rauc: Enable streaming of upgrades

yangerd: containers: widen event debounce to avoid podman contention
yangerd: Fix containers
2026-07-22 17:23:00 +02:00 · 2026-06-27 08:41:22 +02:00 · 2026-06-27 08:41:22 +02:00 · 2026-06-27 08:41:22 +02:00 · 2026-06-27 08:41:22 +02:00 · 2026-06-27 08:41:22 +02:00
1586 changed files with 389070 additions and 5114 deletions
@@ -272,7 +272,7 @@ other contributions that are not aligned to this Code of Conduct."*
 [PEP-8]:    https://peps.python.org/pep-0008/
 [RDD]:      https://tom.preston-werner.com/2010/08/23/readme-driven-development
 [cbeams]:   https://cbea.ms/git-commit/#seven-rules
-[conduct]:    CODE-OF-CONDUCT.md
+[conduct]:    CODE_OF_CONDUCT.md
 [DCO]:        https://developercertificate.org/
 [closing]:    https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
 [gpg-verify]: https://docs.github.com/en/authentication/managing-commit-signature-verification
@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /src/webui
+    schedule:
+      interval: weekly
+    # goyang is pinned to our kernelkit fork via a replace directive and
+    # stepped by hand when we add patches; leave it for Dependabot to ignore.
+    ignore:
+      - dependency-name: github.com/openconfig/goyang
+
+  - package-ecosystem: gomod
+    directory: /src/netbrowse
+    schedule:
+      interval: weekly
@@ -10,7 +10,7 @@ jobs:
    name: Add issue to project Infix&co
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@v2
        with:
          project-url: https://github.com/orgs/kernelkit/projects/3
          github-token: ${{ secrets.ADD_TO_PROJECT }}
@@ -16,7 +16,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Validate release version format
      id: validate
@@ -170,7 +170,7 @@ jobs:
        fi

    - name: Upload signed artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      with:
        name: signed-infix-${{ steps.validate.outputs.file_version }}
        path: ${{ steps.download_signed.outputs.signed_filename }}
@@ -212,4 +212,4 @@ jobs:
        ---

        **Next Steps:** The signed release can now be distributed with cryptographic verification of authenticity.
-        EOF
+        EOF
@@ -41,7 +41,7 @@ jobs:
          ls -la ./

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || github.ref }}
          clean: true
@@ -96,7 +96,7 @@ jobs:
          mv images ${{ steps.vars.outputs.dirname }}
          tar cfz ${{ steps.vars.outputs.archive }} ${{ steps.vars.outputs.dirname }}/

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          path: output/${{ steps.vars.outputs.archive }}
          name: artifact-${{ matrix.defconfig }}
@@ -108,17 +108,11 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
        with:
          pattern: "artifact-*"
          merge-multiple: true

-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
      - uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
@@ -128,7 +122,7 @@ jobs:
          prerelease: true
          tag: "latest-boot"
          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
+          artifacts: "*.tar.gz"

      - name: Summary
        run: |
@@ -1,4 +1,4 @@
-name: Create SD Card & eMMC Images
+name: Create Images

 on:
  workflow_dispatch:
@@ -15,15 +15,16 @@ on:
          - bananapi-bpi-r64
          - friendlyarm-nanopi-r2s
          - microchip-sama7g54-ek
+          - acer-connect-vero-w
        default: 'raspberrypi-rpi64'

 jobs:
  create-image:
-    name: Create SD Card Image for ${{ inputs.board }}
+    name: Create images for ${{ inputs.board }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          clean: true
          fetch-depth: 0
@@ -50,234 +51,171 @@ jobs:
          mkdir -p output/images
          mkdir -p build

-      - name: Set bootloader and target based on board
+      - name: Set bootloaders and targets based on board
        run: |
+          arch=
+          targets=
+          bootloader_sdcard=
+          bootloader_emmc=
+
          case "${{ inputs.board }}" in
            raspberrypi-rpi2)
-              echo "BOOTLOADER=rpi2-boot" >> $GITHUB_ENV
-              echo "ARCH=arm" >> $GITHUB_ENV
-              echo "BUILD_EMMC=false" >> $GITHUB_ENV
+              arch=arm
+              targets="sdcard"
+              bootloader_sdcard=rpi2-boot
              ;;
            raspberrypi-rpi64)
-              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=false" >> $GITHUB_ENV
+              arch=aarch64
+              targets="sdcard"
+              bootloader_sdcard=rpi64-boot
              ;;
            bananapi-bpi-r3)
-              echo "BOOTLOADER_SD=bpi-r3-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r3-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              arch=aarch64
+              targets="sdcard emmc"
+              bootloader_sdcard=bpi-r3-sd-boot
+              bootloader_emmc=bpi-r3-emmc-boot
              ;;
            bananapi-bpi-r4)
-              echo "BOOTLOADER_SD=bpi-r4-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r4-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              arch=aarch64
+              targets="sdcard emmc"
+              bootloader_sdcard=bpi-r4-sd-boot
+              bootloader_emmc=bpi-r4-emmc-boot
              ;;
            bananapi-bpi-r64)
-              echo "BOOTLOADER_SD=bpi-r64-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r64-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              arch=aarch64
+              targets="sdcard emmc"
+              bootloader_sdcard=bpi-r64-sd-boot
+              bootloader_emmc=bpi-r64-emmc-boot
+              ;;
+            acer-connect-vero-w)
+              arch=aarch64
+              targets="emmc"
+              bootloader_emmc=bpi-r3-emmc-boot
              ;;
            friendlyarm-nanopi-r2s)
-              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=false" >> $GITHUB_ENV
+              arch=aarch64
+              targets="sdcard"
+              bootloader_sdcard=nanopi-r2s-boot
              ;;
            microchip-sama7g54-ek)
-              echo "BOOTLOADER_SD=sama7g54-ek-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=sama7g54-ek-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=arm" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              arch=arm
+              targets="sdcard emmc"
+              bootloader_sdcard=sama7g54-ek-sd-boot
+              bootloader_emmc=sama7g54-ek-emmc-boot
              ;;
            *)
              echo "Error: Unknown board ${{ inputs.board }}"
              exit 1
              ;;
          esac
-          echo "Arch: $ARCH for board: ${{ inputs.board }}"
-          if [ "$BUILD_EMMC" = "true" ]; then
-            echo "Building both SD and eMMC images"
-            echo "SD Bootloader: $BOOTLOADER_SD"
-            echo "eMMC Bootloader: $BOOTLOADER_EMMC"
-          else
-            echo "Building SD image only"
-            echo "Bootloader: $BOOTLOADER"
-          fi
+
+          echo "ARCH=$arch" >> $GITHUB_ENV
+          echo "TARGETS=$targets" >> $GITHUB_ENV
+          [ -n "$bootloader_sdcard" ] && echo "BOOTLOADER_SDCARD=$bootloader_sdcard" >> $GITHUB_ENV
+          [ -n "$bootloader_emmc" ] && echo "BOOTLOADER_EMMC=$bootloader_emmc" >> $GITHUB_ENV
+
+          echo "Arch: $arch for board: ${{ inputs.board }}"
+          echo "Targets: $targets"
+          [ -n "$bootloader_sdcard" ] && echo "SD bootloader: $bootloader_sdcard"
+          [ -n "$bootloader_emmc" ] && echo "eMMC bootloader: $bootloader_emmc"

      - name: Download bootloader artifacts
        run: |
-          # Download bootloader from latest-boot release tag
-          if [ "$BUILD_EMMC" = "true" ]; then
-            # Download both SD and eMMC bootloaders for boards that support both
-            echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
-            mkdir -p output_sd/images
-            cd temp_bootloader_sd/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-            cd ../
-            rm -rf temp_bootloader_sd/
+          for target in $TARGETS; do
+            upper=$(printf '%s' "$target" | tr '[:lower:]' '[:upper:]')
+            bootloader_var="BOOTLOADER_${upper}"
+            bootloader="${!bootloader_var}"
+            temp_dir="temp_bootloader_${target}"
+            out_dir="output_${target}/images"

-            echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
-            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
-            mkdir -p output_emmc/images
-            cd temp_bootloader_emmc/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-            cd ../
-            rm -rf temp_bootloader_emmc/
+            echo "Downloading ${target} bootloader: ${bootloader}"
+            mkdir -p "$out_dir"
+            gh release download latest-boot --pattern "*${bootloader}*" --dir "$temp_dir/"
+            tar -xzf "$temp_dir"/*.tar.gz --strip-components=1 -C "$out_dir/"
+            rm -rf "$temp_dir"

-            echo "SD bootloader files:"
-            ls -la output_sd/images/
-            echo "eMMC bootloader files:"
-            ls -la output_emmc/images/
-          else
-            # Single bootloader for boards that only support SD
-            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
-
-            # Extract bootloader directly to output/images
-            cd temp_bootloader/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-            cd ../
-            rm -rf temp_bootloader/
-
-            echo "Bootloader files extracted to output/images:"
-            ls -la output/images/
-          fi
+            echo "${target} bootloader files:"
+            ls -la "$out_dir/"
+          done
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Infix artifacts
        run: |
-          # Download from latest Kernelkit Trigger workflow for main branch
          gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
          INFIX_RUN_ID=$(cat latest_infix_run_id)

-          if [ "$BUILD_EMMC" = "true" ]; then
-            # Copy Infix artifacts to both SD and eMMC output directories
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+          gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/

-            cd temp_infix/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
-            cd ../
-            rm -rf temp_infix/
+          for target in $TARGETS; do
+            out_dir="output_${target}/images"
+            mkdir -p "$out_dir"
+            tar -xzf temp_infix/*.tar.gz --strip-components=1 -C "$out_dir/"

-            echo "Infix files extracted to output_sd/images:"
-            ls -la output_sd/images/
-            echo "Infix files extracted to output_emmc/images:"
-            ls -la output_emmc/images/
-          else
-            # Single output directory for SD-only boards
-            gh run download ${INFIX_RUN_ID} --name artifact-${ARCH} --dir temp_infix/
+            echo "Infix files extracted to ${out_dir}:"
+            ls -la "$out_dir/"
+          done

-            # Extract Infix directly to output/images
-            cd temp_infix/
-            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-            cd ../
-            rm -rf temp_infix/
-
-            echo "Infix files extracted to output/images:"
-            ls -la output/images/
-          fi
+          rm -rf temp_infix/
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify extracted files
        run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            echo "Files available for SD image:"
-            ls -la output_sd/images/
+          for target in $TARGETS; do
+            echo "Files available for ${target} image:"
+            ls -la "output_${target}/images/"
            echo ""
-            echo "Files available for eMMC image:"
-            ls -la output_emmc/images/
-          else
-            echo "Files available for mkimage.sh:"
-            ls -la output/images/
-            echo ""
-            echo "File types:"
-            file output/images/* || true
-          fi
+          done

-      - name: Create SD card image
+      - name: Create images
        run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            export BINARIES_DIR=$PWD/output_sd/images
-            export BUILD_DIR=$PWD/build
-            export BR2_EXTERNAL_INFIX_PATH=$PWD
-            export RELEASE=""
-            export INFIX_ID="infix"
-            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
-          else
-            export BINARIES_DIR=$PWD/output/images
-            export BUILD_DIR=$PWD/build
-            export BR2_EXTERNAL_INFIX_PATH=$PWD
-            export RELEASE=""
-            export INFIX_ID="infix"
-            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
-          fi
-
-      - name: Create eMMC image
-        if: ${{ env.BUILD_EMMC == 'true' }}
-        run: |
-          export BINARIES_DIR=$PWD/output_emmc/images
          export BUILD_DIR=$PWD/build
          export BR2_EXTERNAL_INFIX_PATH=$PWD
          export RELEASE=""
          export INFIX_ID="infix"
-          ./utils/mkimage.sh -t emmc ${{ inputs.board }}
+
+          for target in $TARGETS; do
+            export BINARIES_DIR=$PWD/output_${target}/images
+            ./utils/mkimage.sh -t "$target" ${{ inputs.board }}
+          done

      - name: Verify created images
        run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            echo "SD card image:"
-            ls -lh output_sd/images/*-sdcard.img* 2>/dev/null || true
-            if ls output_sd/images/*-sdcard.img 1> /dev/null 2>&1; then
-              for img in output_sd/images/*-sdcard.img; do
-                echo "- $(basename $img)"
-                file "$img"
-                fdisk -l "$img" 2>/dev/null | head -20
-              done
-            fi
+          mkdir -p output/images

-            echo ""
-            echo "eMMC image:"
-            ls -lh output_emmc/images/*-emmc.img* 2>/dev/null || true
-            if ls output_emmc/images/*-emmc.img 1> /dev/null 2>&1; then
-              for img in output_emmc/images/*-emmc.img; do
-                echo "- $(basename $img)"
-                file "$img"
-                fdisk -l "$img" 2>/dev/null | head -20
-              done
-            fi
+          for target in $TARGETS; do
+            src_dir="output_${target}/images"
+            found=false

-            # Copy both images to output/images for artifact upload
-            mkdir -p output/images
-            cp output_sd/images/*-sdcard.img* output/images/ 2>/dev/null || true
-            cp output_emmc/images/*-emmc.img* output/images/ 2>/dev/null || true
-          else
-            echo "Contents of output/images after mkimage.sh:"
-            ls -lh output/images/
+            echo "${target} image:"
+            ls -lh "$src_dir"/*-"$target".img* 2>/dev/null || true

-            # Look for SD card image with pattern: *-sdcard.img
-            if ls output/images/*-sdcard.img 1> /dev/null 2>&1; then
-              echo "Found SD card image(s):"
-              for img in output/images/*-sdcard.img; do
-                echo "- $(basename $img)"
-                file "$img"
-                fdisk -l "$img" 2>/dev/null || true
-              done
-            else
-              echo "No SD card image found matching pattern: *-sdcard.img"
-              echo "Available files:"
-              ls -la output/images/
+            for img in "$src_dir"/*-"$target".img; do
+              [ -e "$img" ] || continue
+              found=true
+              echo "- $(basename "$img")"
+              file "$img"
+              fdisk -l "$img" 2>/dev/null || true
+            done
+
+            if [ "$found" = false ]; then
+              echo "No ${target} image found matching pattern: *-${target}.img"
+              echo "Available files in ${src_dir}:"
+              ls -la "$src_dir/"
              exit 1
            fi
-          fi
+
+            for artifact in "$src_dir"/*-"$target".img*; do
+              [ -e "$artifact" ] || continue
+              cp "$artifact" output/images/
+            done
+
+            echo ""
+          done

      - name: Upload images as artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: images-${{ inputs.board }}
          path: |
@@ -285,15 +223,6 @@ jobs:
            output/images/*-emmc.img*
          retention-days: 30

-      - name: Create checksums
-        run: |
-          cd output/images/
-          for file in *-sdcard.img *-emmc.img; do
-            if [ -f "$file" ]; then
-              sha256sum "$file" > "$file.sha256"
-            fi
-          done
-
      - name: Upload to release
        uses: ncipollo/release-action@v1
        with:
@@ -304,41 +233,31 @@ jobs:
          prerelease: true
          tag: "latest-boot"
          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "output/images/*-sdcard.img*,output/images/*-emmc.img*"
+          artifacts: "output/images/*-sdcard.img,output/images/*-emmc.img"

