Merge pull request #1298 from kernelkit/releng

Release Infix v25.11.0
Update ChangeLog for Infix v25.11.0 release
2026-07-23 17:33:01 +02:00 · 2025-12-02 16:01:15 +01:00 · 2025-12-02 15:52:54 +01:00 · 2025-12-02 15:22:43 +01:00 · 2025-12-02 14:11:01 +01:00 · 2025-12-02 14:11:00 +01:00
724 changed files with 13667 additions and 2521 deletions
@@ -3,41 +3,39 @@ Checklists for Pull Requests and Releases

 Maintainer checklists for reviewing pull requests and doing releases.

-
 Pull Requests
 -------------

- - If applicable, is there a readable ChangeLog entry?
- - If any LICENSE file has been updated, has the `.hash` file been updated?
- - If any change to a Finit `.svc` file, does any run/task linger?  
-   I.e., is there a runlevel and/or condition defined to prevent them
-   from running outside of their intended runlevel?
- - If any change to grub or qemu/qeneth setup, has it been tested in GNS3?
-   - If any change to u-boot/buildroot, has it been tested with `<booloader>_defconfig`
- - If any change to logging, have the resulting logs been audited?
-   - Check for duplicate entries, misspellings
-   - Check for sneaky severity changes, e.g., error vs note, error vs warning
- - If new subsystem, or major changes to a subsystem, have the docs been updated?
- - If change to mDNS, has it been tested with netbrowse?
- - If change to `_defconfig`, verify `local.mk` and sync with other archs
-   - Test manually as well, e.g., CLI changes do not have ha regression tests
-   - Build from distclean, or use artifacts built by build servers, for manual tests
-
+- If applicable, is there a readable ChangeLog entry?
+- If any LICENSE file has been updated, has the `.hash` file been updated?
+- If any change to a Finit `.svc` file, does any run/task linger?  
+  I.e., is there a runlevel and/or condition defined to prevent them
+  from running outside of their intended runlevel?
+- If any change to grub or qemu/qeneth setup, has it been tested in GNS3?
+  - If any change to u-boot/buildroot, has it been tested with `<booloader>_defconfig`
+- If any change to logging, have the resulting logs been audited?
+  - Check for duplicate entries, misspellings
+  - Check for sneaky severity changes, e.g., error vs note, error vs warning
+- If new subsystem, or major changes to a subsystem, have the docs been updated?
+- If change to mDNS, has it been tested with netbrowse?
+- If change to `_defconfig`, verify `local.mk` and sync with other archs
+  - Test manually as well, e.g., CLI changes do not have ha regression tests
+  - Build from distclean, or use artifacts built by build servers, for manual tests

 Releases
 --------

 Recommended checkpoints, use at your own discretion:

- - Make at least one -betaN release to verify the GitHub workflow well in time release day
-   - Stuff happens, remember kernelkit/infix#735
- - Make at least one -rcN to flush out any issues in customer repos
-   - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
- - Verify release artifacts (checksums, completeness, no corrupted files)
- - Test on actual hardware for at least one architecture
- - Review ChangeLog for completeness
- - Check for release-blocking issues
- - Verify generated GNS3 appliance, no marketplace update on -rc builds
- - Ensure the markdown link for the release diff is updated
- - Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
- - Sync tags for all repo. sync activities
+- Make at least one -betaN release to verify the GitHub workflow well in time release day
+  - Stuff happens, remember kernelkit/infix#735
+- Make at least one -rcN to flush out any issues in customer repos
+  - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
+- Verify release artifacts (checksums, completeness, no corrupted files)
+- Test on actual hardware for at least one architecture
+- Review ChangeLog for completeness
+- Check for release-blocking issues
+- Verify generated GNS3 appliance, no marketplace update on -rc builds
+- Ensure the markdown link for the release diff is updated
+- Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
+- Sync tags for all repo. sync activities
@@ -9,15 +9,15 @@ forms of collaboration as well.  [Let's talk!][support] :handshake:

 If you are unsure how to start implementing an idea or fix:

- - :bug: open an issue, there are human friendly templates for _bugs_
-   and _feature requests_ at <https://github.com/kernelkit/infix/issues>
- - :speech_balloon: use the [Q&A Forum][discuss]
- - :technologist: The [Developer's Guide][devguide] is also a useful start
+- :bug: open an issue, there are human friendly templates for _bugs_
+  and _feature requests_ at <https://github.com/kernelkit/infix/issues>
+- :speech_balloon: use the [Q&A Forum][discuss]
+- :technologist: The [Developer's Guide][devguide] is also a useful start

-> _Talking about code and problems first is often the best way to get
+> [!IMPORTANT]
+> Talking about code and problems first is often the best way to get
 > started before submitting a pull request.  We have found it always
-> saves time, yours and ours._
-
+> saves time, yours and ours.

 :sparkles: General Guidelines
 -----------------------------
@@ -27,21 +27,20 @@ version the change is made against, what it does, and, more importantly
 *why* -- from your perspective, why is it a bug, why does the code need
 changing in this way.  Start with why.

- - :bug: Bug reports need metadata like Infix version or commit hash
- - :adhesive_bandage: Bug fixes also need version, and (preferably) a
-   corresponding issue number for the ChangeLog
- - :new: New features, you need to get approval of the YANG model first!  
-   :speech_balloon: Please use the [Forum][discuss], e.g., category:
-   *Ideas*, or open a :pray: feature request issue
- - :white_check_mark: New features also need new regression tests, this
-   can be basic tests or more complex use-case tests comprising multiple
-   subsystems, see [Testing Changes](#test_tube-testing-changes), below
+- :bug: Bug reports need metadata like Infix version or commit hash
+- :adhesive_bandage: Bug fixes also need version, and (preferably) a
+  corresponding issue number for the ChangeLog
+- :new: New features, you need to get approval of the YANG model first!  
+  :speech_balloon: Please use the [Forum][discuss], e.g., category:
+  *Ideas*, or open a :pray: feature request issue
+- :white_check_mark: New features also need new regression tests, this
+  can be basic tests or more complex use-case tests comprising multiple
+  subsystems, see [Testing Changes](#test_tube-testing-changes), below

 Please take care to ensure you follow the project coding style and the
 commit message format.  If you follow these recommendations you help
 the maintainers and make it easier for them to include your code.

-
 :woman_technologist: Coding Style
 ---------------------------------

@@ -51,39 +50,40 @@ and it is expected that you provide a human-readable summary for the
 release notes (ChangeLog) and at least a configuration example in the
 manual for new features.

-> **Tip:** consider ["Readme driven development"][RDD] for new features.
-> It is amazing how many flaws in your own bright ideas come to bare
-> when you suddenly have to explain them to someone else!
+> [!TIP]
+> Consider ["Readme driven development"][RDD] for new features.  It is
+> amazing how many flaws in your own bright ideas come to bare when you
+> suddenly have to explain them to someone else!

 We expect code contributions for:

- - C code in [Linux Coding Style][Linux]
- - Python code should follow [PEP-8][]
+- C code in [Linux Coding Style][Linux]
+- Python code should follow [PEP-8][]

+> [!IMPORTANT]
 > **However,** always submit code that follows the style of surrounding
 > code!  Legacy takes precedence, and remember, we read code a lot more
 > than write it, so legibility is important.

 The ChangeLog deserves a separate mention:

- - Releases are listed in reverse chronological order order, so the
-   latest/next release is at the beginning of the file
- - Only *user-facing bugs and features* are detailed, so code refactor,
-   new tests, etc. are not listed.
- - Add your changes/features to the Changes section
- - Add your Fix line in the Fixes section, in numeric order 
- - Changes and fixes without an issue number are listed after all
-   numbered ones
- - YANG model changes are documented in their respective model, for
-   standard models, e.g., for `ietf-interfaces.yang`, the corresponding
-   `infix-interfaces.yang` detail augments/deviations as revisions.
+- Releases are listed in reverse chronological order order, so the
+  latest/next release is at the beginning of the file
+- Only *user-facing bugs and features* are detailed, so code refactor,
+  new tests, etc. are not listed.
+- Add your changes/features to the Changes section
+- Add your Fix line in the Fixes section, in numeric order
+- Changes and fixes without an issue number are listed after all
+  numbered ones
+- YANG model changes are documented in their respective model, for
+  standard models, e.g., for `ietf-interfaces.yang`, the corresponding
+  `infix-interfaces.yang` detail augments/deviations as revisions.

 A final note, lines of code are allowed to be longer than 72 characters
 these days, unless you live by PEP-8 (see above).  There is no enforced
 maximum, but the team usually keep it around 100 characters for both C
 and Python.

-
 :test_tube: Testing Changes
 ---------------------------

@@ -97,9 +97,8 @@ the same pull request.

 For help getting started with testing, see the following resources:

- - [Developer's Guide][devguide]
- - [Regression Testing][testing]
-
+- [Developer's Guide][devguide]
+- [Regression Testing][testing]

 :memo: Commit Messages
 ----------------------
@@ -110,45 +109,135 @@ proud of your work and set up a proper GIT identity for your commits:

 <img src="../doc/jack.png" width=70 align="right">

-    $ git config --global user.name "Jacky Linker"
-    $ git config --global user.email jacky.linker@example.com
+```bash
+$ git config --global user.name "Jacky Linker"
+$ git config --global user.email jacky.linker@example.com
+```

 Example commit message from one of many [online guides][cbeams].  Use
 `git commit -s` to automatically add a `Signed-off-by` for proof of
 origin, see [DCO][] for more info.

-    subsystem: brief, but clear and concise summary of changes
-    
-    More detailed explanatory text, if necessary.  Wrap it to about 72
-    characters or so.  In some contexts, the first line is treated as
-    the subject of an email and the rest of the text as the body.  The
-    empty line separating summary from body is critical.  Tools like
-    rebase can get confused if the empty line is missing.
-    
-    Further paragraphs should be separated with empty lines.
-    
-     - Bullet points are okay, too
-    
-     - Typically a hyphen or asterisk is used for the bullet, preceded
-       by a single space, with blank lines in between, but conventions
-       vary here
+```text
+subsystem: brief, but clear and concise summary of changes

-	If you use an issue tracker, put references to them at the bottom,
-	like this:
+More detailed explanatory text, if necessary.  Wrap it to about 72
+characters or so.  In some contexts, the first line is treated as
+the subject of an email and the rest of the text as the body.  The
+empty line separating summary from body is critical.  Tools like
+rebase can get confused if the empty line is missing.

-	Resolves: #123
-	See also: #456, #789
+Further paragraphs should be separated with empty lines.

-    Signed-off-by: Jacky Linker <jacky.linker@example.com>
+ - Bullet points are okay, too
+
+ - Typically a hyphen or asterisk is used for the bullet, preceded
+   by a single space, with blank lines in between, but conventions
+   vary here
+
+If you use an issue tracker, put references to them at the bottom,
+like this:
+
+Resolves: #123
+See also: #456, #789
+
+Signed-off-by: Jacky Linker <jacky.linker@example.com>
+```

 This is an example of how to [automatically close][closing] an issue
 when the commit is merged to mainline.  Several keywords are available.

+:lock_with_ink_pen: Signing Commits with GPG
+---------------------------------------------
+
+To ensure the authenticity and integrity of your contributions, we
+**require** all commits to be signed with GPG.  This cryptographically
+verifies that commits come from a trusted source.
+
+### Generating a GPG Key
+
+If you don't already have a GPG key, generate one:
+
+```bash
+$ gpg --full-generate-key
+```
+
+When prompted, choose:
+- Key type: `RSA and RSA` (default)
+- Key size: `4096` bits (recommended for security)
+- Expiration: `0` (key does not expire)
+- Real name and email: Use the same email as your Git configuration
+
+> [!NOTE]
+> We recommend keys that do not expire for signing commits.  Expiration
+> creates a "usability time bomb" without providing meaningful security
+> benefits for code signing.  See [this article][pgpfan] for details.
+
+### Configuring Git to Sign Commits
+
+First, find your GPG key ID:
+
+```bash
+$ gpg --list-secret-keys --keyid-format=long
+```
+
+Look for the line starting with `sec`, the key ID is the part after the `/`.
+For example, in `sec   rsa4096/ABCD1234EFGH5678`, the key ID is `ABCD1234EFGH5678`.
+
+Configure Git to use your GPG key:
+
+```bash
+$ git config --global user.signingkey ABCD1234EFGH5678
+$ git config --global commit.gpgsign true
+```
+
+The second command enables automatic signing for all commits.  Alternatively,
+you can sign individual commits with `git commit -S`.
+
+### Publishing Your Public Key
+
+To allow others to verify your signatures, publish your public key to a
+keyserver:
+
+```bash
+$ gpg --keyserver hkps://keys.openpgp.org --send-keys ABCD1234EFGH5678
+```
+
+> [!IMPORTANT]
+> The keyserver will send a verification email to the address associated
+> with your key.  You **must** click the link in that email to confirm
+> ownership before your key becomes searchable by email address.
+
+Alternative keyservers you can use:
+- `hkps://keyserver.ubuntu.com`
+- `hkps://pgp.mit.edu`
+
+### Adding Your GPG Key to GitHub
+
+For GitHub to show your commits as "Verified", you need to add your public
+key to your account:
+
+1. Export your public key:
+   ```bash
+   $ gpg --armor --export ABCD1234EFGH5678
+   ```
+
+2. Copy the entire output, including the `-----BEGIN PGP PUBLIC KEY BLOCK-----`
+   and `-----END PGP PUBLIC KEY BLOCK-----` lines.
+
+3. Go to [GitHub Settings → SSH and GPG keys](https://github.com/settings/keys)
+
+4. Click **New GPG key** and paste your public key.
+
+Now your signed commits will display a "Verified" badge on GitHub! :white_check_mark:
+
+For more details, see GitHub's [official documentation on commit signature verification][gpg-verify].

 :twisted_rightwards_arrows: Pull Requests
 -----------------------------------------

-> _The git repository is the canonical location for information._
+> [!NOTE]
+> _The git repository is the canonical location for all information._

 A pull request should preferably address a single issue or change.  This
 may of course include multiple related changes, but what is important to
@@ -167,7 +256,6 @@ Buildroot, consider the pull request message body similar to the cover
 letter for a series of patches -- it's a summary of changes, and it is
 lost when the changes are merged to the mainline branch.

-
 :balance_scale: Code of Conduct
 -------------------------------

@@ -184,6 +272,8 @@ other contributions that are not aligned to this Code of Conduct."*
 [PEP-8]:    https://peps.python.org/pep-0008/
 [RDD]:      https://tom.preston-werner.com/2010/08/23/readme-driven-development
 [cbeams]:   https://cbea.ms/git-commit/#seven-rules
-[conduct]:  CODE-OF-CONDUCT.md
-[DCO]:      https://developercertificate.org/
-[closing]:  https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
+[conduct]:    CODE-OF-CONDUCT.md
+[DCO]:        https://developercertificate.org/
+[closing]:    https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
+[gpg-verify]: https://docs.github.com/en/authentication/managing-commit-signature-verification
+[pgpfan]:     https://articles.59.ca/doku.php?id=pgpfan:expire
@@ -17,7 +17,8 @@ jobs:
      matrix:
        defconfig:
          - aarch64_qemu_boot
-          - bpi_r3_boot
+          - bpi_r3_sd_boot
+          - bpi_r3_emmc_boot
          - cn9130_crb_boot
          - fireant_boot
          - nanopi_r2s_boot
@@ -1,4 +1,4 @@
-name: Create SD Card Images
+name: Create SD Card & eMMC Images

 on:
  workflow_dispatch:
@@ -56,21 +56,33 @@ jobs:
            raspberrypi-rpi64)
              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=false" >> $GITHUB_ENV
              ;;
            bananapi-bpi-r3)
-              echo "BOOTLOADER=bpi_r3_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_SD=bpi_r3_sd_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi_r3_emmc_boot" >> $GITHUB_ENV
              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
              ;;
            friendlyarm-nanopi-r2s)
              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=false" >> $GITHUB_ENV
              ;;
            *)
              echo "Error: Unknown board ${{ inputs.board }}"
              exit 1
              ;;
          esac
-          echo "Using bootloader: $BOOTLOADER and target: $TARGET for board: ${{ inputs.board }}"
+          echo "Target: $TARGET for board: ${{ inputs.board }}"
+          if [ "$BUILD_EMMC" = "true" ]; then
+            echo "Building both SD and eMMC images"
+            echo "SD Bootloader: $BOOTLOADER_SD"
+            echo "eMMC Bootloader: $BOOTLOADER_EMMC"
+          else
+            echo "Building SD image only"
+            echo "Bootloader: $BOOTLOADER"
+          fi

      - name: Download bootloader artifacts
        if: ${{ !inputs.use_latest_release }}
@@ -79,16 +91,41 @@ jobs:
          gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
          BOOT_RUN_ID=$(cat latest_boot_run_id)

-          gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Download both SD and eMMC bootloaders for boards that support both
+            echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_SD} --dir temp_bootloader_sd/
+            mkdir -p output_sd/images
+            cd temp_bootloader_sd/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            cd ../
+            rm -rf temp_bootloader_sd/

-          # Extract bootloader directly to output/images
-          cd temp_bootloader/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_bootloader/
+            echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_EMMC} --dir temp_bootloader_emmc/
+            mkdir -p output_emmc/images
+            cd temp_bootloader_emmc/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_bootloader_emmc/

-          echo "Bootloader files extracted to output/images:"
-          ls -la output/images/
+            echo "SD bootloader files:"
+            ls -la output_sd/images/
+            echo "eMMC bootloader files:"
+            ls -la output_emmc/images/
+          else
+            # Single bootloader for boards that only support SD
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
+
+            # Extract bootloader directly to output/images
+            cd temp_bootloader/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_bootloader/
+
+            echo "Bootloader files extracted to output/images:"
+            ls -la output/images/
+          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

@@ -99,90 +136,193 @@ jobs:
          gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
          INFIX_RUN_ID=$(cat latest_infix_run_id)

-          gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Copy Infix artifacts to both SD and eMMC output directories
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/

-          # Extract Infix directly to output/images
-          cd temp_infix/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_infix/

-          echo "Infix files extracted to output/images:"
-          ls -la output/images/
+            echo "Infix files extracted to output_sd/images:"
+            ls -la output_sd/images/
+            echo "Infix files extracted to output_emmc/images:"
+            ls -la output_emmc/images/
+          else
+            # Single output directory for SD-only boards
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+
+            # Extract Infix directly to output/images
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "Infix files extracted to output/images:"
+            ls -la output/images/
+          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Download from latest releases
        if: ${{ inputs.use_latest_release }}
        run: |
-          # Download latest bootloader release
-          gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
-          cd temp_bootloader/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_bootloader/
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Download both SD and eMMC bootloaders
+            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            mkdir -p output_sd/images
+            cd temp_bootloader_sd/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            cd ../
+            rm -rf temp_bootloader_sd/

-          # Download latest Infix release
-          gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
-          cd temp_infix/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_infix/
+            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            mkdir -p output_emmc/images
+            cd temp_bootloader_emmc/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_bootloader_emmc/

-          echo "All files extracted to output/images:"
-          ls -la output/images/
+            # Download Infix once and extract to both directories
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "SD files extracted to output_sd/images:"
+            ls -la output_sd/images/
+            echo "eMMC files extracted to output_emmc/images:"
+            ls -la output_emmc/images/
+          else
+            # Download latest bootloader release
+            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            cd temp_bootloader/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_bootloader/
+
+            # Download latest Infix release
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "All files extracted to output/images:"
+            ls -la output/images/
+          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify extracted files
        run: |
-          echo "Files available for mkimage.sh:"
-          ls -la output/images/
-          echo ""
-          echo "File types:"
-          file output/images/* || true
+          if [ "$BUILD_EMMC" = "true" ]; then
+            echo "Files available for SD image:"
+            ls -la output_sd/images/
+            echo ""
+            echo "Files available for eMMC image:"
+            ls -la output_emmc/images/
+          else
+            echo "Files available for mkimage.sh:"
+            ls -la output/images/
+            echo ""
+            echo "File types:"
+            file output/images/* || true
+          fi

      - name: Create SD card image
        run: |
-          export BINARIES_DIR=$PWD/output/images
+          if [ "$BUILD_EMMC" = "true" ]; then
+            export BINARIES_DIR=$PWD/output_sd/images
+            export BUILD_DIR=$PWD/build
+            export BR2_EXTERNAL_INFIX_PATH=$PWD
+            export RELEASE=""
+            export INFIX_ID="infix"
+            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
+          else
+            export BINARIES_DIR=$PWD/output/images
+            export BUILD_DIR=$PWD/build
+            export BR2_EXTERNAL_INFIX_PATH=$PWD
+            export RELEASE=""
+            export INFIX_ID="infix"
+            ./utils/mkimage.sh ${{ inputs.board }}
+          fi
+
+      - name: Create eMMC image
+        if: ${{ env.BUILD_EMMC == 'true' }}
+        run: |
+          export BINARIES_DIR=$PWD/output_emmc/images
          export BUILD_DIR=$PWD/build
          export BR2_EXTERNAL_INFIX_PATH=$PWD
          export RELEASE=""
          export INFIX_ID="infix"
-          ./utils/mkimage.sh ${{ inputs.board }}
+          ./utils/mkimage.sh -t emmc ${{ inputs.board }}

-      - name: Verify created image
+      - name: Verify created images
        run: |
-          echo "Contents of output/images after mkimage.sh:"
-          ls -lh output/images/
+          if [ "$BUILD_EMMC" = "true" ]; then
+            echo "SD card image:"
+            ls -lh output_sd/images/*-sdcard.img* 2>/dev/null || true
+            if ls output_sd/images/*-sdcard.img 1> /dev/null 2>&1; then
+              for img in output_sd/images/*-sdcard.img; do
+                echo "- $(basename $img)"
+                file "$img"
+                fdisk -l "$img" 2>/dev/null | head -20
+              done
+            fi

-          # Look for SD card image with pattern: *-sdcard.img
-          if ls output/images/*-sdcard.img 1> /dev/null 2>&1; then
-            echo "Found SD card image(s):"
-            for img in output/images/*-sdcard.img; do
-              echo "- $(basename $img)"
-              file "$img"
-              fdisk -l "$img" 2>/dev/null || true
-            done
+            echo ""
+            echo "eMMC image:"
+            ls -lh output_emmc/images/*-emmc.img* 2>/dev/null || true
+            if ls output_emmc/images/*-emmc.img 1> /dev/null 2>&1; then
+              for img in output_emmc/images/*-emmc.img; do
+                echo "- $(basename $img)"
+                file "$img"
+                fdisk -l "$img" 2>/dev/null | head -20
+              done
+            fi
+
+            # Copy both images to output/images for artifact upload
+            mkdir -p output/images
+            cp output_sd/images/*-sdcard.img* output/images/ 2>/dev/null || true
+            cp output_emmc/images/*-emmc.img* output/images/ 2>/dev/null || true
          else
-            echo "No SD card image found matching pattern: *-sdcard.img"
-            echo "Available files:"
-            ls -la output/images/
-            exit 1
+            echo "Contents of output/images after mkimage.sh:"
+            ls -lh output/images/
+
+            # Look for SD card image with pattern: *-sdcard.img
+            if ls output/images/*-sdcard.img 1> /dev/null 2>&1; then
+              echo "Found SD card image(s):"
+              for img in output/images/*-sdcard.img; do
+                echo "- $(basename $img)"
+                file "$img"
+                fdisk -l "$img" 2>/dev/null || true
+              done
+            else
+              echo "No SD card image found matching pattern: *-sdcard.img"
+              echo "Available files:"
+              ls -la output/images/
+              exit 1
+            fi
          fi

-      - name: Upload SD card image
+      - name: Upload images as artifacts
        uses: actions/upload-artifact@v4
        with:
-          name: sdcard-image-${{ inputs.board }}-${{ env.BOOTLOADER }}
+          name: images-${{ inputs.board }}
          path: |
            output/images/*-sdcard.img*
+            output/images/*-emmc.img*
          retention-days: 30

