infix-hardware: fix operational with virtual radios

* Show a vendor of the radio (hwsim)
* Allow to show alot of supported AP interfaces, hwsim
  supports 2048

.github/CONTRIBUTING.md

@@ -272,7 +272,7 @@ other contributions that are not aligned to this Code of Conduct."*
 [PEP-8]:    https://peps.python.org/pep-0008/
 [RDD]:      https://tom.preston-werner.com/2010/08/23/readme-driven-development
 [cbeams]:   https://cbea.ms/git-commit/#seven-rules
-[conduct]:    CODE-OF-CONDUCT.md
+[conduct]:    CODE_OF_CONDUCT.md
 [DCO]:        https://developercertificate.org/
 [closing]:    https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
 [gpg-verify]: https://docs.github.com/en/authentication/managing-commit-signature-verification

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /src/webui
+    schedule:
+      interval: weekly
+    # goyang is pinned to our kernelkit fork via a replace directive and
+    # stepped by hand when we add patches; leave it for Dependabot to ignore.
+    ignore:
+      - dependency-name: github.com/openconfig/goyang
+
+  - package-ecosystem: gomod
+    directory: /src/netbrowse
+    schedule:
+      interval: weekly

.github/workflows/build-boot.yml

@@ -113,12 +113,6 @@ jobs:
           pattern: "artifact-*"
           merge-multiple: true
 
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
       - uses: ncipollo/release-action@v1
         with:
           allowUpdates: true
@@ -128,7 +122,7 @@ jobs:
           prerelease: true
           tag: "latest-boot"
           token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
+          artifacts: "*.tar.gz"
 
       - name: Summary
         run: |

.github/workflows/build-image.yml

@@ -223,15 +223,6 @@ jobs:
             output/images/*-emmc.img*
           retention-days: 30
 
-      - name: Create checksums
-        run: |
-          cd output/images/
-          for file in *-sdcard.img *-emmc.img; do
-            if [ -f "$file" ]; then
-              sha256sum "$file" > "$file.sha256"
-            fi
-          done
-
       - name: Upload to release
         uses: ncipollo/release-action@v1
         with:
@@ -242,7 +233,7 @@ jobs:
           prerelease: true
           tag: "latest-boot"
           token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "output/images/*-sdcard.img*,output/images/*-emmc.img*"
+          artifacts: "output/images/*-sdcard.img,output/images/*-emmc.img"
 
       - name: Generate summary
         run: |

.github/workflows/build-release.yml

@@ -45,6 +45,9 @@ jobs:
           target: ${{ matrix.target }}
           enabled: ${{ inputs.use_cache }}
 
+      # WebUI images bundle the mkdocs User's Guide via post-build.sh.
+      - uses: kernelkit/actions/setup-mkdocs@v1.2
+
       - name: Configure & Build
         env:
           INFIX_RELEASE: ${{ steps.vars.outputs.ver }}

.github/workflows/build.yml

@@ -124,6 +124,9 @@ jobs:
         with:
           target: ${{ env.TARGET }}
 
+      # WebUI images bundle the mkdocs User's Guide via post-build.sh.
+      - uses: kernelkit/actions/setup-mkdocs@v1.2
+
       - name: Configure ${{ env.TARGET }}
         run: |
           make ${{ env.TARGET }}_defconfig

.github/workflows/govulncheck.yml

@@ -0,0 +1,68 @@
+name: Go Vulnerability Scan
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'src/webui/**'
+      - 'src/netbrowse/**'
+      - '.github/workflows/govulncheck.yml'
+  pull_request:
+    paths:
+      - 'src/webui/**'
+      - 'src/netbrowse/**'
+      - '.github/workflows/govulncheck.yml'
+  schedule:
+    - cron: '5 0 * * 6'  # Saturday at 00:05 UTC, same as Coverity
+  workflow_dispatch:
+
+jobs:
+  govulncheck:
+    if: ${{ github.repository_owner == 'kernelkit' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module:
+          - src/webui
+          - src/netbrowse
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Scan ${{ matrix.module }}
+        working-directory: ${{ matrix.module }}
+        run: |
+          # Full report, for the run summary.  govulncheck exits non-zero
+          # whenever it finds anything, so don't let it fail the step here.
+          {
+            echo "## govulncheck: ${{ matrix.module }}"
+            echo '```'
+            govulncheck ./... || true
+            echo '```'
+          } | tee -a "$GITHUB_STEP_SUMMARY"
+
+          # Gate on vulnerabilities reachable from our code through a
+          # dependency.  govulncheck's call-graph analysis is transitive,
+          # so indirect use counts too (we call a dep that calls the bad
+          # symbol).  trace[0] is the vulnerable symbol; we key on the
+          # module it lives in.  A chain that bottoms out in stdlib is
+          # fixed by bumping the Buildroot host Go, not this module's
+          # go.mod, so it's reported above but doesn't fail the build.
+          # Keep the json scan and jq unguarded so a tool failure fails the
+          # gate closed; only grep's no-match exit (all-clear) is tolerated.
+          govulncheck -format json ./... > scan.json || true
+          called=$(jq -r 'select(.finding.trace[0].function != null) |
+                          .finding.trace[0].module' scan.json | sort -u)
+          vulns=$(printf '%s' "$called" | grep -vx stdlib || true)
+          if [ -n "$vulns" ]; then
+            echo "::error::Called vulnerabilities in dependencies: $(echo "$vulns" | paste -sd, -)"
+            exit 1
+          fi

.github/workflows/inventory.yml

@@ -1,88 +0,0 @@
-name: Manny the Manager
-
-on:
-  workflow_dispatch:
-    inputs:
-      checkout:
-        required: true
-        type: boolean
-      cleanup:
-        required: true
-        type: boolean
-      peek:
-        required: true
-        type: boolean
-
-jobs:
-  inventory:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Disk usage ...
-        run: |
-          cd
-          du -hs .[^.]*
-      - name: Disk inventory (1/2) ...
-        run: |
-          echo "df -h ========================================================================="
-          df -h
-          echo "mounts ========================================================================"
-          mount
-      - name: File inventory (1/2) ...
-        run: |
-          echo "Current directory: $(pwd)"
-          echo "Files in $HOME ================================================================"
-          ls $HOME
-          echo "Find $HOME ===================================================================="
-          find $HOME
-      - name: Container inventory ...
-        run: |
-          echo "Available container images: ==================================================="
-          docker images
-          echo "Available containers: ========================================================="
-          docker ps -a
-
-  checkout:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: kernelkit/actions/cache-restore@v1
-        with:
-          target: x86_64
-          dl-prefix: dl-netconf
-      - name: Disk inventory (2/2) ...
-        run: |
-          echo "df -h ========================================================================="
-          df -h
-          echo "mounts ========================================================================"
-          mount
-      - name: File inventory (2/2) ...
-        run: |
-          echo "Current directory: $(pwd)"
-          echo "Files in $HOME ================================================================"
-          ls $HOME
-          echo "Find $HOME ===================================================================="
-          find $HOME
-
-  peeky:
-    if: ${{ inputs.peek }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Peek & Poke ...
-        run: |
-          whoami
-          ls -l /mnt/
-          cat /mnt/DATALOSS_WARNING_README.txt
-          sudo mkdir /mnt/x-aarch64
-          sudo chown $(id -un):$(id -gn) /mnt/x-aarch64
-          ls -l /mnt/
-
-  cleanup:
-    if: ${{ inputs.cleanup }}
-    needs: [inventory, peeky]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Cleaning up cruft ...
-        run: |
-          docker image prune -af
-          docker volume prune -f
-          docker container prune -f

.github/workflows/publish.yml

@@ -16,12 +16,6 @@ jobs:
           pattern: "artifact-*"
           merge-multiple: true
 
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
       - uses: ncipollo/release-action@v1
         with:
           allowUpdates: true
@@ -32,7 +26,7 @@ jobs:
           prerelease: true
           tag: "latest"
           token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
+          artifacts: "*.tar.gz"
 
       - name: Summary
         run: |

.github/workflows/release.yml

@@ -83,17 +83,6 @@ jobs:
           pattern: "artifact-*"
           merge-multiple: true
 
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi
-
       - name: Extract ChangeLog entry ...
         run: |
           cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
@@ -106,7 +95,7 @@ jobs:
           makeLatest: ${{ steps.rel.outputs.latest }}
           discussionCategory: ${{ steps.rel.outputs.cat }}
           bodyFile: release.md
-          artifacts: "*.tar.gz*,*.qcow2*"
+          artifacts: "*.tar.gz,*.qcow2"
 
       - name: Summary
         run: |

.github/workflows/test.yml

@@ -143,3 +143,15 @@ jobs:
         with:
           name: test-report
           path: output/images/test-report.pdf
+
+      - name: Generate XPath Coverage Report for ${{ env.TARGET }}
+        if: always()
+        run: |
+          make test-dir="$(pwd)/$TEST_PATH" xpath-coverage-report
+
+      - name: Upload XPath Coverage Report as Artifact
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: xpath-coverage-report
+          path: output/images/xpath-coverage-report.pdf

.github/workflows/weekly.yml

@@ -27,17 +27,6 @@ jobs:
           pattern: "artifact-*"
           merge-multiple: true
 
-      - name: Create checksums
-        run: |
-          for file in *.tar.gz; do
-            sha256sum $file > $file.sha256
-          done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi
-
       - uses: ncipollo/release-action@v1
         with:
           tag: latest
@@ -54,7 +43,7 @@ jobs:
 
             **Commit:** ${{ github.sha }}
             **Built:** ${{ github.run_id }}
-          artifacts: "*.tar.gz*,*.qcow2*"
+          artifacts: "*.tar.gz,*.qcow2"
 
       - name: Summary
         run: |

Config.in

@@ -110,9 +110,10 @@ config INFIX_OEM_PATH
 	  directory (absolute path) and the Infix post-build.sh will call `git
 	  describe -C $INFIX_OEM_PATH`.
 
-	  Note: for release builds the global variable INFIX_RELEASE overrides
-	  the version information derived from `git describe`.  However, the
-	  GIT version is always saved as the BUILD_ID in /etc/os-releases.
+	  Note: the OS version (VERSION, VERSION_ID, BUILD_ID in
+	  /etc/os-release) is always derived from `git describe`.  The global
+	  variable INFIX_RELEASE does not change it; it only labels the release
+	  channel (IMAGE_VERSION) and names the published artifacts.
 
 endmenu
 

README.md

@@ -1,63 +1,21 @@
-[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
+[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Discord][discord-badge]][discord-url]
 
-<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=480 padding=10>
+<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=380 padding=10>
 
-Turn any ARM or x86 device into a powerful, manageable network appliance
-in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
-routers, IoT gateways, edge devices, or custom network solutions that
-just work.
+Infix turns an ARM or x86 device into a managed network appliance.  The
+same OS runs on a $35 Raspberry Pi and on enterprise switching hardware,
+so you can build a router, an IoT gateway, or an edge device on whatever
+you have on hand.
 
-## Our Values
+More in-depth material is available in our blog and User Guide:
 
-**🔒 Immutable**  
-Your system never breaks.  Read-only filesystem with atomic upgrades
-means no configuration drift, no corrupted updates, and instant rollback
-if something goes wrong.  Deploy once, trust forever.
+- <https://www.kernelkit.org/>
+- <https://www.kernelkit.org/infix/>
 
-**🤝 Friendly**  
-Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit <kbd>?</kbd> or
-<kbd>TAB</kbd> for context-aware assistance.
+## See it in action
 
-Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
-mean you're never stuck.  Whether you're learning networking or managing
-enterprise infrastructure.
-
-**🛡️ Secure**  
-Built with security as a foundation, not an afterthought.  Minimal
-attack surface, separation between system and data, and container
-isolation.  Sleep better knowing your infrastructure is protected.
-
-## Why Choose Infix
-
-**Hardware Flexibility**: Start with a $35 Raspberry Pi, scale to
-enterprise switching hardware.  Same OS, same tools, same reliability.
-
-**Standards-Based**: Built around YANG models and IETF standards. Learn
-once, use everywhere - no vendor lock-in.
-
-**Container Ready**: Run your applications alongside networking
-functions.  GPIO access, dedicated Ethernet ports, custom protocols —
-your device, your rules.
-
-## Use Cases
-
-1. **Home Labs & Hobbyists**:  
-   Transform a Raspberry Pi into a full-featured router with WiFi  
-1. **IoT & Edge Computing**:  
-   Bridge devices to the cloud with reliable, updatable gateways  
-1. **Small Business Networks**:  
-   Enterprise-grade features without the complexity or cost  
-1. **Developers & Makers**:  
-   Test networking concepts, prototype IoT solutions, or build custom
-   appliances
-1. **Network Professionals**:  
-   Consistent tooling from development to production deployment.  
-   How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
-
-## Quick Example
-
-Configure an interface in seconds - the CLI guides you with built-in help:
+The CLI is generated from the [YANG models][inside], so it guides you with
+built-in help.  Here's setting an IP address on an interface:
 
 <pre><code>admin@infix-12-34-56:/> <b>configure</b>
 admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
@@ -94,38 +52,94 @@ eth0            ethernet   UP          52:54:00:12:34:56
 admin@infix-12-34-56:/> <b>copy running startup</b>
 </code></pre>
 
-Notice how <kbd>TAB</kbd> completion shows available options, `show`
-displays current config, and `diff` shows exactly what changed before
-you commit your changes with the `leave` command.
+<kbd>TAB</kbd> completes available options and <kbd>?</kbd> shows online help
+for each option and argument. `show` displays the current config, and `diff`
+shows exactly what changed before you commit it with `leave`.  See the [CLI
+documentation][3] for more.
 
-For more information, see [CLI documentation][3].
+## Web interface
 
-## Get Started
+If the CLI isn't your style, the same configuration is available through the
+web interface.  Log in from a browser, keep an eye on your device from the
+Status dashboard and use the Configure > Interface setup wizard to create more
+advanced setups, or just fold out an interface to add an IP address.
 
-Get [pre-built images][5] for your hardware.  Use the CLI, web
-interface, or standard NETCONF/RESTCONF tools, e.g., `curl`.  Add
-containers for any custom functionality you need.
+<p>
+  <a href="doc/img/webui-login.png"><img src="doc/img/webui-login.png" alt="Login" align="top" width=220></a>
+  <a href="doc/img/webui-dashboard.png"><img src="doc/img/webui-dashboard.png" alt="Dashboard" width=290></a>
+  <a href="doc/img/webui-wizard.png"><img src="doc/img/webui-wizard.png" alt="Setup wizard" width=260></a>
+</p>
 
-### Supported Platforms
+The web interface is built on the same concepts as the CLI, so operational
+status and state are kept separate from configuration and commands.
 
-- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
-- **Banana Pi-R3** - Your next home router and gateway
-- **NanoPi R2S** - Compact dual-port router in a tiny package
-- **x86_64** - Run in VMs or on mini PCs for development and testing
-- **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
-- **Microchip SparX-5i** - Enterprise switching capabilities
-- **Microchip SAMA7G54-EK** - ARM Cortex-A7
-- **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
-- **StarFive VisionFive2** - RISC-V architecture support
+## Try it in 5 minutes
 
-*Why start with Raspberry Pi?* It's affordable, widely available, has
-built-in WiFi + Ethernet, and runs the exact same Infix OS you'd deploy
-in production. Perfect for learning, prototyping, or even small-scale
-deployments.
+You don't need hardware to get started:
 
+- **In a virtual lab** — run a full topology in [GNS3][gns3-post] and test
+  networks entirely in software.
+- **From source** — [build it and `make run`][build-post] to boot Infix in
+  QEMU, from `git clone` to pinging the internet.
+- **On real hardware** — grab a [pre-built image][5] for your board, or run
+  the `x86_64` image in any VM.
+
+Log in with `admin` / `admin` on the virtual and pre-built images.  On
+shipped products the factory-reset credentials are customizable — we
+typically provision a unique per-device password stored in EEPROM/VPD.
+
+## Supported hardware
+
+- **Raspberry Pi 2B/3B/4B/CM4** - a good starting point; built-in WiFi and Ethernet
+- **Banana Pi-R64/R3/R3 Mini/R4** - multi-port routers and gateways
+- **NanoPi R2S** - compact dual-port router
+- **x86_64** - VMs and mini PCs, for development or production
+- **Marvell CN9130 CRB, EspressoBIN** - ARM64 development boards
+- **Microchip SparX-5i** - enterprise switching
+- **Microchip SAMA7G54-EK** - ARM Cortex-A7 evaluation kit
+- **NXP i.MX8MP EVK** - ARM64 SoC evaluation kit
+- **StarFive VisionFive2** - RISC-V board
+
+*Why start with Raspberry Pi?* It's cheap, easy to get hold of, has
+built-in WiFi and Ethernet, and runs the same Infix you'd deploy in
+production — so what you learn on it carries straight over.
+
+> [!TIP]
 > 📖 **[Complete documentation][4]** • 💬 **[Join our Discord][discord-url]**
 
-## Technical Details
+## Why Infix
+
+**🔒 Immutable**  
+Read-only filesystem with atomic upgrades.  An update either applies
+cleanly or rolls back, so a failed upgrade or a power cut midway through
+won't leave you with a half-broken system.
+
+**🤝 Friendly**  
+The CLI is generated from the YANG models, so every command carries its
+own help — hit <kbd>?</kbd> or <kbd>TAB</kbd> to see what's available.
+The same models are reachable over NETCONF and RESTCONF, with
+[documentation][4] for when you get stuck.
+
+**🛡️ Secure**  
+A small attack surface, separation between system and data, and
+container isolation.  Since the system partition is read-only, a
+compromised service or container can't rewrite the OS underneath it.
+
+## Use cases
+
+1. **Home labs & hobbyists**:  
+   Turn a Raspberry Pi into a router with WiFi  
+1. **IoT & edge**:  
+   Build gateways you can update in the field  
+1. **Small business networks**:  
+   Routing, firewalling, and VLANs on affordable hardware  
+1. **Developers & makers**:  
+   Prototype networking ideas, or build a custom appliance with containers  
+1. **Network professionals**:  
+   The same tooling from lab to production — spin up a digital twin in raw
+   Qemu or [GNS3](https://gns3.com/infix)
+
+## Under the hood
 
 <a href="https://bitsign.se">
   <picture>
@@ -135,27 +149,29 @@ deployments.
   </picture>
 </a>
 
-Built on proven open-source foundations: [Linux][0], [Buildroot][1], and
-[sysrepo][2] — for reliability you can trust:
+Built on [Linux][0], [Buildroot][1], and [sysrepo][2]:
 
-- **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
-- **YANG Configuration**: Industry-standard models with auto-generated tooling
-- **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
-- **Container Integration**: Docker support with flexible network and hardware access
-- **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
-- **Code Signing**: Releases are cryptographically signed for integrity verification
+- **Immutable OS**: read-only filesystem, atomic updates, rollback on failure
+- **YANG configuration**: standard models with an auto-generated CLI and APIs
+- **Hardware acceleration**: switchdev offload for wire-speed forwarding
+- **Container integration**: Docker, with access to host network and hardware
+- **Memory efficient**: runs on devices with as little as 256 MB RAM
+- **Code signing**: releases are cryptographically signed
 
-Perfect for everything from resource-constrained edge devices to
-high-throughput network appliances.
-
-With the entire system modeled in YANG, scalability is no longer an
-issue, be it in development, testing, or end users deploying and
-monitoring their devices.  All knobs and dials are accessible from the
-CLI (console/SSH), or remotely using the native NETCONF or RESTCONF
-APIs.
+Because the whole system is modeled in YANG, every setting is reachable
+the same way: from the CLI over console or SSH, or remotely over the
+native NETCONF and RESTCONF APIs.  The same models drive development,
+testing, and day-to-day monitoring.
 
 > Check the *[Latest Build][]* for bleeding-edge features.
 
+## Contributing
+
+Bug reports, ideas, and pull requests are welcome.  Start with
+[CONTRIBUTING][contributing] and the [code of conduct][coc].  Found a
+security issue?  Follow the [security policy][security].  Need a hand?
+See [support options][support] or [join us on Discord][discord-url].
+
 ---
 
 <div align="center">
@@ -171,6 +187,13 @@ APIs.
 [3]: https://www.kernelkit.org/infix/latest/cli/introduction/
 [4]: https://www.kernelkit.org/infix/
 [5]: https://github.com/kernelkit/infix/releases/latest
+[inside]:          https://www.kernelkit.org/posts/inside-infix/
+[gns3-post]:       https://www.kernelkit.org/posts/infix-in-gns3/
+[build-post]:      https://www.kernelkit.org/posts/building-infix-from-source/
+[contributing]:    .github/CONTRIBUTING.md
+[coc]:             .github/CODE_OF_CONDUCT.md
+[security]:        .github/SECURITY.md
+[support]:         .github/SUPPORT.md
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg

board/aarch64/bananapi-bpi-r4/README.md

@@ -87,45 +87,6 @@ Infix ships with the following factory defaults.
 > are bridged into the LAN as access points.  WiFi is not included with the board
 > and is not part of the factory default configuration.
 
-## SIM Card Installation
-
-The BPI-R4 has three SIM holders, one per PCIe slot:
-
-| Slot     | PCIe socket | Typical use              |
-|----------|-------------|--------------------------|
-| **SIM1** | M.2 Key-B   | 4G/5G WWAN modem         |
-| **SIM2** | mPCIe #1    | Cellular or other modem  |
-| **SIM3** | mPCIe #2    | Cellular or other modem  |
-
-All three take **nano-SIM (4FF)** cards.
-
-> [!NOTE]
-> The official Banana Pi pages show an older board revision with a sliding
-> "sled" holder.  Newer boards ship with a fixed friction-fit holder instead:
-> there is no lid to lift and no spring eject.  The [closest matching photo on
-> bananapi.org][15] shows the current mechanism.
-
-### Inserting a SIM
-
-1. Orient the card with the gold contacts facing the PCB (printed
-   side up) and the cut corner pointing toward the M.2/mPCIe socket,
-   which on this board is also toward the outer edge.  The silkscreen
-   next to each holder shows the same outline.
-2. Push the SIM straight in until it is fully seated.  There is no
-   click and the holder is not spring-loaded, so press firmly until
-   the contacts engage and the rear edge of the card sits flush with
-   the holder.
-3. A SIM that still protrudes is not fully inserted; push again.
-
-### Removing a SIM
-
-The friction grip on these holders is tight.  Gently pry the card out
-with a fingernail or a thin plastic spudger.  Avoid metal tweezers
-near the contacts.  Removing the front panel of the metal case is
-absolutely necessary to access the SIM holder.
-
-For software configuration once the modem is recognised, see the
-[Cellular Modem User's Guide][16].
 
 ## Getting Started
 
@@ -397,6 +358,3 @@ make aarch64
 [12]: https://github.com/frank-w/u-boot/releases
 [13]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2026-01-bpi-2026.01-2026-01-15_2013/bpi-r4_spim-nand_bl2.img
 [14]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2026-01-bpi-2026.01-2026-01-15_2013/bpi-r4_spim-nand_fip.bin
-[15]: https://docs.banana-pi.org/bpi-r4/bpi-r4_4g5g_2.jpg
-[16]: https://www.kernelkit.org/infix/latest/modem/
-

board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4-2g5/etc/factory-config.cfg

@@ -10,13 +10,6 @@
         "state": {
           "admin-state": "unlocked"
         }
-      },
-      {
-        "name": "USB2",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
       }
     ]
   },
@@ -373,7 +366,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.8"
+    "version": "1.7"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4/etc/factory-config.cfg

@@ -10,13 +10,6 @@
         "state": {
           "admin-state": "unlocked"
         }
-      },
-      {
-        "name": "USB2",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
       }
     ]
   },
@@ -365,7 +358,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.8"
+    "version": "1.7"
   },
   "infix-services:mdns": {
     "enabled": true

board/common/post-build.sh

@@ -120,3 +120,29 @@ grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
 if [ "$BR2_PACKAGE_HOST_PYTHON_YANGDOC" = "y" ]; then
    mkyangdoc "$BINARIES_DIR/yangdoc.html"
 fi
+
+# Bundle the mkdocs User's Guide into the rootfs, served by the WebUI's
+# nginx at /guide/.  Only when the WebUI is present (nothing serves it
+# otherwise, and it keeps minimal images small) and mkdocs is on the build
+# host.  Best-effort: a failed build warns but does not abort the image
+# build, and the WebUI hides its User Guide entry when the docs are absent.
+mkuserguide()
+{
+    local cfg dst
+    cfg="$(readlink -f "$common/../..")/mkdocs.yml"
+    dst="$TARGET_DIR/var/www/guide"
+
+    if ! command -v mkdocs >/dev/null 2>&1; then
+        ixmsg "mkdocs not found, skipping User's Guide bundling"
+        return
+    fi
+    ixmsg "Building User's Guide into $dst"
+    if ! mkdocs build -f "$cfg" -d "$dst" --clean --quiet; then
+        ixmsg "WARNING: mkdocs build failed, shipping without on-device User's Guide"
+        rm -rf "$dst"
+    fi
+}
+
+if [ "$BR2_PACKAGE_WEBUI" = "y" ]; then
+    mkuserguide
+fi

board/common/qemu/Config.in.in

@@ -253,3 +253,19 @@ config QEMU_NET_PORTS
 	int "Number of Rocker switch ports"
 	depends on QEMU_NET_ROCKER
 	default 10
+
+comment "Wireless"
+
+config QEMU_WIFI_RADIOS
+	int "Number of virtual WiFi radios (mac80211_hwsim)"
+	default 0
+	help
+	  Number of simulated 802.11 radios to create with mac80211_hwsim.
+	  The count is passed to the guest via the opt/wifi fw_cfg and loaded
+	  by the 00-hwsim boot script.
+
+	  0 (default) means no radios, so nothing wireless clutters the guest.
+	  Set a small number (e.g. 2) for local AP/station experiments.
+
+	  Note: 'make run' is a single guest with no inter-guest wireless
+	  medium, so these radios only reach each other within this one guest.

board/common/qemu/run.sh

@@ -310,6 +310,16 @@ EOF
     echo -n "-fw_cfg name=opt/vpd,file=$vpd_file"
 }
 
+wifi_args()
+{
+    # Number of mac80211_hwsim radios for the guest, read at boot by 00-hwsim
+    # (fw_cfg opt/wifi).  Default 0 -> no radios, no wifi clutter.
+    radios=${CONFIG_QEMU_WIFI_RADIOS:-0}
+    wifi="${qdir}/wifi"
+    echo "$radios" > "$wifi"
+    echo -n "-fw_cfg name=opt/wifi,file=$wifi "
+}
+
 wdt_args()
 {
     echo -n "-device i6300esb "
@@ -387,6 +397,7 @@ run_qemu()
 	  $(usb_args) \
 	  $(host_args) \
 	  $(net_args) \
+	  $(wifi_args) \
 	  $(wdt_args) \
 	  $(rtc_args) \
 	  $(vpd_args) \

board/common/rootfs/etc/default/confd

@@ -1,5 +1 @@
 CONFD_TIMEOUT=60
-#DEBUG=1
-
-# -v debug
-CONFD_ARGS=""

board/common/rootfs/etc/default/webui

@@ -0,0 +1,5 @@
+RESTCONF_URL=https://127.0.0.1/restconf
+INSECURE_TLS=1
+# Spool firmware uploads (and any other temp files) to persistent storage
+# instead of the RAM-backed /tmp to enable push-upgrades on low-memory systems.
+TMPDIR=/var/tmp

board/common/rootfs/etc/iproute2/rt_addrprotos

@@ -5,4 +5,3 @@
 4 static
 5 dhcp
 6 random
-7 wwan

board/common/rootfs/etc/nginx/app/restconf.conf

@@ -0,0 +1 @@
+../restconf.app

board/common/rootfs/etc/nginx/restconf-access-local.conf

@@ -0,0 +1,3 @@
+allow 127.0.0.1;
+allow ::1;
+deny all;

board/common/rootfs/etc/nginx/restconf-access.conf

@@ -0,0 +1 @@
+restconf-access-local.conf

board/common/rootfs/etc/nginx/restconf.app

@@ -1,5 +1,6 @@
 # /telemetry/optics is for streaming (not used atm)
 location ~ ^/(restconf|yang|.well-known)/ {
+    include /etc/nginx/restconf-access.conf;
     grpc_pass grpc://[::1]:10080;
     grpc_set_header Host $host;
     grpc_set_header X-Real-IP $remote_addr;

board/common/rootfs/etc/profile.d/update-check.sh

@@ -0,0 +1,3 @@
+if [ -s /run/os-update ]; then
+    printf '\n\033[1;33m *** %s ***\033[0m\n\n' "$(cat /run/os-update)"
+fi

board/common/rootfs/etc/tmpfiles.d/os-schedule.conf

@@ -0,0 +1 @@
+f  /run/os-update  0666 admin admin

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -620,73 +620,6 @@ def probe_ptp_capabilities(out):
         out.setdefault("interfaces", {}).update(ifaces)
 
 
-def _usb_root_from_sysfs(dev_path):
-    p = dev_path
-    while p not in ("/", "/sys"):
-        parent = os.path.realpath(os.path.join(p, ".."))
-        basename = os.path.basename(parent)
-        if basename.startswith("usb") and basename[3:].isdigit():
-            return parent
-        p = parent
-    return None
-
-
-def _read_usb_vid_pid(dev_path):
-    p = dev_path
-    while p not in ("/", "/sys"):
-        try:
-            vid = open(os.path.join(p, "idVendor")).read().strip()
-            pid = open(os.path.join(p, "idProduct")).read().strip()
-            return vid, pid
-        except OSError:
-            pass
-        p = os.path.dirname(p)
-    return "", ""
-
-
-def probe_modems(out):
-    """devpath is the USB bus root; ModemManager matches by path prefix.
-    seen_roots deduplicates cdc-wdm and ttyUSB ports of the same physical modem."""
-    seen_roots = set()
-    modems = []
-    idx = 0
-
-    def add_modem(dev_path):
-        nonlocal idx
-        usb_root = _usb_root_from_sysfs(dev_path)
-        if usb_root is None or usb_root in seen_roots:
-            return
-        seen_roots.add(usb_root)
-        vid, pid = _read_usb_vid_pid(dev_path)
-        modems.append({
-            "index": idx,
-            "name": "modem%d" % idx,
-            "devpath": usb_root,
-            "vid": vid,
-            "pid": pid,
-        })
-        idx += 1
-
-    for cls_dir, prefix in (("/sys/class/usbmisc", "cdc-wdm"),
-                             ("/sys/class/tty", "ttyUSB")):
-        try:
-            entries = os.listdir(cls_dir)
-        except OSError:
-            continue
-        for entry in entries:
-            if not entry.startswith(prefix):
-                continue
-            try:
-                dev_path = os.path.realpath(
-                    os.path.join(cls_dir, entry, "device"))
-                add_modem(dev_path)
-            except OSError:
-                pass
-
-    if modems:
-        out["modem"] = modems
-
-
 def main():
     out = {
         "vendor": None,
@@ -714,7 +647,6 @@ def main():
 
     probe_wifi_radios(out)
     probe_ptp_capabilities(out)
-    probe_modems(out)
 
     if not out["factory-password-hash"]:
         sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +
@@ -722,10 +654,17 @@ def main():
         err = 1
 
     os.umask(0o337)
+    # Write atomically: confd reads system.json as soon as ixinit signals
+    # done, so a truncated in-place write could be read half-written.  Write
+    # to a temp file in the same dir, then rename (atomic on the same fs).
     # pylint: disable=invalid-name
-    with open(SYSTEM_JSON, "w", encoding="ascii") as f:
+    tmp = SYSTEM_JSON + ".tmp"
+    with open(tmp, "w", encoding="ascii") as f:
         json.dump(out, f)
-    shutil.chown(SYSTEM_JSON, user="root", group="wheel")
+        f.flush()
+        os.fsync(f.fileno())
+    shutil.chown(tmp, user="root", group="wheel")
+    os.replace(tmp, SYSTEM_JSON)
     return err
 
