Merge pull request #1445 from kernelkit/lts-kernel-backport

LTS kernel backport + net.d tmpfiles fix
Update ChangeLog for v26.02.1 GA
2026-07-25 18:23:01 +02:00 · 2026-03-13 08:27:24 +01:00 · 2026-03-13 07:33:15 +01:00 · 2026-03-12 23:33:21 +01:00 · 2026-03-12 19:47:33 +01:00 · 2026-03-12 16:10:14 +01:00
118 changed files with 1738 additions and 270 deletions
@@ -167,8 +167,8 @@ APIs.
 [0]: https://www.kernel.org
 [1]: https://buildroot.org/ "Buildroot Homepage"
 [2]: https://www.sysrepo.org/ "Sysrepo Homepage"
-[3]: https://kernelkit.org/infix/latest/cli/introduction/
-[4]: https://kernelkit.org/infix/
+[3]: https://www.kernelkit.org/infix/latest/cli/introduction/
+[4]: https://www.kernelkit.org/infix/
 [5]: https://github.com/kernelkit/infix/releases
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_ALDER_ALDER
 	bool "Alder"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Alder
@@ -262,8 +262,8 @@ make aarch64
 ./utils/mkimage.sh -odt emmc bananapi-bpi-r3
 ```

-[0]: https://kernelkit.org/posts/flashing-sdcard/
-[1]: https://kernelkit.org/infix/latest/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.kernelkit.org/infix/latest/
 [2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img
 [3]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-emmc.img
 [4]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r3-emmc-boot-2025.01-latest.tar.gz
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MARVELL_CN9130_CRB
 	bool "Marvell CN9130-CRB"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Customer Reference Board for CN9130
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MARVELL_ESPRESSOBIN
 	bool "Marvell ESPRESSObin"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Marvell ESPRESSObin
@@ -312,13 +312,13 @@ While capable of basic routing tasks, be aware of limitations:
 For applications requiring multiple ports or high performance, consider
 dedicated networking hardware like the [Banana Pi R3][12].

-[0]: https://kernelkit.org/posts/flashing-sdcard/
-[1]: https://kernelkit.org/infix/latest/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.kernelkit.org/infix/latest/
 [2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
-[3]: https://kernelkit.org/infix/latest/container/#content-mounts
-[4]: https://kernelkit.org/infix/latest/scripting-restconf/
+[3]: https://www.kernelkit.org/infix/latest/container/#content-mounts
+[4]: https://www.kernelkit.org/infix/latest/scripting-restconf/
 [8]: https://github.com/kernelkit/infix/releases/tag/latest-boot
-[9]: https://kernelkit.org/infix/latest/networking/#wifi
+[9]: https://www.kernelkit.org/infix/latest/networking/#wifi
 [10]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
 [11]: https://www.raspberrypi.com/documentation/
-[12]: https://kernelkit.org/infix/latest/hardware/#banana-pi-bpi-r3
+[12]: https://www.kernelkit.org/infix/latest/hardware/#banana-pi-bpi-r3
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_STYX_DCP_SC_28P
 	bool "Styx DCP-SC-28P"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Styx DCP-SC-28P
@@ -112,5 +112,5 @@ Connect a USB-to-serial adapter to the board's debug UART header.
 > [!WARNING]
 > Use only 3.3V serial adapters.

-[0]: https://kernelkit.org/posts/flashing-sdcard/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
 [1]: https://www.microchip.com/en-us/development-tool/EV21H18A
@@ -91,5 +91,5 @@ Serial settings: 115200 8N1
 > [!WARNING]
 > Use only 3.3V serial adapters. 5V adapters will damage your Raspberry Pi!

-[0]: https://kernelkit.org/posts/flashing-sdcard/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
 [1]: https://www.raspberrypi.com/products/raspberry-pi-2-model-b/
@@ -12,7 +12,7 @@ cat <<EOF >"${gns3a}"
    "category": "router",
    "description": "${ARTIFACT} development appliance",
    "vendor_name": "Kernelkit",
-    "vendor_url": "https://kernelkit.org",
+    "vendor_url": "https://www.kernelkit.org",
    "product_name": "${ARTIFACT} devel",
    "registry_version": 6,
    "status": "experimental",
@@ -50,7 +50,7 @@ The default credentials for the demo builds is
    Password: 
    .-------.
    |  . .  | Infix OS — Immutable.Friendly.Secure
-    |-. v .-| https://kernelkit.org
+    |-. v .-| https://www.kernelkit.org
    '-'---'-'

    Run the command 'cli' for interactive OAM
@@ -1,4 +1,4 @@
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'
@@ -23,7 +23,8 @@ dir=""
 all=""
 env=""
 port=""
-force=
+force=${force:-}
+reset_volumes=

 # Variable shared across subshells
 export meta_sha=""
@@ -227,7 +228,7 @@ fetch()

    if out=$(eval "$cmd" 2>&1); then
 	log "$file downloaded successfully."
-	if check "$file"; then
+	if [ -n "$force" ] || check "$file"; then
 	    echo "$dst"
 	    return 0
 	fi
@@ -897,6 +898,9 @@ while [ "$1" != "" ]; do
 	    shift
 	    restart=$1
 	    ;;
+	-R | --reset-volumes)
+	    reset_volumes=true
+	    ;;
 	-s | --simple)
 	    simple=true
 	    ;;
@@ -1108,7 +1112,8 @@ case $cmd in
 	# Remove the old image if it's not used by any other containers
 	if [ -n "$old_image_id" ]; then
 	    # Check if the old image is still in use by any containers
-	    if ! podman ps -a --format '{{.ImageID}}' | grep -q "^${old_image_id}$"; then
+	    old_image_id=${old_image_id:0:12}
+	    if ! podman ps -a --format '{{.ImageID}}' | grep -q "^${old_image_id}"; then
 		log "Removing old image $old_image_id"
 		podman rmi "$old_image_id" 2>/dev/null || true
 	    else
@@ -1250,8 +1255,22 @@ case $cmd in
 	container stop "$name"
 	echo "done"

+	# If --reset-volumes requested, delete named volumes so they re-initialize from new image
+	if [ -n "$reset_volumes" ]; then
+	    printf ">> Resetting named volumes (all configuration will be lost): "
+	    grep -oE -- '-v [^ ]+' "$script" | awk '{print $2}' | cut -d: -f1 | \
+	    while read -r vol_name; do
+		if podman volume exists "$vol_name" 2>/dev/null; then
+		    printf "%s " "$vol_name"
+		    log "Removing volume $vol_name"
+		    podman volume rm -f "$vol_name" >/dev/null || true
+		fi
+	    done
+	    echo "done"
+	fi
+
 	# Set force flag to ensure fresh pull/fetch of image
-	force="-f"
+	export force="-f"

 	# For remote images, force re-pull
 	case "$img" in
@@ -1273,14 +1292,17 @@ case $cmd in
 	# Recreate container by running the script
 	echo ">> Recreating container ..."
 	if ! "$script"; then
+	    force=
 	    echo ">> Failed recreating container $name"
 	    exit 1
 	fi
+	force=

 	# Remove the old image if it's not used by any other containers
 	if [ -n "$old_image_id" ]; then
 	    # Check if the old image is still in use by any containers
-	    if ! podman ps -a --format '{{.ImageID}}' | grep -q "^${old_image_id}$"; then
+	    old_image_id=${old_image_id:0:12}
+	    if ! podman ps -a --format '{{.ImageID}}' | grep -q "^${old_image_id}"; then
 		log "Removing old image $old_image_id"
 		podman rmi "$old_image_id" 2>/dev/null || true
 	    else
@@ -7,7 +7,7 @@ ACTION="$1"
 IP_CACHE="/var/lib/misc/${interface}.cache"
 RESOLV_CONF="/run/resolvconf/interfaces/${interface}.conf"
 NTPFILE="/run/chrony/dhcp-sources.d/${interface}.sources"
-NAME="/etc/netd/conf.d/${interface}-dhcp.conf"
+NAME="/etc/net.d/${interface}-dhcp.conf"
 NEXT="${NAME}+"

 [ -n "$broadcast" ] && BROADCAST="broadcast $broadcast"
@@ -118,8 +118,6 @@ set_dhcp_routes()
    # Reduce changes needed by comparing with previous route(s)
    cmp -s "$NAME" "$NEXT" && return
    mv "$NEXT" "$NAME"
-
-    initctl reload netd
 }

 clr_dhcp_routes()
@@ -127,8 +125,6 @@ clr_dhcp_routes()
    log "deleting DHCP routes"
    [ -f "$NAME" ] || return
    rm "$NAME"
-
-    initctl reload netd
 }

 clr_dhcp_addresses()
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -41,9 +41,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
@@ -143,10 +140,10 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -41,9 +41,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
@@ -121,12 +118,11 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -43,9 +43,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
@@ -139,10 +136,10 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_MICROCHIP_SAMA7G54_EK=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -43,9 +43,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
@@ -121,12 +118,11 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_MICROCHIP_SAMA7G54_EK=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
@@ -52,9 +52,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
@@ -170,10 +167,10 @@ BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -41,9 +41,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_RNG_TOOLS=y
@@ -142,10 +139,10 @@ BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.14"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -41,9 +41,6 @@ BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_EUDEV_RULES_GEN=y
 # BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_GPSD_DEVICES="/dev/gps0"
-BR2_PACKAGE_GPSD_MAX_CLIENT_VALUE=2
-BR2_PACKAGE_GPSD_MAX_DEV_VALUE=1
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_RNG_TOOLS=y
@@ -120,12 +117,11 @@ BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_VENDOR_HOME="https://www.kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
@@ -3,25 +3,48 @@ Change Log

 All notable changes to the project are documented in this file.

