Merge pull request #1567 from kernelkit/kernel-upgrade-c7cf8e8a-c974-4873-a74d-00042e95b98b

Upgrade to kernel 6.18.39

.github/CONTRIBUTING.md

@@ -272,7 +272,7 @@ other contributions that are not aligned to this Code of Conduct."*
 [PEP-8]:    https://peps.python.org/pep-0008/
 [RDD]:      https://tom.preston-werner.com/2010/08/23/readme-driven-development
 [cbeams]:   https://cbea.ms/git-commit/#seven-rules
-[conduct]:    CODE-OF-CONDUCT.md
+[conduct]:    CODE_OF_CONDUCT.md
 [DCO]:        https://developercertificate.org/
 [closing]:    https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
 [gpg-verify]: https://docs.github.com/en/authentication/managing-commit-signature-verification

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /src/webui
+    schedule:
+      interval: weekly
+    # goyang is pinned to our kernelkit fork via a replace directive and
+    # stepped by hand when we add patches; leave it for Dependabot to ignore.
+    ignore:
+      - dependency-name: github.com/openconfig/goyang
+
+  - package-ecosystem: gomod
+    directory: /src/netbrowse
+    schedule:
+      interval: weekly

.github/workflows/add-issue-to-project.yml

@@ -10,7 +10,7 @@ jobs:
     name: Add issue to project Infix&co
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@v2
         with:
           project-url: https://github.com/orgs/kernelkit/projects/3
           github-token: ${{ secrets.ADD_TO_PROJECT }}

.github/workflows/bitsign.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: Validate release version format
       id: validate
@@ -170,7 +170,7 @@ jobs:
         fi
 
     - name: Upload signed artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: signed-infix-${{ steps.validate.outputs.file_version }}
         path: ${{ steps.download_signed.outputs.signed_filename }}
@@ -212,4 +212,4 @@ jobs:
         ---
 
         **Next Steps:** The signed release can now be distributed with cryptographic verification of authenticity.
-        EOF
+        EOF

.github/workflows/build-boot.yml

@@ -41,7 +41,7 @@ jobs:
           ls -la ./
 
       - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || github.ref }}
           clean: true
@@ -78,7 +78,7 @@ jobs:
 
       - name: Configure ${{ matrix.defconfig }}_defconfig
         run: |
-          make ${{ matrix.defconfig }}_defconfig
+          make ${{ matrix.defconfig }}_defconfig apply-mirror
 
       - name: Build ${{ matrix.defconfig }}_defconfig
         run: |
@@ -96,7 +96,7 @@ jobs:
           mv images ${{ steps.vars.outputs.dirname }}
           tar cfz ${{ steps.vars.outputs.archive }} ${{ steps.vars.outputs.dirname }}/
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           path: output/${{ steps.vars.outputs.archive }}
           name: artifact-${{ matrix.defconfig }}
@@ -108,17 +108,11 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: "artifact-*"
           merge-multiple: true
 
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
       - uses: ncipollo/release-action@v1
         with:
           allowUpdates: true
@@ -128,7 +122,7 @@ jobs:
           prerelease: true
           tag: "latest-boot"
           token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
+          artifacts: "*.tar.gz"
 
       - name: Summary
         run: |

.github/workflows/build-image.yml

@@ -1,4 +1,4 @@
-name: Create SD Card & eMMC Images
+name: Create Images
 
 on:
   workflow_dispatch:
@@ -15,15 +15,16 @@ on:
           - bananapi-bpi-r64
           - friendlyarm-nanopi-r2s
           - microchip-sama7g54-ek
+          - acer-connect-vero-w
         default: 'raspberrypi-rpi64'
 
 jobs:
   create-image:
-    name: Create SD Card Image for ${{ inputs.board }}
+    name: Create images for ${{ inputs.board }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           clean: true
           fetch-depth: 0
@@ -50,234 +51,171 @@ jobs:
           mkdir -p output/images
           mkdir -p build
 
-      - name: Set bootloader and target based on board
+      - name: Set bootloaders and targets based on board
         run: |
+          arch=
+          targets=
+          bootloader_sdcard=
+          bootloader_emmc=
+
           case "${{ inputs.board }}" in
             raspberrypi-rpi2)
-              echo "BOOTLOADER=rpi2-boot" >> $GITHUB_ENV
-              echo "ARCH=arm" >> $GITHUB_ENV
-              echo "BUILD_EMMC=false" >> $GITHUB_ENV
+              arch=arm
+              targets="sdcard"
+              bootloader_sdcard=rpi2-boot
               ;;
             raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=false" >> $GITHUB_ENV
+              arch=aarch64
+              targets="sdcard"
+              bootloader_sdcard=rpi64-boot
               ;;
             bananapi-bpi-r3)
-              echo "BOOTLOADER_SD=bpi-r3-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r3-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              arch=aarch64
+              targets="sdcard emmc"
+              bootloader_sdcard=bpi-r3-sd-boot
+              bootloader_emmc=bpi-r3-emmc-boot
               ;;
             bananapi-bpi-r4)
-              echo "BOOTLOADER_SD=bpi-r4-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r4-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              arch=aarch64
+              targets="sdcard emmc"
+              bootloader_sdcard=bpi-r4-sd-boot
+              bootloader_emmc=bpi-r4-emmc-boot
               ;;
             bananapi-bpi-r64)
-              echo "BOOTLOADER_SD=bpi-r64-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r64-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              arch=aarch64
+              targets="sdcard emmc"
+              bootloader_sdcard=bpi-r64-sd-boot
+              bootloader_emmc=bpi-r64-emmc-boot
+              ;;
+            acer-connect-vero-w)
+              arch=aarch64
+              targets="emmc"
+              bootloader_emmc=bpi-r3-emmc-boot
               ;;
             friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=false" >> $GITHUB_ENV
+              arch=aarch64
+              targets="sdcard"
+              bootloader_sdcard=nanopi-r2s-boot
               ;;
             microchip-sama7g54-ek)
-              echo "BOOTLOADER_SD=sama7g54-ek-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=sama7g54-ek-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=arm" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              arch=arm
+              targets="sdcard emmc"
+              bootloader_sdcard=sama7g54-ek-sd-boot
+              bootloader_emmc=sama7g54-ek-emmc-boot
               ;;
             *)
               echo "Error: Unknown board ${{ inputs.board }}"
               exit 1
               ;;
           esac
-          echo "Arch: $ARCH for board: ${{ inputs.board }}"
-          if [ "$BUILD_EMMC" = "true" ]; then
-            echo "Building both SD and eMMC images"
-            echo "SD Bootloader: $BOOTLOADER_SD"
-            echo "eMMC Bootloader: $BOOTLOADER_EMMC"
-          else
-            echo "Building SD image only"
-            echo "Bootloader: $BOOTLOADER"
-          fi
+
+          echo "ARCH=$arch" >> $GITHUB_ENV
+          echo "TARGETS=$targets" >> $GITHUB_ENV
+          [ -n "$bootloader_sdcard" ] && echo "BOOTLOADER_SDCARD=$bootloader_sdcard" >> $GITHUB_ENV
+          [ -n "$bootloader_emmc" ] && echo "BOOTLOADER_EMMC=$bootloader_emmc" >> $GITHUB_ENV
+
+          echo "Arch: $arch for board: ${{ inputs.board }}"
+          echo "Targets: $targets"
+          [ -n "$bootloader_sdcard" ] && echo "SD bootloader: $bootloader_sdcard"
+          [ -n "$bootloader_emmc" ] && echo "eMMC bootloader: $bootloader_emmc"
 
       - name: Download bootloader artifacts
         run: |
-          # Download bootloader from latest-boot release tag
-          if [ "$BUILD_EMMC" = "true" ]; then
-            # Download both SD and eMMC bootloaders for boards that support both
-            echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
-            mkdir -p output_sd/images
-            cd temp_bootloader_sd/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-            cd ../
-            rm -rf temp_bootloader_sd/
+          for target in $TARGETS; do
+            upper=$(printf '%s' "$target" | tr '[:lower:]' '[:upper:]')
+            bootloader_var="BOOTLOADER_${upper}"
+            bootloader="${!bootloader_var}"
+            temp_dir="temp_bootloader_${target}"
+            out_dir="output_${target}/images"
 
-            echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
-            mkdir -p output_emmc/images
-            cd temp_bootloader_emmc/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-            cd ../
-            rm -rf temp_bootloader_emmc/
+            echo "Downloading ${target} bootloader: ${bootloader}"
+            mkdir -p "$out_dir"
+            gh release download latest-boot --pattern "*${bootloader}*" --dir "$temp_dir/"
+            tar -xzf "$temp_dir"/*.tar.gz --strip-components=1 -C "$out_dir/"
+            rm -rf "$temp_dir"
 
-            echo "SD bootloader files:"
-            ls -la output_sd/images/
-            echo "eMMC bootloader files:"
-            ls -la output_emmc/images/
-          else
-            # Single bootloader for boards that only support SD
-            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
-
-            # Extract bootloader directly to output/images
-            cd temp_bootloader/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-            cd ../
-            rm -rf temp_bootloader/
-
-            echo "Bootloader files extracted to output/images:"
-            ls -la output/images/
-          fi
+            echo "${target} bootloader files:"
+            ls -la "$out_dir/"
+          done
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download Infix artifacts
         run: |
-          # Download from latest Kernelkit Trigger workflow for main branch
           gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
           INFIX_RUN_ID=$(cat latest_infix_run_id)
 
-          if [ "$BUILD_EMMC" = "true" ]; then
-            # Copy Infix artifacts to both SD and eMMC output directories
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+          gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
 
-            cd temp_infix/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-            cd ../
-            rm -rf temp_infix/
+          for target in $TARGETS; do
+            out_dir="output_${target}/images"
+            mkdir -p "$out_dir"
+            tar -xzf temp_infix/*.tar.gz --strip-components=1 -C "$out_dir/"
 
-            echo "Infix files extracted to output_sd/images:"
-            ls -la output_sd/images/
-            echo "Infix files extracted to output_emmc/images:"
-            ls -la output_emmc/images/
-          else
-            # Single output directory for SD-only boards
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+            echo "Infix files extracted to ${out_dir}:"
+            ls -la "$out_dir/"
+          done
 
-            # Extract Infix directly to output/images
-            cd temp_infix/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-            cd ../
-            rm -rf temp_infix/
-
-            echo "Infix files extracted to output/images:"
-            ls -la output/images/
-          fi
+          rm -rf temp_infix/
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Verify extracted files
         run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            echo "Files available for SD image:"
-            ls -la output_sd/images/
+          for target in $TARGETS; do
+            echo "Files available for ${target} image:"
+            ls -la "output_${target}/images/"
             echo ""
-            echo "Files available for eMMC image:"
-            ls -la output_emmc/images/
-          else
-            echo "Files available for mkimage.sh:"
-            ls -la output/images/
-            echo ""
-            echo "File types:"
-            file output/images/* || true
-          fi
+          done
 
-      - name: Create SD card image
+      - name: Create images
         run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            export BINARIES_DIR=$PWD/output_sd/images
-            export BUILD_DIR=$PWD/build
-            export BR2_EXTERNAL_INFIX_PATH=$PWD
-            export RELEASE=""
-            export INFIX_ID="infix"
-            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
-          else
-            export BINARIES_DIR=$PWD/output/images
-            export BUILD_DIR=$PWD/build
-            export BR2_EXTERNAL_INFIX_PATH=$PWD
-            export RELEASE=""
-            export INFIX_ID="infix"
-            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
-          fi
-
-      - name: Create eMMC image
-        if: ${{ env.BUILD_EMMC == 'true' }}
-        run: |
-          export BINARIES_DIR=$PWD/output_emmc/images
           export BUILD_DIR=$PWD/build
           export BR2_EXTERNAL_INFIX_PATH=$PWD
           export RELEASE=""
-          export INFIX_ID="infix"
-          ./utils/mkimage.sh -t emmc ${{ inputs.board }}
+          export IX_ID="infix"
+
+          for target in $TARGETS; do
+            export BINARIES_DIR=$PWD/output_${target}/images
+            ./utils/mkimage.sh -t "$target" ${{ inputs.board }}
+          done
 
       - name: Verify created images
         run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            echo "SD card image:"
-            ls -lh output_sd/images/*-sdcard.img* 2>/dev/null || true
-            if ls output_sd/images/*-sdcard.img 1> /dev/null 2>&1; then
-              for img in output_sd/images/*-sdcard.img; do
-                echo "- $(basename $img)"
-                file "$img"
-                fdisk -l "$img" 2>/dev/null | head -20
-              done
-            fi
+          mkdir -p output/images
 
-            echo ""
-            echo "eMMC image:"
-            ls -lh output_emmc/images/*-emmc.img* 2>/dev/null || true
-            if ls output_emmc/images/*-emmc.img 1> /dev/null 2>&1; then
-              for img in output_emmc/images/*-emmc.img; do
-                echo "- $(basename $img)"
-                file "$img"
-                fdisk -l "$img" 2>/dev/null | head -20
-              done
-            fi
+          for target in $TARGETS; do
+            src_dir="output_${target}/images"
+            found=false
 
-            # Copy both images to output/images for artifact upload
-            mkdir -p output/images
-            cp output_sd/images/*-sdcard.img* output/images/ 2>/dev/null || true
-            cp output_emmc/images/*-emmc.img* output/images/ 2>/dev/null || true
-          else
-            echo "Contents of output/images after mkimage.sh:"
-            ls -lh output/images/
+            echo "${target} image:"
+            ls -lh "$src_dir"/*-"$target".img* 2>/dev/null || true
 
-            # Look for SD card image with pattern: *-sdcard.img
-            if ls output/images/*-sdcard.img 1> /dev/null 2>&1; then
-              echo "Found SD card image(s):"
-              for img in output/images/*-sdcard.img; do
-                echo "- $(basename $img)"
-                file "$img"
-                fdisk -l "$img" 2>/dev/null || true
-              done
-            else
-              echo "No SD card image found matching pattern: *-sdcard.img"
-              echo "Available files:"
-              ls -la output/images/
+            for img in "$src_dir"/*-"$target".img; do
+              [ -e "$img" ] || continue
+              found=true
+              echo "- $(basename "$img")"
+              file "$img"
+              fdisk -l "$img" 2>/dev/null || true
+            done
+
+            if [ "$found" = false ]; then
+              echo "No ${target} image found matching pattern: *-${target}.img"
+              echo "Available files in ${src_dir}:"
+              ls -la "$src_dir/"
               exit 1
             fi
-          fi
+
+            for artifact in "$src_dir"/*-"$target".img*; do
+              [ -e "$artifact" ] || continue
+              cp "$artifact" output/images/
+            done
+
+            echo ""
+          done
 
       - name: Upload images as artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: images-${{ inputs.board }}
           path: |
@@ -285,15 +223,6 @@ jobs:
             output/images/*-emmc.img*
           retention-days: 30
 
-      - name: Create checksums
-        run: |
-          cd output/images/
-          for file in *-sdcard.img *-emmc.img; do
-            if [ -f "$file" ]; then
-              sha256sum "$file" > "$file.sha256"
-            fi
-          done
-
       - name: Upload to release
         uses: ncipollo/release-action@v1
         with:
@@ -304,41 +233,31 @@ jobs:
           prerelease: true
           tag: "latest-boot"
           token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "output/images/*-sdcard.img*,output/images/*-emmc.img*"
+          artifacts: "output/images/*-sdcard.img,output/images/*-emmc.img"
 
       - name: Generate summary
         run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # SD Card & eMMC Image Build Complete! 🚀
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
           **Arch:** ${{ env.ARCH }}
-          **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
-          **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
+          **Targets:** ${{ env.TARGETS }}
           **Bootloader Source:** latest-boot release
           **Infix Source:** Latest workflow run on main
 
+          ## Bootloaders
+          $(for target in $TARGETS; do
+              case "$target" in
+                sdcard) bootloader="$BOOTLOADER_SDCARD" ;;
+                emmc) bootloader="$BOOTLOADER_EMMC" ;;
+              esac
+              printf -- '- %s: %s\n' "$target" "$bootloader"
+            done)
+
           ## Created Images
           $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
 
           ## Download
-          Both SD card and eMMC images are available as workflow artifacts above and in the latest-boot release.
+          The generated images are available as workflow artifacts above and in the latest-boot release.
           EOF
-          else
-            cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # SD Card Image Build Complete! 🚀
-
-          **Board:** ${{ inputs.board }}
-          **Arch:** ${{ env.ARCH }}
-          **Bootloader:** ${{ env.BOOTLOADER }}
-          **Bootloader Source:** latest-boot release
-          **Infix Source:** Latest workflow run on main
-
-          ## Created Images
-          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
-
-          ## Download
-          The SD card image is available as a workflow artifact above.
-          EOF
-          fi

.github/workflows/build-release.yml

@@ -23,7 +23,7 @@ jobs:
         target: [aarch64, arm, x86_64]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           clean: true
           submodules: recursive
@@ -45,13 +45,16 @@ jobs:
           target: ${{ matrix.target }}
           enabled: ${{ inputs.use_cache }}
 
+      # WebUI images bundle the mkdocs User's Guide via post-build.sh.
+      - uses: kernelkit/actions/setup-mkdocs@v1.2
+
       - name: Configure & Build
         env:
           INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
         run: |
           target=${{ matrix.target }}_defconfig
           echo "Building $target ..."
-          make $target
+          make $target apply-mirror
           make
 
       - name: Generate SBOM from Build
@@ -67,6 +70,25 @@ jobs:
         run: |
           make test-spec
 
+      # rootfs.squashfs is still present here; it is stripped from the
+      # tarball below.  mkimage pulls the rpi64 bootloader from the
+      # latest-boot release and uses the freshly built host genimage.
+      - name: Build Raspberry Pi image
+        if: matrix.target == 'aarch64'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          ./utils/mkimage.sh -d -r output raspberrypi-rpi64
+          mkdir -p rpi-image
+          mv output/images/*-rpi64-sdcard.img rpi-image/
+          xz -T0 rpi-image/*-rpi64-sdcard.img
+
+      - uses: actions/upload-artifact@v7
+        if: matrix.target == 'aarch64'
+        with:
+          name: artifact-rpi64-image
+          path: rpi-image/*.img.xz
+
       - name: Prepare Artifacts
         run: |
           cd output/
@@ -86,12 +108,17 @@ jobs:
           ln -s ${{ steps.vars.outputs.dir }} images
           tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: artifact-${{ matrix.target }}
           path: output/*.tar.gz
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: artifact-disk-image-${{ matrix.target }}
           path: output/images/*.qcow2
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: artifact-pkg-${{ matrix.target }}
+          path: output/images/*.pkg

.github/workflows/build.yml

@@ -80,7 +80,7 @@ jobs:
           ls -la ./
 
       - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ env.INFIX_REPO }}
           ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
@@ -124,9 +124,12 @@ jobs:
         with:
           target: ${{ env.TARGET }}
 
+      # WebUI images bundle the mkdocs User's Guide via post-build.sh.
+      - uses: kernelkit/actions/setup-mkdocs@v1.2
+
       - name: Configure ${{ env.TARGET }}
         run: |
-          make ${{ env.TARGET }}_defconfig
+          make ${{ env.TARGET }}_defconfig apply-mirror
 
       - name: Cleanup stale containers and ports
         run: |
@@ -178,7 +181,7 @@ jobs:
           ln -s ${{ steps.vars.outputs.dir }} images
           tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           path: output/${{ steps.vars.outputs.tgz }}
           name: artifact-${{ env.TARGET }}

.github/workflows/check-kernel-release.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Check out infix repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
@@ -103,7 +103,7 @@ jobs:
 
       - name: Create pull request
         if: steps.check.outputs.new_release == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
           script: |

.github/workflows/coverity.yml

@@ -16,7 +16,7 @@ jobs:
     if: ${{github.repository_owner == 'kernelkit'}}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Fetch latest Coverity Scan MD5
         id: var
         env:
@@ -27,7 +27,7 @@ jobs:
                -O coverity-latest.tar.gz.md5
           echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         id: cache
         with:
           path: coverity-latest.tar.gz
@@ -98,7 +98,7 @@ jobs:
             https://scan.coverity.com/builds?project=${PROJECT_NAME}
 