      - name: Create checksums
        run: |
          cd output/images/
-          for file in *-sdcard.img; do
+          for file in *-sdcard.img *-emmc.img; do
            if [ -f "$file" ]; then
              sha256sum "$file" > "$file.sha256"
            fi
@@ -198,11 +338,28 @@ jobs:
          prerelease: true
          tag: "latest-boot"
          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "output/images/*-sdcard.img*"
+          artifacts: "output/images/*-sdcard.img*,output/images/*-emmc.img*"

      - name: Generate summary
        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          if [ "$BUILD_EMMC" = "true" ]; then
+            cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # SD Card & eMMC Image Build Complete! 🚀
+
+          **Board:** ${{ inputs.board }}
+          **Target:** ${{ env.TARGET }}
+          **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
+          **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
+          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
+
+          ## Created Images
+          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
+
+          ## Download
+          Both SD card and eMMC images are available as workflow artifacts above and in the latest-boot release.
+          EOF
+          else
+            cat <<EOF >> $GITHUB_STEP_SUMMARY
          # SD Card Image Build Complete! 🚀

          **Board:** ${{ inputs.board }}
@@ -211,8 +368,9 @@ jobs:
          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}

          ## Created Images
-          $(find output/images/ -name "*.img*" -o -name "*.qcow2" -o -name "*.raw" | xargs ls -lh 2>/dev/null | sed 's/^/- /' || echo "- No images found")
+          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")

          ## Download
          The SD card image is available as a workflow artifact above.
          EOF
+          fi
@@ -1,3 +1,6 @@
+# Needed for make pkg-stats
+# sudo apt install python3-aiohttp
+---
 name: Build Release

 on:
@@ -75,7 +78,12 @@ jobs:

      - name: Generate SBOM from Build
        run: |
+          # Generate manifest files in CSV format for CycloneDX
          make legal-info
+          # Generate cpe.json for CycloneDX
+          make -s show-info > output/cpe.json
+          # Generate pkg-stats.{json,html} for humans
+          make pkg-stats

      - name: Build test specification
        run: |
@@ -84,13 +92,22 @@ jobs:
      - name: Prepare Artifacts
        run: |
          cd output/
+
+          # Collect relevant files for SBOM and CPE info. for more info, see:
+          # https://github.com/CycloneDX/cyclonedx-buildroot
+          mkdir               images/sbom
+          mv pkg-stats.*      images/sbom/
+          mv cpe.json         images/sbom/
+          mv legal-info/*.csv images/sbom/
+
+          # Remove rootfs.squashfs from release (can be extracted from rootfs.itb)
+          # Saves ~131MB per architecture. See issue #858
+          rm -f images/rootfs.squashfs
+
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

-          mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-
      - uses: actions/upload-artifact@v4
        with:
          name: artifact-${{ matrix.target }}
@@ -19,6 +19,10 @@ on:
        description: 'Repo to checkout (for spin overrides)'
        default: kernelkit/infix
        type: string
+      infix_branch:
+        description: 'Branch/tag/commit to checkout (for spin overrides)'
+        default: ''
+        type: string

  workflow_call:
    inputs:
@@ -32,15 +36,30 @@ on:
        required: false
        type: string
        default: kernelkit/infix
+      infix_branch:
+        required: false
+        type: string
+        default: ''
+        description: 'Branch/tag/commit to checkout (for spin overrides). Defaults to github.ref if not specified'
      parallel:
        required: false
        type: boolean
        default: true
+      pre_build_script:
+        required: false
+        type: string
+        default: ''
+        description: 'Optional script to run after checkout (for spin customization)'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'

 env:
  NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  INFIX_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_branch || inputs.infix_branch }}

 jobs:
  build:
@@ -73,10 +92,20 @@ jobs:
        uses: actions/checkout@v4
        with:
          repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
+          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
          clean: true
          fetch-depth: 0
          submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
+
+      - name: Run pre-build script
+        if: ${{ inputs.pre_build_script != '' }}
+        run: |
+          cat > ./pre-build.sh << 'EOF'
+          ${{ inputs.pre_build_script }}
+          EOF
+          chmod +x ./pre-build.sh
+          bash ./pre-build.sh

      - name: Set Build Variables
        id: vars
@@ -1,10 +1,13 @@
 name: Check Kernel 6.12 Release

 on:
-  workflow_dispatch: # Allow manual triggering
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:

 jobs:
  check-kernel:
+    if: github.repository == 'kernelkit/infix'
    runs-on: ubuntu-latest

    steps:
@@ -14,14 +17,6 @@ jobs:
          fetch-depth: 0
          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}

-      - name: Check out linux repository
-        uses: actions/checkout@v4
-        with:
-          repository: kernelkit/linux
-          path: linux
-          fetch-depth: 0
-          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
-
      - name: Fetch kernel.org and check for 6.12 release
        id: check
        run: |
@@ -37,22 +32,52 @@ jobs:
          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
          echo "Current 6.12 kernel version: $CURRENT_VERSION"

-          # Get the latest tag from our linux tree
-          cd linux
-          git fetch origin
-          LATEST_TAG=$(git tag -l "v6.12.*" | sort -V | tail -n1 | sed 's/^v//')
-          cd ..
+          # Get the version from infix defconfig
+          INFIX_VERSION=$(grep 'BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=' configs/aarch64_defconfig | cut -d'"' -f2)

-          echo "latest_tag=$LATEST_TAG" >> $GITHUB_OUTPUT
-          echo "Latest tag in our tree: $LATEST_TAG"
+          echo "infix_version=$INFIX_VERSION" >> $GITHUB_OUTPUT
+          echo "Infix kernel version: $INFIX_VERSION"

-          if [ "$CURRENT_VERSION" != "$LATEST_TAG" ]; then
-            echo "new_release=true" >> $GITHUB_OUTPUT
-            echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (our version: $LATEST_TAG)"
+          if [ "$CURRENT_VERSION" != "$INFIX_VERSION" ]; then
+            # Check if there's already an open PR for this version
+            PR_EXISTS=$(gh pr list --state open --search "Upgrade to kernel $CURRENT_VERSION in:title" --json number --jq 'length')
+
+            if [ "$PR_EXISTS" -gt 0 ]; then
+              echo "new_release=false" >> $GITHUB_OUTPUT
+              echo "PR already exists for kernel $CURRENT_VERSION, skipping"
+            else
+              echo "new_release=true" >> $GITHUB_OUTPUT
+              echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
+            fi
          else
            echo "new_release=false" >> $GITHUB_OUTPUT
            echo "No change - still at $CURRENT_VERSION"
          fi
+        env:
+          GH_TOKEN: ${{ secrets.KERNEL_UPDATE_TOKEN }}
+
+      - name: Generate branch name
+        if: steps.check.outputs.new_release == 'true'
+        id: branch
+        run: |
+          BRANCH_NAME="kernel-upgrade-$(uuidgen | tr '[:upper:]' '[:lower:]')"
+          echo "name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+          echo "Branch name: $BRANCH_NAME"
+
+      - name: Import GPG key
+        if: steps.check.outputs.new_release == 'true'
+        run: |
+          # Import the GPG key
+          echo "${{ secrets.AEL_BOT_GPG_PRIVATE_KEY }}" | gpg --batch --import
+
+          # Get the key ID
+          GPG_KEY_ID=$(gpg --list-secret-keys --keyid-format=long | grep '^sec' | head -1 | awk '{print $2}' | cut -d'/' -f2)
+          echo "GPG_KEY_ID=$GPG_KEY_ID" >> $GITHUB_ENV
+
+          # Configure GPG agent for non-interactive use
+          echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
+          echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf
+          gpg-connect-agent reloadagent /bye || true

      - name: Set up git credentials
        if: steps.check.outputs.new_release == 'true'
@@ -60,6 +85,8 @@ jobs:
          set -e -o pipefail
          git config --global user.email "ael-bot@users.noreply.github.com"
          git config --global user.name "ael-bot"
+          git config --global commit.gpgsign true
+          git config --global user.signingkey ${{ env.GPG_KEY_ID }}

          # Configure git to use the token for HTTPS operations
          git config --global url."https://ael-bot:${{ secrets.KERNEL_UPDATE_TOKEN }}@github.com/".insteadOf "git@github.com:"
@@ -69,9 +96,10 @@ jobs:
        if: steps.check.outputs.new_release == 'true'
        env:
          GIT_TERMINAL_PROMPT: 0
+          BRANCH_NAME: ${{ steps.branch.outputs.name }}
        run: |
          set -e -o pipefail
-          ./utils/kernel-upgrade.sh linux
+          ./utils/kernel-upgrade.sh linux "$BRANCH_NAME"

      - name: Create pull request
        if: steps.check.outputs.new_release == 'true'
@@ -79,7 +107,6 @@ jobs:
        with:
          github-token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
          script: |
-            // Check if PR already exists
            const { data: pulls } = await github.rest.pulls.list({
              owner: context.repo.owner,
              repo: context.repo.repo,
@@ -92,12 +119,11 @@ jobs:
                owner: context.repo.owner,
                repo: context.repo.repo,
                title: `Upgrade to kernel ${{ steps.check.outputs.current_version }}`,
-                head: 'kernel-upgrade',
+                head: '${{ steps.branch.outputs.name }}',
                base: 'main',
-                body: `Automated kernel upgrade to version ${{ steps.check.outputs.current_version }}.\n\n**Previous version:** ${{ steps.check.outputs.latest_tag }}\n**New version:** ${{ steps.check.outputs.current_version }}\n**Source:** https://www.kernel.org/\n\nThis PR was automatically created by the kernel release monitoring workflow.`
+                body: `Automated kernel upgrade to version ${{ steps.check.outputs.current_version }}.\n\n**Previous version:** ${{ steps.check.outputs.infix_version }}\n**New version:** ${{ steps.check.outputs.current_version }}\n**Source:** https://www.kernel.org/\n\nThis PR was automatically created by the kernel release monitoring workflow.`
              });

-              // Add label
              await github.rest.issues.addLabels({
                owner: context.repo.owner,
                repo: context.repo.repo,
@@ -105,7 +131,6 @@ jobs:
                labels: ['ci:main']
              });

-              // Request reviews
              await github.rest.pulls.requestReviewers({
                owner: context.repo.owner,
                repo: context.repo.repo,
@@ -69,10 +69,10 @@ jobs:
          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
          make dep

-      - name: Check applications
+      - name: Build applications for Coverity
        run: |
          export PATH=`pwd`/coverity/bin:$PATH
-          cov-build --dir cov-int make check
+          cov-build --dir cov-int make coverity

      - name: Submit results to Coverity Scan
        env:
@@ -75,7 +75,7 @@ jobs:
          if echo $ver | grep -qE 'v[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
            echo "pre=true"     >> $GITHUB_OUTPUT
            echo "latest=false" >> $GITHUB_OUTPUT
-          elif echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
+          elif echo $ver | grep -qE '^v[0-9]+\.[0-9]+(\.0)?$'; then
            echo "pre=false"    >> $GITHUB_OUTPUT
            echo "latest=true"  >> $GITHUB_OUTPUT
            echo "cat=Releases" >> $GITHUB_OUTPUT
@@ -117,7 +117,7 @@ jobs:
          prerelease: ${{ steps.rel.outputs.pre }}
          makeLatest: ${{ steps.rel.outputs.latest }}
          discussionCategory: ${{ steps.rel.outputs.cat }}
-          bodyFile:  release.md
+          bodyFile: release.md
          artifacts: "*.tar.gz*,*.qcow2*"

      - name: Summary
@@ -8,6 +8,10 @@ on:
        required: false
        default: kernelkit/infix
        type: string
+      infix_branch:
+        description: 'Branch/tag/commit to checkout (for spin overrides)'
+        default: ''
+        type: string

  workflow_call:
    inputs:
@@ -21,6 +25,11 @@ on:
        required: false
        type: string
        default: kernelkit/infix
+      infix_branch:
+        required: false
+        type: string
+        default: ''
+        description: 'Branch/tag/commit to checkout (for spin overrides). Defaults to github.ref if not specified'
      ninepm-conf:
        required: false
        type: string
@@ -29,10 +38,20 @@ on:
        required: false
        type: string
        default: 'test'
+      pre_test_script:
+        required: false
+        type: string
+        default: ''
+        description: 'Optional script to run after checkout (for spin customization)'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'

 env:
  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  INFIX_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_branch || inputs.infix_branch }}
  NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
  TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}

@@ -55,10 +74,20 @@ jobs:
        uses: actions/checkout@v4
        with:
          repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
+          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
          clean: true
          fetch-depth: 0
          submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
+
+      - name: Run pre-test script
+        if: ${{ inputs.pre_test_script != '' }}
+        run: |
+          cat > ./pre-test.sh << 'EOF'
+          ${{ inputs.pre_test_script }}
+          EOF
+          chmod +x ./pre-test.sh
+          bash ./pre-test.sh

      - name: Set Build Variables
        id: vars
@@ -16,8 +16,7 @@ bmake   = $(MAKE) -C buildroot O=$(O) $1
 all: $(config) buildroot/Makefile
 	@+$(call bmake,$@)

-check dep:
-	@echo "Starting local check, stage $@ ..."
+check dep coverity:
 	@make -C src $@

 $(config):
@@ -33,6 +32,11 @@ $(config):
 legal-info: | buildroot/Makefile
 	$(call bmake,legal-info LINUX_LICENSE_FILES=COPYING)

+cyclonedx: | buildroot/Makefile
+	@echo "Generating package information..."
+	@$(MAKE) --no-print-directory -C buildroot O=$(O) show-info | ./buildroot/utils/generate-cyclonedx > $(O)/cyclonedx-sbom.json
+	@echo "CycloneDX SBOM generated: $(O)/cyclonedx-sbom.json"
+
 # Workaround, see board/x86_64/board.mk
 test:
 	@+$(call bmake,$@)
@@ -40,4 +44,4 @@ test:
 buildroot/Makefile:
 	@git submodule update --init

-.PHONY: all check test
+.PHONY: all check coverity dep test cyclonedx
@@ -1,5 +1,6 @@
 menu "Board Support"

+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"
@@ -0,0 +1,5 @@
+if BR2_arm
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/raspberrypi-rpi2/Config.in"
+
+endif
@@ -0,0 +1,7 @@
+aarch32
+=======
+
+Board Specific Documentation
+----------------------------
+
+- [Raspberry Pi 2 Model B (32-bit)](raspberrypi-rpi2/)
@@ -0,0 +1 @@
+
@@ -0,0 +1,7 @@
+blkmap get boot dev devnum
+load blkmap ${devnum} ${kernel_addr_r} /boot/zImage
+#TODO: LOAD FDT
+
+setenv bootargs "${bootargs_root} ${bootargs_rauc} ${bootargs_log}"
+
+bootz ${kernel_addr_r} ${ramdisk} ${fdt_addr}
@@ -0,0 +1,395 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_KEXEC=y
+CONFIG_ARCH_MULTI_V6=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_VIRT=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_SMP=y
+CONFIG_NR_CPUS=4
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_AEABI=y
+CONFIG_VFP=y
+CONFIG_NEON=y
+CONFIG_KERNEL_MODE_NEON=y
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_JUMP_LABEL=y
+# CONFIG_GCC_PLUGINS is not set
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_KSM=y
+CONFIG_CMA=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_NET_IPVTI=m
+CONFIG_NET_FOU_IP_TUNNELS=y
+CONFIG_IPV6_SIT=m
+CONFIG_IPV6_GRE=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETWORK_PHY_TIMESTAMPING=y
+CONFIG_NETFILTER=y
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_CT=m
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_XFRM=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CGROUP=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
+CONFIG_NFT_BRIDGE_META=m
+CONFIG_NF_CONNTRACK_BRIDGE=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BRIDGE=y
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_BRIDGE_MRP=y
+CONFIG_BRIDGE_CFM=y
+CONFIG_NET_DSA=y
+CONFIG_VLAN_8021Q=y
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_MQPRIO=y
+CONFIG_NET_CLS_BASIC=y
+CONFIG_NET_CLS_BPF=y
+CONFIG_NET_CLS_FLOWER=y
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_GACT=y
+CONFIG_NET_ACT_MIRRED=y
+CONFIG_NET_ACT_SKBEDIT=y
+CONFIG_DCB=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_MPLS=y
+CONFIG_NET_MPLS_GSO=y
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
+CONFIG_NET_PKTGEN=y
+# CONFIG_WIRELESS is not set
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_LWTUNNEL=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_AARDVARK=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_ARMADA_8K=y
+CONFIG_UEVENT_HELPER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+# CONFIG_STANDALONE is not set
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_FW_CFG_SYSFS=y
+CONFIG_FW_CFG_SYSFS_CMDLINE=y
+CONFIG_OF_OVERLAY=y
+CONFIG_BLK_DEV_NULL_BLK=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_NVME=y
+CONFIG_SRAM=y
+CONFIG_EEPROM_AT24=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_SCSI_SAS_LIBSAS=y
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_VIRTIO=y
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_MOBILE_LPM_POLICY=0
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_MVEBU=y
+CONFIG_PATA_OF_PLATFORM=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_INIT=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
+CONFIG_VXLAN=m
+CONFIG_GENEVE=m
+CONFIG_BAREUDP=m
+CONFIG_MACSEC=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_VIRTIO_NET=y
+CONFIG_NLMON=y
+CONFIG_NET_VRF=y
+CONFIG_BCMGENET=y
+CONFIG_SMSC911X=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_BRCMFMAC=m
+CONFIG_ZD1211RW=m
+CONFIG_INPUT_MOUSEDEV=m
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_TTY_PRINTK=y
+CONFIG_HVC_DRIVER=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_BCM2835=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=y
+CONFIG_SPI_BCM2835AUX=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_SENSORS_RASPBERRYPI_HWMON=m
+CONFIG_THERMAL=y
+CONFIG_BCM2711_THERMAL=y
+CONFIG_BCM2835_THERMAL=m
+CONFIG_WATCHDOG=y
+CONFIG_BCM2835_WDT=y
+CONFIG_I6300ESB_WDT=y
+CONFIG_MFD_SYSCON=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_DRM=y
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_TOSHIBA_TC358762=m
+CONFIG_DRM_V3D=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_VC4_HDMI_CEC=y
+CONFIG_DRM_SIMPLEDRM=y
+CONFIG_FB=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_SOC=y
+CONFIG_SND_BCM2835_SOC_I2S=y
+CONFIG_HID_GENERIC=m
+CONFIG_USB=y
+CONFIG_USB_OTG=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_DWC2=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_ETH=m
+CONFIG_USB_ETH_EEM=y
+CONFIG_USB_G_SERIAL=m
+CONFIG_MMC=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_IPROC=y
+CONFIG_MMC_BCM2835=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=y
+CONFIG_LEDS_TRIGGER_CAMERA=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_INPUT=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_STAGING=y
+CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_BTRFS_FS=y
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_FUSE_FS=y
+CONFIG_VIRTIO_FS=y
+CONFIG_OVERLAY_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_EXFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_SQUASHFS_ZSTD=y
+CONFIG_9P_FS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_UTF8=y
+CONFIG_CRYPTO_CCM=y
+CONFIG_CRYPTO_GCM=y
+# CONFIG_XZ_DEC_ARM is not set
+# CONFIG_XZ_DEC_ARMTHUMB is not set
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=32
+CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_FS=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_TIMEOUT=20
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_SCHED_DEBUG is not set
+# CONFIG_RCU_TRACE is not set
+CONFIG_FUNCTION_TRACER=y
+# CONFIG_STRICT_DEVMEM is not set
+CONFIG_MEMTEST=y
@@ -0,0 +1,15 @@
+config BR2_PACKAGE_RASPBERRYPI_RPI2
+	bool "Raspberry Pi 2 Model B (32-bit ARMv7)"
+	depends on BR2_arm
+	select SDCARD_AUX
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+
+	help
+	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
+	  (SBC) with BCM2836 quad-core Cortex-A7 processor.
+
+	  This was the only Raspberry Pi model with the BCM2836 and the 2B
+	  actually got a BCM2837 (Cortex-A53) underclocked an w/o wifi in
+	  the v1.2 board revision.
@@ -0,0 +1,13 @@
+Copyright (c) 2025 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -0,0 +1,96 @@
+Raspberry Pi 2 Model B
+======================
+
+The [Raspberry Pi 2 Model B][1] is a 32-bit ARM single-board computer,
+powered by the Broadcom BCM2836 quad-core Cortex-A7 processor @ 900 MHz
+with 1 GB RAM.
+
+The board features:
+
+- 4x USB 2.0 ports
+- Fast Ethernet (100 Mbps)
+- microSD card slot for storage
+- HDMI port
+- GPIO header (40-pin)
+
+> [!NOTE]
+> Revision 1.2 of the Pi 2B actually uses a BCM2837 (Cortex-A53) underclocked
+> and without WiFi, making it very similar to the Pi 3B hardware-wise but
+> running in 32-bit mode.  This revision is not supported.
+
+How to Build
+------------
+
+Since there are no pre-built images for ARM32, you need to build both Infix
+and the bootloader from source.
+
+
+1. Clone the repository
+
+        git clone https://github.com/kernelkit/infix.git
+        cd infix
+
+2. Build the bootloader (in separate tree)
+
+        make O=x-boot rpi2_boot_defconfig
+        make O=x-boot
+
+3. Build Infix (in another tree)
+
+        make O=x-arm32 aarch32_defconfig
+        make O=x-arm32
+
+4. Create the SD card image
+
+        ./utils/mkimage.sh -b x-boot -r x-arm32 raspberrypi-rpi2
+
+The resulting image can be found in `x-boot/images/infix-arm-sdcard.img`
+
+Flashing to SD Card
+-------------------
+
+[Flash the image][0] to a microSD card (at least 4 GB):
+
+```bash
+sudo dd if=x-boot/images/infix-arm-sdcard.img of=/dev/mmcblk0 \
+        bs=1M status=progress oflag=direct
+```
+
+You can also use `bmaptool`:
+
+```bash
+sudo bmaptool copy x-boot/images/infix-rpi2-sdcard.img /dev/mmcblk0
+```
+
+> [!WARNING]
+> Ensure `/dev/mmcblk0` is the correct device for your SD card and not used by
+> the host system! Use `lsblk` to verify.
+
+Booting the Board
+-----------------
+
+1. Insert the flashed SD card into the Raspberry Pi
+2. Connect an Ethernet cable (DHCP will be used to get an IP address)
+3. Power up the board using a 5V/2.5A micro-USB power supply
+
+The board will boot and obtain an IP address via DHCP on the Ethernet port.
+Find the assigned IP and SSH in with the default login credentials, user/pass:
+`admin` / `admin`.
+
+Console Port (Optional)
+-----------------------
+
+A serial console can be useful for debugging. Connect a USB-to-TTL
+serial adapter (3.3V) to GPIO pins:
+
+- GND → Pin 6, ground
+- TxD → Pin 8, GPIO 14
+- RxD → Pin 10, GPIO 15
+
+Serial settings: 115200 8N1
+
+> [!WARNING]
+> Use only 3.3V serial adapters. 5V adapters will damage your Raspberry Pi!
+
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.raspberrypi.com/products/raspberry-pi-2-model-b/
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+mkdir /mnt/primary
+mount /dev/disk0.primary /mnt/primary
+
+global.bootm.image="/mnt/primary/boot/zImage"
+global.bootm.oftree="/mnt/primary/boot/broadcom/bcm2836-rpi-2-b.dtb"
+global.linux.bootargs.base="quiet console=ttyAMA0,115200 console=tty1 rauc.slot=primary"
+global.linux.bootargs.dyn.root="root=PARTLABEL=primary rootwait ro"
+
+bootm
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# Barebox configuration for Raspberry Pi 2
+
+# Boot timeout (seconds)
+global autoboot_timeout=3
+
+# Default boot order
+global boot.default="mmc net"
+
+# Enable colored output if supported
+global allow_color=true
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# Automount MMC partitions
+mkdir -p /mnt/mmc
+automount /mnt/mmc 'mci0.probe=1 && mount /dev/disk0.0 /mnt/mmc'
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+# Set boot order: try mmc first, then network
+global.boot.default="mmc net"
@@ -0,0 +1,17 @@
+# Minimal Barebox configuration for Raspberry Pi 2
+# Basic boot only - A/B partitioning and secure boot to be added later
+
+# Enable custom embedded environment
+CONFIG_DEFAULT_ENVIRONMENT=y
+CONFIG_DEFAULT_ENVIRONMENT_GENERIC_NEW=y
+
+# Enable GPT partition table support for hybrid partition tables
+CONFIG_PARTITION_DISK_EFI=y
+
+# Enable SquashFS support for reading rootfs
+CONFIG_FS_SQUASHFS=y
+CONFIG_FS_SQUASHFS_LZ4=y
+CONFIG_FS_SQUASHFS_LZO=y
+CONFIG_FS_SQUASHFS_XZ=y
+CONFIG_FS_SQUASHFS_ZLIB=y
+CONFIG_FS_SQUASHFS_ZSTD=y
@@ -0,0 +1 @@
+root=/dev/mmcblk0p2 rootwait console=tty1 console=ttyAMA0,115200
@@ -0,0 +1,19 @@
+# Raspberry Pi bootloader (start.elf) configuration
+#
+# uart_2ndstage=1 - Enable early boot debug output from the bootloader
+#                   Useful for debugging boot failures before Barebox starts
+#                   Comment out for production to reduce boot noise
+
+[all]
+kernel=barebox-raspberry-pi-2.img
+
+disable_overscan=1
+
+enable_uart=1
+#uart_2ndstage=1
+
+[pi2]
+start_file=start.elf
+fixup_file=fixup.dat
+
+gpu_mem=100
@@ -0,0 +1 @@
+dtb-y += broadcom/bcm2836-rpi-2-b.dtb
@@ -0,0 +1 @@
+# Placeholder - dtb-y is defined in parent Makefile
@@ -0,0 +1,19 @@
+#include <arm/broadcom/bcm2836-rpi-2-b.dts>
+#include "infix.dtsi"
+
+/ {
+	/* CMA pool for GPU and video */
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		cma-reserved {
+			compatible = "shared-dma-pool";
+			size = <0x4000000>; /* 64MB */
+			alignment = <0x1000000>; /* 16MB aligned */
+			linux,cma-default;
+			reusable;
+		};
+	};
+};
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Common Infix OS defaults
+ */
+
+/ {
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+	};
+};
@@ -0,0 +1,78 @@
+image boot.vfat {
+	vfat {
+		files = {
+#BOOT_FILES#
+		}
+	}
+
+	size = 32M
+}
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
+	ext4 {
+		label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
+image var.ext4 {
+	empty = true
+	temporary = true
+	size = 128M
+
+	ext4 {
+		label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+image #INFIX_ID##VERSION#-rpi2-sdcard.img {
+	hdimage {
+		partition-table-type = "hybrid"
+	}
+
+	partition boot {
+		partition-type = 0xc
+		bootable = "true"
+		image = "boot.vfat"
+	}
+
+	partition aux {
+		partition-type-uuid = srv
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		partition-type-uuid = linux
+		bootable = "true"
+		size = 250M
+		image = "rootfs.squashfs"
+	}
+
+	partition secondary {
+		partition-type-uuid = linux
+		bootable = "true"
+		size = 250M
+		image = "rootfs.squashfs"
+	}
+
+	partition cfg {
+		partition-type-uuid = srv
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		partition-type-uuid = var
+		image = "var.ext4"
+	}
+}
@@ -0,0 +1,61 @@
+# Raspberry Pi 2 Model B specific kernel configuration
+define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SOUND)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_KEYBOARD)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_TOUCHSCREEN)
+	$(call KCONFIG_SET_OPT,CONFIG_INPUT_MOUSEDEV,m)
+	$(call KCONFIG_SET_OPT,CONFIG_HID_GENERIC,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
+	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_MBOX,y)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DMA_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_BCM2835)
+	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
+	$(call KCONFIG_SET_OPT,CONFIG_I2C_BCM2835,m)
+	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_THERMAL,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_BCM2835AUX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
+	$(call KCONFIG_SET_OPT,CONFIG_SMSC911X,y)
+	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,y)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_KMS_HELPER)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_V3D,m)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_VC4,m)
+	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_VC4_HDMI_CEC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_LOAD_EDID_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_PANEL_BRIDGE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_BRIDGE)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_TOSHIBA_TC358762,m)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_PANEL_SIMPLE,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_FBDEV_EMULATION)
+
+	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))
@@ -0,0 +1,206 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "eth0",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {"id": "netmask"},
+              {"id": "broadcast"},
+              {"id": "router"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "ntp-server"},
+              {"id": "vendor-class", "value": "Raspberry Pi 2 Model B"}
+            ]
+          }
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny"
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-address": "::"
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "rpi-%m",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          },
+          "iburst": true
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-meta:meta": {
+    "version": "1.6"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  }
+}
@@ -0,0 +1,8 @@
+{
+    "eth0": {
+	"phy-detached-when-down": true
+    },
+    "@ethtool:driver=smsc95xx": {
+        "broken-flow-control": true
+    }
+}
@@ -0,0 +1,13 @@
+# CONFIG_MMC_PCI is not set
+CONFIG_OF_OVERLAY_LIST="rpi-env infix-key"
+# CONFIG_ENV_IS_IN_FAT is not set
+
+# Increase early malloc heap to handle DTB with embedded scripts
+CONFIG_SYS_MALLOC_F_LEN=0x2000
+
+# Compression support needed for SquashFS
+CONFIG_LZ4=y
+CONFIG_LZMA=y
+CONFIG_CMD_LZMADEC=y
+CONFIG_CMD_UNLZ4=y
+CONFIG_CMD_UNZIP=y
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+&{/} {
+	config {
+		environment {
+			vendor = "infix";
+			preboot = "run ixpreboot";
+			ixbootdelay = "0.5";
+			bootdelay = "-2";
+			bootmenu_delay = "10";
+			boot_targets = "mmc0";
+			ethprime = "eth0";
+			bootcmd = "run ixboot";
+
+			ixpreboot     = /incbin/("scripts/ixpreboot.sh");
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+			ixbtn-factory = "echo \"No button available, use bootmenu\"";
+			ixfactory     = /incbin/("scripts/ixfactory.sh");
+
+			ixboot      = /incbin/("scripts/ixboot.sh");
+			ixbootslot  = /incbin/("scripts/ixbootslot.sh");
+			ixprepblk   = /incbin/("scripts/ixprepblk.sh");
+			ixprepdhcp  = /incbin/("scripts/ixprepdhcp.sh");
+		};
+	};
+};
@@ -1,27 +1,229 @@
-# Banana Pi R3
+# Banana Pi BPI-R3