      - name: Generate summary
        run: |
-          if [ "$BUILD_EMMC" = "true" ]; then
-            cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # SD Card & eMMC Image Build Complete! 🚀
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Image Build Complete! 🚀

          **Board:** ${{ inputs.board }}
          **Arch:** ${{ env.ARCH }}
-          **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
-          **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
+          **Targets:** ${{ env.TARGETS }}
          **Bootloader Source:** latest-boot release
          **Infix Source:** Latest workflow run on main

+          ## Bootloaders
+          $(for target in $TARGETS; do
+              case "$target" in
+                sdcard) bootloader="$BOOTLOADER_SDCARD" ;;
+                emmc) bootloader="$BOOTLOADER_EMMC" ;;
+              esac
+              printf -- '- %s: %s\n' "$target" "$bootloader"
+            done)
+
          ## Created Images
          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")

          ## Download
-          Both SD card and eMMC images are available as workflow artifacts above and in the latest-boot release.
+          The generated images are available as workflow artifacts above and in the latest-boot release.
          EOF
-          else
-            cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # SD Card Image Build Complete! 🚀
-
-          **Board:** ${{ inputs.board }}
-          **Arch:** ${{ env.ARCH }}
-          **Bootloader:** ${{ env.BOOTLOADER }}
-          **Bootloader Source:** latest-boot release
-          **Infix Source:** Latest workflow run on main
-
-          ## Created Images
-          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
-
-          ## Download
-          The SD card image is available as a workflow artifact above.
-          EOF
-          fi
@@ -23,7 +23,7 @@ jobs:
        target: [aarch64, arm, x86_64]
      fail-fast: false
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          clean: true
          submodules: recursive
@@ -45,6 +45,9 @@ jobs:
          target: ${{ matrix.target }}
          enabled: ${{ inputs.use_cache }}

+      # WebUI images bundle the mkdocs User's Guide via post-build.sh.
+      - uses: kernelkit/actions/setup-mkdocs@v1.2
+
      - name: Configure & Build
        env:
          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
@@ -86,12 +89,12 @@ jobs:
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: artifact-${{ matrix.target }}
          path: output/*.tar.gz

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: artifact-disk-image-${{ matrix.target }}
          path: output/images/*.qcow2
@@ -80,7 +80,7 @@ jobs:
          ls -la ./

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ env.INFIX_REPO }}
          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
@@ -124,6 +124,9 @@ jobs:
        with:
          target: ${{ env.TARGET }}

+      # WebUI images bundle the mkdocs User's Guide via post-build.sh.
+      - uses: kernelkit/actions/setup-mkdocs@v1.2
+
      - name: Configure ${{ env.TARGET }}
        run: |
          make ${{ env.TARGET }}_defconfig
@@ -178,7 +181,7 @@ jobs:
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          path: output/${{ steps.vars.outputs.tgz }}
          name: artifact-${{ env.TARGET }}
@@ -12,7 +12,7 @@ jobs:

    steps:
      - name: Check out infix repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
@@ -103,7 +103,7 @@ jobs:

      - name: Create pull request
        if: steps.check.outputs.new_release == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
        with:
          github-token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
          script: |
@@ -16,7 +16,7 @@ jobs:
    if: ${{github.repository_owner == 'kernelkit'}}
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
      - name: Fetch latest Coverity Scan MD5
        id: var
        env:
@@ -27,7 +27,7 @@ jobs:
               -O coverity-latest.tar.gz.md5
          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT

-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
        id: cache
        with:
          path: coverity-latest.tar.gz
@@ -98,7 +98,7 @@ jobs:
            https://scan.coverity.com/builds?project=${PROJECT_NAME}

      - name: Upload build.log
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: coverity-build.log
          path: cov-int/build-log.txt
@@ -24,12 +24,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
        with:
          python-version: '3.x'

@@ -33,7 +33,7 @@ jobs:
            mtools

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.ref }}
@@ -77,7 +77,7 @@ jobs:
          ln -s Infix-x86_64 images
          tar cfz Infix-x86_64.tar.gz Infix-x86_64

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          path: output/Infix-x86_64.tar.gz
          name: artifact-x86_64
@@ -0,0 +1,68 @@
+name: Go Vulnerability Scan
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'src/webui/**'
+      - 'src/netbrowse/**'
+      - '.github/workflows/govulncheck.yml'
+  pull_request:
+    paths:
+      - 'src/webui/**'
+      - 'src/netbrowse/**'
+      - '.github/workflows/govulncheck.yml'
+  schedule:
+    - cron: '5 0 * * 6'  # Saturday at 00:05 UTC, same as Coverity
+  workflow_dispatch:
+
+jobs:
+  govulncheck:
+    if: ${{ github.repository_owner == 'kernelkit' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module:
+          - src/webui
+          - src/netbrowse
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Scan ${{ matrix.module }}
+        working-directory: ${{ matrix.module }}
+        run: |
+          # Full report, for the run summary.  govulncheck exits non-zero
+          # whenever it finds anything, so don't let it fail the step here.
+          {
+            echo "## govulncheck: ${{ matrix.module }}"
+            echo '```'
+            govulncheck ./... || true
+            echo '```'
+          } | tee -a "$GITHUB_STEP_SUMMARY"
+
+          # Gate on vulnerabilities reachable from our code through a
+          # dependency.  govulncheck's call-graph analysis is transitive,
+          # so indirect use counts too (we call a dep that calls the bad
+          # symbol).  trace[0] is the vulnerable symbol; we key on the
+          # module it lives in.  A chain that bottoms out in stdlib is
+          # fixed by bumping the Buildroot host Go, not this module's
+          # go.mod, so it's reported above but doesn't fail the build.
+          # Keep the json scan and jq unguarded so a tool failure fails the
+          # gate closed; only grep's no-match exit (all-clear) is tolerated.
+          govulncheck -format json ./... > scan.json || true
+          called=$(jq -r 'select(.finding.trace[0].function != null) |
+                          .finding.trace[0].module' scan.json | sort -u)
+          vulns=$(printf '%s' "$called" | grep -vx stdlib || true)
+          if [ -n "$vulns" ]; then
+            echo "::error::Called vulnerabilities in dependencies: $(echo "$vulns" | paste -sd, -)"
+            exit 1
+          fi
@@ -1,88 +0,0 @@
-name: Manny the Manager
-
-on:
-  workflow_dispatch:
-    inputs:
-      checkout:
-        required: true
-        type: boolean
-      cleanup:
-        required: true
-        type: boolean
-      peek:
-        required: true
-        type: boolean
-
-jobs:
-  inventory:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Disk usage ...
-        run: |
-          cd
-          du -hs .[^.]*
-      - name: Disk inventory (1/2) ...
-        run: |
-          echo "df -h ========================================================================="
-          df -h
-          echo "mounts ========================================================================"
-          mount
-      - name: File inventory (1/2) ...
-        run: |
-          echo "Current directory: $(pwd)"
-          echo "Files in $HOME ================================================================"
-          ls $HOME
-          echo "Find $HOME ===================================================================="
-          find $HOME
-      - name: Container inventory ...
-        run: |
-          echo "Available container images: ==================================================="
-          docker images
-          echo "Available containers: ========================================================="
-          docker ps -a
-
-  checkout:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: kernelkit/actions/cache-restore@v1
-        with:
-          target: x86_64
-          dl-prefix: dl-netconf
-      - name: Disk inventory (2/2) ...
-        run: |
-          echo "df -h ========================================================================="
-          df -h
-          echo "mounts ========================================================================"
-          mount
-      - name: File inventory (2/2) ...
-        run: |
-          echo "Current directory: $(pwd)"
-          echo "Files in $HOME ================================================================"
-          ls $HOME
-          echo "Find $HOME ===================================================================="
-          find $HOME
-
-  peeky:
-    if: ${{ inputs.peek }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Peek & Poke ...
-        run: |
-          whoami
-          ls -l /mnt/
-          cat /mnt/DATALOSS_WARNING_README.txt
-          sudo mkdir /mnt/x-aarch64
-          sudo chown $(id -un):$(id -gn) /mnt/x-aarch64
-          ls -l /mnt/
-
-  cleanup:
-    if: ${{ inputs.cleanup }}
-    needs: [inventory, peeky]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Cleaning up cruft ...
-        run: |
-          docker image prune -af
-          docker volume prune -f
-          docker container prune -f
@@ -11,17 +11,11 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
        with:
          pattern: "artifact-*"
          merge-multiple: true

-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
      - uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
@@ -32,7 +26,7 @@ jobs:
          prerelease: true
          tag: "latest"
          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
+          artifacts: "*.tar.gz"

      - name: Summary
        run: |
@@ -48,7 +48,7 @@ jobs:
      contents: write
      discussions: write
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: 'true'

@@ -78,22 +78,11 @@ jobs:
          echo "pre=${{ steps.rel.outputs.pre }}"
          echo "latest=${{ steps.rel.outputs.latest }}"

-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
        with:
          pattern: "artifact-*"
          merge-multiple: true

-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi
-
      - name: Extract ChangeLog entry ...
        run: |
          cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
@@ -106,7 +95,7 @@ jobs:
          makeLatest: ${{ steps.rel.outputs.latest }}
          discussionCategory: ${{ steps.rel.outputs.cat }}
          bodyFile: release.md
-          artifacts: "*.tar.gz*,*.qcow2*"
+          artifacts: "*.tar.gz,*.qcow2"

      - name: Summary
        run: |
@@ -43,6 +43,11 @@ on:
        type: string
        default: ''
        description: 'Optional script to run after checkout (for spin customization)'
+      release:
+        required: false
+        type: string
+        default: ''
+        description: 'Release version (e.g. v26.04.0), sets INFIX_RELEASE so make test finds versioned artifacts'
    secrets:
      CHECKOUT_TOKEN:
        required: false
@@ -61,7 +66,7 @@ jobs:
    runs-on: [self-hosted, regression]
    steps:
      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ env.INFIX_REPO }}
          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
@@ -93,7 +98,7 @@ jobs:
        run: |
          make ${{ env.TARGET }}_defconfig

-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
        with:
          pattern: "artifact-*"
          merge-multiple: true
@@ -105,12 +110,15 @@ jobs:

          ls -l
          mkdir -p output
-          mv ${name}-${target}.tar.gz output/
+          tarfile=$(ls ${name}-${target}*.tar.gz | head -1)
+          mv "$tarfile" output/
          cd output/
-          tar xf ${name}-${target}.tar.gz
-          ln -s ${name}-${target} images
+          tar xf "$tarfile"
+          ln -s "${tarfile%.tar.gz}" images

      - name: Regression Test ${{ env.TARGET }}
+        env:
+          INFIX_RELEASE: ${{ inputs.release }}
        run: |
          if [ -n "$NINEPM_CONF" ]; then
            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
@@ -131,7 +139,19 @@ jobs:
          make test-dir="$(pwd)/$TEST_PATH" test-report

      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: test-report
          path: output/images/test-report.pdf
+
+      - name: Generate XPath Coverage Report for ${{ env.TARGET }}
+        if: always()
+        run: |
+          make test-dir="$(pwd)/$TEST_PATH" xpath-coverage-report
+
+      - name: Upload XPath Coverage Report as Artifact
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: xpath-coverage-report
+          path: output/images/xpath-coverage-report.pdf
@@ -78,7 +78,7 @@ jobs:
          ls -la ./

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ env.INFIX_REPO }}
          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
@@ -22,22 +22,11 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
        with:
          pattern: "artifact-*"
          merge-multiple: true

-      - name: Create checksums
-        run: |
-          for file in *.tar.gz; do
-            sha256sum $file > $file.sha256
-          done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi
-
      - uses: ncipollo/release-action@v1
        with:
          tag: latest
@@ -54,7 +43,7 @@ jobs:

            **Commit:** ${{ github.sha }}
            **Built:** ${{ github.run_id }}
-          artifacts: "*.tar.gz*,*.qcow2*"
+          artifacts: "*.tar.gz,*.qcow2"

      - name: Summary
        run: |
@@ -9,8 +9,10 @@ O    ?= output
 # otherwise treat it as relative to ./buildroot.
 override O := $(if $(filter /%,$O),$O,$(CURDIR)/$O)

-config := $(O)/.config
-bmake   = $(MAKE) -C buildroot O=$(O) $1
+config      := $(O)/.config
+bmake        = $(MAKE) -C buildroot O=$(O) $1
+SNIPPETS_DIR := $(CURDIR)/configs/snippets
+MERGE_CONFIG := $(CURDIR)/buildroot/support/kconfig/merge_config.sh


 all: $(config) buildroot/Makefile
@@ -26,6 +28,23 @@ $(config):
 	@echo "'make <board>_defconfig' before building an image."
 	@exit 1

+apply-%: $(SNIPPETS_DIR)/%.conf | $(config)
+	@KCONFIG_CONFIG=$(config) $(MERGE_CONFIG) -m $(config) $<
+	@+$(call bmake,olddefconfig)
+	@echo "Applied snippet: $<"
+
+list-snippets:
+	@echo "Available snippets (use 'make apply-<name>'):"
+	@ls $(SNIPPETS_DIR)/*.conf 2>/dev/null | sed 's|.*/||; s|\.conf$$||; s|^|  |'
+
+dev: | $(config)
+	@for s in $(SNIPPETS_DIR)/*.conf; do \
+		KCONFIG_CONFIG=$(config) $(MERGE_CONFIG) -m $(config) $$s; \
+		echo "Applied snippet: $$s"; \
+	done
+	@+$(call bmake,olddefconfig)
+	@+$(call bmake,all)
+
 %: | buildroot/Makefile
 	@+$(call bmake,$@)

@@ -44,4 +63,4 @@ test:
 buildroot/Makefile:
 	@git submodule update --init

-.PHONY: all check coverity dep test cyclonedx
+.PHONY: all check coverity dep test cyclonedx list-snippets dev
@@ -1,63 +1,21 @@
-[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
+[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Discord][discord-badge]][discord-url]

-<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=480 padding=10>
+<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=380 padding=10>

-Turn any ARM or x86 device into a powerful, manageable network appliance
-in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
-routers, IoT gateways, edge devices, or custom network solutions that
-just work.
+Infix turns an ARM or x86 device into a managed network appliance.  The
+same OS runs on a $35 Raspberry Pi and on enterprise switching hardware,
+so you can build a router, an IoT gateway, or an edge device on whatever
+you have on hand.