       - name: Upload build.log
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverity-build.log
           path: cov-int/build-log.txt

.github/workflows/docs.yml

@@ -24,12 +24,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
 

.github/workflows/generic-x86-build.yml

@@ -33,7 +33,7 @@ jobs:
             mtools
 
       - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ github.repository }}
           ref: ${{ github.ref }}
@@ -77,7 +77,7 @@ jobs:
           ln -s Infix-x86_64 images
           tar cfz Infix-x86_64.tar.gz Infix-x86_64
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           path: output/Infix-x86_64.tar.gz
           name: artifact-x86_64

.github/workflows/govulncheck.yml

@@ -0,0 +1,68 @@
+name: Go Vulnerability Scan
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'src/webui/**'
+      - 'src/netbrowse/**'
+      - '.github/workflows/govulncheck.yml'
+  pull_request:
+    paths:
+      - 'src/webui/**'
+      - 'src/netbrowse/**'
+      - '.github/workflows/govulncheck.yml'
+  schedule:
+    - cron: '5 0 * * 6'  # Saturday at 00:05 UTC, same as Coverity
+  workflow_dispatch:
+
+jobs:
+  govulncheck:
+    if: ${{ github.repository_owner == 'kernelkit' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module:
+          - src/webui
+          - src/netbrowse
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Scan ${{ matrix.module }}
+        working-directory: ${{ matrix.module }}
+        run: |
+          # Full report, for the run summary.  govulncheck exits non-zero
+          # whenever it finds anything, so don't let it fail the step here.
+          {
+            echo "## govulncheck: ${{ matrix.module }}"
+            echo '```'
+            govulncheck ./... || true
+            echo '```'
+          } | tee -a "$GITHUB_STEP_SUMMARY"
+
+          # Gate on vulnerabilities reachable from our code through a
+          # dependency.  govulncheck's call-graph analysis is transitive,
+          # so indirect use counts too (we call a dep that calls the bad
+          # symbol).  trace[0] is the vulnerable symbol; we key on the
+          # module it lives in.  A chain that bottoms out in stdlib is
+          # fixed by bumping the Buildroot host Go, not this module's
+          # go.mod, so it's reported above but doesn't fail the build.
+          # Keep the json scan and jq unguarded so a tool failure fails the
+          # gate closed; only grep's no-match exit (all-clear) is tolerated.
+          govulncheck -format json ./... > scan.json || true
+          called=$(jq -r 'select(.finding.trace[0].function != null) |
+                          .finding.trace[0].module' scan.json | sort -u)
+          vulns=$(printf '%s' "$called" | grep -vx stdlib || true)
+          if [ -n "$vulns" ]; then
+            echo "::error::Called vulnerabilities in dependencies: $(echo "$vulns" | paste -sd, -)"
+            exit 1
+          fi

.github/workflows/inventory.yml

@@ -1,88 +0,0 @@
-name: Manny the Manager
-
-on:
-  workflow_dispatch:
-    inputs:
-      checkout:
-        required: true
-        type: boolean
-      cleanup:
-        required: true
-        type: boolean
-      peek:
-        required: true
-        type: boolean
-
-jobs:
-  inventory:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Disk usage ...
-        run: |
-          cd
-          du -hs .[^.]*
-      - name: Disk inventory (1/2) ...
-        run: |
-          echo "df -h ========================================================================="
-          df -h
-          echo "mounts ========================================================================"
-          mount
-      - name: File inventory (1/2) ...
-        run: |
-          echo "Current directory: $(pwd)"
-          echo "Files in $HOME ================================================================"
-          ls $HOME
-          echo "Find $HOME ===================================================================="
-          find $HOME
-      - name: Container inventory ...
-        run: |
-          echo "Available container images: ==================================================="
-          docker images
-          echo "Available containers: ========================================================="
-          docker ps -a
-
-  checkout:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: kernelkit/actions/cache-restore@v1
-        with:
-          target: x86_64
-          dl-prefix: dl-netconf
-      - name: Disk inventory (2/2) ...
-        run: |
-          echo "df -h ========================================================================="
-          df -h
-          echo "mounts ========================================================================"
-          mount
-      - name: File inventory (2/2) ...
-        run: |
-          echo "Current directory: $(pwd)"
-          echo "Files in $HOME ================================================================"
-          ls $HOME
-          echo "Find $HOME ===================================================================="
-          find $HOME
-
-  peeky:
-    if: ${{ inputs.peek }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Peek & Poke ...
-        run: |
-          whoami
-          ls -l /mnt/
-          cat /mnt/DATALOSS_WARNING_README.txt
-          sudo mkdir /mnt/x-aarch64
-          sudo chown $(id -un):$(id -gn) /mnt/x-aarch64
-          ls -l /mnt/
-
-  cleanup:
-    if: ${{ inputs.cleanup }}
-    needs: [inventory, peeky]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Cleaning up cruft ...
-        run: |
-          docker image prune -af
-          docker volume prune -f
-          docker container prune -f

.github/workflows/publish.yml

@@ -11,17 +11,11 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: "artifact-*"
           merge-multiple: true
 
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
       - uses: ncipollo/release-action@v1
         with:
           allowUpdates: true
@@ -32,7 +26,7 @@ jobs:
           prerelease: true
           tag: "latest"
           token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
+          artifacts: "*.tar.gz"
 
       - name: Summary
         run: |

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
       contents: write
       discussions: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: 'true'
 
@@ -78,22 +78,11 @@ jobs:
           echo "pre=${{ steps.rel.outputs.pre }}"
           echo "latest=${{ steps.rel.outputs.latest }}"
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: "artifact-*"
           merge-multiple: true
 
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi
-
       - name: Extract ChangeLog entry ...
         run: |
           cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
@@ -106,7 +95,7 @@ jobs:
           makeLatest: ${{ steps.rel.outputs.latest }}
           discussionCategory: ${{ steps.rel.outputs.cat }}
           bodyFile: release.md
-          artifacts: "*.tar.gz*,*.qcow2*"
+          artifacts: "*.tar.gz,*.qcow2,*.pkg,*.img.xz"
 
       - name: Summary
         run: |

.github/workflows/test.yml

@@ -43,6 +43,11 @@ on:
         type: string
         default: ''
         description: 'Optional script to run after checkout (for spin customization)'
+      release:
+        required: false
+        type: string
+        default: ''
+        description: 'Release version (e.g. v26.04.0), sets INFIX_RELEASE so make test finds versioned artifacts'
     secrets:
       CHECKOUT_TOKEN:
         required: false
@@ -61,7 +66,7 @@ jobs:
     runs-on: [self-hosted, regression]
     steps:
       - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ env.INFIX_REPO }}
           ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
@@ -93,7 +98,7 @@ jobs:
         run: |
           make ${{ env.TARGET }}_defconfig
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: "artifact-*"
           merge-multiple: true
@@ -105,12 +110,15 @@ jobs:
 
           ls -l
           mkdir -p output
-          mv ${name}-${target}.tar.gz output/
+          tarfile=$(ls ${name}-${target}*.tar.gz | head -1)
+          mv "$tarfile" output/
           cd output/
-          tar xf ${name}-${target}.tar.gz
-          ln -s ${name}-${target} images
+          tar xf "$tarfile"
+          ln -s "${tarfile%.tar.gz}" images
 
       - name: Regression Test ${{ env.TARGET }}
+        env:
+          INFIX_RELEASE: ${{ inputs.release }}
         run: |
           if [ -n "$NINEPM_CONF" ]; then
             export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
@@ -131,7 +139,19 @@ jobs:
           make test-dir="$(pwd)/$TEST_PATH" test-report
 
       - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-report
           path: output/images/test-report.pdf
+
+      - name: Generate XPath Coverage Report for ${{ env.TARGET }}
+        if: always()
+        run: |
+          make test-dir="$(pwd)/$TEST_PATH" xpath-coverage-report
+
+      - name: Upload XPath Coverage Report as Artifact
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: xpath-coverage-report
+          path: output/images/xpath-coverage-report.pdf

.github/workflows/unit-test.yml

@@ -78,7 +78,7 @@ jobs:
           ls -la ./
 
       - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ env.INFIX_REPO }}
           ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}

.github/workflows/weekly.yml

@@ -22,22 +22,11 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: "artifact-*"
           merge-multiple: true
 
-      - name: Create checksums
-        run: |
-          for file in *.tar.gz; do
-            sha256sum $file > $file.sha256
-          done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi
-
       - uses: ncipollo/release-action@v1
         with:
           tag: latest
@@ -54,7 +43,7 @@ jobs:
 
             **Commit:** ${{ github.sha }}
             **Built:** ${{ github.run_id }}
-          artifacts: "*.tar.gz*,*.qcow2*"
+          artifacts: "*.tar.gz,*.qcow2"
 
       - name: Summary
         run: |

Config.in

@@ -2,7 +2,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/board/Config.in"
 
 menu "Branding"
 
-config INFIX_VENDOR
+config IX_VENDOR
 	string "Vendor name"
 	default "KernelKit"
 	help
@@ -15,7 +15,7 @@ config INFIX_VENDOR
 
 	  Used for VENDOR_NAME in /etc/os-release and GNS3 appliance files.
 
-config INFIX_VENDOR_HOME
+config IX_VENDOR_HOME
 	string "Vendor URL"
 	help
 	  The homepage of the OS vendor.  The value should be in RFC3986
@@ -24,14 +24,14 @@ config INFIX_VENDOR_HOME
 
 	  Optional, used for VENDOR_HOME in /etc/os-release
 
-config INFIX_NAME
+config IX_NAME
 	string "Operating system name"
 	default "Infix"
 	help
 	  Mandatory.  Used for identifying the OS as NAME in /etc/os-release
 	  and product_name in GNS3 appliance files.
 
-config INFIX_ID
+config IX_ID
 	string "Operating system identifier"
 	default "infix"
 	help
@@ -43,9 +43,9 @@ config INFIX_ID
 	  Mandatory.  Used for identifying the OS as ID in /etc/os-release and
 	  in the generated image name: ID-ARCH-VERSION.img
 
-config INFIX_IMAGE_ID
+config IX_IMAGE_ID
 	string "Operating system image name"
-	default "${INFIX_ID}-${BR2_ARCH}"
+	default "${IX_ID}-${BR2_ARCH}"
 	help
 	  A lower-case string (no spaces or other characters outside of 0–9,
 	  a–z, ".", "_" and "-"), for naming critical image files, directories
@@ -54,18 +54,18 @@ config INFIX_IMAGE_ID
 	  Mandatory.  When INFIX_RELEASE is set, this string is appended to
 	  the IMAGE_ID with a '-' separator.
 
-config INFIX_COMPATIBLE
+config IX_COMPATIBLE
 	string "Operating system compatible string"
-	default "${INFIX_IMAGE_ID}"
+	default "${IX_IMAGE_ID}"
 	help
 	  A lower-case string (no spaces or other characters outside of 0–9,
 	  a–z, ".", "_" and "-"), used for image identification at upgrade.
 	  E.g., the RAUC [system] compatible string.
 
-	  Mandatory.  Defaults to $INFIX_IMAGE_ID, which in turn is composed
-	  of $INFIX_ID-$BR2_ARCH.
+	  Mandatory.  Defaults to $IX_IMAGE_ID, which in turn is composed
+	  of $IX_ID-$BR2_ARCH.
 
-config INFIX_TAGLINE
+config IX_TAGLINE
 	string "Operating system tagline"
 	default "Infix OS — Immutable.Friendly.Secure"
 	help
@@ -74,25 +74,25 @@ config INFIX_TAGLINE
 
 	  This is also show at boot when the system init process starts.
 
-config INFIX_DESC
+config IX_DESC
 	string "Operating system description"
 	help
 	  Optional.  Used for long description texts about the OS.  E.g.,
 	  the GNS3 appliance file description field.  Saved in the file
-	  /etc/os-release as INFIX_DESC.
+	  /etc/os-release as IX_DESC.
 
-config INFIX_HOME
+config IX_HOME
 	string "Operating system URL"
 	help
 	  Used for identifying the OS, e.g. as HOME_URL in /etc/os-release
 
-config INFIX_DOC
+config IX_DOC
 	string "Operating system docs"
 	help
 	  Optional.  Main documentation URL, will be shown in /etc/os-release
 	  as DOCUMENTATION_URL.
 
-config INFIX_SUPPORT
+config IX_SUPPORT
 	string "Operating system support"
 	help
 	  Main support page for the operating system, if there is any.  This
@@ -102,22 +102,23 @@ config INFIX_SUPPORT
 	  Optional.  Shown, e.g., as SUPPORT_URL in /etc/os-release or
 	  maintainer_email in .gns3a.
 
-config INFIX_OEM_PATH
+config IX_OEM_PATH
 	string "Path to OEM br2-external"
 	help
 	  A br2-external using Infix will likely want to version the branded
 	  OS using their own GIT tags.  Set this variable to point to the base
 	  directory (absolute path) and the Infix post-build.sh will call `git
-	  describe -C $INFIX_OEM_PATH`.
+	  describe -C $IX_OEM_PATH`.
 
-	  Note: for release builds the global variable INFIX_RELEASE overrides
-	  the version information derived from `git describe`.  However, the
-	  GIT version is always saved as the BUILD_ID in /etc/os-releases.
+	  Note: the OS version (VERSION, VERSION_ID, BUILD_ID in
+	  /etc/os-release) is always derived from `git describe`.  The global
+	  variable INFIX_RELEASE does not change it; it only labels the release
+	  channel (IMAGE_VERSION) and names the published artifacts.
 
 endmenu
 
 # For /etc/os-release, uses CondtionArchitechture= from systemd.unit(5)
-config INFIX_ARCH
+config IX_ARCH
 	string
 	default "arm"     if BR2_arm
 	default "arm64"   if BR2_aarch64

Makefile

@@ -9,8 +9,10 @@ O    ?= output
 # otherwise treat it as relative to ./buildroot.
 override O := $(if $(filter /%,$O),$O,$(CURDIR)/$O)
 
-config := $(O)/.config
-bmake   = $(MAKE) -C buildroot O=$(O) $1
+config      := $(O)/.config
+bmake        = $(MAKE) -C buildroot O=$(O) $1
+SNIPPETS_DIR := $(CURDIR)/configs/snippets
+MERGE_CONFIG := $(CURDIR)/buildroot/support/kconfig/merge_config.sh
 
 
 all: $(config) buildroot/Makefile
@@ -26,6 +28,23 @@ $(config):
 	@echo "'make <board>_defconfig' before building an image."
 	@exit 1
 
+apply-%: $(SNIPPETS_DIR)/%.conf | $(config)
+	@KCONFIG_CONFIG=$(config) $(MERGE_CONFIG) -m $(config) $<
+	@+$(call bmake,olddefconfig)
+	@echo "Applied snippet: $<"
+
+list-snippets:
+	@echo "Available snippets (use 'make apply-<name>'):"
+	@ls $(SNIPPETS_DIR)/*.conf 2>/dev/null | sed 's|.*/||; s|\.conf$$||; s|^|  |'
+
+dev: | $(config)
+	@for s in $(SNIPPETS_DIR)/*.conf; do \
+		KCONFIG_CONFIG=$(config) $(MERGE_CONFIG) -m $(config) $$s; \
+		echo "Applied snippet: $$s"; \
+	done
+	@+$(call bmake,olddefconfig)
+	@+$(call bmake,all)
+
 %: | buildroot/Makefile
 	@+$(call bmake,$@)
 
@@ -44,4 +63,4 @@ test:
 buildroot/Makefile:
 	@git submodule update --init
 
-.PHONY: all check coverity dep test cyclonedx
+.PHONY: all check coverity dep test cyclonedx list-snippets dev

README.md

@@ -1,63 +1,21 @@
-[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
+[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Discord][discord-badge]][discord-url]
 
-<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=480 padding=10>
+<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=380 padding=10>
 
-Turn any ARM or x86 device into a powerful, manageable network appliance
-in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
-routers, IoT gateways, edge devices, or custom network solutions that
-just work.
+Infix turns an ARM or x86 device into a managed network appliance.  The
+same OS runs on a $35 Raspberry Pi and on enterprise switching hardware,
+so you can build a router, an IoT gateway, or an edge device on whatever
+you have on hand.
 
-## Our Values
+More in-depth material is available in our blog and User Guide:
 
-**🔒 Immutable**  
-Your system never breaks.  Read-only filesystem with atomic upgrades
-means no configuration drift, no corrupted updates, and instant rollback
-if something goes wrong.  Deploy once, trust forever.
+- <https://www.kernelkit.org/>
+- <https://www.kernelkit.org/infix/>
 
-**🤝 Friendly**  
-Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit <kbd>?</kbd> or
-<kbd>TAB</kbd> for context-aware assistance.
+## See it in action
 
-Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
-mean you're never stuck.  Whether you're learning networking or managing
-enterprise infrastructure.
-
-**🛡️ Secure**  
-Built with security as a foundation, not an afterthought.  Minimal
-attack surface, separation between system and data, and container
-isolation.  Sleep better knowing your infrastructure is protected.
-
-## Why Choose Infix
-
-**Hardware Flexibility**: Start with a $35 Raspberry Pi, scale to
-enterprise switching hardware.  Same OS, same tools, same reliability.
-
-**Standards-Based**: Built around YANG models and IETF standards. Learn
-once, use everywhere - no vendor lock-in.
-
-**Container Ready**: Run your applications alongside networking
-functions.  GPIO access, dedicated Ethernet ports, custom protocols —
-your device, your rules.
-
-## Use Cases
-
-1. **Home Labs & Hobbyists**:  
-   Transform a Raspberry Pi into a full-featured router with WiFi  
-1. **IoT & Edge Computing**:  
-   Bridge devices to the cloud with reliable, updatable gateways  
-1. **Small Business Networks**:  
-   Enterprise-grade features without the complexity or cost  
-1. **Developers & Makers**:  
-   Test networking concepts, prototype IoT solutions, or build custom
-   appliances
-1. **Network Professionals**:  
-   Consistent tooling from development to production deployment.  
-   How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
-
-## Quick Example
-
-Configure an interface in seconds - the CLI guides you with built-in help:
+The CLI is generated from the [YANG models][inside], so it guides you with
+built-in help.  Here's setting an IP address on an interface:
 
 <pre><code>admin@infix-12-34-56:/> <b>configure</b>
 admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
@@ -94,38 +52,94 @@ eth0            ethernet   UP          52:54:00:12:34:56
 admin@infix-12-34-56:/> <b>copy running startup</b>
 </code></pre>
 
-Notice how <kbd>TAB</kbd> completion shows available options, `show`
-displays current config, and `diff` shows exactly what changed before
-you commit your changes with the `leave` command.
+<kbd>TAB</kbd> completes available options and <kbd>?</kbd> shows online help
+for each option and argument. `show` displays the current config, and `diff`
+shows exactly what changed before you commit it with `leave`.  See the [CLI
+documentation][3] for more.
 
-For more information, see [CLI documentation][3].
+## Web interface
 
-## Get Started
+If the CLI isn't your style, the same configuration is available through the
+web interface.  Log in from a browser, keep an eye on your device from the
+Status dashboard and use the Configure > Interface setup wizard to create more
+advanced setups, or just fold out an interface to add an IP address.
 
-Get [pre-built images][5] for your hardware.  Use the CLI, web
-interface, or standard NETCONF/RESTCONF tools, e.g., `curl`.  Add
-containers for any custom functionality you need.
+<p>
+  <a href="doc/img/webui-login.png"><img src="doc/img/webui-login.png" alt="Login" align="top" width=220></a>
+  <a href="doc/img/webui-dashboard.png"><img src="doc/img/webui-dashboard.png" alt="Dashboard" width=290></a>
+  <a href="doc/img/webui-wizard.png"><img src="doc/img/webui-wizard.png" alt="Setup wizard" width=260></a>
+</p>
 
-### Supported Platforms
+The web interface is built on the same concepts as the CLI, so operational
+status and state are kept separate from configuration and commands.
 
-- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
-- **Banana Pi-R3** - Your next home router and gateway
-- **NanoPi R2S** - Compact dual-port router in a tiny package
-- **x86_64** - Run in VMs or on mini PCs for development and testing
-- **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
-- **Microchip SparX-5i** - Enterprise switching capabilities
-- **Microchip SAMA7G54-EK** - ARM Cortex-A7
-- **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
-- **StarFive VisionFive2** - RISC-V architecture support
+## Try it in 5 minutes
 
-*Why start with Raspberry Pi?* It's affordable, widely available, has
-built-in WiFi + Ethernet, and runs the exact same Infix OS you'd deploy
-in production. Perfect for learning, prototyping, or even small-scale
-deployments.
+You don't need hardware to get started:
 
+- **In a virtual lab** — run a full topology in [GNS3][gns3-post] and test
+  networks entirely in software.
+- **From source** — [build it and `make run`][build-post] to boot Infix in
+  QEMU, from `git clone` to pinging the internet.
+- **On real hardware** — grab a [pre-built image][5] for your board, or run
+  the `x86_64` image in any VM.
+
+Log in with `admin` / `admin` on the virtual and pre-built images.  On
+shipped products the factory-reset credentials are customizable — we
+typically provision a unique per-device password stored in EEPROM/VPD.
+
+## Supported hardware
+
+- **Raspberry Pi 2B/3B/4B/CM4** - a good starting point; built-in WiFi and Ethernet
+- **Banana Pi-R64/R3/R3 Mini/R4** - multi-port routers and gateways
+- **NanoPi R2S** - compact dual-port router
+- **x86_64** - VMs and mini PCs, for development or production
+- **Marvell CN9130 CRB, EspressoBIN** - ARM64 development boards
+- **Microchip SparX-5i** - enterprise switching
+- **Microchip SAMA7G54-EK** - ARM Cortex-A7 evaluation kit
+- **NXP i.MX8MP EVK** - ARM64 SoC evaluation kit
+- **StarFive VisionFive2** - RISC-V board
+
+*Why start with Raspberry Pi?* It's cheap, easy to get hold of, has
+built-in WiFi and Ethernet, and runs the same Infix you'd deploy in
+production — so what you learn on it carries straight over.
+
+> [!TIP]
 > 📖 **[Complete documentation][4]** • 💬 **[Join our Discord][discord-url]**
 
-## Technical Details
+## Why Infix
+
+**🔒 Immutable**  
+Read-only filesystem with atomic upgrades.  An update either applies
+cleanly or rolls back, so a failed upgrade or a power cut midway through
+won't leave you with a half-broken system.
+
+**🤝 Friendly**  
+The CLI is generated from the YANG models, so every command carries its
+own help — hit <kbd>?</kbd> or <kbd>TAB</kbd> to see what's available.
+The same models are reachable over NETCONF and RESTCONF, with
+[documentation][4] for when you get stuck.
+
+**🛡️ Secure**  
+A small attack surface, separation between system and data, and
+container isolation.  Since the system partition is read-only, a
+compromised service or container can't rewrite the OS underneath it.
+
+## Use cases
+
+1. **Home labs & hobbyists**:  
+   Turn a Raspberry Pi into a router with WiFi  
+1. **IoT & edge**:  
+   Build gateways you can update in the field  
+1. **Small business networks**:  
+   Routing, firewalling, and VLANs on affordable hardware  
+1. **Developers & makers**:  
+   Prototype networking ideas, or build a custom appliance with containers  
+1. **Network professionals**:  
+   The same tooling from lab to production — spin up a digital twin in raw
+   Qemu or [GNS3](https://gns3.com/infix)
+
+## Under the hood
 
 <a href="https://bitsign.se">
   <picture>
@@ -135,27 +149,29 @@ deployments.
   </picture>
 </a>
 
-Built on proven open-source foundations: [Linux][0], [Buildroot][1], and
-[sysrepo][2] — for reliability you can trust:
+Built on [Linux][0], [Buildroot][1], and [sysrepo][2]:
 
-- **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
-- **YANG Configuration**: Industry-standard models with auto-generated tooling
-- **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
-- **Container Integration**: Docker support with flexible network and hardware access
-- **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
-- **Code Signing**: Releases are cryptographically signed for integrity verification
+- **Immutable OS**: read-only filesystem, atomic updates, rollback on failure
+- **YANG configuration**: standard models with an auto-generated CLI and APIs
+- **Hardware acceleration**: switchdev offload for wire-speed forwarding
+- **Container integration**: Docker, with access to host network and hardware
+- **Memory efficient**: runs on devices with as little as 256 MB RAM
+- **Code signing**: releases are cryptographically signed
 
-Perfect for everything from resource-constrained edge devices to
-high-throughput network appliances.
-
-With the entire system modeled in YANG, scalability is no longer an
-issue, be it in development, testing, or end users deploying and
-monitoring their devices.  All knobs and dials are accessible from the
-CLI (console/SSH), or remotely using the native NETCONF or RESTCONF
-APIs.
+Because the whole system is modeled in YANG, every setting is reachable
+the same way: from the CLI over console or SSH, or remotely over the
+native NETCONF and RESTCONF APIs.  The same models drive development,
+testing, and day-to-day monitoring.
 
 > Check the *[Latest Build][]* for bleeding-edge features.
 
+## Contributing
+
+Bug reports, ideas, and pull requests are welcome.  Start with
+[CONTRIBUTING][contributing] and the [code of conduct][coc].  Found a
+security issue?  Follow the [security policy][security].  Need a hand?
+See [support options][support] or [join us on Discord][discord-url].
+
 ---
 
 <div align="center">
@@ -171,6 +187,13 @@ APIs.
 [3]: https://www.kernelkit.org/infix/latest/cli/introduction/
 [4]: https://www.kernelkit.org/infix/
 [5]: https://github.com/kernelkit/infix/releases/latest
+[inside]:          https://www.kernelkit.org/posts/inside-infix/
+[gns3-post]:       https://www.kernelkit.org/posts/infix-in-gns3/
+[build-post]:      https://www.kernelkit.org/posts/building-infix-from-source/
+[contributing]:    .github/CONTRIBUTING.md
+[coc]:             .github/CODE_OF_CONDUCT.md
+[security]:        .github/SECURITY.md
+[support]:         .github/SUPPORT.md
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg

board/aarch64/Config.in

@@ -1,6 +1,7 @@
 if BR2_aarch64
 
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/acer-connect-vero-w6m/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r4/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r64/Config.in"

board/aarch64/README.md

@@ -4,10 +4,12 @@ aarch64
 Board Specific Documentation
 ----------------------------
 
+- [Acer Connect Vero W6m](acer-connect-vero-w6m/)
 - [Banana Pi BPi-R3](bananapi-bpi-r3/)
 - [Banana Pi BPi-R4](bananapi-bpi-r4/)
 - [Banana Pi BPi-R64](bananapi-bpi-r64/)
 - [Marvell CN9130-CRB](marvell-cn9130-crb/)
+- [Marvell ESPRESSObin](marvell-espressobin/)
 - [Microchip SparX-5i PCB135 (eMMC)](microchip-sparx5-pcb135/)
 - [NanoPi R2S](friendlyarm-nanopi-r2s/)
 - [Raspberry Pi 64-bit](raspberrypi-rpi64/)

board/aarch64/acer-connect-vero-w6m/Config.in

@@ -0,0 +1,6 @@
+config BR2_PACKAGE_ACER_CONNECT_VERO_W6M
+	bool "Acer Connect Vero W6m"
+	depends on BR2_aarch64
+	select BR2_PACKAGE_BANANAPI_BPI_R3
+	help
+	  Build Acer Connect Vero W6m

board/aarch64/acer-connect-vero-w6m/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2026 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

board/aarch64/acer-connect-vero-w6m/README.md

@@ -0,0 +1,131 @@
+# Acer Connect Vero W6m
+
+<img src="connect_vero_w6m_case.jpg" alt="Acer Connect Vero W6m" width=400 padding=10>
+
+## Overview
+
+The Acer Connect Vero W6m is a compact WiFi 6/6E router platform based
+on the MediaTek MT7986A SoC.  In Infix it is supported as an eMMC-based
+target that reuses the factory secure boot chain while replacing the
+system partitions with an Infix installation.
+
+The Acer Connect Vero W6m is based on the same MT7986a SoC as the
+BPI-R3, with tri-band WiFi (2.4 GHz + 5 GHz + 6 GHz) using a PCIe
+MT7916 module and the SoC's built-in MT7976 DBDC radio.
+
+## Default WiFi Layout
+
+The factory configuration on this branch enables all three radios in AP
+mode and bridges them into the default LAN bridge `br0`:
+
+- `radio0` / `wifi0-ap`: 2.4 GHz, SSID `Infix`
+- `radio1` / `wifi1-ap`: 6 GHz, SSID `Infix6G`
+- `radio2` / `wifi2-ap`: 5 GHz, SSID `Infix5G`
+
+6 GHz operation is enabled in the MT7915e driver configuration, and all
+three APs use the same default passphrase `infixinfix` from the factory
+configuration.
+
+Secure boot is enabled on this device, so the factory bootloader
+(partitions 1-4: bl2, u-boot-env, factory, fip) must not be modified.
+Infix is installed by replacing partitions 5+ while keeping the
+factory bootloader intact.  The stock U-Boot chainloads the Infix
+U-Boot from the first partition after fip.
+
+## Prerequisites
+
+- Serial console access (115200 8N1) — required to interrupt U-Boot.
+  Disassembly is needed to reach the UART header.  See the [OpenWrt
+  Vero W6m page][vero-openwrt] for details.
+- TFTP server on the local network with `u-boot.bin` for the initial
+  RAM boot.
+- SSH access from the running Infix system to a host that stores
+  `infix-vero-w-emmc.img`.
+- Ethernet cable connected between the PC and the Vero Internet/WAN
+  port.
+- DHCP server running on the PC, serving addresses on that link during
+  installation.
+- **Save the MAC addresses** from the stock U-Boot environment before
+  installing.  Interrupt autoboot and run `printenv` to note down:
+  `2gMAC`, `5gMAC`, `6gMAC`, `LANMAC`, and `WANMAC`.
+
+## Required Files
+
+Prepare these files on a host reachable from the Vero:
+
+1. **Infix Vero image:**
+   - [infix-vero-w-emmc.img][1] (Complete system image)
+2. **eMMC bootloader** (extracted from):
+   - [bpi-r3-emmc-boot-2025.01-latest.tar.gz][2]
+   - Extract `u-boot.bin` from the tarball to your TFTP server
+
+## Installing Infix
+
+Connect the PC directly to the Vero Internet/WAN port before starting
+the installation.  The PC should provide DHCP service on that link so
+the stock U-Boot and the temporary Infix system can reach the TFTP/SSH
+host.
+
+1. **RAM-load Infix U-Boot** from the stock U-Boot serial console
+   (hit any key to stop autoboot):
+
+   ```
+   setenv serverip <TFTP_SERVER_IP>
+   setenv ipaddr <VERO_IP>
+   setenv bootmenu_default 7
+   tftpboot 0x46000000 u-boot.bin
+   go 0x46000000
+   ```
+
+   `serverip` must point to your TFTP server and `ipaddr` must be a free
+   address for the Vero on the same subnet.  `bootmenu_default 7`
+   bypasses secure boot verification.  The Infix U-Boot will
+   automatically netboot the Infix system.
+
+2. **From running Infix**, stream the image directly to eMMC:
+
+   ```bash
+   ssh <USER>@<HOST> "dd if=/path/to/infix-vero-w-emmc.img bs=512 skip=17408 status=none" | \
+   dd of=/dev/mmcblk0 bs=512 seek=17408 conv=fsync
+   sync
+   ```
+
+   This writes only the Infix partitions (starting after fip at sector
+   17408), leaving the factory bootloader and calibration data intact.
+   Do not interrupt the transfer; if it fails, rerun the command from
+   the beginning.
+
+3. **Update the GPT** to replace stock partitions 5+ with the Infix
+   layout:
+
+   ```bash
+   sudo sgdisk --zap-all /dev/mmcblk0
+   sudo sgdisk -a 1 \
+       -n2:8192:9215      -c2:u-boot-env  \
+       -n3:9216:13311     -c3:factory      \
+       -n4:13312:17407    -c4:fip          \
+       -n5:17408:+32M     -c5:infix-uboot \
+       -n6:0:+8M          -c6:aux         \
+       -n7:0:+250M        -c7:primary     \
+       -n8:0:+250M        -c8:secondary   \
+       -n9:0:+128M        -c9:cfg         \
+       -n10:0:+128M       -c10:var        \
+       -p /dev/mmcblk0
+   ```
+
+4. **Configure U-Boot to chainload Infix permanently** — reboot and
+   interrupt stock U-Boot again:
+
+   ```
+   setenv bootmenu_default 7
+   setenv bootcmd 'mmc read 0x46000000 0x4400 0x10000; go 0x46000000'
+   saveenv
+   reset
+   ```
+
+   The `bootcmd` reads the Infix U-Boot (at sector 0x4400/17408)
+   into RAM and jumps to it.  After `reset`, Infix boots from eMMC.
+
+[vero-openwrt]: https://openwrt.org/toh/acer/predator_vero_w6m
+[1]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-vero-w-emmc.img
+[2]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r3-emmc-boot-2025.01-latest.tar.gz

board/aarch64/acer-connect-vero-w6m/acer-connect-vero-w6m.hash

@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d48246c717b505cc11df95171f2fd548b389e1a463f1af4c68d0b69fe0d1009b  LICENSE

board/aarch64/acer-connect-vero-w6m/acer-connect-vero-w6m.mk

@@ -0,0 +1,2 @@
+$(eval $(ix-board))
+$(eval $(generic-package))

board/aarch64/acer-connect-vero-w6m/dts/Makefile

@@ -0,0 +1 @@
+dtb-y += mediatek/mt7986a-acer-connect-vero-w6m.dtb

board/aarch64/acer-connect-vero-w6m/dts/mediatek/mt7986a-acer-connect-vero-w6m-common.dtsi

@@ -0,0 +1,425 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/pinctrl/mt65xx.h>
+
+#include <arm64/mediatek/mt7986a.dtsi>
+
+/ {
+	chosen {
+		stdout-path = "serial0:115200n8";
+                infix {
+                        /* Default admin user password: 'admin' */
+                        factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+                };
+	};
+
+	memory@40000000 {
+		reg = <0 0x40000000 0 0x20000000>;
+		device_type = "memory";
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-1.8V";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		factory {
+			label = "factory";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&pio {
+	wifi_rst_hog: wifi-reset-hog {
+		gpio-hog;
+		gpios = <6 GPIO_ACTIVE_LOW>;
+		output-low;
+		line-name = "wifi-reset";
+	};
+
+	mmc0_pins_default: mmc0-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <MTK_DRIVE_6mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+
+		conf-ds {
+			pins = "EMMC_DSL";
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-uhs-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <MTK_DRIVE_6mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+
+		conf-ds {
+			pins = "EMMC_DSL";
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+	};
+
+	pcie_pins: pcie-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_pereset";
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <MTK_DRIVE_4mA>;
+		};
+	};
+
+	wf_dbdc_pins: wf-dbdc-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_dbdc";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+				"WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+				"WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+				"WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+				"WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+				"WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+				"WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <MTK_DRIVE_4mA>;
+		};
+	};
+
+	i2c_pins: i2c-pins {
+		mux {
+			function = "i2c";
+			groups = "i2c";
+		};
+	};
+};
+
+&trng {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c_pins>;
+	status = "okay";
+};
+
+&mmc0 {
+	status = "okay";
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <0x08>;
+	max-frequency = <200000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x14014>;
+	vmmc-supply = <&reg_3p3v>;
+	vqmmc-supply = <&reg_1p8v>;
+	non-removable;
+	no-sd;
+	no-sdio;
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	card@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+
+		block {
+			compatible = "block-device";
+
+			partitions {
+				block-partition-factory {
+					partname = "factory";
+
+					nvmem: nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						eeprom_factory_0: eeprom@0 {
+							reg = <0x0 0x1000>;
+						};
+
+						precal_factory_1010: precal@1010 {
+							reg = <0x1010 0x62810>;
+						};
+					};
+				};
+			};
+		};
+	};
+};
+
+&pcie {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie_pins>;
+	num-lanes = <1>;
+	status = "okay";
+
+	slot0: pcie@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		#address-cells = <0x03>;
+		#size-cells = <0x02>;
+
+		pcie_wifi: wifi@0,0 {
+			compatible = "mediatek,mt76";
+			reg = <0x0000 0 0 0 0>;
+		};
+	};
+};
+
+&pcie_phy {
+	status = "okay";
+};
+
+&pcie_port {
+	clocks = <&clk40m>, <&topckgen CLK_TOP_PCIE_PHY_SEL>;
+	clock-names = "ref", "da_ref";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		switch: switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				swport0: port@0 {
+					reg = <0>;
+					phy-handle = <&swphy0>;
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan1";
+					phy-handle = <&swphy1>;
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan2";
+					phy-handle = <&swphy2>;
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan3";
+					phy-handle = <&swphy3>;
+				};
+
+				port@6 {
+					reg = <6>;
+					label = "cpu";
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+
+			mdio {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				swphy0: phy@0 {
+					reg = <0>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy1: phy@1 {
+					reg = <1>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy2: phy@2 {
+					reg = <2>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy3: phy@3 {
+					reg = <3>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+			};
+		};
+	};
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>, <&precal_factory_1010>;
+	nvmem-cell-names = "eeprom", "precal";
+	pinctrl-names = "default", "dbdc";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+	pinctrl-1 = <&wf_dbdc_pins>;
+	status = "okay";
+};

board/aarch64/acer-connect-vero-w6m/dts/mediatek/mt7986a-acer-connect-vero-w6m-factory-eeprom.dtsi