-[v26.02.0][UNRELEASED] -
+[v26.02.1][] - 2026-03-13
 -------------------------

 ### Changes

- Upgrade Linux kernel to 6.18.14 (LTS)
- Upgrade Buildroot to 2025.02.11 (LTS)
- Upgrade FRR to 10.5.1
- Add support for Microchip SAMA7G54-EK Evaluation Kit, Arm Cortex-A7
- Add GPS/GNSS receiver support with NTP reference clock integration
- Add support for [Banana Pi R3 Mini][BPI-R3-MINI], a 2 port router with 2 WiFi chip,
-  uses the same bootloader as BPI-R3 (eMMC-version)
+- Upgrade Linux kernel to 6.18.17 (LTS)
+- Add support for disabling WiFi and GPS features in builds
+- Add OSPF point-to-multipoint (P2MP) and hybrid interface type support.  This
+  also includes support for setting static neighbors, issue #1426

 ### Fixes

-N/A
+- Fix #1389: legacy name limit in firewalld triggered problems with policy names
+- Fix #1416: `show firewall` command show an error when the firewall is disabled
+- Fix #1438: default route from DHCP client not set at boot, regression in v26.02.0
+- Fix instabilities in Zebra route manager after Frr upgrade in v26.02.0
+- Fix regression in MVEBU SafeXcel Crypto Engine for Marvell Armada SOCs (37xx,
+  7k, 8k, and CN913x series).  Firmware package lost in v26.01.0
+
+[v26.02.0][] - 2026-03-01
+-------------------------
+
+> [!NOTE]
+> The blog and User Guide have a new address: <https://www.kernelkit.org>
+
+### Changes
+
+- Upgrade Linux kernel to 6.18.15 (LTS)
+- Upgrade Buildroot to 2025.02.11 (LTS)
+- Upgrade FRR to 10.5.1
+- Add support for [Microchip SAMA7G54][SAMA7G54-EK] Evaluation Kit, Arm Cortex-A7
+- Add support for [Banana Pi R3 Mini][BPI-R3-MINI], a 2 port router with 2 WiFi chip,
+  uses the same bootloader as BPI-R3 (eMMC-version)
+- Add GPS/GNSS receiver support with NTP reference clock integration
+- Add `reset-volumes` option to `container upgrade foo` command
+
+### Fixes
+
+- Fix CLI `copy` command problem to copy to scp/sftp destinations

 [BPI-R3-MINI]: https://wiki.banana-pi.org/Banana_Pi_BPI-R3_Mini
-
+[SAMA7G54-EK]: https://www.microchip.com/en-us/development-tool/ev21h18a

 [v26.01.0][] - 2026-02-03
 -------------------------
@@ -106,7 +129,7 @@ Noteworthy changes and additions in this release are marked below in bold text.
 - Prevent MOTD from showing on non-shell user login attempts
 - Fix mDNS reflector.

-[wifi]: https://kernelkit.org/infix/latest/wifi/
+[wifi]: https://www.kernelkit.org/infix/latest/wifi/
 [sd card image]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img


@@ -724,7 +747,7 @@ renamed to ease maintenance, more info below.
  not supported (yet) in Infix, issue #709
 - The default builds now include the curiOS nftables container image,
  which can be used for advanced firewall setups.  For an introduction
-  see <https://kernelkit.org/posts/firewall-container/>
+  see <https://www.kernelkit.org/posts/firewall-container/>

 ### Fixes

@@ -1927,7 +1950,9 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.01.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.02.0...HEAD
+[v26.02.1]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.02.1
+[v26.02.0]:   https://github.com/kernelkit/infix/compare/v26.01.0...v26.02.0
 [v26.01.0]:   https://github.com/kernelkit/infix/compare/v25.11.0...v26.01.0
 [v25.11.0]:   https://github.com/kernelkit/infix/compare/v25.10.0...v25.11.0
 [v25.10.0]:   https://github.com/kernelkit/infix/compare/v25.09.0...v26.10.0
@@ -295,7 +295,7 @@ linux-pc:# ssh admin@infix-c0-ff-ee.local
 (admin@infix-c0-ff-ee.local) Password: 
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-

 Run the command 'cli' for interactive OAM
@@ -335,7 +335,7 @@ linux-pc:# ssh admin@infix.local
 (admin@infix.local) Password: 
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-

 Run the command 'cli' for interactive OAM
@@ -87,7 +87,7 @@ example login: <b>admin</b>
 Password:
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'

 Run the command 'cli' for interactive OAM
@@ -131,6 +131,66 @@ an Ethernet interface can be done as follows.
 admin@example:/config/routing/…/ospf/area/0.0.0.0/interface/e0/>
 </code></pre>

+
+### Point-to-Multipoint
+
+Point-to-Multipoint (P2MP) is used when multiple OSPF routers share a
+common network segment but should form individual adjacencies rather
+than electing a Designated Router (DR).  This is common in NBMA-like
+environments, DMVPN, or hub-and-spoke topologies.
+
+Infix supports two P2MP variants via the `interface-type` setting:
+
+| **Interface Type**    | **Behavior**                                   |
+|:----------------------|:-----------------------------------------------|
+| `hybrid`              | P2MP with multicast Hellos (broadcast-capable) |
+| `point-to-multipoint` | P2MP with unicast Hellos (non-broadcast)       |
+
+#### Hybrid (broadcast-capable P2MP)
+
+Use `hybrid` when all neighbors on the segment can receive multicast.
+Hello packets are sent to the standard OSPF multicast address (224.0.0.5)
+and neighbors are discovered automatically — no manual neighbor
+configuration is needed.
+
+<pre class="cli"><code>admin@example:/config/> <b>edit routing control-plane-protocol ospfv2 name default ospf</b>
+admin@example:/config/routing/…/ospf/> <b>set area 0.0.0.0 interface e0 interface-type hybrid</b>
+admin@example:/config/routing/…/ospf/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+#### Non-broadcast P2MP
+
+Use `point-to-multipoint` when the network does not support multicast.
+Hello packets are sent as unicast directly to each configured neighbor.
+Since neighbors cannot be discovered automatically, they must be
+configured explicitly using static neighbors (see below).
+
+<pre class="cli"><code>admin@example:/config/> <b>edit routing control-plane-protocol ospfv2 name default ospf</b>
+admin@example:/config/routing/…/ospf/> <b>set area 0.0.0.0 interface e0 interface-type point-to-multipoint</b>
+admin@example:/config/routing/…/ospf/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+
+### Static Neighbors
+
+When using non-broadcast interface types (such as `point-to-multipoint`),
+OSPF cannot discover neighbors via multicast.  Static neighbors must be
+configured so the router knows where to send unicast Hello packets.
+
+<pre class="cli"><code>admin@example:/config/> <b>edit routing control-plane-protocol ospfv2 name default ospf</b>
+admin@example:/config/routing/…/ospf/> <b>set area 0.0.0.0 interface e0 static-neighbors neighbor 10.0.123.2</b>
+admin@example:/config/routing/…/ospf/> <b>set area 0.0.0.0 interface e0 static-neighbors neighbor 10.0.123.3</b>
+admin@example:/config/routing/…/ospf/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+> [!NOTE]
+> Static neighbors are only needed for non-broadcast interface types.
+> With `hybrid` (or `broadcast`), neighbors are discovered automatically
+> via multicast.
+
 ### OSPF global settings

 In addition to *area* and *interface* specific settings, OSPF provides
@@ -336,7 +336,7 @@ It should now be possible to access the switch from the PC via SSH (or NETCONF).
 admin@fe80::0053:00ff:fe06:1101%eth1's password:
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'

 Run the command 'cli' for interactive OAM
@@ -88,7 +88,7 @@ Warning: Permanently added 'fe80::ff:fe00:0%eth0' (ED25519) to the list of known
 admin@fe80::ff:fe00:0%eth0's password: *****
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'

 Run the command 'cli' for interactive OAM
@@ -152,7 +152,7 @@ infix-00-00-00 login: admin
 Password:
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'

 Run the command 'cli' for interactive OAM
@@ -170,7 +170,7 @@ example login: <b>admin</b>
 Password:
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
-|-. v .-| https://kernelkit.org
+|-. v .-| https://www.kernelkit.org
 '-'---'-'

 Run the command 'cli' for interactive OAM
@@ -170,6 +170,6 @@ plugins:

 extra:
  generator: false
-  homepage: https://kernelkit.org/
+  homepage: https://www.kernelkit.org/
  version:
    provider: mike
@@ -30,6 +30,11 @@ CONFD_CONF_OPTS += --enable-wifi
 else
 CONFD_CONF_OPTS += --disable-wifi
 endif
+ifeq ($(BR2_PACKAGE_FEATURE_GPS),y)
+CONFD_CONF_OPTS += --enable-gps
+else
+CONFD_CONF_OPTS += --disable-gps
+endif
 define CONFD_INSTALL_EXTRA
 	for fn in confd.conf resolvconf.conf; do \
 		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
@@ -80,6 +85,12 @@ define CONFD_INSTALL_YANG_MODULES_WIFI
 	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/wifi.inc
 endef
 endif
+ifeq ($(BR2_PACKAGE_FEATURE_GPS),y)
+define CONFD_INSTALL_YANG_MODULES_GPS
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/gps.inc
+endef
+endif

 # PER_PACKAGE_DIR
 # Since the last package in the dependency chain that runs sysrepoctl is confd, we need to
@@ -109,6 +120,7 @@ CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_EXTRA
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WIFI
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_GPS
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_IN_ROMFS
 CONFD_TARGET_FINALIZE_HOOKS += CONFD_CLEANUP

@@ -2,9 +2,10 @@ config BR2_PACKAGE_NETD
 	bool "netd"
 	select BR2_PACKAGE_LIBITE
 	select BR2_PACKAGE_LIBCONFUSE
+	select BR2_PACKAGE_LIBEV
 	help
 	  Network route daemon. Manages static routes and RIP routing.
-	  Reads configuration from /etc/netd/conf.d/*.conf.
+	  Reads configuration from /etc/net.d/*.conf.

 	  With FRR: Full routing via gRPC, vtysh, or frr.conf.
 	  Without FRR: Standalone Linux backend via rtnetlink.
