Merge pull request #1075 from kernelkit/update-changelog-v25.06.0

Update Changelog for Infix v25.06.0
2026-07-22 09:13:01 +02:00 · 2025-06-30 09:48:30 +02:00 · 2025-06-30 08:40:45 +02:00 · 2025-06-29 22:24:23 +02:00 · 2025-06-29 21:07:10 +02:00 · 2025-06-29 21:06:33 +02:00
206 changed files with 5645 additions and 1399 deletions
@@ -13,7 +13,11 @@ on:
        required: false
        default: true
        type: boolean
-
+      parallell:
+        description: 'Massive parallel build of each image'
+        required: false
+        default: true
+        type: boolean
 jobs:
  build:
    name: Build Infix ${{ matrix.target }}
@@ -71,6 +75,7 @@ jobs:
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
          echo "flv=$flavor"              >> $GITHUB_OUTPUT
          echo "Building target ${target}${flavor}_defconfig"
+
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
@@ -96,10 +101,24 @@ jobs:
        run: |
          make test-unit

+      - name: Prepare parallel build
+        id: parallel
+        run: |
+
+          if [ "${{ ((github.event.inputs.parallel == 'true' && github.event_name == 'workflow_dispatch') || (github.ref_name != 'main' && github.event_name != 'workflow_dispatch')) }}" == "true" ]; then
+             echo "BR2_PER_PACKAGE_DIRECTORIES=y" >> output/.config
+             MAKE="make -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
+             echo "Building in parallel with -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
+          else
+             echo "Disabling parallel build"
+             MAKE="make"
+          fi
+          echo "MAKE=$MAKE" >> $GITHUB_OUTPUT
+
      - name: Build ${{ matrix.target }}${{ steps.vars.outputs.flv }}
        run: |
          echo "Building ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
-          make
+          eval "${{ steps.parallel.outputs.MAKE }}"

      - name:  Check SBOM from Build
        run: |
@@ -65,7 +65,7 @@ config INFIX_COMPATIBLE

 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix -- a Network Operating System"
+	default "Infix OS — Immutable.Friendly.Secure"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.
@@ -2,11 +2,11 @@

 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>

-Infix is a free, Linux based, immutable Network Operating System (NOS)
-built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
-porting to different platforms, simplify long-term maintenance, and
-provide made-easy management using NETCONF, RESTCONF[^2], or the
-built-in command line interface (CLI) from a console or SSH login.
+Infix is a free, Linux-based, immutable operating system built around
+[Buildroot][1] and [sysrepo][2].  A powerful mix that ease porting to
+different platforms, simplify long-term maintenance, and provide
+made-easy management using NETCONF, RESTCONF[^2], or the built-in
+command line interface (CLI) from a console or SSH login.

 > Click the **▶ Example CLI Session** foldout below for an example, or
 > head on over to the [Infix Documentation](doc/README.md) for more
@@ -27,13 +27,15 @@ it maintenance-free.  Configuration and data, e.g, containers, is stored
 on separate partitions to ensure complete separation from system files
 and allow for seamless backup, restore, and provisioning.

-In itself, Infix is perfectly suited for dedicated networking tasks, and
-with native support for Docker containers, the operating system provides
-a versatile platform that can easily be adapted to any customer need.
-Be it legacy applications, network protocols, process monitoring, or
-edge data analysis, it can run close to end equipment.  Either directly
-connected on dedicated Ethernet ports or indirectly using virtual
-network cables to exist on the same LAN as other connected equipment.
+In itself, Infix is perfectly suited for dedicated networking tasks,
+such as routing, switching, and monitoring.  This is how it started, as
+a network focused operating system.  Now, with native support for Docker
+containers, it provides a versatile platform that can easily be adapted
+to any customer need.  Be it legacy applications, network protocols,
+process monitoring, or edge data analysis, it can run close to end
+equipment.  Either directly connected on dedicated Ethernet ports or
+indirectly using virtual network cables to exist on the same LAN as
+other connected equipment.

 The simple design of Infix provides complete control over both system
 and data, minimal cognitive burden, and makes it incredibly easy to get
@@ -93,12 +95,14 @@ The [following boards](board/aarch64/README.md) are fully supported:
 - Marvell CN9130 CRB
 - Marvell EspressoBIN
 - Microchip SparX-5i PCB135 (eMMC)
- - StarFive VisionFive2
+ - Raspberry Pi 4B
 - NanoPi R2S

-An x86_64 build is also available, primarily intended for development
-and testing, but can also be used for evaluation and demo purposes.  For
-more information, see: [Infix in Virtual Environments](doc/virtual.md).
+Additionally, StarFive VisionFive2, a RISC-V based two-port router, and
+an x86_64 build is also available.  The latter is primarily intended for
+development and testing, but can also be used for evaluation and demo
+purposes.  For more information, see: [Infix in Virtual
+Environments](doc/virtual.md).

 > See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
 > page for our pre-built images.  The *[Latest Build][]* has bleeding
@@ -0,0 +1,14 @@
+--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts	2025-04-28 00:13:06.880003668 +0200
+++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts	2025-04-28 00:14:17.708941263 +0200
+@@ -14,6 +14,11 @@
+ 	chosen {
+ 		/* 8250 auxiliary UART instead of pl011 */
+ 		stdout-path = "serial1:115200n8";
+
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+ 	};
+ 
+ 	cam1_reg: regulator-cam1 {
@@ -0,0 +1 @@
+root=/dev/mmcblk0p2 rootwait console=tty1 console=ttyAMA0,115200
@@ -0,0 +1,41 @@
+# Please note that this is only a sample, we recommend you to change it to fit
+# your needs.
+# You should override this file using BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE.
+# See http://buildroot.org/manual.html#rootfs-custom
+# and http://elinux.org/RPiconfig for a description of config.txt syntax
+
+start_file=start4.elf
+fixup_file=fixup4.dat
+
+kernel=u-boot.bin
+
+device_tree=bcm2711-rpi-4-b.dtb
+dtoverlay=rpi-env
+dtoverlay=infix-key
+
+# To use an external initramfs file
+#initramfs rootfs.cpio.gz
+
+# Disable overscan assuming the display supports displaying the full resolution
+# If the text shown on the screen disappears off the edge, comment this out
+disable_overscan=1
+
+# How much memory in MB to assign to the GPU on Pi models having
+# 256, 512 or 1024 MB total memory
+gpu_mem_256=100
+gpu_mem_512=100
+gpu_mem_1024=100
+
+# Enable UART0 for serial console on ttyAMA0
+enable_uart=1
+force_turbo=1
+#dtoverlay=miniuart-bt
+
+# Run as fast as firmware / board allows
+arm_boost=1
+
+# enable 64bits support
+arm_64bit=1
+
+# Enable early debugging info
+uart_2ndstage=1
@@ -0,0 +1,71 @@
+image boot.vfat {
+	vfat {
+		files = {
+#BOOT_FILES#
+		}
+	}
+
+	size = 32M
+}
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
+	ext4 {
+		label = "cfg"
+	}
+}
+
+image var.ext4 {
+	empty = true
+	temporary = true
+	size = 512M
+
+	ext4 {
+		label = "var"
+		use-mke2fs = true
+	}
+}
+
+image sdcard.img {
+	hdimage {
+		partition-table-type = "gpt"
+	}
+
+	partition boot {
+		partition-type-uuid = EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
+		bootable = "true"
+		image = "boot.vfat"
+	}
+
+	partition aux {
+		partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 200M
+		image = "rootfs.squashfs"
+	}
+
+	partition secondary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 200M
+		image = "rootfs.squashfs"
+	}
+
+	partition cfg {
+		partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+		image = "var.ext4"
+	}
+}
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+# Armbian firmware installs to /lib/firmware but driver wants the
+# file(s) in /lib/firmware/brcm/
+if [ -f "${TARGET_DIR}/lib/firmware/BCM4345C0.hcd" ]; then
+    mv "${TARGET_DIR}/lib/firmware/BCM4345C0.hcd" "${TARGET_DIR}/lib/firmware/brcm/"
+fi
@@ -0,0 +1,43 @@
+#!/bin/sh
+set -e
+
+BOARD_DIR=$(dirname "$0")
+GENIMAGE_CFG="${BUILD_DIR}/genimage.cfg"
+GENIMAGE_TMP="${BUILD_DIR}/genimage.tmp"
+
+# Device trees are installed for distro boot (syslinux.conf), but on RPi
+# we need them for the SPL, which feeds the TPL (U-Boot) for use instead
+# of the (built-in) control DT other platforms use.
+find "${TARGET_DIR}/boot" -type f -name '*.dtb' -exec cp '{}' "${BINARIES_DIR}/" \;
+
+# We've asked U-Boot previously to build overlays for us: Infix signing
+# key and our ixboot scripts.  Make sure here they are installed in the
+# proper directory so genimage can create the DOS partition the SPL
+# reads config.txt from.
+find "${BINARIES_DIR}" -type f -name '*.dtbo' -exec mv '{}' "${BINARIES_DIR}/rpi-firmware/overlays/" \;
+
+# Create FILES array for the genimage.cfg generation
+FILES=""
+for f in "${BINARIES_DIR}"/*.dtb "${BINARIES_DIR}"/rpi-firmware/*; do
+    case "$f" in
+        *~|*.bak) continue ;;
+    esac
+    FILES="${FILES}\t\t\t\"${f#"${BINARIES_DIR}/"}\",\n"
+done
+
+KERNEL=$(sed -n 's/^kernel=//p' "${BINARIES_DIR}/rpi-firmware/config.txt")
+FILES="${FILES}\t\t\t\"${KERNEL}\""
+
+sed "s|#BOOT_FILES#|${FILES}|" "${BOARD_DIR}/genimage.cfg.in" > "${GENIMAGE_CFG}"
+
+ROOTPATH_TMP=$(mktemp -d)
+trap 'rm -rf \"$ROOTPATH_TMP\"' EXIT
+
+rm -rf "${GENIMAGE_TMP}"
+
+genimage					\
+    --rootpath   "${ROOTPATH_TMP}"		\
+    --tmppath    "${GENIMAGE_TMP}"		\
+    --inputpath  "${BINARIES_DIR}"		\
+    --outputpath "${BINARIES_DIR}"		\
+    --config     "${GENIMAGE_CFG}"
@@ -0,0 +1,16 @@
+default rpi4b
+menu title Boot Menu
+prompt 1
+timeout 30
+
+label rpi4b
+        menu label Infix on Raspberry Pi 4B
+	kernel /boot/Image
+	devicetree /boot/broadcom/bcm2711-rpi-4-b.dtb
+	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}
+
+label rpi400
+	menu label Infix on Raspberry Pi 400
+	kernel /boot/Image
+	devicetree /boot/broadcom/bcm2711-rpi-400.dtb
+	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}
@@ -0,0 +1,193 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "eth0",
+        "type": "infix-if-type:ethernet"
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name":  "deny-password-read",
+            "module-name": "ietf-system",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny"
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-address": "::"
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "rpi4",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          },
+	  "iburst": true
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo="
+  },
+  "infix-dhcp-client:dhcp-client": {
+    "client-if": [
+      {
+        "if-name": "eth0",
+        "option": [
+          {
+            "id": "netmask"
+          },
+          {
+            "id": "broadcast"
+          },
+          {
+            "id": "router"
+          },
+          {
+            "id": "domain"
+          },
+          {
+            "id": "hostname"
+          },
+          {
+            "id": "dns-server"
+          },
+          {
+            "id": "ntp-server"
+          }
+        ]
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "infix-meta:version": "1.2"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1,5 @@
+{
+    "eth0": {
+	"phy-detached-when-down": true
+    }
+}
@@ -0,0 +1,6 @@
+# Broadcom BCM2835 Watchdog timer
+device /dev/watchdog0 {
+    timeout    = 60
+    interval   = 5
+    safe-exit  = true
+}
@@ -0,0 +1,3 @@
+# CONFIG_MMC_PCI is not set
+CONFIG_OF_OVERLAY_LIST="rpi-env infix-key"
+# CONFIG_ENV_IS_IN_FAT is not set
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+&{/} {
+	config {
+		environment {
+			vendor = "infix";
+			preboot = "run ixpreboot";
+			ixbootdelay = "0.5";
+			bootdelay = "-2";
+			bootmenu_delay = "10";
+			boot_targets = "mmc1";
+			ethprime = "eth0";
+			bootcmd = "run ixboot";
+
+			ixpreboot     = /incbin/("scripts/ixpreboot.sh");
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+			ixbtn-factory = "echo \"No button available, use bootmenu\"";
+			ixfactory     = /incbin/("scripts/ixfactory.sh");
+
+			ixboot      = /incbin/("scripts/ixboot.sh");
+			ixbootslot  = /incbin/("scripts/ixbootslot.sh");
+			ixprepblk   = /incbin/("scripts/ixprepblk.sh");
+			ixprepdhcp  = /incbin/("scripts/ixprepdhcp.sh");
+		};
+	};
+};
@@ -45,11 +45,11 @@ The default credentials for the demo builds is
    login: admin
    password: admin

-    Infix -- a Network Operating System v24.09.0-rc1 (hvc0)
+    Infix OS — Immutable.Friendly.Secure v24.09.0-rc1 (hvc0)
    infix-00-00-00 login: admin
    Password: 
    .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
    |-. v .-| https://kernelkit.org
    '-'---'-'

@@ -122,9 +122,9 @@ There's a lot of tutorials and guides online, start here:
 About
 -----

-Infix is a free, Linux based, immutable Network Operating System (NOS)
-built on Buildroot, and sysrepo.  A powerful mix that ease porting to
-different platforms, simplify long-term maintenance, and provide easy
-management using NETCONF, RESTCONF, or the built-in command line
-interface (CLI) from a console or SSH login.
+Infix is a free, Linux-based, immutable operating system built around
+Buildroot, and sysrepo.  A powerful mix that ease porting to different
+platforms, simplify long-term maintenance, and provide easy management
+using NETCONF, RESTCONF, or the built-in command line interface (CLI)
+from a console or SSH login.