@@ -0,0 +1,263 @@
+/* Factory EEPROM for MT7976 WMAC (DBDC) - Acer Connect Vero W */
+/* Band 1 patched from 5GHz-only to 5GHz+6GHz selectable */
+
+&wifi {
+	mediatek,eeprom-data = <
+		 0x86790100 0x000c4326 0x60100000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x01000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000800 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+ 		 0x12525353 0x003c003f 0x3a100700 0x15030000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x0000be00 0x00000000
+		 0x0000c100 0x00000000 0x00000000 0xc3000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000009 0x00000000 0x00000000
+		 0x00000000 0x00000303 0x03030303 0x03030303
+		 0x03030303 0x03030303 0x03040303 0x03040303
+		 0x03040303 0x03040000 0x00161b18 0x1b1a1a1a
+		 0x1a0d0008 0x0f0d0209 0x0e0d0209 0x0e0d0209
+		 0x0e0c020a 0x0e0c020a 0x0e0c020a 0x0e0b020b
+		 0x0e2b2b2b 0x2b222222 0x22222222 0x22222222
+		 0x22222222 0x22222222 0x22000000 0x00000000
+		 0x00000000 0x002a2a2a 0x2a282828 0x282a2a2a
+		 0x2a282828 0x282a2a2a 0x2a282828 0x282a2a2a
+		 0x2a282828 0x28000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x007f7f20 0x2530363c 0x41014847 0x4c52575c
+		 0x7f7f7f7f 0x1b222a33 0x3a40014d 0x464c525a
+		 0x5e7f7f7f 0x7f252834 0x3c424a01 0x4a4f555d
+		 0x636e7f7f 0x7f7f202a 0x303b444a 0x014a5158
+		 0x5f666e7f 0x7f7f7f7f 0x8080c5c5 0xd1d1dddd
+		 0xe5e5f3f3 0x40408080 0xcfcfdbdb 0xe3e3efef
+		 0xf7f74040 0x8080bfbf 0xcbcbd9d9 0xe5e5eded
+		 0x40408080 0xb9b9c5c5 0xd3d3dfdf 0xe7e74040
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0xc0a0c0e0 0xfcfcafe0 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x02200220 0x02200220 0x02300230 0x02300230
+		 0x02300230 0x02300230 0x02300230 0x02300230
+		 0x02240224 0x02240224 0x02240224 0x02240224
+		 0x02240224 0x02240224 0x02240224 0x02240224
+		 0x000000c4 0xc4c4c4c4 0x0000c4c4 0xc4c4c1c1
+		 0x008282c3 0xc3000000 0x00838300 0xc4c4c4c1
+		 0xc1008282 0x8383c3c3 0xc2c10000 0x83838484
+		 0xc4c4c4c1 0xc1008282 0x8383c4c4 0xc4c1c100
+		 0x82828383 0xc4c4c4c1 0xc1008282 0x8383c4c4
+		 0xc3c100c4 0x81c4c3c2 0x00818181 0xc4c4c3c2
+		 0x00818282 0x00c4c4c2 0xc2008182 0x8200c4c4
+		 0xc3c20081 0x82828484 0xc4c4c3c2 0x00818282
+		 0x8484c4c4 0xc2c20081 0x82828484 0xc4c4c2c1
+		 0x81828383 0x8585c4c4 0xc3c20081 0x82828484
+		 0xc4c4c3c2 0x00818282 0x8484c4c4 0xc3c20081
+		 0x82828484 0xc6c5c3c1 0x00c5c5c3 0xc2008182
+		 0x828484c5 0xc5c3c200 0x81828284 0x84c4c4c3
+		 0xc2008182 0x828484c4 0xc4c2c181 0x82838385
+		 0x85c5c5c3 0xc2008182 0x828484c5 0xc5c3c200
+		 0x81828284 0x84c5c5c3 0xc2008182 0x82848400
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x378a6e05 0x0ae64a6c 0x00000000 0x50050000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00b40000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x86828786 0x87c8cb8a 0x8380c982 0x00c8ca86
+		 0x8383c583 0x83c1c58c 0x8883c78b 0x8780c28c
+		 0x8485c682 0xc3c4c4c4 0xc5c6c7c8 0xcfcecdcc
+		 0xcccdcec1 0xc1c1c1c2 0xc4c6c7ce 0xcecfcfcf
+		 0xcecec6c7 0xc8c9caca 0xcbcbd2d2 0xd2d2d0ce
+		 0xcc8100c1 0xc3c5c6c7 0xc8d0d0d1 0xd1d1d0cf
+		 0xdeee6be7 0x5fede2eb 0xce08ce09 0xce0ace0a
+		 0x4e0b4f0b 0x4f0c4f0c 0x4f0d4f0d 0x540a540b
+		 0x540c540b 0x540c510a 0x510b510c 0xd10c510d
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0xde0fde10 0xde115e12
+		 0xde12de12 0xde135e14 0x5e0cde0d 0xde0e5e10
+		 0x5e105e10 0x5e11de11 0xde0ede0f 0xde10de11
+		 0x5e12de12 0x5e135e13 0xde0f5e11 0x5e12de13
+		 0x5e13de13 0xde14de14 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00848484 0x84848484 0x84000000 0x00e4d5d4
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+	>;
+};

board/aarch64/acer-connect-vero-w6m/dts/mediatek/mt7986a-acer-connect-vero-w6m-pcie-eeprom.dtsi

@@ -0,0 +1,263 @@
+/* Factory EEPROM for PCIe MT7916 radio - Acer Connect Vero W */
+/* Offset 0xa0000 in the "factory" GPT partition on eMMC */
+
+&pcie_wifi {
+	mediatek,eeprom-data = <
+		 0x16790000 0x000c4326 0x60000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x50750000 0x07670700 0x00000400 0x50710000
+		 0x00000000 0x00000400 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0xb101e748 0xf57f5e99
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000800 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+ 		 0x12924848 0x003e003f 0x3a100000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x81a3a380
+		 0xa4910091 0x00910091 0x00910000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x000a0000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x0000c500 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000013 0x12120000 0x00000000
+		 0x00000000 0x00000303 0x03030303 0x03030303
+		 0x03030303 0x03030505 0x05050505 0x05050505
+		 0x05050505 0x05050000 0x001b1919 0x19181818
+		 0x180f0006 0x1c0e080a 0x170e080a 0x170d0809
+		 0x170d020a 0x0e0d020a 0x0e0d020a 0x0e0b020a
+		 0x0e22222c 0x2c2b2b2b 0x2b2b2b2b 0x2b2b2b2b
+		 0x2b2b2b2b 0x2b2b2b2b 0x2b000000 0x00000000
+		 0x00000000 0x001e201e 0x201e2020 0x201e201e
+		 0x20201e20 0x20272929 0x29272727 0x27272929
+		 0x29272727 0x27000000 0x00000000 0x00000000
+		 0x00000000 0x00cdcfcf 0xcfcfcf00 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x007f7f20 0x2530363c 0x41014347 0x4c52575c
+		 0x7f7f0000 0x00000000 0x00000000 0x00000000
+		 0x0000007f 0x7f252834 0x3c424a01 0x4d4f555f
+		 0x636e7f7f 0x7f7f202a 0x303b444a 0x014d5158
+		 0x5f666e7f 0x7f7f7f7f 0x8080c5c5 0xcbcbd9d9
+		 0xe1e1ebeb 0x40408080 0xcfcfdbdb 0xe3e3efef
+		 0xf7f74040 0x8080c1c1 0xcdcdd5d5 0xe1e1eded
+		 0x40408080 0xbbbbc7c7 0xcfcfdbdb 0xe7e74040
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0xb0900000 0x0000c0f0 0xf8000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x02000200 0x02000200 0x02000200 0x02000200
+		 0x02000200 0x02000200 0x02000200 0x02000200
+		 0x02000200 0x02000200 0x02000200 0x02000200
+		 0x02000200 0x02000200 0x02000200 0x02000200
+		 0x000000c6 0xc6c6c6c4 0x0000c5c5 0xc5c4c1c1
+		 0x818383c3 0xc3c2c100 0x81848400 0xc5c5c4c1
+		 0xc1818383 0x8585c3c3 0xc2c10081 0x84848686
+		 0xc5c5c4c1 0xc1818383 0x8585c5c5 0xc4c1c181
+		 0x83838585 0xc5c5c4c1 0xc1818383 0x8585c6c6
+		 0xc4c300c6 0x00c6c4c3 0xc1008181 0xc6c6c4c3
+		 0xc1008181 0x00c5c5c3 0xc2008182 0x8200c6c6
+		 0xc4c3c100 0x81818686 0xc6c6c4c3 0xc1008181
+		 0x8686c5c5 0xc3c20081 0x82828787 0xc5c5c3c2
+		 0x00818282 0x8787c6c6 0xc4c3c100 0x81818686
+		 0xc6c6c4c3 0xc1008181 0x8686c6c6 0xc4c3c100
+		 0x81818686 0xc6c6c4c3 0x00c6c6c4 0xc3c10081
+		 0x818686c6 0xc6c4c3c1 0x00818186 0x86c5c5c3
+		 0xc2008182 0x828787c5 0xc5c3c281 0x82838388
+		 0x88c6c6c4 0xc3c10081 0x818686c6 0xc6c4c3c1
+		 0x00818186 0x86c6c6c4 0xc3c10081 0x81868600
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00b70000 0x00b70000 0x00000000 0x00000000
+		 0x01000000 0x0000c400 0xb8008700 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0xc7c60000 0x89898987 0x87858381 0x898a8b8b
+		 0x8a898785 0x88898988 0x87868584 0x00000000
+		 0x00000000 0xcccfcecd 0xcdcacecd 0xcbcfcece
+		 0xcfcfcfc7 0xcececdce 0xc7cfcec7 0xcfcfcfcf
+		 0xcfcf0000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x7fe2f0e4 0x00000000 0xa4de24df 0xa4e0a4e1
+		 0xa4e1a4de 0x24dfa4e0 0xa4e1a4e1 0xa4dea4df
+		 0xa4e0a4e1 0xa4e1a4de 0xa4df24e0 0xa4e1a4e1
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0xde0fde0f 0xde0fde10
+		 0xde11de11 0x5e12de12 0xde10de10 0xde10de11
+		 0xde12de12 0xde13de13 0x5a085a09 0x5a0a5a0a
+		 0x5a0a5a0a 0x5a0a5a0a 0x5a055a06 0x5a075a08
+		 0x5a085a09 0x5a095a09 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00ded453
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+	>;
+};

board/aarch64/acer-connect-vero-w6m/dts/mediatek/mt7986a-acer-connect-vero-w6m.dts

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7986a-acer-connect-vero-w6m-common.dtsi"
+#include "mt7986a-acer-connect-vero-w6m-pcie-eeprom.dtsi"
+
+/ {
+	model = "Acer Connect Vero W6m";
+	compatible = "acer,connect-vero-w", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+	};
+};
+
+&i2c0 {
+	led-controller@30 {
+		compatible = "kinetic,ktd2026";
+		reg = <0x30>;
+		vin-supply = <&reg_5v>;
+		vio-supply = <&reg_3p3v>;
+
+		led_status: multi-led {
+			color = <LED_COLOR_ID_RGB>;
+			function = LED_FUNCTION_STATUS;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			led@0 {
+				reg = <0>;
+				color = <LED_COLOR_ID_RED>;
+			};
+
+			led@1 {
+				reg = <1>;
+				color = <LED_COLOR_ID_GREEN>;
+			};
+
+			led@2 {
+				reg = <2>;
+				color = <LED_COLOR_ID_BLUE>;
+			};
+		};
+	};
+};
+
+&nvmem {
+	eeprom_factory_a0000: eeprom@a0000 {
+		reg = <0xa0000 0x1000>;
+	};
+
+	precal_factory_a1010: precal@a1010 {
+		reg = <0xa1010 0x62810>;
+	};
+};
+
+&swport0 {
+       label = "internet";
+};

board/aarch64/acer-connect-vero-w6m/genimage.cfg.in

@@ -0,0 +1,86 @@
+image cfg.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image var.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image #IX_ID##VERSION#-vero-w-#TARGET#.img {
+        hdimage {
+                partition-table-type = "gpt"
+                gpt-no-backup = true
+        }
+
+        /*
+         * Factory partitions (1-4) -- secure boot, do not overwrite.
+         * Offsets and sizes match the stock Acer GPT exactly.
+         * No image data is written, preserving factory content.
+         */
+        partition u-boot-env {
+                offset = 8192s
+                size = 1024s
+        }
+
+        partition factory {
+                offset = 9216s
+                size = 4096s
+        }
+
+        partition fip {
+                offset = 13312s
+                size = 4096s
+        }
+
+        /* Infix U-Boot, chainloaded by stock bootloader */
+        partition infix-uboot {
+                offset = 17408s
+                image = "u-boot.bin"
+                size = 32M
+        }
+
+        partition aux {
+                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+                image = "aux.ext4"
+        }
+
+        partition primary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition secondary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition cfg {
+                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+                image = "cfg.ext4"
+        }
+
+        partition var {
+                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+                image = "var.ext4"
+        }
+}

board/aarch64/acer-connect-vero-w6m/rootfs/usr/share/product/acer,connect-vero-w/etc/factory-config.cfg

@@ -0,0 +1,488 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "class": "infix-hardware:usb",
+        "name": "USB2",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      },
+      {
+        "name": "radio1",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "6GHz",
+          "channel": "auto"
+        }
+      },
+      {
+        "name": "radio2",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "5GHz",
+          "channel": "auto"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "internet",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Acer Connect Vero W"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "wifi1-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio1",
+          "access-point": {
+            "ssid": "Infix6G",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "wifi2-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio2",
+          "access-point": {
+            "ssid": "Infix5G",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      }
+
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "acer-connect-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "internet"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}

board/aarch64/bananapi-bpi-r3/Config.in

@@ -6,6 +6,7 @@ config BR2_PACKAGE_BANANAPI_BPI_R3
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7986
 	select BR2_PACKAGE_LINUX_FIRMWARE_AIROHA_EN8811H
+	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7916
 	select SDCARD_AUX
 	help
 	  Build Banana PI R3 support

board/aarch64/bananapi-bpi-r3/README.md

@@ -70,11 +70,11 @@ The BPI-R3 has a 4-position DIP switch that controls boot media:
 
 <img align="right" src="bootstrap-switch.webp" alt="DIP switches" width=200 padding=10>
 
-| Position | Mode        | Description                           |
-|----------|-------------|---------------------------------------|
-| 0000     | SD card     | Boot from microSD card                |
-| 0110     | eMMC        | Boot from internal eMMC (recommended) |
-| 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |
+| ABCD | Mode     | Description                           |
+|------|----------|---------------------------------------|
+| 0000 | SD card  | Boot from microSD card                |
+| 0101 | SPI NAND | Boot from SPI NAND (advanced users)   |
+| 1001 | eMMC     | Boot from internal eMMC (recommended) |
 