@@ -4,13 +4,13 @@
 #
 ################################################################################

-NETD_VERSION = 1.0
+NETD_VERSION = 1.1.0
 NETD_SITE_METHOD = local
 NETD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/netd
 NETD_LICENSE = BSD-3-Clause
 NETD_LICENSE_FILES = LICENSE
 NETD_REDISTRIBUTE = NO
-NETD_DEPENDENCIES = libite libconfuse jansson
+NETD_DEPENDENCIES = libite libconfuse jansson libev
 NETD_AUTORECONF = YES

 NETD_CONF_ENV = CFLAGS="$(INFIX_CFLAGS)"
@@ -34,6 +34,10 @@ else
 NETD_CONF_OPTS += --without-frr
 endif

+define NETD_INSTALL_EXTRA
+	cp $(NETD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/etc/tmpfiles.d/netd.conf
+endef
+
 NETD_TARGET_FINALIZE_HOOKS += NETD_INSTALL_EXTRA

 $(eval $(autotools-package))
@@ -0,0 +1 @@
+d  /etc/net.d		- - -
@@ -1,2 +1,2 @@
 # --log-level debug
-ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog --log-level err"
+ZEBRA_ARGS="-A 127.0.0.1 -a -s 90000000 -u frr -g frr --log syslog --log-level err"
@@ -1,2 +1,3 @@
 service <!> pid:!/run/frr/mgmtd.pid env:-/etc/default/mgmtd \
-	[2345] mgmtd $MGMTD_ARGS -- FRR MGMT daemon
+	[2345] mgmtd $MGMTD_ARGS \
+	-- FRR MGMT daemon
@@ -1,2 +1,3 @@
-service <!pid/zebra> env:-/etc/default/ospfd \
-	[2345] ospfd $OSPFD_ARGS -- OSPF daemon
+service <!pid/zebra> pid:!/run/frr/ospfd.pid env:-/etc/default/ospfd \
+	[2345] ospfd $OSPFD_ARGS \
+	-- OSPF daemon
@@ -1,3 +1,3 @@
-service <pid/zebra> env:-/etc/default/ripd \
-	[2345] ripd $RIPD_ARGS
+service <pid/zebra> pid:!/run/frr/ripd.pid env:-/etc/default/ripd \
+	[2345] ripd $RIPD_ARGS \
 	-- RIP daemon
@@ -1,3 +1,3 @@
-service <!pid/mgmtd> pid:!/run/frr/zebra.pid env:-/etc/default/zebra  \
-	[2345] zebra $ZEBRA_ARGS
+service <!pid/mgmtd> pid:!/run/frr/zebra.pid env:-/etc/default/zebra \
+	[2345] zebra $ZEBRA_ARGS \
 	-- Zebra routing daemon
@@ -1,5 +1,4 @@
-# Default FRR daemons file for Infix - confd overwrites on routing changes.
-# watchfrr, zebra, mgmtd, and staticd are always started by frrinit.sh.
+# Default FRR daemons file used with watchfrr, started by frrinit.sh.
 ospfd=no
 ripd=no
 bfdd=no
@@ -25,4 +24,3 @@ staticd_options="-A 127.0.0.1"
 bfdd_options="   -A 127.0.0.1"

 frr_profile="traditional"
-
@@ -0,0 +1 @@
+! Empty stub — mgmtd reads its own config at startup; file must exist to avoid log noise.
@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.
@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.
@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.
@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.
@@ -1,7 +1,7 @@
 From 03f273fc540082d1eaa23bd9b5847e695afd8283 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 25 Sep 2025 15:00:54 +0200
-Subject: [PATCH] Silence warnings about old backends
+Subject: [PATCH 1/2] Silence warnings about old backends
 Organization: Wires

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
@@ -0,0 +1,95 @@
+From 6ab218fe7f2c7027cc5347e3b082285870c502e6 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Fri, 6 Mar 2026 07:44:38 +0100
+Subject: [PATCH 2/2] fix(functions): lift iptables name length limit when
+ using nftables
+Organization: Wires
+
+The max_zone_name_len() and max_policy_name_len() functions return 17
+and 18 respectively, derived from iptables' 28-char netfilter chain name
+limit.  These limits are applied unconditionally in Zone.check_name()
+and Policy.check_name() regardless of the active backend.
+
+When FirewallBackend=nftables nftables imposes no such restriction, so
+user-defined zone and policy names (e.g. "appletv-to-lan-guest", 20
+chars) that exceed the iptables-derived limit are incorrectly rejected.
+
+Add _nftables_backend() which reads firewalld.conf directly so the check
+can be skipped without threading backend context through to check_name()
+call sites, which have no access to all_io_objects.  When nftables is
+active, both functions return sys.maxsize, effectively disabling the
+length check.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/firewall/functions.py | 31 ++++++++++++++++++++++++++++++-
+ 1 file changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/src/firewall/functions.py b/src/firewall/functions.py
+index 27c862fd..1b8a32ce 100644
+--- a/src/firewall/functions.py
+++ b/src/firewall/functions.py
+@@ -10,9 +10,10 @@ import os
+ import os.path
+ import shlex
+ import string
+import sys
+ import tempfile
+ from firewall.core.logger import log
+-from firewall.config import FIREWALLD_TEMPDIR, FIREWALLD_PIDFILE
+from firewall.config import FIREWALLD_CONF, FIREWALLD_TEMPDIR, FIREWALLD_PIDFILE
+ 
+ NOPRINT_TRANS_TABLE = {
+     # Limit to C0 and C1 code points. Building entries for all unicode code
+@@ -576,12 +577,35 @@ def ppid_of_pid(pid):
+     return pid
+ 
+ 
+def _nftables_backend():
+    """Return True if FirewallBackend=nftables is configured in firewalld.conf.
+
+    When using nftables the iptables-derived 28-char chain name limit does not
+    apply.  Reading the config file directly avoids threading backend context
+    through check_name() call sites, which have no access to all_io_objects.
+    """
+    try:
+        with open(FIREWALLD_CONF) as f:
+            for line in f:
+                line = line.strip()
+                if line.startswith("FirewallBackend="):
+                    return line.split("=", 1)[1].strip() == "nftables"
+    except OSError:
+        pass
+    return False
+
+
+ def max_policy_name_len():
+     """
+     iptables limits length of chain to (currently) 28 chars.
+     The longest chain we create is POST_<policy>_allow,
+     which leaves 28 - 11 = 17 chars for <policy>.
+
+    When using the nftables backend, nftables imposes no practical name length
+    restriction, so we return sys.maxsize to lift the check entirely.
+     """
+    if _nftables_backend():
+        return sys.maxsize
+     from firewall.core.ipXtables import POLICY_CHAIN_PREFIX
+     from firewall.core.base import SHORTCUTS
+ 
+@@ -594,7 +618,12 @@ def max_zone_name_len():
+     Netfilter limits length of chain to (currently) 28 chars.
+     The longest chain we create is POST_<zone>_allow,
+     which leaves 28 - 11 = 17 chars for <zone>.
+
+    When using the nftables backend, nftables imposes no practical name length
+    restriction, so we return sys.maxsize to lift the check entirely.
+     """
+    if _nftables_backend():
+        return sys.maxsize
+     from firewall.core.base import SHORTCUTS
+ 
+     longest_shortcut = max(map(len, SHORTCUTS.values()))
+-- 
+2.43.0
+
@@ -1,8 +1,9 @@
-From 00f89f3ba9f41a1c495dddcb83b2f6bb9f938a0c Mon Sep 17 00:00:00 2001
+From 346def32eb16c04f267c1da13735945c9a54231f Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 01/33] net: phy: marvell10g: Support firmware loading on
 88X3310
+Organization: Wires

 When probing, if a device is waiting for firmware to be loaded into
 its RAM, ask userspace for the binary and load it over XMDIO.
@@ -1,8 +1,9 @@
-From 2a31d49efc597de1f30f3067076a77750d29a15f Mon Sep 17 00:00:00 2001
+From 77b517d44bdffdf6b34e6349c1dd2fa3b82f8a49 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 02/33] net: phy: marvell10g: Fix power-up when strapped to
 start powered down
+Organization: Wires

 On devices which are hardware strapped to start powered down (PDSTATE
 == 1), make sure that we clear the power-down bit on all units
@@ -1,7 +1,8 @@
-From 6b0e8831d0a6303daa38e92f6cf557e476f17539 Mon Sep 17 00:00:00 2001
+From 9e51a2fa9f7aa8bace041a943b517faa47f30624 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 03/33] net: phy: marvell10g: Add LED support for 88X3310
+Organization: Wires

 Pickup the LEDs from the state in which the hardware reset or
 bootloader left them, but also support further configuration via
@@ -1,8 +1,9 @@
-From b5c0e5112b0d3e01af0f67c383cb981d83c185d0 Mon Sep 17 00:00:00 2001
+From d6da0f58dc1a27bf6a73ac8842e7830772199550 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 04/33] net: phy: marvell10g: Support LEDs tied to a single
 media side
+Organization: Wires

 In a combo-port setup, i.e. where both the copper and fiber interface
 are available to the user, the LEDs may be physically located either
@@ -1,7 +1,8 @@
-From 81a6a60b94c633a4c2e3c11ab77252f827f8ea65 Mon Sep 17 00:00:00 2001
+From bbfb5ff1a1deac6617e889e9eae61ad90932372d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 05/33] net: phy: Do not resume PHY when attaching
+Organization: Wires

 The PHY should not start negotiating with its link-partner until
 explicitly instructed to do so.
@@ -19,7 +20,7 @@ administratively down.