@@ -78,7 +78,7 @@ config QEMU_MACHINE

 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
-	default "384M"
+	default "448M"
 	help
 	  The default, 384 MiB, works for most configurations.  However,
 	  if you get kernel panic with: "System is deadlocked on memory",
@@ -0,0 +1,5 @@
+service name:wpa_supplicant :%i \
+			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+			       -- WPA supplicant @%i
+
+task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i
@@ -1,4 +1,4 @@
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'
@@ -0,0 +1 @@
+SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+if [ $# -ne 1 ]; then
+	echo "usage: $0 <ifname>"
+	exit 1
+fi
+ifname=$1
+
+TIMEOUT=300
+status=$(wpa_cli -i $ifname scan)
+while [ "$status" != "OK" ]; do
+	status=$(wpa_cli -i $ifname scan)
+	TIMEOUT=$((TIMEOUT-1))
+	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
+	sleep 0.5
+done
@@ -550,7 +550,7 @@ while [ "$1" != "" ]; do
 	    ;;
 	-m | --mount)
 	    shift
-	    mount="--mount=$1"
+	    mount="$mount --mount=$1"
 	    ;;
 	--manual)
 	    manual=true
@@ -696,7 +696,7 @@ case $cmd in
 	    oci)
 		find $BUILTIN $DOWNLOADS -type f 2>/dev/null
 		;;
-	    *)		
+	    *)
 		podman ps $all --format "{{.Names}}"
 		;;
 	esac
@@ -17,14 +17,23 @@ endef
 # U-Boot build tree. This will then be built in to the final U-Boot
 # image's control DT via the CONFIG_DEVICE_TREE_INCLUDES option (see
 # extras.config).
+#
+# Some platforms, most notably Raspberry Pi, load the device tree
+# from the SPL, effectively overriding the built-in control DT.
+# For that we bundle an overlay that can be included instead.
 define UBOOT_PRE_BUILD_INSTALL_KEY
-	$(HOST_DIR)/bin/dtc <(echo '/dts-v1/; / { signature {}; };') >$(@D)/infix-key.dtb
+	$(HOST_DIR)/bin/dtc -a 1024 <(echo '/dts-v1/; / { signature {}; };') \
+		>$(@D)/infix-key.dtb
 	$(foreach key, \
 		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
 		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
-	| sed -e 's:/dts-v[0-9]\+/;::' >$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi
+		| sed -e 's:/dts-v[0-9]\+/;::' \
+		| tee $(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi \
+		| sed -e '1i\/dts-v1/;\n/plugin/;\n' -e '/^$$/d' -e 's:/ {:\&{/} {:' \
+		>$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtso
+
 	rm $(@D)/infix-key.dtb
 endef
 UBOOT_PRE_BUILD_HOOKS += UBOOT_PRE_BUILD_INSTALL_KEY
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.26"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -126,7 +126,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -165,6 +165,8 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.26"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -108,7 +108,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -29,7 +29,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.26"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
@@ -170,7 +170,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-r2s"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -162,7 +162,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -0,0 +1,201 @@
+BR2_aarch64=y
+BR2_cortex_a72=y
+BR2_ARM_FPU_VFPV4=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
+BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
+BR2_GLOBAL_PATCH_DIR="board/raspberrypi/patches ${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_TARGET_GENERIC_HOSTNAME="infix"
+BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
+BR2_INIT_FINIT=y
+BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
+BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
+BR2_TARGET_GENERIC_GETTY_TERM="xterm"
+BR2_SYSTEM_DHCP="eth0"
+BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
+BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-image.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
+BR2_LINUX_KERNEL_PATCH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711-rpi-4-b-dts.patch"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711_defconfig"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="broadcom/bcm2711-rpi-4-b broadcom/bcm2711-rpi-400"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
+BR2_PACKAGE_XZ=y
+BR2_PACKAGE_STRACE=y
+BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_ARMBIAN_FIRMWARE=y
+BR2_PACKAGE_ARMBIAN_FIRMWARE_AP6255=y
+BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI=y
+BR2_PACKAGE_LINUX_FIRMWARE=y
+BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XXX=y
+BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366B1=y
+BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366C0=y
+BR2_PACKAGE_RPI_FIRMWARE=y
+BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4=y
+BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4_X=y
+BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/config.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/cmdline.txt"
+BR2_PACKAGE_DBUS_CXX=y
+BR2_PACKAGE_DBUS_GLIB=y
+BR2_PACKAGE_DBUS_TRIGGERD=y
+BR2_PACKAGE_EUDEV_RULES_GEN=y
+# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
+BR2_PACKAGE_EVEMU=y
+BR2_PACKAGE_EVTEST=y
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_INPUT_EVENT_DAEMON=y
+BR2_PACKAGE_MDIO_TOOLS=y
+BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
+BR2_PACKAGE_LIBSSH_OPENSSL=y
+BR2_PACKAGE_LIBSSH2=y
+BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
+BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_NETOPEER2_CLI=y
+BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_LINUX_PAM=y
+BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
+BR2_PACKAGE_ONIGURUMA=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_CONNTRACK_TOOLS=y
+BR2_PACKAGE_DNSMASQ=y
+BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FPING=y
+BR2_PACKAGE_FRR=y
+BR2_PACKAGE_HOSTAPD=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_IPTABLES_NFTABLES=y
+BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_IW=y
+BR2_PACKAGE_LLDPD=y
+BR2_PACKAGE_MSTPD=y
+BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NETCAT_OPENBSD=y
+BR2_PACKAGE_NETSNMP=y
+BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_NMAP=y
+BR2_PACKAGE_NMAP_NCAT=y
+BR2_PACKAGE_NMAP_NMAP=y
+BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_OPENRESOLV=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_SOCAT=y
+BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_TRACEROUTE=y
+BR2_PACKAGE_ULOGD=y
+BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIRELESS_REGDB=y
+BR2_PACKAGE_WIRELESS_TOOLS=y
+BR2_PACKAGE_WPA_SUPPLICANT=y
+BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
+BR2_PACKAGE_GETENT=y
+BR2_PACKAGE_HTOP=y
+BR2_PACKAGE_IRQBALANCE=y
+BR2_PACKAGE_KMOD_TOOLS=y
+BR2_PACKAGE_PWGEN=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_DBUS=y
+BR2_PACKAGE_RAUC_GPT=y
+BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_RAUC_JSON=y
+BR2_PACKAGE_SYSKLOGD=y
+BR2_PACKAGE_SYSKLOGD_LOGGER=y
+BR2_PACKAGE_WATCHDOGD=y
+BR2_PACKAGE_LESS=y
+BR2_PACKAGE_MG=y
+BR2_PACKAGE_NANO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_arm64"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/extras.config"
+BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/rpi-env.dtso"
+BR2_PACKAGE_HOST_DOSFSTOOLS=y
+BR2_PACKAGE_HOST_E2FSPROGS=y
+BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
+BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_KMOD_XZ=y
+BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+INFIX_VENDOR_HOME="https://github.com/kernelkit"
+INFIX_IMAGE_ID="${INFIX_ID}-rpi4"
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_GENCERT=y
+BR2_PACKAGE_STATD=y
+BR2_PACKAGE_FACTORY=y
+BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
+BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
+BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
+BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
+BR2_PACKAGE_FINIT_PLUGIN_TTY=y
+BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_IITO=y
+BR2_PACKAGE_KEYACK=y
+BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
+BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
+BR2_PACKAGE_PODMAN=y
+BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
+BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
+BR2_PACKAGE_PODMAN_DRIVER_VFS=y
+BR2_PACKAGE_SHOW=y
+BR2_PACKAGE_TETRIS=y
+BR2_PACKAGE_ROUSETTE=y
+BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
+SDCARD_AUX=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.26"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -132,7 +132,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -167,6 +167,8 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.26"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -115,7 +115,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -3,16 +3,52 @@ Change Log

 All notable changes to the project are documented in this file.

-[v25.05.0][UNRELEASED]
+[v25.06.0][] - 2025-06-30
 -------------------------
+
 ### Changes
- Upgrade Linux kernel to 6.12.26 (LTS)
+- Upgrade Buildroot to 2025.02.4 (LTS)
+- Upgrade Linux kernel to 6.12.35 (LTS)
+- Upgrade curiOS built-in containers to v25.06.0
+- Add support for setting mode of a container content mount, issue #1070
+- Add Wi-Fi client support and add support for some USB-Wi-Fi cards
+- New slogan: Infix OS — Immutable.Friendly.Secure
+
+### Fixes
+- cli: fix by-word movement, detect word barrier using non-alphanum chars
+- cli: fix delete word left/right, make sure to save word in kill buffer
+
+
+[v25.05.1][] - 2025-06-12
+-------------------------
+
+### Changes
+- Upgrade Linux kernel to 6.12.32 (LTS)
+
+### Fixes
+- Fix #1060: Restore of missing CLI commands, regression in Infix v25.05.0
+
+[v25.05.0][] - 2025-05-27
+-------------------------
+
+### Changes
+- Upgrade Buildroot to 2025.02.3 (LTS)
+- Upgrade Linux kernel to 6.12.30 (LTS)
 - Upgrade libyang to 3.12.2
 - Upgrade sysrepo to 3.6.11
 - Upgrade netopeer2 (NETCONF) to 2.4.1
+- New hardware support: Raspberry Pi 4B (aarch64)
 - Add documentation on Infix upgrading and downgrading, issue #1009
+- Add HDMI and USB support for iMX8MP-evk
+- Enforced strict format for LLDP destination MAC address:
+  - Only accepts colon-separated format: `01:80:C2:00:00:0E`
+- Add `show lldp` command to show discovered neighbors per interface.
+- Add configuration support for per-interface LLDP administrative status

 ### Fixes
+- Fix containers with multiple mounts
+- Correct description for LAG LACP modes
+- Fix #1040: Add `mount` constraint for container config


 [v25.04.0][] - 2025-04-30
@@ -125,6 +161,7 @@ All notable changes to the project are documented in this file.
 - Add support for GRE/GRETAP tunnels
 - Add support for STP/RSTP on bridges
 - Add support for VXLAN tunnels
+ - Add support for configuring global LLDP `message-tx-interval`

 ### Fixes

@@ -1557,7 +1594,8 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.04.0...HEAD
+[v25.06.0]:   https://github.com/kernelkit/infix/compare/v25.05.1...v26.06.0
+[v25.05.1]:   https://github.com/kernelkit/infix/compare/v25.05.0...v25.05.1
 [v25.05.0]:   https://github.com/kernelkit/infix/compare/v25.04.0...v25.05.0
 [v25.04.0]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
 [v25.03.0]:   https://github.com/kernelkit/infix/compare/v25.02.0...v25.03.0
@@ -1,7 +1,7 @@
 <img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>

-Welcome to Infix, your friendly Network Operating System!  On these
-pages you can find both user and developer documentation.
+Welcome to Infix, your immutable, friendly, and secure operating system!
+On these pages you can find both user and developer documentation.

 Most topics on configuring the system include CLI examples, but every
 setting, as well as status read-back from the operational datastore, is
@@ -63,7 +63,7 @@ bootloader's validation procedure, user configuration is kept to a
 minimum.  Two settings are available:

 - **Boot order**: Since Infix maintains two copies of its software image,
-  and as some bootloaders support netbooting, the order in which boot
+  and as some bootloaders support [netbooting][2], the order in which boot
  sources are considered can be configured. To select the active
  source, use [RAUC][]:

@@ -352,3 +352,5 @@ If `var` is not available, Infix will still persist `/var/lib` using
 [^1]: See [Upgrading procedures and boot
    order](system.md#upgrade-procedures-and-boot-order) for
    information on upgrading via CLI.
+
+[2]: netboot.md
@@ -214,7 +214,7 @@ text file without line breaks (`-w0`):
 ```bash
 $ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" |base64 -d
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.github.io
 '-'---'-'
 ```
@@ -46,7 +46,7 @@ admin@infix-c0-ff-ee:~$

 ## LLDP

-Infix supports LLDP (IEEE 802.1AB).  For a device with factory default
+Infix supports LLDP (IEEE 802.1AB). For a device with factory default
 settings, the link-local IPv6 address can be read from the Management
 Address TLV using *tcpdump* or other sniffing tools[^1]:

@@ -131,6 +131,10 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
 linux-pc:#
 ```

+The following capabilities are available via NETCONF/RESTCONF or the Infix CLI.
+
+### LLDP Enable/Disable
+
 The LLDP service can be disabled using the following commands.

 ```
@@ -140,6 +144,59 @@ admin@infix-c0-ff-ee:/config/> leave
 admin@infix-c0-ff-ee:/> 
 ```

+To reenable it from the CLI config mode:
+
+```
+admin@test-00-01-00:/config/> set lldp enabled 
+admin@test-00-01-00:/config/> leave
+```
+
+### LLDP Message Transmission Interval
+
+By default, LLDP uses a `message-tx-interval` of 30 seconds, as defined
+by the IEEE standard. Infix allows this value to be customized.
+To change it using the CLI:
+
+```
+admin@test-00-01-00:/config/> set lldp message-tx-interval 1
+admin@test-00-01-00:/config/> leave
+```
+
+### LLDP Administrative Status per Interface
+
+Infix supports configuring the LLDP administrative status on a per-port
+basis. The default mode is `tx-and-rx`, but the following options are 
+also supported:
+
+- `rx-only` – Receive LLDP packets only
+- `tx-only` – Transmit LLDP packets only
+- `disabled` – Disable LLDP on the interface
+
+Example configuration:
+
+```
+admin@test-00-01-00:/config/> set lldp port e8 dest-mac-address 01:80:C2:00:00:0E admin-status disabled
+admin@test-00-01-00:/config/> set lldp port e5 dest-mac-address 01:80:C2:00:00:0E admin-status rx-only 
+admin@test-00-01-00:/config/> set lldp port e6 dest-mac-address 01:80:C2:00:00:0E admin-status tx-only
+admin@test-00-01-00:/config/> leave
+```
+
+> [!NOTE]
+> The destination MAC address must be the standard LLDP multicast 
+> address: `01:80:C2:00:00:0E`.
+
+###  Displaying LLDP Neighbor Information
+
+In CLI mode, Infix also provides a convenient `show lldp` command to
+list LLDP neighbors detected on each interface:
+
+```
+admin@test-00-01-00:/> show lldp 
+INTERFACE       REM-IDX   TIME        CHASSIS-ID          PORT-ID             
+e5              1         902         00:a0:85:00:04:01   00:a0:85:00:04:07   
+e6              3         897         00:a0:85:00:03:01   00:a0:85:00:03:07   
+e8              2         901         00:a0:85:00:02:01   00:a0:85:00:02:05
+```

 ## mDNS-SD

@@ -237,7 +294,7 @@ rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
 linux-pc:# ssh admin@infix-c0-ff-ee.local
 (admin@infix-c0-ff-ee.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-

@@ -277,7 +334,7 @@ rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
 linux-pc:# ssh admin@infix.local
 (admin@infix.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-

@@ -79,11 +79,11 @@ typically setup to run at 115200 baud, 8N1.