 

board/common/rootfs/usr/libexec/infix/init.d/20-nameif

@@ -43,5 +43,12 @@ for iface in $ports; do
 	ip link set "$iface" group port
 done
 
+# The mac80211_hwsim monitor tap (hwsim test images only) is a debug
+# observer, not a user-facing interface.  It cannot be deleted (no rtnl
+# link ops), so classify it as internal like the DSA CPU interfaces.
+if [ -d /sys/class/net/hwsim0 ]; then
+	ip link set dev hwsim0 group internal
+fi
+
 # At least loopback in iface group
 ip link set lo group iface

board/common/rootfs/usr/libexec/infix/iw.py

@@ -176,19 +176,25 @@ def parse_phy_info(phy_name):
     if current_band and current_band.get('frequencies'):
         result['bands'].append(current_band)
 
-    # Determine band names and assign band numbers
+    # Keep only the bands Infix supports (2.4/5/6 GHz), naming them by their
+    # first frequency.  Hardware may expose others (e.g. S1G on hwsim) that we
+    # neither configure nor report.
+    bands = []
     for band in result['bands']:
-        if band['frequencies']:
-            freq = band['frequencies'][0]
-            if 2400 <= freq <= 2500:
-                band['name'] = '2.4GHz'
-                band['band'] = 1
-            elif 5150 <= freq <= 5900:
-                band['name'] = '5GHz'
-                band['band'] = 2
-            elif 5955 <= freq <= 7115:
-                band['name'] = '6GHz'
-                band['band'] = 3
+        freq = band['frequencies'][0]
+        if 2400 <= freq <= 2500:
+            band['name'] = '2.4GHz'
+            band['band'] = 1
+        elif 5150 <= freq <= 5900:
+            band['name'] = '5GHz'
+            band['band'] = 2
+        elif 5955 <= freq <= 7115:
+            band['name'] = '6GHz'
+            band['band'] = 3
+        else:
+            continue
+        bands.append(band)
+    result['bands'] = bands
 
     # Set max TX power
     if max_power is not None:
@@ -207,7 +213,9 @@ def parse_phy_info(phy_name):
 
             # Map driver to manufacturer
             driver_lower = driver_name.lower()
-            if 'mt' in driver_lower or 'mediatek' in driver_lower:
+            if 'hwsim' in driver_lower:
+                result['manufacturer'] = 'Virtual (hwsim)'
+            elif 'mt' in driver_lower or 'mediatek' in driver_lower:
                 result['manufacturer'] = 'MediaTek Inc.'
             elif 'rtw' in driver_lower or 'realtek' in driver_lower:
                 result['manufacturer'] = 'Realtek Semiconductor Corp.'

board/common/rootfs/usr/sbin/check-update

@@ -0,0 +1,55 @@
+#!/bin/sh
+# Check for available software updates and notify on login if one exists.
+# Called by the scheduler.
+
+NOTIFY_FILE=/run/os-update
+TAG=os-update
+
+# Source os-release for VERSION and IMAGE_ID
+if [ ! -f /etc/os-release ]; then
+    logger -t "$TAG" "ERROR: /etc/os-release not found"
+    exit 1
+fi
+. /etc/os-release
+
+# Dev/dirty builds have no comparable semver — always show the latest release
+IS_RELEASE=true
+if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
+    IS_RELEASE=false
+fi
+
+# Read configured update-url from running config, fall back to upstream
+UPDATE_URL=$(copy running-config \
+    -x '/ietf-system:system/infix-system:software/check-update/update-url' \
+    2>/dev/null \
+    | jq -r '.. | objects | ."update-url"? // empty')
+UPDATE_URL=${UPDATE_URL:-"https://github.com/kernelkit/infix"}
+
+# Derive API URL from the configured update URL.
+# Default (github.com): https://github.com/org/repo → https://api.github.com/repos/org/repo
+REPO=$(echo "$UPDATE_URL" | sed 's|https://github.com/||; s|/*$||')
+API_URL="https://api.github.com/repos/${REPO}/releases/latest"
+
+LATEST_TAG=$(curl -sSL --max-time 10 "$API_URL" 2>/dev/null \
+    | jq -r '.tag_name // empty')
+if [ -z "$LATEST_TAG" ]; then
+    logger -p daemon.info -t "$TAG" "Update check skipped: could not reach ${API_URL}"
+    exit 0
+fi
+LATEST=${LATEST_TAG#v}
+
+# Compare: is $1 strictly newer than $2?
+newer() {
+    [ "$1" = "$2" ] && return 1
+    [ "$(printf '%s\n%s' "$1" "$2" | sort -V | tail -1)" = "$1" ]
+}
+
+if [ "$IS_RELEASE" = false ] || newer "$LATEST" "$VERSION"; then
+    RELEASE_URL="${UPDATE_URL}/releases/${LATEST_TAG}"
+    MSG="Software update available: ${LATEST_TAG}, running ${VERSION} (see ${RELEASE_URL})"
+    logger -t "$TAG" "$MSG"
+    printf '%s\n' "$MSG" > "$NOTIFY_FILE"
+else
+    logger -p daemon.debug -t "$TAG" "No update available (current: $VERSION, latest: $LATEST)"
+    printf '' > "$NOTIFY_FILE"
+fi

configs/aarch64_defconfig

@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -149,7 +149,6 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
-BR2_PACKAGE_FEATURE_MODEM=y
 BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
 BR2_PACKAGE_FEATURE_WIFI_QUALCOMM=y
@@ -176,7 +175,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -188,6 +186,8 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
+# BR2_PACKAGE_LANDING is not set
+BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y

configs/aarch64_minimal_defconfig

@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -144,6 +144,7 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y

configs/arm_defconfig

@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -162,7 +162,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -170,6 +169,8 @@ BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
+# BR2_PACKAGE_LANDING is not set
+BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 IMAGE_ITB_AUX=y

configs/arm_minimal_defconfig

@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -142,6 +142,7 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y

configs/riscv64_defconfig

@@ -194,7 +194,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -206,6 +205,8 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
+# BR2_PACKAGE_LANDING is not set
+BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y

configs/x86_64_defconfig

@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -146,6 +146,7 @@ INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_HWSIM=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
 BR2_PACKAGE_FEATURE_WIFI_QUALCOMM=y
 BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
@@ -169,7 +170,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -181,6 +181,8 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
+# BR2_PACKAGE_LANDING is not set
+BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y

configs/x86_64_minimal_defconfig

@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -141,6 +141,7 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y

doc/ChangeLog.md

@@ -3,33 +3,75 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
-[v26.06.0][UNRELEASED]
---------------
+[v26.06.0][] - 2026-07-01
+-------------------------
+
+> [!NOTE]
+> Noteworthy changes and additions in this release:
+>
+> **🌐 Web Interface:** Infix gets its first-ever web interface!  Browse live
+> status and a full operational tree, handle common tasks from curated
+> configuration pages, and drop into a YANG tree editor for everything else.
+> A maintenance section covers firmware upgrade, backup & restore, and more.
+>
+> **📶 Wi-Fi Roaming & Mesh:** Access points sharing an SSID can hand clients
+> off seamlessly with 802.11k/v/r, form a cable-free 802.11s mesh backhaul,
+> and steer dual-band clients onto the faster 5/6 GHz band.
+>
+> **🗓️ System Scheduling:** Reusable time schedules based on ietf-schedule
+> (RFC 9922) let features like scheduled reboot and software update checks
+> run on a recurring, cron-style calendar.
 
 ### Changes
 
+- Upgrade Linux kernel to 6.18.37 (LTS)
+- Upgrade Buildroot to 2025.02.15 (LTS)
+- Add basic web interface: static status pages and a tree view of operational
+  status.  Curated configuration pages for some common tasks and a YANG tree
+  editor for the rest.  Also includes a maintenance section for firmware
+  upgrade, backup & restore, and more
 - Add Wi-Fi roaming for fast, seamless handoff between access points that
   share an SSID: 802.11k, 802.11v and 802.11r (over-the-air FT).  See the
-  [Wi-Fi User's Guide][wifi] for details
+  [Wi-Fi][wifi] guide for details
 - Add Wi-Fi 802.11s mesh support, letting access points form a wireless
   backhaul between each other without cabling
 - Add band steering for dual-band access points, nudging dual-band
   clients onto the faster 5/6 GHz band
 - Add `legacy-rates` option to re-enable 802.11b rates on 2.4 GHz for
   old IoT devices (disabled by default)
-- Add cellular modem (WWAN) support for USB-attached MBIM/QMI modems,
-  including USB dongles, mPCIe cards, and M.2 Key-B modules.  Multiple
-  APNs per modem, SIM PIN configuration, and NMEA routing from modem
-  GPS to gpsd.  See the [Modem User's Guide][modem] for details
+- Add system scheduling based on ietf-schedule (RFC 9922), using the
+  iCalendar recurrence grouping pruned to cron-expressible rules.  Schedules
+  are reusable time-specs; features (`scheduled-reboot`,
+  `software/check-update`) trigger off them via a schedule reference
+- Configuring multiple BSS (more than one SSID) on a single Wi-Fi radio now
+  requires an explicitly configured MAC address per BSS
+- New operational `advertised-pmd-types` leaf-list on each Ethernet interface,
+  exposing the link modes currently advertised, to compare against the
+  `supported-pmd-types` introduced in v26.05.0
+- Release assets no longer ship separate `.sha256` checksum files; the
+  download page now publishes a SHA-256 checksum for each asset directly
 
 ### Fixes
 
-- Firewall masquerade no longer enables the global IPv4/IPv6 forwarding
-  sysctls.  You must now enable IP forwarding explicitly on the interfaces
-  that should route traffic; enabling NAT alone is no longer enough
+- Fix #941: a VETH pair can now connect two containers directly, with both
+  ends assigned to containers.
+- Enabling IP masquerading in the firewall no longer enables IP forwarding on
+  all interfaces.  This has been an issue ever since the firewall support was
+  introduced in v25.10.0
+- Fix file permission regression in `/cfg/startup-config.cfg`, causing the
+  default `admin` user no permission to read or write the file from shell
+- Fix admin url shown for HTTP/HTTPS links in <https://network.local> browser,
+  used pre-conflict resolution hostname.local, instead of hostname-2.local
+- Fix unreadable per-port temperature sensor names in `show hardware` on
+  Marvell based switches: each sensor is now named after the front-panel port
+  it serves (e.g. `e1`, `e2`) instead of a raw device-tree path.  `show
+  system` also reports a representative SoC temperature on CN913x platforms
+- Fix missing `contact` and `location` settings in operational status; the
+  values were configurable but never returned on RESTCONF/NETCONF reads
+- Fix spurious YANG validation warnings, for NTP and WireGuard configuration,
+  emitted on every NETCONF session and schema load
 
-[wifi]:  https://www.kernelkit.org/infix/latest/wifi/
-[modem]: https://www.kernelkit.org/infix/latest/modem/
+[wifi]: https://www.kernelkit.org/infix/latest/wifi/
 
 [v26.05.0][] - 2026-05-29
 -------------------------
@@ -90,7 +132,7 @@ All notable changes to the project are documented in this file.
 
 [ethernet]: https://www.kernelkit.org/infix/latest/ethernet/#restricting-advertised-link-modes
 [BPI-R3]:   https://docs.banana-pi.org/en/BPI-R3/BananaPi_BPI-R3
-[AcerConnectVero]: https://github.com/kernelkit/infix/tree/main/board/aarch64/acer-connect-vero-w6m/
+[AcerConnectVero]: https://github.com/kernelkit/infix/tree/main/board/aarch64/acer-connect-vero-w6m
 
 [v26.04.0][] - 2026-04-30
 -------------------------
@@ -2163,7 +2205,8 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
  - N/A
 
 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.05.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.06.0...HEAD
+[v26.06.0]:   https://github.com/kernelkit/infix/compare/v26.05.0...v26.06.0
 [v26.05.0]:   https://github.com/kernelkit/infix/compare/v26.04.0...v26.05.0
 [v26.04.0]:   https://github.com/kernelkit/infix/compare/v26.03.0...v26.04.0
 [v26.03.0]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.03.0

doc/README.md

@@ -23,7 +23,6 @@ regression test system solely relies on NETCONF and RESTCONF.
    - [Network Configuration](networking.md)
    - [Wi-Fi](wifi.md)
    - [DHCP Server](dhcp.md)
-   - [Cellular Modem (WWAN)](modem.md)
    - [Syslog Support](syslog.md)
  - **Infix In-Depth**
    - [Boot Procedure](boot.md)

doc/container.md

@@ -668,11 +668,9 @@ set:
 
 For an example of both, see the next section.
 
-> [!IMPORTANT]
-> **VETH Pair Limitation:** When using VETH pairs with containers, at least
-> one side of the pair must remain in the host namespace. It is currently
-> not possible to create VETH pairs where both ends are assigned to different
-> containers. One end must always be accessible from the host.
+> [!TIP]
+> Both ends of a VETH pair may be assigned to containers, connecting two
+> containers directly without involving the host namespace.
 
 [^3]: Something which the container bridge network type does behind the
     scenes with one end of an automatically created VETH pair.

doc/developers-guide.md

@@ -122,13 +122,21 @@ recommend using `pipx` to install the necessary tooling:
 ```bash
 $ sudo apt install pipx
 $ pipx install mkdocs
-$ pipx inject mkdocs mkdocs-material pymdown-extensions mkdocs-callouts mike mkdocs-to-pdf
+$ pipx inject mkdocs mkdocs-material pymdown-extensions mkdocs-callouts mike mkdocs-to-pdf mkdocs-glightbox
 ```
 
-The last two packages, `mike` and `mkdocs-to-pdf`, are used for online
-versioning and PDF generation by GitHub Actions, but since they are in
-the `mkdocs.yml` file, everyone who wants to preview the documentation
-have to install all the tooling.
+The `mike` and `mkdocs-to-pdf` packages are used for online versioning
+and PDF generation by GitHub Actions, but since every plugin is listed
+in `mkdocs.yml`, anyone who wants to preview the documentation has to
+install all the tooling.
+
+> [!IMPORTANT]
+> MkDocs is also required to **build a WebUI image**.  The build bundles
+> the User's Guide into the image (served on-device at `/guide/`), so
+> `make` runs `mkdocs build` from `post-build.sh` when the `webui`
+> package is selected.  If MkDocs is missing the build still succeeds,
+> but the image ships without the on-device guide.  Minimal images and
+> any build without the `webui` package skip this step entirely.
 
