrt
-}:
-stdenv.mkDerivation {
-  name = "zyxel-bootconfig";
-  inherit (openwrt) src;
-  sourceRoot = "openwrt-source/package/utils/zyxel-bootconfig/src";
-  installPhase = ''
-    mkdir -p $out/bin
-    install -Dm544 zyxel-bootconfig $out/bin/zyxel-bootconfig
-  '';
-  meta = {
-    mainProgram = "zyxel-bootconfig";
-  };
-}
--- a/tests/tftpboot/test.nix
+++ b/tests/tftpboot/test.nix
@ -44,11 +44,7 @@ in {
  mipsLz = check  "qemu" {
    boot.tftp.compressRoot = true;
  };
-  # this works on real hardware but I haven't figured out how
-  # to make it work on qemu: it says
-  # "OF: fdt: No chosen node found, continuing without"
-
-  # mipsOldUboot = check  "qemu" {
-  #   boot.tftp.appendDTB = true;
-  # };
+  mipsOldUboot = check  "qemu" {
+    boot.tftp.appendDTB = true;
+  };
 }