 ```
-Infix -- a Network Operating System v24.11.1 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v24.11.1 (ttyS0)
 example login: admin
 Password:
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -92,7 +92,7 @@ Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
 Warning: Permanently added 'fe80::ff:fe00:0%eth0' (ED25519) to the list of known hosts.
 admin@fe80::ff:fe00:0%eth0's password: *****
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -1263,7 +1263,7 @@ It should now be possible to access the switch from the PC via SSH (or NETCONF).
 ~ $ ssh admin@fe80::0053:00ff:fe06:1101%eth1
 admin@fe80::0053:00ff:fe06:1101%eth1's password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -357,25 +357,45 @@ booted from one partition, an `upgrade` will apply to the other

 1. Download and unpack the release to install. Make the image *pkg*
   bundle available at some URL[^10]
-2. Assume the unit has booted the `primary` image. Then running the
+2. (Optional) Backup the startup configuration
+3. Assume the unit has booted the `primary` image. Then running the
   `upgrade` command installs a new image on the `secondary`
   partition
-3. As part of a successful upgrade, the boot-order is implictly
+4. As part of a successful upgrade, the boot-order is implictly
   changed to boot the newly installed image
-4. Reboot the unit
-5. The unit now runs the new image. To upgrade the remaining partition
+5. Reboot the unit
+6. The unit now runs the new image. To upgrade the remaining partition
   (`primary`), run the same upgrade command again, and (optionally)
   reboot to verify the upgrade
   
 > [!CAUTION]
-> During boot, the unit may [migrate](#configuration-migration) the
-> startup configuration for any syntax changes.  It is therefore
-> important that you make sure to upgrade the other partition as well
-> after reboot, of course after having verified your setup.
+> During boot (step 5), the unit may
+> [migrate](#configuration-migration) the startup configuration for
+> any syntax changes.  It is therefore important that you make sure to
+> upgrade the other partition as well after reboot, of course after
+> having verified your setup.

-The CLI example below shows steps 2-4.
+The CLI example below shows steps 2-5.

-Upgrade: here the image *pkg bundle* was made available via TFTP.
+*Backup startup configuration:* It is recommended to backup the
+startup configuration before performing an upgrade. The backup is
+useful if the upgrade fails, and makes a later
+[downgrade](#downgrading-infix) smoother to conduct.
+
+```
+admin@example:/> dir /cfg
+/cfg directory
+backup/             ssl/                startup-config.cfg
+
+admin@example:/> copy /cfg/startup-config.cfg /cfg/v25.01.0-startup-config.cfg
+admin@example:/> dir /cfg
+/cfg directory
+backup/             ssl/                startup-config.cfg           v25.01.0-startup-config.cfg
+
+admin@example:/> 
+```
+
+*Upgrade:* Here the image *pkg bundle* was made available via TFTP.

 ```
 admin@example:/> upgrade tftp://198.18.117.1/infix-aarch64-25.03.1.pkg
@@ -393,7 +413,7 @@ Installing `tftp://198.18.117.1/infix-aarch64-25.03.1.pkg` succeeded
 admin@example:/>
 ```

-Reboot: The unit will boot on the other partition, with the newly
+*Reboot:* The unit will boot on the other partition, with the newly
 installed image. The `Loading startup-config` step conducts migration
 of startup configuration if applicable.

@@ -407,11 +427,11 @@ admin@example:/> reboot
 [ OK ] Update DNS configuration
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.03.1 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.03.1 (ttyS0)
 example login: admin
 Password:
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -435,7 +455,7 @@ As shown, the *boot order* has been updated, so that *secondary* is
 now the preferred boot source.

 To upgrade the remaining partition (`primary`), run the `upgrade URL`
-command again, and reboot.
+command again, and (optionally) reboot.

 ### Configuration Migration

@@ -519,8 +539,25 @@ with the unit in *failure config*.

 *Find the backup configuration file:*

-Assume you have a backup startup config for the version to downgrade
-to (here Infix v25.01.0, config `version 1.4`).
+Assume you have a backup startup config for the Infix version to
+downgrade to (here Infix v25.01.0, config `version 1.4`).
+
+The preferred approach is to use a startup configuration backed up
+when running Infix v25.01.0 on the unit. See the section on [upgrading
+Infix](#upgrading-infix) above for more information. In the example
+below, there is a backup file available named
+*v25.01.0-startup-config.cfg* 
+
+```
+admin@example:/> dir /cfg
+/cfg directory
+backup/             ssl/                startup-config.cfg           v25.01.0-startup-config.cfg
+
+admin@example:/> 
+```
+
+The alternative is to use a startup config implicitly backed up by the
+system as part of [configuration migration](#configuration-migration).

 ```
 admin@example:/> dir /cfg/backup/
@@ -530,6 +567,23 @@ startup-config-1.4.cfg
 admin@example:/>
 ```

+> [!CAUTION] Using a backup configuration file stored when the unit
+> was running the old version (e.g., v25.01.0-startup-config.cfg) is
+> preferred. Although backup files stored due to configuration
+> migration (e.g., startup-config-1.4.cfg) usually works too if the
+> configuration file version (`1.4`) matches, there are
+> situations when the system may fail to apply it as described below.
+
+The *configuration file version* (`1.4`) is only incremented when
+changes in YANG configuration syntax mandates it to handle
+*upgrading*.  Say the next Infix version includes a new feature
+setting, it can still have version `1.4`, as upgrading to it would not
+need migration. If a user then enables the new feature setting, the
+new configuration will no longer be compatible with the previous *Infix
+version*. A downgrade after enabling new features risks ending up with
+the unit in *failure config*. 
+
+
 *Use `upgrade` command to downgrade:*

 ```
@@ -548,6 +602,19 @@ admin@example:/>

 *Apply the backup configuration file:*

+It is recommended to use a backup configuration file for the Infix version to
+downgrade to, if there is one available.
+
+```
+admin@example:/> copy /cfg/v25.01.0-startup-config.cfg /cfg/startup-config.cfg
+Overwrite existing file /cfg/startup-config.cfg (y/N)? y
+admin@example:/>
+```
+
+An alternative is to use a backup file stored when the system
+conducted a [configuration migration](#configuration-migration). See
+the *caution* note above.
+
 ```
 admin@example:/> copy /cfg/backup/startup-config-1.4.cfg /cfg/startup-config.cfg
 Overwrite existing file /cfg/startup-config.cfg (y/N)? y
@@ -556,8 +623,7 @@ admin@example:/>

 *Reboot:*

-The unit will come up with the applied backup configuration instead of
-failure config.
+The unit will come up with the applied backup configuration. 

 ```
 admin@example:/> reboot
@@ -572,9 +638,12 @@ admin@example:/> reboot
 [ OK ] Verifying self-signed https certificate
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
 example login:
 ```
+> [!NOTE]
+> If the unit despite these measures ends up in *failure config*, see
+> the next section for more information on how to recover.

 #### Downgrading without applying a backup startup configuration

@@ -626,7 +695,7 @@ admin@example:/> reboot
 [ OK ] Verifying self-signed https certificate
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)

 ERROR: Corrupt startup-config, system has reverted to default login credentials
 failed-00-00-00 login:
@@ -669,7 +738,7 @@ Reboot now to perform reset, (y/N)? y

 Please press Enter to activate this console.