 Preview with:
 

doc/modem.md

@@ -1,438 +0,0 @@
-# Cellular Modem (WWAN)
-
-Infix supports cellular modem connectivity via modems that expose a
-QMI or MBIM control interface over USB.  Form factor does not matter:
-USB dongles, mPCIe cards, and M.2 Key-B modules all work as long as
-the modem chipset uses USB on the connector (the typical case for
-4G/LTE modems).  See *Supported Modems* below for the exceptions.
-
-Setup involves three configuration items:
-
-- A `modem0` hardware component for the physical modem
-- A `sim0` hardware component for the SIM card slot
-- A `wwan0` network interface that references both and carries the
-  bearer (APN) configuration
-
-## Architecture
-
-Infix uses a three-layer architecture for cellular modem support:
-
-1. **Modem hardware component (modem0)**: the physical modem
-     - Configured via `ietf-hardware` with class `infix-hardware:modem`
-     - `admin-state` controls whether ModemManager and modemd are active
-     - Holds physical-layer config: allowed bands, preferred mode, location
-     - Auto-discovered into factory-default config when the modem is
-       present at first boot
-
-2. **SIM hardware component (sim0)**: the SIM card slot
-     - Configured via `ietf-hardware` with class `infix-hardware:sim`
-     - Holds PIN/PUK credentials and carrier profile
-     - Auto-discovered into factory-default config alongside the modem
-
-3. **Network interface (wwan0)**: data bearer to the cellular network
-     - Configured via `ietf-interfaces` with type `infix-if-type:modem`
-     - References a modem component and a SIM component
-     - Holds bearer config: APN, IP type, roaming, route preference,
-       authentication
-     - Always added by the user, never auto-created
-
-## Naming Conventions
-
-| **Name Pattern** | **Type**             | **Description**                                 |
-|------------------|----------------------|-------------------------------------------------|
-| `modemN`         | Modem hardware       | Hardware component for the physical modem       |
-| `simN`           | SIM hardware         | Hardware component for the SIM card slot        |
-| `wwanN`          | Modem interface      | Network interface for cellular data             |
-
-Where `N` is a number (0, 1, 2, ...).
-
-> [!TIP]
-> Using these naming conventions simplifies configuration since type and
-> class are automatically inferred.  Creating a hardware component named
-> `modem0` automatically sets its class to `infix-hardware:modem`, and
-> creating an interface named `wwan0` automatically sets its type to
-> `infix-if-type:modem`.
->
-> **Note:** This inference only works via the CLI.  When configuring
-> over NETCONF or RESTCONF the class and type must be set explicitly.
-
-## Multi-Bearer (Multiple APNs)
-
-Multiple wwan interfaces can reference the same modem component, each
-with a different APN.  Same idea as multi-SSID on a WiFi radio: one
-hardware modem, several independent data connections.
-
-Configure `wwan0` and `wwan1` both pointing to `modem0`:
-
-```
-edit interface wwan0 wwan
-set modem modem0
-set bearer apn internet
-
-edit interface wwan1 wwan
-set modem modem0
-set bearer apn corporate.vpn.apn
-```
-
-## Current Limitations
-
-- The modem must be present at boot.  Hot-plug is not supported.
-- If the modem is absent at boot, and no `probe-timeout` is set, a
-  dummy `wwan0` placeholder is created immediately so IP configuration
-  can proceed.  A reboot is required once the hardware is inserted.
-
-## Supported Modems
-
-Modems exposing a CDC-WDM control interface over USB are supported,
-regardless of physical form factor.  Two protocols are handled by
-ModemManager:
-
-- **MBIM**: Mobile Broadband Interface Model (e.g. Sierra Wireless,
-  Quectel EM06/EM12)
-- **QMI**: Qualcomm MSM Interface (e.g. Sierra Wireless EM7xxx,
-  Quectel EM/RMxxx)
-
-Most 4G/LTE modules (USB dongles, mPCIe cards, M.2 Key-B) use USB on
-the connector even when the slot also carries PCIe lanes.  From Infix's
-view they are all USB modems.  PCIe-only modems (some 5G NR modules)
-are not supported, since the modemd / ModemManager pipeline assumes a
-USB-attached control interface.
-
-## Step-by-step Setup
-
-### 1. Hardware Detection
-
-At first boot, USB modems detected by the kernel are written to
-`/run/system.json` and added as hardware components in the
-factory-default configuration.  Verify the modem appears:
-
-<pre class="cli"><code>admin@example:/> <b>show modem</b>
-──────────────────────────────────────────────────────────────
-<span class="title">Cellular Modems</span>
-NAME    MANUFACTURER  MODEL   STATE       NETWORK  SIGNAL
-modem0  Quectel       EM06-E  registered  lte      good
-──────────────────────────────────────────────────────────────
-<span class="title">SIM Cards</span>
-NAME  SLOT  STATE     OPERATOR
-sim0  1     unlocked  Tele2
-</code></pre>
-
-The `STATE`, `SIM STATE`, and `SIGNAL` columns are color-coded so the
-healthy / attention / problem cases are visible at a glance: green for
-`registered`, `connected`, `unlocked`, `excellent`, `good`; yellow for
-transient or attention states like `enabling`, `pin-required`, `poor`;
-red for `failed`, `not-inserted`, `bad`.
-
-If `modem0` does not appear:
-
-- Verify the kernel sees the modem (`dmesg | grep -i mbim` or
-  `dmesg | grep -i qmi`).  Without a kernel driver no further setup
-  is possible.
-- On boards with a custom factory configuration, or after replacing
-  hardware on a running system, the components may need to be added
-  manually.  See Step 2.
-
-### 2. Hardware Components
-
-If `show modem` already lists `modem0` and `sim0`, the components were
-auto-discovered into the factory-default configuration and you can skip
-ahead to Step 3.
-
-Otherwise, add them manually.  The class is inferred from the component
-name (`modemN` → `infix-hardware:modem`, `simN` → `infix-hardware:sim`).
-The `admin-state` must be set explicitly.  There is no implicit default,
-and without `unlocked` confd will not start ModemManager or modemd:
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit hardware component modem0</b>
-admin@example:/config/hardware/component/modem0/> <b>set state admin-state unlocked</b>
-admin@example:/config/hardware/component/modem0/> <b>end</b>
-admin@example:/config/hardware/> <b>edit component sim0</b>
-admin@example:/config/hardware/component/sim0/> <b>set state admin-state unlocked</b>
-admin@example:/config/hardware/component/sim0/> <b>leave</b>
-admin@example:/>
-</code></pre>
-
-To take the modem offline cleanly without removing the configuration,
-set `admin-state locked`.  All related services are stopped and the
-bearer is torn down before the modem goes offline:
-
-<pre class="cli"><code>admin@example:/config/> <b>edit hardware component modem0</b>
-admin@example:/config/hardware/component/modem0/> <b>set state admin-state locked</b>
-admin@example:/config/hardware/component/modem0/> <b>leave</b>
-</code></pre>
-
-#### Slow USB Modems
-
-USB modems can be slow to enumerate at boot.  The kernel wwan interface
-may not appear until several seconds after confd starts applying
-configuration.  The `probe-timeout` leaf inside the `modem` hardware
-configuration container controls how long confd waits.  It defaults to
-30 seconds when the container is present.
-
-To enable the timeout, create the modem configuration container (this
-also lets you configure bands, preferred mode, etc.):
-
-<pre class="cli"><code>admin@example:/config/> <b>edit hardware component modem0 modem</b>
-admin@example:/config/hardware/component/modem0/modem/> <b>leave</b>
-</code></pre>
-
-With `probe-timeout` at its default of 30, confd waits up to 30 seconds
-for the wwan interface to appear before proceeding.  For most modems it
-is ready in 2-5 seconds.  If the modem has not appeared within the
-timeout, a dummy placeholder interface is created and a reboot is
-required for the real interface to take over.  Set `probe-timeout 0`
-to disable waiting entirely.
-
-> [!NOTE]
-> Some Quectel modules (e.g. EM05) re-enumerate the USB device several
-> times during a cold-boot firmware-init sequence that takes around 50
-> to 60 seconds.  Bump `probe-timeout` to 90 for those, otherwise the
-> dummy placeholder fires before the modem settles and the real
-> interface ends up with a different name (`wwan1` instead of `wwan0`).
-
-### 3. Configure the Bearer (APN)
-
-Bearer configuration lives on the `wwan0` interface.  Reference the
-modem hardware component and set the APN:
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit interface wwan0</b>
-admin@example:/config/interface/wwan0/> <b>set wwan modem modem0</b>
-admin@example:/config/interface/wwan0/> <b>set wwan sim sim0</b>
-admin@example:/config/interface/wwan0/> <b>set wwan bearer apn internet</b>
-admin@example:/config/interface/wwan0/> <b>leave</b>
-</code></pre>
-
-The modem will connect automatically once the bearer is configured and
-the hardware is unlocked.
-
-**Key bearer parameters:**
-
-- `apn`: Access Point Name, required, provided by your operator
-  (e.g. `internet`, `data.vodafone.com`, `web.tele2.se`)
-- `route-preference`: Administrative distance for the default route
-  (default: `200`).  Higher value = lower priority.  The default of 200
-  places cellular behind wired Ethernet (distance 5) and WiFi, so
-  cellular acts as a failover when the wired link is up
-- `roaming`: Allow data when roaming on a foreign network
-  (default: `false`)
-- `ip-type`: `ipv4`, `ipv6`, or `ipv4v6` dual-stack
-  (default: `ipv4v6`)
-
-### 4. Configure Authentication
-
-Most consumer APNs connect without credentials.  If your operator
-requires authentication, first store the password in the keystore, then
-reference it from the bearer.
-
-Create the keystore entry for the APN password:
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit keystore symmetric-key apn-pass</b>
-admin@example:/config/keystore/…/apn-pass/> <b>set key-format passphrase-key-format</b>
-admin@example:/config/keystore/…/apn-pass/> <b>change cleartext-symmetric-key</b>
-Passphrase: ************
-Retype passphrase: ************
-admin@example:/config/keystore/…/apn-pass/> <b>leave</b>
-</code></pre>
-
-Then point the bearer's authentication at it:
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit interface wwan0 wwan bearer</b>
-admin@example:/config/interface/wwan0/wwan/bearer/> <b>set authentication username myuser</b>
-admin@example:/config/interface/wwan0/wwan/bearer/> <b>set authentication password apn-pass</b>
-admin@example:/config/interface/wwan0/wwan/bearer/> <b>leave</b>
-</code></pre>
-
-Setting any leaf inside `authentication` creates the container, which
-enables authentication.  The `password` leaf is a reference to a
-symmetric key in the keystore, not the plaintext password itself.
-
-The authentication protocol defaults to `chap`.  To use PAP instead:
-
-<pre class="cli"><code>admin@example:/config/interface/wwan0/wwan/bearer/> <b>set authentication type pap</b>
-</code></pre>
-
-### 5. Configure SIM PIN
-
-If the SIM requires a PIN to unlock, configure it on the SIM hardware
-component:
-
-<pre class="cli"><code>admin@example:/config/> <b>edit hardware component sim0</b>
-admin@example:/config/hardware/component/sim0/> <b>set sim pin 1234</b>
-admin@example:/config/hardware/component/sim0/> <b>leave</b>
-</code></pre>
-
-### 6. Verify Connectivity
-
-Once connected, the `wwan0` interface receives an IP address from the
-carrier and modemd installs the default route:
-
-<pre class="cli"><code>admin@example:/> <b>show interface wwan0</b>
-name                : wwan0
-type                : modem
-index               : 5
-mtu                 : 1500
-operational status  : up
-ip forwarding       : enabled
-physical address    : 12:34:56:78:9a:bc
-ipv4 addresses      : 10.142.87.33/30 (wwan)
-ipv6 addresses      : 2001:db8:1:2::1/64 (wwan)
-in-octets           : 84213
-out-octets          : 31456
-</code></pre>
-
-Check the full modem state including signal quality and registration:
-
-<pre class="cli"><code>admin@example:/> <b>show modem modem0</b>
-<span class="header">MODEM: modem0                                                 </span>
-──────────────────────────────────────────────────────────────
-<span class="title">Hardware Information</span>
-  Manufacturer        : Quectel
-  Model               : EM06-E
-  Firmware Version    : EM06ELAR04A07M4G
-  Serial Number       : 352753090141905
-  IMSI                : 240021234567890
-  ICCID               : 8946020000001234567
-──────────────────────────────────────────────────────────────
-<span class="title">Status</span>
-  State               : connected
-  Power State         : on
-  Signal              : Quality: 72% good  RSSI: -59 dBm  RSRP: -95 dBm  RSRQ: -11.0 dB
-──────────────────────────────────────────────────────────────
-<span class="title">Cellular</span>
-  Registration        : home
-  Service State       : attached
-  Operator            : Tele2
-  Operator ID         : 23002
-  Network Type        : lte
-──────────────────────────────────────────────────────────────
-<span class="title">SIM Card</span>
-  Name                : sim0
-  Slot                : 1
-  Lock State          : unlocked
-  Operator            : Tele2
-</code></pre>
-
-When the modem is in trouble, the same view shows why.  A
-`State: failed` line is followed by `Failed Reason` (e.g.
-`sim-missing`), and the `SIM Card` section's `Lock State` reads
-`not-inserted` or `pin-required` to match.
-
-## Cellular Failover
-
-The default `route-preference` (200) is deliberately higher than the
-distances used by wired Ethernet (udhcpc default: 5) and WiFi.  When a
-wired link is up it takes precedence automatically; cellular becomes
-the active path only if higher-priority routes are withdrawn.
-
-A default route via the bearer is always installed when the bearer
-connects.  To adjust the failover priority between two cellular modems,
-or to prefer cellular over WiFi, set `route-preference` explicitly:
-
-<pre class="cli"><code>admin@example:/config/> <b>edit interface wwan0 wwan bearer</b>
-admin@example:/config/interface/wwan0/wwan/bearer/> <b>set route-preference 100</b>
-admin@example:/config/interface/wwan0/wwan/bearer/> <b>leave</b>
-</code></pre>
-
-Lower `route-preference` = higher priority.
-
-## Roaming
-
-Data roaming is disabled by default.  To allow the modem to connect
-when on a foreign (roaming) network:
-
-<pre class="cli"><code>admin@example:/config/> <b>edit interface wwan0 wwan bearer</b>
-admin@example:/config/interface/wwan0/wwan/bearer/> <b>set roaming true</b>
-admin@example:/config/interface/wwan0/wwan/bearer/> <b>leave</b>
-</code></pre>
-
-> [!IMPORTANT]
-> Enabling roaming may incur significant charges depending on your
-> mobile subscription.  Check with your operator before enabling.
-
-## Management Commands
-
-### Restart Bearer
-
-Disconnect and reconnect all bearers without resetting the modem
-hardware.  Use this after changing APN or authentication settings:
-
-<pre class="cli"><code>admin@example:/> <b>modem restart modem0</b>
-</code></pre>
-
-### Reset Modem
-
-Factory-reset the modem firmware.  This clears all modem-internal
-settings and takes longer than a restart.  Only use it if the modem is
-in a bad state that a bearer restart cannot fix:
-
-<pre class="cli"><code>admin@example:/> <b>modem reset modem0</b>
-</code></pre>
-
-> [!NOTE]
-> Not all modules accept `--reset` from ModemManager.  Quectel EM05,
-> for example, rejects both `--reset` and `--factory-reset`.  The only
-> way to recover from a hung firmware on these is a physical power
-> cycle.  When the modem reports the rejection, modemd logs it once and
-> stops retrying.
-
-### Send SMS
-
-Send an SMS message via the signalling plane.  No active data bearer
-is required; the modem only needs to be registered on the network:
-
-<pre class="cli"><code>admin@example:/> <b>modem sms modem0 +46701234567 "Hello from Infix"</b>
-</code></pre>
-
-> [!NOTE]
-> Some SIM cards have Fixed Dialing Number (FDN) enabled, which
-> restricts outgoing SMS and calls to a pre-configured whitelist.  If
-> `modem sms` fails, check whether FDN is active with `mmcli -m 0` and
-> look for `enabled locks: fixed-dialing` in the output.
-
-## Troubleshooting
-
-**Modem not detected (`show modem` shows no modem entry)**
-
-- Verify the modem is connected and recognized by the kernel: check
-  `dmesg` for `cdc_mbim` or `qmi_wwan` driver messages
-- Confirm `/sys/class/usbmisc/` contains a `cdc-wdm*` entry
-- The modem must be present at boot; hotplug after boot is not
-  supported
-
-**`wwan0` shows as `down` or has no IP address**
-
-- Check `show modem modem0`.  The State should show `registered` or
-  `connected`, not `failed`
-- If the State is `failed`, look at the `Failed Reason` line that
-  immediately follows:
-    - `sim-missing`: the SIM Card section will also show
-      `Lock State: not-inserted`.  Power off the device, insert the
-      SIM, power back on.  A warm reboot is not enough; on most M.2
-      slots the SIM tray stays powered through reboot, so the modem
-      keeps the original not-inserted reading
-    - `unlock-required`: the SIM Card section will show
-      `Lock State: pin-required`.  Configure the PIN with
-      `set hardware component sim0 sim pin <code>`
-    - `sim-wrong` / `sim-error`: the SIM is not compatible or is
-      damaged.  Try a different SIM
-- Verify the APN is correct for your operator
-- Check system logs with `show log` for modemd or ModemManager
-  messages
-
-**`wwan0` interface is a dummy (no data flows, no carrier address)**
-
-- The modem was not enumerated by the kernel before confd applied
-  config
-- Create the modem hardware configuration container (see Step 2),
-  which enables the default 30-second probe-timeout so confd waits for
-  the wwan interface before falling back to a dummy placeholder
-
-**High latency or poor signal**
-
-- Use `show modem modem0` to check signal quality and RSRP
-- Signal below -110 dBm RSRP typically indicates poor coverage
-- Consider repositioning the antenna or the device

doc/test-arch.md

@@ -297,6 +297,36 @@ image.  The device will boot into test mode on first power-on.
 > unless `startup_override()` is called first (or the marker is removed
 > and a normal startup config is saved).
 