-## Support level
-Full support for all Infix enabled features including switched ethernet ports, WiFi,
-and SFP interfaces. The board includes comprehensive hardware support for
-MediaTek MT7986 SoC features.
+<img src="bananapi-bpi-r3.webp" alt="The board" width=800 padding=10>

-### Hardware features
-The Banana Pi R3 is a high-performance networking board featuring:
- MediaTek MT7986 ARM Cortex-A53 quad-core processor
- 4x Gigabit LAN ports (lan1-lan4)
- 1x Gigabit WAN port
- 2x SFP ports (sfp1, sfp2) for fiber connectivity
- Dual WiFi interfaces (wifi0 for 2.4GHz, wifi1 for 5GHz)
- USB support
- SD card boot support
+## Overview

-### Network configuration
-The board comes preconfigured with:
- 4 switched LAN ports for internal networking
- Dedicated WAN port with DHCP client enabled
- SFP ports for high-speed fiber connections
- Dual WiFi interfaces for wireless connectivity
+The Banana Pi R3 is a high-performance networking board with full Infix
+support for all enabled features including switched Ethernet ports, WiFi,
+and SFP interfaces.

-### Pre-built images
-SD card image: [infix-bpi-r3-sdcard.img](https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img)
+### Hardware Features

+- MediaTek MT7986 ARM Cortex-A53 quad-core processor @ 2.0 GHz
+- 2 GB DDR4 RAM
+- 8 GB eMMC storage + microSD card slot
+- 5x Gigabit Ethernet ports (4x LAN, 1x WAN)
+- 2x SFP cages for fiber connectivity (1G/2.5G)
+- Dual-band WiFi (2.4 GHz + 5 GHz)
+- USB 3.0 port
+- Mini PCIe slot
+
+### Default Network Configuration
+
+Infix comes preconfigured with:
+
+- **LAN ports** (lan1-lan4): Bridged for internal networking
+- **WAN port**: DHCP client enabled for internet connectivity
+- **SFP ports** (sfp1, sfp2): Available for configuration
+- **WiFi interfaces** (wifi0, wifi1): Available for configuration
+
+## Getting Started
+
+### Quick Start with SD Card
+
+The easiest way to get started is using an SD card:
+
+1. **Download the SD card image:** [infix-bpi-r3-sdcard.img][2]
+2. **Flash the image to an SD card:** see [this guide][0]
+3. **Set boot switches:**
+   - Set DIP switches to **0000** (SD card boot mode)
+   - Switch positions are on the underside of the board near the SD slot
+4. **Boot the board:**
+   - Insert the SD card
+   - Connect power
+   - Connect to LAN port or console (115200 8N1)
+   - Default login: `admin` / `admin`
+
+### Boot Switch Reference
+
+The BPI-R3 has a 4-position DIP switch that controls boot media:
+
+<img align="right" src="bootstrap-switch.webp" alt="DIP switches" width=200 padding=10>
+
+| Position | Mode        | Description                           |
+|----------|-------------|---------------------------------------|
+| 0000     | SD card     | Boot from microSD card (recommended)  |
+| 0110     | eMMC        | Boot from internal eMMC storage       |
+| 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |
+
+> [!NOTE]
+> Switch position is read from left to right: "0" = OFF, "1" = ON.  
+> When the DIP switch is in the "UP" position it is OFF(0).
+
+## Advanced: Installing to eMMC
+
+For production deployments or better performance, you can install Infix
+to the internal eMMC storage. This is more complex but provides faster
+boot times and eliminates the external SD card.
+
+### Why Use eMMC?
+
+**Advantages:**
+
+- Faster boot and better performance
+- No external SD card to manage
+- More robust for industrial/embedded deployments
+
+**Disadvantages:**
+
+- More complex installation process
+- Requires intermediate NAND boot step
+- Harder to recover from errors
+
+### Prerequisites
+
+- FTDI USB-to-serial cable (3.3V) for console access
+- microSD card with Infix (for initial boot)
+- USB flash drive (FAT32 formatted)
+- Downloaded files (see below)
+
+### Required Files
+
+Download and place these files on a FAT32-formatted USB drive:
+
+1. **Intermediate NAND bootloader** (from Frank-W's U-Boot):
+   - [bpi-r3_spim-nand_bl2.img][5] (BL2 loader)
+   - [bpi-r3_spim-nand_fip.bin][6] (FIP image)
+2. **Infix eMMC image:**
+   - [infix-bpi-r3-emmc.img][3] (Complete system image)
+3. **eMMC bootloader** (extracted from):
+   - [bpi-r3-emmc-boot-2025.01-latest.tar.gz][4]
+   - Extract `bl2.img` from the tarball to your USB drive
+
+> [!WARNING]
+> The following process involves multiple boot mode changes.  Take your
+> time verify each step carefully.
+
+### Installation Steps
+
+#### Step 1: Boot from SD card
+
+1. Set boot switches to **0000** (SD card mode)
+2. Insert SD card with Infix
+3. Power on and break into U-Boot (press Ctrl-C during boot)
+
+#### Step 2: Flash intermediate NAND bootloader
+
+This step installs a temporary bootloader to NAND that will help us
+flash the eMMC. From the U-Boot prompt:
+
+```
+usb start
+mtd erase spi-nand0
+fatload usb 0:1 0x50000000 bpi-r3_spim-nand_bl2.img
+mtd write spi-nand0 0x50000000 0x0 0x100000
+fatload usb 0:1 0x50000000 bpi-r3_spim-nand_fip.bin
+mtd write spi-nand0 0x50000000 0x380000 0x200000
+```
+
+#### Step 3: Boot from NAND
+
+1. Power off the board
+2. Set boot switches to **1010** (NAND mode)
+3. Power on - you should boot into U-Boot again
+
+#### Step 4: Write Infix image to eMMC
+
+From the U-Boot prompt:
+
+```
+usb start
+fatload usb 0:1 0x50000000 infix-bpi-r3-emmc.img
+setexpr blocks ${filesize} / 0x200
+mmc write 0x50000000 0x0 ${blocks}
+```
+
+This writes the complete Infix system (partitions, rootfs, etc.) to eMMC.
+
+#### Step 5: Configure eMMC boot
+
+Now configure the eMMC boot partition and write the bootloader:
+
+```
+mmc partconf 0 1 1 1
+mmc erase 0x0 0x400
+fatload usb 0:1 0x50000000 bl2.img
+mmc write 0x50000000 0x0 0x400
+mmc partconf 0 1 1 0
+```
+
+#### Step 6: Boot from eMMC
+
+1. Power off the board
+2. Set boot switches to **0110** (eMMC mode)
+3. Remove SD card (optional, but recommended to verify eMMC boot)
+4. Power on
+
+Your BPI-R3 should now boot Infix from internal eMMC storage!
+
+## Troubleshooting
+
+### Board won't boot
+
+- Verify boot switch positions (check twice!)
+- Ensure power supply provides adequate current (12V/2A recommended)
+- Try booting from SD card with switches at **0000**
+
+### Can't break into U-Boot
+
+- Ensure serial console is connected properly (115200 8N1, 3.3V)
+- Press Ctrl-C immediately when you see boot messages
+- Try power cycling and pressing Ctrl-C repeatedly
+
+### eMMC boot fails after installation
+
+- Boot from NAND (**1010**) and verify eMMC image was written
+- Check USB drive contents - ensure all files are present
+- Re-run Step 5 (eMMC boot configuration)
+
+### Reverting to SD card
+
+Simply set boot switches back to **0000** and boot from SD card. The
+eMMC installation does not affect SD card functionality.
+
+## Additional Resources
+
+- [Infix Documentation][1]
+- [Official BPI-R3 Wiki][7]
+- [Release Downloads][8]
+
+## Building Custom Images
+
+See the main Infix documentation for building from source. To build both
+SD card and eMMC images locally:
+
+```bash
+# Build bootloaders for both SD and eMMC
+make x-bpi-r3-sd-boot
+make x-bpi-r3-emmc-boot
+
+# Build main system
+make aarch64
+
+# Create SD card image
+./utils/mkimage.sh -od bananapi-bpi-r3
+
+# Create eMMC image
+./utils/mkimage.sh -odt emmc bananapi-bpi-r3
+```
+
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://kernelkit.org/infix/latest/
+[2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img
+[3]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-emmc.img
+[4]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r3-emmc-boot-2025.01-latest.tar.gz
+[5]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2025-10-bpi-2025.10-2025-10-13_1032/bpi-r3_spim-nand_bl2.img
+[6]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2025-10-bpi-2025.10-2025-10-13_1032/bpi-r3_spim-nand_fip.bin
+[7]: https://wiki.banana-pi.org/Banana_Pi_BPI-R3
+[8]: https://github.com/kernelkit/infix/releases/tag/latest-boot
@@ -1 +1 @@
-dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb
+dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb
@@ -0,0 +1,2 @@
+#include "mt7986a-bananapi-bpi-r3.dtsi"
+#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"
@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/*
+This is copied from linux where it is an overlay, unfortunatly it is not
+possible to use dtbo in sysboot unless present in syslinux.conf
+*/
+&{/soc/mmc@11230000} {
+        bus-width = <8>;
+        max-frequency = <200000000>;
+        cap-mmc-highspeed;
+        mmc-hs200-1_8v;
+        mmc-hs400-1_8v;
+        hs400-ds-delay = <0x14014>;
+        non-removable;
+        no-sd;
+        no-sdio;
+        status = "okay";
+};
@@ -24,7 +24,7 @@ image var.ext4 {
        }
 }

-image #INFIX_ID##VERSION#-bpi-r3-sdcard.img {
+image #INFIX_ID##VERSION#-bpi-r3-#TARGET#.img {
        hdimage {
                partition-table-type = "gpt"

@@ -99,7 +99,31 @@
      {
        "name": "wan",
        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
+        "ietf-ip:ipv6": {},
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"},
+              {"id": "vendor-class", "value": "Banana Pi BPI-R3"}
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {"id": "ntp-server"},
+              {"id": "client-fqdn"},
+              {"id": "domain-search"},
+              {"id": "dns-server"}
+            ]
+          }
+        }
      },
      {
        "name": "wifi0",
@@ -221,36 +245,6 @@
    },
    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
  },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
-      {
-        "if-name": "wan",
-        "option": [
-          {
-            "id": "ntp-server"
-          },
-          {
-            "id": "broadcast"
-          },
-          {
-            "id": "domain"
-          },
-          {
-            "id": "hostname"
-          },
-          {
-            "id": "dns-server"
-          },
-          {
-            "id": "router"
-          },
-          {
-            "id": "netmask"
-          }
-        ]
-      }
-    ]
-  },
  "infix-dhcp-server:dhcp-server": {
    "option": [
      {
@@ -300,6 +294,7 @@
    "policy": [
      {
        "name": "lan-to-wan",
+	"action": "accept",
        "ingress": [
          "lan"
        ],
@@ -311,7 +306,7 @@
    ]
  },
  "infix-meta:meta": {
-    "version": "1.5"
+    "version": "1.6"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -0,0 +1,3 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7986-emmc-env.dtsi"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES="BOOT_DEVICE=emmc DRAM_USE_DDR4=1 USE_MKIMAGE=1  MKIMAGE=$(HOST_DIR)/bin/mkimage"
+CONFIG_SUPPORT_EMMC_BOOT=y
@@ -7,6 +7,27 @@ CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_MTK=y
 CONFIG_USB_MTU3=y
-CONFIG_CMD_USB=y
 CONFIG_PHY=y
 CONFIG_PHY_MTK_TPHY=y
+
+CONFIG_MTK_SPIM=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_SPI_FLASH=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH_MTD=y
+CONFIG_SPI_FLASH_MACRONIX=y
+CONFIG_SPI_FLASH_WINBOND=y
+CONFIG_SPI_FLASH_GIGADEVICE=y
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTK_SPIM=y
+CONFIG_MTK_SNOR=y
+
+CONFIG_CMD_SF=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_MTDPARTS=y
+CONFIG_CMD_DM=y
@@ -0,0 +1,5 @@
+#include <mt7986-env.dtsi>
+
+&env {
+      fdtfile = "mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb";
+};
@@ -58,7 +58,31 @@
      {
        "name": "wan",
        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
+        "ietf-ip:ipv6": {},
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"},
+              {"id": "vendor-class", "value": "NanoPi R2S"}
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {"id": "ntp-server"},
+              {"id": "client-fqdn"},
+              {"id": "domain-search"},
+              {"id": "dns-server"}
+            ]
+          }
+        }
      }
    ]
  },
@@ -172,36 +196,6 @@
    },
    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
  },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
-      {
-        "if-name": "wan",
-        "option": [
-          {
-            "id": "ntp-server"
-          },
-          {
-            "id": "broadcast"
-          },
-          {
-            "id": "domain"
-          },
-          {
-            "id": "hostname"
-          },
-          {
-            "id": "dns-server"
-          },
-          {
-            "id": "router"
-          },
-          {
-            "id": "netmask"
-          }
-        ]
-      }
-    ]
-  },
  "infix-dhcp-server:dhcp-server": {
    "option": [
      {
@@ -251,6 +245,7 @@
    "policy": [
      {
        "name": "lan-to-wan",
+	"action": "accept",
        "ingress": [
          "lan"
        ],
@@ -262,7 +257,7 @@
    ]
  },
  "infix-meta:meta": {
-    "version": "1.5"
+    "version": "1.6"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -1,59 +1,322 @@
-# Raspberry Pi 3B/4B
+# Raspberry Pi 3B/4B/CM4

-## Support level
+## Overview

-Full support for base board but not any extension board on the GPIOs.
-Other RPi boards of the same generation may work as well, but may need
-some additional testing/work.  A few CM4 variants have been tested and
-seem to work as expected, but YMMV as always.
+The Raspberry Pi is one of the most popular single-board computers with full
+Infix support for networking features, making it an excellent platform for
+learning, prototyping, and lightweight network applications.