 1 file changed, 1 deletion(-)

 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 7a67c900e79a..5c61faf4b10a 100644
+index 2353d6eced68..9b0983453393 100644
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
@@ -1750,7 +1750,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
@@ -27,6 +28,6 @@ index 7a67c900e79a..5c61faf4b10a 100644
 		goto error;
 
 -	phy_resume(phydev);
- 	if (!phydev->is_on_sfp_module)
- 		phy_led_triggers_register(phydev);
 
+ 	/**
+ 	 * If the external phy used by current mac interface is managed by
@@ -1,8 +1,9 @@
-From d1187bd54f9d346e1037621822738548e167a668 Mon Sep 17 00:00:00 2001
+From 86d59814723739aae2e0dccc1d5143e99239e517 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 06/33] net: bridge: avoid classifying unknown multicast as
 mrouters_only
+Organization: Wires

 Unknown multicast, MAC/IPv4/IPv6, should always be flooded according to
 the per-port mcast_flood setting, as well as to detected and configured
@@ -61,7 +62,7 @@ index c37e52e2f29a..0759bc37d6f0 100644
 		/* shouldn't be called with unsupported options */
 		WARN_ON(1);
 diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
-index a818fdc22da9..3cdb97ded410 100644
+index 525d4eccd194..6278dfc9612f 100644
 --- a/net/bridge/br_device.c
 +++ b/net/bridge/br_device.c
@@ -89,10 +89,10 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -140,7 +141,7 @@ index dea09096ad0f..f0a613238e0d 100644
 				continue;
 			break;
 diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
-index 1405f1061a54..1ae4b4173821 100644
+index 2cbae0f9ae1f..0c539bf4bebe 100644
 --- a/net/bridge/br_input.c
 +++ b/net/bridge/br_input.c
@@ -186,9 +186,13 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
@@ -1,8 +1,9 @@
-From d292a3a9ad8ef75d589d51bc7fe11f39371781c0 Mon Sep 17 00:00:00 2001
+From 9fa94b200cb73d0d03f724610e53b8019a6ebad2 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 07/33] net: bridge: Ignore router ports when forwarding L2
 multicast
+Organization: Wires

 Multicast router ports are either statically configured or learned from
 control protocol traffic (IGMP/MLD/PIM).  These protocols regulate IP
@@ -1,8 +1,9 @@
-From 8786298e55fc4b5f108ad18dad5be21acd4ba911 Mon Sep 17 00:00:00 2001
+From 53004f71947c52aab8e6e3fabc3fd5d78a3c643f Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 08/33] net: bridge: drop delay for applying strict multicast
 filtering
+Organization: Wires

 This *local* patch drops the initial delay before applying strict multicast
 filtering, introduced in [1] and recently updated in [2].
@@ -1,8 +1,9 @@
-From be0a8a1d4d6ba0bbf046cd72ebe1710800869ee5 Mon Sep 17 00:00:00 2001
+From 7229b8a8650191d42ff67d584751ab49dbcd7ed8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 09/33] net: bridge: Differentiate MDB additions from
 modifications
+Organization: Wires

 Before this change, the reception of an IGMPv3 report (and analogously
 for MLDv2) that adds a new group, would trigger two MDB RTM_NEWMDB
@@ -1,8 +1,9 @@
-From 75070ac3fb6fdd403039bfc9b14d9edc6c3133dc Mon Sep 17 00:00:00 2001
+From 5b8492fa5bc5b79455e79a8e37498ecb93ee5359 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 10/33] nvmem: layouts: onie-tlv: Let device probe even when
 TLV is invalid
+Organization: Wires

 Before this change, probing an NVMEM device, expected to contain a
 valid TLV, would fail if it had not been provisioned yet. But an
@@ -1,8 +1,9 @@
-From 931afb4a82cce9b479f3377a78519ad20a5e2175 Mon Sep 17 00:00:00 2001
+From 9f4c2b07839ef00084ed542c48149f0f335dd760 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 11/33] net: usb: r8152: add r8153b support for link/activity
 LEDs
+Organization: Wires

 This patch adds support for the link/activity LEDs on the NanoPi R2S
 and OrangePi R1 Plus.
@@ -18,7 +19,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 1 file changed, 8 insertions(+)

 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index 6a43054d5171..ef8bcb4a7339 100644
+index da8de7b1a489..36d79a77316c 100644
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
@@ -41,6 +41,11 @@
@@ -33,7 +34,7 @@ index 6a43054d5171..ef8bcb4a7339 100644
 #define R8152_PHY_ID		32
 
 #define PLA_IDR			0xc000
-@@ -7277,6 +7282,9 @@ static void r8153b_init(struct r8152 *tp)
+@@ -7279,6 +7284,9 @@ static void r8153b_init(struct r8152 *tp)
 	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
 	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
 
@@ -1,8 +1,9 @@
-From 23a3579ca235bbc5c4b3417176aef7846ba022b3 Mon Sep 17 00:00:00 2001
+From 3ad4ee7ae3a89aada6d57176c07cef526d9c96eb Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 10 Aug 2025 18:52:54 +0200
 Subject: [PATCH 12/33] arm64: dts: mediatek: mt7986a: rename BPi R3 ports to
 match case
+Organization: Wires

 For ref. see: https://wiki.banana-pi.org/File:Bpi-r3_Metal_case.jpg

@@ -1,8 +1,9 @@
-From b3eb28e66efdbe13153c13ee492b56e284dd7cc7 Mon Sep 17 00:00:00 2001
+From 3250cc2366b749241d615615ce2ea0d768bb4921 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 20 Aug 2025 21:38:24 +0200
 Subject: [PATCH 13/33] drm/panel-simple: Add a timing for the Raspberry Pi 7"
 panel
+Organization: Wires

 The Raspberry Pi 7" 800x480 panel uses a Toshiba TC358762 DSI
 to DPI bridge chip, so there is a requirement for the timings
@@ -1,7 +1,8 @@
-From 18b1eb460fefbd0a6dff47dc6900a5948df40a8f Mon Sep 17 00:00:00 2001
+From 642ead96253f70bf7c0fcca3c2fa85e73914bb33 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 21 Aug 2025 11:20:23 +0200
 Subject: [PATCH 14/33] input:touchscreen:edt-ft5x06: Add polled mode
+Organization: Wires

 Not all hardware has interrupts therefore we need
 to poll the touchscreen.
@@ -1,8 +1,9 @@
-From 70a3642435e2510a8f16e2115a7b555dc3ec64b4 Mon Sep 17 00:00:00 2001
+From 43a979e0aa5701c0c1c0c0e9d57800bd0ef01faa Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 15/33] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
 PPU on 6393X
+Organization: Wires

 In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,
@@ -1,8 +1,9 @@
-From a8f89c96786d6dfc6d7c728b92e7ad33ec7cc12b Mon Sep 17 00:00:00 2001
+From 76efa741dff5a8ad7d31a3d6b676c564397c88e6 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 16/33] net: dsa: mv88e6xxx: Improve indirect register access
 perf on 6393
+Organization: Wires

 When operating in multi-chip mode, the 6393 family maps a subset of
 commonly used global registers to the outermost address space (in
@@ -1,8 +1,9 @@
-From c1ff82cfcd6786690edce944c5a44616d42426fb Mon Sep 17 00:00:00 2001
+From 7901aa874746fcd698d57099e01690ca591d9361 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 17/33] net: dsa: mv88e6xxx: Honor ports being managed via
 in-band-status
+Organization: Wires

 Keep all link parameters in their unforced states when the port is
 declared as being managed via in-band-status, and let the MAC
@@ -1,8 +1,9 @@
-From dc2e3d0dc7bb298fb4fb25cd9befbac2cadbaa36 Mon Sep 17 00:00:00 2001
+From bff65cd654873c1fe2910f1ab8a757539fa920b7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 18/33] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
 ports on 6393X
+Organization: Wires

 For packets with a DA in the IEEE reserved L2 group range, originating
 from a CPU, forward it as normal, rather than classifying it as
@@ -1,8 +1,9 @@
-From 7b41de01eeac05ef76798168f1bf2aebb303410b Mon Sep 17 00:00:00 2001
+From a93d06218d7b7627c5327aa10c612471840eee05 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 19/33] net: dsa: tag_dsa: Use tag priority as initial
 skb->priority
+Organization: Wires

 Use the 3-bit priority field from the DSA tag as the initial packet
 priority on ingress to the CPU.
@@ -1,8 +1,9 @@
-From 2993149c029e9c53d1538850173b585ae39b69d7 Mon Sep 17 00:00:00 2001
+From c467011d7ea11c7c3f728dc73b433cc3c0b67b80 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 20/33] net: dsa: Support MDB memberships whose L2 addresses
 overlap
+Organization: Wires

 Multiple IP multicast groups (32 for v4, 2^80 for v6) map to the same
 L2 address. This means that switchdev drivers may receive multiple MDB
@@ -1,7 +1,8 @@
-From 3402c2bee5c28a7c7e0e16cc75304749ec57895e Mon Sep 17 00:00:00 2001
+From d84d7cf2a2b00203ac6e2261fd3474e6c0c954ca Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 21/33] net: dsa: Support EtherType based priority overrides
+Organization: Wires

 ---
 include/net/dsa.h |  4 ++++
@@ -1,8 +1,9 @@
-From 103e7309ed96e845cbd2075a89e0e10b962490fa Mon Sep 17 00:00:00 2001
+From e556a41a4c568492a2723ca5de155edd22ddd913 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 22/33] net: dsa: mv88e6xxx: Support EtherType based priority
 overrides
+Organization: Wires

 ---
 drivers/net/dsa/mv88e6xxx/chip.c    | 64 +++++++++++++++++++++++++++++
@@ -1,7 +1,8 @@
-From 0ebdd84bda066b82db85280a266e8d01e0872115 Mon Sep 17 00:00:00 2001
+From d3546da36444aa4679725ec839f08da518d4923b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 23/33] net: dsa: mv88e6xxx: Add mqprio qdisc support
+Organization: Wires

 Add support for attaching mqprio qdisc's to mv88e6xxx ports and use
 the packet's traffic class as the outgoing priority when no PCP bits
@@ -1,8 +1,9 @@
-From 216d17528054c744b76f68731cdc61c2a7f16bf0 Mon Sep 17 00:00:00 2001
+From b7519c9fa980c3875d27b11ffd6981b0ed48e9b5 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 24/33] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
 are available
+Organization: Wires

 Switch the priority sourcing precdence to prefer VLAN PCP over IP
 DSCP, when both are available.