-## Our Values
+More in-depth material is available in our blog and User Guide:

-**🔒 Immutable**  
-Your system never breaks.  Read-only filesystem with atomic upgrades
-means no configuration drift, no corrupted updates, and instant rollback
-if something goes wrong.  Deploy once, trust forever.
+- <https://www.kernelkit.org/>
+- <https://www.kernelkit.org/infix/>

-**🤝 Friendly**  
-Actually easy to use. Auto-generated CLI from standard YANG models comes
-with built-in help for every command — just hit <kbd>?</kbd> or
-<kbd>TAB</kbd> for context-aware assistance.
+## See it in action

-Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
-mean you're never stuck.  Whether you're learning networking or managing
-enterprise infrastructure.
-
-**🛡️ Secure**  
-Built with security as a foundation, not an afterthought.  Minimal
-attack surface, separation between system and data, and container
-isolation.  Sleep better knowing your infrastructure is protected.
-
-## Why Choose Infix
-
-**Hardware Flexibility**: Start with a $35 Raspberry Pi, scale to
-enterprise switching hardware.  Same OS, same tools, same reliability.
-
-**Standards-Based**: Built around YANG models and IETF standards. Learn
-once, use everywhere - no vendor lock-in.
-
-**Container Ready**: Run your applications alongside networking
-functions.  GPIO access, dedicated Ethernet ports, custom protocols —
-your device, your rules.
-
-## Use Cases
-
-1. **Home Labs & Hobbyists**:  
-   Transform a Raspberry Pi into a full-featured router with WiFi  
-1. **IoT & Edge Computing**:  
-   Bridge devices to the cloud with reliable, updatable gateways  
-1. **Small Business Networks**:  
-   Enterprise-grade features without the complexity or cost  
-1. **Developers & Makers**:  
-   Test networking concepts, prototype IoT solutions, or build custom
-   appliances
-1. **Network Professionals**:  
-   Consistent tooling from development to production deployment.  
-   How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
-
-## Quick Example
-
-Configure an interface in seconds - the CLI guides you with built-in help:
+The CLI is generated from the [YANG models][inside], so it guides you with
+built-in help.  Here's setting an IP address on an interface:

 <pre><code>admin@infix-12-34-56:/> <b>configure</b>
 admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
@@ -94,38 +52,94 @@ eth0            ethernet   UP          52:54:00:12:34:56
 admin@infix-12-34-56:/> <b>copy running startup</b>
 </code></pre>

-Notice how <kbd>TAB</kbd> completion shows available options, `show`
-displays current config, and `diff` shows exactly what changed before
-you commit your changes with the `leave` command.
+<kbd>TAB</kbd> completes available options and <kbd>?</kbd> shows online help
+for each option and argument. `show` displays the current config, and `diff`
+shows exactly what changed before you commit it with `leave`.  See the [CLI
+documentation][3] for more.

-For more information, see [CLI documentation][3].
+## Web interface

-## Get Started
+If the CLI isn't your style, the same configuration is available through the
+web interface.  Log in from a browser, keep an eye on your device from the
+Status dashboard and use the Configure > Interface setup wizard to create more
+advanced setups, or just fold out an interface to add an IP address.

-Get [pre-built images][5] for your hardware.  Use the CLI, web
-interface, or standard NETCONF/RESTCONF tools, e.g., `curl`.  Add
-containers for any custom functionality you need.
+<p>
+  <a href="doc/img/webui-login.png"><img src="doc/img/webui-login.png" alt="Login" align="top" width=220></a>
+  <a href="doc/img/webui-dashboard.png"><img src="doc/img/webui-dashboard.png" alt="Dashboard" width=290></a>
+  <a href="doc/img/webui-wizard.png"><img src="doc/img/webui-wizard.png" alt="Setup wizard" width=260></a>
+</p>

-### Supported Platforms
+The web interface is built on the same concepts as the CLI, so operational
+status and state are kept separate from configuration and commands.

- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
- **Banana Pi-R3** - Your next home router and gateway
- **NanoPi R2S** - Compact dual-port router in a tiny package
- **x86_64** - Run in VMs or on mini PCs for development and testing
- **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
- **Microchip SparX-5i** - Enterprise switching capabilities
- **Microchip SAMA7G54-EK** - ARM Cortex-A7
- **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
- **StarFive VisionFive2** - RISC-V architecture support
+## Try it in 5 minutes

-*Why start with Raspberry Pi?* It's affordable, widely available, has
-built-in WiFi + Ethernet, and runs the exact same Infix OS you'd deploy
-in production. Perfect for learning, prototyping, or even small-scale
-deployments.
+You don't need hardware to get started:

+- **In a virtual lab** — run a full topology in [GNS3][gns3-post] and test
+  networks entirely in software.
+- **From source** — [build it and `make run`][build-post] to boot Infix in
+  QEMU, from `git clone` to pinging the internet.
+- **On real hardware** — grab a [pre-built image][5] for your board, or run
+  the `x86_64` image in any VM.
+
+Log in with `admin` / `admin` on the virtual and pre-built images.  On
+shipped products the factory-reset credentials are customizable — we
+typically provision a unique per-device password stored in EEPROM/VPD.
+
+## Supported hardware
+
+- **Raspberry Pi 2B/3B/4B/CM4** - a good starting point; built-in WiFi and Ethernet
+- **Banana Pi-R64/R3/R3 Mini/R4** - multi-port routers and gateways
+- **NanoPi R2S** - compact dual-port router
+- **x86_64** - VMs and mini PCs, for development or production
+- **Marvell CN9130 CRB, EspressoBIN** - ARM64 development boards
+- **Microchip SparX-5i** - enterprise switching
+- **Microchip SAMA7G54-EK** - ARM Cortex-A7 evaluation kit
+- **NXP i.MX8MP EVK** - ARM64 SoC evaluation kit
+- **StarFive VisionFive2** - RISC-V board
+
+*Why start with Raspberry Pi?* It's cheap, easy to get hold of, has
+built-in WiFi and Ethernet, and runs the same Infix you'd deploy in
+production — so what you learn on it carries straight over.
+
+> [!TIP]
 > 📖 **[Complete documentation][4]** • 💬 **[Join our Discord][discord-url]**

-## Technical Details
+## Why Infix
+
+**🔒 Immutable**  
+Read-only filesystem with atomic upgrades.  An update either applies
+cleanly or rolls back, so a failed upgrade or a power cut midway through
+won't leave you with a half-broken system.
+
+**🤝 Friendly**  
+The CLI is generated from the YANG models, so every command carries its
+own help — hit <kbd>?</kbd> or <kbd>TAB</kbd> to see what's available.
+The same models are reachable over NETCONF and RESTCONF, with
+[documentation][4] for when you get stuck.
+
+**🛡️ Secure**  
+A small attack surface, separation between system and data, and
+container isolation.  Since the system partition is read-only, a
+compromised service or container can't rewrite the OS underneath it.
+
+## Use cases
+
+1. **Home labs & hobbyists**:  
+   Turn a Raspberry Pi into a router with WiFi  
+1. **IoT & edge**:  
+   Build gateways you can update in the field  
+1. **Small business networks**:  
+   Routing, firewalling, and VLANs on affordable hardware  
+1. **Developers & makers**:  
+   Prototype networking ideas, or build a custom appliance with containers  
+1. **Network professionals**:  
+   The same tooling from lab to production — spin up a digital twin in raw
+   Qemu or [GNS3](https://gns3.com/infix)
+
+## Under the hood

 <a href="https://bitsign.se">
  <picture>
@@ -135,27 +149,29 @@ deployments.
  </picture>
 </a>

-Built on proven open-source foundations: [Linux][0], [Buildroot][1], and
-[sysrepo][2] — for reliability you can trust:
+Built on [Linux][0], [Buildroot][1], and [sysrepo][2]:

- **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
- **YANG Configuration**: Industry-standard models with auto-generated tooling
- **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
- **Container Integration**: Docker support with flexible network and hardware access
- **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
- **Code Signing**: Releases are cryptographically signed for integrity verification
+- **Immutable OS**: read-only filesystem, atomic updates, rollback on failure
+- **YANG configuration**: standard models with an auto-generated CLI and APIs
+- **Hardware acceleration**: switchdev offload for wire-speed forwarding
+- **Container integration**: Docker, with access to host network and hardware
+- **Memory efficient**: runs on devices with as little as 256 MB RAM
+- **Code signing**: releases are cryptographically signed

-Perfect for everything from resource-constrained edge devices to
-high-throughput network appliances.
-
-With the entire system modeled in YANG, scalability is no longer an
-issue, be it in development, testing, or end users deploying and
-monitoring their devices.  All knobs and dials are accessible from the
-CLI (console/SSH), or remotely using the native NETCONF or RESTCONF
-APIs.
+Because the whole system is modeled in YANG, every setting is reachable
+the same way: from the CLI over console or SSH, or remotely over the
+native NETCONF and RESTCONF APIs.  The same models drive development,
+testing, and day-to-day monitoring.

 > Check the *[Latest Build][]* for bleeding-edge features.

+## Contributing
+
+Bug reports, ideas, and pull requests are welcome.  Start with
+[CONTRIBUTING][contributing] and the [code of conduct][coc].  Found a
+security issue?  Follow the [security policy][security].  Need a hand?
+See [support options][support] or [join us on Discord][discord-url].
+
 ---

 <div align="center">
@@ -171,6 +187,13 @@ APIs.
 [3]: https://www.kernelkit.org/infix/latest/cli/introduction/
 [4]: https://www.kernelkit.org/infix/
 [5]: https://github.com/kernelkit/infix/releases/latest
+[inside]:          https://www.kernelkit.org/posts/inside-infix/
+[gns3-post]:       https://www.kernelkit.org/posts/infix-in-gns3/
+[build-post]:      https://www.kernelkit.org/posts/building-infix-from-source/
+[contributing]:    .github/CONTRIBUTING.md
+[coc]:             .github/CODE_OF_CONDUCT.md
+[security]:        .github/SECURITY.md
+[support]:         .github/SUPPORT.md
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
@@ -1,6 +1,7 @@
 if BR2_aarch64

 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/acer-connect-vero-w6m/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r4/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r64/Config.in"
@@ -4,10 +4,12 @@ aarch64
 Board Specific Documentation
 ----------------------------