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
 example login:
 ```

@@ -680,7 +749,7 @@ Continued configuration is done as with any unit after factory reset.
 [3]: https://www.rfc-editor.org/rfc/rfc8341
 [4]: https://chrony-project.org/doc/4.6.1/chronyc.html
 [5]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/confd/infix-system-software.yang
-[6]: boot.md#system-configuration
+[6]: netboot.md
 [7]: introduction.md#system-boot
 [8]: management.md#console-port
 [^9]: In failure config, Infix puts all Ethernet ports as individual
@@ -688,3 +757,5 @@ Continued configuration is done as with any unit after factory reset.
    using link local IPv6 addresses. This as an alternative to
    connecting via a console port.
 [^10]: Set up an FTP/TFTP/SFTP or HTTP/HTTPS server on the same LAN. 
+
+[11]: scripting.md#-backup-configuration-using-sysrepocfg-and-scp
@@ -123,11 +123,11 @@ there is another helper script in Infamy for this:
    Trying 127.0.0.1...
    Connected to 127.0.0.1.

-    Infix -- a Network Operating System v23.11.0-226-g0c144da (console)
+    Infix OS — Immutable.Friendly.Secure v23.11.0-226-g0c144da (console)
    infix-00-00-00 login: admin
    Password:
    .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
    |-. v .-| https://kernelkit.org
    '-'---'-'

@@ -0,0 +1,152 @@
+# Wi-Fi (Wireless LAN)
+
+Infix includes built-in Wi-Fi client support for connecting to
+wireless networks. When a compatible Wi-Fi adapter is detected, the
+system automatically begins scanning for available networks.
+
+## Current Limitations
+
+- Only client mode is supported (no access point functionality)
+- USB hotplug is not supported - adapters must be present at boot
+- Interface naming may be inconsistent with multiple USB Wi-Fi adapters
+
+## Supported Wi-Fi Adapters
+
+Wi-Fi support is primarily tested with Realtek chipset-based adapters.
+
+### Known Working Chipsets
+
+- RTL8821CU
+- Other Realtek chipsets may work but are not guaranteed
+
+
+> [!NOTE]  Some Realtek chipsets require proprietary drivers not included in the standard kernel
+>          Firmware requirements vary by chipset
+>          Check kernel logs if your adapter is not detected
+
+## Configuration
+
+Add a supported Wi-Fi network device. To verify that it has been
+detected, look for `wifi0` in `show interfaces`
+
+```
+admin@example:/>  show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   DOWN        f0:09:0d:36:5f:86
+                wifi                   ssid: ------, signal: ------
+
+```
+Add the new Wi-Fi interface to the configuration to start scanning.
+```
+admin@example:/config/> set interface wifi0
+admin@example:/config/> leave
+```
+Now the system will now start scanning in the background. To
+see the result read the operational datastore for interface `wifi0` or
+use the CLI
+
+```
+admin@infix-00-00-00:/> show interfaces name wifi0
+name                : wifi0
+type                : wifi
+index               : 3
+mtu                 : 1500
+operational status  : down
+physical address    : f0:09:0d:36:5f:86
+ipv4 addresses      :
+ipv6 addresses      :
+SSID                : ----
+Signal              : ----
+
+SSID                                    ENCRYPTION                    SIGNAL
+ssid1                                   WPA2-Personal                 excellent
+ssid2                                   WPA2-Personal                 excellent
+ssid3                                   WPA2-Personal                 excellent
+ssid4                                   WPA2-Personal                 good
+ssid5                                   WPA2-Personal                 good
+ssid6                                   WPA2-Personal                 good
+```
+
+In the CLI, signal strength is reported as: excellent, good, poor or
+bad. For precise values, use NETCONF or RESTCONF, where the RSSI (in
+dBm) is available in the operational datastore.
+
+Configure your Wi-Fi secret in the keystore, it should be between 8
+and 63 characters
+
+```
+admin@example:/> configure
+admin@example:/config/> edit keystore symmetric-key example
+admin@example:/config/keystore/symmetric-key/example/> set key-format wifi-preshared-key-format
+admin@example:/config/keystore/symmetric-key/example/> set cleartext-key mysecret
+admin@example:/config/keystore/symmetric-key/example/> leave
+admin@example:/>
+```
+
+Configure the Wi-Fi settings, set secret to the name selected above
+for the symmetric key, in this case `example`.
+
+WPA2 or WPA3 encryption will be automatically selected based on what
+the access point supports. No manual selection is required unless
+connecting to an open network. No support for certificate based
+authentication yet.
+
+Unencrypted network is also supported, to connect to an unencrypted
+network (generally not recommended):
+```
+admin@example:/config/interface/wifi0/> set wifi encryption disabled
+```
+
+A valid `country-code` is also required for regulatory compliance, the
+valid codes are documented in the YANG model `infix-wifi-country-codes`
+
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface wifi0
+admin@example:/config/interface/wifi0/>
+admin@example:/config/interface/wifi0/> set wifi ssid ssid1
+admin@example:/config/interface/wifi0/> set wifi secret example
+admin@example:/config/interface/wifi0/> set wifi country-code SE
+admin@example:/config/interface/wifi0/> leave
+```
+
+The Wi-Fi negotiation should now start immediately, provided that the
+SSID and pre-shared key are correct. You can verify the connection by
+running `show interfaces` again.
+
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   UP          f0:09:0d:36:5f:86
+                wifi                   ssid: ssid1, signal: excellent
+
+admin@example:/>
+```
+
+## Troubleshooting Connection Issues
+
+Use `show wifi scan wifi0` and `show interfaces` to verify signal strength
+and connection status. If issues arise, try the following
+troubleshooting steps:
+
+1. **Verify signal strength**: Check that the target network shows "good" or "excellent" signal
+2. **Check credentials**: Verify the preshared key in `ietf-keystore`
+3. **Review logs**: Check system logs with `show log` for Wi-Fi related errors
+4. **Regulatory compliance**: Ensure the country-code matches your location
+5. **Hardware detection**: Confirm the adapter appears in `show interfaces`
+
+If issues persist, check the system log for specific error messages that can help identify the root cause.
@@ -2,6 +2,7 @@ menu "Packages"

 comment "Hardware Support"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/feature-wifi/Config.in"

 comment "Software Packages"
 source "$BR2_EXTERNAL_INFIX_PATH/package/bin/Config.in"
@@ -42,5 +43,4 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rauc-installation-status/Config.in"
-
 endmenu
@@ -1,53 +1,2 @@
-define inner-ix-board
-
-$(2)_VERSION = ix-board
-$(2)_LICENSE = BSD-3-Clause
-$(2)_LICENSE_FILES = LICENSE
-$(2)_SITE_METHOD = local
-$(2)_SITE = $$(BR2_EXTERNAL_INFIX_PATH)/src/board/$(1)
-$(2)_REDISTRIBUTE = NO
-
-# The kernel must be built first.
-$(2)_DEPENDENCIES += \
-	linux \
-	$$(BR2_MAKE_HOST_DEPENDENCY)
-
-# This is only defined in some infrastructures (e.g. autotools, cmake),
-# but not in others (e.g. generic). So define it here as well.
-$(2)_MAKE ?= $$(BR2_MAKE)
-
-define $(2)_DTBS_BUILD
-	@$$(call MESSAGE,"Building device tree blob(s)")
-	$$(LINUX_MAKE_ENV) $$($$(PKG)_MAKE) \
-		-C $$(LINUX_DIR) \
-		$$(LINUX_MAKE_FLAGS) \
-		$$($(2)_DTB_MAKE_OPTS) \
-		PWD=$$(@D)/dts \
-		M=$$(@D)/dts \
-		modules
-endef
-$(2)_POST_BUILD_HOOKS += $(2)_DTBS_BUILD
-
-define $(2)_DTBS_INSTALL_TARGET
-	@$$(call MESSAGE,"Installing device tree blob(s)")
-	$$(TARGET_MAKE_ENV) $$(TARGET_CONFIGURE_OPTS) $$($$(PKG)_MAKE) \
-		-f $$(BR2_EXTERNAL_INFIX_PATH)/package/board/dtb-inst.makefile \
-		-C $$(@D)/dts \
-		DESTDIR="$$(TARGET_DIR)" \
-		install
-endef
-$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_DTBS_INSTALL_TARGET
-
-define $(2)_OVERLAY_INSTALL_TARGET
-	@test -d $$(@D)/rootfs && \
-	$$(call MESSAGE,"Copying overlay") && \
-	$$(call SYSTEM_RSYNC,$$(@D)/rootfs,$(TARGET_DIR)) || \
-	true
-endef
-$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_OVERLAY_INSTALL_TARGET
-
-endef
-
-ix-board = $(call inner-ix-board,$(pkgname),$(call UPPERCASE,$(pkgname)))
-
+include $(BR2_EXTERNAL_INFIX_PATH)/package/board/ix-board.mk
 include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/package/board/*/*.mk))
@@ -20,6 +20,26 @@ define FREESCALE_IMX8MP_EVK_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INTERCONNECT_IMX)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INTERCONNECT_IMX8MP)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+# For X
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_ETNAVIV)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_IMX8MP_DW_HDMI_BRIDGE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_FSL_SAMSUNG_HDMI_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_IMX8MP_HDMI_PVI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_IMX_LCDIF)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSEDEV)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_HID_GENERIC)
+
+# For USB
+	$(call KCONFIG_DISABLE_OPT,CONFIG_USB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3)
+	$(call KCONFIG_DISABLE_OPT,CONFIG_USB_DWC3_GADGET)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3_HOST)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARM_IMX_BUS_DEVFREQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_TYPEC_TCPCI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_TYPEC_SWITCH_GPIO)
 endef

 $(eval $(ix-board))
@@ -0,0 +1,51 @@
+define inner-ix-board
+
+$(2)_VERSION = ix-board
+$(2)_LICENSE = BSD-3-Clause
+$(2)_LICENSE_FILES = LICENSE
+$(2)_SITE_METHOD = local
+$(2)_SITE = $$(BR2_EXTERNAL_INFIX_PATH)/src/board/$(1)
+$(2)_REDISTRIBUTE = NO
+
+# The kernel must be built first.
+$(2)_DEPENDENCIES += \
+	linux \
+	$$(BR2_MAKE_HOST_DEPENDENCY)
+
+# This is only defined in some infrastructures (e.g. autotools, cmake),
+# but not in others (e.g. generic). So define it here as well.
+$(2)_MAKE ?= $$(BR2_MAKE)
+
+define $(2)_DTBS_BUILD
+	@$$(call MESSAGE,"Building device tree blob(s)")
+	$$(LINUX_MAKE_ENV) $$($$(PKG)_MAKE) \
+		-C $$(LINUX_DIR) \
+		$$(LINUX_MAKE_FLAGS) \
+		$$($(2)_DTB_MAKE_OPTS) \
+		PWD=$$(@D)/dts \
+		M=$$(@D)/dts \
+		modules
+endef
+$(2)_POST_BUILD_HOOKS += $(2)_DTBS_BUILD
+
+define $(2)_DTBS_INSTALL_TARGET
+	@$$(call MESSAGE,"Installing device tree blob(s)")
+	$$(TARGET_MAKE_ENV) $$(TARGET_CONFIGURE_OPTS) $$($$(PKG)_MAKE) \
+		-f $$(BR2_EXTERNAL_INFIX_PATH)/package/board/dtb-inst.makefile \
+		-C $$(@D)/dts \
+		DESTDIR="$$(TARGET_DIR)" \
+		install
+endef
+$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_DTBS_INSTALL_TARGET
+
+define $(2)_OVERLAY_INSTALL_TARGET
+	@test -d $$(@D)/rootfs && \
+	$$(call MESSAGE,"Copying overlay") && \
+	$$(call SYSTEM_RSYNC,$$(@D)/rootfs,$(TARGET_DIR)) || \
+	true
+endef
+$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_OVERLAY_INSTALL_TARGET
+
+endef
+
+ix-board = $(call inner-ix-board,$(pkgname),$(call UPPERCASE,$(pkgname)))
@@ -25,6 +25,11 @@ else
 CONFD_CONF_OPTS += --disable-containers
 endif

+ifeq ($(BR2_PACKAGE_FEATURE_WIFI),y)
+CONFD_CONF_OPTS += --enable-wifi
+else
+CONFD_CONF_OPTS += --disable-wifi
+endif
 define CONFD_INSTALL_EXTRA
 	for fn in confd.conf resolvconf.conf; do \
 		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
@@ -69,23 +74,42 @@ define CONFD_INSTALL_YANG_MODULES_CONTAINERS
 	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/containers.inc
 endef
 endif
-
-define CONFD_PERMISSIONS
-	/etc/sysrepo/data/ r 660 root sys-cli - - - - -
-	/etc/sysrepo/data  d 770 root sys-cli - - - - -
+ifeq ($(BR2_PACKAGE_FEATURE_WIFI),y)
+define CONFD_INSTALL_YANG_MODULES_WIFI
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/wifi.inc
 endef
+endif

+# PER_PACKAGE_DIR
+# Since the last package in the dependency chain that runs sysrepoctl is confd, we need to
+# manually copy the *real* content here from host-sysrepo.
+ifeq ($(BR2_PER_PACKAGE_DIRECTORIES),y)
+define CONFD_INSTALL_IN_ROMFS
+	cp -a $(PER_PACKAGE_DIR)/host-sysrepo/target/etc/sysrepo/* $(PER_PACKAGE_DIR)/confd/target/etc/sysrepo/
+endef
+endif
+
+# PER_PACKAGE_DIR
+# Need to do some special stuff if using per-packet (parallel) since sysrepo install the submodules in
+# $(PER_PACKAGE_DIR)/host-sysrepo/target/etc/sysrepo/ but $(PER_PACKAGE_DIR)/confd/target/etc/sysrepo/ contains remains
+# of other packets that have installed its models (netopeer2), we want the result in $(PER_PACKAGE_DIR)/host-sysrepo/target/etc/sysrepo/
 define CONFD_EMPTY_SYSREPO
-	rm -rf $(TARGET_DIR)/etc/sysrepo/data/
+	rm -rf $(TARGET_DIR)/etc/sysrepo/*
+	if [ "$(BR2_PER_PACKAGE_DIRECTORIES)" = "y" ]; then \
+		rm -rf $(PER_PACKAGE_DIR)/host-sysrepo/target/etc/sysrepo/* $(PER_PACKAGE_DIR)/confd/target/etc/sysrepo/*; \
+	fi
 endef
 define CONFD_CLEANUP
 	rm -f /dev/shm/$(CONFD_SYSREPO_SHM_PREFIX)*
 endef
-CONFD_PRE_INSTALL_TARGET_HOOKS += CONFD_EMPTY_SYSREPO
-CONFD_PRE_INSTALL_TARGET_HOOKS += CONFD_CLEANUP
+CONFD_PRE_BUILD_HOOKS += CONFD_EMPTY_SYSREPO
+CONFD_PRE_BUILD_HOOKS += CONFD_CLEANUP
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_EXTRA
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
-CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_CLEANUP
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WIFI
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_IN_ROMFS
+CONFD_TARGET_FINALIZE_HOOKS += CONFD_CLEANUP

 $(eval $(autotools-package))
@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  3e7f777a054fbc29173bcdafe50ca096a8abf9e556bec9f52617c9881c9ce3e3  curios-httpd-oci-arm64-v24.11.0.tar.gz
-sha256  bfa52f712301427a21b89cfee31ca315e1404973affaf34b23978a70a3ec4f63  curios-httpd-oci-amd64-v24.11.0.tar.gz