@@ -1,8 +1,9 @@
-From e0e692a81515e6111a0d60a679dff7d1d382700c Mon Sep 17 00:00:00 2001
+From 521ca7fd27093c4ddcddd662a6dfd21f000275b8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 25/33] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
 VLANs
+Organization: Wires

 Before this change, in a setup like the following, packets assigned to
 VLAN 10 were forwarded between the switch ports, even though the
@@ -1,8 +1,9 @@
-From b609b6ac8841e77f1c1b51bb8d20ba8c6aff28a1 Mon Sep 17 00:00:00 2001
+From 89b2a6e022f85b415a46f49df0c93676834bf57c Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 16 Jan 2025 12:35:12 +0100
 Subject: [PATCH 26/33] net: dsa: mv88e6xxx: collapse disabled state into
 blocking
+Organization: Wires

 This patch changes the behavior of switchcore ports wrt. the port state.
 Instead of disabling the port, the driver now treats the disabled state
@@ -1,8 +1,9 @@
-From 47c2f59a47315c3032e936b58a83fe6cb905b970 Mon Sep 17 00:00:00 2001
+From 63367ac49816e95fd4da9194d58d1f5074cf8119 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 12 Feb 2025 22:03:14 +0100
 Subject: [PATCH 27/33] net: dsa: mv88e6xxx: Only activate LAG offloading when
 bridged
+Organization: Wires

 The current port isolation scheme for mv88e6xxx is detailed here:
 https://lore.kernel.org/netdev/20220203101657.990241-1-tobias@waldekranz.com/
@@ -1,7 +1,8 @@
-From 09fcae28ec65a3b3c8e82a1ebffcefd1ef2f3076 Mon Sep 17 00:00:00 2001
+From b5ccc175297291d19697cd775c6f2a5691828e68 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 14 Jan 2026 18:22:41 +0100
 Subject: [PATCH 28/33] net: dsa: mv88e6xxx: Add LED support for 6393X
+Organization: Wires

 Original commit:
 commit 462277b926140ee2d231317e92afb6cabf640268
@@ -1,4 +1,4 @@
-From 3fd13d10d7153f700233e4f91b2070bfa280c265 Mon Sep 17 00:00:00 2001
+From 8c51a0724ae7b1ad5115282c954d4edc81364585 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 15 Jan 2026 22:47:37 +0100
 Subject: [PATCH 29/33] wifi: brcmfmac: support deletion and recreation of
@@ -6,6 +6,7 @@ Subject: [PATCH 29/33] wifi: brcmfmac: support deletion and recreation of
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
+Organization: Wires

 The Broadcom FullMAC firmware does not allow the primary interface
 (bsscfgidx 0) to be deleted - it always exists in firmware. However,
@@ -1,4 +1,4 @@
-From e30fdea3ea2c1d52b258d78796e8a2d5307c8e57 Mon Sep 17 00:00:00 2001
+From 36e885ca1f4115203e05e2886ae32563247b3b97 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Mon, 19 Jan 2026 13:06:53 +0100
 Subject: [PATCH 30/33] wifi: brcmfmac: check connection state before querying
@@ -6,6 +6,7 @@ Subject: [PATCH 30/33] wifi: brcmfmac: check connection state before querying
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
+Organization: Wires

 In station mode, brcmf_cfg80211_get_station() queries the firmware for
 station info even when not connected to an AP. This results in error
@@ -1,4 +1,4 @@
-From 03fbaedfaef56f23862d6b390eeb4a53830ba5b9 Mon Sep 17 00:00:00 2001
+From 5463dd561cd1076e7f18a5119acc969c5f0ab989 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Tue, 20 Jan 2026 20:12:10 +0100
 Subject: [PATCH 31/33] wifi: brcmfmac: suppress log spam for
@@ -6,6 +6,7 @@ Subject: [PATCH 31/33] wifi: brcmfmac: suppress log spam for
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
+Organization: Wires

 When scanning, the driver attempts to set each channel and logs an
 error if the firmware rejects it. For regulatory-restricted channels,
@@ -1,4 +1,4 @@
-From e0da4bfce5f50959b9e1874019cfe242970a9071 Mon Sep 17 00:00:00 2001
+From 1f631f03e316387caf2af8ebc082796ce843c26c Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Tue, 20 Jan 2026 20:18:45 +0100
 Subject: [PATCH 32/33] wifi: brcmfmac: reduce log noise during AP to station
@@ -6,6 +6,7 @@ Subject: [PATCH 32/33] wifi: brcmfmac: reduce log noise during AP to station
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
+Organization: Wires

 When transitioning from AP mode to station mode (e.g., hostapd stopping
 and wpa_supplicant starting), several non-fatal errors can occur:
@@ -1,8 +1,9 @@
-From 384b9a4f22df36918c26f893a3e808a6c7879ba7 Mon Sep 17 00:00:00 2001
+From d88dde71434c48f78d44803e467adbc6633d4b10 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Tue, 17 Feb 2026 21:59:59 +0100
 Subject: [PATCH 33/33] net: phy: air_en8811h: add OF device table for
 auto-loading
+Organization: Wires

 mdio_uevent() only emits an OF-style MODALIAS via
 of_device_uevent_modalias(), never the mdio: binary format that
@@ -1,2 +1,2 @@
 # Calculated with utils/kernel-refresh.sh
-sha256   8d1934a72a185f1be6b56e3ad8ea31fd9a381ffec0346c69f06c90d776da7cb8  linux-6.18.14.tar.xz
+sha256   2bff97ab0590bc5ccdd5b82286d5ef324828672126ebddc88d062e3ac65af80d  linux-6.18.17.tar.xz
@@ -466,7 +466,7 @@ static int curl(char *op, const char *path, const char *uri)
 {
 	char *argv[10] = { "curl", "-L", NULL };
 	int err = 1, i = 2;
-	int path_i, uri_i, user_i = 0;
+	int path_i, uri_i = 0, user_i = 0;

 	argv[i++] = op;

@@ -492,7 +492,8 @@ static int curl(char *op, const char *path, const char *uri)

 out:
 	free(argv[path_i]);
-	free(argv[uri_i]);
+	if (uri_i)
+		free(argv[uri_i]);
 	if (user_i)
 		free(argv[user_i]);
 	return err;
@@ -752,7 +753,7 @@ static int copy(const char *src, const char *dst)
 	 * meaningful name instead: the datastore's on-disk filename, or the
 	 * source file's own basename.
 	 */
-	if (is_ssh_uri(dst) && dst[strlen(dst) - 1] == '/') {
+	if (dst && is_ssh_uri(dst) && dst[strlen(dst) - 1] == '/') {
 		const char *bn, *slash;

 		if (srcds && srcds->path) {
@@ -46,6 +46,10 @@ AC_ARG_ENABLE(wifi,
        AS_HELP_STRING([--enable-wifi], [Enable support for Wi-Fi]),,[
 	enable_wifi=no])

+AC_ARG_ENABLE(gps,
+        AS_HELP_STRING([--enable-gps], [Enable support for GPS receivers]),,[
+	enable_gps=no])
+
 AC_ARG_WITH(login-shell,
        AS_HELP_STRING([--with-login-shell=shell], [Login shell for new users, default: /bin/false]),
 	[login_shell=$withval], [login_shell=yes])
@@ -60,6 +64,9 @@ AS_IF([test "x$enable_containers" = "xyes"], [
 AS_IF([test "x$enable_wifi" = "xyes"], [
        AC_DEFINE(HAVE_WIFI, 1, [Built with Wi-Fi support])])

+AS_IF([test "x$enable_gps" = "xyes"], [
+        AC_DEFINE(HAVE_GPS, 1, [Built with GPS receiver support])])
+
 AS_IF([test "x$with_login_shell" != "xno"], [
 	AS_IF([test "x$login_shell" = "xyes"], [login_shell=/bin/false])
 	AC_DEFINE_UNQUOTED(LOGIN_SHELL, "$login_shell", [Default: /bin/false])],[
@@ -131,6 +138,7 @@ cat <<EOF
 Optional features:
  Container support ....: $enable_containers
  Wi-Fi support ........: $enable_wifi
+  GPS support ..........: $enable_gps
  Login shell ..........: $login_shell
  Default crypt algo ...: $crypt

@@ -144,7 +144,7 @@ static void add(const char *ifname, struct lyd_node *cfg)

 	fprintf(fp, "# Generated by Infix confd\n");
 	fprintf(fp, "metric=%s\n", metric);
-	fprintf(fp, "service <!> name:dhcp-client :%s <net/%s/running> \\\n"
+	fprintf(fp, "service <!pid/netd> name:dhcp-client :%s <net/%s/running> \\\n"
 		"	[2345] udhcpc -f -p /run/dhcp-client-%s.pid -t 3 -T 5 -A 30 %s -S -R \\\n"
 		"		%s%s \\\n"
 		"		-i %s %s %s \\\n"
@@ -695,18 +695,17 @@ int hardware_change(sr_session_ctx_t *session, struct lyd_node *config, struct l
 			wifi_find_interfaces_on_radio(interfaces_config, name,
 						       &wifi_iface_list, &wifi_iface_count);

-
-			if (!wifi_iface_count)
-				continue;
-
-			/* Generate AP config (hostapd) for all APs on this radio */
-			rc = wifi_gen_aps_on_radio(name, interfaces_config, cwifi_radio, config);
-			if (rc != SR_ERR_OK)
-				ERROR("Failed to generate AP config for radio %s", name);
-			/* Free the interface list */
-			free(wifi_iface_list);
-			wifi_iface_list = NULL;
-			wifi_iface_count = 0;
+			if (wifi_iface_list) {
+				if (wifi_iface_count) {
+					/* Generate AP config (hostapd) for all APs on this radio */
+					rc = wifi_gen_aps_on_radio(name, interfaces_config, cwifi_radio, config);
+					if (rc != SR_ERR_OK)
+						ERROR("Failed to generate AP config for radio %s", name);
+				}
+				free(wifi_iface_list);
+				wifi_iface_list = NULL;
+				wifi_iface_count = 0;
+			}
 		} else if (!strcmp(class, "infix-hardware:gps")) {
 			if (event != SR_EV_DONE)
 				continue;
@@ -8,7 +8,7 @@

 #define XPATH_BASE_ "/ietf-routing:routing/control-plane-protocols/control-plane-protocol"
 #define XPATH_OSPF_ XPATH_BASE_ "/ietf-ospf:ospf"
-#define NETD_CONF "/etc/netd/conf.d/confd.conf"
+#define NETD_CONF "/etc/net.d/confd.conf"
 #define NETD_CONF_NEXT NETD_CONF "+"
 #define NETD_CONF_PREV NETD_CONF "-"
 #define OSPFD_CONF "/etc/frr/ospfd.conf"
@@ -154,6 +154,17 @@ int parse_rip(sr_session_ctx_t *session, struct lyd_node *rip, FILE *fp)
 	return num_interfaces;
 }

+static const char *ospf_network_type(const char *yang_type)
+{
+	if (!strcmp(yang_type, "hybrid"))
+		return "point-to-multipoint";
+	if (!strcmp(yang_type, "point-to-multipoint"))
+		return "point-to-multipoint non-broadcast";
+
+	/* broadcast, non-broadcast, point-to-point pass through unchanged */
+	return yang_type;