+Simulated Wi-Fi
+---------------
+
+The virtual topology has no real radios, so Wi-Fi tests run against
+`mac80211_hwsim` devices and the "air" between guests is faked.  A small
+relay, `wifimedium` (`package/feature-wifi/wifimedium`), takes every frame
+a radio transmits, forwards it to the other guests, and injects what
+arrives back into the local radios.
+
+Each radio (`radio0`, `radio1`, ...) is paired with a carrier NIC of the
+same name, and that carrier joins the multicast group (a *cell*) the
+topology wires it to.  Two radios hear each other only when their carriers
+share a cell.  Radios on the same cell that tune to different channels are
+still kept apart, as on real hardware.
+
+By convention the two general cells carry `radio0` and `radio1` across all
+DUTs, so most tests put communicating radios on the same index: a station
+joins an AP on the same `radioN`.  The mesh-roaming test, for instance,
+uses `radio1` for both the gateway APs and the client.  That is only a
+convention, though.  A cell can carry any set of radios, including two of
+the *same* DUT.  The band-steering test relies on that: it wires one DUT's
+`radio2` (2.4GHz) and `radio3` (5GHz) onto a dedicated cell so a single
+client radio hears the same SSID on both bands.
+
+How many radios each DUT gets depends on the topology.  The number of
+`radioN` ports wired to a node is passed in via the `opt/wifi` fw_cfg and
+loaded at boot by the `00-hwsim` script, so a node with no wifi links has
+no radios at all.  The wiring for the standard suite lives in
+`test/virt/quad`.
+
 [9PM]:    https://github.com/rical/9pm
 [Qeneth]: https://github.com/wkz/qeneth
 [TAP]:    https://testanything.org/

doc/wifi.md

@@ -304,6 +304,7 @@ in-octets          : 148388
 out-octets         : 24555
 mode               : station
 ssid               : MyNetwork
+bssid              : b4:fb:e4:17:b6:a7
 signal             : -45 dBm (good)
 rx bitrate         : 72.2 Mbps
 tx bitrate         : 86.6 Mbps
@@ -319,6 +320,11 @@ In the CLI, signal strength is reported as: excellent, good, fair or bad.
 For precise signal strength values in dBm, use NETCONF or RESTCONF to access
 the `signal-strength` leaf in the operational datastore.
 
+When connected, `bssid` shows the MAC address of the access point the
+station is associated to.  It appears only while connected.  When several
+access points share one SSID (a roaming network), the `bssid` is what
+tells them apart, and it changes as the station roams between them.
+
 ## Passphrase Requirements
 
 To ensure your connection is secure and compatible with all network
@@ -378,6 +384,7 @@ operational status : up
 physical address   : f0:09:0d:36:5f:86
 mode               : station
 ssid               : MyHomeNetwork
+bssid              : b4:fb:e4:17:b6:a7
 signal             : -52 dBm (good)
 </code></pre>
 

infix.mk

@@ -4,10 +4,12 @@ oem-dir := $(call qstrip,$(INFIX_OEM_PATH))
 INFIX_TOPDIR = $(if $(oem-dir),$(oem-dir),$(BR2_EXTERNAL_INFIX_PATH))
 
 # Unless the user specifies an explicit build id, source it from git.
-# The build id also becomes the image version, unless an official
-# release is being built.
-export INFIX_BUILD_ID ?= $(shell git -C $(INFIX_TOPDIR) describe --dirty --always --tags)
-export INFIX_VERSION = $(if $(INFIX_RELEASE),$(INFIX_RELEASE),$(INFIX_BUILD_ID))
+# Exclude the moving 'latest*' tags so the version always resolves to a
+# real release tag, see issue #1524.  The build id is also the version
+# shown to users; INFIX_RELEASE only labels the release channel and names
+# artifacts (see INFIX_ARTIFACT below).
+export INFIX_BUILD_ID ?= $(shell git -C $(INFIX_TOPDIR) describe --dirty --always --tags --exclude 'latest*')
+export INFIX_VERSION = $(INFIX_BUILD_ID)
 export INFIX_ARTIFACT = $(call qstrip,$(INFIX_IMAGE_ID)$(if $(INFIX_RELEASE),-$(INFIX_RELEASE)))
 
 INFIX_CFLAGS:=-Wall -Werror -Wextra -Wno-unused-parameter -Wformat=2 -Wformat-overflow=2 -Winit-self -Wstrict-overflow=4 -Wno-format-truncation -Wno-format-nonliteral

mkdocs.yml

@@ -44,7 +44,6 @@ nav:
           - Overview: vpn.md
           - WireGuard: vpn-wireguard.md
       - Wireless LAN (WiFi): wifi.md
-      - Cellular Modem (wwan): modem.md
   - Services:
       - Device Discovery: discovery.md
       - DHCP Server: dhcp.md

package/Config.in

@@ -2,7 +2,6 @@ menu "Packages"
 
 comment "Hardware Support"
 source "$BR2_EXTERNAL_INFIX_PATH/package/feature-gps/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/feature-modem/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/feature-wifi/Config.in"
 
 comment "Software Packages"
@@ -31,7 +30,6 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/landing/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/libsrx/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/lowdown/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/mcd/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/modemd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/mdns-alias/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/netbrowse/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/onieprom/Config.in"
@@ -44,6 +42,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/tetris/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/libyang-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/webui/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rauc-installation-status/Config.in"

package/confd/confd.conf

@@ -1,9 +1,11 @@
+#set DEBUG=1
+
 # Single daemon handles gen-config, datastore init, config load, and plugins
-service log:console env:/etc/default/confd        \
+#  log:prio:daemon.err
+service log:console env:/etc/default/confd           \
 	[S12345] <usr/ixinit> confd -f -v warning \
-		-F /etc/factory-config.cfg        \
-		-S /cfg/startup-config.cfg        \
-		-E /etc/failure-config.cfg        \
-		-t $CONFD_TIMEOUT                 \
-		$CONFD_ARGS                       \
+		-F /etc/factory-config.cfg \
+		-S /cfg/startup-config.cfg \
+		-E /etc/failure-config.cfg \
+		-t $CONFD_TIMEOUT \
 	-- Configuration daemon

package/confd/confd.mk

@@ -36,8 +36,10 @@ else
 CONFD_CONF_OPTS += --disable-gps
 endif
 define CONFD_INSTALL_EXTRA
-	for fn in confd.conf resolvconf.conf; do \
+	for fn in confd.conf crond.conf resolvconf.conf; do \
 		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
+	done
+	for fn in confd.conf resolvconf.conf; do \
 		ln -sf ../available/$$fn $(FINIT_D)/enabled/$$fn; \
 	done
 	cp $(CONFD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/etc/tmpfiles.d/confd.conf
@@ -91,10 +93,10 @@ define CONFD_INSTALL_YANG_MODULES_GPS
 	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/gps.inc
 endef
 endif
-ifeq ($(BR2_PACKAGE_FEATURE_MODEM),y)
-define CONFD_INSTALL_YANG_MODULES_MODEM
+ifeq ($(BR2_PACKAGE_WEBUI),y)
+define CONFD_INSTALL_YANG_MODULES_WEBUI
 	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/modem.inc
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/web.inc
 endef
 endif
 
@@ -127,7 +129,7 @@ CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WIFI
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_GPS
-CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_MODEM
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WEBUI
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_IN_ROMFS
 CONFD_TARGET_FINALIZE_HOOKS += CONFD_CLEANUP
 

package/confd/crond.conf

@@ -0,0 +1,2 @@
+# Cron daemon for infix-schedule
+service [2345] crond -f -- Cron daemon

package/feature-modem/Config.in

@@ -1,25 +0,0 @@
-config BR2_PACKAGE_FEATURE_MODEM
-	bool "Feature Modem"
-	select BR2_PACKAGE_MODEMD
-	select BR2_PACKAGE_MODEM_MANAGER
-	select BR2_PACKAGE_MODEM_MANAGER_ATVIADBUS
-	select BR2_PACKAGE_MODEM_MANAGER_LIBMBIM
-	select BR2_PACKAGE_MODEM_MANAGER_LIBQMI
-	select BR2_PACKAGE_MODEM_MANAGER_LIBQRTR
-	help
-	  Enables cellular modem support in Infix via ModemManager and
-	  the modemd management daemon.  Includes drivers for common
-	  USB option modems and QMI/MBIM-based devices.
-
-	  ATVIADBUS allows raw AT commands over D-Bus (used by modemd to
-	  enable GPS NMEA output via vendor-specific AT commands such as
-	  AT+QGPS=1) without needing to start ModemManager in --debug
-	  mode.
-
-config BR2_PACKAGE_FEATURE_MODEM_QUALCOMM
-	bool "Qualcomm-based modems (QMI/QRTR/MHI)"
-	depends on BR2_PACKAGE_FEATURE_MODEM
-	help
-	  Adds kernel support for Qualcomm-based cellular modems that use
-	  the MHI bus and QRTR IPC router (e.g. Sierra Wireless EM7xxx,
-	  Quectel EM/RMxxx, Telit LN9xx).

package/feature-modem/feature-modem.mk

@@ -1,26 +0,0 @@
-################################################################################
-#
-# Cellular modem support
-#
-################################################################################
-
-FEATURE_MODEM_PACKAGE_VERSION = 1.0
-FEATURE_MODEM_PACKAGE_LICENSE = MIT
-
-define FEATURE_MODEM_LINUX_CONFIG_FIXUPS
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_SERIAL)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_SERIAL_WWAN)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_SERIAL_OPTION)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_WDM)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_NET_QMI_WWAN)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_CDC_MBIM)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_NET_CDC_MBIM)
-
-	$(if $(filter y,$(BR2_PACKAGE_FEATURE_MODEM_QUALCOMM)),
-		$(call KCONFIG_SET_OPT,CONFIG_QRTR,m)
-		$(call KCONFIG_SET_OPT,CONFIG_MHI_BUS,m)
-		$(call KCONFIG_ENABLE_OPT,CONFIG_QRTR_MHI)
-	)
-endef
-
-$(eval $(generic-package))

package/feature-wifi/00-hwsim

@@ -0,0 +1,47 @@
+#!/bin/sh
+# Load mac80211_hwsim virtual radios sized to this DUT's topology, then wait
+# for udev to rename the phys (phyN -> radioN) before returning.
+#
+# The radio count comes from a dedicated fw_cfg file (opt/wifi) that qeneth
+# writes per node from the number of radioN carrier ports the topology wired
+# to it.  A node with no wifi links gets 0 (or no file), so hwsim is not loaded
+# at all -- no phys, nothing clutters its interface view.
+#
+# Runs early in ixinit, before 00-probe, so the system probe records the radios
+# by their final radioN names.  ixinit is past the <pid/syslogd> / udev-settle
+# barrier, so 60-rename-wifi-phy.rules (phyN -> radioN) and
+# 70-remove-virtual-wifi-interfaces.rules (drop the stray wlanN) are loaded and
+# fire on the phy add events.  On success it sets the <usr/hwsim> condition so
+# wifimedium starts only where radios exist.  Installed only with
+# BR2_PACKAGE_FEATURE_WIFI_HWSIM.
+
+wifi=/sys/firmware/qemu_fw_cfg/by_name/opt/wifi/raw
+ieee=/sys/class/ieee80211
+
+# Number of radios to create, from the topology (via fw_cfg).
+radios=0
+[ -r "$wifi" ] && radios=$(cat "$wifi" 2>/dev/null)
+
+# No radios wanted -> don't load hwsim, keep the view wifi-free.
+[ "$radios" -gt 0 ] 2>/dev/null || exit 0
+
+modprobe mac80211_hwsim radios="$radios" || exit 0
+
+# Wait (bounded ~10s) for the phyN -> radioN rename to finish: the class has
+# entries and none are still named phyN.  The rename is a udev RUN, so it lags
+# modprobe's return.  On timeout the radios never settled -- fail (and log) so
+# it is visible why 00-probe may record stale phyN names.
+TIMEOUT=100
+i=0
+while [ "$i" -lt "$TIMEOUT" ]; do
+	names=$(ls "$ieee" 2>/dev/null)
+	if [ -n "$names" ] && ! echo "$names" | grep -q '^phy'; then
+		initctl -bq cond set hwsim
+		exit 0
+	fi
+	i=$((i + 1))
+	sleep 0.1
+done
+
+logger -p user.err -t 00-hwsim "timed out waiting for hwsim phys to be renamed radioN"
+exit 1

package/feature-wifi/Config.in

@@ -18,6 +18,18 @@ config BR2_PACKAGE_FEATURE_WIFI
 	help
 	  Enables WiFi in Infix. Enables all requried applications.
 