+sha256  c4995c0a7a96d5273c97c7c026c03ff5e2a42cade6d66808fdeba0fae9a343d8  curios-httpd-oci-arm64-v25.06.0.tar.gz
+sha256  4d48a03b38eabe558052ecbab7560e6d9f995311eb91b90ddaac336b5f001a5e  curios-httpd-oci-amd64-v25.06.0.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CURIOS_HTTPD_VERSION = v24.11.0
+CURIOS_HTTPD_VERSION = v25.06.0
 CURIOS_HTTPD_SOURCE = curios-httpd-oci-$(GO_GOARCH)-$(CURIOS_HTTPD_VERSION).tar.gz
 CURIOS_HTTPD_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_HTTPD_VERSION)
 CURIOS_HTTPD_LICENSE = GPL
@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  95b3625587738cb0a8cc6e9eb41d10a0b2f77ae99dbb1d9b213148d35268eb75  curios-nftables-oci-arm64-v24.11.0.tar.gz
-sha256  4f61ccef90721b8f95a5c7b77b69ccccb5dbd215b9c38986d20e5b245244e902  curios-nftables-oci-amd64-v24.11.0.tar.gz
+sha256  94c7173fe4b8e64dcb1e0f67b974c23753ccce73bc07212a87e35f41a41ae5b8  curios-nftables-oci-arm64-v25.06.0.tar.gz
+sha256  feceb82327cccb4433db63e469f6ed115c10c0266242f0171b85ae1a88472757  curios-nftables-oci-amd64-v25.06.0.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CURIOS_NFTABLES_VERSION = v24.11.0
+CURIOS_NFTABLES_VERSION = v25.06.0
 CURIOS_NFTABLES_SOURCE = curios-nftables-oci-$(GO_GOARCH)-$(CURIOS_NFTABLES_VERSION).tar.gz
 CURIOS_NFTABLES_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_NFTABLES_VERSION)
 CURIOS_NFTABLES_LICENSE = GPL
@@ -0,0 +1,20 @@
+config BR2_PACKAGE_FEATURE_WIFI
+	bool "Feature Wi-Fi"
+	select BR2_PACKAGE_WPA_SUPPLICANT
+	select BR2_PACKAGE_WPA_SUPPLICANT_WPA3
+	select BR2_PACKAGE_WPA_SUPPLICANT_DEBUG_SYSLOG
+	select BR2_PACKAGE_WPA_SUPPLICANT_AUTOSCAN
+	select BR2_PACKAGE_WPA_SUPPLICANT_CLI
+	select BR2_PACKAGE_WIRELESS_REGDB
+	select BR2_PACKAGE_IW
+	help
+	  Enables WiFi in Infix. Enables all requried applications.
+
+config BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK
+       bool "Realtek USB WiFi Dongles"
+       depends on BR2_PACKAGE_FEATURE_WIFI
+       select BR2_PACKAGE_LINUX_FIRMWARE
+       select BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88
+       select BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW89
+       help
+         Enables Support for RTW88 and RTW89 USB dongles.
@@ -0,0 +1,42 @@
+################################################################################
+#
+# Wi-Fi support
+#
+################################################################################
+
+FEATURE_WIFI_PACKAGE_VERSION = 1.0
+FEATURE_WIFI_PACKAGE_LICENSE = MIT
+
+define FEATURE_WIFI_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_WLAN)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RFKILL)
+	$(call KCONFIG_SET_OPT,CONFIG_MAC80211,m)
+	$(call KCONFIG_SET_OPT,CONFIG_CFG80211,m)
+
+	$(if $(filter y,$(BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK)),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_WLAN_VENDOR_REALTEK)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW89)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8703B)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723CS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723D)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723X)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821C)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822B)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822C)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822CU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822CE)
+	)
+endef
+
+
+$(eval $(generic-package))
@@ -28,7 +28,6 @@ KLISH_PLUGIN_INFIX_CONF_OPTS += --enable-shell
 else
 KLISH_PLUGIN_INFIX_CONF_OPTS += --disable-shell
 endif
-
 ifeq ($(BR2_PACKAGE_BASH),y)
 KLISH_PLUGIN_INFIX_CONF_OPTS += --with-shell=/bin/bash
 else
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  79c9b16b227320fea358114738933ea25be33f8f263d3eec1f83fb603c0c0b22  klish-019ebd2704e322b5d500f5687d526431e535eec8-git4.tar.gz
+sha256  eff4cc740c6cfe2c03f7aeee2092f16616575d1462b1ad67d9f476463a6bf3fe  klish-1c5ae4bbb49a0d7e1425ca1afe8518b873ee84cb-git4.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-KLISH_VERSION = 019ebd2704e322b5d500f5687d526431e535eec8
+KLISH_VERSION = 1c5ae4bbb49a0d7e1425ca1afe8518b873ee84cb
 KLISH_SITE = https://github.com/kernelkit/klish.git
 #KLISH_VERSION = tags/3.0.0
 #KLISH_SITE = https://src.libcode.org/pkun/klish.git
@@ -11,6 +11,7 @@ LANDING_LICENSE = ISC
 LANDING_LICENSE_FILES = LICENSE

 define LANDING_INSTALL_TARGET_CMDS
+        mkdir -p $(TARGET_DIR)/usr/html/
 	cp $(@D)/*.html $(TARGET_DIR)/usr/html/
 	cp $(@D)/*.png  $(TARGET_DIR)/usr/html/
 endef
@@ -0,0 +1,27 @@
+diff -urN lowdown-VERSION_1_0_2.orig/configure lowdown-VERSION_1_0_2/configure
+--- lowdown-VERSION_1_0_2.orig/configure	2025-03-21 12:58:06.151106271 +0000
+++ lowdown-VERSION_1_0_2/configure	2025-03-21 13:20:20.649825864 +0000
+@@ -61,12 +61,7 @@
+ 
+ MAKE_FLAGS=""
+ 
+-if [ -n "${MAKELEVEL}" ]; then
+-	if [ "${MAKELEVEL}" -gt 0 ] ; then
+-		MAKE_FLAGS="--no-print-directory"
+-		echo "all:" | make ${MAKE_FLAGS} -sf - 2>/dev/null || MAKE_FLAGS=""
+-	fi
+-fi
+MAKE_FLAGS="--no-print-directory"
+ 
+ if [ -n "$MAKE_FLAGS" ]; then 
+ 	echo "GNU submake detected: using --no-print-directory" 1>&2
+@@ -79,9 +74,6 @@
+ # in.
+ #----------------------------------------------------------------------
+ 
+-AR=`printf "all:\\n\\t@echo \\\$(AR)\\n" | make ${MAKE_FLAGS} -sf -`
+-CC=`printf "all:\\n\\t@echo \\\$(CC)\\n" | make ${MAKE_FLAGS} -sf -`
+-CFLAGS=`printf "all:\\n\\t@echo \\\$(CFLAGS)\\n" | make ${MAKE_FLAGS} -sf -`
+ CFLAGS="${CFLAGS} -g -W -Wall -Wextra -Wmissing-prototypes -Wstrict-prototypes"
+ CFLAGS="${CFLAGS} -Wwrite-strings -Wno-unused-parameter"
+ LDLIBS=
@@ -9,7 +9,7 @@ NGHTTP2_ASIO_SITE = https://github.com/kernelkit/nghttp2-asio.git
 NGHTTP2_ASIO_SITE_METHOD = git
 NGHTTP2_ASIO_LICENSE = MIT
 NGHTTP2_ASIO_LICENSE_FILES = COPYING
-NGHTTP2_ASIO_DEPENDENCIES = boost nghttp2
+NGHTTP2_ASIO_DEPENDENCIES = boost nghttp2 openssl
 NGHTTP2_ASIO_INSTALL_STAGING = YES
 NGHTTP2_ASIO_AUTOGEN = YES
 NGHTTP2_ASIO_AUTORECONF = YES
@@ -10,8 +10,8 @@ PYTHON_LIBYANG_SITE = https://files.pythonhosted.org/packages/91/2e/ff13ee16c874
 PYTHON_LIBYANG_SETUP_TYPE = setuptools
 PYTHON_LIBYANG_LICENSE = MIT
 PYTHON_LIBYANG_LICENSE_FILES = LICENSE
-PYTHON_LIBYANG_DEPENDENCIES = python-cython python-cffi
-HOST_PYTHON_LIBYANG_DEPENDENCIES = host-python-cython host-python-cffi
+PYTHON_LIBYANG_DEPENDENCIES = python-cython python-cffi libyang
+HOST_PYTHON_LIBYANG_DEPENDENCIES = host-python-cython host-python-cffi host-libyang

 $(eval $(python-package))
 $(eval $(host-python-package))
@@ -1,5 +1,5 @@
 # From https://github.com/troglobit/tetris/releases/
-sha256 2c6e17f927d4b73dca97c7d280d3848a515a87ca70ecdf072808561e47bf757c  tetris-1.4.0.tar.gz
+sha256 c19b3e5eea43891d55481de5530f5824131974a85fc2a18b8a977bcebcba8223  tetris-1.5.0.tar.gz

 # Locally calculated
 sha256 a84e2b5247b2013a69496eecdd16e6051c04f1f3cb259b5f6ca8e671101a1f94  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-TETRIS_VERSION = 1.4.0
+TETRIS_VERSION = 1.5.0
 TETRIS_SITE = https://github.com/troglobit/tetris/releases/download/$(TETRIS_VERSION)
 TETRIS_LICENSE = ISC
 TETRIS_LICENSE_FILES = LICENSE
@@ -1,4 +1,4 @@
-From dfd52e38ab402822aa4011039efa00e9d183d6a6 Mon Sep 17 00:00:00 2001
+From 392735fcb41b303b6dbe3517fab9ba734ff2e288 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 09:41:46 +0100
 Subject: [PATCH 1/2] iplink_bridge: add mcast_flood_always bridge option
@@ -17,7 +17,7 @@ Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 3 files changed, 32 insertions(+)

 diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
-index c206cf6d..84ef4233 100644
+index c206cf6..84ef423 100644
 --- a/include/uapi/linux/if_bridge.h
 +++ b/include/uapi/linux/if_bridge.h
@@ -830,6 +830,7 @@ enum br_boolopt_id {
@@ -29,7 +29,7 @@ index c206cf6d..84ef4233 100644
 };
 
 diff --git a/ip/iplink_bridge.c b/ip/iplink_bridge.c
-index f01ffe15..2a489b7b 100644
+index 1fe8955..d4f2c80 100644
 --- a/ip/iplink_bridge.c
 +++ b/ip/iplink_bridge.c
@@ -41,6 +41,7 @@ static void print_explain(FILE *f)
@@ -80,10 +80,10 @@ index f01ffe15..2a489b7b 100644
 
 	if (tb[IFLA_BR_MCAST_ROUTER])
 diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
-index eabca490..ba0a5304 100644
+index efb6248..2308835 100644
 --- a/man/man8/ip-link.8.in
 +++ b/man/man8/ip-link.8.in
-@@ -1703,6 +1703,8 @@ the following additional arguments are supported:
+@@ -1712,6 +1712,8 @@ the following additional arguments are supported:
 ] [
 .BI vlan_stats_per_port " VLAN_STATS_PER_PORT "
 ] [
@@ -92,7 +92,7 @@ index eabca490..ba0a5304 100644
 .BI mcast_snooping " MULTICAST_SNOOPING "
 ] [
 .BI mcast_vlan_snooping " MULTICAST_VLAN_SNOOPING "
-@@ -1851,6 +1853,16 @@ or disable
+@@ -1860,6 +1862,16 @@ or disable
 .RI ( VLAN_STATS_PER_PORT " == 0) "
 per-VLAN per-port stats accounting. Can be changed only when there are no port VLANs configured.
 
@@ -1,4 +1,4 @@
-From 0c35a5314291a78047df920779fc55412e96c135 Mon Sep 17 00:00:00 2001
+From 072c2f0732bc1a55aaeb9b5319a71bb472e2fd7d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 01/27] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
@@ -1,4 +1,4 @@
-From a4d558c209f19f4d1e18f7e0ed8996102b7f875d Mon Sep 17 00:00:00 2001
+From 7b18b787450759f1c2507c7b65c81c3686040c90 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 02/27] net: dsa: mv88e6xxx: Improve indirect register access
@@ -1,4 +1,4 @@
-From 57b19d8263f232d6b3d418fd7a4a71d1f00567bd Mon Sep 17 00:00:00 2001
+From 379dd2a00dc647b034befead65b26e467e63ae75 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 03/27] net: dsa: mv88e6xxx: Honor ports being managed via
@@ -1,4 +1,4 @@
-From 8c83473996a0830e9d3f74792694de575d1ad6f4 Mon Sep 17 00:00:00 2001
+From fd676f49b5aa5a1d372446be9ee01d1f126bcd54 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 04/27] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
@@ -1,4 +1,4 @@
-From ec095ae1520437c6ba73c354c63f11114b69ee5e Mon Sep 17 00:00:00 2001
+From 2aeb87ab82b7b9fb37e6b1c830dec5374158aa5d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 19:44:32 +0100
 Subject: [PATCH 05/27] net: dsa: mv88e6xxx: Add LED infrastructure
@@ -1,4 +1,4 @@
-From 4c49605ae3cced0e0358a1b485ceb49c40e43de8 Mon Sep 17 00:00:00 2001
+From 3de6f58239d6b09c3fe1e0978a556481be8f3a95 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 21:59:35 +0100
 Subject: [PATCH 06/27] net: dsa: mv88e6xxx: Add LED support for 6393X
@@ -1,4 +1,4 @@
-From c4eb35a6767bd6652c8c947da1f069cba2c6ed16 Mon Sep 17 00:00:00 2001
+From f28803088158ddf97186f143f4bdc516e42e9354 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 07/27] net: dsa: tag_dsa: Use tag priority as initial
@@ -1,4 +1,4 @@
-From 7be2376fd4e698d5b123c36d67c45119b6c4860f Mon Sep 17 00:00:00 2001
+From bbbf265610459ec49afcde923d1872ca3e2ad679 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 08/27] net: dsa: Support MDB memberships whose L2 addresses
@@ -1,4 +1,4 @@
-From 69b036e535b1ee6f62ee965d6ffbd559be954a3e Mon Sep 17 00:00:00 2001
+From 797ed124853b8f0ef6d110e1633be2637c97c31d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 09/27] net: dsa: Support EtherType based priority overrides
@@ -1,4 +1,4 @@
-From 6935453500d2083106b9809487d5a6e97fdd39e7 Mon Sep 17 00:00:00 2001
+From ea2d865a2101317e22c60143e891d643feac8e8c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 10/27] net: dsa: mv88e6xxx: Support EtherType based priority
@@ -1,4 +1,4 @@
-From e1068697ab45bbf67412c0a1aa07769c2a077efc Mon Sep 17 00:00:00 2001
+From a239baf492b7c4a1280562bb9478006627b73036 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 11/27] net: dsa: mv88e6xxx: Add mqprio qdisc support
@@ -1,4 +1,4 @@
-From 47de3a790395796d7717bfc81b3c6bc6ffb683b5 Mon Sep 17 00:00:00 2001
+From 60ac4461cef9b2024df52c23a040b100093ba1d7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 12/27] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
@@ -1,4 +1,4 @@
-From 75fa8486867714f1c12fd3d9bf40b8201adecdae Mon Sep 17 00:00:00 2001
+From d3b20e07514928830034d4af2eb7660bfcacc1e0 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 13/27] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
@@ -1,4 +1,4 @@
-From a0639986c74ca3cd4e57f2f5d50639c83c595115 Mon Sep 17 00:00:00 2001
+From b4870c7df5d6659da439e8f1322dd5496a15445e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 14/27] net: phy: marvell10g: Support firmware loading on
@@ -1,4 +1,4 @@
-From 968b1126891d9e18da8f82fa54d43aaebf519bfb Mon Sep 17 00:00:00 2001
+From 6161b59334064ebfc0b80b0214fa12e6d042400e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 15/27] net: phy: marvell10g: Fix power-up when strapped to
@@ -1,4 +1,4 @@
-From 44175ca9f0b20e7ad959054c51d6c685cb9f9586 Mon Sep 17 00:00:00 2001
+From 403075caa172cf8e5c50346a86698b0a909a9263 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 16/27] net: phy: marvell10g: Add LED support for 88X3310
@@ -1,4 +1,4 @@
-From aa25b267d951e8052f4bc314e48ea427f2429891 Mon Sep 17 00:00:00 2001
+From 84ca381445809f1d796c461a5b085ff4a3b7f93e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 17/27] net: phy: marvell10g: Support LEDs tied to a single
@@ -1,4 +1,4 @@
-From e551a59c1848d1e1731fc80727a0d145f22787b0 Mon Sep 17 00:00:00 2001
+From 47eddfb80fd6bbbc186b0d8a93697c36840168e8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 18/27] net: phy: Do not resume PHY when attaching
@@ -20,7 +20,7 @@ administratively down.
 1 file changed, 1 deletion(-)

 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 8af44224480f..a2e386e9fafc 100644
+index 13dea33d86ff..25d0face304a 100644
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
@@ -1661,7 +1661,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
@@ -1,4 +1,4 @@
-From f7974affbd2493316b47be12e1b375f531ccbeb1 Mon Sep 17 00:00:00 2001