 > [!NOTE]
 > Switch position is read from left to right: "0" = OFF, "1" = ON.
@@ -150,6 +150,7 @@ From the U-Boot prompt:
 usb start
 fatload usb 0:1 0x50000000 infix-bpi-r3-emmc.img
 setexpr blocks ${filesize} / 0x200
+mmc dev 0
 mmc write 0x50000000 0x0 ${blocks}
 ```
 
@@ -211,6 +212,7 @@ sync
 2. Set boot switches to eMMC mode (see image above)
 3. Power on
 
+
 ## Troubleshooting
 
 ### Board won't boot

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-emmc.dtsi

@@ -19,4 +19,34 @@ possible to use dtbo in sysboot unless present in syslinux.conf
         no-sd;
         no-sdio;
         status = "okay";
+
+        #address-cells = <1>;
+        #size-cells = <0>;
+
+        card@0 {
+                compatible = "mmc-card";
+                reg = <0>;
+
+                partitions {
+                        compatible = "gpt-partitions";
+
+                        partition-factory {
+                                partname = "factory";
+
+                                nvmem-layout {
+                                        compatible = "fixed-layout";
+                                        #address-cells = <1>;
+                                        #size-cells = <1>;
+
+                                        eeprom_factory_wmac: eeprom@0 {
+                                                reg = <0x0 0x1000>;
+                                        };
+
+                                        eeprom_factory_pcie: eeprom@a0000 {
+                                                reg = <0xa0000 0x1000>;
+                                        };
+                                };
+                        };
+                };
+        };
 };

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3.dtsi

@@ -24,6 +24,18 @@ https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/patches-6.12/
 &secmon_reserved {
 	reg = <0 0x43000000 0 0x40000>;
 };
+/*
+ * The T-PHY's pcie-phy sub-node only claims clk40m ("ref") in the SoC
+ * dtsi.  CLK_TOP_PCIE_PHY_SEL ("da_ref") is left unclaimed, so the
+ * kernel's clk_disable_unused late_initcall gates it — killing the
+ * PCIe REFCLK output to the endpoint mid-probe.  Wire it here so the
+ * clock stays enabled while the PHY is active.
+ */
+&pcie_port {
+	clocks = <&clk40m>, <&topckgen CLK_TOP_PCIE_PHY_SEL>;
+	clock-names = "ref", "da_ref";
+};
+
 &cpu_thermal {
 	/delete-node/ trips;
 	/delete-node/ cooling-maps;

board/aarch64/bananapi-bpi-r3/genimage.cfg.in

@@ -24,7 +24,7 @@ image var.ext4 {
         }
 }
 
-image #INFIX_ID##VERSION#-bpi-r3-#TARGET#.img {
+image #IX_ID##VERSION#-bpi-r3-#TARGET#.img {
         hdimage {
                 partition-table-type = "gpt"
 

board/aarch64/bananapi-bpi-r3/uboot/extras.config

@@ -4,7 +4,7 @@ CONFIG_BOOTDELAY=2
 CONFIG_ENV_IS_NOWHERE=y
 # CONFIG_ENV_IS_IN_MMC is not set
 CONFIG_MULTI_DTB_FIT=y
-CONFIG_OF_LIST="mt7986a-bpi-r3-sd mt7986a-bpi-r3-emmc mt7986a-bpi-r3-mini"
+CONFIG_OF_LIST="mt7986a-bpi-r3-sd mt7986a-bpi-r3-emmc mt7986a-bpi-r3-mini mt7986a-acer-connect-vero-w6m"
 
 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y

board/aarch64/bananapi-bpi-r4/genimage.cfg.in

@@ -24,7 +24,7 @@ image var.ext4 {
         }
 }
 
-image #INFIX_ID##VERSION#-bpi-r4-#TARGET#.img {
+image #IX_ID##VERSION#-bpi-r4-#TARGET#.img {
         hdimage {
                 partition-table-type = "gpt"
                 gpt-no-backup = true

board/aarch64/bananapi-bpi-r64/README.md

@@ -14,7 +14,7 @@ The Banana Pi BPI-R64 is a networking board based on the MediaTek MT7622
 - 8 GB eMMC storage
 - microSD card slot
 - MT7531 Gigabit Ethernet switch (4x LAN + 1x WAN)
-- MT7603E built-in 2.4 GHz WiFi
+- MT7622 WMAC built-in 2.4 GHz 802.11ac WiFi
 - USB 3.0 port
 - 2x Mini PCIe slots
 
@@ -24,7 +24,7 @@ Infix comes preconfigured with:
 
 - **LAN ports** (lan0-lan3): Bridged for internal networking
 - **WAN port**: DHCP client enabled for internet connectivity
-- **WiFi** (wifi0-ap): Bridged to LAN (MT7615 PCIe card if fitted, otherwise MT7603E)
+- **WiFi** (wifi0-ap): Bridged to LAN (MT7622 WMAC, 2.4 GHz; or MT7615 PCIe card if fitted)
 
 ## Boot Switch Reference
 
@@ -113,6 +113,19 @@ mmc partconf 0 1 1 0
 
 ## Platform Notes
 
+### WiFi
+
+The MT7622 SoC includes a built-in WMAC that provides 2.4 GHz 802.11b/g/n/ac
+(2×2) — there is no 5 GHz capability from the onboard radio.
+
+For dual-band operation, a PCIe card can be fitted in one of the two Mini PCIe
+slots.  The [Banana Pi BPI-MT7615][bpi-mt7615] is a purpose-built dual-band
+(2.4 + 5 GHz, 802.11ac 4×4) module designed for BPI router boards and is a
+natural fit.  With it installed, Infix will use it in preference to the onboard
+WMAC for the `wifi0-ap` interface.
+
+[bpi-mt7615]: https://docs.banana-pi.org/en/BPI-MT7615/BananaPi_MT7615
+
 ### mmc0 = eMMC, mmc1 = SD
 
 On MT7622, MSDC0 (mmc0) is the 8-bit eMMC controller and MSDC1 (mmc1) is the

board/aarch64/bananapi-bpi-r64/genimage.cfg.in

@@ -24,7 +24,7 @@ image var.ext4 {
         }
 }
 
-image #INFIX_ID##VERSION#-bpi-r64-#TARGET#.img {
+image #IX_ID##VERSION#-bpi-r64-#TARGET#.img {
         hdimage {
                 partition-table-type = "hybrid"
                 # MT7622 TF-A partition driver detects GPT by checking MBR[0]

board/aarch64/friendlyarm-nanopi-r2s/genimage.cfg.in

@@ -26,7 +26,7 @@ image var.ext4 {
 	}
 }
 
-image #INFIX_ID##VERSION#-nanopi-r2s-sdcard.img {
+image #IX_ID##VERSION#-nanopi-r2s-sdcard.img {
 	hdimage {
 		partition-table-type = "gpt"
 	}

board/aarch64/marvell-espressobin/README.md

@@ -0,0 +1,232 @@
+# Marvell ESPRESSObin
+
+<img src="espressobin.png" alt="The board" width=800 padding=10>
+
+The [ESPRESSObin][0] is a single-board computer based on the [Marvell Armada
+3720][1] (dual Cortex-A53, AArch64) SoC and the [Marvell 88E6341][2] (Topaz)
+switch, oriented toward networking applications.
+
+The board design is old but the switch offers full Linux support, including
+advanced TSN features for [IEEE 1588-2019][3] (PTP) and [IEEE 802.1AS-2020][4]
+(gPTP).
+
+## Board Variants
+
+The board has gone through several hardware revisions:
+
+| Revision   | Storage             | Notes                          |
+|------------|---------------------|--------------------------------|
+| v1, v3, v5 | SPI NOR only        | Obsolete; U-Boot always in SPI |
+| v7         | SPI NOR + 4 GB eMMC | Current; SD and eMMC usable    |
+| Ultra      | SPI NOR + 4 GB eMMC | High-end variant               |
+
+On **all revisions** the Boot ROM is hardwired to load U-Boot from SPI NOR
+flash.  There is no strap or jumper to make the Boot ROM load directly from an
+SD card.  The SD card (or eMMC on v7/Ultra) is used only for the operating
+system.
+
+## Building
+
+The ESPRESSObin uses ext4 for its rootfs partitions rather than the default
+squashfs, because the stock SPI U-Boot lacks squashfs and `blkmap` support.
+The `ext4` configuration snippet enables this.  Apply it once after selecting
+the defconfig, then build and compose the SD card image:
+
+```sh
+make O=x-aarch64 aarch64_defconfig
+make O=x-aarch64 apply-ext4
+make O=x-aarch64
+
+utils/mkimage.sh -r x-aarch64 marvell-espressobin
+```
+
+The resulting image (`x-aarch64/images/infix-espressobin-sdcard.img`) contains
+a GPT disk with the standard Infix partition layout, using ext4 instead of the
+read-only squashfs:
+
+| Partition | Label     | Contents                     |
+|-----------|-----------|------------------------------|
+| 1         | aux       | RAUC upgrade state (ext4)    |
+| 2         | primary   | Rootfs slot primary (ext4)   |
+| 3         | secondary | Rootfs slot secondary (ext4) |
+| 4         | cfg       | Persistent config (ext4)     |
+| 5         | var       | Runtime data (ext4)          |
+
+## Writing to SD Card
+
+```sh
+dd if=infix-espressobin-sdcard.img of=/dev/sdX bs=4M status=progress conv=fsync
+```
+
+## Upgrading
+
+The build produces `x-aarch64/images/infix-aarch64-ext4.pkg`, a RAUC bundle
+containing the ext4 rootfs.  Once the board is running Infix, upgrade over the
+network in the usual way:
+
+```
+upgrade ftp://192.168.1.1/infix-aarch64-ext4.pkg
+```
+
+RAUC writes the new rootfs to the inactive slot, updates `BOOT_ORDER` in
+`/mnt/aux/uboot.env`, and the next boot picks it up automatically.
+
+> [!NOTE]
+> Use `infix-aarch64-ext4.pkg`, not the standard `infix-aarch64.pkg`.  The
+> standard bundle contains a squashfs rootfs which the stock U-Boot cannot
+> boot.
+
+## Booting with the Stock SPI U-Boot
+
+The stock Marvell U-Boot has `ext4load` and the standard variables
+(`$kernel_addr`, `$fdt_addr`, `$loadaddr`, `$console`, `$image_name`,
+`$fdt_name`) already set sensibly.  Connect to the board's console port, the
+micro USB connector, at 115200 8N1, interrupt autoboot, and paste the commands
+below.
+
+### Environment Variable Reference
+
+These variables are pre-set in the stock U-Boot environment.  Restore them
+with these values if they are ever lost or corrupted:
+
+```
+setenv kernel_addr  0x5000000
+setenv fdt_addr     0x4f00000
+setenv loadaddr     0x5000000
+setenv console      'console=ttyMV0,115200 earlycon=ar3700_uart,0xd0012000'
+setenv image_name   boot/Image
+setenv extra_params quiet
+```
+
+`$fdt_name` selects the device tree for your specific board revision:
+
+| Board revision | `fdt_name` value                                    |
+|----------------|-----------------------------------------------------|
+| v3 / v5        | `boot/marvell/armada-3720-espressobin.dtb`          |
+| v7             | `boot/marvell/armada-3720-espressobin-v7.dtb`       |
+| Ultra          | `boot/marvell/armada-3720-espressobin-ultra.dtb`    |
+| v3/v5 eMMC     | `boot/marvell/armada-3720-espressobin-emmc.dtb`     |
+| v7 eMMC        | `boot/marvell/armada-3720-espressobin-v7-emmc.dtb`  |
+
+```
+setenv fdt_name boot/marvell/armada-3720-espressobin.dtb   # adjust for your board
+```
+
+### Simple Boot
+
+Fixed boot from the primary slot, useful for initial bring-up:
+
+```
+setenv bootcmd 'mmc dev 0; \
+  ext4load mmc 0:2 $kernel_addr $image_name; \
+  ext4load mmc 0:2 $fdt_addr $fdt_name; \
+  setenv bootargs $console root=PARTLABEL=primary rw rootwait $extra_params rauc.slot=primary; \
+  booti $kernel_addr - $fdt_addr'
+saveenv
+```
+
+### Automatic Slot Selection (RAUC Integration)
+
+The CLI `upgrade` command writes to the inactive slot and updates `uboot.env`
+on the `aux` partition with the new boot order.  On the next boot U-Boot reads
+`BOOT_ORDER` from the aux partition and selects the appropriate slot.  The
+setup below also defines `bootcmd_primary`, `bootcmd_secondary`, and
+`bootcmd_net` for manual use (see [Manual Slot Selection](#manual-slot-selection)
+and [Netbooting](#netbooting)):
+
+```
+setenv bootcmd_boot \
+  'mmc dev 0; \
+   ext4load mmc 0:$bootpart $kernel_addr $image_name; \
+   ext4load mmc 0:$bootpart $fdt_addr $fdt_name; \
+   setenv bootargs $console root=PARTLABEL=$bootslot rw rootwait $extra_params rauc.slot=$bootslot; \
+   booti $kernel_addr - $fdt_addr'
+
+setenv bootcmd_primary   'setenv bootpart 2; setenv bootslot primary;   run bootcmd_boot'
+setenv bootcmd_secondary 'setenv bootpart 3; setenv bootslot secondary; run bootcmd_boot'
+
+setenv bootcmd_net \
+  'dhcp $kernel_addr $image_name; \
+   tftpboot $fdt_addr $fdt_name; \
+   setenv bootargs $console root=PARTLABEL=primary rw rootwait $extra_params rauc.slot=primary; \
+   booti $kernel_addr - $fdt_addr'
+
+setenv bootcmd \
+  'setenv bootpart 2; setenv bootslot primary; setenv auxpart 1; \
+   if ext4load mmc 0:$auxpart $loadaddr /uboot.env; then \
+     env import -c $loadaddr $filesize BOOT_ORDER; \
+   fi; \
+   if test "$BOOT_ORDER" = "secondary primary" || \
+      test "$BOOT_ORDER" = "secondary primary net"; then \
+     setenv bootpart 3; setenv bootslot secondary; \
+   fi; \
+   if test "$BOOT_ORDER" = "net" || \
+      test "$BOOT_ORDER" = "net primary" || \
+      test "$BOOT_ORDER" = "net secondary primary"; then \
+     run bootcmd_net; \
+   fi; \
+   echo ">> Booting $bootslot from mmc 0:$bootpart ..."; \
+   run bootcmd_boot'
+
+saveenv
+```
+
+### Manual Slot Selection
+
+To boot a specific slot without waiting for the autoboot countdown, interrupt
+the bootloader (press any key) and run one of the convenience commands defined
+above:
+
+```
+run bootcmd_primary      # boot from primary   (partition 2)
+run bootcmd_secondary    # boot from secondary (partition 3)
+run bootcmd_net          # netboot via DHCP/TFTP
+```
+
+You can also force a permanent change to which slot boots next by setting
+`BOOT_ORDER` directly from Linux (the change persists across reboots):
+
+```sh
+fw_setenv BOOT_ORDER "secondary primary"   # next boot: secondary
+fw_setenv BOOT_ORDER "primary secondary"   # next boot: primary  (default)
+```
+
+### Netbooting
+
+The stock U-Boot supports TFTP.  This is useful for testing a new kernel or
+device tree without reflashing the SD card.  Set up a TFTP server with the
+contents of the Infix `boot/` directory (from the built rootfs at
+`x-aarch64/target/boot/`) and configure the variables:
+
+```
+setenv serverip 192.168.1.1    # IP of your TFTP server
+setenv ipaddr   192.168.1.100  # board IP (omit if using dhcp)
+saveenv
+```
+
+Then netboot manually:
+
+```
+run bootcmd_net
+```
+
+`bootcmd_net` uses `dhcp` to obtain an IP address and the `$serverip` from
+the DHCP server (option 66), then downloads `$image_name` and `$fdt_name`
+via TFTP.  The kernel mounts the primary SD card slot as root, so the SD
+card must still be present.
+
+To make netbooting the default on next boot (e.g. for iterative kernel
+development), set `BOOT_ORDER` from Linux:
+
+```sh
+fw_setenv BOOT_ORDER "net primary secondary"
+```
+
+This causes `bootcmd` to attempt netboot first; on failure it falls through
+to the primary slot on the SD card.
+
+[0]: https://wiki.espressobin.net/
+[1]: https://www.marvell.com/content/dam/marvell/en/public-collateral/embedded-processors/marvell-embedded-processors-armada-37xx-hardware-specifications.pdf
+[2]: https://www.marvell.com/content/dam/marvell/en/public-collateral/switching/marvell-link-street-88E6341-product-brief.pdf
+[3]: https://standards.ieee.org/ieee/1588/6825/
+[4]: https://standards.ieee.org/ieee/802.1AS/7121/

board/aarch64/marvell-espressobin/genimage.cfg

@@ -1,25 +0,0 @@
-image cfg.ext4 {
-	ext4 {
-		label = "cfg"
-	}
-	empty = true
-	size = 16M
-}
-
-image sdcard.img {
-	hdimage {
-	}
-
-	partition rootfs {
-		partition-type = 0x83
-		image = "rootfs.ext4"
-	}
-
-	partition cfg {
-		partition-type = 0x83
-		image = "cfg.ext4"
-	}
-}
-
-# Silence genimage warnings
-config {}

board/aarch64/marvell-espressobin/genimage.cfg.in

@@ -0,0 +1,61 @@
+image cfg.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card.
+image var.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image #IX_ID##VERSION#-espressobin-#TARGET#.img {
+        hdimage {
+                partition-table-type = "gpt"
+        }
+
+        # No bootloader partition: U-Boot lives in SPI NOR flash on all
+        # ESPRESSObin board revisions.  The SD card carries the OS only.
+
+        partition aux {
+                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+                image = "aux.ext4"
+        }
+
+        partition primary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                image = "rootfs.ext2"
+        }
+
+        partition secondary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                image = "rootfs.ext2"
+        }
+
+        partition cfg {
+                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+                image = "cfg.ext4"
+        }
+
+        partition var {
+                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+                image = "var.ext4"
+        }
+}

board/aarch64/raspberrypi-rpi64/genimage.cfg.in

@@ -36,7 +36,7 @@ image var.ext4 {
 	}
 }
 
-image #INFIX_ID##VERSION#-rpi64-sdcard.img {
+image #IX_ID##VERSION#-rpi64-sdcard.img {
 	hdimage {
 		partition-table-type = "hybrid"
 	}

board/arm/microchip-sama7g54-ek/genimage.cfg.in

@@ -39,7 +39,7 @@ image var.ext4 {
 	}
 }
 
-image #INFIX_ID##VERSION#-sama7g54-ek-#TARGET#.img {
+image #IX_ID##VERSION#-sama7g54-ek-#TARGET#.img {
 	hdimage {
 		partition-table-type = "hybrid"
 	}

board/arm/raspberrypi-rpi2/genimage.cfg.in

@@ -36,7 +36,7 @@ image var.ext4 {
 	}
 }
 
-image #INFIX_ID##VERSION#-rpi2-sdcard.img {
+image #IX_ID##VERSION#-rpi2-sdcard.img {
 	hdimage {
 		partition-table-type = "hybrid"
 	}

board/common/Config.in

@@ -5,12 +5,13 @@ source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-qcow/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ext4-rauc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"
 
 endmenu
 
-config QEMU_SCRIPTS
+config IX_QEMU_SCRIPTS
 	bool "QEMU scripts"
 	default y
 	help
@@ -18,20 +19,20 @@ config QEMU_SCRIPTS
 	  directory, which can be used to launch virtual Infix
 	  instances.
 
-menuconfig TRUSTED_KEYS
+menuconfig IX_TRUSTED_KEYS
 	bool "Trusted keys for image"
 	help
 	 Keys that will be accepted for this image
 
-config TRUSTED_KEYS_DEVELOPMENT
+config IX_TRUSTED_KEYS_DEVELOPMENT