+config BR2_PACKAGE_FEATURE_WIFI_HWSIM
+	bool "Virtual Wi-Fi radios (mac80211_hwsim)"
+	depends on BR2_PACKAGE_FEATURE_WIFI
+	help
+	  Build the mac80211_hwsim virtual radio driver (as a module) for the
+	  QEMU test target, to exercise AP, station, and mesh modes without
+	  physical WiFi adapters. The module is autoloaded at boot (see the
+	  x86_64 /etc/modules-load.d) and frames are bridged between guests by
+	  the wifimedium relay.
+
+	  Leave disabled on real hardware; it only provides simulated radios.
+
 config BR2_PACKAGE_FEATURE_WIFI_MEDIATEK
        bool "Mediatek WiFi Devices"
        depends on BR2_PACKAGE_FEATURE_WIFI

package/feature-wifi/feature-wifi.mk

@@ -14,6 +14,15 @@ define FEATURE_WIFI_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_CFG80211,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MAC80211_MESH)
 
+	# Virtual radio for automated testing (mac80211_hwsim), built as a
+	# module and gated behind BR2_PACKAGE_FEATURE_WIFI_HWSIM so it is not
+	# built on real boards.  When selected, the module is loaded early in
+	# ixinit by 00-hwsim -- sized to the DUT's topology, so radio-less nodes
+	# load nothing -- and bridged between QEMU guests by the wifimedium relay
+	# (both installed by FEATURE_WIFI_INSTALL_HWSIM below).
+	$(if $(BR2_PACKAGE_FEATURE_WIFI_HWSIM),
+		$(call KCONFIG_SET_OPT,CONFIG_MAC80211_HWSIM,m))
+
 	$(if $(filter y,$(BR2_PACKAGE_FEATURE_WIFI_MEDIATEK)),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_MT7601U)
 		$(call KCONFIG_ENABLE_OPT,CONFIG_MT76x0U)
@@ -76,5 +85,20 @@ define FEATURE_WIFI_INSTALL_IN_ROMFS
 endef
 FEATURE_WIFI_POST_INSTALL_TARGET_HOOKS += FEATURE_WIFI_INSTALL_IN_ROMFS
 
+# Virtual-radio (mac80211_hwsim) runtime, installed only when the option is
+# selected: the 00-hwsim ixinit script loads the module sized to the opt/wifi
+# fw_cfg qeneth writes per node (no radios -> not loaded), and the wifimedium
+# relay + its Finit service bridge hwsim frames between QEMU guests so they can
+# associate "wirelessly".
+ifeq ($(BR2_PACKAGE_FEATURE_WIFI_HWSIM),y)
+define FEATURE_WIFI_INSTALL_HWSIM
+	$(INSTALL) -D -m 0755 $(FEATURE_WIFI_PKGDIR)/00-hwsim $(TARGET_DIR)/usr/libexec/infix/init.d/00-hwsim
+	$(INSTALL) -D -m 0755 $(FEATURE_WIFI_PKGDIR)/wifimedium $(TARGET_DIR)/usr/libexec/infix/wifimedium
+	$(INSTALL) -D -m 0644 $(FEATURE_WIFI_PKGDIR)/wifimedium.conf $(TARGET_DIR)/etc/finit.d/available/wifimedium.conf
+	ln -sf ../available/wifimedium.conf $(TARGET_DIR)/etc/finit.d/enabled/wifimedium.conf
+endef
+FEATURE_WIFI_POST_INSTALL_TARGET_HOOKS += FEATURE_WIFI_INSTALL_HWSIM
+endif
+
 
 $(eval $(generic-package))

package/feature-wifi/wifimedium

@@ -0,0 +1,401 @@
+#!/usr/bin/env python3
+"""wifimedium - a virtual WiFi medium for mac80211_hwsim, extended over Ethernet.
+
+mac80211_hwsim simulates 802.11 radios in software.  By default all radios in
+one kernel share an in-kernel medium; radios in *different* kernels (i.e.
+different QEMU guests) cannot hear each other.  The moment a userspace process
+registers on the hwsim generic-netlink family, the kernel stops delivering
+frames itself and hands every transmitted frame to that process, which becomes
+responsible for delivery.
+
+This daemon is that process.  On each DUT it:
+
+  * registers on the "mac80211_hwsim" genl family and receives every frame the
+    local radios transmit (HWSIM_CMD_FRAME),
+  * acknowledges each transmit back to the kernel (HWSIM_CMD_TX_INFO_FRAME) so
+    mac80211's TX path completes, and
+  * relays the frame per radio: each radio (phy radioN) is paired by name with a
+    carrier NIC (netdev radioN) that joins one multicast "cell" -- a QEMU socket
+    multicast group shared by every DUT's radioN (see test/virt/quad and
+    test/qeneth).  A radio's frame is sent only onto its own carrier, and a
+    carrier's frames are injected only into its own radio
+    (HWSIM_CMD_FRAME with HWSIM_ATTR_ADDR_RECEIVER).
+
+Each cell is a shared medium: every DUT's radioN is "in range" of every other
+radioN.  Radios on different indices are on different cells, so two radios
+communicate only if they share an index -- the convention the test topologies
+follow (a station uses the same radio index as the AP it joins).  Channel
+filtering in mac80211 still separates radios that share a cell but tune to
+different frequencies.
+
+This is intended for the QEMU/qeneth test topology only.  On real hardware the
+radios use the air, there are no radioN carrier netdevs, and this daemon idles.
+See doc/wifi.md.
+"""
+import os
+import socket
+import struct
+import time
+import subprocess
+import sys
+import select
+
+# ---- generic netlink / hwsim ABI (drivers/net/wireless/virtual/mac80211_hwsim.h)
+NETLINK_GENERIC = 16
+GENL_ID_CTRL = 16
+CTRL_CMD_GETFAMILY = 3
+CTRL_ATTR_FAMILY_ID = 1
+CTRL_ATTR_FAMILY_NAME = 2
+CTRL_ATTR_MCAST_GROUPS = 7
+CTRL_ATTR_MCAST_GRP_NAME = 1
+CTRL_ATTR_MCAST_GRP_ID = 2
+
+SOL_NETLINK = 270
+NETLINK_ADD_MEMBERSHIP = 1
+
+HWSIM_CMD_REGISTER = 1
+HWSIM_CMD_FRAME = 2
+HWSIM_CMD_TX_INFO_FRAME = 3
+
+HWSIM_ATTR_ADDR_RECEIVER = 1
+HWSIM_ATTR_ADDR_TRANSMITTER = 2
+HWSIM_ATTR_FRAME = 3
+HWSIM_ATTR_FLAGS = 4
+HWSIM_ATTR_RX_RATE = 5
+HWSIM_ATTR_SIGNAL = 6
+HWSIM_ATTR_TX_INFO = 7
+HWSIM_ATTR_COOKIE = 8
+HWSIM_ATTR_FREQ = 19
+HWSIM_ATTR_TX_INFO_FLAGS = 21
+
+HWSIM_TX_STAT_ACK = 1 << 2
+
+# Signal/rate reported for injected (received) frames.  A strong, fixed signal
+# keeps mac80211 happy; the exact value is not significant for a virtual cell.
+RX_SIGNAL = -30
+RX_RATE = 0
+
+# The medium is carried as raw Ethernet frames with a custom EtherType on the
+# configured interface -- no IP addressing needed (the carrier link has none).
+# A broadcast destination means every DUT on the segment is "in range".
+ETH_P_WIFIMEDIUM = 0x88B5         # local-experimental EtherType
+ETH_BROADCAST = b"\xff\xff\xff\xff\xff\xff"
+ETYPE = struct.pack("!H", ETH_P_WIFIMEDIUM)
+SOL_PACKET = 263
+PACKET_IGNORE_OUTGOING = 23       # don't deliver our own TX back to the socket
+
+NLMSG_HDR = struct.Struct("=IHHII")     # len, type, flags, seq, pid
+GENL_HDR = struct.Struct("=BBH")        # cmd, version, reserved
+
+
+DEBUG = bool(os.environ.get("WIFIMEDIUM_DEBUG"))
+
+
+def log(msg):
+    sys.stderr.write(f"wifimedium: {msg}\n")
+    sys.stderr.flush()
+
+
+def dbg(msg):
+    if DEBUG:
+        log(msg)
+
+
+def nla_align(n):
+    return (n + 3) & ~3
+
+
+def put_attr(atype, payload):
+    hdr = struct.pack("=HH", len(payload) + 4, atype)
+    return hdr + payload + b"\0" * (nla_align(len(payload) + 4) - (len(payload) + 4))
+
+
+def parse_attrs(buf):
+    attrs = {}
+    off = 0
+    while off + 4 <= len(buf):
+        alen, atype = struct.unpack_from("=HH", buf, off)
+        if alen < 4:
+            break
+        attrs[atype & 0x7fff] = buf[off + 4:off + alen]
+        off += nla_align(alen)
+    return attrs
+
+
+class Netlink:
+    """Minimal generic-netlink client for the hwsim family."""
+
+    def __init__(self):
+        self.sock = socket.socket(socket.AF_NETLINK, socket.SOCK_RAW, NETLINK_GENERIC)
+        self.sock.bind((0, 0))
+        self.seq = 0
+        # NB: the genl family is "MAC80211_HWSIM" (uppercase); the lowercase
+        # "mac80211_hwsim" is the platform driver name, not the family.
+        self.family_id, self.mcast_id = self._resolve("MAC80211_HWSIM", "config")
+
+    def fileno(self):
+        return self.sock.fileno()
+
+    def _send(self, family_id, cmd, attrs=b"", flags=0):
+        self.seq += 1
+        payload = GENL_HDR.pack(cmd, 1, 0) + attrs
+        msg = NLMSG_HDR.pack(NLMSG_HDR.size + len(payload), family_id,
+                             flags | 1, self.seq, 0) + payload  # NLM_F_REQUEST
+        self.sock.send(msg)
+
+    def _resolve(self, name, grpname):
+        self._send(GENL_ID_CTRL, CTRL_CMD_GETFAMILY,
+                   put_attr(CTRL_ATTR_FAMILY_NAME, name.encode() + b"\0"))
+        data = self.sock.recv(65536)
+        _, mtype, _, _, _ = NLMSG_HDR.unpack_from(data, 0)
+        if mtype == 2:  # NLMSG_ERROR (also used for ACKs; err<0 is a failure)
+            err = struct.unpack_from("=i", data, NLMSG_HDR.size)[0]
+            raise RuntimeError(f"genl GETFAMILY({name}) failed: "
+                               f"{os.strerror(-err) if err else 'empty reply'}")
+        attrs = parse_attrs(data[NLMSG_HDR.size + GENL_HDR.size:])
+        family_id = struct.unpack("=H", attrs[CTRL_ATTR_FAMILY_ID][:2])[0]
+
+        mcast_id = None
+        for _, grp in _parse_nested(attrs.get(CTRL_ATTR_MCAST_GROUPS, b"")):
+            gattrs = parse_attrs(grp)
+            gname = gattrs.get(CTRL_ATTR_MCAST_GRP_NAME, b"").rstrip(b"\0").decode()
+            if gname == grpname:
+                mcast_id = struct.unpack("=I", gattrs[CTRL_ATTR_MCAST_GRP_ID])[0]
+        if mcast_id is None:
+            raise RuntimeError(f"hwsim multicast group '{grpname}' not found")
+        return family_id, mcast_id
+
+    def register(self):
+        self.sock.setsockopt(SOL_NETLINK, NETLINK_ADD_MEMBERSHIP, self.mcast_id)
+        self._send(self.family_id, HWSIM_CMD_REGISTER)
+
+    def recv(self):
+        return self.sock.recv(65536)
+
+    def inject(self, receiver, frame, freq):
+        attrs = put_attr(HWSIM_ATTR_ADDR_RECEIVER, receiver)
+        attrs += put_attr(HWSIM_ATTR_FRAME, frame)
+        attrs += put_attr(HWSIM_ATTR_RX_RATE, struct.pack("=I", RX_RATE))
+        attrs += put_attr(HWSIM_ATTR_SIGNAL, struct.pack("=i", RX_SIGNAL))
+        if freq:
+            attrs += put_attr(HWSIM_ATTR_FREQ, struct.pack("=I", freq))
+        self._send(self.family_id, HWSIM_CMD_FRAME, attrs)
+
+    def tx_ack(self, transmitter, flags, tx_info, tx_info_flags, cookie):
+        attrs = put_attr(HWSIM_ATTR_ADDR_TRANSMITTER, transmitter)
+        attrs += put_attr(HWSIM_ATTR_FLAGS, struct.pack("=I", flags | HWSIM_TX_STAT_ACK))
+        attrs += put_attr(HWSIM_ATTR_SIGNAL, struct.pack("=i", RX_SIGNAL))
+        if tx_info:
+            attrs += put_attr(HWSIM_ATTR_TX_INFO, tx_info)
+        if tx_info_flags:
+            attrs += put_attr(HWSIM_ATTR_TX_INFO_FLAGS, tx_info_flags)
+        if cookie:
+            attrs += put_attr(HWSIM_ATTR_COOKIE, cookie)
+        self._send(self.family_id, HWSIM_CMD_TX_INFO_FRAME, attrs)
+
+
+def _parse_nested(buf):
+    off = 0
+    while off + 4 <= len(buf):
+        alen, atype = struct.unpack_from("=HH", buf, off)
+        if alen < 4:
+            break
+        yield atype & 0x7fff, buf[off + 4:off + alen]
+        off += nla_align(alen)
+
+
+def radio_addr1(phy):
+    """The address mac80211_hwsim identifies a radio by on the medium.
+
+    A hwsim radio has three addresses (kernel new_radio()).  sysfs 'macaddress'
+    is addresses[0]; the address the kernel stamps as HWSIM_ATTR_ADDR_TRANSMITTER
+    and matches HWSIM_ATTR_ADDR_RECEIVER against (its rhashtable key) is
+    addresses[1] -- addresses[0] with bit 0x40 set in the first octet, for the
+    default no-perm_addr radios we use.  So both the transmitter we observe and
+    the receiver we must inject to are this 0x40 variant, not the sysfs value.
+    (Note custom-phys-address changes the vif/netdev MAC, not these.)
+    """
+    with open(f"/sys/class/ieee80211/{phy}/macaddress") as fh:
+        addr = bytearray.fromhex(fh.read().strip().replace(":", ""))
+    addr[0] |= 0x40
+    return bytes(addr)
+
+
+def open_medium(ifname):
+    """Raw-Ethernet socket on the medium interface, or (None, None).
+
+    Returns (sock, mac); mac is the interface's own (unique) address, used as
+    the Ethernet source and to drop frames we transmitted ourselves -- the
+    multicast cell loops our own frames back to us."""
+    if not ifname:
+        return None, None
+    # The carrier NIC is unconfigured (it is not a real DUT port), so Infix
+    # leaves it administratively down -- a raw packet socket on a down link
+    # carries no frames.  Bring it up; wifimedium owns the medium, like hwsim0.
+    ifup(ifname)
+    sock = socket.socket(socket.AF_PACKET, socket.SOCK_RAW,
+                         socket.htons(ETH_P_WIFIMEDIUM))
+    sock.bind((ifname, ETH_P_WIFIMEDIUM))
+    # Don't receive our own transmitted frames (avoids a self-feedback path
+    # and any reliance on the source MAC, which can collide between guests).
+    try:
+        sock.setsockopt(SOL_PACKET, PACKET_IGNORE_OUTGOING, 1)
+    except OSError:
+        pass  # pre-4.20 kernels; the length check below still applies
+    with open(f"/sys/class/net/{ifname}/address") as fh:
+        mac = bytes.fromhex(fh.read().strip().replace(":", ""))
+    return sock, mac
+
+
+# Wire format on the medium: 6-byte transmitter MAC, 4-byte LE freq, then the
+# raw 802.11 frame.
+WIRE = struct.Struct("=6sI")
+
+
+def wait_radios_renamed(timeout=20):
+    """Wait until the hwsim phys have been renamed phyN -> radioN.
+
+    60-rename-wifi-phy.rules renames each phy *asynchronously* (a udev RUN),
+    and the carrier NICs are already named radioN (mactab/nameif, early boot).
+    We pair phy and carrier by name, so discovering while a phy is still 'phyN'
+    would miss it -- and we discover only once.  This raced our start (gated
+    merely on the module load) and left some boots relaying nothing until a
+    restart.  Block until every phy is renamed (no 'phyN' left) and the set has
+    settled, so discovery sees radioN phys that match the radioN carriers.
+    """
+    base = "/sys/class/ieee80211"
+    prev, stable = None, 0
+    for _ in range(timeout * 4):
+        phys = sorted(os.listdir(base)) if os.path.isdir(base) else []
+        if phys and not any(p.startswith("phy") for p in phys):
+            if phys == prev:
+                stable += 1
+                if stable >= 2:          # unchanged for ~0.5s
+                    return
+            else:
+                stable = 0
+        prev = phys
+        time.sleep(0.25)
+
+
+def discover_radios():
+    """Pair each local hwsim radio with its multicast carrier interface.
+
+    A radio's phy is named radioN (60-rename-wifi-phy.rules) under
+    /sys/class/ieee80211/.  In the qeneth test topology each radio also has a
+    carrier NIC of the SAME name under /sys/class/net/ -- the topology names the
+    port radioN, so the mactab/nameif rename the carrier to match -- joined to
+    one multicast cell shared by every DUT's radioN.  Pairing them by name gives
+    a per-radio relay: a radio's frames go onto its own carrier (its cell) and a
+    carrier's frames are injected only into its own radio.
+
+    Returns a list of {name, addr1, sock, mac}.  A phy with no matching carrier
+    netdev (e.g. real hardware) is skipped, so the daemon simply idles there.
+    """
+    wait_radios_renamed()
+    radios = []
+    base = "/sys/class/ieee80211"
+    if not os.path.isdir(base):
+        return radios
+    for phy in sorted(os.listdir(base)):
+        if not os.path.isdir(f"/sys/class/net/{phy}"):
+            continue          # no carrier of this name -> not a relayed radio
+        sock, mac = open_medium(phy)
+        if sock:
+            radios.append({"name": phy, "addr1": radio_addr1(phy),
+                           "sock": sock, "mac": mac})
+    return radios
+
+
+def ifup(ifname):
+    """Bring an interface up (best effort)."""
+    subprocess.run(["ip", "link", "set", ifname, "up"], check=False)
+
+
+def main():
+    # The hwsim monitor interface is down after boot; bring it up so the
+    # simulated medium is observable (tcpdump -i hwsim0) and active.
+    ifup("hwsim0")
+
+    # Discover carriers first.  With none -- e.g. 'make run', which creates
+    # radios but no inter-guest medium -- registering on the hwsim family would
+    # make the kernel hand us every frame with nowhere to relay it, breaking
+    # delivery between this guest's own radios.  So leave the medium to the
+    # kernel and idle instead of registering.
+    radios = discover_radios()
+    if not radios:
+        log("no radio carriers found; leaving local hwsim medium to the kernel")
+        while True:
+            time.sleep(3600)
+
+    nl = Netlink()
+    nl.register()
+    log(f"registered on hwsim family {nl.family_id}; "
+        f"radios={' '.join(r['name'] for r in radios)}")
+
+    # TX routing: a frame's transmitter (addresses[1]) -> that radio's carrier.
+    by_addr1 = {r["addr1"]: r for r in radios}
+    dbg(f"netlink portid={nl.sock.getsockname()[0]}; "
+        + "; ".join(f"{r['name']} addr1={r['addr1'].hex()} "
+                    f"carrier={r['mac'].hex()}" for r in radios))
+
+    socks = [nl] + [r["sock"] for r in radios]
+    while True:
+        ready, _, _ = select.select(socks, [], [])
+
+        if nl in ready:
+            data = nl.recv()
+            off = 0
+            while off + NLMSG_HDR.size <= len(data):
+                mlen, mtype, _, _, _ = NLMSG_HDR.unpack_from(data, off)
+                if mlen < NLMSG_HDR.size:
+                    break
+                if mtype == nl.family_id and \
+                   data[off + NLMSG_HDR.size] == HWSIM_CMD_FRAME:
+                    a = parse_attrs(data[off + NLMSG_HDR.size + GENL_HDR.size:
+                                         off + mlen])
+                    tx = a.get(HWSIM_ATTR_ADDR_TRANSMITTER)
+                    frame = a.get(HWSIM_ATTR_FRAME)
+                    if tx and frame:
+                        freq = struct.unpack("=I", a[HWSIM_ATTR_FREQ])[0] \
+                            if HWSIM_ATTR_FREQ in a else 0
+                        flags = struct.unpack("=I", a[HWSIM_ATTR_FLAGS])[0] \
+                            if HWSIM_ATTR_FLAGS in a else 0
+                        # Complete the kernel TX path regardless of delivery.
+                        nl.tx_ack(tx, flags, a.get(HWSIM_ATTR_TX_INFO),
+                                  a.get(HWSIM_ATTR_TX_INFO_FLAGS),
+                                  a.get(HWSIM_ATTR_COOKIE))
+                        # Send only onto the transmitting radio's own carrier.
+                        r = by_addr1.get(tx)
+                        if r:
+                            r["sock"].send(ETH_BROADCAST + r["mac"] + ETYPE +
+                                           WIRE.pack(tx, freq) + frame)
+                            dbg(f"tx {r['name']} freq={freq} len={len(frame)}")
+                        else:
+                            dbg(f"tx from unknown radio {tx.hex()} -- dropped")
+                off += nla_align(mlen)
+
+        for r in radios:
+            if r["sock"] not in ready:
+                continue
+            pkt = r["sock"].recv(65536)
+            if len(pkt) < 14 + WIRE.size:
+                continue
+            # The cell multicasts our own frames back to us; PACKET_IGNORE_-
+            # OUTGOING does not catch that looped copy, so drop anything whose
+            # Ethernet source is our own carrier (carrier MACs are unique per
+            # DUT; transmitter addrs are not, so we must key on the carrier).
+            if pkt[6:12] == r["mac"]:
+                continue
+            tx, freq = WIRE.unpack_from(pkt, 14)
+            frame = pkt[14 + WIRE.size:]
+            # Inject into THIS radio only -- its carrier is its cell.
+            nl.inject(r["addr1"], frame, freq)
+            dbg(f"rx {r['name']} tx={tx.hex()} freq={freq} len={len(frame)}")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except KeyboardInterrupt:
+        pass