-### Touch screen
+### Hardware Features

-The [Raspberry Pi touch display v1][0] is supported on the 4B, including
-touch functionality.  There are multiple touchscreens on the market for
-Raspberry Pi, but currently only the official first version with 800x480
-resolution is supported.  Infix supplies all drivers required to utilize
-the hardware, but you need to add the actual graphical application in a
-container.
+**Raspberry Pi 3B:**

-There are some important considerations you need to know about when
-using Infix for graphical applications.  The container needs access to
-`/dev/dri/` to be able to access the graphics card, it also need access
-to `/run/udev` to be able to find the input devices.
+- Broadcom BCM2837B0 ARM Cortex-A53 quad-core processor @ 1.4 GHz
+- 1 GB LPDDR2 RAM
+- microSD card slot for storage
+- 4x USB 2.0 ports
+- Fast Ethernet (100 Mbps)
+- Dual-band WiFi (2.4 GHz + 5 GHz) and Bluetooth 4.2
+- HDMI port
+- GPIO header (40-pin)

-Example of running Doom in Infix:
+**Raspberry Pi 4B:**
+
+- Broadcom BCM2711 ARM Cortex-A72 quad-core processor @ 1.5 GHz
+- 1 GB, 2 GB, 4 GB, or 8 GB LPDDR4 RAM (depending on model)
+- microSD card slot for storage
+- 2x USB 3.0 + 2x USB 2.0 ports
+- Gigabit Ethernet
+- Dual-band WiFi (2.4 GHz + 5 GHz) and Bluetooth 5.0
+- 2x micro-HDMI ports (up to 4K output)
+- GPIO header (40-pin)
+- PoE support (with add-on HAT)
+
+**Compute Module 4 (CM4):**
+
+- Same processor as Pi 4B
+- Compact form factor for embedded applications
+- Optional eMMC storage (0 GB, 8 GB, 16 GB, or 32 GB)
+- Requires carrier board for I/O connectivity
+- Various configurations tested and working
+
+### Default Network Configuration
+
+Infix comes preconfigured with:
+
+- **Ethernet port**: DHCP client enabled for internet connectivity
+- **WiFi interfaces** (wlan0, wlan1): Available for configuration as AP or client
+- **GPIO**: Available but extension boards not currently supported
+
+### Support Level
+
+Full support for base board networking and core functionality. GPIO extension
+boards (HATs) are not currently supported. Other Raspberry Pi boards of the
+same generation may work but may require additional testing.
+
+## Getting Started
+
+### Quick Start with SD Card
+
+The easiest way to get started is using a microSD card:
+
+1. **Download the SD card image:** [infix-rpi64-sdcard.img][2]
+2. **Flash the image to a microSD card:** see [this guide][0]
+3. **Boot the board:**
+   - Insert the microSD card into your Raspberry Pi
+   - Connect an Ethernet cable to your network
+   - Connect power (see [Power Supply Requirements](#power-supply-requirements))
+   - The board will boot automatically
+4. **Connect and login:**
+   - SSH to the DHCP-assigned IP address
+   - Default login: `admin` / `admin`
+
+> [!NOTE]
+> Raspberry Pi 3B and 4B boot with a factory configuration (`factory-config.cfg`)
+> that enables DHCP client on the Ethernet port. This means you can access
+> the device over the network without needing a serial console. Simply find
+> the assigned IP address and SSH in!
+>
+> **Compute Module 4 (CM4)** and some other variants do not have this factory
+> configuration, so you'll need to use a serial console for initial setup or
+> configure the carrier board accordingly.
+
+### First Boot Notes
+
+On first boot, Infix will:
+
+- Obtain an IP address via DHCP on the Ethernet port
+- Generate unique SSH host keys
+- Initialize the configuration system
+
+You can find the assigned IP address by:
+
+- Checking your DHCP server/router's client list
+- Using network scanning tools like `nmap` or `arp-scan`
+- Connecting via serial console and running `ip addr` (if needed)
+
+## Hardware-Specific Features
+
+### WiFi Configuration
+
+Both Pi 3B and Pi 4B include dual-band WiFi that can be configured as a
+client (station mode). See the [Infix WiFi documentation][9] for detailed
+configuration examples.
+
+To configure WiFi as a client, first store your WiFi password in the keystore:

 ```
-admin@example:/> configure
-admin@example:/config/> edit container doom
-admin@example:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
-admin@example:/config/container/doom/> set privileged
-admin@example:/config/container/doom/> edit mount udev
-admin@example:/config/container/doom/mount/udev/> set type bind
-admin@example:/config/container/doom/mount/udev/> set target /run/udev/
-admin@example:/config/container/doom/mount/udev/> set source /run/udev/
-admin@example:/config/container/doom/mount/udev/> end
-admin@example:/config/container/doom/mount/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
-admin@example:/config/container/doom/mount/xorg.conf/> set target /etc/X11/xorg.conf
-admin@example:/config/container/doom/mount/xorg.conf/> end
-admin@example:/config/container/doom/> edit volume var
-admin@example:/config/container/doom/volume/var/> set target /var
-admin@example:/config/container/doom/volume/var/> leave
-admin@example:/>
+admin@infix:/> configure
+admin@infix:/config/> edit keystore symmetric-key mywifi
+admin@infix:/config/keystore/…/mywifi/> set key-format wifi-preshared-key-format
+admin@infix:/config/keystore/…/mywifi/> set cleartext-key YourWiFiPassword
+admin@infix:/config/keystore/…/mywifi/> leave
+```
+
+Then configure the WiFi interface using the keystore reference:
+
+```
+admin@infix:/> configure
+admin@infix:/config/> edit interface wifi0
+admin@infix:/config/interface/wifi0/> set ipv4 dhcp-client
+admin@infix:/config/interface/wifi0/> set wifi ssid YourNetworkName
+admin@infix:/config/interface/wifi0/> set wifi secret mywifi
+admin@infix:/config/interface/wifi0/> set wifi country-code US
+admin@infix:/config/interface/wifi0/> leave
 ```

 > [!NOTE]
-> The `xorg.conf` [content mount][2] is a nifty detail of Infix that
-> allows you to keep all the relevant configuration in a single file.
-> The deta is "simply" `base64` encoded, so you do not really need the
-> features of the Infix CLI, everything can be set up remotely [using
-> `curl`][3] if you like.
+> The WiFi password (8-63 characters) is stored securely in the keystore as
+> `mywifi` (or any name you choose), which is then referenced in the WiFi
+> configuration. The country-code must match your location for regulatory
+> compliance (e.g., US, SE, DE, JP).

-### Pre-built images
+### Touch Screen Support

-Pre-built SD card images are available here: [infix-rpi64-sdcard.img][sdcard]
+The [Raspberry Pi Touch Display v1][10] (800x480 resolution) is supported on
+the Pi 4B, including touch functionality. To use graphical applications with
+the touch screen, you need to run them in a container with proper device
+access.

-[0]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
-[1]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
-[2]: https://kernelkit.org/infix/latest/container/#content-mounts
-[3]: https://kernelkit.org/infix/latest/scripting-restconf/
+#### Requirements for Graphical Applications
+
+Containers need:
+- Access to `/dev/dri/` for graphics card access
+- Access to `/run/udev` for input device detection
+- Privileged mode or specific capabilities
+
+#### Example: Running Doom with Touch Screen
+
+```
+admin@infix:/> configure
+admin@infix:/config/> edit container doom
+admin@infix:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
+admin@infix:/config/container/doom/> set privileged
+admin@infix:/config/container/doom/> edit mount udev
+admin@infix:/config/container/…/udev/> set type bind
+admin@infix:/config/container/…/udev/> set target /run/udev/
+admin@infix:/config/container/…/udev/> set source /run/udev/
+admin@infix:/config/container/…/udev/> end
+admin@infix:/config/container/doom/> edit mount xorg.conf
+admin@infix:/config/container/…/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
+admin@infix:/config/container/…/xorg.conf/> set target /etc/X11/xorg.conf
+admin@infix:/config/container/…/xorg.conf/> end
+admin@infix:/config/container/doom/> edit volume var
+admin@infix:/config/container/…/var/> set target /var
+admin@infix:/config/container/…/var/> leave
+```
+
+> [!NOTE]
+> The `xorg.conf` [content mount][3] is a useful Infix feature that allows you
+> to keep all configuration in a single file. The data is base64 encoded, and
+> everything can be set up remotely [using `curl`][4] if preferred.
+
+### Power Supply Requirements
+
+Proper power supply is critical for stable operation:
+
+- **Raspberry Pi 4B:** 5V/3A USB-C power supply (official recommended)
+- **Raspberry Pi 3B:** 5V/2.5A micro-USB power supply
+- **Compute Module 4:** Power requirements depend on carrier board
+
+Inadequate power can cause:
+- Random reboots or crashes
+- USB device failures
+- Network disconnections
+- Corrupted storage
+
+<img align="right" src="gpio-pinout.png" alt="GPIO Pinout" width=300 padding=10>
+
+### Serial Console Access (Optional)
+
+A serial console is useful for debugging but not required for Pi 3B/4B, since
+the factory configuration enables network access via DHCP. For CM4 and other
+variants without factory configuration, serial console access is required for
+initial setup.
+
+To connect via serial:
+
+1. Connect a USB-to-TTL serial adapter (3.3V) to GPIO pins:
+   - GND (black wire) → Pin 6 (Ground)
+   - TX → Pin 8 (GPIO 14, RXD)
+   - RX → Pin 10 (GPIO 15, TXD)
+   - **VCC (red wire) → Leave disconnected** (Pi has its own power supply)
+2. Use 115200 baud, 8 data bits, no parity, 1 stop bit (115200 8N1)
+3. Connect using `screen`, `minicom`, or similar terminal emulator
+
+The image shows the standard 40-pin GPIO header pinout. For serial console:
+- **Pin 6** (black) = Ground
+- **Pin 8** (orange) = TxD (UART) - connect to RX on your adapter
+- **Pin 10** (orange) = RxD (UART) - connect to TX on your adapter
+
+> [!WARNING]
+> Use only 3.3V serial adapters. 5V adapters will damage your Raspberry Pi!
+
+## Troubleshooting
+
+### Board won't boot
+
+- Verify the power supply meets requirements (see [Power Supply Requirements](#power-supply-requirements))
+- Check that the SD card is properly seated
+- Try re-flashing the SD card image
+- Look for the green LED activity indicator (should flash during boot)
+- Connect via serial console to see boot messages if needed
+
+### Can't find IP address
+
+- Ensure Ethernet cable is properly connected (look for link LED activity)
+- Verify your DHCP server is running and has available addresses
+- Check your router/DHCP server's client list for new devices
+- Use `nmap` or `arp-scan` to scan your network
+- Connect via serial console and run `ip addr` to see the assigned address
+
+### WiFi not working
+
+- Verify WiFi regulatory domain is set correctly
+- Check that SSID and password are correct
+- Ensure WiFi channel is supported in your region
+- Try connecting to a 2.4 GHz network first (better compatibility)
+
+### SD card corruption
+
+If the system becomes unresponsive or won't boot:
+
+- Always use proper shutdown procedures (don't just pull power)
+- Use a quality SD card (Class 10, A1, or better recommended)
+- Consider using a UPS or battery backup for critical deployments
+- Verify power supply meets requirements (see [Power Supply Requirements](#power-supply-requirements))
+
+### Container/Docker issues
+
+- Verify adequate RAM is available (check with `free -h`)
+- Ensure sufficient SD card space (check with `df -h`)
+- For Pi 3B, consider using lighter containers due to limited RAM
+
+## Additional Resources
+
+- [Infix Documentation][1]
+- [Flashing SD Card Guide][0]
+- [Infix Container Documentation][3]
+- [Scripting with RESTCONF][4]
+- [Release Downloads][8]
+- [Official Raspberry Pi Documentation][11]
+
+## Building Custom Images
+
+See the main Infix documentation for building from source. To build a custom
+Raspberry Pi image:
+
+```bash
+# Build the bootloader (only needed once or when bootloader changes)
+make O=x-boot rpi64_boot_defconfig
+make O=x-boot
+
+# Build main system
+make aarch64_defconfig
+make
+
+# Create SD card image
+./utils/mkimage.sh -od raspberrypi-rpi64
+```
+
+The resulting image will be in `output/images/infix-rpi64-sdcard.img`.
+
+### Customizing the Build
+
+You can customize the build by:
+- Modifying `board/aarch64/raspberrypi-rpi64/config.txt` for boot configuration
+- Adding packages to the Buildroot configuration
+- Customizing the device tree in `board/aarch64/raspberrypi-rpi64/dts/`
+
+## Performance Notes
+
+### Raspberry Pi 4B vs 3B
+
+The Pi 4B offers significant improvements over the 3B:
+- 3x faster processor
+- Up to 8x more RAM
+- Gigabit Ethernet (vs 100 Mbps)
+- USB 3.0 for faster storage and peripherals
+- Better thermal performance
+
+For network-intensive applications, the Pi 4B is strongly recommended.
+
+### Raspberry Pi as a Router
+
+While capable of basic routing tasks, be aware of limitations:
+- Single Ethernet port (consider USB Ethernet adapters for multi-port setups)
+- CPU-based packet processing (no hardware offload)
+- Best suited for home/lab use rather than high-throughput production
+
+For applications requiring multiple ports or high performance, consider
+dedicated networking hardware like the [Banana Pi R3][12].
+
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://kernelkit.org/infix/latest/
+[2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
+[3]: https://kernelkit.org/infix/latest/container/#content-mounts
+[4]: https://kernelkit.org/infix/latest/scripting-restconf/
+[8]: https://github.com/kernelkit/infix/releases/tag/latest-boot
+[9]: https://kernelkit.org/infix/latest/networking/#wifi
+[10]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
+[11]: https://www.raspberrypi.com/documentation/
+[12]: https://kernelkit.org/infix/latest/hardware/#banana-pi-bpi-r3
@@ -1,3 +1,9 @@
+# Raspberry Pi bootloader (start.elf) configuration
+#
+# uart_2ndstage=1 - Enable early boot debug output from the bootloader
+#                   Useful for debugging boot failures before U-Boot starts
+#                   Comment out for production to reduce boot noise
+
 [all]
 arm_64bit=1

@@ -12,7 +18,7 @@ dtoverlay=infix-key
 disable_overscan=1

 enable_uart=1
-uart_2ndstage=1
+#uart_2ndstage=1

 [pi3]
 start_file=start.elf
@@ -37,7 +37,21 @@
      },
      {
        "name": "eth0",
-        "type": "infix-if-type:ethernet"
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {"id": "netmask"},
+              {"id": "broadcast"},
+              {"id": "router"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "ntp-server"},
+              {"id": "vendor-class", "value": "Raspberry Pi 4 Model B"}
+            ]
+          }
+        }
      },
      {
        "name": "wifi0",
@@ -157,38 +171,8 @@
    },
    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
  },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
-      {
-        "if-name": "eth0",
-        "option": [
-          {
-            "id": "netmask"
-          },
-          {
-            "id": "broadcast"
-          },
-          {
-            "id": "router"
-          },
-          {
-            "id": "domain"
-          },
-          {
-            "id": "hostname"
-          },
-          {
-            "id": "dns-server"
-          },
-          {
-            "id": "ntp-server"
-          }
-        ]
-      }
-    ]
-  },
  "infix-meta:meta": {
-    "version": "1.5"
+    "version": "1.6"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -1,6 +0,0 @@
-cat <<EOF
-   {
-        "name": "wifi0",
-        "type": "infix-if-type:wifi",
-   }
-EOF
@@ -1,5 +1,11 @@
 mainmenu "QEMU Virtualization"

+config QEMU_ARCH_IS_32
+	bool
+
+config QEMU_ARCH_IS_64
+	bool
+
 choice
 	prompt "Target Architecture"
 	default @ARCH@
@@ -12,6 +18,10 @@ config QEMU_x86_64
 	bool "x86_64"
 	select QEMU_ARCH_IS_64

+config QEMU_arm
+	bool "AArch32 (little endian)"
+	select QEMU_ARCH_IS_32
+
 config QEMU_aarch64
 	bool "AArch64 (little endian)"
 	select QEMU_ARCH_IS_64
@@ -54,6 +64,7 @@ endchoice

 choice
     prompt "Console"
+     default QEMU_CONSOLE_SERIAL if QEMU_arm
     default QEMU_CONSOLE_VIRTIO

 config QEMU_CONSOLE_VIRTIO
@@ -66,6 +77,7 @@ endchoice

 config QEMU_MACHINE
 	string "Select emulated machine"
+	default "qemu-system-arm     -M virt,accel=kvm:tcg -cpu max" if QEMU_arm
 	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
 	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
@@ -73,8 +85,8 @@ config QEMU_MACHINE
 	  want to tweak it, or change the acceleration.

 	  The default is based on the Buildroot architecture, selected by
-	  the defconfig you started with.  Currently Infix supports only
-	  aarch64 (ARM64) and x86_64 (AMD64).
+	  the defconfig you started with.  Currently Infix supports
+	  arm (AArch32), aarch64 (ARM64), and x86_64 (AMD64).

 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
@@ -87,6 +99,7 @@ config QEMU_MACHINE_RAM
 config QEMU_KERNEL
 	string
 	depends on QEMU_LOADER_KERNEL
+	default "zImage"  if QEMU_arm
 	default "Image"   if QEMU_aarch64
 	default "bzImage" if QEMU_x86_64

@@ -211,12 +224,15 @@ endchoice

 config QEMU_NET_MODEL
 	string "Interface model"
+	default "virtio-net-device" if QEMU_arm
 	default "virtio-net-pci"
 	help
 	  The default, virtio-net-pci, NIC works for most use-cases, but
 	  if you want to play with low-level stuff like ethtool, you
 	  might want to test the Intel 82545EM driver, e1000.

+	  Note: ARM32 uses virtio-net-device (MMIO) by default.
+
 config QEMU_NET_BRIDGE_DEV
 	string "Bridge device"
 	depends on QEMU_NET_BRIDGE
@@ -84,7 +84,10 @@ loader_args()

 append_args()
 {
-    if [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
+    # ARM32 doesn't support virtio console properly, always use serial
+    if [ "$CONFIG_QEMU_arm" ]; then
+	echo -n "console=ttyAMA0 "
+    elif [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
 	echo -n "console=hvc0 "
    elif [ "$CONFIG_QEMU_x86_64" ]; then
 	echo -n "console=ttyS0 "
@@ -120,7 +123,13 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=qemu.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
+	# ARM32 virt machine uses MMIO virtio devices, not PCI
+	if [ "$CONFIG_QEMU_arm" ]; then
+	    echo -n "-drive file=qemu.qcow2,if=none,format=qcow2,id=rootfs "
+	    echo -n "-device virtio-blk-device,drive=rootfs "
+	else
+	    echo -n "-drive file=qemu.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
+	fi
    fi
 }

@@ -173,22 +182,38 @@ rw_args()
 	dd if=/dev/zero of="aux.ext4" bs=1M count=1 >/dev/null 2>&1
 	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
    fi
-    echo -n "-drive file=aux.ext4,if=virtio,format=raw,bus=0,unit=3 "

    if ! [ -f "$CONFIG_QEMU_RW" ]; then
 	dd if=/dev/zero of="$CONFIG_QEMU_RW" bs=16M count=1 >/dev/null 2>&1
 	mkfs.ext4 -L cfg "$CONFIG_QEMU_RW" >/dev/null 2>&1
    fi

-    echo -n "-drive file=$CONFIG_QEMU_RW,if=virtio,format=raw,bus=0,unit=1 "
+    # ARM32 virt machine uses MMIO virtio devices, not PCI
+    if [ "$CONFIG_QEMU_arm" ]; then
+	echo -n "-drive file=aux.ext4,if=none,format=raw,id=aux "
+	echo -n "-device virtio-blk-device,drive=aux "
+	echo -n "-drive file=$CONFIG_QEMU_RW,if=none,format=raw,id=cfg "
+	echo -n "-device virtio-blk-device,drive=cfg "

-    if [ "$CONFIG_QEMU_RW_VAR_OPT" ]; then
-	if ! [ -f "$CONFIG_QEMU_RW_VAR" ]; then
-	    dd if=/dev/zero of="$CONFIG_QEMU_RW_VAR" bs=$CONFIG_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
-	    mkfs.ext4 -L var "$CONFIG_QEMU_RW_VAR" >/dev/null 2>&1
+	if [ "$CONFIG_QEMU_RW_VAR_OPT" ]; then
+	    if ! [ -f "$CONFIG_QEMU_RW_VAR" ]; then
+		dd if=/dev/zero of="$CONFIG_QEMU_RW_VAR" bs=$CONFIG_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
+		mkfs.ext4 -L var "$CONFIG_QEMU_RW_VAR" >/dev/null 2>&1
+	    fi
+	    echo -n "-drive file=$CONFIG_QEMU_RW_VAR,if=none,format=raw,id=var "
+	    echo -n "-device virtio-blk-device,drive=var "
 	fi
+    else
+	echo -n "-drive file=aux.ext4,if=virtio,format=raw,bus=0,unit=3 "
+	echo -n "-drive file=$CONFIG_QEMU_RW,if=virtio,format=raw,bus=0,unit=1 "

-	echo -n "-drive file=$CONFIG_QEMU_RW_VAR,if=virtio,format=raw,bus=0,unit=2 "
+	if [ "$CONFIG_QEMU_RW_VAR_OPT" ]; then
+	    if ! [ -f "$CONFIG_QEMU_RW_VAR" ]; then
+		dd if=/dev/zero of="$CONFIG_QEMU_RW_VAR" bs=$CONFIG_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
+		mkfs.ext4 -L var "$CONFIG_QEMU_RW_VAR" >/dev/null 2>&1
+	    fi
+	    echo -n "-drive file=$CONFIG_QEMU_RW_VAR,if=virtio,format=raw,bus=0,unit=2 "
+	fi
    fi
 }

@@ -313,8 +338,35 @@ gdb_args()
    echo -n "-gdb chardev:gdbqemu"
 }

+extract_squashfs()
+{
+    # Extract rootfs.squashfs from rootfs.itb if missing
+    # The .itb file is rootfs.itbh (4096 bytes) + rootfs.squashfs
+    input="${1:-rootfs.itb}"
+    output="${2:-rootfs.squashfs}"
+
+    [ -f "$input" ] || die "Cannot extract $output: $input not found"
+
+    echo "Extracting $output from $input (skipping 4096-byte FIT header)..."
+    dd if="$input" of="$output" bs=4096 skip=1 2>/dev/null \
+        || die "Failed to extract $output from $input"
+
+    echo "Successfully created $output"
+}
+
 run_qemu()
 {
+    # Auto-extract rootfs.squashfs from rootfs.itb if needed for initrd mode
+    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
+	if [ "$CONFIG_QEMU_ROOTFS" = "rootfs.squashfs" ] && [ ! -f "rootfs.squashfs" ]; then
+	    if [ -f "rootfs.itb" ]; then
+		extract_squashfs "rootfs.itb" "rootfs.squashfs"
+	    else
+		die "Missing rootfs.squashfs and cannot find rootfs.itb to extract it from"
+	    fi
+	fi
+    fi
+
    if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	if ! qemu-img check "qemu.qcow2"; then
 	    rm -f "qemu.qcow2"
@@ -31,6 +31,8 @@ bind "set completion-ignore-case on"
 # show all completions immediately instead of ringing bell
 bind "set show-all-if-ambiguous on"

+export LANG=C.UTF-8
+
 log()
 {
    local fn="/var/log/syslog"
@@ -1,2 +1,3 @@
 set COLORTERM=yes
-rlimit soft core infinity
+set LANG=C.UTF-8
+rlimit soft core infinity
@@ -15,9 +15,9 @@ cfgfs		/config		configfs	nofail,noauto		0	0
 # The chosen backing storage for the overlays placed on /cfg, /etc,
 # /home, /root, and /var, are determined dynamically by /usr/libexec/infix/mnt
 # depending on the available devices.
-mnttmp		/mnt/tmp	tmpfs	defaults				0	0
-LABEL=aux	/mnt/aux	auto	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
-LABEL=var	/mnt/var	auto	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
-LABEL=cfg	/mnt/cfg	auto	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
-hostfs		/mnt/host	9p	cache=none,msize=16384,noauto		0	0
-/usr/libexec/infix/mnt#	/cfg	helper	none					0	0
+mnttmp		/mnt/tmp	tmpfs	defaults					0	0
+LABEL=aux	/mnt/aux	auto	noatime,nodiratime,noauto,errors=remount-ro	0	0
+LABEL=var	/mnt/var	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
+LABEL=cfg	/mnt/cfg	ext4	noatime,nodiratime,noauto,commit=30,errors=remount-ro	0 0
+hostfs		/mnt/host	9p	cache=none,msize=16384,noauto			0	0
+/usr/libexec/infix/mnt#	/cfg	helper	none						0	0
@@ -3,6 +3,7 @@ alias la='ls -A'
 alias ll='ls -alF'
 alias ls='ls --color=auto'

+export LANG=C.UTF-8
 export EDITOR=/usr/bin/edit
 export VISUAL=/usr/bin/edit
 export LESS="-P %f (press h for help or q to quit)"
@@ -0,0 +1 @@
+/usr/share/udhcpc/default.script
@@ -0,0 +1 @@
+/usr/share/udhcpc/default6.script
@@ -0,0 +1,74 @@
+#!/bin/sh
+# Deterministically set system hostname from /etc/hostname.d/
+#
+# Highest numbered file wins (lexicographic sort, 90-dhcp > 50-configured > 10-default)
+#
+# Priority scheme:
+#   10-default       - Bootstrap/factory default (%h-%m format)
+#   50-configured    - From confd /system/hostname
+#   90-dhcp-<iface>  - From DHCP clietn on interface (highest priority)
+
+HOSTNAME_D="/etc/hostname.d"
+
+# Ensure directory exists
+mkdir -p "$HOSTNAME_D"
+
+# Find the highest priority file (reverse sort, take first)
+hostname_file=$(ls -1 "$HOSTNAME_D" 2>/dev/null | sort -r | head -1)
+
+if [ -z "$hostname_file" ]; then
+    logger -it confd "No hostname sources found in $HOSTNAME_D"
+    exit 1
+fi
+
+# Read hostname from the file (first line only, strip whitespace)
+new_hostname=$(cat "$HOSTNAME_D/$hostname_file" | head -1 | tr -d '\n\r\t ')
+if [ -z "$new_hostname" ]; then
+    logger -it confd "Empty hostname in $hostname_file"
+    exit 1
+fi
+
+if [ ${#new_hostname} -gt 64 ]; then
+    logger -it confd "Hostname too long (${#new_hostname} > 64) in $hostname_file"
+    exit 1
+fi
+
+# Check if hostname has actually changed
+current_hostname=$(hostname)
+if [ "$new_hostname" = "$current_hostname" ]; then
+    # No change needed, exit silently
+    exit 0
+fi
+
+# Set the hostname
+logger -it confd "Setting hostname to '$new_hostname' from $hostname_file"
+hostname "$new_hostname"
+
+# Update /etc/hostname (for persistence across reboots)
+echo "$new_hostname" > /etc/hostname
+
+# Update /etc/hosts (127.0.1.1 entry for proper name resolution)
+if grep -q "^127\.0\.1\.1" /etc/hosts; then
+    sed -i -E "s/^(127\.0\.1\.1\s+).*/\1$new_hostname/" /etc/hosts
+else
+    # Add entry if it doesn't exist
+    echo "127.0.1.1	$new_hostname" >> /etc/hosts
+fi
+
+# Notify services of hostname change, skip while in bootstrap
+initctl -nbq touch sysklogd
+if ! runlevel >/dev/null 2>&1; then
+    exit 0
+fi
+
+initctl -bq status lldpd && lldpcli configure system hostname "$new_hostname" 2>/dev/null
+initctl -bq status mdns  && avahi-set-host-name "$new_hostname" 2>/dev/null
+initctl -bq touch netbrowse 2>/dev/null
+
+# If called from dhcp script we need to reload to activate new name in syslogd
+# Otherwise we're called from confd, which does the reload when all is done.
+if [ -n "$1" ]; then
+    initctl -b reload
+fi
+
+exit 0
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-
 import importlib.machinery
 import json
 import os
@@ -146,6 +145,87 @@ class DTSystem:
        flat_devices = [device for sublist in self.infix_devices("vpds") for device in sublist]
        return [self.into_vpd(device) for device in flat_devices]