 	bool "Development key"
-	depends on TRUSTED_KEYS
+	depends on IX_TRUSTED_KEYS
 
-config TRUSTED_KEYS_DEVELOPMENT_PATH
+config IX_TRUSTED_KEYS_DEVELOPMENT_PATH
 	string
-	depends on TRUSTED_KEYS_DEVELOPMENT
+	depends on IX_TRUSTED_KEYS_DEVELOPMENT
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
 
-config TRUSTED_KEYS_EXTRA_PATH
+config IX_TRUSTED_KEYS_EXTRA_PATH
 	string "Path to extra keys to include in image"
-	depends on TRUSTED_KEYS
+	depends on IX_TRUSTED_KEYS

board/common/common.mk

@@ -1,14 +1,14 @@
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/image.mk
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/qemu/qemu.mk
 
-ifeq ($(TRUSTED_KEYS),y)
+ifeq ($(IX_TRUSTED_KEYS),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk
 
-TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)
+IX_TRUSTED_KEYS=$(IX_TRUSTED_KEYS_DEVELOPMENT_PATH) $(IX_TRUSTED_KEYS_EXTRA_PATH)
 define RAUC_POST_BUILD_INSTALL_CERT
 	@$(call IXMSG,"Installing signing cert for RAUC")
 	mkdir -p $(TARGET_DIR)/etc/rauc/keys
-	$(foreach crt,$(shell ls $(TRUSTED_KEYS)), \
+	$(foreach crt,$(shell ls $(IX_TRUSTED_KEYS)), \
 		cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)
 
 endef

board/common/image/image-ext4-rauc/Config.in

@@ -0,0 +1,27 @@
+config IX_IMAGE_EXT4_RAUC
+	bool "RAUC upgrade bundle (ext4)"
+	depends on BR2_TARGET_ROOTFS_EXT2
+	select BR2_PACKAGE_HOST_RAUC
+	help
+	  Create a RAUC upgrade bundle for targets using an ext4 rootfs
+	  image.  Intended for development boards whose bootloader does
+	  not support squashfs.
+
+config IX_IMAGE_EXT4_RAUC_KEY
+	string "signing key"
+	depends on IX_IMAGE_EXT4_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private key, in PKCS#8 format, used to sign
+	  the RAUC bundle; or a PKCS#11 URI.
+
+config IX_IMAGE_EXT4_RAUC_CERT
+	string "signing certificate"
+	depends on IX_IMAGE_EXT4_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+	help
+	  Path to the X509 certificate which will be associated with
+	  the bundle signature.
+
+	  NOTE: This cert MUST be included in the trust store of the
+	        system on which this bundle is to be installed.

board/common/image/image-ext4-rauc/generate.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+
+set -e
+
+ext2="${BINARIES_DIR}/rootfs.ext2"
+pkg="${BINARIES_DIR}/${ARTIFACT}-ext4.pkg"
+
+# RAUC internally uses the file extension to find a suitable install
+# handler, hence the name must be .img
+cp -f "${ext2}" "${WORKDIR}/rootfs.img"
+
+cat >"${WORKDIR}/manifest.raucm" <<EOF
+[update]
+compatible=${COMPATIBLE}
+version=${VERSION}
+
+[bundle]
+format=verity
+
+[image.rootfs]
+filename=rootfs.img
+EOF
+
+rauc --cert="${CERT}" --key="${KEY}" \
+     bundle "${WORKDIR}" "${pkg}.next"
+
+mv "${pkg}.next" "${pkg}"

board/common/image/image-ext4-rauc/image-ext4-rauc.mk

@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-ext4-rauc
+#
+################################################################################
+
+IMAGE_EXT4_RAUC_DEPENDENCIES := host-rauc
+IMAGE_EXT4_RAUC_CONFIG_VARS := KEY CERT
+
+$(eval $(ix-image))

board/common/image/image-itb-aux/Config.in

@@ -1,6 +1,6 @@
-config IMAGE_ITB_AUX
+config IX_IMAGE_ITB_AUX
 	bool "aux partition"
-	depends on IMAGE_ITB_ROOTFS
+	depends on IX_IMAGE_ITB_ROOTFS
 	select BR2_PACKAGE_HOST_UBOOT_TOOLS
 	select BR2_PACKAGE_HOST_GENIMAGE
 	help

board/common/image/image-itb-dl-release/Config.in

@@ -1,4 +1,4 @@
-menuconfig IMAGE_ITB_DL_RELEASE
+menuconfig IX_IMAGE_ITB_DL_RELEASE
 	bool "Download existing release"
 	depends on !BR2_TARGET_ROOTFS_SQUASHFS
 	help
@@ -7,9 +7,9 @@ menuconfig IMAGE_ITB_DL_RELEASE
 	  Infix image, to create a full disk image that can be
 	  provisioned to an SD-card or eMMC.
 
-config IMAGE_ITB_DL_RELEASE_URL
+config IX_IMAGE_ITB_DL_RELEASE_URL
 	string "URL"
-	depends on IMAGE_ITB_DL_RELEASE
+	depends on IX_IMAGE_ITB_DL_RELEASE
 	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
 	help
 	  URL to release tarball.

board/common/image/image-itb-gns3a/Config.in

@@ -1,23 +1,23 @@
-menuconfig IMAGE_ITB_GNS3A
+menuconfig IX_IMAGE_ITB_GNS3A
 	bool "GNS3 Appliance (ITB)"
 	depends on BR2_x86_64
-	select IMAGE_ITB_QCOW
+	select IX_IMAGE_ITB_QCOW
 	help
 	  Create a GNS3 appliance description that, together with the
 	  disk image, can be imported into GNS3.
 
-config IMAGE_ITB_GNS3A_RAM
+config IX_IMAGE_ITB_GNS3A_RAM
 	int "Reserved RAM (MiB)"
-	depends on IMAGE_ITB_GNS3A
+	depends on IX_IMAGE_ITB_GNS3A
 	default "192"
 	help
 	  Amount of host RAM reserved for an appliance instance.
 
 	  Minimum supported size is 192M.
 
-config IMAGE_ITB_GNS3A_IFNUM
+config IX_IMAGE_ITB_GNS3A_IFNUM
 	int "Number of interfaces"
-	depends on IMAGE_ITB_GNS3A
+	depends on IX_IMAGE_ITB_GNS3A
 	default "1"
 	help
 	  Number of Ethernet interfaces to create for an appliance instance.

board/common/image/image-itb-qcow/Config.in

@@ -1,6 +1,6 @@
-menuconfig IMAGE_ITB_QCOW
+menuconfig IX_IMAGE_ITB_QCOW
 	bool "QEMU disk image (ITB)"
-	depends on (IMAGE_ITB_ROOTFS && IMAGE_ITB_AUX) || IMAGE_ITB_DL_RELEASE
+	depends on (IX_IMAGE_ITB_ROOTFS && IX_IMAGE_ITB_AUX) || IX_IMAGE_ITB_DL_RELEASE
 	select BR2_PACKAGE_HOST_GENIMAGE
 	help
 	  Compose a full disk image with redundant Linux OS partitions,
@@ -11,9 +11,9 @@ menuconfig IMAGE_ITB_QCOW
 	  - Creating a GNS3 appliance
 	  - Developing/debugging issues in the boot process in QEMU
 
-menuconfig IMAGE_ITB_QCOW_SIZE
+menuconfig IX_IMAGE_ITB_QCOW_SIZE
 	string "Image size"
-	depends on IMAGE_ITB_QCOW
+	depends on IX_IMAGE_ITB_QCOW
 	default "512M"
 	help
 	  Create a disk image of this size.  A K/M/G suffix may be used
@@ -26,22 +26,22 @@ menuconfig IMAGE_ITB_QCOW_SIZE
 
 choice
 	prompt "Bootloader"
-	depends on IMAGE_ITB_QCOW
-	default IMAGE_ITB_QCOW_BOOT_EFI if BR2_x86_64
-	default IMAGE_ITB_QCOW_BOOT_NONE
+	depends on IX_IMAGE_ITB_QCOW
+	default IX_IMAGE_ITB_QCOW_BOOT_EFI if BR2_x86_64
+	default IX_IMAGE_ITB_QCOW_BOOT_NONE
 
-config IMAGE_ITB_QCOW_BOOT_NONE
+config IX_IMAGE_ITB_QCOW_BOOT_NONE
 	bool "None"
 	help
 	  Do not create any bootloader partition in the disk image.
 
-config IMAGE_ITB_QCOW_BOOT_EFI
+config IX_IMAGE_ITB_QCOW_BOOT_EFI
 	bool "EFI"
 	help
 	  Create a boot partition from a directory containing an EFI
 	  boot application, e.g. GRUB.
 
-config IMAGE_ITB_QCOW_BOOT_BIN
+config IX_IMAGE_ITB_QCOW_BOOT_BIN
 	bool "Binary"
 	help
 	  Create a boot partition from a raw image containing the boot
@@ -49,18 +49,18 @@ config IMAGE_ITB_QCOW_BOOT_BIN
 
 endchoice
 
-config IMAGE_ITB_QCOW_BOOT_DATA
+config IX_IMAGE_ITB_QCOW_BOOT_DATA
 	string "Bootloader data"
-	depends on IMAGE_ITB_QCOW
-	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
+	depends on IX_IMAGE_ITB_QCOW
+	depends on IX_IMAGE_ITB_QCOW_BOOT_EFI || IX_IMAGE_ITB_QCOW_BOOT_BIN
 	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
 	help
 	  Path to the directory or file holding the bootloader data.
 
-config IMAGE_ITB_QCOW_BOOT_OFFSET
+config IX_IMAGE_ITB_QCOW_BOOT_OFFSET
 	hex "Bootloader offset"
-	depends on IMAGE_ITB_QCOW
-	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
+	depends on IX_IMAGE_ITB_QCOW
+	depends on IX_IMAGE_ITB_QCOW_BOOT_EFI || IX_IMAGE_ITB_QCOW_BOOT_BIN
 	default 0x8000
 	help
 	  Offset at which the bootloader partition is placed. Remember

board/common/image/image-itb-qcow/image-itb-qcow.mk

@@ -6,8 +6,8 @@
 
 # We can source the rootfs+aux from a local build, or from a
 # downloaded release; so adjust our dependencies accordingly.
-IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_ROOTFS)     := image-itb-rootfs image-itb-aux
-IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_DL_RELEASE) := image-itb-dl-release
+IMAGE_ITB_QCOW_SRC-$(IX_IMAGE_ITB_ROOTFS)     := image-itb-rootfs image-itb-aux
+IMAGE_ITB_QCOW_SRC-$(IX_IMAGE_ITB_DL_RELEASE) := image-itb-dl-release
 
 IMAGE_ITB_QCOW_DEPENDENCIES := host-genimage $(IMAGE_ITB_QCOW_SRC-y)
 IMAGE_ITB_QCOW_CONFIG_VARS := BOOT_DATA BOOT_OFFSET SIZE

board/common/image/image-itb-rauc/Config.in

@@ -1,23 +1,23 @@
-menuconfig IMAGE_ITB_RAUC
+menuconfig IX_IMAGE_ITB_RAUC
 	bool "RAUC upgrade bundle (ITB)"
-	select IMAGE_ITB_ROOTFS
+	select IX_IMAGE_ITB_ROOTFS
 	select BR2_PACKAGE_HOST_RAUC
 	help
 	  Create RAUC upgrade bundle, for targets using ITB images,
 	  that can be used to upgrade a running system to this version
 	  of Infix.
 
-config IMAGE_ITB_RAUC_KEY
+config IX_IMAGE_ITB_RAUC_KEY
 	string "signing key"
-	depends on IMAGE_ITB_RAUC
+	depends on IX_IMAGE_ITB_RAUC
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
 	help
 	  Path to the private key, in PKCS#8 format, used to sign
 	  the RAUC bundle; or a PKCS#11 URI.
 
-config IMAGE_ITB_RAUC_CERT
+config IX_IMAGE_ITB_RAUC_CERT
 	string "signing certificate"
-	depends on IMAGE_ITB_RAUC
+	depends on IX_IMAGE_ITB_RAUC
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
 	help
 	  Path to the X509 certificate which will be associated with

board/common/image/image-itb-rootfs/Config.in

@@ -1,4 +1,4 @@
-menuconfig IMAGE_ITB_ROOTFS
+menuconfig IX_IMAGE_ITB_ROOTFS
 	bool "rootfs.itb+.itbh"
 	select BR2_TARGET_ROOTFS_SQUASHFS
 	select BR2_PACKAGE_HOST_UBOOT_TOOLS
@@ -7,9 +7,9 @@ menuconfig IMAGE_ITB_ROOTFS
 	  and extract detached header (.itbh) for U-Boot based
 	  targets.
 
-config IMAGE_ITB_ROOTFS_KEY
+config IX_IMAGE_ITB_ROOTFS_KEY
 	string "signing key"
-	depends on IMAGE_ITB_ROOTFS
+	depends on IX_IMAGE_ITB_ROOTFS
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
 	help
 	  Path to the private RSA key, in PKCS#8 format, used to sign

board/common/image/image-readme/Config.in

@@ -1,4 +1,4 @@
-config IMAGE_README
+config IX_IMAGE_README
 	bool "Install README.md in images"
 	help
 	  Install a README.md with useful information about getting

board/common/image/image-readme/image-readme.mk

@@ -13,6 +13,6 @@ $(BINARIES_DIR)/README.md: $(IMAGE_README_DIR)/README.md
 	@mkdir -p $(BINARIES_DIR)
 	@cp $< $@
 
-ifeq ($(IMAGE_README),y)
+ifeq ($(IX_IMAGE_README),y)
 TARGETS_ROOTFS += image-readme
 endif

board/common/image/ix-image.mk

@@ -12,15 +12,17 @@ $(1): $$($(2)_DEPENDENCIES)
 	BINARIES_DIR=$$(BINARIES_DIR) \
 	BR2_EXTERNAL_INFIX_PATH=$$(BR2_EXTERNAL_INFIX_PATH) \
 	ARTIFACT=$$(INFIX_ARTIFACT) \
-	COMPATIBLE=$$(INFIX_COMPATIBLE) \
+	COMPATIBLE=$$(IX_COMPATIBLE) \
 	VERSION=$$(INFIX_VERSION) \
-	$$(foreach var,$$($(2)_CONFIG_VARS),$$(var)=$$($(2)_$$(var)) ) \
+	$$(foreach var,$$($(2)_CONFIG_VARS),$$(var)=$$($(3)_$$(var)) ) \
 	$$($(2)_DIR)/generate.sh $$($(2)_OPTS)
 
-ifeq ($$($(2)),y)
+ifeq ($$($(3)),y)
 TARGETS_ROOTFS += $(1)
 endif
 
 endef
 
-ix-image = $(call inner-ix-image,$(pkgname),$(call UPPERCASE,$(pkgname)))
+# $(2) is the package-local make-var prefix (UPPERCASE pkgname); $(3) is
+# the IX_ prefixed Kconfig symbol name, see issue #1305.
+ix-image = $(call inner-ix-image,$(pkgname),$(call UPPERCASE,$(pkgname)),IX_$(call UPPERCASE,$(pkgname)))

board/common/lib.sh

@@ -16,7 +16,7 @@ die()
 #      DISK_IMAGE_SIZE="512"
 #      etc.
 #
-# Nested variables, like INFIX_COMPATIBLE="${INFIX_IMAGE_ID}"
+# Nested variables, like IX_COMPATIBLE="${IX_IMAGE_ID}"
 # are handled by sourcing the file in a subshell.
 #
 # shellcheck disable=SC1090

board/common/post-build.sh

@@ -37,7 +37,7 @@ EOF
 }
 
 if [ -f "$TARGET_DIR/etc/rauc/system.conf" ]; then
-    sed -i "s/compatible=.*/compatible=$INFIX_COMPATIBLE/" "$TARGET_DIR/etc/rauc/system.conf"
+    sed -i "s/compatible=.*/compatible=$IX_COMPATIBLE/" "$TARGET_DIR/etc/rauc/system.conf"
 fi
 
 if [ -n "${ID_LIKE}" ]; then
@@ -53,40 +53,40 @@ cp "$TARGET_DIR/etc/hostname" "$TARGET_DIR/etc/hostname.d/10-default"
 ixmsg "Creating /etc/os-release"
 rm -f "$TARGET_DIR/etc/os-release"
 {
-    echo "NAME=\"$INFIX_NAME\""
-    echo "ID=$INFIX_ID"
-    echo "PRETTY_NAME=\"$INFIX_TAGLINE $INFIX_VERSION\""
+    echo "NAME=\"$IX_NAME\""
+    echo "ID=$IX_ID"
+    echo "PRETTY_NAME=\"$IX_TAGLINE $INFIX_VERSION\""
     echo "ID_LIKE=\"${ID}\""
     echo "DEFAULT_HOSTNAME=$BR2_TARGET_GENERIC_HOSTNAME"
     echo "VERSION=\"${INFIX_VERSION}\""
     echo "VERSION_ID=${INFIX_VERSION}"
     echo "BUILD_ID=\"${INFIX_BUILD_ID}\""
-    if [ -n "$INFIX_IMAGE_ID" ]; then
-	echo "IMAGE_ID=\"$INFIX_IMAGE_ID\""
+    if [ -n "$IX_IMAGE_ID" ]; then
+	echo "IMAGE_ID=\"$IX_IMAGE_ID\""
     fi
     if [ -n "$INFIX_RELEASE" ]; then
 	echo "IMAGE_VERSION=\"$INFIX_RELEASE\""
     fi
-    echo "ARCHITECTURE=\"${INFIX_ARCH}\""
-    echo "HOME_URL=$INFIX_HOME"
-    if [ -n "$INFIX_VENDOR" ]; then
-	echo "VENDOR_NAME=\"$INFIX_VENDOR\""
+    echo "ARCHITECTURE=\"${IX_ARCH}\""
+    echo "HOME_URL=$IX_HOME"
+    if [ -n "$IX_VENDOR" ]; then
+	echo "VENDOR_NAME=\"$IX_VENDOR\""
     fi
-    if [ -n "$INFIX_VENDOR_HOME" ]; then
-	echo "VENDOR_HOME=\"$INFIX_VENDOR_HOME\""
+    if [ -n "$IX_VENDOR_HOME" ]; then
+	echo "VENDOR_HOME=\"$IX_VENDOR_HOME\""
     fi
-    if [ -n "$INFIX_DOC" ]; then
-	echo "DOCUMENTATION_URL=\"$INFIX_DOC\""
+    if [ -n "$IX_DOC" ]; then
+	echo "DOCUMENTATION_URL=\"$IX_DOC\""
     fi
-    if [ -n "$INFIX_SUPPORT" ]; then
-	echo "SUPPORT_URL=\"$INFIX_SUPPORT\""
+    if [ -n "$IX_SUPPORT" ]; then
+	echo "SUPPORT_URL=\"$IX_SUPPORT\""
     fi
-    if [ -n "$INFIX_DESC" ]; then
-	echo "INFIX_DESC=\"$INFIX_DESC\""
+    if [ -n "$IX_DESC" ]; then
+	echo "INFIX_DESC=\"$IX_DESC\""
     fi
 } > "$TARGET_DIR/etc/os-release"
 
-echo "$INFIX_TAGLINE $INFIX_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
+echo "$IX_TAGLINE $INFIX_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
 ixmsg "Creating /etc/version: $(cat "$TARGET_DIR/etc/version")"
 
 # In case of ambguities, this is what the image was built from
@@ -120,3 +120,29 @@ grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
 if [ "$BR2_PACKAGE_HOST_PYTHON_YANGDOC" = "y" ]; then
    mkyangdoc "$BINARIES_DIR/yangdoc.html"
 fi
+
+# Bundle the mkdocs User's Guide into the rootfs, served by the WebUI's
+# nginx at /guide/.  Only when the WebUI is present (nothing serves it
+# otherwise, and it keeps minimal images small) and mkdocs is on the build
+# host.  Best-effort: a failed build warns but does not abort the image
+# build, and the WebUI hides its User Guide entry when the docs are absent.
+mkuserguide()
+{
+    local cfg dst
+    cfg="$(readlink -f "$common/../..")/mkdocs.yml"
+    dst="$TARGET_DIR/var/www/guide"
+
+    if ! command -v mkdocs >/dev/null 2>&1; then
+        ixmsg "mkdocs not found, skipping User's Guide bundling"
+        return
+    fi
+    ixmsg "Building User's Guide into $dst"
+    if ! mkdocs build -f "$cfg" -d "$dst" --clean --quiet; then
+        ixmsg "WARNING: mkdocs build failed, shipping without on-device User's Guide"
+        rm -rf "$dst"
+    fi
+}
+
+if [ "$BR2_PACKAGE_WEBUI" = "y" ]; then
+    mkuserguide
+fi

board/common/qemu/Config.in.in

@@ -1,85 +1,85 @@
 mainmenu "QEMU Virtualization"
 
-config QEMU_ARCH_IS_32
+config IX_QEMU_ARCH_IS_32
 	bool
 
-config QEMU_ARCH_IS_64
+config IX_QEMU_ARCH_IS_64
 	bool
 
 choice
 	prompt "Target Architecture"
 	default @ARCH@
 
-config QEMU_riscv64
-	bool "risv64"
-	select QEMU_ARCH_IS_64
+config IX_QEMU_riscv64
+	bool "riscv64"
+	select IX_QEMU_ARCH_IS_64
 
-config QEMU_x86_64
+config IX_QEMU_x86_64
 	bool "x86_64"
-	select QEMU_ARCH_IS_64
+	select IX_QEMU_ARCH_IS_64
 
-config QEMU_arm
+config IX_QEMU_arm
 	bool "AArch32 (little endian)"
-	select QEMU_ARCH_IS_32
+	select IX_QEMU_ARCH_IS_32
 
-config QEMU_aarch64
+config IX_QEMU_aarch64
 	bool "AArch64 (little endian)"
-	select QEMU_ARCH_IS_64
+	select IX_QEMU_ARCH_IS_64
 
 endchoice
 
 choice
 	prompt "Loader"
-	default QEMU_LOADER_KERNEL
+	default IX_QEMU_LOADER_KERNEL
 
-config QEMU_LOADER_KERNEL
+config IX_QEMU_LOADER_KERNEL
 	bool "Kernel"
 
-config QEMU_LOADER_UBOOT
+config IX_QEMU_LOADER_UBOOT
 	bool "U-Boot"
-	depends on QEMU_aarch64
+	depends on IX_QEMU_aarch64
 
-config QEMU_LOADER_OVMF
+config IX_QEMU_LOADER_OVMF
 	bool "OVMF (UEFI)"
-	depends on QEMU_x86_64
+	depends on IX_QEMU_x86_64
 
 endchoice
 
 choice
      prompt "Rootfs type"
-     default QEMU_ROOTFS_INITRD
+     default IX_QEMU_ROOTFS_INITRD
 
-config QEMU_ROOTFS_MMC
+config IX_QEMU_ROOTFS_MMC
      bool "MMC"
-     depends on QEMU_aarch64
+     depends on IX_QEMU_aarch64
 
-config QEMU_ROOTFS_INITRD
+config IX_QEMU_ROOTFS_INITRD
      bool "Initrd"
-     depends on QEMU_LOADER_KERNEL
+     depends on IX_QEMU_LOADER_KERNEL
 
-config QEMU_ROOTFS_VSCSI
+config IX_QEMU_ROOTFS_VSCSI
      bool "Virtio SCSI"
 
 endchoice
 
 choice
      prompt "Console"
-     default QEMU_CONSOLE_SERIAL if QEMU_arm
-     default QEMU_CONSOLE_VIRTIO
+     default IX_QEMU_CONSOLE_SERIAL if IX_QEMU_arm
+     default IX_QEMU_CONSOLE_VIRTIO
 
-config QEMU_CONSOLE_VIRTIO
+config IX_QEMU_CONSOLE_VIRTIO
      bool "Virtio (hvc0)"
 
-config QEMU_CONSOLE_SERIAL
+config IX_QEMU_CONSOLE_SERIAL
      bool "Serial (ttyS0/ttyAMA0)"
-     depends on !QEMU_LOADER_OVMF
+     depends on !IX_QEMU_LOADER_OVMF
 endchoice
 
-config QEMU_MACHINE
+config IX_QEMU_MACHINE
 	string "Select emulated machine"
-	default "qemu-system-arm     -M virt,accel=kvm:tcg -cpu max" if QEMU_arm
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu cortex-a53" if QEMU_aarch64