+From 761e5315fc2bac3809258e9719efd1475a73ac14 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 19/27] net: bridge: avoid classifying unknown multicast as
@@ -153,10 +153,10 @@ index ceaa5a89b947..e54d648db7de 100644
 			br_multicast_flood(mdst, skb, brmctx, local_rcv, false);
 	}
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index b2ae0d2434d2..3137c1fcfc6a 100644
+index 733ff6b758f6..b1799e03403f 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
-@@ -3774,6 +3774,11 @@ static void br_multicast_err_count(const struct net_bridge *br,
+@@ -3835,6 +3835,11 @@ static void br_multicast_err_count(const struct net_bridge *br,
 	u64_stats_update_end(&pstats->syncp);
 }
 
@@ -168,7 +168,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 static void br_multicast_pim(struct net_bridge_mcast *brmctx,
 			     struct net_bridge_mcast_port *pmctx,
 			     const struct sk_buff *skb)
-@@ -3820,7 +3825,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
+@@ -3881,7 +3886,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
 
 	if (err == -ENOMSG) {
 		if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
@@ -178,7 +178,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 		} else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
 			if (ip_hdr(skb)->protocol == IPPROTO_PIM)
 				br_multicast_pim(brmctx, pmctx, skb);
-@@ -3889,7 +3895,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
+@@ -3950,7 +3956,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
 
 	if (err == -ENOMSG || err == -ENODATA) {
 		if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
@@ -189,7 +189,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 		    ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
 			br_ip6_multicast_mrd_rcv(brmctx, pmctx, skb);
 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index 041f6e571a20..40651b07df94 100644
+index 6a1bce8959af..ed5325c6add9 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
@@ -483,6 +483,7 @@ enum net_bridge_opts {
@@ -200,7 +200,7 @@ index 041f6e571a20..40651b07df94 100644
 };
 
 struct net_bridge {
-@@ -886,8 +887,8 @@ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb,
+@@ -887,8 +888,8 @@ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb,
 		bool local_rcv, bool local_orig);
 int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
 void br_flood(struct net_bridge *br, struct sk_buff *skb,
@@ -211,7 +211,7 @@ index 041f6e571a20..40651b07df94 100644
 
 /* return true if both source port and dest port are isolated */
 static inline bool br_skb_isolated(const struct net_bridge_port *to,
-@@ -1408,6 +1409,19 @@ static inline void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
+@@ -1410,6 +1411,19 @@ static inline void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
 {
 }
 
@@ -1,4 +1,4 @@
-From 95d58304a71fd93d6096db629abce24bf84ea510 Mon Sep 17 00:00:00 2001
+From 41c6eeb5c4042027eac70243dd28bcaf963ac6b8 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 20/27] net: bridge: Ignore router ports when forwarding L2
@@ -17,10 +17,10 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 1 file changed, 4 insertions(+), 1 deletion(-)

 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index 40651b07df94..e90b4f5cab76 100644
+index ed5325c6add9..0afb886b9a30 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
-@@ -1086,7 +1086,10 @@ br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
+@@ -1088,7 +1088,10 @@ br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
 	if (skb->protocol == htons(ETH_P_IPV6))
 		return rcu_dereference(hlist_first_rcu(&brmctx->ip6_mc_router_list));
 #endif
@@ -1,4 +1,4 @@
-From 044c9d6d96738f24849180f06d0a3d19861fbb73 Mon Sep 17 00:00:00 2001
+From f831362d0a5717cbb18a9173defca6ec4d886377 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 21/27] net: bridge: drop delay for applying strict multicast
@@ -25,7 +25,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2 files changed, 8 insertions(+), 38 deletions(-)

 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 3137c1fcfc6a..34be07a1fd00 100644
+index b1799e03403f..282105bdca85 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
@@ -1762,10 +1762,6 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t)
@@ -39,7 +39,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx,
 					    struct br_ip *ip,
 					    struct sk_buff *skb)
-@@ -3196,12 +3192,8 @@ int br_multicast_dump_querier_state(struct sk_buff *skb,
+@@ -3257,12 +3253,8 @@ int br_multicast_dump_querier_state(struct sk_buff *skb,
 
 static void
 br_multicast_update_query_timer(struct net_bridge_mcast *brmctx,
@@ -53,7 +53,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval);
 }
 
-@@ -3392,13 +3384,12 @@ static void
+@@ -3453,13 +3445,12 @@ static void
 br_ip4_multicast_query_received(struct net_bridge_mcast *brmctx,
 				struct net_bridge_mcast_port *pmctx,
 				struct bridge_mcast_other_query *query,
@@ -69,7 +69,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	br_ip4_multicast_mark_router(brmctx, pmctx);
 }
 
-@@ -3407,13 +3398,12 @@ static void
+@@ -3468,13 +3459,12 @@ static void
 br_ip6_multicast_query_received(struct net_bridge_mcast *brmctx,
 				struct net_bridge_mcast_port *pmctx,
 				struct bridge_mcast_other_query *query,
@@ -85,7 +85,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	br_ip6_multicast_mark_router(brmctx, pmctx);
 }
 #endif
-@@ -3467,7 +3457,7 @@ static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
+@@ -3528,7 +3518,7 @@ static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
 
 		br_ip4_multicast_query_received(brmctx, pmctx,
 						&brmctx->ip4_other_query,
@@ -94,7 +94,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 		goto out;
 	}
 
-@@ -3555,7 +3545,7 @@ static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
+@@ -3616,7 +3606,7 @@ static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
 
 		br_ip6_multicast_query_received(brmctx, pmctx,
 						&brmctx->ip6_other_query,
@@ -103,7 +103,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 		goto out;
 	} else if (!group) {
 		goto out;
-@@ -4063,8 +4053,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
+@@ -4124,8 +4114,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
 		    br_ip4_multicast_local_router_expired, 0);
 	timer_setup(&brmctx->ip4_other_query.timer,
 		    br_ip4_multicast_querier_expired, 0);
@@ -112,7 +112,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	timer_setup(&brmctx->ip4_own_query.timer,
 		    br_ip4_multicast_query_expired, 0);
 #if IS_ENABLED(CONFIG_IPV6)
-@@ -4072,8 +4060,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
+@@ -4133,8 +4121,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
 		    br_ip6_multicast_local_router_expired, 0);
 	timer_setup(&brmctx->ip6_other_query.timer,
 		    br_ip6_multicast_querier_expired, 0);
@@ -121,7 +121,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	timer_setup(&brmctx->ip6_own_query.timer,
 		    br_ip6_multicast_query_expired, 0);
 #endif
-@@ -4208,12 +4194,10 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
+@@ -4269,12 +4255,10 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
 {
 	del_timer_sync(&brmctx->ip4_mc_router_timer);
 	del_timer_sync(&brmctx->ip4_other_query.timer);
@@ -134,7 +134,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	del_timer_sync(&brmctx->ip6_own_query.timer);
 #endif
 }
-@@ -4641,8 +4625,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
+@@ -4728,8 +4712,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
 
 int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
 {
@@ -143,7 +143,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	val = !!val;
 
 	spin_lock_bh(&brmctx->br->multicast_lock);
-@@ -4653,19 +4635,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
+@@ -4740,19 +4722,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
 	if (!val)
 		goto unlock;
 
@@ -164,7 +164,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 #endif
 
 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index e90b4f5cab76..73b78c594564 100644
+index 0afb886b9a30..5b5b2c2442a5 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
@@ -78,7 +78,6 @@ struct bridge_mcast_own_query {
@@ -175,7 +175,7 @@ index e90b4f5cab76..73b78c594564 100644
 };
 
 /* selected querier */
-@@ -1164,8 +1163,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
+@@ -1166,8 +1165,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
 		own_querier_enabled = false;
 	}
 
@@ -1,4 +1,4 @@
-From f3f893da3380e7faf14b068c4490236d7102e52f Mon Sep 17 00:00:00 2001
+From 1e0eb62180058e98c7d18e3e04540925801e34b5 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 22/27] net: bridge: Differentiate MDB additions from
@@ -41,7 +41,7 @@ index db7254d52d93..63508279df47 100644
 	RTM_NEWNSID = 88,
 #define RTM_NEWNSID RTM_NEWNSID
 diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
-index 1a52a0bca086..d5757ab72d2f 100644
+index 7e1ad229e133..3b1873e7c499 100644
 --- a/net/bridge/br_mdb.c
 +++ b/net/bridge/br_mdb.c
@@ -734,7 +734,7 @@ static int br_mdb_replace_group_sg(const struct br_mdb_config *cfg,
@@ -63,7 +63,7 @@ index 1a52a0bca086..d5757ab72d2f 100644
 	if (br_multicast_should_handle_mode(brmctx, cfg->group.proto))
 		br_multicast_star_g_handle_mode(pg, cfg->filter_mode);
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 34be07a1fd00..9c8bf38e0079 100644
+index 282105bdca85..aa97b07ed528 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
@@ -619,7 +619,7 @@ static void br_multicast_fwd_src_handle(struct net_bridge_group_src *src)
@@ -84,7 +84,7 @@ index 34be07a1fd00..9c8bf38e0079 100644
 	}
 out:
 	spin_unlock(&br->multicast_lock);
-@@ -2887,7 +2887,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge_mcast *brmctx,
+@@ -2948,7 +2948,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge_mcast *brmctx,
 			break;
 		}
 		if (changed)
@@ -93,7 +93,7 @@ index 34be07a1fd00..9c8bf38e0079 100644
 unlock_continue:
 		spin_unlock(&brmctx->br->multicast_lock);
 	}
-@@ -3029,7 +3029,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge_mcast *brmctx,
+@@ -3090,7 +3090,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge_mcast *brmctx,
 			break;
 		}
 		if (changed)
@@ -1,4 +1,4 @@
-From fd9bccb249ef2768b567a5ae658f1d5f2083888e Mon Sep 17 00:00:00 2001
+From 86a738ca46e019a8913d100138d8972681a65b4b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 23/27] nvmem: layouts: onie-tlv: Let device probe even when
@@ -1,4 +1,4 @@
-From b9729c330f866285cb96131d0aa28f3f70f2629b Mon Sep 17 00:00:00 2001
+From df19ceb2579bd87d58f2caab739d8ba678785f5c Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 29 Apr 2024 15:14:51 +0200
 Subject: [PATCH 24/27] usb: core: adjust log level for unauthorized devices
@@ -1,4 +1,4 @@
-From 7ba5eea475b969ec5c1827a76b7dc714b551f6ad Mon Sep 17 00:00:00 2001
+From eea7cb00b2e657445de9913736ff38b99ed0f9a5 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 16 Jan 2025 12:35:12 +0100
 Subject: [PATCH 25/27] net: dsa: mv88e6xxx: collapse disabled state into
@@ -1,4 +1,4 @@
-From a661d6d7d362ded9ec2730fcb3b8fb508841ea84 Mon Sep 17 00:00:00 2001
+From 0e24579e619a9d3ebb03293822092e03d16d6ad2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 12 Feb 2025 22:03:14 +0100
 Subject: [PATCH 26/27] net: dsa: mv88e6xxx: Only activate LAG offloading when
@@ -1,4 +1,4 @@
-From 47be565408de02e2ab973d0b05bf88826d2e3510 Mon Sep 17 00:00:00 2001
+From 73b60d31a3318344428842c7368b2f1eb0c05596 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 27/27] net: usb: r8152: add r8153b support for link/activity
@@ -19,7 +19,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 1 file changed, 8 insertions(+)

 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index 96fa3857d8e2..cddb025aa56b 100644
+index 2cab046749a9..c9947ad320ff 100644
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
@@ -41,6 +41,11 @@
@@ -1,2 +1,2 @@
 # Calculated with ../utils/kernel-refresh.sh
-sha256   402de222c7425893c38102ddd53d2b602c74c2eabcf6631bb0791089c05e3bca  linux-6.12.26.tar.xz
+sha256   05f4e0b01dde578c3328eb539d305cccec7b84e939f6dd5f21fdaf5f313da748  linux-6.12.35.tar.xz
@@ -0,0 +1,232 @@
+From 9df1957e656940a50b844da879911ab5981ad1a9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= <lazzer@gmail.com>
+Date: Wed, 18 Jun 2025 21:21:18 +0200
+Subject: [PATCH] Add pidfile support when not daemonize
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Organization: Wires
+
+Adds pidfile.c from libite
+
+Signed-off-by: Mattias Walström <lazzer@gmail.com>
+---
+ wpa_supplicant/Makefile         |   1 +
+ wpa_supplicant/pidfile.c        | 153 ++++++++++++++++++++++++++++++++
+ wpa_supplicant/wpa_supplicant.c |   7 +-
+ 3 files changed, 160 insertions(+), 1 deletion(-)
+ create mode 100644 wpa_supplicant/pidfile.c
+
+diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
+index fd7d7a0bd..e14c7732a 100644
+--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
+@@ -104,6 +104,7 @@ endif
+ OBJS = config.o
+ OBJS += notify.o
+ OBJS += bss.o
+OBJS += pidfile.o
+ OBJS += eap_register.o
+ OBJS += ../src/utils/common.o
+ OBJS += ../src/utils/config.o
+diff --git a/wpa_supplicant/pidfile.c b/wpa_supplicant/pidfile.c
+new file mode 100644
+index 000000000..29dfbe242
+--- /dev/null
+++ b/wpa_supplicant/pidfile.c
+@@ -0,0 +1,153 @@
+/*	Updated by troglobit for libite/finit/uftpd projects 2016/07/04 */
+/*	$OpenBSD: pidfile.c,v 1.11 2015/06/03 02:24:36 millert Exp $	*/
+/*	$NetBSD: pidfile.c,v 1.4 2001/02/19 22:43:42 cgd Exp $	*/
+
+/*-
+ * Copyright (c) 1999 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Jason R. Thorpe.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file pidfile.c
+ * @author NetBSD Foundation Inc.
+ * @date 1999
+ * @copyright 2-clause BSD License
+ */
+
+#include <sys/stat.h>		/* utimensat() */
+#include <sys/time.h>		/* utimensat() on *BSD */
+#include <sys/types.h>
+#include <errno.h>