+- [Acer Connect Vero W6m](acer-connect-vero-w6m/)
 - [Banana Pi BPi-R3](bananapi-bpi-r3/)
 - [Banana Pi BPi-R4](bananapi-bpi-r4/)
 - [Banana Pi BPi-R64](bananapi-bpi-r64/)
 - [Marvell CN9130-CRB](marvell-cn9130-crb/)
+- [Marvell ESPRESSObin](marvell-espressobin/)
 - [Microchip SparX-5i PCB135 (eMMC)](microchip-sparx5-pcb135/)
 - [NanoPi R2S](friendlyarm-nanopi-r2s/)
 - [Raspberry Pi 64-bit](raspberrypi-rpi64/)
@@ -0,0 +1,6 @@
+config BR2_PACKAGE_ACER_CONNECT_VERO_W6M
+	bool "Acer Connect Vero W6m"
+	depends on BR2_aarch64
+	select BR2_PACKAGE_BANANAPI_BPI_R3
+	help
+	  Build Acer Connect Vero W6m
@@ -0,0 +1,13 @@
+Copyright (c) 2026 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -0,0 +1,131 @@
+# Acer Connect Vero W6m
+
+<img src="connect_vero_w6m_case.jpg" alt="Acer Connect Vero W6m" width=400 padding=10>
+
+## Overview
+
+The Acer Connect Vero W6m is a compact WiFi 6/6E router platform based
+on the MediaTek MT7986A SoC.  In Infix it is supported as an eMMC-based
+target that reuses the factory secure boot chain while replacing the
+system partitions with an Infix installation.
+
+The Acer Connect Vero W6m is based on the same MT7986a SoC as the
+BPI-R3, with tri-band WiFi (2.4 GHz + 5 GHz + 6 GHz) using a PCIe
+MT7916 module and the SoC's built-in MT7976 DBDC radio.
+
+## Default WiFi Layout
+
+The factory configuration on this branch enables all three radios in AP
+mode and bridges them into the default LAN bridge `br0`:
+
+- `radio0` / `wifi0-ap`: 2.4 GHz, SSID `Infix`
+- `radio1` / `wifi1-ap`: 6 GHz, SSID `Infix6G`
+- `radio2` / `wifi2-ap`: 5 GHz, SSID `Infix5G`
+
+6 GHz operation is enabled in the MT7915e driver configuration, and all
+three APs use the same default passphrase `infixinfix` from the factory
+configuration.
+
+Secure boot is enabled on this device, so the factory bootloader
+(partitions 1-4: bl2, u-boot-env, factory, fip) must not be modified.
+Infix is installed by replacing partitions 5+ while keeping the
+factory bootloader intact.  The stock U-Boot chainloads the Infix
+U-Boot from the first partition after fip.
+
+## Prerequisites
+
+- Serial console access (115200 8N1) — required to interrupt U-Boot.
+  Disassembly is needed to reach the UART header.  See the [OpenWrt
+  Vero W6m page][vero-openwrt] for details.
+- TFTP server on the local network with `u-boot.bin` for the initial
+  RAM boot.
+- SSH access from the running Infix system to a host that stores
+  `infix-vero-w-emmc.img`.
+- Ethernet cable connected between the PC and the Vero Internet/WAN
+  port.
+- DHCP server running on the PC, serving addresses on that link during
+  installation.
+- **Save the MAC addresses** from the stock U-Boot environment before
+  installing.  Interrupt autoboot and run `printenv` to note down:
+  `2gMAC`, `5gMAC`, `6gMAC`, `LANMAC`, and `WANMAC`.
+
+## Required Files
+
+Prepare these files on a host reachable from the Vero:
+
+1. **Infix Vero image:**
+   - [infix-vero-w-emmc.img][1] (Complete system image)
+2. **eMMC bootloader** (extracted from):
+   - [bpi-r3-emmc-boot-2025.01-latest.tar.gz][2]
+   - Extract `u-boot.bin` from the tarball to your TFTP server
+
+## Installing Infix
+
+Connect the PC directly to the Vero Internet/WAN port before starting
+the installation.  The PC should provide DHCP service on that link so
+the stock U-Boot and the temporary Infix system can reach the TFTP/SSH
+host.
+
+1. **RAM-load Infix U-Boot** from the stock U-Boot serial console
+   (hit any key to stop autoboot):
+
+   ```
+   setenv serverip <TFTP_SERVER_IP>
+   setenv ipaddr <VERO_IP>
+   setenv bootmenu_default 7
+   tftpboot 0x46000000 u-boot.bin
+   go 0x46000000
+   ```
+
+   `serverip` must point to your TFTP server and `ipaddr` must be a free
+   address for the Vero on the same subnet.  `bootmenu_default 7`
+   bypasses secure boot verification.  The Infix U-Boot will
+   automatically netboot the Infix system.
+
+2. **From running Infix**, stream the image directly to eMMC:
+
+   ```bash
+   ssh <USER>@<HOST> "dd if=/path/to/infix-vero-w-emmc.img bs=512 skip=17408 status=none" | \
+   dd of=/dev/mmcblk0 bs=512 seek=17408 conv=fsync
+   sync
+   ```
+
+   This writes only the Infix partitions (starting after fip at sector
+   17408), leaving the factory bootloader and calibration data intact.
+   Do not interrupt the transfer; if it fails, rerun the command from
+   the beginning.
+
+3. **Update the GPT** to replace stock partitions 5+ with the Infix
+   layout:
+
+   ```bash
+   sudo sgdisk --zap-all /dev/mmcblk0
+   sudo sgdisk -a 1 \
+       -n2:8192:9215      -c2:u-boot-env  \
+       -n3:9216:13311     -c3:factory      \
+       -n4:13312:17407    -c4:fip          \
+       -n5:17408:+32M     -c5:infix-uboot \
+       -n6:0:+8M          -c6:aux         \
+       -n7:0:+250M        -c7:primary     \
+       -n8:0:+250M        -c8:secondary   \
+       -n9:0:+128M        -c9:cfg         \
+       -n10:0:+128M       -c10:var        \
+       -p /dev/mmcblk0
+   ```
+
+4. **Configure U-Boot to chainload Infix permanently** — reboot and
+   interrupt stock U-Boot again:
+
+   ```
+   setenv bootmenu_default 7
+   setenv bootcmd 'mmc read 0x46000000 0x4400 0x10000; go 0x46000000'
+   saveenv
+   reset
+   ```
+
+   The `bootcmd` reads the Infix U-Boot (at sector 0x4400/17408)
+   into RAM and jumps to it.  After `reset`, Infix boots from eMMC.
+
+[vero-openwrt]: https://openwrt.org/toh/acer/predator_vero_w6m
+[1]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-vero-w-emmc.img
+[2]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r3-emmc-boot-2025.01-latest.tar.gz
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d48246c717b505cc11df95171f2fd548b389e1a463f1af4c68d0b69fe0d1009b  LICENSE
@@ -0,0 +1,2 @@
+$(eval $(ix-board))
+$(eval $(generic-package))
@@ -0,0 +1 @@
+dtb-y += mediatek/mt7986a-acer-connect-vero-w6m.dtb
@@ -0,0 +1,425 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/pinctrl/mt65xx.h>
+
+#include <arm64/mediatek/mt7986a.dtsi>
+
+/ {
+	chosen {
+		stdout-path = "serial0:115200n8";
+                infix {
+                        /* Default admin user password: 'admin' */
+                        factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+                };
+	};
+
+	memory@40000000 {
+		reg = <0 0x40000000 0 0x20000000>;
+		device_type = "memory";
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-1.8V";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		factory {
+			label = "factory";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&pio {
+	wifi_rst_hog: wifi-reset-hog {
+		gpio-hog;
+		gpios = <6 GPIO_ACTIVE_LOW>;
+		output-low;
+		line-name = "wifi-reset";
+	};
+
+	mmc0_pins_default: mmc0-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <MTK_DRIVE_6mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+
+		conf-ds {
+			pins = "EMMC_DSL";
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-uhs-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <MTK_DRIVE_6mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+
+		conf-ds {
+			pins = "EMMC_DSL";
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+	};
+
+	pcie_pins: pcie-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_pereset";
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <MTK_DRIVE_4mA>;
+		};
+	};
+
+	wf_dbdc_pins: wf-dbdc-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_dbdc";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+				"WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+				"WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+				"WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+				"WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+				"WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+				"WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <MTK_DRIVE_4mA>;
+		};
+	};
+
+	i2c_pins: i2c-pins {
+		mux {
+			function = "i2c";
+			groups = "i2c";
+		};
+	};
+};
+
+&trng {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c_pins>;
+	status = "okay";
+};
+
+&mmc0 {
+	status = "okay";
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <0x08>;
+	max-frequency = <200000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x14014>;
+	vmmc-supply = <&reg_3p3v>;
+	vqmmc-supply = <&reg_1p8v>;
+	non-removable;
+	no-sd;
+	no-sdio;
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	card@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+
+		block {
+			compatible = "block-device";
+
+			partitions {
+				block-partition-factory {
+					partname = "factory";
+
+					nvmem: nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						eeprom_factory_0: eeprom@0 {
+							reg = <0x0 0x1000>;
+						};
+
+						precal_factory_1010: precal@1010 {
+							reg = <0x1010 0x62810>;
+						};
+					};
+				};
+			};
+		};
+	};
+};
+
+&pcie {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie_pins>;
+	num-lanes = <1>;
+	status = "okay";
+
+	slot0: pcie@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		#address-cells = <0x03>;
+		#size-cells = <0x02>;
+
+		pcie_wifi: wifi@0,0 {
+			compatible = "mediatek,mt76";
+			reg = <0x0000 0 0 0 0>;
+		};
+	};
+};
+
+&pcie_phy {
+	status = "okay";
+};
+
+&pcie_port {
+	clocks = <&clk40m>, <&topckgen CLK_TOP_PCIE_PHY_SEL>;
+	clock-names = "ref", "da_ref";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		switch: switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				swport0: port@0 {
+					reg = <0>;
+					phy-handle = <&swphy0>;
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan1";
+					phy-handle = <&swphy1>;
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan2";
+					phy-handle = <&swphy2>;
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan3";
+					phy-handle = <&swphy3>;
+				};
+
+				port@6 {
+					reg = <6>;
+					label = "cpu";
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+
+			mdio {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				swphy0: phy@0 {
+					reg = <0>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy1: phy@1 {
+					reg = <1>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy2: phy@2 {
+					reg = <2>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy3: phy@3 {
+					reg = <3>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+			};
+		};
+	};
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>, <&precal_factory_1010>;
+	nvmem-cell-names = "eeprom", "precal";
+	pinctrl-names = "default", "dbdc";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+	pinctrl-1 = <&wf_dbdc_pins>;
+	status = "okay";
+};
@@ -0,0 +1,263 @@
+/* Factory EEPROM for MT7976 WMAC (DBDC) - Acer Connect Vero W */
+/* Band 1 patched from 5GHz-only to 5GHz+6GHz selectable */
+
+&wifi {
+	mediatek,eeprom-data = <
+		 0x86790100 0x000c4326 0x60100000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x01000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000800 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+ 		 0x12525353 0x003c003f 0x3a100700 0x15030000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x0000be00 0x00000000
+		 0x0000c100 0x00000000 0x00000000 0xc3000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000009 0x00000000 0x00000000
+		 0x00000000 0x00000303 0x03030303 0x03030303
+		 0x03030303 0x03030303 0x03040303 0x03040303
+		 0x03040303 0x03040000 0x00161b18 0x1b1a1a1a
+		 0x1a0d0008 0x0f0d0209 0x0e0d0209 0x0e0d0209
+		 0x0e0c020a 0x0e0c020a 0x0e0c020a 0x0e0b020b
+		 0x0e2b2b2b 0x2b222222 0x22222222 0x22222222
+		 0x22222222 0x22222222 0x22000000 0x00000000
+		 0x00000000 0x002a2a2a 0x2a282828 0x282a2a2a
+		 0x2a282828 0x282a2a2a 0x2a282828 0x282a2a2a
+		 0x2a282828 0x28000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x007f7f20 0x2530363c 0x41014847 0x4c52575c
+		 0x7f7f7f7f 0x1b222a33 0x3a40014d 0x464c525a
+		 0x5e7f7f7f 0x7f252834 0x3c424a01 0x4a4f555d
+		 0x636e7f7f 0x7f7f202a 0x303b444a 0x014a5158
+		 0x5f666e7f 0x7f7f7f7f 0x8080c5c5 0xd1d1dddd
+		 0xe5e5f3f3 0x40408080 0xcfcfdbdb 0xe3e3efef
+		 0xf7f74040 0x8080bfbf 0xcbcbd9d9 0xe5e5eded
+		 0x40408080 0xb9b9c5c5 0xd3d3dfdf 0xe7e74040
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0xc0a0c0e0 0xfcfcafe0 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x02200220 0x02200220 0x02300230 0x02300230
+		 0x02300230 0x02300230 0x02300230 0x02300230
+		 0x02240224 0x02240224 0x02240224 0x02240224
+		 0x02240224 0x02240224 0x02240224 0x02240224
+		 0x000000c4 0xc4c4c4c4 0x0000c4c4 0xc4c4c1c1