-	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
+	default "qemu-system-arm     -M virt,accel=kvm:tcg -cpu max" if IX_QEMU_arm
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu cortex-a53" if IX_QEMU_aarch64
+	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if IX_QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
 	  want to tweak it, or change the acceleration.
@@ -88,7 +88,7 @@ config QEMU_MACHINE
 	  the defconfig you started with.  Currently Infix supports
 	  arm (AArch32), aarch64 (ARM64), and x86_64 (AMD64).
 
-config QEMU_MACHINE_RAM
+config IX_QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
 	default "448M"
 	help
@@ -96,62 +96,62 @@ config QEMU_MACHINE_RAM
 	  if you get kernel panic with: "System is deadlocked on memory",
 	  try increasing this one.
 
-config QEMU_KERNEL
+config IX_QEMU_KERNEL
 	string
-	depends on QEMU_LOADER_KERNEL
-	default "../zImage"  if QEMU_arm
-	default "../Image"   if QEMU_aarch64
-	default "../bzImage" if QEMU_x86_64
+	depends on IX_QEMU_LOADER_KERNEL
+	default "../zImage"  if IX_QEMU_arm
+	default "../Image"   if IX_QEMU_aarch64
+	default "../bzImage" if IX_QEMU_x86_64
 
-config QEMU_BIOS
+config IX_QEMU_BIOS
 	string
-	depends on !QEMU_LOADER_KERNEL
-	default "../u-boot.bin" if QEMU_LOADER_UBOOT
-	default "../OVMF.fd"    if QEMU_LOADER_OVMF
+	depends on !IX_QEMU_LOADER_KERNEL
+	default "../u-boot.bin" if IX_QEMU_LOADER_UBOOT
+	default "../OVMF.fd"    if IX_QEMU_LOADER_OVMF
 
-config QEMU_ROOTFS
+config IX_QEMU_ROOTFS
 	string
-	default "@DISK_IMG@" if !QEMU_ROOTFS_INITRD
-	default "../rootfs.squashfs" if QEMU_ROOTFS_INITRD
+	default "@DISK_IMG@" if !IX_QEMU_ROOTFS_INITRD
+	default "../rootfs.squashfs" if IX_QEMU_ROOTFS_INITRD
 
-config QEMU_DTB_EXTEND
+config IX_QEMU_DTB_EXTEND
 	bool
-	depends on QEMU_LOADER_UBOOT
-	default y if QEMU_aarch64
+	depends on IX_QEMU_LOADER_UBOOT
+	default y if IX_QEMU_aarch64
 
-if QEMU_ROOTFS_INITRD
+if IX_QEMU_ROOTFS_INITRD
 
-config QEMU_RW
+config IX_QEMU_RW
 	string "Writable /cfg layer"
-	depends on QEMU_ROOTFS_INITRD
+	depends on IX_QEMU_ROOTFS_INITRD
 	default "cfg.ext4"
 
-config QEMU_RW_VAR_OPT
+config IX_QEMU_RW_VAR_OPT
 	bool "Separate writable /var"
 
-if QEMU_RW_VAR_OPT
-config QEMU_RW_VAR_SIZE
+if IX_QEMU_RW_VAR_OPT
+config IX_QEMU_RW_VAR_SIZE
 	string "Size of /var"
 	default "256M"
-config QEMU_RW_VAR
+config IX_QEMU_RW_VAR
 	string "Writable /var layer"
 	default "var.ext4"
 endif
 
 endif
 
-config QEMU_VPD
+config IX_QEMU_VPD
 	bool "Emulate a Vital Product Data (VPD) Memory"
 
-config QEMU_HOST
+config IX_QEMU_HOST
 	string "Export host filesystem path"
 	default "/tmp"
 
-config QEMU_APPEND
+config IX_QEMU_APPEND
 	string "Extra kernel options"
-	depends on !QEMU_ROOTFS_MMC
+	depends on !IX_QEMU_ROOTFS_MMC
 
-config QEMU_EXTRA
+config IX_QEMU_EXTRA
 	string "Extra QEMU options"
 
 
@@ -159,72 +159,72 @@ comment "RTC"
 
 choice
 	prompt "Mode"
-	default QEMU_RTC_UTC
+	default IX_QEMU_RTC_UTC
 
-config QEMU_RTC_UTC
+config IX_QEMU_RTC_UTC
 	bool "UTC"
 
-config QEMU_RTC_LOCAL
+config IX_QEMU_RTC_LOCAL
 	bool "Local time"
 
-config QEMU_RTC_RANDOM
+config IX_QEMU_RTC_RANDOM
 	bool "Random"
 
 endchoice
 
 choice
 	prompt "Clock"
-	default QEMU_CLOCK_HOST
+	default IX_QEMU_CLOCK_HOST
 
-config QEMU_CLOCK_HOST
+config IX_QEMU_CLOCK_HOST
 	bool "Host clock"
 
-config QEMU_CLOCK_RT
+config IX_QEMU_CLOCK_RT
 	bool "Independent (monotonic)"
 
-config QEMU_CLOCK_VM
+config IX_QEMU_CLOCK_VM
 	bool "Virtual"
 
 endchoice
 
-config QEMU_RTC
+config IX_QEMU_RTC
 	string
-	default "utc"       if QEMU_RTC_UTC
-	default "localtime" if QEMU_RTC_LOCAL
-	default "random"    if QEMU_RTC_RANDOM
+	default "utc"       if IX_QEMU_RTC_UTC
+	default "localtime" if IX_QEMU_RTC_LOCAL
+	default "random"    if IX_QEMU_RTC_RANDOM
 
-config QEMU_CLOCK
+config IX_QEMU_CLOCK
 	string
-	default "host"      if QEMU_CLOCK_HOST
-	default "rt"        if QEMU_CLOCK_RT
-	default "vm"        if QEMU_CLOCK_VM
+	default "host"      if IX_QEMU_CLOCK_HOST
+	default "rt"        if IX_QEMU_CLOCK_RT
+	default "vm"        if IX_QEMU_CLOCK_VM
 
 comment "Networking"
 
 choice
      prompt "Network Mode"
-     default QEMU_NET_USER
+     default IX_QEMU_NET_USER
 
-config QEMU_NET_NONE
+config IX_QEMU_NET_NONE
      bool "None"
 
-config QEMU_NET_BRIDGE
+config IX_QEMU_NET_BRIDGE
      bool "Bridged"
 
-config QEMU_NET_USER
+config IX_QEMU_NET_USER
      bool "User"
 
-config QEMU_NET_TAP
+config IX_QEMU_NET_TAP
      bool "TAP"
 
-config QEMU_NET_ROCKER
+config IX_QEMU_NET_ROCKER
      bool "Rocker"
 
 endchoice
 
-config QEMU_NET_MODEL
+config IX_QEMU_NET_MODEL
 	string "Interface model"
-	default "virtio-net-device" if QEMU_arm
+	default "virtio-net-device" if IX_QEMU_arm
 	default "virtio-net-pci"
 	help
 	  The default, virtio-net-pci, NIC works for most use-cases, but
@@ -233,23 +233,23 @@ config QEMU_NET_MODEL
 
 	  Note: ARM 32-bit uses virtio-net-device (MMIO) by default.
 
-config QEMU_NET_BRIDGE_DEV
+config IX_QEMU_NET_BRIDGE_DEV
 	string "Bridge device"
-	depends on QEMU_NET_BRIDGE
+	depends on IX_QEMU_NET_BRIDGE
 	default "virbr0"
 
-config QEMU_NET_USER_OPTS
+config IX_QEMU_NET_USER_OPTS
 	string "User mode options"
-	depends on QEMU_NET_USER
+	depends on IX_QEMU_NET_USER
 	help
 	  Extra -nic user,<OPTIONS>
 
-config QEMU_NET_TAP_N
+config IX_QEMU_NET_TAP_N
 	int "Number of TAPs"
-	depends on QEMU_NET_TAP
+	depends on IX_QEMU_NET_TAP
 	default 1
 
-config QEMU_NET_PORTS
+config IX_QEMU_NET_PORTS
 	int "Number of Rocker switch ports"
-	depends on QEMU_NET_ROCKER
+	depends on IX_QEMU_NET_ROCKER
 	default 10

board/common/qemu/qemu.mk

@@ -10,7 +10,7 @@ qemu-kconfig = \
 	BR2_CONFIG="$(BINARIES_DIR)/qemu/.config" \
 	$(BUILD_DIR)/buildroot-config/$(1) $(2) "$(BINARIES_DIR)/qemu/Config.in"
 
-ifeq ($(QEMU_SCRIPTS),y)
+ifeq ($(IX_QEMU_SCRIPTS),y)
 
 .PHONY: run
 run:
@@ -33,7 +33,7 @@ $(BINARIES_DIR)/qemu/run.sh: $(QEMU_SCRIPTS_DIR)/run.sh
 $(BINARIES_DIR)/qemu/Config.in: $(QEMU_SCRIPTS_DIR)/Config.in.in
 	@mkdir -p $(dir $@)
 	@sed \
-		-e "s:@ARCH@:QEMU_$(BR2_ARCH):" \
+		-e "s:@ARCH@:IX_QEMU_$(BR2_ARCH):" \
 		-e "s:@DISK_IMG@:../$(INFIX_ARTIFACT).qcow2:" \
 	< $< >$@
 

board/common/qemu/run.sh

@@ -40,7 +40,7 @@ usage()
     echo "  ARGS1  Args before the '--' separator are for kernel space"
     echo "  --     Separator"
     echo "  ARGS2  Args after the '--' separator are for the init process"
-    echo "         Also, qemu.cfg has QEMU_APPEND which can affect this."
+    echo "         Also, qemu.cfg has IX_QEMU_APPEND which can affect this."
     echo
     echo "Example:"
     echo "  $prognm -- finit.debug"
@@ -62,45 +62,45 @@ load_qemucfg()
     # shellcheck disable=SC1090
     .  "./.config"
 
-    [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
-    [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
+    [ "$CONFIG_IX_QEMU_MACHINE" ] || die "Missing IX_QEMU_MACHINE"
+    [ "$CONFIG_IX_QEMU_ROOTFS"  ] || die "Missing IX_QEMU_ROOTFS"
 
-    [ -n "$CONFIG_QEMU_KERNEL" ] && [ -n "$CONFIG_QEMU_BIOS" ] \
-	&& die "QEMU_KERNEL conflicts with QEMU_BIOS"
+    [ -n "$CONFIG_IX_QEMU_KERNEL" ] && [ -n "$CONFIG_IX_QEMU_BIOS" ] \
+	&& die "IX_QEMU_KERNEL conflicts with IX_QEMU_BIOS"
 
-    [ -z "$CONFIG_QEMU_KERNEL" ] && [ -z "$CONFIG_QEMU_BIOS" ] \
-	&& die "QEMU_KERNEL or QEMU_BIOS must be set"
+    [ -z "$CONFIG_IX_QEMU_KERNEL" ] && [ -z "$CONFIG_IX_QEMU_BIOS" ] \
+	&& die "IX_QEMU_KERNEL or IX_QEMU_BIOS must be set"
 }
 
 loader_args()
 {
-    if [ "$CONFIG_QEMU_BIOS" ]; then
-	echo -n "-bios $CONFIG_QEMU_BIOS "
-    elif [ "$CONFIG_QEMU_KERNEL" ]; then
-	echo -n "-kernel $CONFIG_QEMU_KERNEL "
+    if [ "$CONFIG_IX_QEMU_BIOS" ]; then
+	echo -n "-bios $CONFIG_IX_QEMU_BIOS "
+    elif [ "$CONFIG_IX_QEMU_KERNEL" ]; then
+	echo -n "-kernel $CONFIG_IX_QEMU_KERNEL "
     fi
 }
 
 append_args()
 {
     # ARM 32-bit doesn't support virtio console properly, always use serial
-    if [ "$CONFIG_QEMU_arm" ]; then
+    if [ "$CONFIG_IX_QEMU_arm" ]; then
 	echo -n "console=ttyAMA0 "
-    elif [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
+    elif [ "$CONFIG_IX_QEMU_CONSOLE_VIRTIO" ]; then
 	echo -n "console=hvc0 "
-    elif [ "$CONFIG_QEMU_x86_64" ]; then
+    elif [ "$CONFIG_IX_QEMU_x86_64" ]; then
 	echo -n "console=ttyS0 "
-    elif [ "$CONFIG_QEMU_aarch64" ]; then
+    elif [ "$CONFIG_IX_QEMU_aarch64" ]; then
 	echo -n "console=ttyAMA0 "
     else
 	die "Unknown console"
     fi
 
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
+    if [ "$CONFIG_IX_QEMU_ROOTFS_INITRD" = "y" ]; then
 	# Size of initrd, rounded up to nearest kb
-	size=$((($(stat -c %s "$CONFIG_QEMU_ROOTFS") + 1023) >> 10))
+	size=$((($(stat -c %s "$CONFIG_IX_QEMU_ROOTFS") + 1023) >> 10))
 	echo -n "root=/dev/ram0 ramdisk_size=${size} "
-    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
+    elif [ "$CONFIG_IX_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	echo -n "root=PARTLABEL=primary "
     fi
 
@@ -110,20 +110,20 @@ append_args()
 	echo -n "debug "
     fi
 
-    echo -n "${QEMU_APPEND} ${QEMU_EXTRA_APPEND} "
+    echo -n "${IX_QEMU_APPEND} ${QEMU_EXTRA_APPEND} "
 }
 
 rootfs_args()
 {
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
-	echo -n "-initrd $CONFIG_QEMU_ROOTFS "
-    elif [ "$CONFIG_QEMU_ROOTFS_MMC" = "y" ]; then
+    if [ "$CONFIG_IX_QEMU_ROOTFS_INITRD" = "y" ]; then
+	echo -n "-initrd $CONFIG_IX_QEMU_ROOTFS "
+    elif [ "$CONFIG_IX_QEMU_ROOTFS_MMC" = "y" ]; then
 	echo -n "-device sdhci-pci "
 	echo -n "-device sd-card,drive=mmc "
-	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
-    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
+	echo -n "-drive id=mmc,file=$CONFIG_IX_QEMU_ROOTFS,if=none,format=raw "
+    elif [ "$CONFIG_IX_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	# ARM 32-bit virt machine uses MMIO virtio devices, not PCI
-	if [ "$CONFIG_QEMU_arm" ]; then
+	if [ "$CONFIG_IX_QEMU_arm" ]; then
 	    echo -n "-drive file=qemu.qcow2,if=none,format=qcow2,id=rootfs "
 	    echo -n "-device virtio-blk-device,drive=rootfs "
 	else
@@ -140,9 +140,9 @@ serial_args()
     echo -n "-chardev stdio,id=console0,mux=on "
     echo -n "-mon chardev=console0 "
 
-    if [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
+    if [ "$CONFIG_IX_QEMU_CONSOLE_VIRTIO" ]; then
 	echo -n "-device virtconsole,nr=0,name=console,chardev=console0 "
-    elif [ "$CONFIG_QEMU_CONSOLE_SERIAL" ]; then
+    elif [ "$CONFIG_IX_QEMU_CONSOLE_SERIAL" ]; then
 	echo -n "-serial chardev:console0 "
     else
 	die "Unknown console"
@@ -175,7 +175,7 @@ usb_args()
 
 rw_args()
 {
-    [ "$CONFIG_QEMU_RW" ] ||  return
+    [ "$CONFIG_IX_QEMU_RW" ] ||  return
 
     command -v mkfs.ext4 >/dev/null || die "$prognm: cannot find mkfs.ext4"
 
@@ -184,45 +184,45 @@ rw_args()
 	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
     fi
 
-    if ! [ -f "$CONFIG_QEMU_RW" ]; then
-	dd if=/dev/zero of="$CONFIG_QEMU_RW" bs=16M count=1 >/dev/null 2>&1
-	mkfs.ext4 -L cfg "$CONFIG_QEMU_RW" >/dev/null 2>&1
+    if ! [ -f "$CONFIG_IX_QEMU_RW" ]; then
+	dd if=/dev/zero of="$CONFIG_IX_QEMU_RW" bs=16M count=1 >/dev/null 2>&1
+	mkfs.ext4 -L cfg "$CONFIG_IX_QEMU_RW" >/dev/null 2>&1
     fi
 
     # ARM 32-bit virt machine uses MMIO virtio devices, not PCI
-    if [ "$CONFIG_QEMU_arm" ]; then
+    if [ "$CONFIG_IX_QEMU_arm" ]; then
 	echo -n "-drive file=aux.ext4,if=none,format=raw,id=aux "
 	echo -n "-device virtio-blk-device,drive=aux "
-	echo -n "-drive file=$CONFIG_QEMU_RW,if=none,format=raw,id=cfg "
+	echo -n "-drive file=$CONFIG_IX_QEMU_RW,if=none,format=raw,id=cfg "
 	echo -n "-device virtio-blk-device,drive=cfg "
 
-	if [ "$CONFIG_QEMU_RW_VAR_OPT" ]; then
-	    if ! [ -f "$CONFIG_QEMU_RW_VAR" ]; then
-		dd if=/dev/zero of="$CONFIG_QEMU_RW_VAR" bs=$CONFIG_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
-		mkfs.ext4 -L var "$CONFIG_QEMU_RW_VAR" >/dev/null 2>&1
+	if [ "$CONFIG_IX_QEMU_RW_VAR_OPT" ]; then
+	    if ! [ -f "$CONFIG_IX_QEMU_RW_VAR" ]; then
+		dd if=/dev/zero of="$CONFIG_IX_QEMU_RW_VAR" bs=$CONFIG_IX_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
+		mkfs.ext4 -L var "$CONFIG_IX_QEMU_RW_VAR" >/dev/null 2>&1
 	    fi
-	    echo -n "-drive file=$CONFIG_QEMU_RW_VAR,if=none,format=raw,id=var "
+	    echo -n "-drive file=$CONFIG_IX_QEMU_RW_VAR,if=none,format=raw,id=var "
 	    echo -n "-device virtio-blk-device,drive=var "
 	fi
     else
 	echo -n "-drive file=aux.ext4,if=virtio,format=raw,bus=0,unit=3 "
-	echo -n "-drive file=$CONFIG_QEMU_RW,if=virtio,format=raw,bus=0,unit=1 "
+	echo -n "-drive file=$CONFIG_IX_QEMU_RW,if=virtio,format=raw,bus=0,unit=1 "
 
-	if [ "$CONFIG_QEMU_RW_VAR_OPT" ]; then
-	    if ! [ -f "$CONFIG_QEMU_RW_VAR" ]; then
-		dd if=/dev/zero of="$CONFIG_QEMU_RW_VAR" bs=$CONFIG_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
-		mkfs.ext4 -L var "$CONFIG_QEMU_RW_VAR" >/dev/null 2>&1
+	if [ "$CONFIG_IX_QEMU_RW_VAR_OPT" ]; then
+	    if ! [ -f "$CONFIG_IX_QEMU_RW_VAR" ]; then
+		dd if=/dev/zero of="$CONFIG_IX_QEMU_RW_VAR" bs=$CONFIG_IX_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
+		mkfs.ext4 -L var "$CONFIG_IX_QEMU_RW_VAR" >/dev/null 2>&1
 	    fi
-	    echo -n "-drive file=$CONFIG_QEMU_RW_VAR,if=virtio,format=raw,bus=0,unit=2 "
+	    echo -n "-drive file=$CONFIG_IX_QEMU_RW_VAR,if=virtio,format=raw,bus=0,unit=2 "
 	fi
     fi
 }
 
 host_args()
 {
-    [ "$CONFIG_QEMU_HOST" ] || return
+    [ "$CONFIG_IX_QEMU_HOST" ] || return
 
-    echo -n "-virtfs local,path=$CONFIG_QEMU_HOST,security_model=none,writeout=immediate,mount_tag=hostfs "
+    echo -n "-virtfs local,path=$CONFIG_IX_QEMU_HOST,security_model=none,writeout=immediate,mount_tag=hostfs "
 }
 
 net_dev_args()
@@ -230,7 +230,7 @@ net_dev_args()
     name="e$1"
     mac=$(printf "02:00:00:00:00:%02x" "$1")
 
-    echo -n "-device $CONFIG_QEMU_NET_MODEL,netdev=$name,mac=$mac "
+    echo -n "-device $CONFIG_IX_QEMU_NET_MODEL,netdev=$name,mac=$mac "
     echo "$name	$mac" >>"$mactab"
 }
 
@@ -252,29 +252,29 @@ net_args()
     :> "$mactab"
     echo -n "-fw_cfg name=opt/mactab,file=$mactab "
 
-    if [ "$CONFIG_QEMU_NET_BRIDGE" = "y" ]; then
-	echo -n "-netdev bridge,id=e1,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
+    if [ "$CONFIG_IX_QEMU_NET_BRIDGE" = "y" ]; then
+	echo -n "-netdev bridge,id=e1,br=$CONFIG_IX_QEMU_NET_BRIDGE_DEV "
 	net_dev_args 1
-    elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
-	for i in $(seq 1 "$CONFIG_QEMU_NET_TAP_N"); do
+    elif [ "$CONFIG_IX_QEMU_NET_TAP" = "y" ]; then
+	for i in $(seq 1 "$CONFIG_IX_QEMU_NET_TAP_N"); do
 	    echo -n "-netdev tap,id=e$i,ifname=qtap$i "
 	    net_dev_args "$i"
 	done
-    elif [ "$CONFIG_QEMU_NET_ROCKER" = "y" ]; then
+    elif [ "$CONFIG_IX_QEMU_NET_ROCKER" = "y" ]; then
 	sw=sw0			# Only single switch support atm.
 	echo -n "-device '{\"driver\":\"rocker\", \"name\":\"${sw}\", "
 	echo -n "\"fp_start_macaddr\":\"02:00:00:00:00:01\", "
 	echo -n "\"ports\":["
-	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
+	for i in $(seq 1 "$CONFIG_IX_QEMU_NET_PORTS"); do
 	    [ "$i" -gt 1 ] && echo -n ", "
 	    echo -n "\"${sw}p${i}\""
 	done
 	echo -n "]}' "
-	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
+	for i in $(seq 1 "$CONFIG_IX_QEMU_NET_PORTS"); do
 	    rocker_port_args 0 "$i"
 	done
-    elif [ "$CONFIG_QEMU_NET_USER" = "y" ]; then
-	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"
+    elif [ "$CONFIG_IX_QEMU_NET_USER" = "y" ]; then
+	[ "$CONFIG_IX_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_IX_QEMU_NET_USER_OPTS"
 	echo -n "-netdev user,id=e1${useropts} "
 	net_dev_args 1
     else
@@ -285,7 +285,7 @@ net_args()
 # Vital Product data
 vpd_args()
 {
-    [ "$CONFIG_QEMU_VPD" = "y" ] || return
+    [ "$CONFIG_IX_QEMU_VPD" = "y" ] || return
 
     vpd_file="${qdir}/vpd"
 
@@ -324,8 +324,8 @@ random_date()
 
 rtc_args()
 {
-    rtc="${CONFIG_QEMU_RTC:-utc}"
-    clock="${CONFIG_QEMU_CLOCK:-host}"
+    rtc="${CONFIG_IX_QEMU_RTC:-utc}"
+    clock="${CONFIG_IX_QEMU_CLOCK:-host}"
     if [ "$rtc" = "random" ]; then
 	rtc=$(random_date)
     fi
@@ -358,28 +358,28 @@ extract_squashfs()
 run_qemu()
 {
     # Auto-extract rootfs.squashfs from rootfs.itb if needed for initrd mode
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ] && [ ! -f "$CONFIG_QEMU_ROOTFS" ]; then
-	itb="${CONFIG_QEMU_ROOTFS%.squashfs}.itb"
+    if [ "$CONFIG_IX_QEMU_ROOTFS_INITRD" = "y" ] && [ ! -f "$CONFIG_IX_QEMU_ROOTFS" ]; then
+	itb="${CONFIG_IX_QEMU_ROOTFS%.squashfs}.itb"
 	if [ -f "$itb" ]; then
-	    extract_squashfs "$itb" "$CONFIG_QEMU_ROOTFS"
+	    extract_squashfs "$itb" "$CONFIG_IX_QEMU_ROOTFS"
 	else
-	    die "Missing $CONFIG_QEMU_ROOTFS and cannot find $itb to extract it from"
+	    die "Missing $CONFIG_IX_QEMU_ROOTFS and cannot find $itb to extract it from"
 	fi
     fi
 
-    if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
+    if [ "$CONFIG_IX_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	if ! qemu-img check "qemu.qcow2"; then
 	    rm -f "qemu.qcow2"
 	fi
 	if [ ! -f "qemu.qcow2" ]; then
 	    echo "Creating qcow2 disk image for Qemu ..."
-	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
+	    qemu-img create -f qcow2 -o backing_file="$CONFIG_IX_QEMU_ROOTFS" \