package/feature-wifi/wifimedium.conf

@@ -0,0 +1,14 @@
+# Virtual WiFi medium for mac80211_hwsim (QEMU test target).
+#
+# Installed only when BR2_PACKAGE_FEATURE_WIFI_HWSIM is set.  Bridges hwsim
+# frames between the local radios and -- when a medium interface is configured
+# (WIFIMEDIUM_IFACE env or 'wifimedium.iface=' on the kernel cmdline) -- to
+# peer DUTs over that Ethernet segment, so two QEMU guests can associate
+# "wirelessly".  hwsim is loaded by the 00-hwsim ixinit script, which sets the
+# <usr/hwsim> condition once radios exist and are renamed -- so this service
+# starts only on nodes that actually have radios (registering on the hwsim genl
+# family would fail otherwise).  On real hardware neither is shipped and the
+# radios use the air.
+service env:-/etc/default/wifimedium name:wifimedium \
+	[2345] <usr/hwsim> \
+	/usr/libexec/infix/wifimedium -- Virtual WiFi medium (hwsim)

package/landing/landing.mk

@@ -14,6 +14,8 @@ define LANDING_INSTALL_TARGET_CMDS
         mkdir -p $(TARGET_DIR)/usr/html/
 	cp $(@D)/*.html $(TARGET_DIR)/usr/html/
 	cp $(@D)/*.png  $(TARGET_DIR)/usr/html/
+	$(INSTALL) -D -m 0644 $(LANDING_PKGDIR)/default.conf \
+		$(TARGET_DIR)/etc/nginx/available/default.conf
 endef
 
 $(eval $(generic-package))

package/modemd/Config.in

@@ -1,6 +0,0 @@
-config BR2_PACKAGE_MODEMD
-	bool "modemd"
-	select BR2_PACKAGE_MODEM_MANAGER
-	select BR2_PACKAGE_PYTHON3
-	help
-	  Daemon which manages modems.

package/modemd/modemd.hash

@@ -1,2 +0,0 @@
-# Locally calculated
-sha256  25b33026a661c4c550374cfcba6890a4363bf19db0c1c31a6e65b5edd113ecf0  LICENSE

package/modemd/modemd.mk

@@ -1,56 +0,0 @@
-################################################################################
-#
-# modemd
-#
-################################################################################
-
-MODEMD_VERSION = 1.0
-MODEMD_SITE_METHOD = local
-MODEMD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/modemd
-MODEMD_LICENSE = BSD-3-Clause
-MODEMD_LICENSE_FILES = LICENSE
-MODEMD_REDISTRIBUTE = NO
-MODEMD_DEPENDENCIES = modem-manager jansson python3 \
-	host-python3 host-python-pypa-build host-python-installer \
-	host-python-poetry-core
-
-define MODEMD_BUILD_CMDS
-    $(TARGET_CC) $(TARGET_CFLAGS) $(TARGET_LDFLAGS) \
-        $(MODEMD_DIR)/modem-command.c -o $(MODEMD_DIR)/modem-command -ljansson
-endef
-
-define MODEMD_BUILD_PYTHON
-	cd $(MODEMD_SITE) && \
-		$(PKG_PYTHON_PEP517_ENV) $(HOST_DIR)/bin/python3 $(PKG_PYTHON_PEP517_BUILD_CMD) -o $(@D)/dist
-	mkdir -p $(TARGET_DIR)/usr/libexec/modemd
-	rm -f $(TARGET_DIR)/usr/libexec/modemd/modemd \
-		$(TARGET_DIR)/usr/libexec/modemd/modem-* \
-		$(TARGET_DIR)/usr/libexec/modemd/sim-setup
-	cd $(@D) && \
-		$(HOST_DIR)/bin/python3 $(TOPDIR)/support/scripts/pyinstaller.py \
-			dist/*.whl \
-			--interpreter=/usr/bin/python3 \
-			--script-kind=posix \
-			--purelib=$(TARGET_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages \
-			--headers=$(TARGET_DIR)/usr/include/python$(PYTHON3_VERSION_MAJOR) \
-			--scripts=$(TARGET_DIR)/usr/libexec/modemd \
-			--data=$(TARGET_DIR)
-endef
-MODEMD_POST_INSTALL_TARGET_HOOKS += MODEMD_BUILD_PYTHON
-
-define MODEMD_INSTALL_TARGET_CMDS
-	mkdir -p $(TARGET_DIR)/usr/libexec/modemd
-	mkdir -p $(TARGET_DIR)/lib/udev/rules.d
-	mkdir -p $(FINIT_D)/available/
-	mkdir -p $(TARGET_DIR)/sbin
-	$(INSTALL) -D -m 0644 $(MODEMD_DIR)/finit.conf $(FINIT_D)/available/modemd.conf
-	install -m 644 $(MODEMD_DIR)/modemd.rules $(TARGET_DIR)/lib/udev/rules.d/90-modemd.rules
-	install -m 644 $(MODEMD_DIR)/qmi-wwan-ids.rules $(TARGET_DIR)/lib/udev/rules.d/91-qmi-wwan-ids.rules
-	install -m 644 $(MODEMD_DIR)/77-mm-dell-port-types.rules $(TARGET_DIR)/etc/udev/rules.d/77-mm-dell-port-types.rules
-	install -m 644 $(MODEMD_DIR)/77-mm-modem-gps.rules $(TARGET_DIR)/etc/udev/rules.d/77-mm-modem-gps.rules
-	install -D -m 644 $(MODEMD_DIR)/modemd.modules-load $(TARGET_DIR)/etc/modules-load.d/modemd.conf
-	install -m 755 $(MODEMD_DIR)/modem-command $(TARGET_DIR)/sbin/modem-command
-	ln -sf /usr/libexec/modemd/modemd $(TARGET_DIR)/sbin/modemd
-endef
-
-$(eval $(generic-package))

package/skeleton-init-finit/skeleton/etc/finit.d/available/modem-manager.conf

@@ -1 +0,0 @@
-service [2345789] ModemManager -- ModemManager daemon

package/webui/50x.html

@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Loading…</title>
+<meta charset="utf-8">
+<meta http-equiv="refresh" content="3">
+<style>
+  html { color-scheme: light dark; font-family: Tahoma, Verdana, Arial, sans-serif; }
+  body { max-width: 32em; margin: 4em auto; text-align: center; }
+  h1 { font-weight: 500; margin-bottom: 0.5em; }
+  p { color: #888; margin: 0.5em 0; }
+  .spinner {
+    display: inline-block;
+    width: 1.5em;
+    height: 1.5em;
+    margin-top: 1em;
+    border: 3px solid currentColor;
+    border-top-color: transparent;
+    border-radius: 50%;
+    animation: rot 1s linear infinite;
+  }
+  @keyframes rot { to { transform: rotate(360deg); } }
+</style>
+</head>
+<body>
+<h1>Loading…</h1>
+<p>The device is finishing its startup. This page refreshes automatically.</p>
+<p><span class="spinner" aria-hidden="true"></span></p>
+</body>
+</html>

package/webui/Config.in

@@ -0,0 +1,9 @@
+config BR2_PACKAGE_WEBUI
+	bool "webui"
+	depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
+	depends on BR2_PACKAGE_ROUSETTE
+	depends on !BR2_PACKAGE_LANDING
+	help
+	  Web management interface for Infix, a Go+HTMX application
+	  that provides browser-based configuration and monitoring
+	  via RESTCONF.

package/webui/default.conf

@@ -0,0 +1,44 @@
+# Throttle POST /login so a brute-force attempt can't pin the box on
+# the bcrypt-shaped credential check inside rousette/PAM. GET is left
+# unmetered: page loads after a 401-driven HX-Redirect shouldn't eat
+# into the budget.
+#
+# Zone is 32k (~500 IPs) — the minimum nginx accepts via shared-memory
+# allocation. With the cache full an attacker rotating source addresses
+# still tops out at ~2500 attempts/min total, all serialised through
+# bcrypt one at a time.
+#
+# 429 instead of the default 503 keeps the rate-limit response out of
+# the /50x.html error_page rewrite below (which auto-refreshes — would
+# loop a throttled client straight back to /login).
+map $request_method $webui_login_key {
+    POST    $binary_remote_addr;
+    default "";
+}
+limit_req_zone   $webui_login_key zone=webui_login:32k rate=5r/m;
+limit_req_status 429;
+
+server {
+    listen       80;
+    listen       [::]:80;
+    server_name  _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    server_name  _;
+    include      ssl.conf;
+
+    # 404 also points at /50x.html: the page is a "Loading…" screen
+    # with a meta-refresh, so the early-boot window where the Go
+    # backend isn't up yet (and any other transient 404 / 5xx) self-
+    # recovers as soon as upstream comes back.
+    error_page   404 500 502 503 504  /50x.html;
+    location = /50x.html {
+	root   html;
+    }
+
+    include /etc/nginx/app/*.conf;
+}

package/webui/webui-proxy.conf

@@ -0,0 +1,11 @@
+# Shared proxy-pass shape for the webui upstream. Nested locations that
+# declare their own proxy_* directives don't inherit from the outer block,
+# so each location includes this file rather than relying on inheritance.
+
+proxy_pass         http://127.0.0.1:10000;
+proxy_http_version 1.1;
+proxy_set_header   Host $host;
+proxy_set_header   X-Real-IP $remote_addr;
+proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header   X-Forwarded-Proto $scheme;
+proxy_redirect     off;