+		 0x008282c3 0xc3000000 0x00838300 0xc4c4c4c1
+		 0xc1008282 0x8383c3c3 0xc2c10000 0x83838484
+		 0xc4c4c4c1 0xc1008282 0x8383c4c4 0xc4c1c100
+		 0x82828383 0xc4c4c4c1 0xc1008282 0x8383c4c4
+		 0xc3c100c4 0x81c4c3c2 0x00818181 0xc4c4c3c2
+		 0x00818282 0x00c4c4c2 0xc2008182 0x8200c4c4
+		 0xc3c20081 0x82828484 0xc4c4c3c2 0x00818282
+		 0x8484c4c4 0xc2c20081 0x82828484 0xc4c4c2c1
+		 0x81828383 0x8585c4c4 0xc3c20081 0x82828484
+		 0xc4c4c3c2 0x00818282 0x8484c4c4 0xc3c20081
+		 0x82828484 0xc6c5c3c1 0x00c5c5c3 0xc2008182
+		 0x828484c5 0xc5c3c200 0x81828284 0x84c4c4c3
+		 0xc2008182 0x828484c4 0xc4c2c181 0x82838385
+		 0x85c5c5c3 0xc2008182 0x828484c5 0xc5c3c200
+		 0x81828284 0x84c5c5c3 0xc2008182 0x82848400
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x378a6e05 0x0ae64a6c 0x00000000 0x50050000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00b40000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x86828786 0x87c8cb8a 0x8380c982 0x00c8ca86
+		 0x8383c583 0x83c1c58c 0x8883c78b 0x8780c28c
+		 0x8485c682 0xc3c4c4c4 0xc5c6c7c8 0xcfcecdcc
+		 0xcccdcec1 0xc1c1c1c2 0xc4c6c7ce 0xcecfcfcf
+		 0xcecec6c7 0xc8c9caca 0xcbcbd2d2 0xd2d2d0ce
+		 0xcc8100c1 0xc3c5c6c7 0xc8d0d0d1 0xd1d1d0cf
+		 0xdeee6be7 0x5fede2eb 0xce08ce09 0xce0ace0a
+		 0x4e0b4f0b 0x4f0c4f0c 0x4f0d4f0d 0x540a540b
+		 0x540c540b 0x540c510a 0x510b510c 0xd10c510d
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0xde0fde10 0xde115e12
+		 0xde12de12 0xde135e14 0x5e0cde0d 0xde0e5e10
+		 0x5e105e10 0x5e11de11 0xde0ede0f 0xde10de11
+		 0x5e12de12 0x5e135e13 0xde0f5e11 0x5e12de13
+		 0x5e13de13 0xde14de14 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00848484 0x84848484 0x84000000 0x00e4d5d4
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+	>;
+};
@@ -0,0 +1,263 @@
+/* Factory EEPROM for PCIe MT7916 radio - Acer Connect Vero W */
+/* Offset 0xa0000 in the "factory" GPT partition on eMMC */
+
+&pcie_wifi {
+	mediatek,eeprom-data = <
+		 0x16790000 0x000c4326 0x60000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x50750000 0x07670700 0x00000400 0x50710000
+		 0x00000000 0x00000400 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0xb101e748 0xf57f5e99
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000800 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+ 		 0x12924848 0x003e003f 0x3a100000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x81a3a380
+		 0xa4910091 0x00910091 0x00910000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x000a0000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x0000c500 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000013 0x12120000 0x00000000
+		 0x00000000 0x00000303 0x03030303 0x03030303
+		 0x03030303 0x03030505 0x05050505 0x05050505
+		 0x05050505 0x05050000 0x001b1919 0x19181818
+		 0x180f0006 0x1c0e080a 0x170e080a 0x170d0809
+		 0x170d020a 0x0e0d020a 0x0e0d020a 0x0e0b020a
+		 0x0e22222c 0x2c2b2b2b 0x2b2b2b2b 0x2b2b2b2b
+		 0x2b2b2b2b 0x2b2b2b2b 0x2b000000 0x00000000
+		 0x00000000 0x001e201e 0x201e2020 0x201e201e
+		 0x20201e20 0x20272929 0x29272727 0x27272929
+		 0x29272727 0x27000000 0x00000000 0x00000000
+		 0x00000000 0x00cdcfcf 0xcfcfcf00 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x007f7f20 0x2530363c 0x41014347 0x4c52575c
+		 0x7f7f0000 0x00000000 0x00000000 0x00000000
+		 0x0000007f 0x7f252834 0x3c424a01 0x4d4f555f
+		 0x636e7f7f 0x7f7f202a 0x303b444a 0x014d5158
+		 0x5f666e7f 0x7f7f7f7f 0x8080c5c5 0xcbcbd9d9
+		 0xe1e1ebeb 0x40408080 0xcfcfdbdb 0xe3e3efef
+		 0xf7f74040 0x8080c1c1 0xcdcdd5d5 0xe1e1eded
+		 0x40408080 0xbbbbc7c7 0xcfcfdbdb 0xe7e74040
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0xb0900000 0x0000c0f0 0xf8000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x02000200 0x02000200 0x02000200 0x02000200
+		 0x02000200 0x02000200 0x02000200 0x02000200
+		 0x02000200 0x02000200 0x02000200 0x02000200
+		 0x02000200 0x02000200 0x02000200 0x02000200
+		 0x000000c6 0xc6c6c6c4 0x0000c5c5 0xc5c4c1c1
+		 0x818383c3 0xc3c2c100 0x81848400 0xc5c5c4c1
+		 0xc1818383 0x8585c3c3 0xc2c10081 0x84848686
+		 0xc5c5c4c1 0xc1818383 0x8585c5c5 0xc4c1c181
+		 0x83838585 0xc5c5c4c1 0xc1818383 0x8585c6c6
+		 0xc4c300c6 0x00c6c4c3 0xc1008181 0xc6c6c4c3
+		 0xc1008181 0x00c5c5c3 0xc2008182 0x8200c6c6
+		 0xc4c3c100 0x81818686 0xc6c6c4c3 0xc1008181
+		 0x8686c5c5 0xc3c20081 0x82828787 0xc5c5c3c2
+		 0x00818282 0x8787c6c6 0xc4c3c100 0x81818686
+		 0xc6c6c4c3 0xc1008181 0x8686c6c6 0xc4c3c100
+		 0x81818686 0xc6c6c4c3 0x00c6c6c4 0xc3c10081
+		 0x818686c6 0xc6c4c3c1 0x00818186 0x86c5c5c3
+		 0xc2008182 0x828787c5 0xc5c3c281 0x82838388
+		 0x88c6c6c4 0xc3c10081 0x818686c6 0xc6c4c3c1
+		 0x00818186 0x86c6c6c4 0xc3c10081 0x81868600
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00b70000 0x00b70000 0x00000000 0x00000000
+		 0x01000000 0x0000c400 0xb8008700 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0xc7c60000 0x89898987 0x87858381 0x898a8b8b
+		 0x8a898785 0x88898988 0x87868584 0x00000000
+		 0x00000000 0xcccfcecd 0xcdcacecd 0xcbcfcece
+		 0xcfcfcfc7 0xcececdce 0xc7cfcec7 0xcfcfcfcf
+		 0xcfcf0000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x7fe2f0e4 0x00000000 0xa4de24df 0xa4e0a4e1
+		 0xa4e1a4de 0x24dfa4e0 0xa4e1a4e1 0xa4dea4df
+		 0xa4e0a4e1 0xa4e1a4de 0xa4df24e0 0xa4e1a4e1
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0xde0fde0f 0xde0fde10
+		 0xde11de11 0x5e12de12 0xde10de10 0xde10de11
+		 0xde12de12 0xde13de13 0x5a085a09 0x5a0a5a0a
+		 0x5a0a5a0a 0x5a0a5a0a 0x5a055a06 0x5a075a08
+		 0x5a085a09 0x5a095a09 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00ded453
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+		 0x00000000 0x00000000 0x00000000 0x00000000
+	>;
+};
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7986a-acer-connect-vero-w6m-common.dtsi"
+#include "mt7986a-acer-connect-vero-w6m-pcie-eeprom.dtsi"
+
+/ {
+	model = "Acer Connect Vero W6m";
+	compatible = "acer,connect-vero-w", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+	};
+};
+
+&i2c0 {
+	led-controller@30 {
+		compatible = "kinetic,ktd2026";
+		reg = <0x30>;
+		vin-supply = <&reg_5v>;
+		vio-supply = <&reg_3p3v>;
+
+		led_status: multi-led {
+			color = <LED_COLOR_ID_RGB>;
+			function = LED_FUNCTION_STATUS;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			led@0 {
+				reg = <0>;
+				color = <LED_COLOR_ID_RED>;
+			};
+
+			led@1 {
+				reg = <1>;
+				color = <LED_COLOR_ID_GREEN>;
+			};
+
+			led@2 {
+				reg = <2>;
+				color = <LED_COLOR_ID_BLUE>;
+			};
+		};
+	};
+};
+
+&nvmem {
+	eeprom_factory_a0000: eeprom@a0000 {
+		reg = <0xa0000 0x1000>;
+	};
+
+	precal_factory_a1010: precal@a1010 {
+		reg = <0xa1010 0x62810>;
+	};
+};
+
+&swport0 {
+       label = "internet";
+};
@@ -0,0 +1,86 @@
+image cfg.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image var.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image #INFIX_ID##VERSION#-vero-w-#TARGET#.img {
+        hdimage {
+                partition-table-type = "gpt"
+                gpt-no-backup = true
+        }
+
+        /*
+         * Factory partitions (1-4) -- secure boot, do not overwrite.
+         * Offsets and sizes match the stock Acer GPT exactly.
+         * No image data is written, preserving factory content.
+         */
+        partition u-boot-env {
+                offset = 8192s
+                size = 1024s
+        }
+
+        partition factory {
+                offset = 9216s
+                size = 4096s
+        }
+
+        partition fip {
+                offset = 13312s
+                size = 4096s
+        }
+
+        /* Infix U-Boot, chainloaded by stock bootloader */
+        partition infix-uboot {
+                offset = 17408s
+                image = "u-boot.bin"
+                size = 32M
+        }
+
+        partition aux {
+                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+                image = "aux.ext4"
+        }
+
+        partition primary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition secondary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition cfg {
+                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+                image = "cfg.ext4"
+        }
+
+        partition var {
+                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+                image = "var.ext4"
+        }
+}
@@ -11,17 +11,80 @@
          "admin-state": "unlocked"
        }
      },
+      {
+        "class": "infix-hardware:usb",
+        "name": "USB2",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
      {
        "name": "radio0",
        "class": "infix-hardware:wifi",
        "infix-hardware:wifi-radio": {
-          "country-code": "00"
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      },
+      {
+        "name": "radio1",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "6GHz",
+          "channel": "auto"
+        }
+      },
+      {
+        "name": "radio2",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "5GHz",
+          "channel": "auto"
        }
      }
    ]
  },
  "ietf-interfaces:interfaces": {
    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
      {
        "name": "lo",
        "type": "infix-if-type:loopback",
@@ -43,21 +106,17 @@
        }
      },
      {
-        "name": "eth0",
+        "name": "internet",
        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
        "ietf-ip:ipv4": {
          "infix-dhcp-client:dhcp": {
            "option": [
              {
-                "id": "netmask"
+                "id": "ntp-server"
              },
              {
                "id": "broadcast"
              },
-              {
-                "id": "router"
-              },
              {
                "id": "domain"
              },
@@ -69,23 +128,86 @@
                "id": "dns-server"
              },
              {
-                "id": "ntp-server"
+                "id": "router"
+              },
+              {
+                "id": "netmask"
              },
              {
                "id": "vendor-class",
-                "value": "Raspberry Pi 5 Model B"
+                "value": "Acer Connect Vero W"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
              }
            ]
          }
        }
      },
      {
-        "name": "wifi0",
+        "name": "wifi0-ap",
        "type": "infix-if-type:wifi",
        "infix-interfaces:wifi": {
-          "radio": "radio0"
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "wifi1-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio1",
+          "access-point": {
+            "ssid": "Infix6G",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "wifi2-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio2",
+          "access-point": {
+            "ssid": "Infix5G",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
        }
      }
+
    ]
  },
  "ietf-keystore:keystore": {
@@ -100,6 +222,15 @@
          "certificates": {}
        }
      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
    }
  },
  "ietf-netconf-acm:nacm": {
@@ -236,16 +367,14 @@
    }
  },
  "ietf-system:system": {
-    "hostname": "rpi-%m",
+    "hostname": "acer-connect-%m",
    "ntp": {
-      "enabled": true,
      "server": [
        {
-          "name": "ntp.org",
+          "name": "default",
          "udp": {
            "address": "pool.ntp.org"
-          },
-          "iburst": true
+          }
        }
      ]
    },
@@ -260,24 +389,72 @@
    },
    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "internet"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
  "infix-meta:meta": {
    "version": "1.7"
  },
  "infix-services:mdns": {
    "enabled": true
  },
-  "infix-services:web": {
-    "enabled": true,
-    "console": {
-      "enabled": true
-    },
-    "netbrowse": {
-      "enabled": true
-    },
-    "restconf": {
-      "enabled": true
-    }
-  },
  "infix-services:ssh": {
    "enabled": true,
    "hostkey": [
@@ -295,5 +472,17 @@
        "port": 22
      }
    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
  }
 }
@@ -6,6 +6,7 @@ config BR2_PACKAGE_BANANAPI_BPI_R3
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7986
 	select BR2_PACKAGE_LINUX_FIRMWARE_AIROHA_EN8811H
+	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7916
 	select SDCARD_AUX
 	help
 	  Build Banana PI R3 support
@@ -70,11 +70,11 @@ The BPI-R3 has a 4-position DIP switch that controls boot media:

 <img align="right" src="bootstrap-switch.webp" alt="DIP switches" width=200 padding=10>

-| Position | Mode        | Description                           |
-|----------|-------------|---------------------------------------|
-| 0000     | SD card     | Boot from microSD card                |
-| 0110     | eMMC        | Boot from internal eMMC (recommended) |
-| 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |
+| ABCD | Mode     | Description                           |
+|------|----------|---------------------------------------|
+| 0000 | SD card  | Boot from microSD card                |
+| 0101 | SPI NAND | Boot from SPI NAND (advanced users)   |
+| 1001 | eMMC     | Boot from internal eMMC (recommended) |

 > [!NOTE]
 > Switch position is read from left to right: "0" = OFF, "1" = ON.
@@ -150,6 +150,7 @@ From the U-Boot prompt:
 usb start
 fatload usb 0:1 0x50000000 infix-bpi-r3-emmc.img
 setexpr blocks ${filesize} / 0x200
+mmc dev 0
 mmc write 0x50000000 0x0 ${blocks}
 ```

@@ -211,6 +212,7 @@ sync
 2. Set boot switches to eMMC mode (see image above)
 3. Power on

+
 ## Troubleshooting

 ### Board won't boot
@@ -19,4 +19,34 @@ possible to use dtbo in sysboot unless present in syslinux.conf
        no-sd;
        no-sdio;
        status = "okay";
+
+        #address-cells = <1>;
+        #size-cells = <0>;
+
+        card@0 {
+                compatible = "mmc-card";
+                reg = <0>;
+
+                partitions {
+                        compatible = "gpt-partitions";
+
+                        partition-factory {
+                                partname = "factory";
+
+                                nvmem-layout {
+                                        compatible = "fixed-layout";
+                                        #address-cells = <1>;
+                                        #size-cells = <1>;
+
+                                        eeprom_factory_wmac: eeprom@0 {
+                                                reg = <0x0 0x1000>;
+                                        };
+
+                                        eeprom_factory_pcie: eeprom@a0000 {
+                                                reg = <0xa0000 0x1000>;
+                                        };
+                                };
+                        };
+                };
+        };
 };
@@ -24,6 +24,18 @@ https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/patches-6.12/
 &secmon_reserved {
 	reg = <0 0x43000000 0 0x40000>;
 };
+/*
+ * The T-PHY's pcie-phy sub-node only claims clk40m ("ref") in the SoC
+ * dtsi.  CLK_TOP_PCIE_PHY_SEL ("da_ref") is left unclaimed, so the
+ * kernel's clk_disable_unused late_initcall gates it — killing the
+ * PCIe REFCLK output to the endpoint mid-probe.  Wire it here so the
+ * clock stays enabled while the PHY is active.
+ */
+&pcie_port {
+	clocks = <&clk40m>, <&topckgen CLK_TOP_PCIE_PHY_SEL>;
+	clock-names = "ref", "da_ref";
+};
+
 &cpu_thermal {
 	/delete-node/ trips;
 	/delete-node/ cooling-maps;
@@ -4,7 +4,7 @@ CONFIG_BOOTDELAY=2
 CONFIG_ENV_IS_NOWHERE=y
 # CONFIG_ENV_IS_IN_MMC is not set
 CONFIG_MULTI_DTB_FIT=y
-CONFIG_OF_LIST="mt7986a-bpi-r3-sd mt7986a-bpi-r3-emmc mt7986a-bpi-r3-mini"
+CONFIG_OF_LIST="mt7986a-bpi-r3-sd mt7986a-bpi-r3-emmc mt7986a-bpi-r3-mini mt7986a-acer-connect-vero-w6m"

 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
@@ -14,7 +14,7 @@ The Banana Pi BPI-R64 is a networking board based on the MediaTek MT7622
 - 8 GB eMMC storage
 - microSD card slot
 - MT7531 Gigabit Ethernet switch (4x LAN + 1x WAN)
- MT7603E built-in 2.4 GHz WiFi
+- MT7622 WMAC built-in 2.4 GHz 802.11ac WiFi
 - USB 3.0 port
 - 2x Mini PCIe slots

@@ -24,7 +24,7 @@ Infix comes preconfigured with:

 - **LAN ports** (lan0-lan3): Bridged for internal networking
 - **WAN port**: DHCP client enabled for internet connectivity
- **WiFi** (wifi0-ap): Bridged to LAN (MT7615 PCIe card if fitted, otherwise MT7603E)
+- **WiFi** (wifi0-ap): Bridged to LAN (MT7622 WMAC, 2.4 GHz; or MT7615 PCIe card if fitted)

 ## Boot Switch Reference

@@ -113,6 +113,19 @@ mmc partconf 0 1 1 0

 ## Platform Notes

+### WiFi
+
+The MT7622 SoC includes a built-in WMAC that provides 2.4 GHz 802.11b/g/n/ac
+(2×2) — there is no 5 GHz capability from the onboard radio.
+
+For dual-band operation, a PCIe card can be fitted in one of the two Mini PCIe
+slots.  The [Banana Pi BPI-MT7615][bpi-mt7615] is a purpose-built dual-band
+(2.4 + 5 GHz, 802.11ac 4×4) module designed for BPI router boards and is a
+natural fit.  With it installed, Infix will use it in preference to the onboard
+WMAC for the `wifi0-ap` interface.
+
+[bpi-mt7615]: https://docs.banana-pi.org/en/BPI-MT7615/BananaPi_MT7615
+
 ### mmc0 = eMMC, mmc1 = SD

 On MT7622, MSDC0 (mmc0) is the 8-bit eMMC controller and MSDC1 (mmc1) is the
@@ -0,0 +1,232 @@
+# Marvell ESPRESSObin
+
+<img src="espressobin.png" alt="The board" width=800 padding=10>
+
+The [ESPRESSObin][0] is a single-board computer based on the [Marvell Armada
+3720][1] (dual Cortex-A53, AArch64) SoC and the [Marvell 88E6341][2] (Topaz)
+switch, oriented toward networking applications.
+
+The board design is old but the switch offers full Linux support, including
+advanced TSN features for [IEEE 1588-2019][3] (PTP) and [IEEE 802.1AS-2020][4]
+(gPTP).
+
+## Board Variants
+
+The board has gone through several hardware revisions:
+
+| Revision   | Storage             | Notes                          |
+|------------|---------------------|--------------------------------|
+| v1, v3, v5 | SPI NOR only        | Obsolete; U-Boot always in SPI |
+| v7         | SPI NOR + 4 GB eMMC | Current; SD and eMMC usable    |
+| Ultra      | SPI NOR + 4 GB eMMC | High-end variant               |
+
+On **all revisions** the Boot ROM is hardwired to load U-Boot from SPI NOR
+flash.  There is no strap or jumper to make the Boot ROM load directly from an
+SD card.  The SD card (or eMMC on v7/Ultra) is used only for the operating
+system.
+
+## Building
+
+The ESPRESSObin uses ext4 for its rootfs partitions rather than the default
+squashfs, because the stock SPI U-Boot lacks squashfs and `blkmap` support.
+The `ext4` configuration snippet enables this.  Apply it once after selecting
+the defconfig, then build and compose the SD card image:
+
+```sh
+make O=x-aarch64 aarch64_defconfig
+make O=x-aarch64 apply-ext4
+make O=x-aarch64
+
+utils/mkimage.sh -r x-aarch64 marvell-espressobin
+```
+
+The resulting image (`x-aarch64/images/infix-espressobin-sdcard.img`) contains
+a GPT disk with the standard Infix partition layout, using ext4 instead of the
+read-only squashfs:
+
+| Partition | Label     | Contents                     |
+|-----------|-----------|------------------------------|
+| 1         | aux       | RAUC upgrade state (ext4)    |
+| 2         | primary   | Rootfs slot primary (ext4)   |
+| 3         | secondary | Rootfs slot secondary (ext4) |
+| 4         | cfg       | Persistent config (ext4)     |
+| 5         | var       | Runtime data (ext4)          |
+
+## Writing to SD Card
+
+```sh
+dd if=infix-espressobin-sdcard.img of=/dev/sdX bs=4M status=progress conv=fsync
+```
+
+## Upgrading
+
+The build produces `x-aarch64/images/infix-aarch64-ext4.pkg`, a RAUC bundle
+containing the ext4 rootfs.  Once the board is running Infix, upgrade over the
+network in the usual way:
+
+```
+upgrade ftp://192.168.1.1/infix-aarch64-ext4.pkg
+```
+
+RAUC writes the new rootfs to the inactive slot, updates `BOOT_ORDER` in
+`/mnt/aux/uboot.env`, and the next boot picks it up automatically.
+
+> [!NOTE]
+> Use `infix-aarch64-ext4.pkg`, not the standard `infix-aarch64.pkg`.  The
+> standard bundle contains a squashfs rootfs which the stock U-Boot cannot
+> boot.
+
+## Booting with the Stock SPI U-Boot
+
+The stock Marvell U-Boot has `ext4load` and the standard variables
+(`$kernel_addr`, `$fdt_addr`, `$loadaddr`, `$console`, `$image_name`,
+`$fdt_name`) already set sensibly.  Connect to the board's console port, the
+micro USB connector, at 115200 8N1, interrupt autoboot, and paste the commands
+below.
+
+### Environment Variable Reference
+
+These variables are pre-set in the stock U-Boot environment.  Restore them
+with these values if they are ever lost or corrupted:
+
+```
+setenv kernel_addr  0x5000000
+setenv fdt_addr     0x4f00000
+setenv loadaddr     0x5000000
+setenv console      'console=ttyMV0,115200 earlycon=ar3700_uart,0xd0012000'
+setenv image_name   boot/Image
+setenv extra_params quiet
+```
+
+`$fdt_name` selects the device tree for your specific board revision:
+
+| Board revision | `fdt_name` value                                    |
+|----------------|-----------------------------------------------------|
+| v3 / v5        | `boot/marvell/armada-3720-espressobin.dtb`          |
+| v7             | `boot/marvell/armada-3720-espressobin-v7.dtb`       |
+| Ultra          | `boot/marvell/armada-3720-espressobin-ultra.dtb`    |
+| v3/v5 eMMC     | `boot/marvell/armada-3720-espressobin-emmc.dtb`     |
+| v7 eMMC        | `boot/marvell/armada-3720-espressobin-v7-emmc.dtb`  |
+
+```
+setenv fdt_name boot/marvell/armada-3720-espressobin.dtb   # adjust for your board
+```
+
+### Simple Boot
+
+Fixed boot from the primary slot, useful for initial bring-up:
+
+```
+setenv bootcmd 'mmc dev 0; \
+  ext4load mmc 0:2 $kernel_addr $image_name; \
+  ext4load mmc 0:2 $fdt_addr $fdt_name; \
+  setenv bootargs $console root=PARTLABEL=primary rw rootwait $extra_params rauc.slot=primary; \
+  booti $kernel_addr - $fdt_addr'
+saveenv
+```
+
+### Automatic Slot Selection (RAUC Integration)
+
+The CLI `upgrade` command writes to the inactive slot and updates `uboot.env`
+on the `aux` partition with the new boot order.  On the next boot U-Boot reads
+`BOOT_ORDER` from the aux partition and selects the appropriate slot.  The
+setup below also defines `bootcmd_primary`, `bootcmd_secondary`, and
+`bootcmd_net` for manual use (see [Manual Slot Selection](#manual-slot-selection)
+and [Netbooting](#netbooting)):
+
+```
+setenv bootcmd_boot \
+  'mmc dev 0; \
+   ext4load mmc 0:$bootpart $kernel_addr $image_name; \
+   ext4load mmc 0:$bootpart $fdt_addr $fdt_name; \
+   setenv bootargs $console root=PARTLABEL=$bootslot rw rootwait $extra_params rauc.slot=$bootslot; \
+   booti $kernel_addr - $fdt_addr'
+
+setenv bootcmd_primary   'setenv bootpart 2; setenv bootslot primary;   run bootcmd_boot'
+setenv bootcmd_secondary 'setenv bootpart 3; setenv bootslot secondary; run bootcmd_boot'
+
+setenv bootcmd_net \
+  'dhcp $kernel_addr $image_name; \
+   tftpboot $fdt_addr $fdt_name; \
+   setenv bootargs $console root=PARTLABEL=primary rw rootwait $extra_params rauc.slot=primary; \
+   booti $kernel_addr - $fdt_addr'
+
+setenv bootcmd \
+  'setenv bootpart 2; setenv bootslot primary; setenv auxpart 1; \
+   if ext4load mmc 0:$auxpart $loadaddr /uboot.env; then \
+     env import -c $loadaddr $filesize BOOT_ORDER; \
+   fi; \
+   if test "$BOOT_ORDER" = "secondary primary" || \
+      test "$BOOT_ORDER" = "secondary primary net"; then \
+     setenv bootpart 3; setenv bootslot secondary; \
+   fi; \
+   if test "$BOOT_ORDER" = "net" || \
+      test "$BOOT_ORDER" = "net primary" || \
+      test "$BOOT_ORDER" = "net secondary primary"; then \
+     run bootcmd_net; \
+   fi; \
+   echo ">> Booting $bootslot from mmc 0:$bootpart ..."; \
+   run bootcmd_boot'
+
+saveenv
+```
+
+### Manual Slot Selection
+
+To boot a specific slot without waiting for the autoboot countdown, interrupt
+the bootloader (press any key) and run one of the convenience commands defined
+above:
+
+```
+run bootcmd_primary      # boot from primary   (partition 2)
+run bootcmd_secondary    # boot from secondary (partition 3)
+run bootcmd_net          # netboot via DHCP/TFTP
+```
+
+You can also force a permanent change to which slot boots next by setting
+`BOOT_ORDER` directly from Linux (the change persists across reboots):
+
+```sh
+fw_setenv BOOT_ORDER "secondary primary"   # next boot: secondary
+fw_setenv BOOT_ORDER "primary secondary"   # next boot: primary  (default)
+```
+
+### Netbooting
+
+The stock U-Boot supports TFTP.  This is useful for testing a new kernel or
+device tree without reflashing the SD card.  Set up a TFTP server with the
+contents of the Infix `boot/` directory (from the built rootfs at
+`x-aarch64/target/boot/`) and configure the variables:
+
+```
+setenv serverip 192.168.1.1    # IP of your TFTP server
+setenv ipaddr   192.168.1.100  # board IP (omit if using dhcp)
+saveenv
+```
+
+Then netboot manually:
+
+```
+run bootcmd_net
+```
+
+`bootcmd_net` uses `dhcp` to obtain an IP address and the `$serverip` from
+the DHCP server (option 66), then downloads `$image_name` and `$fdt_name`
+via TFTP.  The kernel mounts the primary SD card slot as root, so the SD
+card must still be present.
+
+To make netbooting the default on next boot (e.g. for iterative kernel
+development), set `BOOT_ORDER` from Linux:
+
+```sh
+fw_setenv BOOT_ORDER "net primary secondary"
+```
+
+This causes `bootcmd` to attempt netboot first; on failure it falls through
+to the primary slot on the SD card.
+
+[0]: https://wiki.espressobin.net/
+[1]: https://www.marvell.com/content/dam/marvell/en/public-collateral/embedded-processors/marvell-embedded-processors-armada-37xx-hardware-specifications.pdf
+[2]: https://www.marvell.com/content/dam/marvell/en/public-collateral/switching/marvell-link-street-88E6341-product-brief.pdf
+[3]: https://standards.ieee.org/ieee/1588/6825/
+[4]: https://standards.ieee.org/ieee/802.1AS/7121/
@@ -1,25 +0,0 @@
-image cfg.ext4 {
-	ext4 {
-		label = "cfg"
-	}
-	empty = true
-	size = 16M
-}
-
-image sdcard.img {
-	hdimage {
-	}
-
-	partition rootfs {
-		partition-type = 0x83
-		image = "rootfs.ext4"
-	}
-
-	partition cfg {
-		partition-type = 0x83
-		image = "cfg.ext4"
-	}
-}
-
-# Silence genimage warnings
-config {}
@@ -0,0 +1,61 @@
+image cfg.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card.
+image var.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image #INFIX_ID##VERSION#-espressobin-#TARGET#.img {
+        hdimage {
+                partition-table-type = "gpt"
+        }
+
+        # No bootloader partition: U-Boot lives in SPI NOR flash on all
+        # ESPRESSObin board revisions.  The SD card carries the OS only.
+
+        partition aux {
+                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+                image = "aux.ext4"
+        }
+
+        partition primary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                image = "rootfs.ext2"
+        }
+
+        partition secondary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                image = "rootfs.ext2"
+        }
+
+        partition cfg {
+                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+                image = "cfg.ext4"
+        }
+
+        partition var {
+                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+                image = "var.ext4"
+        }
+}
@@ -1,4 +1,4 @@
-# Raspberry Pi 3B/4B/400/CM4/5B
+# Raspberry Pi 3B/4B/CM4

 ## Overview

@@ -31,18 +31,6 @@ learning, prototyping, and lightweight network applications.
 - GPIO header (40-pin)
 - PoE support (with add-on HAT)

-**Raspberry Pi 5B:**
-
- Broadcom BCM2712 ARM Cortex-A76 quad-core processor @ 2.4 GHz
- 4 GB or 8 GB LPDDR4X RAM
- microSD card slot for storage (PCIe Gen 2 speed via RP1)
- 2x USB 3.0 + 2x USB 2.0 ports (via RP1 companion chip)
- Gigabit Ethernet (via RP1)
- Dual-band WiFi (2.4 GHz + 5 GHz) and Bluetooth 5.0
- 2x micro-HDMI ports (up to 4K@60fps output)
- GPIO header (40-pin)
- PCIe Gen 2 x1 connector (FPC)
-
 **Compute Module 4 (CM4):**

 - Same processor as Pi 4B
@@ -65,12 +53,6 @@ Full support for base board networking and core functionality. GPIO extension
 boards (HATs) are not currently supported. Other Raspberry Pi boards of the
 same generation may work but may require additional testing.

-> [!NOTE]
-> The Raspberry Pi 5B uses the RP1 companion chip, which provides USB, Ethernet,
-> and PCIe connectivity over an internal PCIe Gen 2 link.  The mainline Linux
-> `drm/vc4` driver handles HDMI display on the Pi 5 — no firmware overlay is
-> required, unlike on the Pi 4.
-
 ## Getting Started

 ### Quick Start with SD Card
@@ -89,10 +71,10 @@ The easiest way to get started is using a microSD card:
   - Default login: `admin` / `admin`

 > [!NOTE]
-> Raspberry Pi 3B/4B/5B boot with a dedicated `factory-config.cfg` that
-> enables DHCP client on the Ethernet port.  This means you can access the
-> device over the network without needing a serial console.  Simply find the