+}
+
 int parse_ospf_interfaces(sr_session_ctx_t *session, struct lyd_node *areas, FILE *fp)
 {
 	struct lyd_node *interface, *interfaces, *area;
@@ -203,7 +214,7 @@ int parse_ospf_interfaces(sr_session_ctx_t *session, struct lyd_node *areas, FIL
 				if (passive)
 					fputs("  ip ospf passive\n", fp);
 				if (interface_type)
-					fprintf(fp, "  ip ospf network %s\n", interface_type);
+					fprintf(fp, "  ip ospf network %s\n", ospf_network_type(interface_type));
 				if (cost)
 					fprintf(fp, "  ip ospf cost %s\n", cost);
 			}
@@ -226,6 +237,28 @@ int parse_ospf_redistribute(sr_session_ctx_t *session, struct lyd_node *redistri
 	return 0;
 }

+static void parse_ospf_static_neighbors(struct lyd_node *areas, FILE *fp)
+{
+	struct lyd_node *area, *interface, *interfaces, *neighbors, *neighbor;
+
+	LY_LIST_FOR(lyd_child(areas), area) {
+		interfaces = lydx_get_child(area, "interfaces");
+
+		LY_LIST_FOR(lyd_child(interfaces), interface) {
+			neighbors = lydx_get_child(interface, "static-neighbors");
+			if (!neighbors)
+				continue;
+
+			LY_LIST_FOR(lyd_child(neighbors), neighbor) {
+				const char *id = lydx_get_cattr(neighbor, "identifier");
+
+				if (id)
+					fprintf(fp, "  neighbor %s\n", id);
+			}
+		}
+	}
+}
+
 int parse_ospf_areas(sr_session_ctx_t *session, struct lyd_node *areas, FILE *fp)
 {
 	int areas_configured = 0;
@@ -315,6 +348,7 @@ int parse_ospf(sr_session_ctx_t *session, struct lyd_node *ospf)
 	fputs("router ospf\n", fp);
 	num_areas = parse_ospf_areas(session, areas, fp);
 	parse_ospf_redistribute(session, lydx_get_child(ospf, "redistribute"), fp);
+	parse_ospf_static_neighbors(areas, fp);
 	default_route = lydx_get_child(ospf, "default-route-advertise");
 	if (default_route) {
 		/* enable is obsolete in favor for enabled. */
@@ -458,7 +492,8 @@ static void frr_daemons_write(int ospfd, int ripd, int bfdd)
 		fp);

 	fclose(fp);
-	rename(next, FRR_DAEMONS);
+	if (rename(next, FRR_DAEMONS))
+		ERROR("Failed to rename %s to %s: %m", next, FRR_DAEMONS);
 }

 int routing_change(sr_session_ctx_t *session, struct lyd_node *config, struct lyd_node *diff, sr_event_t event, struct confd *confd)
@@ -519,7 +554,6 @@ int routing_change(sr_session_ctx_t *session, struct lyd_node *config, struct ly
 			num = parse_rip(session, lydx_get_child(cplane, "rip"), fp);
 			if (num > 0) {
 				touch(RIPD_SIGNAL_NEXT);
-				ripd_enabled = 1;
 				netd_enabled = 1;
 			}
 		}
@@ -14,7 +14,7 @@ MODULES=(
 	"ietf-routing@2018-03-13.yang"
 	"ietf-ipv6-unicast-routing@2018-03-13.yang"
 	"ietf-ipv4-unicast-routing@2018-03-13.yang"
-	"ietf-ospf@2022-10-19.yang -e bfd -e explicit-router-id"
+	"ietf-ospf@2022-10-19.yang -e bfd -e explicit-router-id -e hybrid-interface"
 	"ietf-rip@2020-02-20.yang"
 	"iana-bfd-types@2021-10-21.yang"
 	"ietf-bfd-types@2022-09-22.yang"
@@ -31,7 +31,7 @@ MODULES=(
 	"ieee802-dot1q-types@2022-10-29.yang"
 	"infix-ip@2025-11-02.yang"
 	"infix-if-type@2026-01-07.yang"
-	"infix-routing@2025-12-02.yang"
+	"infix-routing@2026-03-11.yang"
 	"ieee802-dot1ab-lldp@2022-03-15.yang"
 	"infix-lldp@2025-05-05.yang"
 	"infix-dhcp-common@2025-12-21.yang"
@@ -45,6 +45,13 @@ module infix-hardware {
    description "Initial";
    reference "internal";
  }
+  feature wifi {
+    description "WiFi support is an optional build-time feature in Infix.";
+  }
+
+  feature gps {
+    description "GPS support is an optional build-time feature in Infix.";
+  }

  typedef country-code {
    type string {
@@ -104,11 +111,13 @@ module infix-hardware {
    description "This identity is used to a VPD memory on the device.";
  }
  identity wifi {
+    if-feature wifi;
    base iahw:hardware-class;
    description "This identity is used to describe a WiFi radio/PHY";
  }

  identity gps {
+    if-feature gps;
    base iahw:hardware-class;
    description "GPS/GNSS receiver for time synchronization";
  }
@@ -211,6 +220,7 @@ module infix-hardware {
     */

    container wifi-radio {
+      if-feature wifi;
      when "derived-from-or-self(../iehw:class, 'ih:wifi')";
      presence "WiFi radio configuration";
      description
@@ -534,6 +544,7 @@ module infix-hardware {
     */

    container gps-receiver {
+      if-feature gps;
      when "derived-from-or-self(../iehw:class, 'ih:gps')";
      presence "GPS receiver configuration";
      description
@@ -26,6 +26,12 @@ module infix-routing {
  contact      "kernelkit@googlegroups.com";
  description  "Deviations and augments for ietf-routing, ietf-ospf, and ietf-rip.";

+  revision 2026-03-11 {
+    description "Remove interface-type deviation to expose standard ietf-ospf
+                 interface types including point-to-multipoint and hybrid.
+                 Un-deviate static-neighbors for non-broadcast P2MP support.";
+  }
+
  revision 2025-12-02 {
    description "Add configurable OSPF debug logging container.
                 Add RIP (Routing Information Protocol) support.";
@@ -247,18 +253,6 @@ module infix-routing {
  }

  /* OSPF */
-  typedef infix-ospf-interface-type {
-    type enumeration {
-      enum broadcast {
-        description
-          "Specifies an OSPF broadcast multi-access network.";
-      }
-      enum point-to-point {
-        description
-          "Specifies an OSPF point-to-point network.";
-      }
-    }
-  }


  deviation "/rt:routing/rt:control-plane-protocols/rt:control-plane-protocol" {
@@ -367,11 +361,6 @@ module infix-routing {
    }
  }

-  deviation "/rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/ospf:ospf/ospf:areas/ospf:area/ospf:interfaces/ospf:interface/ospf:interface-type" {
-    deviate replace {
-      type infix-ospf-interface-type;
-    }
-  }

  deviation "/rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/ospf:ospf/ospf:auto-cost" {
    deviate not-supported;
@@ -463,9 +452,12 @@ module infix-routing {
  }

  /* OSPF Area Interface */
-  deviation "/rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/ospf:ospf/ospf:areas/ospf:area/ospf:interfaces/ospf:interface/ospf:static-neighbors"
-  {
-    deviate not-supported;
+  deviation "/rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/ospf:ospf/ospf:areas/ospf:area/ospf:interfaces/ospf:interface/ospf:static-neighbors/ospf:neighbor" {
+    deviate add {
+      must "../../ospf:interface-type = 'point-to-multipoint' or ../../ospf:interface-type = 'non-broadcast'" {
+        error-message "Static neighbors are only applicable to point-to-multipoint or non-broadcast interface types.";
+      }
+    }
  }
  deviation "/rt:routing/rt:control-plane-protocols/rt:control-plane-protocol/ospf:ospf/ospf:areas/ospf:area/ospf:interfaces/ospf:interface/ospf:multi-areas"    {
    deviate not-supported;
@@ -0,0 +1,3 @@
+MODULES=(
+	"infix-hardware -e gps"
+)
@@ -1,4 +1,5 @@
 MODULES=(
 	"infix-interfaces -e wifi"
+	"infix-hardware -e wifi"
 	"infix-if-type -e wifi"
 )
@@ -178,9 +178,15 @@
  </COMMAND>

  <COMMAND name="upgrade" help="Upgrade image of a container (writable layer is lost!)">
-    <PARAM name="name" ptype="/CONTAINERS" help="Container name" />
+    <PARAM name="name" ptype="/CONTAINERSa" help="Container name" />
+    <SWITCH name="optional" min="0" max="1">
+      <COMMAND name="reset-volumes" help="Delete named volumes, re-initialize from new image (all config lost!)" />
+    </SWITCH>
    <ACTION sym="script" out="tty" interrupt="true">
-      doas container upgrade $KLISH_PARAM_name
+      if env | grep -q 'reset-volumes' >/dev/null; then
+          opt="-R"
+      fi
+      doas container $opt upgrade $KLISH_PARAM_name
    </ACTION>
  </COMMAND>
 </COMMAND>
@@ -461,7 +461,7 @@ echo "Public:  $pub"
        <ACTION sym="printl">peer</ACTION>
      </COMPL>
    </PARAM>
-    <PARAM name="peer_addr" ptype="/STRING" help="Peer IP address" min="0" max="1"/>
+    <PARAM name="peer" ptype="/STRING" help="Peer IP address" min="0" max="1"/>
    <SWITCH name="optional" min="0">
      <COMMAND name="brief" help="Show brief output" mode="switch"/>
    </SWITCH>
@@ -471,7 +471,7 @@ echo "Public:  $pub"
        BRIEF_ARG="brief"
      fi
      # Pass subcommand, optional peer address, and brief flag
-      show bfd ${KLISH_PARAM_subcommand:+"$KLISH_PARAM_subcommand"} ${KLISH_PARAM_peer_addr:+"$KLISH_PARAM_peer_addr"} ${BRIEF_ARG:+"$BRIEF_ARG"} |pager
+      show bfd ${KLISH_PARAM_subcommand:+"$KLISH_PARAM_subcommand"} ${KLISH_PARAM_peer:+"$KLISH_PARAM_peer"} ${BRIEF_ARG:+"$BRIEF_ARG"} |pager
    </ACTION>
  </COMMAND>

@@ -6,7 +6,7 @@ netd_SOURCES        = src/netd.c src/netd.h src/config.c src/config.h
 netd_CPPFLAGS       = -D_DEFAULT_SOURCE -D_GNU_SOURCE -I$(srcdir)/src
 netd_CFLAGS         = -W -Wall -Wextra
 netd_CFLAGS        += $(libite_CFLAGS) $(libconfuse_CFLAGS) $(jansson_CFLAGS)
-netd_LDADD          = $(libite_LIBS) $(libconfuse_LIBS) $(jansson_LIBS)
+netd_LDADD          = $(libite_LIBS) $(libconfuse_LIBS) $(jansson_LIBS) $(EV_LIBS)

 # Backend selection: FRR gRPC, FRR frr.conf, or Linux kernel
 if HAVE_FRR_GRPC
@@ -60,7 +60,7 @@ make install

 netd uses [libconfuse](https://github.com/martinh/libconfuse) for configuration parsing, providing a clean and structured format.