+    def vendor_name(self):
+        """Extract vendor name from devicetree compatible property"""
+        compatible = self.base.str_array("compatible")
+        if not compatible or len(compatible) == 0:
+            return None
+
+        # Map of common devicetree vendor prefixes to proper names
+        vendor_map = {
+            "raspberrypi": "Raspberry Pi Foundation",
+            "brcm": "Broadcom Inc.",
+            "marvell": "Marvell Technology, Inc.",
+            "fsl": "NXP Semiconductors N.V.",
+            "nxp": "NXP Semiconductors N.V.",
+            "ti": "Texas Instruments Inc.",
+            "qcom": "Qualcomm Inc.",
+            "rockchip": "Rockchip Electronics Co., Ltd.",
+            "amlogic": "Amlogic Inc.",
+            "allwinner": "Allwinner Technology Co., Ltd.",
+            "mediatek": "MediaTek Inc.",
+            "st": "STMicroelectronics N.V.",
+            "xlnx": "Xilinx, Inc.",
+            "intel": "Intel Corporation",
+            "amd": "Advanced Micro Devices, Inc.",
+            "nvidia": "NVIDIA Corporation",
+            "bananapi": "SinoVoip Co., Ltd.",
+            "sinovoip": "SinoVoip Co., Ltd.",
+            "friendlyarm": "FriendlyElec",
+            "friendlyelec": "FriendlyElec",
+            "microchip": "Microchip Technology Inc.",
+            "atmel": "Microchip Technology Inc.",
+        }
+
+        # Get the first (most specific) compatible string
+        compat = compatible[0]
+
+        # Extract vendor prefix (part before comma)
+        if ',' in compat:
+            prefix = compat.split(',')[0].lower()
+            # Return mapped name or capitalized prefix
+            return vendor_map.get(prefix, prefix.capitalize())
+
+        return None
+
+
+class DMISystem:
+    BASE = "/sys/class/dmi/id"
+
+    def read_dmi(self, attr):
+        """Read DMI attribute from /sys/class/dmi/id/"""
+        path = os.path.join(DMISystem.BASE, attr)
+        if not os.path.exists(path):
+            return None
+        try:
+            with open(path, 'r', encoding='utf-8') as f:
+                value = f.read().strip()
+                return value if value else None
+        except:
+            return None
+
+    def populate(self, out):
+        """Read DMI/SMBIOS data and populate output dictionary"""
+        vendor = self.read_dmi("sys_vendor")
+        if vendor:
+            out["vendor"] = vendor
+
+        product_name = self.read_dmi("product_name")
+        if product_name:
+            out["product-name"] = product_name
+
+        serial = self.read_dmi("product_serial")
+        if serial:
+            out["serial-number"] = serial
+
+        version = self.read_dmi("product_version")
+        if version:
+            out["product-version"] = version
+
+    def vpds(self):
+        """DMI systems don't have VPD in the traditional sense"""
+        return []
+

 class QEMUSystem:
    BASE = "/sys/firmware/qemu_fw_cfg"
@@ -278,49 +358,32 @@ def vpd_inject(out, vpds):


 def fallback_base_mac():
-    """Find MAC address of first suitable non-loopback interface.
-
-    Prefers real (globally unique) MACs over locally administered ones.
-    Prioritizes interface types: eth* > wan > wifi* > others.
-    """
+    """Find lowest valid MAC address from all interfaces."""
    base_path = '/sys/class/net'
-    interfaces = []
+    macs = []

    for iface in os.listdir(base_path):
-        if iface == 'lo':
-            continue
        try:
-            # pylint: disable=invalid-name
            fn = os.path.join(base_path, iface, 'address')
            with open(fn, 'r', encoding='ascii') as f:
                mac = f.read().strip()

-            # Check if locally administered (bit 1 of first octet is set)
-            first_byte = int(mac.split(':')[0], 16)
-            is_local = bool(first_byte & 0x02)
+            # Skip invalid/empty/unset MAC addresses
+            if not mac or len(mac) < 17 or mac == '00:00:00:00:00:00':
+                continue

-            # Prefer: eth* > wan > wifi* > others, then real MACs > local MACs
-            priority = 0
-            if iface.startswith('eth'):
-                priority = 400
-            elif iface == 'wan':
-                priority = 300
-            elif iface.startswith('wifi'):
-                priority = 200
-            else:
-                priority = 100
+            # Validate MAC address format
+            parts = mac.split(':')
+            if len(parts) != 6:
+                continue

-            # Real MACs get +100 bonus
-            if not is_local:
-                priority += 100
-
-            interfaces.append((priority, iface, mac))
-        except FileNotFoundError:
+            macs.append(mac)
+        except (FileNotFoundError, ValueError):
            continue

-    if interfaces:
-        interfaces.sort(reverse=True)  # Highest priority first
-        return interfaces[0][2]  # Return MAC
+    if macs:
+        macs.sort()
+        return macs[0]

    return None

@@ -355,6 +418,9 @@ def probe_qemusystem(out):
        if not out[attr]:
            out[attr] = default

+    if os.path.exists(DMISystem.BASE):
+        DMISystem().populate(out)
+
    if not out["factory-password-hash"] and \
       not out["vpd"]["product"]["available"]:
        # Virtual instance without VPD emulation, fallback to
@@ -397,6 +463,21 @@ def generic_usb_ports(out):
            out["usb-ports"] = [{"name": f"USB{p['num']}", "path": p["path"]} for p in ports]


+def probe_dmisystem(out):
+    """Probe DMI/SMBIOS based system (x86/AMD64)"""
+    dmisys = DMISystem()
+
+    dmisys.populate(out)
+    generic_usb_ports(out)
+
+    if not out["mac-address"]:
+        out["mac-address"] = fallback_base_mac()
+
+    vpd_inject(out, dmisys.vpds())
+
+    return 0
+
+
 def probe_dtsystem(out):
    """Probe DTS based system, expects a VPD in ONIE PROM format."""
    dtsys = DTSystem()
@@ -413,12 +494,24 @@ def probe_dtsystem(out):

    out["compatible"] = dtsys.base.str_array("compatible")

+    # Extract vendor from compatible string if not already set
+    if not out["vendor"]:
+        vendor = dtsys.vendor_name()
+        if vendor:
+            out["vendor"] = vendor
+
    staticpw = dtsys.infix.str("factory-password-hash")
    if not out["factory-password-hash"]:
        out["factory-password-hash"] = staticpw

    vpd_inject(out, vpds)

+    # Fallback to devicetree serial-number if VPD doesn't provide one
+    if not out["serial-number"]:
+        serial = dtsys.base.str("serial-number")
+        if serial:
+            out["serial-number"] = serial
+
    # Fallback to interface MAC if VPD doesn't provide one (e.g., SBCs)
    if not out["mac-address"]:
        out["mac-address"] = fallback_base_mac()
@@ -430,6 +523,7 @@ def main():
    out = {
        "vendor": None,
        "product-name": None,
+        "product-version": None,
        "part-number": None,
        "serial-number": None,
        "mac-address": None,
@@ -440,6 +534,8 @@ def main():

    if os.path.exists(QEMUSystem.REV):
        err = probe_qemusystem(out)
+    elif os.path.exists(DMISystem.BASE):
+        err = probe_dmisystem(out)
    elif os.path.exists(DTSystem.BASE):
        err = probe_dtsystem(out)
    else:
@@ -0,0 +1,18 @@
+#!/bin/sh
+# Initialize default hostname for hostname.d pattern
+# This runs very early in boot to set up the default hostname entry
+
+HOSTNAME_D="/etc/hostname.d"
+
+# Ensure directory exists
+mkdir -p "$HOSTNAME_D"
+
+# If no default exists yet, create it from /etc/hostname (from squashfs)
+if [ ! -f "$HOSTNAME_D/10-default" ] && [ -f /etc/hostname ]; then
+    cp /etc/hostname "$HOSTNAME_D/10-default"
+fi
+
+# Apply hostname using the deterministic helper
+if [ -x /usr/libexec/infix/hostname ]; then
+    /usr/libexec/infix/hostname
+fi
@@ -8,7 +8,8 @@ PUB=$2

 mkdir -p "$(dirname "$KEY")" "$(dirname "$PUB")"

+# openssl genpkey -quiet -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -outform PEM
 openssl genpkey -quiet -algorithm RSA -pkeyopt rsa_keygen_bits:$BIT -outform PEM > "$KEY"
-openssl rsa -RSAPublicKey_out < "$KEY" > "$PUB"
+openssl rsa -RSAPublicKey_out < "$KEY" 2>/dev/null > "$PUB"

 exit 0
@@ -1,7 +1,7 @@
-#!/bin/bash
-# Store and convert RSA PUBLIC/PRIVATE KEYs to be able to use them in
-# OpenSSHd.
+#!/bin/sh
+# Generate OpenSSH host key pair from same keys as NETCONF
 set -e
+umask 0077

 NAME="$1"
 DIR="$2"
@@ -9,15 +9,21 @@ PUBLIC="$3"
 PRIVATE="$4"
 TMP="$(mktemp)"

-echo -e '-----BEGIN RSA PRIVATE KEY-----' > "$DIR/$NAME"
-echo "$PRIVATE" >> "$DIR/$NAME"
-echo -e '-----END RSA PRIVATE KEY-----' >> "$DIR/$NAME"
+{
+	echo '-----BEGIN PRIVATE KEY-----'
+	printf '%s\n' "$PRIVATE" | fold -w 64
+	echo '-----END PRIVATE KEY-----'
+} > "$DIR/$NAME"

-echo -e "-----BEGIN RSA PUBLIC KEY-----" > "$TMP"
-echo -e "$PUBLIC" >> "$TMP"
-echo -e "-----END RSA PUBLIC KEY-----" >> "$TMP"
+{
+	echo "-----BEGIN RSA PUBLIC KEY-----"
+	printf '%s\n' "$PUBLIC" | fold -w 64
+	echo "-----END RSA PUBLIC KEY-----"
+} > "$TMP"
+
+ssh-keygen -i -f "$TMP" -m PKCS8 > "$DIR/$NAME.pub"
+rm "$TMP"

-ssh-keygen -i -m PKCS8 -f "$TMP" > "$DIR/$NAME.pub"
 chmod 0600 "$DIR/$NAME.pub"
 chmod 0600 "$DIR/$NAME"
 chown sshd:sshd "$DIR/$NAME.pub"
@@ -44,12 +44,15 @@ check_factory()
 factory_reset()
 {
    find /sys/class/leds/ -type l -exec sh -c 'echo 100 > $0/brightness' {} \;
-    logger $opt -p user.crit -t "$nm" "Resetting to factory defaults."
+    print_start "Resetting to factory defaults."
+    logger $opt -p user.notice -t "$nm" "Resetting to factory defaults."

    rm -rf /mnt/cfg/* /mnt/var/*
-
-    logger $opt -p user.crit -t "$nm" "Factory reset complete."
    sync
+
+    logger $opt -p user.notice -t "$nm" "Factory reset complete."
+    print_end 0 "Factory reset complete."
+    print_restore
 }

 is_mmc()
@@ -105,15 +108,18 @@ find_partition_by_label()
 	esac

 	disk="/dev/$devname"
+
+	#
+	# 1. Try GPT/MBR partition label using sgdisk
+	#
 	result=$(sgdisk -p "$disk" 2>/dev/null | awk -v label="$label" -v devname="$devname" '
-	    /^  *[0-9]/ {
+	    /^ *[0-9]/ {
 		if ($7 == label) {
-		    if (devname ~ /^(mmcblk|nvme|loop)/) {
-			print devname "p" $1
-		    } else {
-			print devname $1
-		    }
-		    exit 0
+		    if (devname ~ /^(mmcblk|nvme|loop)/)
+			print devname "p" $1;
+		    else
+			print devname $1;
+		    exit 0;
 		}
 	    }
 	')
@@ -122,7 +128,30 @@ find_partition_by_label()
 	    echo "$result"
 	    return 0
 	fi
+
+	#
+	# 2. Fallback: Check if the whole disk is an ext4/ext2/ext3 filesystem
+	#
+
+	# Check for ext4/ext2/ext3 magic number (0xEF53) at offset 1080 (1024+56).
+	magic_number=$(dd if="$disk" bs=1 skip=1080 count=2 2>/dev/null | od -t x2 -A n | tr -d ' \n')
+
+	# Check for both Little-Endian ('53ef') and Big-Endian ('ef53') interpretations of 0xEF53.
+	# This supports bi-endian architectures like MIPS that may run in BE mode,
+	# as well as the LE mode which is standard for RISC-V and ext filesystems.
+	if [ "$magic_number" = "ef53" ] || [ "$magic_number" = "53ef" ]; then
+
+	    # Read the volume label from offset 1144 (1024+120)
+	    fslabel=$(dd if="$disk" bs=1 skip=1144 count=16 2>/dev/null | tr -d '\000')
+	    logger $opt -p user.notice -t "$nm" "Found label $fslabel on disk $disk ..."
+
+	    if [ "$fslabel" = "$label" ]; then
+		echo "$devname"
+		return 0
+	    fi
+	fi
    done
+
    return 1
 }

@@ -273,6 +302,9 @@ mount_rw()
    # If something is already setup, leave it be.
    mountpoint -q "/$1" && return 0

+    # If partition doesn't exist (var is optional), signal caller.
+    find_partition_by_label "$1" >/dev/null || return 1
+
    # Check if /var has been resized to fill the sdcard/eMMC
    if [ "$1" = "var" ] && is_mmc; then
 	if [ -f /mnt/aux/resized ] || [ -f /mnt/aux/resized.failed ]; then
@@ -289,8 +321,10 @@ mount_rw()

    # TODO: Also look for UBI partitions

-    # 
-    tune2fs -c 0 -i 0 LABEL="$1" 2>/dev/null 
+    # Disable periodic fsck, yet keeping safety checks on ext4
+    if grep "LABEL=$label" /etc/fstab |grep -q ext4; then
+	tune2fs -c 0 -i 0 LABEL="$1" 2>/dev/null
+    fi
    mount LABEL="$1" 2>/dev/null && return 0

    return 1
@@ -50,6 +50,26 @@ wait_for_ipv6_default_route()
    err "Timed out waiting for IPv6 default route!"
 }

+# Check if a DHCP option was requested in the parameter request list
+# Returns: 0 if requested, 1 if not requested or config unavailable
+was_option_requested()
+{
+    local opt_num="$1"
+    local config="/etc/finit.d/available/dhcp-client-${interface}.conf"
+
+    if [ ! -f "$config" ]; then
+	dbg "config file not found: $config"
+	return 1
+    fi
+
+    # Extract udhcpc command line and check for -O <option_num>
+    if grep -q -- "-O ${opt_num}\b" "$config"; then
+	return 0
+    fi
+
+    return 1
+}
+
 # RFC3442: If the DHCP server returns both a Classless
 # Static Routes option and a Router option, the DHCP
 # client MUST ignore the Router option.
@@ -57,17 +77,25 @@ set_dhcp_routes()
 {
    echo "! Generated by udhcpc" > "$NEXT"
    if [ -n "$staticroutes" ]; then
-	# format: dest1/mask gw1 ... destn/mask gwn
-	set -- $staticroutes
-	while [ -n "$1" -a -n "$2" ]; do
-	    dbg "adding route $1 via $2 metric $metric tag 100"
-	    echo "ip route $1 $2 $metric tag 100" >> "$NEXT"
-	    shift 2
-	done
+	if was_option_requested 121; then
+	    # format: dest1/mask gw1 ... destn/mask gwn
+	    set -- $staticroutes
+	    while [ -n "$1" -a -n "$2" ]; do
+		dbg "adding route $1 via $2 metric $metric tag 100"
+		echo "ip route $1 $2 $metric tag 100" >> "$NEXT"
+		shift 2
+	    done
+	else
+	    log "ignoring unrequested staticroutes (option 121)"
+	fi
    elif [ -n "$router" ] ; then
-	for i in $router ; do
-	    echo "ip route 0.0.0.0/0 $i $metric tag 100" >> "$NEXT"
-	done
+	if was_option_requested 3; then
+	    for i in $router ; do
+		echo "ip route 0.0.0.0/0 $i $metric tag 100" >> "$NEXT"
+	    done
+	else
+	    log "ignoring unrequested router (option 3)"
+	fi
    fi

    # Reduce changes needed by comparing with previous route(s)
@@ -104,11 +132,15 @@ case "$ACTION" in
    deconfig)
 	clr_dhcp_addresses
 	clr_dhcp_routes
-	/bin/ip link set dev $interface up

 	# drop info from this interface
 	rm -f "$RESOLV_CONF"
 	rm -f "$NTPFILE"
+	if [ -f "/etc/hostname.d/90-dhcp-${interface}" ]; then
+	    log "removing /etc/hostname.d/90-dhcp-${interface}"
+	     rm -f "/etc/hostname.d/90-dhcp-${interface}"
+	     /usr/libexec/infix/hostname dhcp
+	fi
 	if [ -x /usr/sbin/avahi-autoipd ]; then
 	    /usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
 	fi
@@ -134,21 +166,35 @@ case "$ACTION" in

 	set_dhcp_routes

-	# set hostname if given
+	# set hostname if given and requested
 	if [ -n "$hostname" ]; then
-	    log "setting new hostname: $hostname"
-	    hostname "$hostname"
-	    sed -i -E "s/^(127\.0\.1\.1\s+).*/\1$hostname/" /etc/hosts
+	    if was_option_requested 12; then
+		log "received DHCP hostname: $hostname"
+		mkdir -p /etc/hostname.d
+		echo "$hostname" > "/etc/hostname.d/90-dhcp-${interface}"
+		/usr/libexec/infix/hostname dhcp
+	    else
+		log "ignoring unrequested hostname (option 12): $hostname"
+	    fi
 	fi

 	# drop info from this interface
 	truncate -s 0 "$RESOLV_CONF"

 	# prefer rfc3397 domain search list (option 119) if available
+	search_list=""
 	if [ -n "$search" ]; then
-	    search_list=$search
+	    if was_option_requested 119; then
+		search_list=$search
+	    else
+		log "ignoring unrequested search (option 119): $search"
+	    fi
 	elif [ -n "$domain" ]; then
-	    search_list=$domain
+	    if was_option_requested 15; then
+		search_list=$domain
+	    else
+		log "ignoring unrequested domain (option 15): $domain"
+	    fi
 	fi

 	if [ -n "$search_list" ]; then
@@ -156,19 +202,29 @@ case "$ACTION" in
 	    echo "search $search_list # $interface" >> $RESOLV_CONF
 	fi

-	for i in $dns ; do
-	    dbg "adding dns $i"
-	    echo "nameserver $i # $interface" >> $RESOLV_CONF
-	    resolvconf -u
-	done
+	if [ -n "$dns" ]; then
+	    if was_option_requested 6; then
+		for i in $dns ; do
+		    dbg "adding dns $i"
+		    echo "nameserver $i # $interface" >> $RESOLV_CONF
+		    resolvconf -u
+		done
+	    else
+		log "ignoring unrequested dns (option 6): $dns"
+	    fi
+	fi

 	if [ -n "$ntpsrv" ]; then
-	    truncate -s 0 "$NTPFILE"
-	    for srv in $ntpsrv; do
-		dbg "got NTP server $srv"
-		echo "server $srv iburst" >> "$NTPFILE"
-	    done
-	    chronyc reload sources >/dev/null
+	    if was_option_requested 42; then
+		truncate -s 0 "$NTPFILE"
+		for srv in $ntpsrv; do
+		    dbg "got NTP server $srv"
+		    echo "server $srv iburst" >> "$NTPFILE"
+		done
+		chronyc reload sources >/dev/null
+	    else
+		log "ignoring unrequested ntpsrv (option 42): $ntpsrv"
+	    fi
 	fi
 esac