package/webui/webui.conf

@@ -0,0 +1,72 @@
+# Must be at server scope, not on an inner location: client_max_body_size
+# does not inherit into a nested location that declares its own proxy_pass,
+# and the http-level 1m default would silently apply and reject bundle
+# uploads with 413.
+client_max_body_size 256m;
+
+location / {
+    include /etc/nginx/webui-proxy.conf;
+}
+
+# burst=3 nodelay: three POSTs land back-to-back; the next needs a
+# fresh token (~12 s at 5r/m) or 429s.
+location = /login {
+    limit_req zone=webui_login burst=3 nodelay;
+    include /etc/nginx/webui-proxy.conf;
+}
+
+# Keep proxy_request_buffering on (the default). Streaming the body races
+# the Go handler's response close, producing RST instead of FIN at
+# Content-Length and a client-visible 502. nginx spools the body to
+# /var/cache/nginx/client-body during the upload instead.
+location = /software/upload {
+    proxy_read_timeout 600s;
+    include /etc/nginx/webui-proxy.conf;
+}
+
+# SSE progress stream: RAUC's Progress D-Bus property doesn't change while
+# it's writing a slot, so the upstream goes minutes without a frame. The
+# default 60 s proxy_read_timeout closes the stream and the browser sees
+# a transient error. Raise to cover a slow image write end-to-end.
+location = /software/progress {
+    proxy_read_timeout 1800s;
+    proxy_buffering off;
+    include /etc/nginx/webui-proxy.conf;
+}
+
+# SSE live-tail stream for Maintenance > Logs.  Same buffering / timeout
+# concerns as the software progress stream: nginx must not buffer the
+# event frames, and the connection has to stay open through quiet logs.
+# The Go side sends a 15 s heartbeat, so 600 s of read timeout is plenty
+# of safety margin.
+location ~ ^/maintenance/logs/[^/]+/tail$ {
+    proxy_read_timeout 600s;
+    proxy_buffering off;
+    include /etc/nginx/webui-proxy.conf;
+}
+
+# Support bundle collection runs `support collect`, which emits nothing
+# until it finishes (~50 s) and then sends the whole archive at once.
+# The upstream is silent for that window, so the default 60 s
+# proxy_read_timeout would 504 just as the bundle is ready.  Buffering
+# stays on — it's a plain file download, not a stream.
+location = /maintenance/support-bundle {
+    proxy_read_timeout 300s;
+    include /etc/nginx/webui-proxy.conf;
+}
+
+# On-device User's Guide: the mkdocs site bundled into the rootfs at
+# /var/www/guide by post-build.sh.  Served as static files (no upstream
+# call), public like the published guide.  Present only when the build
+# host had mkdocs; the WebUI hides its User Guide entry when it's absent.
+location /guide/ {
+    alias /var/www/guide/;
+    index index.html;
+}
+
+# Liveness probe — nginx-only, no upstream call. Used by the watchdog
+# div in base.html and the reboot-overlay poller.
+location = /device-status {
+    access_log off;
+    return 204;
+}

package/webui/webui.mk

@@ -0,0 +1,29 @@
+################################################################################
+#
+# webui
+#
+################################################################################
+
+WEBUI_VERSION = 1.0
+WEBUI_SITE_METHOD = local
+WEBUI_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/webui
+WEBUI_GOMOD = infix/webui
+WEBUI_LICENSE = MIT
+WEBUI_LICENSE_FILES = LICENSE
+WEBUI_REDISTRIBUTE = NO
+
+define WEBUI_INSTALL_EXTRA
+	$(INSTALL) -D -m 0644 $(WEBUI_PKGDIR)/webui.svc \
+		$(FINIT_D)/available/webui.conf
+	$(INSTALL) -D -m 0644 $(WEBUI_PKGDIR)/webui.conf \
+		$(TARGET_DIR)/etc/nginx/app/webui.conf
+	$(INSTALL) -D -m 0644 $(WEBUI_PKGDIR)/webui-proxy.conf \
+		$(TARGET_DIR)/etc/nginx/webui-proxy.conf
+	$(INSTALL) -D -m 0644 $(WEBUI_PKGDIR)/default.conf \
+		$(TARGET_DIR)/etc/nginx/available/default.conf
+	$(INSTALL) -D -m 0644 $(WEBUI_PKGDIR)/50x.html \
+		$(TARGET_DIR)/usr/html/50x.html
+endef
+WEBUI_POST_INSTALL_TARGET_HOOKS += WEBUI_INSTALL_EXTRA
+
+$(eval $(golang-package))

package/webui/webui.svc

@@ -0,0 +1,3 @@
+service <!> name:webui log:prio:daemon.info,tag:webui \
+	[2345] env:-/etc/default/webui webui -listen 127.0.0.1:10000 \
+	-- Web management interface

patches/libqmi/0001-Ignore-sysfs-for-download-mode.patch

@@ -1,21 +0,0 @@
-diff --git a/src/qmi-firmware-update/qfu-helpers-udev.c b/src/qmi-firmware-update/qfu-helpers-udev.c
-index bda9106..40d648f 100644
---- a/src/qmi-firmware-update/qfu-helpers-udev.c
-+++ b/src/qmi-firmware-update/qfu-helpers-udev.c
-@@ -364,8 +364,14 @@ device_matches (GUdevDevice          *device,
-     if (!device_sysfs_path)
-         goto out;
- 
--    if (g_strcmp0 (device_sysfs_path, sysfs_path) != 0)
--        goto out;
-+    /*
-+     * don't compare sysfs path for download mode as it
-+     * changes from USB4 to USB3 and thus may use a different host controller
-+     */
-+    if (mode != QFU_HELPERS_DEVICE_MODE_DOWNLOAD) {
-+        if (g_strcmp0 (device_sysfs_path, sysfs_path) != 0)
-+            goto out;
-+    }
- 
-     if (device_mode != mode)
-         return NULL;

patches/linux/6.18.37/0001-net-phy-marvell10g-Support-firmware-loading-on-88X33.patch

@@ -1,4 +1,4 @@
-From 2b86219131c6bed9658c75334e0b2748d4b68c04 Mon Sep 17 00:00:00 2001
+From f614327b6eca20319f5eee20ac954ea8d92276e4 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 01/50] net: phy: marvell10g: Support firmware loading on

patches/linux/6.18.37/0002-net-phy-marvell10g-Fix-power-up-when-strapped-to-sta.patch

@@ -1,4 +1,4 @@
-From 9eb5c192c3c76f9141b344d3bbbc954a0e4be50e Mon Sep 17 00:00:00 2001
+From 7d453cb838611f44d7566b6174ae95a5d2265fa1 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 02/50] net: phy: marvell10g: Fix power-up when strapped to

patches/linux/6.18.37/0003-net-phy-marvell10g-Add-LED-support-for-88X3310.patch

@@ -1,4 +1,4 @@
-From c08724121dc4d08ac783333a2ac38178649c918c Mon Sep 17 00:00:00 2001
+From 4b08a36e3107c4018ddf3a19760cc87d02281bd7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 03/50] net: phy: marvell10g: Add LED support for 88X3310

patches/linux/6.18.37/0004-net-phy-marvell10g-Support-LEDs-tied-to-a-single-med.patch

@@ -1,4 +1,4 @@
-From cd914eb2ac2b86240294108f4d4ab18b0bfbb44b Mon Sep 17 00:00:00 2001
+From e5e81eb1172db22be7c83efc8071108d0d42565e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 04/50] net: phy: marvell10g: Support LEDs tied to a single

patches/linux/6.18.37/0005-net-phy-Do-not-resume-PHY-when-attaching.patch

@@ -1,4 +1,4 @@
-From 25d84725be05967330bbeaac957fade38e338e40 Mon Sep 17 00:00:00 2001
+From 1f735096f1b8920ee6f21bf60a4c2d3f6376adeb Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 05/50] net: phy: Do not resume PHY when attaching
@@ -19,10 +19,10 @@ administratively down.
  1 file changed, 1 deletion(-)
 
 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 78cf05a17f8f..ddf47a586a5a 100644
+index 26b08e3dbd1d..7597308534a0 100644
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1750,7 +1750,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
+@@ -1753,7 +1753,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
  	if (err)
  		goto error;
  

patches/linux/6.18.37/0006-net-bridge-avoid-classifying-unknown-multicast-as-mr.patch

@@ -1,4 +1,4 @@
-From cb1dbb66184b3a07f8da93d8a52a56e77d97b98f Mon Sep 17 00:00:00 2001
+From e38d2d2f07f55819d2191d4282dc2d4688075d7d Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 06/50] net: bridge: avoid classifying unknown multicast as

patches/linux/6.18.37/0007-net-bridge-Ignore-router-ports-when-forwarding-L2-mu.patch

@@ -1,4 +1,4 @@
-From 66e1ca5038625bc0feb132edf07953b2e6c350da Mon Sep 17 00:00:00 2001
+From a9b80b26c96e5492ab32a72ee36e3321a2b90ee9 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 07/50] net: bridge: Ignore router ports when forwarding L2

patches/linux/6.18.37/0008-net-bridge-drop-delay-for-applying-strict-multicast-.patch

@@ -1,4 +1,4 @@
-From 31bfb62384ef4b09238f93db137547d0d6d63663 Mon Sep 17 00:00:00 2001
+From 01e41d87efa1b63d292f0acfe4d1fb0e39baab20 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 08/50] net: bridge: drop delay for applying strict multicast

patches/linux/6.18.37/0009-net-bridge-Differentiate-MDB-additions-from-modifica.patch

@@ -1,4 +1,4 @@
-From c16b809eb7ef941870dcfb6ecceab83570fcd223 Mon Sep 17 00:00:00 2001
+From 944c77d075c8e0655bd3a28e96892261465a5cf4 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 09/50] net: bridge: Differentiate MDB additions from

patches/linux/6.18.37/0010-nvmem-layouts-onie-tlv-Let-device-probe-even-when-TL.patch

@@ -1,4 +1,4 @@
-From 4ba33d783110e4559b5abfcfd8c095f0e71befc5 Mon Sep 17 00:00:00 2001
+From 3f58061ab8f869a6432a1256ee7422bb157b624e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 10/50] nvmem: layouts: onie-tlv: Let device probe even when
@@ -17,10 +17,10 @@ simply refrain from registering any cells in those cases.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/drivers/nvmem/layouts/onie-tlv.c b/drivers/nvmem/layouts/onie-tlv.c
-index 0967a32319a2..48547d5bb502 100644
+index 8b0f3c1b8a0e..de85690aaa30 100644
 --- a/drivers/nvmem/layouts/onie-tlv.c
 +++ b/drivers/nvmem/layouts/onie-tlv.c
-@@ -197,7 +197,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
+@@ -198,7 +198,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
  
  	if (!onie_tlv_hdr_is_valid(dev, &hdr)) {
  		dev_err(dev, "Invalid ONIE TLV header\n");
@@ -29,7 +29,7 @@ index 0967a32319a2..48547d5bb502 100644
  	}
  
  	hdr_len = sizeof(hdr.id) + sizeof(hdr.version) + sizeof(hdr.data_len);
-@@ -205,7 +205,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
+@@ -206,7 +206,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
  	table_len = hdr_len + data_len;
  	if (table_len > ONIE_TLV_MAX_LEN) {
  		dev_err(dev, "Invalid ONIE TLV data length\n");
@@ -38,7 +38,7 @@ index 0967a32319a2..48547d5bb502 100644
  	}
  
  	table = devm_kmalloc(dev, table_len, GFP_KERNEL);
-@@ -217,7 +217,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
+@@ -218,7 +218,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
  		return ret;
  
  	if (!onie_tlv_crc_is_valid(dev, table_len, table))

patches/linux/6.18.37/0011-net-usb-r8152-add-r8153b-support-for-link-activity-L.patch

@@ -1,4 +1,4 @@
-From f19c6a56de0743c906cbef917bc201d0c5a74c99 Mon Sep 17 00:00:00 2001
+From f492d4efac3a65bca4d53e383336c36113e28a8b Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 11/50] net: usb: r8152: add r8153b support for link/activity
@@ -18,7 +18,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
  1 file changed, 8 insertions(+)
 
 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index d61074178279..701cc975cf11 100644
+index 8cf4e81f8f88..1bb93efb96c6 100644
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
 @@ -41,6 +41,11 @@

patches/linux/6.18.37/0012-arm64-dts-mediatek-mt7986a-rename-BPi-R3-ports-to-ma.patch

@@ -1,4 +1,4 @@
-From daed6dc750e19a316a1a3db62df42ca31f830bd9 Mon Sep 17 00:00:00 2001
+From a2448b84e5483b5b91b46ac31b27609352fd9ed6 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 10 Aug 2025 18:52:54 +0200
 Subject: [PATCH 12/50] arm64: dts: mediatek: mt7986a: rename BPi R3 ports to

patches/linux/6.18.37/0013-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch

@@ -1,4 +1,4 @@
-From 42a6936aeb6ed136f7ce7524551307d6eecb3d95 Mon Sep 17 00:00:00 2001
+From c4ac90dcc5aefbb704c70ebbfe041dee683b882b Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 20 Aug 2025 21:38:24 +0200
 Subject: [PATCH 13/50] drm/panel-simple: Add a timing for the Raspberry Pi 7"

patches/linux/6.18.37/0014-input-touchscreen-edt-ft5x06-Add-polled-mode.patch

@@ -1,4 +1,4 @@
-From c83feafa1899f66855f13b8a5c63a3f04b037686 Mon Sep 17 00:00:00 2001
+From 8da101ec2429ba0bf1410346260f9a7ddfb0bdbe Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 21 Aug 2025 11:20:23 +0200
 Subject: [PATCH 14/50] input:touchscreen:edt-ft5x06: Add polled mode

patches/linux/6.18.37/0015-FIX-net-dsa-mv88e6xxx-Fix-timeout-on-waiting-for-PPU.patch

@@ -1,4 +1,4 @@
-From cb3652859a4c5f0ffad4b4cae5d112370829f9ad Mon Sep 17 00:00:00 2001
+From 93646f890903157bb78ef369ddf9d99a9161de0d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 15/50] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for

patches/linux/6.18.37/0016-net-dsa-mv88e6xxx-Improve-indirect-register-access-p.patch

@@ -1,4 +1,4 @@
-From abe555c35cf1f2c35f0b9b05917abb5f5470564e Mon Sep 17 00:00:00 2001
+From 29cfa1b5ffba41728dc5e0991d1ee27b903d569c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 16/50] net: dsa: mv88e6xxx: Improve indirect register access

patches/linux/6.18.37/0017-net-dsa-mv88e6xxx-Honor-ports-being-managed-via-in-b.patch

@@ -1,4 +1,4 @@
-From 1e0374357606ce86a7fad14d3eedbf650cab2f31 Mon Sep 17 00:00:00 2001
+From a7fa9a45329781519702d46ba05815433fff4acc Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 17/50] net: dsa: mv88e6xxx: Honor ports being managed via

patches/linux/6.18.37/0018-net-dsa-mv88e6xxx-Limit-rsvd2cpu-policy-to-user-port.patch

@@ -1,4 +1,4 @@
-From f3a986c8529106e426b0fb5ecafdb0a852a0f344 Mon Sep 17 00:00:00 2001
+From cda7100b0a29e6a9bd29a67ff9db3bcccb72065c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 18/50] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user

patches/linux/6.18.37/0019-net-dsa-tag_dsa-Use-tag-priority-as-initial-skb-prio.patch

@@ -1,4 +1,4 @@
-From 8eaf45f3a3c527db200164eb44a234a33bea0024 Mon Sep 17 00:00:00 2001
+From ccf9f9262e8570cfd522b841465f3edf76b3447a Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 19/50] net: dsa: tag_dsa: Use tag priority as initial

patches/linux/6.18.37/0020-net-dsa-Support-MDB-memberships-whose-L2-addresses-o.patch

@@ -1,4 +1,4 @@
-From 01af01f03f4bbaeead33d32f5f8b340a02aca16c Mon Sep 17 00:00:00 2001
+From 3200169701ef4d9afdea35355b3fe41d6f363134 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 20/50] net: dsa: Support MDB memberships whose L2 addresses

patches/linux/6.18.37/0021-net-dsa-Support-EtherType-based-priority-overrides.patch

@@ -1,4 +1,4 @@
-From ee554d75ddc33549f25c132f394ce346dc661cf9 Mon Sep 17 00:00:00 2001
+From dea9ff6c0bdf7c3e4abc2fb507d2ab4b94dabb63 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 21/50] net: dsa: Support EtherType based priority overrides