 		     -F qcow2 "qemu.qcow2" > /dev/null
 	fi
     fi
 
     read -r qemu <<EOF
-	$CONFIG_QEMU_MACHINE -nodefaults -m $CONFIG_QEMU_MACHINE_RAM \
+	$CONFIG_IX_QEMU_MACHINE -nodefaults -m $CONFIG_IX_QEMU_MACHINE_RAM \
 	  $(loader_args) \
 	  $(rootfs_args) \
 	  $(serial_args) \
@@ -391,14 +391,14 @@ run_qemu()
 	  $(rtc_args) \
 	  $(vpd_args) \
 	  $(gdb_args) \
-	  $CONFIG_QEMU_EXTRA
+	  $CONFIG_IX_QEMU_EXTRA
 EOF
     # Save resulting command to a script, because I cannot for the life
     # of me figure out how to embed the JSON snippet for Rocker and run
     # it here without issues, spent way too much time on it -- Joachim
     run=$(mktemp -t run.qemu.XXX)
     echo "#!/bin/sh" > "$run"
-    if [ "$CONFIG_QEMU_KERNEL" ]; then
+    if [ "$CONFIG_IX_QEMU_KERNEL" ]; then
 	echo "$qemu -append \"$(append_args)\" $*" >> "$run"
     else
 	echo "$qemu $*" >> "$run"
@@ -419,9 +419,9 @@ EOF
 
 dtb_args()
 {
-    [ "$CONFIG_QEMU_LOADER_UBOOT" ] || return
+    [ "$CONFIG_IX_QEMU_LOADER_UBOOT" ] || return
 
-    if [ "$CONFIG_QEMU_DTB_EXTEND" ]; then
+    if [ "$CONFIG_IX_QEMU_DTB_EXTEND" ]; then
 	# On the current architecture, QEMU will generate an internal
 	# DT based on the system configuration.
 
@@ -445,12 +445,12 @@ dtb_args()
 
 generate_dot()
 {
-    [ "$CONFIG_QEMU_NET_TAP" = "y" ] || return
+    [ "$CONFIG_IX_QEMU_NET_TAP" = "y" ] || return
 
     hostports="<qtap1> qtap1"
     targetports="<e1> e1"
     edges="host:qtap1 -- target:e1 [kind=mgmt];"
-    for tap in $(seq 2 $((CONFIG_QEMU_NET_TAP_N - 1))); do
+    for tap in $(seq 2 $((CONFIG_IX_QEMU_NET_TAP_N - 1))); do
 	hostports="$hostports | <qtap$tap> qtap$tap "
 	targetports="$targetports | <e$tap> e$tap "
 	edges="$edges host:qtap$tap -- target:e$tap;"
@@ -485,7 +485,7 @@ EOF
 
 menuconfig()
 {
-    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the $$O/images/qemu directory"
+    grep -q IX_QEMU_MACHINE Config.in || die "$prognm: must be run from the $$O/images/qemu directory"
     command -v kconfig-mconf >/dev/null || die "$prognm: cannot find kconfig-mconf for menuconfig"
     exec kconfig-mconf Config.in
 }

board/common/rootfs/etc/default/webui

@@ -0,0 +1,5 @@
+RESTCONF_URL=https://127.0.0.1/restconf
+INSECURE_TLS=1
+# Spool firmware uploads (and any other temp files) to persistent storage
+# instead of the RAM-backed /tmp to enable push-upgrades on low-memory systems.
+TMPDIR=/var/tmp

board/common/rootfs/etc/finit.d/available/hostapd@.conf

@@ -1,3 +0,0 @@
-service <!> name:hostapd :%i \
-	[2345] hostapd -P/var/run/hostapd-%i.pid  /etc/hostapd-%i.conf \
-	-- Wi-Fi Access Point @%i

board/common/rootfs/etc/finit.d/available/mesh@.conf

@@ -0,0 +1,3 @@
+service name:wpa_supplicant :%i \
+	[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+	-- Wi-Fi Mesh @%i

board/common/rootfs/etc/finit.d/available/phc2sys@.conf

@@ -0,0 +1,3 @@
+service <!> name:phc2sys :%i log:prio:daemon,tag:phc2sys-%i \
+	[2345] phc2sys -a -z /var/run/ptp4l-%i \
+	-- PHC synchronization for PTP instance %i

board/common/rootfs/etc/finit.d/available/ptp4l@.conf

@@ -0,0 +1,3 @@
+service <!> name:ptp4l :%i log:prio:daemon,tag:ptp4l-%i \
+	[2345] ptp4l -f /etc/linuxptp/ptp4l-%i.conf \
+	-- PTP instance %i

board/common/rootfs/etc/nginx/app/restconf.conf

@@ -0,0 +1 @@
+../restconf.app

board/common/rootfs/etc/nginx/restconf-access-local.conf

@@ -0,0 +1,3 @@
+allow 127.0.0.1;
+allow ::1;
+deny all;

board/common/rootfs/etc/nginx/restconf-access.conf

@@ -0,0 +1 @@
+restconf-access-local.conf

board/common/rootfs/etc/nginx/restconf.app

@@ -1,5 +1,6 @@
 # /telemetry/optics is for streaming (not used atm)
 location ~ ^/(restconf|yang|.well-known)/ {
+    include /etc/nginx/restconf-access.conf;
     grpc_pass grpc://[::1]:10080;
     grpc_set_header Host $host;
     grpc_set_header X-Real-IP $remote_addr;

board/common/rootfs/etc/profile.d/update-check.sh

@@ -0,0 +1,3 @@
+if [ -s /run/os-update ]; then
+    printf '\n\033[1;33m *** %s ***\033[0m\n\n' "$(cat /run/os-update)"
+fi

board/common/rootfs/etc/sysctl.d/ipv4.conf

@@ -24,6 +24,10 @@ net.ipv4.conf.all.arp_ignore=1
 net.ipv4.ip_forward=1
 net.ipv4.ip_forward_update_priority=0
 
+# Allow binding to non-local addresses, e.g. floating VIPs not yet
+# configured on an interface, see issue #1022
+net.ipv4.ip_nonlocal_bind=1
+
 net.ipv4.conf.all.forwarding=0
 net.ipv4.conf.default.forwarding=0
 

board/common/rootfs/etc/sysctl.d/ipv6.conf

@@ -7,6 +7,10 @@ net.ipv6.conf.all.ignore_routes_with_linkdown=1
 net.ipv6.conf.all.forwarding=0
 net.ipv6.conf.default.forwarding=0
 
+# Allow binding to non-local addresses, e.g. floating VIPs not yet
+# configured on an interface, see issue #1022
+net.ipv6.ip_nonlocal_bind=1
+
 # Accept router advertisements even when forwarding is enabled
 net.ipv6.conf.all.accept_ra=2
 net.ipv6.conf.default.accept_ra=2

board/common/rootfs/etc/tmpfiles.d/os-schedule.conf

@@ -0,0 +1 @@
+f  /run/os-update  0666 admin admin

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -567,6 +567,59 @@ def probe_wifi_radios(out):
         out["wifi-radios"].append(info)
 
 
+def probe_ptp_capabilities(out):
+    """Probe PTP timestamping capabilities per physical interface via ethtool --json -T.
+
+    Only physical interfaces (those with a 'device' sysfs symlink) are probed;
+    virtual interfaces such as bridges, VLANs, and tun/tap devices are skipped.
+    Results are stored under out["interfaces"][<ifname>]["ptp-capabilities"].
+    """
+    net_base = "/sys/class/net"
+    if not os.path.exists(net_base):
+        return
+
+    ifaces = {}
+    for ifname in sorted(os.listdir(net_base)):
+        if ifname == "lo":
+            continue
+        # Physical interfaces have a 'device' symlink; virtual ones do not.
+        if not os.path.exists(os.path.join(net_base, ifname, "device")):
+            continue
+
+        try:
+            result = subprocess.run(
+                ["ethtool", "--json", "-T", ifname],
+                capture_output=True, text=True, timeout=5
+            )
+            if result.returncode != 0:
+                continue
+            data = json.loads(result.stdout)[0]
+        except Exception:
+            continue
+
+        caps = {
+            "capabilities": data.get("capabilities", []),
+            "tx-types":     data.get("tx-types", []),
+            "rx-filters":   data.get("rx-filters", []),
+        }
+
+        # phc-index is -1 when no PHC is present; omit in that case.
+        phc = data.get("phc-index", -1)
+        if phc >= 0:
+            caps["phc-index"] = phc
+
+        # hwtstamp provider fields are present only on newer kernels/hardware.
+        if (idx := data.get("hwtstamp-provider-index")) is not None:
+            caps["hwtstamp-provider-index"] = idx
+        if (qual := data.get("hwtstamp-provider-qualifier")) is not None:
+            caps["hwtstamp-provider-qualifier"] = qual
+
+        ifaces[ifname] = {"ptp-capabilities": caps}
+
+    if ifaces:
+        out.setdefault("interfaces", {}).update(ifaces)
+
+
 def main():
     out = {
         "vendor": None,
@@ -593,6 +646,7 @@ def main():
         return err
 
     probe_wifi_radios(out)
+    probe_ptp_capabilities(out)
 
     if not out["factory-password-hash"]:
         sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +

board/common/rootfs/usr/libexec/infix/iw.py

@@ -257,15 +257,15 @@ def parse_interface_info(ifname):
     for line in output.splitlines():
         stripped = line.strip()
 
-        # Interface type
+        # Interface type (can be multi-word, e.g. "mesh point")
         if stripped.startswith('type '):
-            result['iftype'] = stripped.split()[1]
+            result['iftype'] = ' '.join(stripped.split()[1:])
 
         # MAC address
         elif stripped.startswith('addr '):
             result['mac'] = stripped.split()[1]
 
-        # SSID
+        # SSID (AP mode) or mesh-id (mesh point mode) — kernel uses same attr
         elif stripped.startswith('ssid '):
             result['ssid'] = decode_iw_ssid(' '.join(stripped.split()[1:]))
 
@@ -538,6 +538,43 @@ def parse_link(ifname):
     return result
 
 
+def parse_phy_caps(phy_name):
+    """
+    Parse 'iw phy <name> info' for HT and VHT capability bitmasks.
+    Returns: {ht_cap: int, vht_cap: int}
+
+    iw phy info output format:
+        Capabilities: 0x1ef
+            ...
+        VHT Capabilities (0x339071b2):
+            ...
+    """
+    actual_phy = normalize_phy_name(phy_name)
+    output = run_iw('phy', actual_phy, 'info')
+    if not output:
+        output = run_iw(actual_phy, 'info')
+    if not output:
+        return {'ht_cap': 0, 'vht_cap': 0}
+
+    ht_cap = 0
+    vht_cap = 0
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # HT Capabilities: "Capabilities: 0x1ef"
+        ht_match = re.match(r'Capabilities:\s+(0x[0-9a-fA-F]+)', stripped)
+        if ht_match:
+            ht_cap = int(ht_match.group(1), 16)
+
+        # VHT Capabilities: "VHT Capabilities (0x339071b2):"
+        vht_match = re.match(r'VHT Capabilities\s+\((0x[0-9a-fA-F]+)\)', stripped)
+        if vht_match:
+            vht_cap = int(vht_match.group(1), 16)
+
+    return {'ht_cap': ht_cap, 'vht_cap': vht_cap}
+
+
 def main():
     if len(sys.argv) < 2:
         print(json.dumps({
@@ -548,7 +585,8 @@ def main():
                 'info': 'Get PHY or interface information (requires device)',
                 'survey': 'Get channel survey data (requires interface)',
                 'station': 'Get connected stations in AP mode (requires interface)',
-                'link': 'Get link info in station mode (requires interface)'
+                'link': 'Get link info in station mode (requires interface)',
+                'caps': 'Get HT/VHT capability bitmasks (requires PHY/radio)'
             },
             'examples': [
                 'iw.py list',
@@ -557,7 +595,8 @@ def main():
                 'iw.py info wlan0',
                 'iw.py station wifi0',
                 'iw.py link wlan0',
-                'iw.py survey wlan0'
+                'iw.py survey wlan0',
+                'iw.py caps radio0'
             ]
         }, indent=2))
         sys.exit(1)
@@ -594,6 +633,11 @@ def main():
                 data = {'error': 'survey command requires interface argument'}
             else:
                 data = parse_survey(sys.argv[2])
+        elif command == 'caps':
+            if len(sys.argv) < 3:
+                data = {'error': 'caps command requires PHY/radio argument'}
+            else:
+                data = parse_phy_caps(sys.argv[2])
         else:
             data = {'error': f'Unknown command: {command}'}
 

board/common/rootfs/usr/sbin/check-update

@@ -0,0 +1,55 @@
+#!/bin/sh
+# Check for available software updates and notify on login if one exists.
+# Called by the scheduler.
+
+NOTIFY_FILE=/run/os-update
+TAG=os-update
+
+# Source os-release for VERSION and IMAGE_ID
+if [ ! -f /etc/os-release ]; then
+    logger -t "$TAG" "ERROR: /etc/os-release not found"
+    exit 1
+fi
+. /etc/os-release
+
+# Dev/dirty builds have no comparable semver — always show the latest release
+IS_RELEASE=true
+if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
+    IS_RELEASE=false
+fi
+
+# Read configured update-url from running config, fall back to upstream
+UPDATE_URL=$(copy running-config \
+    -x '/ietf-system:system/infix-system:software/check-update/update-url' \
+    2>/dev/null \
+    | jq -r '.. | objects | ."update-url"? // empty')
+UPDATE_URL=${UPDATE_URL:-"https://github.com/kernelkit/infix"}
+
+# Derive API URL from the configured update URL.
+# Default (github.com): https://github.com/org/repo → https://api.github.com/repos/org/repo
+REPO=$(echo "$UPDATE_URL" | sed 's|https://github.com/||; s|/*$||')
+API_URL="https://api.github.com/repos/${REPO}/releases/latest"
+
+LATEST_TAG=$(curl -sSL --max-time 10 "$API_URL" 2>/dev/null \
+    | jq -r '.tag_name // empty')
+if [ -z "$LATEST_TAG" ]; then
+    logger -p daemon.info -t "$TAG" "Update check skipped: could not reach ${API_URL}"
+    exit 0
+fi
+LATEST=${LATEST_TAG#v}
+
+# Compare: is $1 strictly newer than $2?
+newer() {
+    [ "$1" = "$2" ] && return 1
+    [ "$(printf '%s\n%s' "$1" "$2" | sort -V | tail -1)" = "$1" ]
+}
+
+if [ "$IS_RELEASE" = false ] || newer "$LATEST" "$VERSION"; then
+    RELEASE_URL="${UPDATE_URL}/releases/${LATEST_TAG}"
+    MSG="Software update available: ${LATEST_TAG}, running ${VERSION} (see ${RELEASE_URL})"
+    logger -t "$TAG" "$MSG"
+    printf '%s\n' "$MSG" > "$NOTIFY_FILE"
+else
+    logger -p daemon.debug -t "$TAG" "No update available (current: $VERSION, latest: $LATEST)"
+    printf '' > "$NOTIFY_FILE"
+fi

board/common/rootfs/usr/sbin/container

@@ -652,7 +652,9 @@ wrap()
 
     if [ "$cmd" = "stop" ]; then
 	# The setup phase may run forever in the background trying to fetch
-	# the image.  It saves its PID in /run/containers/${name}.pid
+	# the image.  It saves its PID in /run/containers/${name}.pid.  Kill
+	# any in-flight setup, then fall through to podman stop -- a stale
+	# pidfile is not proof the container isn't running.
 	if [ -f "$pidfile" ]; then
             pid=$(cat "$pidfile")
 
@@ -663,10 +665,9 @@ wrap()
             fi
 
             rm -f "$pidfile"
-            return 0
 	fi
 
-	# Only the 'podman stop' command takes -i and --timeout
+	# Only the 'podman stop' command takes -i (ignore missing) and --timeout
 	args="-i --timeout $timeout"
     fi
 

board/common/uboot/scripts/ixpreboot.sh

@@ -33,7 +33,7 @@ for tgt in "${boot_targets}"; do
 	setexpr ixmenu_n ${ixmenu_n} + 1
 
 	if load ${devtype} ${devnum}:${auxpart} ${loadaddr} /uboot.env; then
-	    env import -b ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact BOARD_VARIANT
+	    env import -c ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact BOARD_VARIANT
 	    run ixvariant
 	fi
 

board/common/uboot/uboot.mk

@@ -25,7 +25,7 @@ define UBOOT_PRE_BUILD_INSTALL_KEY
 	$(HOST_DIR)/bin/dtc -a 1024 <(echo '/dts-v1/; / { signature {}; };') \
 		>$(@D)/infix-key.dtb
 	$(foreach key, \
-		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
+		$(call qstrip,$(IX_TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(IX_TRUSTED_KEYS_EXTRA_PATH)),\
 		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
@@ -46,3 +46,12 @@ define UBOOT_PRE_BUILD_INSTALL_ENV
 		$(@D)/arch/$(UBOOT_ARCH)/dts/
 endef
 UBOOT_PRE_BUILD_HOOKS += UBOOT_PRE_BUILD_INSTALL_ENV
+
+# Stamp non-release builds so they cannot be mistaken for a release,
+# U-Boot's setlocalversion picks up .scmversion, see issue #919.
+define UBOOT_PRE_BUILD_DEVEL_VERSION
+	echo "-DEVEL" >$(@D)/.scmversion
+endef
+ifeq ($(INFIX_RELEASE),)
+UBOOT_PRE_BUILD_HOOKS += UBOOT_PRE_BUILD_DEVEL_VERSION
+endif

configs/aarch64_defconfig

@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.39"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -75,6 +75,7 @@ BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_MTR=y
@@ -133,6 +134,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
+BR2_PACKAGE_ACER_CONNECT_VERO_W6M=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
 BR2_PACKAGE_BANANAPI_BPI_R4=y
 BR2_PACKAGE_BANANAPI_BPI_R64=y
@@ -141,11 +143,11 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
@@ -173,7 +175,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -185,12 +186,14 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
+# BR2_PACKAGE_LANDING is not set
+BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y

configs/aarch64_minimal_defconfig

@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.39"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -68,6 +68,7 @@ BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
@@ -120,11 +121,11 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
@@ -143,15 +144,16 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y

configs/aarch64_qemu_boot_defconfig

@@ -25,5 +25,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y

configs/arm_defconfig

@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.39"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -74,6 +74,7 @@ BR2_PACKAGE_FRR=y
 BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_MTR=y
@@ -128,6 +129,7 @@ BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
@@ -135,11 +137,11 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_MICROCHIP_SAMA7G54_EK=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
 BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
@@ -161,7 +163,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -169,11 +170,13 @@ BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
+# BR2_PACKAGE_LANDING is not set
+BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y

configs/arm_minimal_defconfig

@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.39"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -70,6 +70,7 @@ BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
@@ -118,11 +119,11 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_MICROCHIP_SAMA7G54_EK=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
@@ -141,15 +142,16 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y