@@ -0,0 +1,111 @@
+#!/bin/sh
+# This script expects a system with resolvconf (openresolv) and iproute2
+
+[ -z "$1" ] && echo "Error: should be called from udhcpc6" && exit 1
+
+ACTION="$1"
+RESOLV_CONF="/run/resolvconf/interfaces/${interface}-ipv6.conf"
+NTPFILE="/run/chrony/dhcp-sources.d/${interface}-ipv6.sources"
+
+[ -n "$metric" ] || metric=5
+
+if [ -z "${IF_WAIT_DELAY}" ]; then
+	IF_WAIT_DELAY=10
+fi
+
+log()
+{
+    logger -I $$ -t udhcpc6 -p user.notice "${interface}: $*"
+}
+
+dbg()
+{
+    logger -I $$ -t udhcpc6 -p user.debug "${interface}: $*"
+}
+
+err()
+{
+    logger -I $$ -t udhcpc6 -p user.err "${interface}: $*"
+}
+
+clr_dhcpv6_addresses()
+{
+    addrs=$(ip -j addr show dev $interface \
+		| jq -c '.[0].addr_info[] | select(.family == "inet6") | select(.protocol == "dhcp")')
+
+    for addr in $addrs; do
+	ip="$(echo "$addr" | jq -r '."local"')"
+	prefix="$(echo "$addr" | jq -r '."prefixlen"')"
+	log "removing $ip/$prefix"
+	ip addr del "$ip/$prefix" dev "$interface"
+    done
+}
+
+log "action $ACTION"
+case "$ACTION" in
+    deconfig)
+	clr_dhcpv6_addresses
+
+	# drop info from this interface
+	rm -f "$RESOLV_CONF"
+	rm -f "$NTPFILE"
+	;;
+
+    leasefail|nak)
+	# DHCPv6 lease failed - log it
+	err "DHCPv6 lease failed"
+	;;
+
+    renew|bound)
+	# Add IPv6 address if provided (stateful DHCPv6)
+	if [ -n "$ipv6" ]; then
+	    if /bin/ip addr add dev $interface $ipv6 proto dhcp; then
+		log "assigned address $ipv6"
+	    fi
+	fi
+
+	# Handle delegated prefix (prefix delegation)
+	if [ -n "$ipv6prefix" ]; then
+	    log "received delegated prefix $ipv6prefix"
+	    # Prefix delegation handling could be added here
+	    # For now, just log it - actual routing/distribution
+	    # would need additional configuration
+	fi
+
+	# drop info from this interface
+	truncate -s 0 "$RESOLV_CONF"
+
+	# DHCPv6 domain search list (option 24)
+	if [ -n "$search" ]; then
+	    dbg "adding search $search"
+	    echo "search $search # $interface" >> $RESOLV_CONF
+	fi
+
+	# DHCPv6 DNS servers (option 23)
+	if [ -n "$dns" ]; then
+	    for i in $dns ; do
+		dbg "adding dns $i"
+		echo "nameserver $i # $interface" >> $RESOLV_CONF
+	    done
+	    resolvconf -u
+	fi
+
+	# NTP servers (option 56)
+	if [ -n "$ntpsrv" ]; then
+	    truncate -s 0 "$NTPFILE"
+	    for srv in $ntpsrv; do
+		dbg "got NTP server $srv"
+		echo "server $srv iburst" >> "$NTPFILE"
+	    done
+	    chronyc reload sources >/dev/null
+	fi
+	;;
+esac
+
+HOOK_DIR="$0.d"
+for hook in "${HOOK_DIR}/"*; do
+    [ -f "${hook}" -a -x "${hook}" ] || continue
+    "${hook}" "$ACTION"
+done
+
+exit 0
@@ -0,0 +1,145 @@
+BR2_arm=y
+BR2_cortex_a7=y
+BR2_ARM_FPU_NEON_VFPV4=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_TARGET_GENERIC_HOSTNAME="infix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
+BR2_TARGET_GENERIC_GETTY_TERM="xterm"
+BR2_SYSTEM_DHCP="eth0"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
+BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.58"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_STRACE=y
+BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_LINUX_PAM=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FRR=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_MSTPD=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_GETENT=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_DBUS=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_RAUC_JSON=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_LESS=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_PACKAGE_HOST_DOSFSTOOLS=y
+BR2_PACKAGE_HOST_E2FSPROGS=y
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_KMOD_XZ=y
+BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_RASPBERRYPI_RPI2=y
+INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CONFD_TEST_MODE=y
+BR2_PACKAGE_GENCERT=y
+BR2_PACKAGE_STATD=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_KEYACK=y
+BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_SHOW=y
+BR2_PACKAGE_ROUSETTE=y
+BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
+GNS3_APPLIANCE_RAM=512
+GNS3_APPLIANCE_IFNUM=10
@@ -0,0 +1,145 @@
+BR2_arm=y
+BR2_cortex_a7=y
+BR2_ARM_FPU_NEON_VFPV4=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_TARGET_GENERIC_HOSTNAME="ix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
+BR2_TARGET_GENERIC_GETTY_TERM="xterm"
+BR2_SYSTEM_DHCP="eth0"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
+BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.58"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
+BR2_PACKAGE_STRACE=y
+BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_LINUX_PAM=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FRR=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_MSTPD=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_GETENT=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_DBUS=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_RAUC_JSON=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_LESS=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_PACKAGE_HOST_DOSFSTOOLS=y
+BR2_PACKAGE_HOST_E2FSPROGS=y
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_KMOD_XZ=y
+BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_RASPBERRYPI_RPI2=y
+INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CONFD_TEST_MODE=y
+BR2_PACKAGE_GENCERT=y
+BR2_PACKAGE_STATD=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_KEYACK=y
+BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_SHOW=y
+BR2_PACKAGE_ROUSETTE=y
+BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
+GNS3_APPLIANCE_RAM=512
+GNS3_APPLIANCE_IFNUM=10
@@ -28,7 +28,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.56"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -38,6 +38,7 @@ BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.56"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -37,6 +37,9 @@ BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -0,0 +1,44 @@
+BR2_aarch64=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
+BR2_SSP_NONE=y
+BR2_INIT_NONE=y
+BR2_SYSTEM_BIN_SH_NONE=y
+# BR2_PACKAGE_BUSYBOX is not set
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/mtk-openwrt/arm-trusted-firmware-mtk.git"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="78a0dfd927bb00ce973a1f8eb4079df0f755887a"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="mt7986"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_FIP=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_UBOOT_AS_BL33=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES="BOOT_DEVICE=emmc DRAM_USE_DDR4=1 USE_MKIMAGE=1  MKIMAGE=$(HOST_DIR)/bin/mkimage"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="*.img *.bin"
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mt7986a_bpir3_emmc"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r3/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r3/uboot/emmc-extras.config"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+BR2_TARGET_UBOOT_FORMAT_DTB=y
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r3/uboot/*.dtsi"
+BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
+DISK_IMAGE_BOOT_DATA="${BINARIES_DIR}/flash-image.bin"
+DISK_IMAGE_BOOT_OFFSET=0x00200000
@@ -0,0 +1,34 @@
+BR2_arm=y
+BR2_cortex_a7=y
+BR2_ARM_FPU_NEON_VFPV4=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
+BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
+BR2_SSP_NONE=y
+BR2_INIT_NONE=y
+BR2_SYSTEM_BIN_SH_NONE=y
+# BR2_PACKAGE_BUSYBOX is not set
+BR2_PACKAGE_RPI_FIRMWARE=y
+BR2_PACKAGE_RPI_FIRMWARE_BOOTCODE_BIN=y
+BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI=y
+BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/config.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/cmdline.txt"
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_BAREBOX=y
+BR2_TARGET_BAREBOX_CUSTOM_VERSION=y
+BR2_TARGET_BAREBOX_CUSTOM_VERSION_VALUE="2025.06.0"
+BR2_TARGET_BAREBOX_BOARD_DEFCONFIG="rpi"
+BR2_TARGET_BAREBOX_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/barebox/extras.config"
+BR2_TARGET_BAREBOX_CUSTOM_EMBEDDED_ENV_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/barebox/env"
+BR2_TARGET_BAREBOX_IMAGE_FILE="images/barebox-raspberry-pi-2.img"
+BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+# GNS3_APPLIANCE is not set
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.56"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.56"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.60"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -3,24 +3,100 @@ Change Log

 All notable changes to the project are documented in this file.

-[v25.11.0][UNRELEASED]
+[v25.11.0][] - 2025-12-02
 -------------------------

+> [!NOTE]
+> Noteworthy changes and additions in this release:
+>
+> - DHCPv6 client support
+> - Configurable support for TTL in GRE/VXLAN tunnels
+> - Extensive filtering support for syslog messages
+
 ### Changes

+- Upgrade Buildroot to 2025.02.8 (LTS)
+- Upgrade Linux kernel to 6.12.60 (LTS)
+- Initial support for 32-bit ARM systems, reference board: Raspberry Pi 2B
+- Enable MVEBU SafeXcel Crypto Engine firmware for Marvell Armada SOCs (37xx,
+  7k, 8k, and CN913x series). Fixes kernel warnings about firmware load failures
+  and crypto-safexcel probe errors on affected boards
+- Major improvements to OSPF and BFD operational data and CLI commands:
+   - CLI commands now use data from the operational datastore instead of
+     calling vtysh directly, providing better integration and consistency
+   - New `show ip ospf` command family (neighbor, interface, route) to align
+     with industry standard CLI conventions. Legacy `show ospf` commands are
+     deprecated but still work with warnings
+   - The `show ip ospf database` subcommand has been dropped for now, the
+     advanced user can still use `vtysh` from Bash if necessary, issue #1253
+   - Extended BFD commands: `show bfd` (status), `show bfd peers` (detailed),
+     `show bfd peers brief` (table format), and `show bfd peer <address>`
+   - All command names now use singular form (interface, route, neighbor)
+     matching Cisco/FRR conventions, as well as configure context naming
+   - New support for configuring OSPF interface priority for DR/BDR election
+- The DHCP client configuration has moved from `/infix-dhcp-client:dhcp-client`
+  to `/interfaces/interface[name]/ipv4/infix-dhcp-client:dhcp`, issue #1109.
+  The configuration is automatically migrated on upgrade.  The DHCP client is
+  now enabled using a presence container instead of a separate `enabled` leaf
+- The `enabled` node for IPv4 autoconf (ZeroConf) has been dropped, `autoconf`
+  is now a presence container.  Configuration automatically migrated on upgrade
+- Add DHCPv6 client support for per-interface IPv6 configuration, augmenting
+  `/interfaces/interface[name]/ipv6/infix-dhcpv6-client:dhcp`, issue #1110
+- Fix namespace for DHCPv4 client YANG module from `urn:ietf:params:xml:ns:yang`
+  to `urn:infix:params:xml:ns:yang` to properly reflect custom implementation
 - Improvements to `sdcard.img` generation, useful for developers mostly:
   - The NanoPi R2S bootloader is now automatically built and uploaded to
-     the [`latest-boot` release][lastest-boot] tag
+     the [`latest-boot` release][latest-boot] tag
   - The `utils/mkimage.sh` script now supports fetching the bootloader
   - The raspberrypi-rpi64 board's bootloader is now aptly named rpi64
+- Add support for configuring TTL, ToS/DSCP, and Path MTU Discovery on GRE and
+  VXLAN tunnels.  This also changes the default TTL of tunnels to 64, from the
+  kernel default (*inherit*), which in turn fixes reported issues with dropped
+  OSPF Hello frames in GRE tunnels
+- [Document][bpi-r3-emmc-documentation] how to go from SD card to eMMC on BPi-R3
+- Add CLI commands for managing boot partition order: `show boot-order` and
+  `set boot-order` allow viewing and changing the boot order from the CLI,
+  complementing the existing YANG RPC support, issue #1032
+- Extended syslog filtering capabilities, issue #1091:
+   - Add support for pattern matching using POSIX extended regular expressions
+     on message content (IETF `select-match` feature)
+   - Add support for advanced severity comparison: exact match (`equals`) and
+     exclusion (`block`/`stop`) in addition to the default equals-or-higher
+     (IETF `select-adv-compare` feature)
+   - Add support for hostname-based filtering, useful when acting as a log
+     server to route messages from different devices to separate log files
+   - Add support for property-based filtering with operators (contains, isequal,
+     startswith, regex, ereregex) on message properties (msg, msgid, programname,
+     hostname, source, data), with optional case-insensitive and negate modifiers
+- Update factory configuration for BPi-R3 and NanoPi R2S boards to enable
+  DHCPv6 client on WAN interface and allow traffic forwarding from LAN to WAN
+  zone in the firewall (this is what most users expect)
+- New `support` command for collecting system diagnostics to aid in both
+  troubleshooting and support.  Run `support collect > data.tar.gz`
+  locally or remotely via SSH to gather configuration, logs, network state,
+  and system information (encryption using `gpg` available too)

 ### Fixes

 - Fix #855: User admin sometimes fails to be added to `wheel` group
- Fix serious regression in boot time, introduced in v25.10, delays the
-  boot step "Mounting filesystems ..." with up to 30 seconds!
+- Fix #1112: setting hostname via DHCP client sometimes gets overridden by the
+  configured system hostname
+- Fix #1247: Prevent invalid configuration of OSPF backbone area (0.0.0.0) as
+  stub or NSSA. The backbone must always be a normal area per RFC 2328. Any
+  existing invalid configurations are automatically corrected during upgrade
+- Fix #1255: serious regression in boot time, introduced in v25.10, delays the
+  boot step "Mounting filesystems ...", from 30 seconds up to five minutes!
+- Fix #1289: SSH host key generation warning at boot after factory reset
+- Fix broken intra-document links in container and tunnel documentation
+- Fix `show dhcp-server` command crashing with invalid timestamp format.
+  DHCP lease expiry timestamps had double timezone suffix causing libyang
+  validation errors
+- Fix `show dhcp-server` output alignment. The EXPIRES column was misaligned
+  when CLIENT ID field was empty, and CLIENT ID column was too narrow for
+  typical 20-character client IDs

-[lastest-boot]: https://github.com/kernelkit/infix/releases/latest-boot
+[latest-boot]: https://github.com/kernelkit/infix/releases/latest-boot
+[bpi-r3-emmc-documentation]: https://github.com/kernelkit/infix/blob/main/board/aarch64/bananapi-bpi-r3/README.md

 [v25.10.0][] - 2025-10-31
 -------------------------
@@ -1744,8 +1820,9 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.10.0...HEAD
-[v25.11.0]:   https://github.com/kernelkit/infix/compare/v25.10.0...v26.11.0
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.11.0...HEAD
+[v26.01.0]:   https://github.com/kernelkit/infix/compare/v25.11.0...v26.01.0
+[v25.11.0]:   https://github.com/kernelkit/infix/compare/v25.10.0...v25.11.0
 [v25.10.0]:   https://github.com/kernelkit/infix/compare/v25.09.0...v26.10.0
 [v25.09.0]:   https://github.com/kernelkit/infix/compare/v25.08.0...v26.09.0
 [v25.08.0]:   https://github.com/kernelkit/infix/compare/v25.06.1...v26.08.0
@@ -1053,8 +1053,7 @@ tarballs with SHA256 checksums for integrity checking.

 Finally, if you build your own version of Infix, and embed OCI tarballs
 in the system image, then see the tip at the end of [Upgrading a
-Container Image](#upgrading-a-container-image) (above).
-
+Container Image](#embedded-container-images) (above).

 [0]:      networking.md
 [1]:      https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-containers.yang
@@ -21,10 +21,9 @@ with an address pool:

 ```
 admin@example:/> configure
-admin@example:/config/> edit dhcp-server
-admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> leave
+admin@example:/config/> edit dhcp-server subnet 192.168.2.0/24
+admin@example:/config/dhcp-server/…/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
+admin@example:/config/dhcp-server/…/192.168.2.0/24/> leave
 ```

 When setting up the server from the CLI, the system automatically adds a
@@ -70,21 +69,21 @@ To reserve specific IP addresses for clients based on their MAC address,
 hostname, or client ID:

 ```
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit host 192.168.2.10
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> set match mac-address 00:11:22:33:44:55
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> set hostname printer
-admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> leave
+admin@example:/config/dhcp-server/…/192.168.2.0/24/> edit host 192.168.2.10
+admin@example:/config/dhcp-server/…/192.168.2.10/> set match mac-address 00:11:22:33:44:55
+admin@example:/config/dhcp-server/…/192.168.2.10/> set hostname printer
+admin@example:/config/dhcp-server/…/192.168.2.10/> leave
 ```

 Match hosts using a client identifier instead of MAC address:

 ```
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> edit host 192.168.1.50
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> edit match
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/match/> set client-id hex c0:ff:ee
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/match/> leave
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> set lease-time infinite
-admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> leave
+admin@example:/config/dhcp-server/…/192.168.1.0/24/> edit host 192.168.1.50
+admin@example:/config/dhcp-server/…/192.168.1.50/> edit match
+admin@example:/config/dhcp-server/…/match/> set client-id hex c0:ff:ee
+admin@example:/config/dhcp-server/…/match/> leave
+admin@example:/config/dhcp-server/…/192.168.1.50/> set lease-time infinite
+admin@example:/config/dhcp-server/…/192.168.1.50/> leave
 ```

 The `hex` prefix here ensures matching of client ID is done using the
@@ -289,25 +289,25 @@ blocks external threats.
 admin@example:/config/> <b>edit firewall</b>
 admin@example:/config/firewall/> <b>set default wan</b>
 admin@example:/config/firewall/> <b>edit zone lan</b>
-admin@example:/config/firewall/zone/lan/> <b>set description "Internal LAN network - trusted"</b>
-admin@example:/config/firewall/zone/lan/> <b>set action accept</b>
-admin@example:/config/firewall/zone/lan/> <b>set interface eth1</b>
-admin@example:/config/firewall/zone/lan/> <b>set service ssh</b>
-admin@example:/config/firewall/zone/lan/> <b>set service dhcp</b>
-admin@example:/config/firewall/zone/lan/> <b>set service dns</b>
-admin@example:/config/firewall/zone/lan/> <b>end</b>
+admin@example:/config/firewall/…/lan/> <b>set description "Internal LAN network - trusted"</b>
+admin@example:/config/firewall/…/lan/> <b>set action accept</b>
+admin@example:/config/firewall/…/lan/> <b>set interface eth1</b>
+admin@example:/config/firewall/…/lan/> <b>set service ssh</b>
+admin@example:/config/firewall/…/lan/> <b>set service dhcp</b>
+admin@example:/config/firewall/…/lan/> <b>set service dns</b>
+admin@example:/config/firewall/…/lan/> <b>end</b>
 admin@example:/config/firewall/> <b>edit zone wan</b>
-admin@example:/config/firewall/zone/wan/> <b>set description "External WAN interface - untrusted"</b>
-admin@example:/config/firewall/zone/wan/> <b>set action drop</b>
-admin@example:/config/firewall/zone/wan/> <b>set interface eth0</b>
-admin@example:/config/firewall/zone/wan/> <b>end</b>
+admin@example:/config/firewall/…/wan/> <b>set description "External WAN interface - untrusted"</b>
+admin@example:/config/firewall/…/wan/> <b>set action drop</b>
+admin@example:/config/firewall/…/wan/> <b>set interface eth0</b>
+admin@example:/config/firewall/…/wan/> <b>end</b>
 admin@example:/config/firewall/> <b>edit policy loc-to-wan</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>set description "Allow LAN traffic to WAN with SNAT"</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>set ingress lan</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>set egress wan</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>set action accept</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>set masquerade</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>leave</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>set description "Allow LAN traffic to WAN with SNAT"</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>set ingress lan</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>set egress wan</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>set action accept</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>set masquerade</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>leave</b>
 </pre></code>

 ### Enterprise Gateway
@@ -317,28 +317,28 @@ resources.  We can build upon the Home/Office Router example above and add
 a DMZ zone with additional policies for controlled access.
 <code><pre>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit firewall zone dmz</b>
-admin@example:/config/firewall/zone/dmz/> <b>set description "Semi-trusted public services"</b>
-admin@example:/config/firewall/zone/dmz/> <b>set action drop</b>
-admin@example:/config/firewall/zone/dmz/> <b>set interface eth1</b>
-admin@example:/config/firewall/zone/dmz/> <b>set service ssh</b>
-admin@example:/config/firewall/zone/dmz/> <b>end</b>
+admin@example:/config/firewall/…/dmz/> <b>set description "Semi-trusted public services"</b>
+admin@example:/config/firewall/…/dmz/> <b>set action drop</b>
+admin@example:/config/firewall/…/dmz/> <b>set interface eth1</b>
+admin@example:/config/firewall/…/dmz/> <b>set service ssh</b>
+admin@example:/config/firewall/…/dmz/> <b>end</b>
 admin@example:/config/firewall/> <b>edit policy loc-to-wan</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>set description "Allow local networks (LAN+DMZ) to WAN with SNAT"</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>set ingress dmz</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>set egress wan</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>set action accept</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>set masquerade</b>
-admin@example:/config/firewall/policy/loc-to-wan/> <b>end</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>set description "Allow local networks (LAN+DMZ) to WAN with SNAT"</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>set ingress dmz</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>set egress wan</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>set action accept</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>set masquerade</b>
+admin@example:/config/firewall/…/loc-to-wan/> <b>end</b>
 admin@example:/config/firewall/> <b>edit policy lan-to-dmz</b>
-admin@example:/config/firewall/policy/lan-to-dmz/> <b>set description "Allow LAN to manage DMZ services"</b>
-admin@example:/config/firewall/policy/lan-to-dmz/> <b>set ingress lan</b>
-admin@example:/config/firewall/policy/lan-to-dmz/> <b>set egress dmz</b>
-admin@example:/config/firewall/policy/lan-to-dmz/> <b>set action accept</b>
-admin@example:/config/firewall/policy/lan-to-dmz/> <b>end</b>
+admin@example:/config/firewall/…/lan-to-dmz/> <b>set description "Allow LAN to manage DMZ services"</b>
+admin@example:/config/firewall/…/lan-to-dmz/> <b>set ingress lan</b>
+admin@example:/config/firewall/…/lan-to-dmz/> <b>set egress dmz</b>
+admin@example:/config/firewall/…/lan-to-dmz/> <b>set action accept</b>
+admin@example:/config/firewall/…/lan-to-dmz/> <b>end</b>
 admin@example:/config/firewall/> <b>edit zone wan port-forward 8080 tcp</b>
-admin@example:/config/firewall/zone/wan/port-forward/8080/tcp/> <b>set to addr 192.168.2.10</b>
-admin@example:/config/firewall/zone/wan/port-forward/8080/tcp/> <b>set to port 80</b>
-admin@example:/config/firewall/zone/wan/port-forward/8080/tcp/> <b>leave</b>
+admin@example:/config/firewall/…/tcp/> <b>set to addr 192.168.2.10</b>
+admin@example:/config/firewall/…/tcp/> <b>set to port 80</b>
+admin@example:/config/firewall/…/tcp/> <b>leave</b>
 </pre></code>

 This adds a DMZ zone for public services, updates the internet access policy
@@ -562,7 +562,7 @@ In addition to basic status shown in the interface overview, detailed
 LAG status can be inspected:

 ```
-admin@example:/> show interfaces name lag0
+admin@example:/> show interface lag0
 name                : lag0
 index               : 25
 mtu                 : 1500
@@ -582,7 +582,7 @@ out-octets          : 2142
 Same aggregate, but in LACP mode:

 ```
-admin@example:/> show interfaces name lag0
+admin@example:/> show interface lag0
 name                : lag0
 index               : 24
 mtu                 : 1500
@@ -624,7 +624,7 @@ Member ports provide additional status information:
 Example member port status:

 ```
-admin@example:/> show interfaces name eth7
+admin@example:/> show interface eth7
 name                : eth7
 index               : 8
 mtu                 : 1500
@@ -755,7 +755,7 @@ The speed and duplex status for the links can be listed as shown
 below, assuming the link operational status is 'up'. 