+#include <paths.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifndef pidfile
+static char *pidfile_path = NULL;
+static pid_t pidfile_pid  = 0;
+
+static void pidfile_cleanup(void);
+
+const  char *__pidfile_path = _PATH_VARRUN; /* Note: includes trailing slash '/' */
+const  char *__pidfile_name = NULL;
+extern char *__progname;
+
+/**
+ * Create or update mtime of process PID file.
+ * @param basename  Program name, or @c NULL, may start with '/'
+ *
+ * This function is intended to be used by UNIX daemons to save the PID of the main process
+ * responsible for handling signals.  If @p basename is @c NULL the implicit @a __progname
+ * variable from the C-library is used.  The @p basename may also start with '/', in which
+ * case it is interpreted as the absolute path to the PID file.
+ *
+ * @returns POSIX OK(0) on success, otherwise non-zero on error.
+ */
+int pidfile(const char *basename)
+{
+	int save_errno;
+	int atexit_already;
+	pid_t pid;
+	FILE *f;
+
+	if (basename == NULL)
+		basename = __progname;
+
+	pid = getpid();
+	atexit_already = 0;
+
+	if (pidfile_path != NULL) {
+		if (!access(pidfile_path, R_OK) && pid == pidfile_pid) {
+			utimensat(0, pidfile_path, NULL, 0);
+			return (0);
+		}
+		free(pidfile_path);
+		pidfile_path = NULL;
+		__pidfile_name = NULL;
+		atexit_already = 1;
+	}
+
+	if (basename[0] != '/') {
+		if (asprintf(&pidfile_path, "%s.pid", basename) == -1)
+			return (-1);
+	} else {
+		if (asprintf(&pidfile_path, "%s", basename) == -1)
+			return (-1);
+	}
+
+	if ((f = fopen(pidfile_path, "w")) == NULL) {
+		save_errno = errno;
+		free(pidfile_path);
+		pidfile_path = NULL;
+		errno = save_errno;
+		return (-1);
+	}
+
+	if (fprintf(f, "%ld\n", (long)pid) <= 0 || fflush(f) != 0) {
+		save_errno = errno;
+		(void) fclose(f);
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+		errno = save_errno;
+		return (-1);
+	}
+	(void) fclose(f);
+	__pidfile_name = pidfile_path;
+
+	/*
+	 * LITE extension, no need to set up another atexit() handler
+	 * if user only called us to update the mtime of the PID file
+	 */
+	if (atexit_already)
+		return (0);
+
+	pidfile_pid = pid;
+	if (atexit(pidfile_cleanup) < 0) {
+		save_errno = errno;
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+		pidfile_pid = 0;
+		errno = save_errno;
+		return (-1);
+	}
+
+	return (0);
+}
+
+static void
+pidfile_cleanup(void)
+{
+	if (pidfile_path != NULL && pidfile_pid == getpid()) {
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+	}
+}
+#endif
+diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
+index dfbd63163..3a762ebc2 100644
+--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
+@@ -123,6 +123,7 @@ const char *const wpa_supplicant_full_license5 =
+ "\n";
+ #endif /* CONFIG_NO_STDOUT_DEBUG */
+ 
+int pidfile(const char *basename);
+ 
+ static void wpa_bss_tmp_disallow_timeout(void *eloop_ctx, void *timeout_ctx);
+ static void wpas_verify_ssid_beacon(void *eloop_ctx, void *timeout_ctx);
+@@ -1490,6 +1491,9 @@ static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
+ 		/* Ignore errors since we cannot really do much to fix this */
+ 		wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
+ 	}
+
+	if (!global->params.daemonize)
+		pidfile(global->params.pid_file);
+ }
+ 
+ 
+@@ -8555,7 +8559,6 @@ struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
+ 	return global;
+ }
+ 
+-
+ /**
+  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
+  * @global: Pointer to global data from wpa_supplicant_init()
+@@ -8589,6 +8592,8 @@ int wpa_supplicant_run(struct wpa_global *global)
+ 	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
+ 	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
+ 
+	if (!global->params.daemonize)
+		pidfile(global->params.pid_file);
+ 	eloop_run();
+ 
+ 	return 0;
+-- 
+2.43.0
+
@@ -1,6 +1,109 @@
 #include <arm64/freescale/imx8mp-evk.dts>
+#include <dt-bindings/usb/pd.h>
+&usb3_phy0 {
+
+	status = "okay";
+};
+&iomuxc {
+	pinctrl_typec_mux: typec1muxgrp {
+		fsl,pins = <
+		MX8MP_IOMUXC_SAI1_MCLK__GPIO4_IO20	0x16
+		>;
+	};
+	pinctrl_typec: typec1grp {
+		fsl,pins = <
+			MX8MP_IOMUXC_SAI1_TXD7__GPIO4_IO19	0x1c4
+		>;
+	};
+};
+
+&i2c2 {
+	ptn5110: tcpc@50 {
+		compatible = "nxp,ptn5110";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinctrl_typec>;
+		reg = <0x50>;
+		interrupt-parent = <&gpio4>;
+		interrupts = <19 8>;
+
+		port {
+			typec_dr_sw: endpoint {
+				remote-endpoint = <&usb3_drd_sw>;
+			};
+		};
+
+		usb_con: connector {
+			compatible = "usb-c-connector";
+			label = "USB-C";
+			power-role = "dual";
+			data-role = "dual";
+			try-power-role = "sink";
+			source-pdos = <PDO_FIXED(5000, 3000, PDO_FIXED_USB_COMM)>;
+			sink-pdos = <PDO_FIXED(5000, 3000, PDO_FIXED_USB_COMM)
+			PDO_VAR(5000, 20000, 3000)>;
+			op-sink-microwatt = <15000000>;
+			self-powered;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@1 {
+					reg = <1>;
+					typec_con_ss: endpoint {
+						remote-endpoint = <&usb3_data_ss>;
+					};
+				};
+			};
+		};
+	};
+};
+&usb3_phy0 {
+	fsl,phy-tx-vref-tune = <0xe>;
+	fsl,phy-tx-preemp-amp-tune = <3>;
+	fsl,phy-tx-vboost-level = <5>;
+	fsl,phy-comp-dis-tune = <7>;
+	fsl,pcs-tx-deemph-3p5db = <0x21>;
+	fsl,phy-pcs-tx-swing-full = <0x7f>;
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&usb_dwc3_0 {
+	dr_mode = "otg";
+	hnp-disable;
+	srp-disable;
+	adp-disable;
+	usb-role-switch;
+	role-switch-default-mode = "none";
+	snps,dis-u1-entry-quirk;
+	snps,dis-u2-entry-quirk;
+	status = "okay";
+
+	port {
+		usb3_drd_sw: endpoint {
+			remote-endpoint = <&typec_dr_sw>;
+		};
+	};
+};

 / {
+	gpio-sbu-mux {
+		compatible = "gpio-sbu-mux";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinctrl_typec_mux>;
+		switch-gpios = <&gpio4 20 GPIO_ACTIVE_LOW>;
+		orientation-switch;
+
+		port {
+			usb3_data_ss: endpoint {
+				remote-endpoint = <&typec_con_ss>;
+			};
+		};
+	};
        chosen {
                infix {
                        /* "admin" */
@@ -1,4 +1,4 @@
 pkglibexec_SCRIPTS = bootstrap error load gen-service gen-hostname \
 		     gen-interfaces gen-motd gen-hardware gen-version \
-		     mstpd-wait-online
+		     mstpd-wait-online wait-interface
 sbin_SCRIPTS       = dagger migrate
@@ -0,0 +1,21 @@
+#!/bin/sh
+if [ $# -lt 2 ]; then
+	echo "usage: $0 <ifname> <timeout>"
+	exit 1
+fi
+
+ifname=$1
+timeout=$2
+while true; do
+    if ip link show $ifname &>/dev/null; then
+        break
+    fi
+
+    retries=$(($retries + 1))
+    if [ $retries -ge $timeout ]; then
+        logger -t wait-interface "Timeout: Interface $ifname not found after $timeout seconds"
+        exit 1
+    fi
+
+    sleep 1
+done
@@ -41,6 +41,10 @@ AC_ARG_ENABLE(containers,
        AS_HELP_STRING([--enable-containers], [Enable support for containers]),,[
 	enable_containers=no])

+AC_ARG_ENABLE(wifi,
+        AS_HELP_STRING([--enable-wifi], [Enable support for Wi-Fi]),,[
+	enable_wifi=no])
+
 AC_ARG_WITH(login-shell,
        AS_HELP_STRING([--with-login-shell=shell], [Login shell for new users, default: /bin/false]),
 	[login_shell=$withval], [login_shell=yes])
@@ -52,6 +56,9 @@ AC_ARG_WITH(crypt,
 AS_IF([test "x$enable_containers" = "xyes"], [
        AC_DEFINE(CONTAINERS, 1, [Built with container support])])

+AS_IF([test "x$enable_wifi" = "xyes"], [
+        AC_DEFINE(HAVE_WIFI, 1, [Built with Wi-Fi support])])
+
 AS_IF([test "x$with_login_shell" != "xno"], [
 	AS_IF([test "x$login_shell" = "xyes"], [login_shell=/bin/false])
 	AC_DEFINE_UNQUOTED(LOGIN_SHELL, "$login_shell", [Default: /bin/false])],[
@@ -122,6 +129,7 @@ cat <<EOF

 Optional features:
  Container support ....: $enable_containers
+  Wi-Fi support ........: $enable_wifi
  Login shell ..........: $login_shell
  Default crypt algo ...: $crypt

@@ -37,6 +37,7 @@ confd_plugin_la_SOURCES =			\
 	  infix-if-vlan.c			\
 	  infix-if-gre.c			\
 	  infix-if-vxlan.c			\
+	  infix-if-wifi.c			\
 	ietf-keystore.c				\
 	ietf-system.c				\
 	ietf-syslog.c				\
@@ -12,6 +12,7 @@
 #include <sys/time.h>
 #include <sys/param.h>
 #include <unistd.h>
+#include <stdbool.h>

 #include <libite/lite.h>
 #include <libite/queue.h>
@@ -137,9 +138,20 @@ static inline int register_change(sr_session_ctx_t *session, const char *module,
 	int flags, sr_module_change_cb cb, void *arg, sr_subscription_ctx_t **sub)
 {
 	struct confd *ptr = (struct confd *)arg;
+	bool need_core_hooks;
 	int rc;

-	if (!flags) {
+	/*
+	 * For standard subscribtions we hook into the callback chain
+	 * for all modules to figure out, per changeset, which of the
+	 * callbacks is the last one.  This is where we want to call the
+	 * global commit-done hook for candidate -> running changes and
+	 * the startup-save hook for running -> startup copying.
+	 */
+
+	need_core_hooks = !(flags & SR_SUBSCR_UPDATE);
+
+	if (need_core_hooks) {
 		sr_module_change_subscribe(ptr->session, module, xpath, core_pre_hook, NULL,
 				0, SR_SUBSCR_PASSIVE, sub);
 	}
@@ -151,14 +163,7 @@ static inline int register_change(sr_session_ctx_t *session, const char *module,
 		return rc;
 	}

-	/*
-	 * For standard subscribtions we hook into the callback chain
-	 * for all modules to figure out, per changeset, which of the
-	 * callbacks is the last one.  This is where we want to call the
-	 * global commit-done hook for candidate -> running changes and
-	 * the startup-save hook for running -> startup copying.
-	 */
-	if (!flags) {
+	if (need_core_hooks) {
 		sr_module_change_subscribe(ptr->session, module, xpath, core_post_hook, NULL,
 				core_hook_prio(), SR_SUBSCR_PASSIVE, sub);
 		sr_module_change_subscribe(ptr->startup, module, xpath, core_startup_save, NULL,
@@ -52,6 +52,9 @@ enum netdag_exit {
 };

 enum netdag_init {
+	/* Timeout for slow interfaces */
+	NETDAG_INIT_TIMEOUT = 00,
+
 	/* Configure link layer */
 	NETDAG_INIT_PHYS = 10,

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jon-Olov VatnandGitHub	de113503ea	Merge pull request #1075 from kernelkit/update-changelog-v25.06.0 Update Changelog for Infix v25.06.0	2025-06-30 09:48:30 +02:00
Jon-Olov Vatn	6f203b1c78	Update Changelog for Infix v25.06.0 [skip ci]	2025-06-30 08:40:45 +02:00
Mattias WalströmandGitHub	c31bbbefa9	Merge pull request #1074 from kernelkit/wifi-fixes	2025-06-29 22:24:23 +02:00
Mattias Walström	0d03f874ee	confd: wifi: Fix several bugs in WiFi implemenation * Did not work to reconfigure * Was not possible to run from startup * Othe minor things.	2025-06-29 21:07:10 +02:00
Mattias Walström	51176c7d26	feature: wifi: Allow to set regulation setting (country-code) We was missing the firmware required for this, and for this to work cfg80211 needs to be as module since the rootfs is not loaded when it is loaded if compiled in kernel. And add iw since it very useful for debugging.	2025-06-29 21:06:33 +02:00
Mattias WalströmandGitHub	88958a0b1f	Merge pull request #1073 from kernelkit/upgrade-kernel Bump kernel to 6.12.35 (LTS)	2025-06-27 15:04:49 +02:00
Mattias Walström	e3f87799b6	utils/kernel-refresh.sh: Stage defconfigs Everything else got staged, but not defconfigs	2025-06-27 13:39:31 +02:00
Mattias Walström	ebcb38be37	Bump kernel to 6.12.35 (LTS)	2025-06-27 13:36:41 +02:00
Ahmed KaricandGitHub	889fb3eb79	Merge pull request #1072 from kernelkit/container-remote-exec Verify Host Command Execution from Container	2025-06-26 14:11:28 +02:00
Ahmed Karic	2a6e7e5208	test: Verify host command execution Add test to verify a container on Infix can execute commands on the host by mounting a script to `/etc/rc.local` with proper permissions. The test confirms host hostname change using `nsenter` from inside a privileged container. Resolves #1024	2025-06-26 13:10:43 +02:00
Joachim WibergandGitHub	9629e2eef4	Merge pull request #1071 from kernelkit/mount-mode Add support for setting mode of a container content mount	2025-06-26 12:35:02 +02:00
Joachim Wiberg	a0c48e7b5f	Add support for setting mode of a container content mount Fixes #1070 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-25 19:49:47 +02:00
Ahmed KaricandGitHub	edd2e60dd5	Merge pull request #1059 from kernelkit/speed_duplex Verify auto-negotiated speed/duplex	2025-06-25 10:00:10 +02:00
Ahmed Karic	ec82d68a9f	test: Verify auto-negotiated speed/duplex (copper)	2025-06-25 08:54:33 +02:00
Ahmed Karic	20d5426935	test/docker: Upgrade docker image to include ethtool Add `ethtool` to the Docker test environment to support interface auto-negotiation tests.	2025-06-25 08:01:13 +02:00
Mattias WalströmandGitHub	9d6d0e2388	Merge pull request #1069 from kernelkit/upgrade-buildroot	2025-06-24 19:55:41 +02:00
Joachim WibergandGitHub	6167f2a6a4	Merge pull request #1067 from kernelkit/misc New slogan and updated containers Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 15:11:06 +02:00
Joachim Wiberg	4ad2664b78	doc: update changelog for v25.06 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:54 +02:00
Joachim Wiberg	fe031f1a10	package/klish: fix by-word movement and kill buffer support - Fix by-word movement, detect word barrier using non-alphanum chars - Fix delete word left/right, make sure to save word in kill buffer Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:54 +02:00
Joachim Wiberg	0a3277caf2	package/curious-*: bump to v25.06.0 - Buildroot updated to v25.02.3 - Tefactor of nftables container The nftables container now includes BusyBox, a shell with vi and some basic filesystem tools, as well as nsenter and unshare, suitable for testing and other more advanced tasks. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:53 +02:00
Joachim Wiberg	cac357458c	Rebranding, make slogan more inclusive, Infix is more now ... Fixes #1052 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:53 +02:00
Mattias Walström	7b8bc43bca	Bump buildroot to 2025.02.4 (LTS)	2025-06-24 13:36:36 +02:00
Joachim Wiberg	5c7fc3f570	package/tetris: bump to v1.5.0 ChangeLog https://github.com/troglobit/tetris/releases/tag/1.5.0 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-22 21:12:50 +02:00