-> assigned IP address using an mDNS scan and SSH in!
+> Raspberry Pi 3B and 4B boot with a factory configuration (`factory-config.cfg`)
+> that enables DHCP client on the Ethernet port. This means you can access
+> the device over the network without needing a serial console. Simply find
+> the assigned IP address and SSH in!
 >
 > **Compute Module 4 (CM4)** and some other variants do not have this factory
 > configuration, so you'll need to use a serial console for initial setup or
@@ -194,7 +176,6 @@ admin@infix:/config/container/…/var/> leave

 Proper power supply is critical for stable operation:

- **Raspberry Pi 5B:** 5V/5A USB-C power supply (official 27W recommended)
 - **Raspberry Pi 4B:** 5V/3A USB-C power supply (official recommended)
 - **Raspberry Pi 3B:** 5V/2.5A micro-USB power supply
 - **Compute Module 4:** Power requirements depend on carrier board
@@ -209,16 +190,11 @@ Inadequate power can cause:

 ### Serial Console Access (Optional)

-A serial console is useful for debugging but not required for Pi 3B/4B/5B, since
+A serial console is useful for debugging but not required for Pi 3B/4B, since
 the factory configuration enables network access via DHCP. For CM4 and other
 variants without factory configuration, serial console access is required for
 initial setup.

-> [!NOTE]
-> On the Raspberry Pi 5B the serial console is on `ttyAMA10` (GPIO pins 8/10),
-> not `ttyAMA0` as on earlier models. Use the same wiring but connect to the
-> correct UART in your terminal emulator.
-
 To connect via serial:

 1. Connect a USB-to-TTL serial adapter (3.3V) to GPIO pins:
@@ -36,5 +36,3 @@ dtoverlay=vc4-kms-v3d-pi4
 lcd_rotate=2

 gpu_mem=256
-
-[pi5]
@@ -1,5 +1,4 @@
 dtb-y += broadcom/bcm2837-rpi-3-b.dtb broadcom/bcm2837-rpi-zero-2-w.dtb \
 	 broadcom/bcm2711-rpi-4-b.dtb broadcom/bcm2711-rpi-4-b-dsi.dtb  \
 	 broadcom/bcm2711-rpi-400.dtb broadcom/bcm2711-rpi-cm4-io.dtb   \
-	 broadcom/bcm2711-rpi-cm4.dtb                                    \
-	 broadcom/bcm2712-rpi-5-b.dtb
+	 broadcom/bcm2711-rpi-cm4.dtb
@@ -1,2 +0,0 @@
-#include <arm64/broadcom/bcm2712-rpi-5-b.dts>
-#include "infix.dtsi"
@@ -61,15 +61,6 @@ define RASPBERRYPI_RPI64_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)

 	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)
-
-	# RPi 5 (BCM2712): PCIe bus to RP1 companion chip and its sub-drivers.
-	# Must be built-in (=y) — no initramfs, root is on RP1 SDHCI via PCIe.
-	$(call KCONFIG_SET_OPT,CONFIG_PCIE_BRCMSTB,y)
-	$(call KCONFIG_SET_OPT,CONFIG_MISC_RP1,y)
-	$(call KCONFIG_SET_OPT,CONFIG_COMMON_CLK_RP1,y)
-	$(call KCONFIG_SET_OPT,CONFIG_PINCTRL_RP1,y)
-	$(call KCONFIG_SET_OPT,CONFIG_MMC_SDHCI_BRCMSTB,y)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2712)
 endef

 $(eval $(ix-board))
@@ -5,6 +5,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-qcow/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ext4-rauc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"

@@ -0,0 +1,27 @@
+config IMAGE_EXT4_RAUC
+	bool "RAUC upgrade bundle (ext4)"
+	depends on BR2_TARGET_ROOTFS_EXT2
+	select BR2_PACKAGE_HOST_RAUC
+	help
+	  Create a RAUC upgrade bundle for targets using an ext4 rootfs
+	  image.  Intended for development boards whose bootloader does
+	  not support squashfs.
+
+config IMAGE_EXT4_RAUC_KEY
+	string "signing key"
+	depends on IMAGE_EXT4_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private key, in PKCS#8 format, used to sign
+	  the RAUC bundle; or a PKCS#11 URI.
+
+config IMAGE_EXT4_RAUC_CERT
+	string "signing certificate"
+	depends on IMAGE_EXT4_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+	help
+	  Path to the X509 certificate which will be associated with
+	  the bundle signature.
+
+	  NOTE: This cert MUST be included in the trust store of the
+	        system on which this bundle is to be installed.
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+set -e
+
+ext2="${BINARIES_DIR}/rootfs.ext2"
+pkg="${BINARIES_DIR}/${ARTIFACT}-ext4.pkg"
+
+# RAUC internally uses the file extension to find a suitable install
+# handler, hence the name must be .img
+cp -f "${ext2}" "${WORKDIR}/rootfs.img"
+
+cat >"${WORKDIR}/manifest.raucm" <<EOF
+[update]
+compatible=${COMPATIBLE}
+version=${VERSION}
+
+[bundle]
+format=verity
+
+[image.rootfs]
+filename=rootfs.img
+EOF
+
+rauc --cert="${CERT}" --key="${KEY}" \
+     bundle "${WORKDIR}" "${pkg}.next"
+
+mv "${pkg}.next" "${pkg}"
@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-ext4-rauc
+#
+################################################################################
+
+IMAGE_EXT4_RAUC_DEPENDENCIES := host-rauc
+IMAGE_EXT4_RAUC_CONFIG_VARS := KEY CERT
+
+$(eval $(ix-image))
@@ -120,3 +120,29 @@ grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
 if [ "$BR2_PACKAGE_HOST_PYTHON_YANGDOC" = "y" ]; then
   mkyangdoc "$BINARIES_DIR/yangdoc.html"
 fi
+
+# Bundle the mkdocs User's Guide into the rootfs, served by the WebUI's
+# nginx at /guide/.  Only when the WebUI is present (nothing serves it
+# otherwise, and it keeps minimal images small) and mkdocs is on the build
+# host.  Best-effort: a failed build warns but does not abort the image
+# build, and the WebUI hides its User Guide entry when the docs are absent.
+mkuserguide()
+{
+    local cfg dst
+    cfg="$(readlink -f "$common/../..")/mkdocs.yml"
+    dst="$TARGET_DIR/var/www/guide"
+
+    if ! command -v mkdocs >/dev/null 2>&1; then
+        ixmsg "mkdocs not found, skipping User's Guide bundling"
+        return
+    fi
+    ixmsg "Building User's Guide into $dst"
+    if ! mkdocs build -f "$cfg" -d "$dst" --clean --quiet; then
+        ixmsg "WARNING: mkdocs build failed, shipping without on-device User's Guide"
+        rm -rf "$dst"
+    fi
+}
+
+if [ "$BR2_PACKAGE_WEBUI" = "y" ]; then
+    mkuserguide
+fi
@@ -0,0 +1,5 @@
+RESTCONF_URL=https://127.0.0.1/restconf
+INSECURE_TLS=1
+# Spool firmware uploads (and any other temp files) to persistent storage
+# instead of the RAM-backed /tmp to enable push-upgrades on low-memory systems.
+TMPDIR=/var/tmp
@@ -1,3 +0,0 @@
-service <!> name:hostapd :%i \
-	[2345] hostapd -P/var/run/hostapd-%i.pid  /etc/hostapd-%i.conf \
-	-- Wi-Fi Access Point @%i
@@ -0,0 +1,3 @@
+service name:wpa_supplicant :%i \
+	[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+	-- Wi-Fi Mesh @%i
@@ -0,0 +1,3 @@
+service <!> name:phc2sys :%i log:prio:daemon,tag:phc2sys-%i \
+	[2345] phc2sys -a -z /var/run/ptp4l-%i \
+	-- PHC synchronization for PTP instance %i
@@ -0,0 +1,3 @@
+service <!> name:ptp4l :%i log:prio:daemon,tag:ptp4l-%i \
+	[2345] ptp4l -f /etc/linuxptp/ptp4l-%i.conf \
+	-- PTP instance %i
@@ -0,0 +1 @@
+../restconf.app
@@ -0,0 +1,3 @@
+allow 127.0.0.1;
+allow ::1;
+deny all;
@@ -0,0 +1 @@
+restconf-access-local.conf
@@ -1,5 +1,6 @@
 # /telemetry/optics is for streaming (not used atm)
 location ~ ^/(restconf|yang|.well-known)/ {
+    include /etc/nginx/restconf-access.conf;
    grpc_pass grpc://[::1]:10080;
    grpc_set_header Host $host;
    grpc_set_header X-Real-IP $remote_addr;
@@ -0,0 +1,3 @@
+if [ -s /run/os-update ]; then
+    printf '\n\033[1;33m *** %s ***\033[0m\n\n' "$(cat /run/os-update)"
+fi
@@ -0,0 +1 @@
+f  /run/os-update  0666 admin admin
@@ -567,6 +567,59 @@ def probe_wifi_radios(out):
        out["wifi-radios"].append(info)


+def probe_ptp_capabilities(out):
+    """Probe PTP timestamping capabilities per physical interface via ethtool --json -T.
+
+    Only physical interfaces (those with a 'device' sysfs symlink) are probed;
+    virtual interfaces such as bridges, VLANs, and tun/tap devices are skipped.
+    Results are stored under out["interfaces"][<ifname>]["ptp-capabilities"].
+    """
+    net_base = "/sys/class/net"
+    if not os.path.exists(net_base):
+        return
+
+    ifaces = {}
+    for ifname in sorted(os.listdir(net_base)):
+        if ifname == "lo":
+            continue
+        # Physical interfaces have a 'device' symlink; virtual ones do not.
+        if not os.path.exists(os.path.join(net_base, ifname, "device")):
+            continue
+
+        try:
+            result = subprocess.run(
+                ["ethtool", "--json", "-T", ifname],
+                capture_output=True, text=True, timeout=5
+            )
+            if result.returncode != 0:
+                continue
+            data = json.loads(result.stdout)[0]
+        except Exception:
+            continue
+
+        caps = {
+            "capabilities": data.get("capabilities", []),
+            "tx-types":     data.get("tx-types", []),
+            "rx-filters":   data.get("rx-filters", []),
+        }
+
+        # phc-index is -1 when no PHC is present; omit in that case.
+        phc = data.get("phc-index", -1)
+        if phc >= 0:
+            caps["phc-index"] = phc
+
+        # hwtstamp provider fields are present only on newer kernels/hardware.
+        if (idx := data.get("hwtstamp-provider-index")) is not None:
+            caps["hwtstamp-provider-index"] = idx
+        if (qual := data.get("hwtstamp-provider-qualifier")) is not None:
+            caps["hwtstamp-provider-qualifier"] = qual
+
+        ifaces[ifname] = {"ptp-capabilities": caps}
+
+    if ifaces:
+        out.setdefault("interfaces", {}).update(ifaces)
+
+
 def main():
    out = {
        "vendor": None,
@@ -593,6 +646,7 @@ def main():
        return err

    probe_wifi_radios(out)
+    probe_ptp_capabilities(out)

    if not out["factory-password-hash"]:
        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +
@@ -257,15 +257,15 @@ def parse_interface_info(ifname):
    for line in output.splitlines():
        stripped = line.strip()

-        # Interface type
+        # Interface type (can be multi-word, e.g. "mesh point")
        if stripped.startswith('type '):
-            result['iftype'] = stripped.split()[1]
+            result['iftype'] = ' '.join(stripped.split()[1:])

        # MAC address
        elif stripped.startswith('addr '):
            result['mac'] = stripped.split()[1]

-        # SSID
+        # SSID (AP mode) or mesh-id (mesh point mode) — kernel uses same attr
        elif stripped.startswith('ssid '):
            result['ssid'] = decode_iw_ssid(' '.join(stripped.split()[1:]))

@@ -538,6 +538,43 @@ def parse_link(ifname):
    return result


+def parse_phy_caps(phy_name):
+    """
+    Parse 'iw phy <name> info' for HT and VHT capability bitmasks.
+    Returns: {ht_cap: int, vht_cap: int}
+
+    iw phy info output format:
+        Capabilities: 0x1ef
+            ...
+        VHT Capabilities (0x339071b2):
+            ...
+    """
+    actual_phy = normalize_phy_name(phy_name)
+    output = run_iw('phy', actual_phy, 'info')
+    if not output:
+        output = run_iw(actual_phy, 'info')
+    if not output:
+        return {'ht_cap': 0, 'vht_cap': 0}
+
+    ht_cap = 0
+    vht_cap = 0
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # HT Capabilities: "Capabilities: 0x1ef"
+        ht_match = re.match(r'Capabilities:\s+(0x[0-9a-fA-F]+)', stripped)
+        if ht_match:
+            ht_cap = int(ht_match.group(1), 16)
+
+        # VHT Capabilities: "VHT Capabilities (0x339071b2):"
+        vht_match = re.match(r'VHT Capabilities\s+\((0x[0-9a-fA-F]+)\)', stripped)
+        if vht_match:
+            vht_cap = int(vht_match.group(1), 16)
+
+    return {'ht_cap': ht_cap, 'vht_cap': vht_cap}
+
+
 def main():
    if len(sys.argv) < 2:
        print(json.dumps({
@@ -548,7 +585,8 @@ def main():
                'info': 'Get PHY or interface information (requires device)',
                'survey': 'Get channel survey data (requires interface)',
                'station': 'Get connected stations in AP mode (requires interface)',
-                'link': 'Get link info in station mode (requires interface)'
+                'link': 'Get link info in station mode (requires interface)',
+                'caps': 'Get HT/VHT capability bitmasks (requires PHY/radio)'
            },
            'examples': [
                'iw.py list',
@@ -557,7 +595,8 @@ def main():
                'iw.py info wlan0',
                'iw.py station wifi0',
                'iw.py link wlan0',
-                'iw.py survey wlan0'
+                'iw.py survey wlan0',
+                'iw.py caps radio0'
            ]
        }, indent=2))
        sys.exit(1)
@@ -594,6 +633,11 @@ def main():
                data = {'error': 'survey command requires interface argument'}
            else:
                data = parse_survey(sys.argv[2])
+        elif command == 'caps':
+            if len(sys.argv) < 3:
+                data = {'error': 'caps command requires PHY/radio argument'}
+            else:
+                data = parse_phy_caps(sys.argv[2])
        else:
            data = {'error': f'Unknown command: {command}'}

@@ -0,0 +1,55 @@
+#!/bin/sh
+# Check for available software updates and notify on login if one exists.
+# Called by the scheduler.
+
+NOTIFY_FILE=/run/os-update
+TAG=os-update
+
+# Source os-release for VERSION and IMAGE_ID
+if [ ! -f /etc/os-release ]; then
+    logger -t "$TAG" "ERROR: /etc/os-release not found"
+    exit 1
+fi
+. /etc/os-release
+
+# Dev/dirty builds have no comparable semver — always show the latest release
+IS_RELEASE=true
+if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
+    IS_RELEASE=false
+fi
+
+# Read configured update-url from running config, fall back to upstream
+UPDATE_URL=$(copy running-config \
+    -x '/ietf-system:system/infix-system:software/check-update/update-url' \
+    2>/dev/null \
+    | jq -r '.. | objects | ."update-url"? // empty')
+UPDATE_URL=${UPDATE_URL:-"https://github.com/kernelkit/infix"}
+
+# Derive API URL from the configured update URL.
+# Default (github.com): https://github.com/org/repo → https://api.github.com/repos/org/repo
+REPO=$(echo "$UPDATE_URL" | sed 's|https://github.com/||; s|/*$||')
+API_URL="https://api.github.com/repos/${REPO}/releases/latest"
+
+LATEST_TAG=$(curl -sSL --max-time 10 "$API_URL" 2>/dev/null \
+    | jq -r '.tag_name // empty')
+if [ -z "$LATEST_TAG" ]; then
+    logger -p daemon.info -t "$TAG" "Update check skipped: could not reach ${API_URL}"
+    exit 0
+fi
+LATEST=${LATEST_TAG#v}
+
+# Compare: is $1 strictly newer than $2?
+newer() {
+    [ "$1" = "$2" ] && return 1
+    [ "$(printf '%s\n%s' "$1" "$2" | sort -V | tail -1)" = "$1" ]
+}
+
+if [ "$IS_RELEASE" = false ] || newer "$LATEST" "$VERSION"; then
+    RELEASE_URL="${UPDATE_URL}/releases/${LATEST_TAG}"
+    MSG="Software update available: ${LATEST_TAG}, running ${VERSION} (see ${RELEASE_URL})"
+    logger -t "$TAG" "$MSG"
+    printf '%s\n' "$MSG" > "$NOTIFY_FILE"
+else
+    logger -p daemon.debug -t "$TAG" "No update available (current: $VERSION, latest: $LATEST)"
+    printf '' > "$NOTIFY_FILE"
+fi
@@ -652,7 +652,9 @@ wrap()

    if [ "$cmd" = "stop" ]; then
 	# The setup phase may run forever in the background trying to fetch
-	# the image.  It saves its PID in /run/containers/${name}.pid
+	# the image.  It saves its PID in /run/containers/${name}.pid.  Kill
+	# any in-flight setup, then fall through to podman stop -- a stale
+	# pidfile is not proof the container isn't running.
 	if [ -f "$pidfile" ]; then
            pid=$(cat "$pidfile")

@@ -663,10 +665,9 @@ wrap()
            fi

            rm -f "$pidfile"
-            return 0
 	fi

-	# Only the 'podman stop' command takes -i and --timeout
+	# Only the 'podman stop' command takes -i (ignore missing) and --timeout
 	args="-i --timeout $timeout"
    fi

@@ -33,7 +33,7 @@ for tgt in "${boot_targets}"; do
 	setexpr ixmenu_n ${ixmenu_n} + 1

 	if load ${devtype} ${devnum}:${auxpart} ${loadaddr} /uboot.env; then
-	    env import -b ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact BOARD_VARIANT
+	    env import -c ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact BOARD_VARIANT
 	    run ixvariant
 	fi

@@ -244,6 +244,7 @@ CONFIG_FW_CFG_SYSFS_CMDLINE=y
 CONFIG_BLK_DEV_NULL_BLK=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_NBD=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_DEV_SR=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -75,6 +75,7 @@ BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_MTR=y
@@ -133,6 +134,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
+BR2_PACKAGE_ACER_CONNECT_VERO_W6M=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
 BR2_PACKAGE_BANANAPI_BPI_R4=y
 BR2_PACKAGE_BANANAPI_BPI_R64=y
@@ -160,6 +162,7 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -173,7 +176,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -185,6 +187,8 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