 ```
-admin@example:/> show interfaces name eth1
+admin@example:/> show interface eth1
 name                : eth1
 index               : 2
 mtu                 : 1500
@@ -769,7 +769,7 @@ ipv6 addresses      :
 in-octets           : 75581
 out-octets          : 43130
 ...
-admin@example:/> show interfaces name eth4
+admin@example:/> show interface eth4
 name                : eth4
 index               : 5
 mtu                 : 1500
@@ -827,7 +827,7 @@ require auto-negotiation to be enabled.
 Ethernet packet statistics[^6] can be listed as shown below.

 ```
-admin@example:/> show interfaces name eth1
+admin@example:/> show interface eth1
 name                : eth1
 index               : 2
 mtu                 : 1500
@@ -959,16 +959,55 @@ Client Configuration](system.md#ntp-client-configuration) section.

 Multiple address assignment methods are available:

-| **Type**         | **Yang Model** | **Description**                                                                                                                                   |
-|:---------------- |:-------------- |:------------------------------------------------------------------------------------------------------------------------------------------------- |
-| static           | ietf-ip        | Static assignment of IPv6 address, e.g., *2001:db8:0:1::1/64*                                                                                     |
-| link-local       | ietf-ip[^2]    | (RFC4862) Auto-configured link-local IPv6 address (*fe80::0* prefix + interface identifier, e.g., *fe80::ccd2:82ff:fe52:728b/64*)                 |
-| global auto-conf | ietf-ip        | (RFC4862) Auto-configured (stateless) global IPv6 address (prefix from router + interface identifier, e.g., *2001:db8:0:1:ccd2:82ff:fe52:728b/64* |
+| **Type**         | **Yang Model**       | **Description**                                                                                                                                   |
+|:---------------- |:-------------------- |:------------------------------------------------------------------------------------------------------------------------------------------------- |
+| static           | ietf-ip              | Static assignment of IPv6 address, e.g., *2001:db8:0:1::1/64*                                                                                     |
+| link-local       | ietf-ip[^2]          | (RFC4862) Auto-configured link-local IPv6 address (*fe80::0* prefix + interface identifier, e.g., *fe80::ccd2:82ff:fe52:728b/64*)                 |
+| global auto-conf | ietf-ip              | (RFC4862) Auto-configured (stateless) global IPv6 address (prefix from router + interface identifier, e.g., *2001:db8:0:1:ccd2:82ff:fe52:728b/64* |
+| dhcp             | infix-dhcpv6-client  | Assignment of IPv6 address by DHCPv6 server, e.g., *2001:db8::42/128*                                                                             |

 Both for *link-local* and *global auto-configuration*, it is possible
 to auto-configure using a random suffix instead of the interface
 identifier.

+> [!NOTE]
+> The DHCPv6 address method is only available for *LAN* interfaces
+> (Ethernet, virtual Ethernet (veth), bridge, link aggregates, etc.)
+
+Supported DHCPv6 (request) options, configurability (Cfg) and defaults,
+are listed below.  Configurable options can be disabled on a per client
+interface basis, some options, like `client-id` and `client-fqdn`, are
+possible to set the value of as well.
+
+| **Opt** | **Name**                   | **Cfg** | **Description**                                        |
+|---------|----------------------------|---------|--------------------------------------------------------|
+| 1       | `client-id`                | Yes     | Client identifier (DUID), auto-generated by default    |
+| 2       | `server-id`                | Yes     | Server identifier (DUID)                               |
+| 23      | `dns-server`               | Yes     | DNS recursive name servers, static ones take precedence|
+| 24      | `domain-search`            | Yes     | Domain search list                                     |
+| 25      | `ia-pd`                    | Yes     | Prefix delegation for downstream networks              |
+| 31      | `sntp-server`              | Yes     | Simple Network Time Protocol servers                   |
+| 32      | `information-refresh-time` | Yes     | Refresh time for stateless DHCPv6                      |
+| 39      | `client-fqdn`              | Yes     | Client FQDN, request DNS update from server            |
+| 56      | `ntp-server`               | Yes     | NTP time servers, static ones take precedence          |
+|         |                            |         |                                                        |
+
+**Default:** `dns-server`, `domain-search`, `ntp-server`
+
+DHCPv6 supports both **stateful** (address assignment) and **stateless**
+(information-only) modes:
+
+- **Stateful DHCPv6**: The server assigns IPv6 addresses to clients. This is
+  the default mode when enabling the DHCPv6 client.
+- **Stateless DHCPv6**: Used with SLAAC (Stateless Address Autoconfiguration)
+  when only configuration information (DNS, NTP, etc.) is needed. Enable with
+  the `information-only` setting.
+
+When configuring a DHCPv6 client, ensure that the NTP client is enabled
+for the `ntp-server` DHCPv6 option to be processed correctly.  If the
+NTP client is not enabled, any NTP servers provided by the DHCPv6 server
+will be ignored. For details on how to enable the NTP client, see the
+[NTP Client Configuration](system.md#ntp-client-configuration) section.

 ### Examples

@@ -996,7 +1035,7 @@ default.
    admin@example:/> configure
    admin@example:/config/> edit interface eth0 ipv4
    admin@example:/config/interface/eth0/ipv4/> set address 10.0.1.1 prefix-length 24
-    admin@example:/config/interface/eth0/ipv4/> set autoconf enabled true
+    admin@example:/config/interface/eth0/ipv4/> set autoconf
 	admin@example:/config/interface/eth0/ipv4/> diff
    +interfaces {
    +  interface eth0 {
@@ -1004,9 +1043,7 @@ default.
    +      address 10.0.1.1 {
    +        prefix-length 24;
    +      }
-    +      autoconf {
-    +        enabled true;
-    +      }
+    +      autoconf;
    +    }
    +  }
    +}
@@ -1022,15 +1059,18 @@ default.
                    ipv6                   ::1/128 (static)
    admin@example:/>

-As shown, the link-local IPv4 address is configured with `set autconf
-enabled true`.  The resulting address (169.254.1.3/16) is of type
-*random* ([ietf-ip.yang][2]).
+As shown, the link-local IPv4 address is configured with `set autoconf`.
+The presence of the `autoconf` container enables IPv4 link-local address
+assignment. The resulting address (169.254.1.3/16) is of type *random*
+([ietf-ip.yang][2]).

 The IPv4LL client also supports a `request-address` setting which can be
 used to "seed" the client's starting address.  If the address is free it
 will be used, otherwise it falls back to the default algorithm.

-    admin@example:/config/interface/eth0/ipv4/> set autoconf request-address 169.254.1.2
+    admin@example:/config/interface/eth0/ipv4/> edit autoconf
+    admin@example:/config/interface/eth0/ipv4/autoconf/> set request-address 169.254.1.2
+    admin@example:/config/interface/eth0/ipv4/autoconf/> leave


 #### Use of DHCP for IPv4 address assignment
@@ -1038,9 +1078,9 @@ will be used, otherwise it falls back to the default algorithm.
 ![Using DHCP for IPv4 address assignment](img/ip-address-example-ipv4-dhcp.svg)

    admin@example:/> configure
-    admin@example:/config/> edit dhcp-client
-    admin@example:/config/dhcp-client/> set client-if eth0
-    admin@example:/config/dhcp-client/> leave
+    admin@example:/config/> edit interface eth0 ipv4
+    admin@example:/config/interface/eth0/ipv4/> set dhcp
+    admin@example:/config/interface/eth0/ipv4/> leave
    admin@example:/> show interfaces
    INTERFACE       PROTOCOL   STATE       DATA
    eth0            ethernet   UP          02:00:00:00:00:00
@@ -1053,6 +1093,88 @@ will be used, otherwise it falls back to the default algorithm.

 The resulting address (10.1.2.100/24) is of type *dhcp*.

+To configure DHCP client options, such as sending a specific hostname to the
+server, you can specify options with values:
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface eth0 ipv4 dhcp
+admin@example:/config/interface/eth0/ipv4/dhcp/> set option hostname value myhost
+admin@example:/config/interface/eth0/ipv4/dhcp/> show
+option hostname {
+  value myhost;
+}
+admin@example:/config/interface/eth0/ipv4/dhcp/> leave
+admin@example:/>
+```
+
+> [!TIP]
+> The special value `auto` can be used with the hostname option to
+> automatically use the configured system hostname.
+
+Other useful DHCP options include:
+
+- `client-id` - Send a specific client identifier to the server
+- `route-preference` - Set the administrative distance for DHCP-learned routes (default: 5)
+
+For advanced usage with vendor-specific options, see the YANG model.
+
+#### Use of DHCPv6 for IPv6 address assignment
+
+![Using DHCPv6 for IPv6 address assignment](img/ip-address-example-ipv6-dhcp.svg)
+
+    admin@example:/> configure
+    admin@example:/config/> edit interface eth0 ipv6
+    admin@example:/config/interface/eth0/ipv6/> set dhcp
+    admin@example:/config/interface/eth0/ipv6/> leave
+    admin@example:/> show interface
+    INTERFACE       PROTOCOL   STATE       DATA
+    eth0            ethernet   UP          02:00:00:00:00:00
+                    ipv6                   2001:db8::42/128 (dhcp)
+                    ipv6                   fe80::ff:fe00:0/64 (link-layer)
+    lo              ethernet   UP          00:00:00:00:00:00
+                    ipv4                   127.0.0.1/8 (static)
+                    ipv6                   ::1/128 (static)
+    admin@example:/>
+
+The resulting address (2001:db8::42/128) is of type *dhcp*.
+
+To configure DHCPv6 client options, such as requesting prefix delegation
+for downstream networks, you can specify options:
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface eth0 ipv6 dhcp
+admin@example:/config/interface/eth0/ipv6/dhcp/> set option ia-pd
+admin@example:/config/interface/eth0/ipv6/dhcp/> set option dns-server
+admin@example:/config/interface/eth0/ipv6/dhcp/> show
+option dns-server;
+option ia-pd;
+admin@example:/config/interface/eth0/ipv6/dhcp/> leave
+admin@example:/>
+```
+
+For stateless DHCPv6 (used with SLAAC to get only configuration information):
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface eth0 ipv6 dhcp
+admin@example:/config/interface/eth0/ipv6/dhcp/> set information-only true
+admin@example:/config/interface/eth0/ipv6/dhcp/> show
+information-only true;
+option dns-server;
+option domain-search;
+admin@example:/config/interface/eth0/ipv6/dhcp/> leave
+admin@example:/>
+```
+
+Other useful DHCPv6 options include:
+
+- `duid` - Set a specific DHCPv6 Unique Identifier (auto-generated by default)
+- `client-fqdn` - Request the server to update DNS records with client's FQDN
+- `route-preference` - Set the administrative distance for DHCPv6-learned routes (default: 5)
+
+For advanced usage with vendor-specific options, see the YANG model.

 #### Disabling IPv6 link-local address(es)

@@ -1238,18 +1360,18 @@ control plane protocol.  For our examples we use the instance name
 For a route with destination 192.168.200.0/24 via 192.168.1.1:

    admin@example:/> configure
-    admin@example:/config/> edit routing control-plane-protocol static name default
-    admin@example:/config/routing/control-plane-protocol/static/name/default/> set ipv4 route 192.168.200.0/24 next-hop next-hop-address 192.168.1.1
-    admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
+    admin@example:/config/> edit routing control-plane-protocol static name default ipv4
+    admin@example:/config/routing/…/ipv4/> set route 192.168.200.0/24 next-hop next-hop-address 192.168.1.1
+    admin@example:/config/routing/…/ipv4/> leave
    admin@example:/>

 For a "floating" static route with destination 10.0.0.0/16 via a backup
 router 192.168.1.1, using the highest possible distance:

    admin@example:/> configure
-    admin@example:/config/> edit routing control-plane-protocol static name default
-    admin@example:/config/routing/control-plane-protocol/static/name/default/> set ipv4 route 10.0.0.0/16 next-hop next-hop-address 192.168.1.1 route-preference 254
-    admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
+    admin@example:/config/> edit routing control-plane-protocol static name default ipv4
+    admin@example:/config/routing/…/ipv4/> set route 10.0.0.0/16 next-hop next-hop-address 192.168.1.1 route-preference 254
+    admin@example:/config/routing/…/ipv4/> leave
    admin@example:/>

 > [!TIP]
@@ -1260,9 +1382,9 @@ router 192.168.1.1, using the highest possible distance:
 ### IPv6 Static routes

    admin@example:/> configure
-    admin@example:/config/> edit routing control-plane-protocol static name default
-    admin@example:/config/routing/control-plane-protocol/static/name/default/> set ipv6 route 2001:db8:3c4d:200::/64 next-hop next-hop-address 2001:db8:3c4d:1::1
-    admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
+    admin@example:/config/> edit routing control-plane-protocol static name default ipv6
+    admin@example:/config/routing/…/ipv6/> set route 2001:db8:3c4d:200::/64 next-hop next-hop-address 2001:db8:3c4d:1::1
+    admin@example:/config/routing/…/ipv6/> leave
    admin@example:/>


@@ -1271,9 +1393,9 @@ router 192.168.1.1, using the highest possible distance:
 The system supports OSPF dynamic routing for IPv4, i.e., OSPFv2.  To
 enable OSPF and set one active interface in area 0:

-    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.0 interface e0 enabled
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
+    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
+    admin@example:/config/routing/…/ospf/> set area 0.0.0.0 interface e0 enabled
+    admin@example:/config/routing/…/ospf/> leave
    admin@example:/>

 > [!TIP]
@@ -1286,10 +1408,10 @@ enable OSPF and set one active interface in area 0:
 In addition to *regular* OSPF areas, area types *NSSA* and *Stub* are
 also supported.  To configure an NSSA area with summary routes:

-    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.1 area-type nssa-area
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.1 summary true
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
+    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
+    admin@example:/config/routing/…/ospf/> set area 0.0.0.1 area-type nssa-area
+    admin@example:/config/routing/…/ospf/> set area 0.0.0.1 summary true
+    admin@example:/config/routing/…/ospf/> leave
    admin@example:/>


@@ -1298,9 +1420,9 @@ also supported.  To configure an NSSA area with summary routes:
 It is possible to enable BFD per OSPF interface to speed up detection of
 link loss.

-    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set area 0.0.0.0 interface e0 bfd enabled true
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
+    admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
+    admin@example:/config/routing/…/ospf/> set area 0.0.0.0 interface e0 bfd enabled true
+    admin@example:/config/routing/…/ospf/> leave
    admin@example:/>


@@ -1311,9 +1433,9 @@ and BFD for OSPF per interface (*bfd enabled true*).  These and other
 OSPF interface settings are done in context of an OSFP area, e.g., *area
 0.0.0.0*.  Available commands can be listed using the `?` mark.

-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> edit ospf area 0.0.0.0
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/> edit interface e0
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set ?
+    admin@example:/config/routing/…/> edit ospf area 0.0.0.0
+    admin@example:/config/routing/…/ospf/area/0.0.0.0/> edit interface e0
+    admin@example:/config/routing/…/ospf/area/0.0.0.0/interface/e0/> set ?
      bfd                  BFD interface configuration.
      cost                 Interface's cost.
      dead-interval        Interval after which a neighbor is declared down
@@ -1323,13 +1445,13 @@ OSPF interface settings are done in context of an OSFP area, e.g., *area
      passive              Enables/disables a passive interface.  A passive
      retransmit-interval  Interval between retransmitting unacknowledged Link
      transmit-delay       Estimated time needed to transmit Link State Update
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set
+    admin@example:/config/routing/…/ospf/area/0.0.0.0/interface/e0/> set

 For example, setting the OSPF *interface type* to *point-to-point* for
 an Ethernet interface can be done as follows.

-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set interface-type point-to-point
-    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/>
+    admin@example:/config/routing/…/ospf/area/0.0.0.0/interface/e0/> set interface-type point-to-point
+    admin@example:/config/routing/…/ospf/area/0.0.0.0/interface/e0/>

 #### OSPF global settings

@@ -1338,12 +1460,12 @@ global settings for route redistribution and OSPF router identifier.

 ```
 admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
-admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set ?
+admin@example:/config/routing/…/ospf/> set ?
  area                     List of OSPF areas.
  default-route-advertise  Distribute default route to network
  explicit-router-id       Defined in RFC 2328.  A 32-bit number
  redistribute             Redistribute protocols into OSPF
-admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set
+admin@example:/config/routing/…/ospf/> set
 ```

 - Explicit router ID: By default the router will pick an IP address
@@ -1499,10 +1621,10 @@ currently supported, namely `ipv4` and `ipv6`.
 [^3]: For example, IPv4 groups are mapped to MAC multicast addresses by
    mapping the low-order 23-bits of the IP address in the low-order 23
    bits of the Ethernet address 01:00:5E:00:00:00.  Meaning, more than
-	one IP multicast group maps to the same MAC multicast group.
+    one IP multicast group maps to the same MAC multicast group.
 [^4]: A YANG deviation was previously used to make it possible to set
    `phys-address`, but this has been replaced with the more flexible
-	`custom-phys-address`.
+    `custom-phys-address`.
 [^5]: MAC bridges on Marvell Linkstreet devices are currently limited to
    a single MAC database, this may be a problem if the same MAC address
    appears in different MAC bridges.
@@ -173,11 +173,13 @@ Enabling DHCPv4 client on interface *e0*, with current default options.
 ```
 ~$ cat /tmp/file.json
 {
-  "infix-dhcp-client:dhcp-client": {
-    "enabled": true,
-    "client-if": [
+  "ietf-interfaces:interfaces": {
+    "interface": [
      {
-        "if-name": "e0"
+        "name": "e0",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {}
+        }
      }
    ]
  }
@@ -187,13 +189,18 @@ Enabling DHCPv4 client on interface *e0*, with current default options.
 ~$
 ```

-Disabling DHCPv4 client.
+Disabling DHCPv4 client on interface *e0* (remove the dhcp container).

 ```
 ~$ cat /tmp/file.json
 {
-  "infix-dhcp-client:dhcp-client": {
-    "enabled": false
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "e0",
+        "ietf-ip:ipv4": {}
+      }
+    ]
  }
 }
 ~$ scp file.json admin@example.local:/tmp/file.json
@@ -201,27 +208,8 @@ Disabling DHCPv4 client.
 ~$
 ```

-Configuration for client interface *e0* remains, but does not apply as
-DHCPv4 is disabled.
-
-```
-admin@example:~$ sysrepocfg -X -fjson -d running -x "/infix-dhcp-client:dhcp-client"
-{
-  "infix-dhcp-client:dhcp-client": {
-    "enabled": false,
-    "client-if": [
-      {
-        "if-name": "e0"
-      }
-    ]
-  }
-}
-admin@example:~$
-```
-
-To fully remove the DHCPv4 client configuration or a specific
-*client-if* with sysrepocfg, one would need to read out the full
-configuration, remove relevant parts and read back.
+To fully remove the DHCPv4 client configuration, remove the `infix-dhcp-client:dhcp`
+container from the interface's ipv4 configuration.

 ## Enable/Disable IPv6

@@ -23,17 +23,16 @@ For a list of available log facilities, see the table in a later section.

 ```
 admin@example:/> configure
-admin@example:/config/> edit syslog
-admin@example:/config/syslog/> edit actions log-file file:/media/log/mylog
-admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list
+admin@example:/config/> edit syslog actions log-file file:/media/log/mylog
+admin@example:/config/syslog/…/file:/media/log/mylog/> set facility-list
      all    audit     auth authpriv  console     cron    cron2   daemon      ftp     kern
   local0   local1   local2   local3   local4   local5   local6   local7      lpr     mail
     news      ntp   syslog     user     uucp
-admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list all severity
+admin@example:/config/syslog/…/file:/media/log/mylog/> set facility-list all severity
     alert       all  critical     debug emergency     error      info      none    notice   warning
-admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list all severity critical
-admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list mail severity warning
-admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> leave
+admin@example:/config/syslog/…/file:/media/log/mylog/> set facility-list all severity critical
+admin@example:/config/syslog/…/file:/media/log/mylog/> set facility-list mail severity warning
+admin@example:/config/syslog/…/file:/media/log/mylog/> leave
 admin@example:/>
 ```

@@ -137,11 +136,11 @@ perform time stamping at the time of arrival.
 Configuring the log format is the same for log files and remotes:

 ```
-admin@example:/config/> edit syslog actions log-file file:foobar 
-admin@example:/config/syslog/actions/log-file/file:foobar/> set log-format 
+admin@example:/config/> edit syslog actions log-file file:foobar
+admin@example:/config/syslog/…/file:foobar/> set log-format
                  bsd               rfc3164              rfc5424
-admin@example:/config/syslog/actions/log-file/file:foobar/> set log-format rfc5424 
-admin@example:/config/syslog/actions/log-file/file:foobar/> leave
+admin@example:/config/syslog/…/file:foobar/> set log-format rfc5424
+admin@example:/config/syslog/…/file:foobar/> leave
 admin@example:/>
 ```

@@ -163,13 +162,13 @@ up, as well as local policy.
 admin@example:/config/> edit syslog
       actions file-rotation        server
 admin@example:/config/> edit syslog actions destination moon
-admin@example:/config/syslog/actions/destination/moon/> set
+admin@example:/config/syslog/…/moon/> set
 facility-list    log-format           udp
-admin@example:/config/syslog/actions/destination/moon/> set udp
+admin@example:/config/syslog/…/moon/> set udp
 address    port
-admin@example:/config/syslog/actions/destination/moon/> set udp address 192.168.0.12
-admin@example:/config/syslog/actions/destination/moon/> set facility-list container severity all
-admin@example:/config/syslog/actions/destination/moon/> leave
+admin@example:/config/syslog/…/moon/> set udp address 192.168.0.12
+admin@example:/config/syslog/…/moon/> set facility-list container severity all
+admin@example:/config/syslog/…/moon/> leave
 admin@example:/>
 ```

@@ -192,8 +191,114 @@ admin@example:/>
 ```

 See the above [Log to File](#log-to-file) section on how to set up
-filtering of received logs to local files.  Please note, filtering based
-on property, e.g., hostname, is not supported yet.
+filtering of received logs to local files.  Advanced filtering based
+on hostname and message properties is also available, see the next
+section for details.
+
+## Advanced Filtering
+
+The syslog subsystem supports several advanced filtering options that
+allow fine-grained control over which messages are logged.  These can
+be combined with facility and severity filters to create sophisticated
+logging rules.
+
+### Pattern Matching
+
+Messages can be filtered using regular expressions (POSIX extended regex)
+on the message content.  This is useful when you want to log only messages
+containing specific keywords or patterns:
+
+```
+admin@example:/config/> edit syslog actions log-file file:errors
+admin@example:/config/syslog/…/file:errors/> set pattern-match "ERROR|CRITICAL|FATAL"
+admin@example:/config/syslog/…/file:errors/> set facility-list all severity info
+admin@example:/config/syslog/…/file:errors/> leave
+admin@example:/>
+```
+
+This will log all messages containing ERROR, CRITICAL, or FATAL.
+
+### Advanced Severity Comparison
+
+By default, severity filtering uses "equals-or-higher" comparison,
+meaning a severity of `error` will match error, critical, alert, and
+emergency messages.  You can change this behavior:
+
+```
+admin@example:/config/> edit syslog actions log-file file:daemon-errors
+admin@example:/config/syslog/…/file:daemon-errors/> set facility-list daemon
+admin@example:/config/syslog/…/daemon/> set severity error
+admin@example:/config/syslog/…/daemon/> set advanced-compare compare equals
+admin@example:/config/syslog/…/daemon/> leave
+admin@example:/>
+```
+
+This will log only `error` severity messages, not higher severities.
+
+You can also block specific severities:
+
+```
+admin@example:/config/syslog/…/daemon/> set advanced-compare action block
+```
+
+This will exclude `error` messages from the log.
+
+### Hostname Filtering
+
+When acting as a log server, you can filter messages by hostname.  This
+is useful for directing logs from different devices to separate files:
+
+```
+admin@example:/config/> edit syslog actions log-file file:router1
+admin@example:/config/syslog/…/file:router1/> set hostname-filter router1
+admin@example:/config/syslog/…/file:router1/> set facility-list all severity info
+admin@example:/config/syslog/…/file:router1/> leave
+admin@example:/>
+```
+
+Multiple hostnames can be added to the filter list.
+
+### Property-Based Filtering
+
+For more advanced filtering, you can match on specific message properties
+using various comparison operators:
+
+```
+admin@example:/config/> edit syslog actions log-file file:myapp
+admin@example:/config/syslog/…/file:myapp/> edit property-filter
+admin@example:/config/syslog/…/property-filter/> set property programname
+admin@example:/config/syslog/…/property-filter/> set operator isequal
+admin@example:/config/syslog/…/property-filter/> set value myapp
+admin@example:/config/syslog/…/property-filter/> leave
+admin@example:/>
+```
+
+Available properties:
+- `msg`: Message body
+- `msgid`: RFC5424 message identifier
+- `programname`: Program/tag name
+- `hostname`: Source hostname
+- `source`: Alias for hostname
+- `data`: RFC5424 structured data
+
+Available operators:
+- `contains`: Substring match
+- `isequal`: Exact equality
+- `startswith`: Prefix match
+- `regex`: Basic regular expression
+- `ereregex`: Extended regular expression (POSIX ERE)
+
+The comparison can be made case-insensitive:
+
+```
+admin@example:/config/syslog/…/property-filter/> set case-insensitive true
+```
+
+Or negated to exclude matching messages:
+
+```
+admin@example:/config/syslog/…/property-filter/> set negate true
+```

 ### Facilities

@@ -323,6 +323,94 @@ reference ID, stratum, time offsets, frequency, and root delay.
 > The system uses `chronyd` Network Time Protocol (NTP) daemon.  The
 > output shown here is best explained in the [Chrony documentation][4].

+## Support Data Collection
+
+When troubleshooting issues or seeking support, the `support` command
+provides a convenient way to collect comprehensive system diagnostics.
+This command gathers configuration files, logs, network state, and other
+system information into a single compressed archive.
+
+### Collecting Support Data
+
+To collect support data and save it to a file:
+
+```bash
+admin@host:~$ support collect > support-data.tar.gz
+(admin@host) Password: ***********
+Starting support data collection from host...
+This may take up to a minute. Please wait...
+Tailing /var/log/messages for 30 seconds (please wait)...
+Log tail complete.
+Collection complete. Creating archive...
+admin@host:~$ ls -l support-data.tar.gz
+-rw-rw-r-- 1 admin admin 508362 nov 30 13:05 support-data.tar.gz
+```
+
+The command can also be run remotely via SSH from your workstation:
+
+```bash
+$ ssh admin@host support collect > support-data.tar.gz
+...
+```
+
+The collection process may take up to a minute depending on system load
+and the amount of logging data. Progress messages are shown during the
+collection process.
+
+### Encrypted Collection
+
+For secure transmission of support data, the archive can be encrypted
+with GPG using a password:
+
+```bash
+admin@host:~$ support collect -p mypassword > support-data.tar.gz.gpg
+Starting support data collection from host...
+This may take up to a minute. Please wait...
+...
+Collection complete. Creating archive...
+Encrypting with GPG...
+```
+
+The `support collect` command even supports omitting `mypassword` and
+will then prompt interactively for the password.  This works over SSH too,
+but the local ssh client may then echo the password.
+
+> [!TIP]
+> To hide the encryption password for an SSH session, the script supports reading from stdin:  
+> `echo "$MYSECRET" | ssh user@device support collect -p > file.tar.gz.gpg`
+
+After transferring the resulting file to your workstation, decrypt it
+with the password:
+
+```bash
+$ gpg -d support-data.tar.gz.gpg > support-data.tar.gz
+$ tar xzf support-data.tar.gz
+```
+
+or
+
+```bash
+$ gpg -d support-data.tar.gz.gpg | tar xz
+```
+
+> [!IMPORTANT]
+> Make sure to share `mypassword` out-of-band from the encrypted data
+> with the recipient of the data.  I.e., avoid sending both in the same
+> plain-text email for example.
+
+### What is Collected
+
+The support archive includes:
+
+ - System identification (hostname, uptime, kernel version)
+ - Running and operational configuration (sysrepo datastores)
+ - System logs (`/var/log` directory and live tail of messages log)
+ - Network configuration and state (interfaces, routes, neighbors, bridges)
+ - FRRouting information (OSPF, BFD status)
+ - Container information (podman containers and their configuration)
+ - System resource usage (CPU, memory, disk, processes)
+ - Hardware information (PCI, USB devices, network interfaces)
+
 [1]: https://www.rfc-editor.org/rfc/rfc7317
 [2]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-system%402024-02-29.yang
 [3]: https://www.rfc-editor.org/rfc/rfc8341
@@ -93,14 +93,14 @@ Each test case is a separate executable, which can be run without
 arguments:

 ```
-11:42:53 infamy0:test # ./case/infix_dhcp/dhcp_basic.py
+11:42:53 infamy0:test # ./case/dhcp/dhcp_basic.py
 ```

 To run a suite of tests, e.g., only the DHCP client tests, pass the
 suite as an argument to [9PM][]:

 ```
-11:42:53 infamy0:test # ./9pm/9pm.py case/infix_dhcp/infix_dhcp.yaml
+11:42:53 infamy0:test # ./9pm/9pm.py case/dhcp/dhcp.yaml
 ```

 To run the suite of all tests:
@@ -234,12 +234,12 @@ your test and run it as normal. Once Python executes the call, it will
 drop you into the Python debugger:

 ```
-11:42:58 infamy0:test # ./case/infix_dhcp/dhcp_basic.py
+11:42:58 infamy0:test # ./case/dhcp/dhcp_basic.py
 # Starting (2024-02-10 11:42:59)
 # Probing dut1 on port d1a for IPv6LL mgmt address ...
 # Connecting to mgmt IP fe80::ff:fe00:0%d1a:830 ...
 ok 1 - Initialize
-> /home/jocke/src/infix/test/case/infix_dhcp/dhcp_basic.py(44)<module>()
+> /home/jocke/src/infix/test/case/dhcp/dhcp_basic.py(44)<module>()
 (Pdb)
 ```

@@ -252,7 +252,7 @@ want to setup breakpoints without modifying the source, or simply step
 through the code:

 ```
-11:42:58 infamy0:test # python -m pdb case/infix_dhcp/dhcp_basic.py
+11:42:58 infamy0:test # python -m pdb case/dhcp/dhcp_basic.py
 ```

 ### Deterministic Topology Mappings
@@ -296,7 +296,7 @@ This is useful because this value can then be used to rerun a test (or
 the whole suite) with identical topology mappings:

 ```
-$ make PYTHONHASHSEED=3773822171 TESTS=case/ietf_system/hostname.py test
+$ make PYTHONHASHSEED=3773822171 TESTS=case/system/hostname.py test
 ```

 ### Deterministic Transport Protocol
@@ -307,14 +307,14 @@ you get the same protocol used for that hash.  But if you want to choose
 the protocol, add extra arguments to Infamy:

 ```
-$ make INFAMY_EXTRA_ARGS="--transport=restconf" TESTS=case/ietf_system/hostname.py test
+$ make INFAMY_EXTRA_ARGS="--transport=restconf" TESTS=case/system/hostname.py test
 ```

 or, when running interactively:

 ```
 $ make test-sh
-09:08:17 infamy0:test # ./9pm/9pm.py -o"--transport=restconf" case/ietf_system/hostname.py
+09:08:17 infamy0:test # ./9pm/9pm.py -o"--transport=restconf" case/system/hostname.py
 ```

 ### Test specification
@@ -360,7 +360,7 @@ to start by reviewing an existing test case.

 All tests are located in the `infix/test/case` repository and are
 grouped by the features they verify. For example,
-`infix/test/case/infix_services` contains tests for various Infix
+`infix/test/case/services` contains tests for various Infix
 services, such as LLDP and mDNS.

 While test grouping is flexible, each test should be placed in a
@@ -372,12 +372,12 @@ suite](#running-subsets-of-tests):

 ```
 - name:  infix-services
-  suite: infix_services/infix_services.yaml
+  suite: services/services.yaml
 ```

 A new test (e.g., lldp_enable_disable) should be added to the
 corresponding test group .yaml file, such as
-`infix/test/cases/infix_services.yaml`:
+`infix/test/cases/services.yaml`:

 ```
 - name: lldp_enable_disable
@@ -385,7 +385,7 @@ corresponding test group .yaml file, such as
 ```

 It is necessary to include the test in
-`infix/test/case/infix_services/Readme.adoc` to ensure proper test
+`infix/test/case/services/Readme.adoc` to ensure proper test
 specification generation:

 ```
@@ -393,7 +393,7 @@ include::lldp_enable_disable/Readme.adoc[]
 ```

 Each test case should have its own directory under,
-`infix/test/case/infix_services`, containing:
+`infix/test/case/services`, containing:

 - `test.py` - the test script
 - `topology.dot` - the logical topology definition.
@@ -1,28 +1,212 @@
-# Tunnel configuration
+# Tunnel Configuration

-Tunnel traffic from point A to point B
+Infix supports multiple tunnel encapsulation protocols for connecting
+remote networks or devices across an IP backbone.  Tunnels encapsulate
+packets within IP datagrams, allowing traffic to traverse intermediate
+networks transparently.

+> [!IMPORTANT]
+> When issuing `leave` to activate your changes, remember to also save
+> your settings, `copy running-config startup-config`.  See the [CLI
+> Introduction](cli/introduction.md) for a background.

 ## Generic Routing Encapsulation (GRE)

-The support for GRE tunnels includes IPv4 and IPv6 tunnels both in GRE
-(IP) and GRETAP (MAC) modes.
+GRE tunnels provide a simple and efficient method to encapsulate various
+network layer protocols over IP networks.  Infix supports both IPv4 and
+IPv6 tunnels in two modes:
+
+- **GRE (Layer 3):** Point-to-point IP tunnel for routing protocols and
+  routed traffic
+- **GRETAP (Layer 2):** Ethernet tunnel for bridging Layer 2 networks
+
+> [!TIP]
+> If you name your tunnel interface `greN` or `gretapN`, where `N` is a
+> number, the CLI infers the interface type automatically.
+
+### Basic GRE Configuration
+
+A basic GRE tunnel for routing between two sites:
+
 ```
-admin@example:/config/> edit interface gre1
-admin@example:/config/interface/gre1/> set type gretap
-admin@example:/config/interface/gre1/> set gre local 192.168.3.1 remote 192.168.3.2
-admin@example:/config/interface/gre1/> leave
+admin@example:/> configure
+admin@example:/config/> edit interface gre0
+admin@example:/config/interface/gre0/> set gre local 192.168.3.1 remote 192.168.3.2
+admin@example:/config/interface/gre0/> set ipv4 address 10.255.0.1 prefix-length 30
+admin@example:/config/interface/gre0/> leave
 admin@example:/>
 ```

-##  Virtual eXtensible Local Area Network (VXLAN)
+This creates a Layer 3 tunnel between 192.168.3.1 and 192.168.3.2 using
+the outer IP addresses, with the tunnel itself using 10.255.0.0/30 for
+the inner IP addressing.

-The support for VXLAN tunnels includes IPv4 and IPv6.
+### GRETAP Configuration
+
+GRETAP tunnels operate at Layer 2, allowing bridging across the tunnel:

 ```
+admin@example:/> configure
+admin@example:/config/> edit interface gretap0
+admin@example:/config/interface/gretap0/> set type gretap
+admin@example:/config/interface/gretap0/> set gre local 192.168.3.1 remote 192.168.3.2
+admin@example:/config/interface/gretap0/> leave
+admin@example:/>
+```
+
+GRETAP interfaces can be added to a bridge, bridging local and remote Ethernet
+segments.  See the [Bridge Configuration](networking.md#bridging)
+for more on bridges.
+
+### OSPF over GRE
+
+GRE tunnels are commonly used to carry dynamic routing protocols like
+OSPF across networks that don't support multicast or where you want to
+create a virtual topology different from the physical network.
+
+Example topology: Two sites connected via a GRE tunnel, running OSPF to
+exchange routes.
+
+**Site A configuration:**
+
+```
+admin@siteA:/> configure
+admin@siteA:/config/> edit interface gre0
+admin@siteA:/config/interface/gre0/> set gre local 203.0.113.1 remote 203.0.113.2
+admin@siteA:/config/interface/gre0/> set ipv4 address 10.255.0.1 prefix-length 30
+admin@siteA:/config/interface/gre0/> set ipv4 forwarding
+admin@siteA:/config/interface/gre0/> end
+admin@siteA:/config/> edit routing control-plane-protocol ospfv2 name default ospf
+admin@siteA:/config/routing/…/ospf/> set area 0.0.0.0 interface gre0
+admin@siteA:/config/routing/…/ospf/> leave
+admin@siteA:/>
+```
+
+**Site B configuration:**
+
+```
+admin@siteB:/> configure
+admin@siteB:/config/> edit interface gre0
+admin@siteB:/config/interface/gre0/> set gre local 203.0.113.2 remote 203.0.113.1
+admin@siteB:/config/interface/gre0/> set ipv4 address 10.255.0.2 prefix-length 30
+admin@siteB:/config/interface/gre0/> set ipv4 forwarding
+admin@siteB:/config/interface/gre0/> end
+admin@siteB:/config/> edit routing control-plane-protocol ospfv2 name default ospf
+admin@siteB:/config/routing/…/ospf/> set area 0.0.0.0 interface gre0
+admin@siteB:/config/routing/…/ospf/> leave
+admin@siteB:/>
+```
+
+Once configured, OSPF will establish a neighbor relationship through the
+tunnel and exchange routes between the sites.  For more info on OSPF
+configuration, see [OSPFv2 Routing](networking.md#ospfv2-routing).
+
+> [!NOTE]
+> Consider adjusting MTU on the tunnel interface to account for GRE
+> overhead (typically 24 bytes for IPv4, 44 bytes for IPv6) to avoid
+> fragmentation issues.
+
+
+### Advanced Tunnel Settings
+
+All tunnel types support common parameters for controlling tunnel behavior
+and performance.
+
+#### Time To Live (TTL)
+
+The TTL setting controls the Time To Live value for the outer tunnel packets.
+By default, tunnels use a fixed TTL of 64, which allows packets to traverse
+multiple hops between tunnel endpoints.
+
+```
+admin@example:/config/> edit interface gre0
+admin@example:/config/interface/gre0/> set gre ttl 255
+admin@example:/config/interface/gre0/> leave
+```
+
+Valid values are 1-255, or the special value `inherit` which copies the TTL
+from the encapsulated packet.
+
+> [!IMPORTANT]
+> The `inherit` mode can cause problems with routing protocols like OSPF
+> that use TTL=1 for their packets.  For tunnels carrying routing protocols,
+> always use a fixed TTL value (typically 64 or 255).
+
+#### Type of Service (ToS)
+
+The ToS setting controls QoS marking for tunnel traffic:
+
+```
+admin@example:/config/> edit interface gre0
+admin@example:/config/interface/gre0/> set gre tos 0x10
+admin@example:/config/interface/gre0/> leave
+```
+
+Valid values are 0-255 for fixed ToS/DSCP marking, or `inherit` (default)
+to copy the ToS value from the encapsulated packet.
+
+#### Path MTU Discovery (GRE only)
+
+The `pmtu-discovery` setting can be used to control the Path MTU Discovery on
+GRE tunnels.  When enabled (default), the tunnel respects the Don't Fragment
+(DF) bit and performs PMTU discovery:
+
+```
+admin@example:/config/> edit interface gre0
+admin@example:/config/interface/gre0/> set gre pmtudisc false
+admin@example:/config/interface/gre0/> leave
+```
+
+Disabling PMTU discovery may be necessary in networks with broken ICMP
+filtering but can lead to suboptimal performance and fragmentation.
+
+## Virtual eXtensible Local Area Network (VXLAN)
+
+VXLAN is a network virtualization technology that encapsulates Layer 2
+Ethernet frames within Layer 4 UDP datagrams.  It uses a 24-bit segment
+ID, termed VXLAN Network Identifier (VNI), allowing up to 16 million
+isolated networks.
+
+Infix supports both IPv4 and IPv6 for VXLAN tunnel endpoints.
+
+### Basic VXLAN Configuration
+
+> [!TIP]
+> If you name your VXLAN interface `vxlanN`, where `N` is a number, the
+> CLI infers the interface type automatically.
+
+```
+admin@example:/> configure
 admin@example:/config/> edit interface vxlan100
 admin@example:/config/interface/vxlan100/> set vxlan local 192.168.3.1
 admin@example:/config/interface/vxlan100/> set vxlan remote 192.168.3.2
 admin@example:/config/interface/vxlan100/> set vxlan vni 100
 admin@example:/config/interface/vxlan100/> leave
+admin@example:/>
 ```
+
+The VNI uniquely identifies the VXLAN segment and must match on both
+tunnel endpoints.
+
+### VXLAN with Custom UDP Port
+
+The default VXLAN UDP destination port is 4789 (IANA assigned).  In some
+cases you may need to use a different port:
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface vxlan100
+admin@example:/config/interface/vxlan100/> set vxlan local 192.168.3.1
+admin@example:/config/interface/vxlan100/> set vxlan remote 192.168.3.2
+admin@example:/config/interface/vxlan100/> set vxlan vni 100
+admin@example:/config/interface/vxlan100/> set vxlan remote-port 8472
+admin@example:/config/interface/vxlan100/> leave
+admin@example:/>
+```
+
+The remote-port setting allows interoperability with systems using
+non-standard VXLAN ports.
+
+> [!NOTE]
+> VXLAN tunnels also support the `ttl` and `tos` settings described in
+> the [Advanced Tunnel Settings](#advanced-tunnel-settings) section above.
@@ -23,6 +23,79 @@ YANG support for upgrading Infix, inspecting and _modifying_ the
 boot-order, is defined in [infix-system-software][2].


+## Changing Boot Order
+
+The boot order can be manually changed using the `set boot-order` command.
+This is useful for rolling back to a previous version or changing the
+preferred boot source.
+
+The command accepts one to three boot targets as separate arguments, in the
+desired boot order. Valid boot targets are:
+
+- `primary` - The primary partition
+- `secondary` - The secondary partition
+- `net` - Network boot (if supported by bootloader)
+
+The CLI provides tab-completion for boot targets, making it easy to enter
+valid values.
+
+Example: View current boot order and change it:
+
+```
+admin@example:/> show boot-order
+primary secondary net
+admin@example:/> set boot-order secondary primary net
+admin@example:/> show boot-order
+secondary primary net
+admin@example:/>
+```
+
+Example: Set boot order to only try primary partition:
+
+```
+admin@example:/> show boot-order
+secondary primary net
+admin@example:/> set boot-order primary
+admin@example:/> show boot-order
+primary
+admin@example:/>
+```
+
+Example: Using tab-completion (press TAB to see available options):
+
+```
+admin@example:/> set boot-order <TAB>
+net        primary    secondary
+admin@example:/> set boot-order secondary <TAB>
+net        primary    secondary
+admin@example:/> set boot-order secondary primary
+admin@example:/> show boot-order
+secondary primary
+admin@example:/>
+```
+
+The new boot order takes effect on the next reboot and can be verified
+with `show boot-order` or `show software`:
+
+```
+admin@example:/> show software
+BOOT ORDER
+secondary primary
+
+NAME      STATE     VERSION                DATE
+primary   booted    v25.01.0               2025-04-25T10:15:00+00:00
+secondary inactive  v25.01.0               2025-04-25T10:07:20+00:00
+admin@example:/>
+```
+
+> [!NOTE]
+> The boot order is automatically updated when performing an upgrade.
+> The newly installed image will be set as the first boot target.
+>
+> Duplicate boot targets are not allowed. The CLI will reject attempts to
+> specify the same target multiple times.
+
+
 ## Upgrading

 Upgrading Infix is done one partition at a time. If the system has
@@ -27,10 +27,10 @@ Wi-Fi support is primarily tested with Realtek chipset-based adapters.
 ## Configuration

 Add a supported Wi-Fi network device. To verify that it has been
-detected, look for `wifi0` in `show interfaces`
+detected, look for `wifi0` in `show interface`

 ```
-admin@example:/>  show interfaces
+admin@example:/>  show interface
 INTERFACE       PROTOCOL   STATE       DATA
 lo              loopback   UP
                ipv4                   127.0.0.1/8 (static)
@@ -52,7 +52,7 @@ see the result read the operational datastore for interface `wifi0` or
 use the CLI

 ```
-admin@infix-00-00-00:/> show interfaces name wifi0
+admin@infix-00-00-00:/> show interface wifi0
 name                : wifi0
 type                : wifi
 index               : 3
@@ -83,9 +83,9 @@ and 63 characters
 ```
 admin@example:/> configure
 admin@example:/config/> edit keystore symmetric-key example
-admin@example:/config/keystore/symmetric-key/example/> set key-format wifi-preshared-key-format
-admin@example:/config/keystore/symmetric-key/example/> set cleartext-key mysecret
-admin@example:/config/keystore/symmetric-key/example/> leave
+admin@example:/config/keystore/…/example/> set key-format wifi-preshared-key-format
+admin@example:/config/keystore/…/example/> set cleartext-key mysecret
+admin@example:/config/keystore/…/example/> leave
 admin@example:/>
 ```

@@ -119,11 +119,11 @@ admin@example:/config/interface/wifi0/> leave

 The Wi-Fi negotiation should now start immediately, provided that the
 SSID and pre-shared key are correct. You can verify the connection by
-running `show interfaces` again.
+running `show interface` again.


 ```
-admin@example:/> show interfaces
+admin@example:/> show interface
 INTERFACE       PROTOCOL   STATE       DATA
 lo              loopback   UP
                ipv4                   127.0.0.1/8 (static)
@@ -139,7 +139,7 @@ admin@example:/>

 ## Troubleshooting Connection Issues

-Use `show wifi scan wifi0` and `show interfaces` to verify signal strength
+Use `show wifi scan wifi0` and `show interface` to verify signal strength
 and connection status. If issues arise, try the following
 troubleshooting steps:

@@ -147,6 +147,6 @@ troubleshooting steps:
 2. **Check credentials**: Verify the preshared key in `ietf-keystore`
 3. **Review logs**: Check system logs with `show log` for Wi-Fi related errors
 4. **Regulatory compliance**: Ensure the country-code matches your location
-5. **Hardware detection**: Confirm the adapter appears in `show interfaces`
+5. **Hardware detection**: Confirm the adapter appears in `show interface`

 If issues persist, check the system log for specific error messages that can help identify the root cause.
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CONFD_VERSION = 1.5
+CONFD_VERSION = 1.6
 CONFD_SITE_METHOD = local
 CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
 CONFD_LICENSE = BSD-3-Clause
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  eff4cc740c6cfe2c03f7aeee2092f16616575d1462b1ad67d9f476463a6bf3fe  klish-1c5ae4bbb49a0d7e1425ca1afe8518b873ee84cb-git4.tar.gz
+sha256  d3148fd6d3fc106384c88efe5a4ce3c7b1d512bd919b864d84c13b7b9ad523f0  klish-4fd82287cfe74c6bbafea8d6c0ba8d8b4c65cdd0-git4.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-KLISH_VERSION = 1c5ae4bbb49a0d7e1425ca1afe8518b873ee84cb
+KLISH_VERSION = 4fd82287cfe74c6bbafea8d6c0ba8d8b4c65cdd0
 KLISH_SITE = https://github.com/kernelkit/klish.git
 #KLISH_VERSION = tags/3.0.0
 #KLISH_SITE = https://src.libcode.org/pkun/klish.git
@@ -1,5 +1,7 @@
-# -l      :: Keep kernel looging to console
+# -H      :: Log remote messages using hostname from the message
+# -l      :: Keep kernel logging to console
 # -m0     :: Disable periodic syslog MARK entries
+# -n      :: Disable DNS query for every request, trust hostname in message
 # -s      :: Enable secure mode, don't listen to remote logs
 # -r 1M:5 :: Log rotation every 1 MiB and keep 5 rotated ones
-SYSLOGD_ARGS="-l -m0"
+SYSLOGD_ARGS="-H -l -m0"
@@ -1,9 +1,8 @@
-From 52f290cad56b362568c210dbcb5b64362b87585c Mon Sep 17 00:00:00 2001
+From 83cd7a46ae0346e1cbf2872ff251e9c72bf5dc7f Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 01/30] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
 PPU on 6393X
-Organization: Wires

 In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,
@@ -1,9 +1,8 @@
-From c4317d637f4cfb2905be011becf0f822c7a83b6b Mon Sep 17 00:00:00 2001
+From b9e507bb66c93910a1ee2576b6073e807d0dee2e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 02/30] net: dsa: mv88e6xxx: Improve indirect register access
 perf on 6393
-Organization: Wires

 When operating in multi-chip mode, the 6393 family maps a subset of
 commonly used global registers to the outermost address space (in
@@ -1,9 +1,8 @@
-From cb5f94c0fedcf97fc7d6a52b64b534150bffa82a Mon Sep 17 00:00:00 2001
+From a08a351c076eb52d49caa8e73335fe9b402bd460 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 03/30] net: dsa: mv88e6xxx: Honor ports being managed via
 in-band-status
-Organization: Wires

 Keep all link parameters in their unforced states when the port is
 declared as being managed via in-band-status, and let the MAC
@@ -1,9 +1,8 @@
-From f94a92a11b277a3a398b2611024b523bb5188c77 Mon Sep 17 00:00:00 2001
+From 5250f7348511e6f8e6b0cd30581968fc8ea0e9af Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 04/30] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
 ports on 6393X
-Organization: Wires

 For packets with a DA in the IEEE reserved L2 group range, originating
 from a CPU, forward it as normal, rather than classifying it as
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`root=/dev/mmcblk0p2 rootwait console=tty1 console=ttyAMA0,115200`
				`@@ -0,0 +1 @@`
				`# Placeholder - dtb-y is defined in parent Makefile`