Joachim WibergandGitHub	bae70ec85a	Merge pull request #1066 from kernelkit/upgrade-kernel Upgrade Linux kernel to 6.12.34 (LTS) Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-20 09:52:54 +02:00
Mattias Walström	eeb10b0f07	Upgrade Linux kernel to 6.12.34 (LTS)	2025-06-19 21:14:30 +02:00
Mattias WalströmandGitHub	b92c9daedd	Merge pull request #1058 from kernelkit/wifi-support	2025-06-19 18:34:35 +02:00
Mattias Walström	de33df14e2	test: case: ietf_syslog/remote: Fix typo of interface type Has not been triggered before because we ignored operations on fixed interfaces.	2025-06-19 15:23:32 +02:00
Mattias Walström	5eeed0e743	changelog: Update with Wi-Fi client Also add kernel update to correct release.	2025-06-19 15:23:31 +02:00
Mattias Walström	24852caad0	doc: Add Wi-Fi Documention	2025-06-19 15:23:31 +02:00
Mattias Walström	08f4207277	configs: Enable Wi-Fi support	2025-06-19 15:23:30 +02:00
Mattias Walström	5fbb30fed5	Wi-Fi: Add Wi-Fi information to operational and CLI output * show wifi scan <ifname> to see located SSIDs * interface status	2025-06-19 15:23:30 +02:00
Mattias Walström	f25f0ab050	Wi-Fi: Add template finit service for wpa_supplicant	2025-06-19 15:23:29 +02:00
Mattias Walström	b53c1612f0	confd: Add basic Wi-Fi client support Support implemented: * WPA2/3 support * scanning (in background, results in operational) * Unencrypted networks No certificate support, only PSK only client so far, no AP	2025-06-19 15:23:28 +02:00
Mattias Walström	57d5bf1577	confd: Add script to wait for an interface usage: wait-interface wlan0 30	2025-06-19 15:23:27 +02:00
Mattias Walström	0ad8fab5c7	wpa_supplicant: Add support for pidfile when not daemonize	2025-06-19 15:23:27 +02:00
Mattias Walström	ecabce86c7	Add meta-package for adding Wi-Fi support Helps adding everything that needs to be compiled to get Wi-Fi support working. Both modules, firmware and applications are selected here	2025-06-19 15:23:26 +02:00
Mattias Walström	a7e72a46d9	confd: Simplify enabling features in YANG models If a extra infix feature require features to be added to an already loaded module. Instead of have the exact module definition in multiple places (with date), this will allow a much more flexible sytax: MODULES=( "infix-interfaces -e containers" ) This require that the infix-interfaces is loaded before this file is run.	2025-06-19 15:23:25 +02:00
Mattias Walström	915bef2dd4	udev: Rename all wlan interfaces wifiN and start scanning This since the feature is called 'wifi' in Infix, this makes the naming consistent over the system. Also trigger start of a wpa_supplicant, for scanning in the background. The scanning results is available operational.	2025-06-19 15:23:24 +02:00
Mattias Walström	7f9a1df6f7	qemu: Increase memory for virtual machine Image is too big, more memory is required	2025-06-19 15:23:24 +02:00
Mattias Walström	67a6fc18d5	confd: Always run netdag_gen_afspec_set and netdag_gen_afspec_add on all iftypes If an iftype does not need to do anything, just return 0. This makes the code much more easy to follow.	2025-06-19 15:23:23 +02:00
Mattias Walström	8538888069	confd: core: Allow all other flags then SR_SUBSCR_UPDATE Other flags may be load-bearing in some modules, but SR_SUBSCR_UPDATE, we never want to keep track on in the core hooks.	2025-06-19 10:34:46 +02:00
Mattias WalströmandGitHub	5a1cf7f9f8	Merge pull request #1063 from kernelkit/upgrade-kernel Upgrade Linux kernel to v6.12.33 (LTS)	2025-06-18 07:56:21 +02:00
Ahmed Karic	6755011b25	Upgrade Linux kernel to 6.12.33 (LTS)	2025-06-16 10:49:02 +02:00
Mattias WalströmandGitHub	e5a8514fa0	Merge pull request #1061 from kernelkit/update-changelog-v25.05.1 Update changelog for Infix v25.05.1	2025-06-12 15:03:41 +02:00
Jon-Olov Vatn	82c3eb1ee7	Update changelog for Infix v25.05.1	2025-06-12 12:31:35 +02:00
Jon-Olov VatnandGitHub	159135786a	Merge pull request #1060 from kernelkit/fix-missing-cmd-regression Restore missing CLI commands moved to show context	2025-06-11 09:14:09 +02:00
Richard Alpe	8a9415f0b4	klish-plugin-infix: restore missing CLI commands moved to show context Some CLI commands where inadvertently moved from the global CLI context into the show context. For example the upgrade command. As a result, commands like upgrade were unavailable at the top-level prompt:admin@ix-00-00-00:/> upgrade ? Error: Command not found, or incomplete. However, these commands remained accessible under the "show" context as a temporary workaround: admin@ix-00-00-00:/> show upgrade ? URI [(ftp\|tftp\|http\|https\|ftp)://(dns.name \| ip.address)/path/to/]upgrade-bundle.pkg This patch restores the affected commands to the global CLI context so that commands like upgrade function as intended at the root prompt. Fixes: `9c0a8e39` klish-plugin-infix: fix indentation in infix.xml Signed-off-by: Richard Alpe <richard@bit42.se>	2025-06-10 16:06:12 +02:00
Mattias WalströmandGitHub	93cffaedde	Merge pull request #1057 from kernelkit/upgrade-kernel	2025-06-04 21:22:39 +02:00
Ahmed Karic	991364b411	Upgrade linux kernel to v6.12.32 (LTS)	2025-06-04 18:21:11 +02:00
Mattias WalströmandGitHub	22cf97fdbd	Merge pull request #1056 from kernelkit/upgrade-kernel	2025-05-30 12:49:48 +02:00
Ahmed Karic	16c1b50349	Upgrade Linux kernel to 6.12.31 (LTS)	2025-05-30 11:26:53 +02:00
Richard AlpeandGitHub	d2e5c2cd29	Merge pull request #1054 from kernelkit/update-changelog Update changelog for v25.05.0	2025-05-27 12:04:05 +02:00
Richard Alpe	8bca1bed9e	Update changelog for v25.05.0 Signed-off-by: Richard Alpe <richard@bit42.se>	2025-05-27 11:04:25 +02:00
Mattias WalströmandGitHub	b88841952a	Merge pull request #1048 from kernelkit/fix-downgrade-documentation Fix downgrade documentation	2025-05-27 09:55:53 +02:00
Jon-Olov Vatn	9c3e951286	Update downgrade doc to recommend explicitly store/use backup cfg - relying on config version and files backed up during configuration is not enough. - storing a configuration file before upgrading, to be used when downgrading, is more reliable. [skip ci]	2025-05-27 08:04:52 +02:00
Jon-Olov VatnandGitHub	c7c01e3616	Merge branch 'main' into fix-downgrade-documentation	2025-05-26 16:20:02 +02:00
Mattias WalströmandGitHub	a6889fa8c5	Merge pull request #1053 from kernelkit/rpi4 Add support for Raspberry Pi 4B	2025-05-26 11:23:26 +02:00
Joachim Wiberg	6cd92c25a8	doc: introduce Raspberry Pi 4B support Also, fix placement of the VisionFive2, it's not an Aarch64 boartd. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-05-25 23:15:37 +02:00
Joachim Wiberg	ff4e20221c	configs,rpi4: complete port, Infix booting Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-05-25 23:15:37 +02:00
Joachim Wiberg	808edf0a29	configs,rpi4: quirk, phy-detached-when-down Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-05-25 23:15:36 +02:00
Joachim Wiberg	3f68e297ef	configs,rpi4: quirk, override /etc/watchdogd.conf Apparently the BCM2835 watchdog driver does not hook into /dev/watchdog but creates its own /dev/watchdog0, and is very picky about interval and timeout as well it seems. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-05-25 23:15:36 +02:00
Joachim Wiberg	0158fe1adb	configs,rpi4: add factory default password Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-05-25 23:15:35 +02:00
Joachim Wiberg	4345ec1694	configs,rpi4: switch to mainline kernel, fix console access - switch to 6.12 LTS, same as other Infix boards - trim down kernel config a bit - sync defconfig with r2s to switch to Finit Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-05-25 23:15:35 +02:00
Joachim Wiberg	ebace5020b	configs: new rpi4_defconfig Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-05-25 20:37:27 +02:00
Joachim Wiberg	ae4424dafe	board/common: create infix-key.dtso as well for U-Boot Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-05-25 20:37:27 +02:00
Joachim Wiberg	50036e086d	confd: fix yang description of dhcp client option Update description to match new option name: subnet -> netmask. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-05-25 20:37:26 +02:00
Mattias WalströmandGitHub	6d53d92346	Merge pull request #1050 from kernelkit/upgrade-buildroot Upgrade Buildroot to 2025.02.3 (LTS)	2025-05-23 16:00:04 +02:00
Ahmed Karic	e0696c453a	Upgrade Buildroot to 2025.02.3 (LTS)	2025-05-23 11:24:35 +02:00
Ahmed KaricandGitHub	8b9a452f0c	Merge pull request #1051 from kernelkit/upgrade-kernel Upgrade Linux kernel to 6.12.30 (LTS)	2025-05-23 09:30:18 +02:00
Ahmed Karic	8bc7858694	Upgrade Linux kernel to 6.12.30 (LTS)	2025-05-22 18:28:23 +02:00
Ahmed KaricandGitHub	0065aeef47	Merge pull request #1046 from kernelkit/resctrict-mount-in-cont confd: Add mount constraint for container config	2025-05-22 18:26:29 +02:00
Ahmed Karic	dfc350a783	confd: Validate container mount source path If an invalid mount source path is specified, the container logs a "file not found" error and subsequently crashes. Adding a check inside the SR_EV_CHANGE event handler performs an early validation of the mount source path, allowing to reject configurations that reference non-existent or unreadable files before they are committed to the datastore.	2025-05-19 09:35:38 +02:00
Ahmed Karic	21a78c7639	confd: Add mount constraint for container config This change ensures configuration correctness by enforcing that each container mount has either a source or content set. Without this, the system may generate invalid runtime arguments (src=(null)), leading to container startup failures.	2025-05-19 09:35:38 +02:00
Tobias WaldekranzandGitHub	d6d621af36	Merge pull request #1047 from kernelkit/ix-board-fix board: Make ix-board reusable from upper externals	2025-05-16 22:32:06 +02:00
Tobias Waldekranz	e6ea2991e1	board: Make ix-board reusable from upper externals Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>	2025-05-16 20:06:09 +02:00
Ahmed KaricandGitHub	00f69baace	Merge pull request #1039 from kernelkit/verify-ieee-group-fwd Verify ieee group fwd	2025-05-16 14:26:42 +02:00
Jon-Olov Vatn	e5299fff1c	Update downgrade doc to recommend explicitly store/use backup cfg - relying on config version and files backed up during configuration is not enough. - storing a configuration file before upgrading, to be used when downgrading, is more reliable. [skip ci]	2025-05-16 12:46:24 +02:00
Jon-Olov Vatn	d5e96a8232	Add link to netbooting howto from boot doc [skip ci]	2025-05-15 13:00:52 +02:00
Ahmed Karic	aff385f37f	statd: Drop unsupported Chassis-ID and Port-ID Subtypes	2025-05-13 16:59:35 +02:00
Ahmed Karic	e40fc33a55	doc: Document LLDP config support	2025-05-13 16:59:25 +02:00
Ahmed Karic	71b4aed05d	test: Reorganize infix_services test	2025-05-13 16:59:12 +02:00
Ahmed Karic	50a94e8175	test: Verify ieee-group-forward LLDP	2025-05-13 16:58:57 +02:00
Ahmed Karic	2cbba5cf1f	test: Cleanup topologies	2025-05-13 16:58:46 +02:00
Ahmed Karic	00f2a4cf33	statd: Refactor cli_pretty.py - Sort commands in an alphabetical order	2025-05-13 16:58:38 +02:00
Ahmed Karic	ec7891c097	statd: Fix function and class separation in cli_pretty.py Fix new lines according to PEP8	2025-05-13 16:58:31 +02:00
Ahmed Karic	9c0a8e39ec	klish-plugin-infix: fix indentation in infix.xml	2025-05-13 16:58:21 +02:00
Ahmed Karic	4a4325baa3	cli: Add CLI option to show LLDP neighbors	2025-05-13 16:58:14 +02:00
Ahmed Karic	cae5cfd3f0	statd: Set default dest-mac-address for LLDP	2025-05-13 16:58:02 +02:00
Mattias WalströmandGitHub	fa7c3d0a51	Merge pull request #1045 from kernelkit/activate-full-parallel Use massive parallel in workflow for PRs	2025-05-13 10:40:37 +02:00
Mattias Walström	874c0a54c4	Use massive parallel in workflow for PRs This to get quick turnaround development -> test when doing PRs main branch builds and release builds are still build sequentially. Signed-off-by: Mattias Walström <lazzer@gmail.com>	2025-05-13 08:02:16 +02:00
Mattias WalströmandGitHub	6a2abd962f	Merge pull request #989 from kernelkit/enable-full-parallel Enable full parallel	2025-05-12 09:36:57 +02:00
Mattias WalströmandGitHub	aa995e3321	Merge pull request #1044 from kernelkit/upgrade-kernel Bump kernel to 6.12.28 (LTS)	2025-05-12 09:36:30 +02:00
Mattias Walström	0a74ba341f	confd: Refactor when yang models are installed And add support for BR2_PER_PACKAGE_DIR	2025-05-12 08:39:54 +02:00
Mattias Walström	13de8be58d	confd: Fix some typos in sysrepo.inc * Install correct yang file, instead of one that does not exist at all * Remove some models only used in tests (and is causing troubble!)	2025-05-12 08:39:54 +02:00
Mattias Walström	606aee68db	package/lowdown: Fix configure script for parallel builds	2025-05-12 08:39:53 +02:00
Mattias Walström	e4578364b6	package: python-libyang: Add missing libyang dependency	2025-05-12 08:39:53 +02:00
Mattias Walström	5cdaebf5e8	package: nghttp-asio: Add missing openssl dependency	2025-05-12 08:39:52 +02:00
Mattias Walström	2848cd62bc	package: landing: Create target directory before copying files The directory may not exist in parallel builds	2025-05-12 08:39:52 +02:00
Mattias Walström	2303fc08aa	Bump kernel to 6.12.28 (LTS)	2025-05-12 08:10:41 +02:00
Joachim WibergandGitHub	6277aaedcd	Merge pull request #1043 from kernelkit/lacp-descr	2025-05-08 17:45:36 +02:00
Ahmed Karic	f81b74458d	confd: Correct description for LAG LACP modes Fixes #1031	2025-05-08 15:54:59 +02:00
Mattias WalströmandGitHub	8f61879966	Merge pull request #1041 from kernelkit/imx8-graphic imx8mp-evk: Add USB and HDMI support	2025-05-07 15:18:52 +02:00
Mattias Walström	5560266e19	containers: Allow to have multiple mounts Only first mount was sent to podman.	2025-05-07 13:24:07 +02:00
Mattias Walström	d8cbdd7d92	imx8mp-evk: Add USB and HDMI support	2025-05-07 13:24:04 +02:00
				`@@ -0,0 +1 @@`
				`root=/dev/mmcblk0p2 rootwait console=tty1 console=ttyAMA0,115200`
				`@@ -0,0 +1 @@`
				`SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"`