-Configuration files are placed in `/etc/netd/conf.d/` with the `.conf` extension. Files are processed in alphabetical order.
+Configuration files are placed in `/etc/net.d/` with the `.conf` extension. Files are processed in alphabetical order.

 ### Configuration Format

@@ -219,10 +219,10 @@ rip {

 ### Configuration Files

-Configuration files must be placed in `/etc/netd/conf.d/` with the `.conf` extension:
+Configuration files must be placed in `/etc/net.d/` with the `.conf` extension:

 ```bash
-/etc/netd/conf.d/
+/etc/net.d/
 ├── 10-static.conf      # Static routes
 ├── 20-rip.conf         # RIP configuration
 └── 99-local.conf       # Local overrides
@@ -256,7 +256,7 @@ netd validates configuration on reload. Check syslog for errors.

 ```
 ┌─────────┐
-│  confd  │ Writes /etc/netd/conf.d/confd.conf
+│  confd  │ Writes /etc/net.d/confd.conf
 └────┬────┘
     │ SIGHUP
     ▼
@@ -1,5 +1,5 @@
 AC_PREREQ(2.61)
-AC_INIT([netd], [1.0.0], [https://github.com/kernelkit/infix/issues])
+AC_INIT([netd], [1.1.0], [https://github.com/kernelkit/infix/issues])
 AM_INIT_AUTOMAKE(1.11 foreign subdir-objects)
 AM_SILENT_RULES(yes)

@@ -81,6 +81,16 @@ PKG_CHECK_MODULES([libite], [libite >= 2.6.1])
 PKG_CHECK_MODULES([libconfuse], [libconfuse >= 3.0])
 PKG_CHECK_MODULES([jansson], [jansson >= 2.0])

+AC_CHECK_HEADER([ev.h],
+    [saved_LIBS="$LIBS"
+     AC_CHECK_LIB([ev], [ev_loop_new],
+        [EV_LIBS="-lev"],
+        [AC_MSG_ERROR("libev not found")])
+     LIBS="$saved_LIBS"],
+    [AC_MSG_ERROR("ev.h not found")]
+)
+AC_SUBST([EV_LIBS])
+
 test "x$prefix" = xNONE && prefix=$ac_default_prefix
 test "x$exec_prefix" = xNONE && exec_prefix='${prefix}'

@@ -2,6 +2,8 @@

 #include <errno.h>
 #include <getopt.h>
+#include <sys/inotify.h>
+#include <ev.h>
 #include <libite/lite.h>

 #include "netd.h"
@@ -9,9 +11,6 @@

 int debug;

-static sig_atomic_t do_reload;
-static sig_atomic_t do_shutdown;
-
 static struct route_head active_routes = TAILQ_HEAD_INITIALIZER(active_routes);
 static struct rip_config active_rip;

@@ -46,19 +45,7 @@ static int backend_apply(struct route_head *routes, struct rip_config *rip) {
 }
 #endif

-static void sighup_handler(int sig)
-{
-	(void)sig;
-
-	INFO("Got SIGHUP, reloading ...");
-	do_reload = 1;
-}
-
-static void sigterm_handler(int sig)
-{
-	(void)sig;
-	do_shutdown = 1;
-}
+static ev_timer retry_w;

 static void route_list_free(struct route_head *head)
 {
@@ -118,7 +105,7 @@ static void rip_config_free(struct rip_config *cfg)
 	}
 }

-static void reload(void)
+static void reload(struct ev_loop *loop)
 {
 	struct route_head new_routes = TAILQ_HEAD_INITIALIZER(new_routes);
 	struct rip_redistribute *redist;
@@ -129,7 +116,7 @@ static void reload(void)
 	struct route *r;
 	int count = 0;

-	INFO("Reloading configuration");
+	DEBUG("Reloading configuration");

 	rip_config_init(&new_rip);

@@ -148,11 +135,16 @@ static void reload(void)

 	/* Apply config via backend */
 	if (backend_apply(&new_routes, &new_rip)) {
-		ERROR("Failed applying config via backend");
+		ERROR("Failed applying config via backend, retry in 5s");
 		route_list_free(&new_routes);
 		rip_config_free(&new_rip);
+		ev_timer_stop(loop, &retry_w);
+		ev_timer_set(&retry_w, 5., 0.);
+		ev_timer_start(loop, &retry_w);
+		pidfile(NULL);
 		return;
 	}
+	ev_timer_stop(loop, &retry_w);

 	route_list_free(&active_routes);
 	TAILQ_INIT(&active_routes);
@@ -214,26 +206,59 @@ static void reload(void)
 		}
 	}

-	INFO("Configuration reloaded");
 	pidfile(NULL);
 }

+static void inotify_cb(struct ev_loop *loop, ev_io *w, int revents)
+{
+	char buf[sizeof(struct inotify_event) + NAME_MAX + 1];
+
+	(void)revents;
+	while (read(w->fd, buf, sizeof(buf)) > 0)
+		;
+	DEBUG("conf.d changed, triggering reload");
+	reload(loop);
+}
+
+static void sighup_cb(struct ev_loop *loop, ev_signal *w, int revents)
+{
+	(void)w; (void)revents;
+	INFO("Got SIGHUP, reloading ...");
+	reload(loop);
+}
+
+static void sigterm_cb(struct ev_loop *loop, ev_signal *w, int revents)
+{
+	(void)w; (void)revents;
+	ev_break(loop, EVBREAK_ALL);
+}
+
+static void retry_cb(struct ev_loop *loop, ev_timer *w, int revents)
+{
+	(void)w; (void)revents;
+	reload(loop);
+}
+
 static int usage(int rc)
 {
 	fprintf(stderr,
-		"Usage: netd [-dh]\n"
+		"Usage: netd [-dhv]\n"
 		"  -d  Enable debug (log to stderr)\n"
-		"  -h  Show this help text\n");
+		"  -h  Show this help text\n"
+		"  -v  Show version and exit\n");
 	return rc;
 }

 int main(int argc, char *argv[])
 {
+	struct ev_loop *loop = EV_DEFAULT;
+	ev_signal sighup_w, sigterm_w, sigint_w;
+	ev_io inotify_w;
 	int log_opts = LOG_PID | LOG_NDELAY;
-	struct sigaction sa = { 0 };
+	int ifd = -1;
 	int c;

-	while ((c = getopt(argc, argv, "dhp:")) != -1) {
+	while ((c = getopt(argc, argv, "dhv")) != -1) {
 		switch (c) {
 		case 'd':
 			log_opts |= LOG_PERROR;
@@ -241,6 +266,9 @@ int main(int argc, char *argv[])
 			break;
 		case 'h':
 			return usage(0);
+		case 'v':
+			puts("v" PACKAGE_VERSION);
+			return 0;
 		default:
 			return usage(1);
 		}
@@ -248,15 +276,7 @@ int main(int argc, char *argv[])

 	openlog("netd", log_opts, LOG_DAEMON);
 	setlogmask(LOG_UPTO(LOG_INFO));
-	INFO("starting");
-
-	/* Set up signal handlers */
-	sa.sa_handler = sighup_handler;
-	sigaction(SIGHUP, &sa, NULL);
-
-	sa.sa_handler = sigterm_handler;
-	sigaction(SIGTERM, &sa, NULL);
-	sigaction(SIGINT, &sa, NULL);
+	INFO("v%s starting", PACKAGE_VERSION);

 	if (backend_init()) {
 		ERROR("Failed to initialize backend");
@@ -267,19 +287,44 @@ int main(int argc, char *argv[])
 	TAILQ_INIT(&active_routes);
 	rip_config_init(&active_rip);

-	/* Initial load */
-	do_reload = 1;
+	/* Signal watchers */
+	ev_signal_init(&sighup_w, sighup_cb, SIGHUP);
+	ev_signal_start(loop, &sighup_w);

-	while (!do_shutdown) {
-		if (do_reload) {
-			do_reload = 0;
-			reload();
-		}
-		pause();
+	ev_signal_init(&sigterm_w, sigterm_cb, SIGTERM);
+	ev_signal_start(loop, &sigterm_w);
+
+	ev_signal_init(&sigint_w, sigterm_cb, SIGINT);
+	ev_signal_start(loop, &sigint_w);
+
+	/* Retry timer — one-shot, started only on backend failure */
+	ev_timer_init(&retry_w, retry_cb, 0., 0.);
+
+	/* Watch conf.d for changes so we don't rely solely on signals */
+	mkdir(CONF_DIR, 0755);
+	ifd = inotify_init1(IN_CLOEXEC | IN_NONBLOCK);
+	if (ifd < 0) {
+		ERROR("inotify_init1: %s, falling back to signals only", strerror(errno));
+	} else if (inotify_add_watch(ifd, CONF_DIR,
+				     IN_CLOSE_WRITE | IN_DELETE |
+				     IN_MOVED_TO | IN_MOVED_FROM) < 0) {
+		ERROR("inotify_add_watch %s: %s", CONF_DIR, strerror(errno));
+		close(ifd);
+		ifd = -1;
+	} else {
+		ev_io_init(&inotify_w, inotify_cb, ifd, EV_READ);
+		ev_io_start(loop, &inotify_w);
 	}

+	/* Initial load */
+	reload(loop);
+
+	ev_run(loop, 0);
+
 	INFO("shutting down");

+	if (ifd >= 0)
+		close(ifd);
 	route_list_free(&active_routes);
 	rip_config_free(&active_rip);
 	backend_cleanup();
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Mattias WalströmandGitHub	7176666340	Merge pull request #1445 from kernelkit/lts-kernel-backport LTS kernel backport + net.d tmpfiles fix	2026-03-13 08:27:24 +01:00
Joachim Wiberg	0b475a7ce6	Update ChangeLog for v26.02.1 GA Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-13 07:33:15 +01:00
Joachim Wiberg	2e9e5858b9	package/netd: ensure /etc/net.d exists at boot Before netd starts confd might want to create .conf file for it to run, so we sort of depend on /etc/net.d existing at boot. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-12 23:33:21 +01:00
Mattias WalströmandJoachim Wiberg	4c8b62d1b1	Upgrade Linux kernel to 6.18.17 Signed-off-by: Mattias Walström <lazzer@gmail.com>	2026-03-12 19:47:33 +01:00
Joachim WibergandGitHub	e17780f197	Merge pull request #1442 from kernelkit/netd-backport Backport fix to critical v26.02.0 regression	2026-03-12 16:10:14 +01:00
Joachim Wiberg	b4ea26961f	Update ChangeLog for v26.02.1 GA Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-12 13:53:38 +01:00
Joachim Wiberg	be3891c2f0	netd: watch conf.d with inotify, retry on backend failure Two races could prevent DHCP-learned default routes from being installed at boot: 1. The signal from the DHCP client script could be lost leaving conf.d updated but frr.conf stale. 2. Even when the signal was received, 'vtysh -b' could fail because the FRR daemon chain (mgmtd→zebra→staticd) writes PID files before being fully operational, causing netd to give up with no retry. Fix both by refactoring netd to use libev: - Use an inotify watch of CONF_DIR, so netd reacts directly to file changes without depending on signal delivery. - On backend_apply() failure, schedule a retry in 5s and call pidfile() unconditionally so dependent services are not blocked waiting for the Finit condition 'pid/netd' to be satisfied. We also take this opportunity to rename /etc/netd/conf.d/ to /etc/net.d/ The extra /etc/netd/ directory level served no purpose — nothing else lives there. Flatten to /etc/net.d/ which reads more naturally as the drop-in directory for network configuration snippets. Also, reduce logging a bit since each netd backend already logs success or fail which is sufficient to know that a configuration change has been applied or not. Finally, with the new inotify processing in netd it's redundant to call 'initctl reload netd' from the udhcpc script, in fact it will only cause unnecessary overhead, so we drop it. Fixes #1438 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-12 13:50:01 +01:00
Joachim WibergandGitHub	f6f6381eaf	Merge pull request #1433 from kernelkit/cand/v26.02.x v26.02.1 Release Candidate	2026-03-11 14:07:13 +01:00
Joachim Wiberg	e5754b4001	doc: prepare for v26.02.1 release Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-11 12:36:17 +01:00
Joachim Wiberg	6838cc9c25	confd: follow-up to OSPF point-to-multipoint Add a must expression to ensure users do not set static neighbors when the interface type is not point-to-multipoint or non-broadcast. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-11 12:36:17 +01:00
Mattias WalströmandJoachim Wiberg	d869f6c478	Followup OSPF point-to-multipoint [skip ci]	2026-03-11 12:36:16 +01:00
Mattias WalströmandJoachim Wiberg	f37d29aa21	ospf: add point-to-multipoint and hybrid interface type support Signed-off-by: Mattias Walström <lazzer@gmail.com>	2026-03-11 12:36:16 +01:00
ael-botandJoachim Wiberg	982a754472	Upgrade Linux kernel to 6.18.16	2026-03-10 14:33:33 +01:00
Joachim Wiberg	931ae71019	board: relocate SafeXcel firmware selection to Marvell BSPs The MVEBU SafeXcel Crypto Engine firmware (linux-firmware minifw) was originally added in `70c12c3` to the generic aarch64 defconfigs to silence kernel probe failures on Marvell Armada SoCs (37xx, 7k, 8k, CN913x): crypto-safexcel f2800000.crypto: Firmware load failed. crypto-safexcel f2800000.crypto: HW init failed (-2) It was then accidentally dropped in `0e2d12e` (kernel upgrade to 6.18), which rebased on a tree that predated the firmware addition. Rather than restoring it to the generic defconfigs, move it to the two Marvell board Config.in files where it actually belongs — consistent with how RTL8169 firmware was handled for the Raspberry Pi CM4 IoT Router Board Mini in `68313773`. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-10 14:27:31 +01:00
Joachim Wiberg	c69a617ecb	patches: lift iptables name length limit in firewalld A legacy name length limit in firewalld triggered problems with longer policy names. This patch to firewalld lifts that limit by checking the backend in use, no limit for nftables. Fixes #1389 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-10 14:27:31 +01:00
Joachim Wiberg	c79beea4ec	statd: silence 'show firewall' when firewall is disabled Fixes #1416 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-10 14:27:30 +01:00
Joachim Wiberg	cf1e81c8d1	package/skeleton-init-fint: increase zebra netlink buffer Increase Zebra NETLINK buffer to fix reported issues with zebra being out of sync with kernel routes and interface changes. Also, try '-a' option to allow other processes to delete zebra routes. Other changes in this commit: - Minor fixes to Finit service files for consistency - Empty daemon.conf stub files to silence bogus mgmtd errors at startup - Relocate all skeleton files from board/common to separate from files that are actual Infix additions and what's package system integration Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-10 14:27:30 +01:00
Mattias WalströmandJoachim Wiberg	e04937a0f7	GPS: Disable GPS in _minimal config	2026-03-10 14:27:30 +01:00
Mattias WalströmandJoachim Wiberg	e838f6dfd8	yang: add feature flags for wifi and gps in infix-hardware	2026-03-10 14:27:27 +01:00
Mattias WalströmandGitHub	7ccddc086b	Merge pull request #1422 from kernelkit/container-fixes Container and Coverity fixes	2026-03-01 10:21:58 +01:00
Joachim Wiberg	fb9a1fa1a5	Update ChangeLog for v26.02 release Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-01 08:29:13 +01:00
Joachim Wiberg	386ca9618e	confd: ensure DHCP client is not started before netd This is a follow-up to `c559b8f2` (new-frr) where netd now is responsible for funneling static routes, as well as routes from DHCP clients, into the kernel via Frr. For this to work, in particular at boot, any DHCP client must wait for netd to have started or any default routes learned will be lost. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-01 08:29:06 +01:00
Joachim Wiberg	abe571d32c	confd: silence Coverity false positive resource leak Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-01 07:00:06 +01:00
Joachim Wiberg	131177f3c9	confd: check return value and drop redundant assignment Found by Coverity Scan: - check rename() return value - drop redundant ripd_enabled assignment Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-01 07:00:06 +01:00
Joachim Wiberg	c3d396b5fe	copy: fix null dst dereference and uninit uri_i in curl() Found by Coverity Scan Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-01 07:00:05 +01:00
Joachim Wiberg	b341d37267	Update URL from kernelkit.org to www.kernelkit.org DNS does not allow CNAME records at an apex domain (e.g. kernelkit.org), so GitHub Pages cannot reliably redirect kernelkit.github.io to it. A www subdomain can carry a CNAME pointing directly to kernelkit.github.io, giving GitHub full control over the mapping and making the redirect work. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-01 06:59:48 +01:00
Joachim Wiberg	cbe8315508	cli: simplify 'show bfd [peer_addr]' -> 'show bfd [peer]' Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-01 06:59:48 +01:00
Joachim Wiberg	a5687bda7f	cli: add support for --reset-volumes on container upgrade The weird `if env \| grep -q 'reset-volumes'` construct is due to Klish not sanitizing names before constructing variables, which leads to env variables with '-' in them, not allowed in POSIX sh. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-01 06:58:21 +01:00
Joachim Wiberg	8fac3720fb	board/common: fix container force option for upgrade Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-01 06:57:36 +01:00
Joachim Wiberg	a4715debe8	cli: fix 'container upgrade <tab>' command completion Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-01 06:57:36 +01:00
Mattias WalströmandGitHub	da06ca14d4	Merge pull request #1421 from kernelkit/kernel-upgrade-25b449b5-0348-4f93-94a0-a0602c90ced5 Upgrade to kernel 6.18.15	2026-02-28 08:12:36 +01:00
ael-bot	9946357285	Upgrade Linux kernel to 6.18.15	2026-02-28 04:28:07 +00:00
				`@@ -0,0 +1 @@`
				`! Empty stub — mgmtd reads its own config at startup; file must exist to avoid log noise.`
				`@@ -0,0 +1 @@`
				`! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.`