+# BR2_PACKAGE_LANDING is not set
+BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -68,6 +68,7 @@ BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
@@ -130,6 +131,7 @@ BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -143,6 +145,7 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -74,6 +74,7 @@ BR2_PACKAGE_FRR=y
 BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_MTR=y
@@ -148,6 +149,7 @@ BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -161,7 +163,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -169,6 +170,8 @@ BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
+# BR2_PACKAGE_LANDING is not set
+BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 IMAGE_ITB_AUX=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -70,6 +70,7 @@ BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
@@ -128,6 +129,7 @@ BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -141,6 +143,7 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -85,6 +85,7 @@ BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_MTR=y
@@ -180,6 +181,7 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -193,7 +195,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -205,6 +206,8 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
+# BR2_PACKAGE_LANDING is not set
+BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y
@@ -0,0 +1 @@
+BR2_TARGET_ENABLE_ROOT_LOGIN=y
@@ -0,0 +1,4 @@
+BR2_TARGET_ROOTFS_EXT2=y
+BR2_TARGET_ROOTFS_EXT2_4=y
+BR2_TARGET_ROOTFS_EXT2_SIZE="512M"
+IMAGE_EXT4_RAUC=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -74,6 +74,7 @@ BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_MTR=y
@@ -109,6 +110,7 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
+BR2_PACKAGE_RAUC_STREAMING=y
 BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
@@ -155,6 +157,7 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -168,7 +171,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -180,6 +182,8 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
+# BR2_PACKAGE_LANDING is not set
+BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -67,6 +67,7 @@ BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
@@ -127,6 +128,7 @@ BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -140,6 +142,7 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -3,25 +3,154 @@ Change Log

 All notable changes to the project are documented in this file.

-[v26.04.0][UNRELEASED] -
+[v26.06.0][UNRELEASED]
 -------------------------

 ### Changes

- Upgrade Linux kernel to 6.18.23 (LTS)
- Add support for [Banana Pi BPI-R4][BPI-R4], quad-core Cortex-A73 router with
-  4x 2.5 GbE switching, dual 10 GbE SFP+.  Variants BPI-R4-2g5 and BPI-R4P have
-  one SFP+ replaced by a 2.5 GbE RJ45, with optional PoE on the R4P
- Add support for [Raspberry Pi 5 Model B][RPI-5], Broadcom BCM2712 Cortex-A76
-  quad-core @ 2.4 GHz with Gigabit Ethernet, dual USB 3.0, dual HDMI, and WiFi
-  via the RP1 companion chip
+- Upgrade Linux kernel to 6.18.36 (LTS)
+- Upgrade Buildroot to 2025.02.15 (LTS)
+- Add basic web interface: static status pages and a tree view of operational
+  status.  Curated configuration pages for some common tasks and a YANG tree
+  editor for the rest.  Also includes a maintenance section for firmware
+  upgrade, backup & restore, and more
+- Add Wi-Fi roaming for fast, seamless handoff between access points that
+  share an SSID: 802.11k, 802.11v and 802.11r (over-the-air FT).  See the
+  [Wi-Fi][wifi] guide for details
+- Add Wi-Fi 802.11s mesh support, letting access points form a wireless
+  backhaul between each other without cabling
+- Add band steering for dual-band access points, nudging dual-band
+  clients onto the faster 5/6 GHz band
+- Add `legacy-rates` option to re-enable 802.11b rates on 2.4 GHz for
+  old IoT devices (disabled by default)
+- Add system scheduling based on ietf-schedule (RFC 9922), using the
+  iCalendar recurrence grouping pruned to cron-expressible rules.  Schedules
+  are reusable time-specs; features (`scheduled-reboot`,
+  `software/check-update`) trigger off them via a schedule reference

 ### Fixes

- N/A
+- Fix #941: a VETH pair can now connect two containers directly, with both
+  ends assigned to containers.
+- Enabling IP masquerading in the firewall no longer enables IP forwarding on
+  all interfaces.  This has been an issue ever since the firewall support was
+  introduced in v25.10.0
+- Fix file permission regression in `/cfg/startup-config.cfg`, causing the
+  default `admin` user no permission to read or write the file from shell
+- Fix admin url shown for HTTP/HTTPS links in <https://network.local> browser,
+  used pre-conflict resolution hostname.local, instead of hostname-2.local
+
+[wifi]: https://www.kernelkit.org/infix/latest/wifi/
+
+[v26.05.0][] - 2026-05-29
+-------------------------
+
+### Changes
+
+- Upgrade Linux kernel to 6.18.33 (LTS)
+- Upgrade Buildroot to 2025.02.14 (LTS)
+- Upgrade FRR to 10.5.4
+- Add support for [Acer Connect Vero W6m][AcerConnectVero], a low-cost COTS
+  home router, based on the same hardware as [Banana Pi BPI-R3][BPI-R3], but
+  with a Wi-Fi 6E (6 GHz band) chip.
+- Add configurable channel-width in Wi-Fi configuration.
+- Upgrade `ieee802-ethernet-interface` YANG model to revision 2025-09-10 (IEEE
+  Std 802.3.2-2025), adding the standard `phy-type` and `pmd-type` operational
+  leaves.  Speed is now exposed via `ietf-interfaces:speed` (bps, RFC 8343);
+  the now obsolete `eth:speed` is no longer returned
+- Rework `show interface` summary output as layered protocol rows.  When a
+  port has link, a physical-medium row (e.g. `1000baseT`, `10GbaseLR`) appears
+  above the `ethernet` row.  VLAN, GRE, VXLAN and WiFi interfaces likewise get
+  one row per protocol layer, with type-specific data on each (`vid:`,
+  `remote:`, `vni:`, `station ssid:`, etc.), issue #530
+- Add support for configurable auto-negotiation for Ethernet ports.  A new
+  `advertised-pmd-types` leaf-list replaces the fixed speed idiom for pinned
+  link modes, issue #805.  See the [Ethernet Interfaces][ethernet] section in
+  the User Guide for details. Existing configurations using fixed speed are
+  migrated automatically on upgrade
+- Add support for configurable MDI/MDI-X pinout on Ethernet ports.  Needed on
+  some PHYs where Auto-MDIX stops working once auto-negotiation is disabled
+- New operational `supported-pmd-types` leaf-list on each Ethernet interface,
+  exposing the set of PMD types currently supported
+- New CLI command `show operational`, and optional XPath filtering for this
+  and any of the other datastores, using `[path /path/to/subtree]`
+- CLI `show` commands now surface human-friendly error messages instead of a
+  raw Python exceptions, e.g., `Interface "w" not found`
+
+### Fixes
+
+- Fix #1493: container with a physical interface not properly removed when
+  switching to a configuration without containers
+- Fix #1506: add documentation on how to configure VLAN interfaces, including
+  stacked (Q-in-Q) VLAN interfaces, in a dedicated `vlan.md`
+- Handle unclean daemon exits better, e.g., `dbus-daemon` crashing and leaving
+  a stale pidfile behind, causing it to refuse to be restarted
+- Fix occasional blank or garbled `[ OK ]` lines at startup
+- Disallow multicast MAC addresses in custom MAC address configuration
+- Fix broken Wi-Fi 6 GHz band configuration.
+- Fix operational read of `/containers` failing and thereby aborting all
+  operational get-data, including RESTCONF/NETCONF reads — for containers
+  whose command contains shell metacharacters, e.g. `sh -c "... && ..."`
+- WireGuard interfaces are now regenerated when a referenced keystore key
+  changes: the asymmetric `private-key`, and the symmetric `preshared-key` at
+  both peer-group and per-peer level
+- Fix crash in operational data when a bridge has VLAN ranges configured: the
+  kernel may report ranges (e.g. `vlan 1 vlanEnd 3`) from `bridge vlan global
+  show`, which were not expanded, so `show interface` and other operational
+  reads failed.  Ranges are now expanded and listed correctly
+
+[ethernet]: https://www.kernelkit.org/infix/latest/ethernet/#restricting-advertised-link-modes
+[BPI-R3]:   https://docs.banana-pi.org/en/BPI-R3/BananaPi_BPI-R3
+[AcerConnectVero]: https://github.com/kernelkit/infix/tree/main/board/aarch64/acer-connect-vero-w6m
+
+[v26.04.0][] - 2026-04-30
+-------------------------
+
+### Changes
+
+- Upgrade Linux kernel to 6.18.25 (LTS)
+- Upgrade Buildroot to 2025.02.13 (LTS)
+- Add support for per-bridge multicast router port in operational, issue #395
+- Add support for static ARP (IPv4) and neighbor cache (IPv6) entries per
+  interface, issue #819.  Static entries are installed as permanent kernel
+  neighbor table entries that are never evicted by normal ARP/NDP aging
+- Add support for PTP/gPTP (IEEE 1588-2019 / 802.1AS) clock synchronization.
+  Supported clock types: Ordinary Clock, Boundary Clock, and Transparent Clock.
+  See the User Guide for configuration details
+- Add support for [Banana Pi BPI-R4][BPI-R4], quad-core Cortex-A73 router with
+  4x 2.5 GbE switching, dual 10 GbE SFP+.  Variants BPI-R4-2g5 and BPI-R4P have
+  one SFP+ replaced by a 2.5 GbE RJ45, with optional PoE on the R4P
+- Update [Marvell ESPRESSObin][ESPRESSObin] board support.  Allow booting with
+  stock U-Boot, which only supports ext4 rootfs partitions; to use, apply the
+  `ext4` developer snippet before building (`make apply-ext4 all`)
+- Fix onboard WiFi support on the Banana Pi BPi-R64
+
+### Fixes
+
+- Fix #520: warn in syslog if multicast flooding is disabled
+- Fix #769: document dummy interfaces in user guide
+- Fix #790: document static multicast filters in user guide
+- Fix #1439: changing hostname does not regenerate DHCP client conf until restart
+- Fix #1458: `show ntp tracking` displaying a truncated Reference ID, e.g.,
+  `92.2` instead of `92.246.137.39`
+- Fix #1466: `show container` showing no output for containers whose command
+  line includes environment variables
+- Fix issue with IGMP queries sent with all-zeroes source MAC address
+- Fix missing IGMP query startup burst when assuming IGMP querier role, as
+  defined in RFC3376 §8.6/§8.7
+- Fix Raspberry Pi 4 and Pi 400 display instability after soft reboot.
+  Previously the touchscreen/DSI display required a full power cycle to
+  reinitialise correctly; it now works reliably after `reboot`.  Please note,
+  you need a fairly up-to-date EEPROM version as well
+- Fix [BPI-R4][] board README showing inverted DIP switch values for eMMC and
+  SPI NAND boot modes, which would prevent the board from booting correctly
+- Fix [SAMA7G54][] U-Boot build system selection that caused build failures
+- Fix [BPI-R3][] PCIe devices failing to initialize on boot due to a missing
+  clock definition in the device tree

 [BPI-R4]: https://docs.banana-pi.org/en/BPI-R4/BananaPi_BPI-R4
-[RPI-5]:  https://www.raspberrypi.com/products/raspberry-pi-5/
+[ESPRESSObin]: https://espressobin.net/
+[SAMA7G54]: https://www.microchip.com/en-us/development-tool/ev21h18a

 [v26.03.0][] - 2026-03-31
 -------------------------
@@ -122,7 +251,7 @@ All notable changes to the project are documented in this file.

 - Fix CLI `copy` command problem to copy to scp/sftp destinations

-[BPI-R3-MINI]: https://wiki.banana-pi.org/Banana_Pi_BPI-R3_Mini
+[BPI-R3-MINI]: https://docs.banana-pi.org/en/BPI-R3_Mini/BananaPi_BPI-R3_Mini
 [SAMA7G54-EK]: https://www.microchip.com/en-us/development-tool/ev21h18a

 [v26.01.0][] - 2026-02-03
@@ -2045,7 +2174,10 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.03.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.05.0...HEAD
+[v26.06.0]:   https://github.com/kernelkit/infix/compare/v26.05.0...v26.06.0
+[v26.05.0]:   https://github.com/kernelkit/infix/compare/v26.04.0...v26.05.0
+[v26.04.0]:   https://github.com/kernelkit/infix/compare/v26.03.0...v26.04.0
 [v26.03.0]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.03.0
 [v26.02.0]:   https://github.com/kernelkit/infix/compare/v26.01.0...v26.02.0
 [v26.01.0]:   https://github.com/kernelkit/infix/compare/v25.11.0...v26.01.0
@@ -21,6 +21,7 @@ regression test system solely relies on NETCONF and RESTCONF.
   - [Introduction](introduction.md)
   - [System Configuration](system.md)
   - [Network Configuration](networking.md)
+   - [Wi-Fi](wifi.md)
   - [DHCP Server](dhcp.md)
   - [Syslog Support](syslog.md)
 - **Infix In-Depth**
@@ -73,8 +73,8 @@ admin@example:/config/interface/br0/> <b>set bridge vlans vlan 20 tagged br0</b>
 </code></pre>

 To route or to manage via a VLAN, a VLAN interface needs to be created
-on top of the bridge, see section [VLAN Interfaces](ethernet.md#vlan-interfaces)
-for more on this topic.
+on top of the bridge, see section [VLAN Interfaces](vlan.md) for more
+on this topic.

 > [!NOTE]
 > In some use-cases only a single management VLAN on the bridge is used.
@@ -183,6 +183,48 @@ In this setup we have a lot more going on.  Multiple multicast router
 ports have been detected, and behind the scenes someone has also added
 an IGMP/MLD fast-leave port.

+### Static Multicast Filters
+
+When IGMP/MLD snooping is in use, traffic for an unregistered group is
+flooded to all ports until a receiver joins.  For MAC multicast groups,
+or for groups where snooping cannot learn membership automatically, you
+can add static entries to the MDB that immediately restrict forwarding
+to a given set of ports.
+
+> [!NOTE]
+> Snooping must be enabled on the bridge (or per VLAN) before static
+> multicast filters can be configured.
+
+On a plain (non-VLAN) bridge, add a static IPv4 or MAC multicast filter
+like this:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface br0</b>
+admin@example:/config/interface/br0/> <b>set bridge multicast-filters multicast-filter 224.1.1.1 ports e2</b>
+admin@example:/config/interface/br0/> <b>set bridge multicast-filters multicast-filter 224.1.1.1 ports e3</b>
+admin@example:/config/interface/br0/> <b>set bridge multicast-filters multicast-filter 01:00:5e:01:01:01 ports e2</b>
+admin@example:/config/interface/br0/> <b>leave</b>
+admin@example:/> <b>copy running-config startup-config</b>
+</code></pre>
+
+Each `ports` entry for the same group adds one port to the filter.
+Receivers on all other ports will not see traffic for that group.
+
+On a VLAN-filtering bridge the filter is scoped per VLAN:
+
+<pre class="cli"><code>admin@example:/config/interface/br1/> <b>set bridge vlans vlan 10 multicast-filters multicast-filter 224.2.2.2 ports e5</b>
+admin@example:/config/interface/br1/> <b>set bridge vlans vlan 10 multicast-filters multicast-filter 224.2.2.2 ports e6</b>
+</code></pre>
+
+To verify the MDB — both statically configured and dynamically learned
+entries — use:
+
+<pre class="cli"><code>admin@example:/> <b>show bridge mdb</b>
+<span class="header">BRIDGE   VID  GROUP                 PORTS                              </span>
+br0           224.1.1.1             e2, e3
+br0           01:00:5e:01:01:01     e2
+</code></pre>
+
 ### Terminology & Abbreviations

 - **IGMP**: Internet Group Membership Protocol, multicast subscription
@@ -164,7 +164,7 @@ interfaces {
  }
 }
 admin@host-12-34-56:/config/interface/eth0/> leave
-admin@host-12-34-56:/> show interfaces
+admin@host-12-34-56:/> show interface
 INTERFACE       PROTOCOL   STATE       DATA
 lo              loopback   UNKNOWN     00:00:00:00:00:00
                ipv4                   127.0.0.1/8 (static)
@@ -668,11 +668,9 @@ set:

 For an example of both, see the next section.

-> [!IMPORTANT]
-> **VETH Pair Limitation:** When using VETH pairs with containers, at least
-> one side of the pair must remain in the host namespace. It is currently
-> not possible to create VETH pairs where both ends are assigned to different
-> containers. One end must always be accessible from the host.
+> [!TIP]
+> Both ends of a VETH pair may be assigned to containers, connecting two
+> containers directly without involving the host namespace.

 [^3]: Something which the container bridge network type does behind the
    scenes with one end of an automatically created VETH pair.
@@ -7,12 +7,12 @@ account, which is created based on credentials found in the VPD area --
 for Qemu devices this is emulated using `qemu_fw_cfg`.

 For developers this can be quite frustrating to be blocked from logging
-in to debug the system.  So we recommend enabling the `root` account in
-the Buildroot `make menuconfig` system.
+in to debug the system.  The quickest way to enable root login is to
+apply the `dev` configuration snippet:

-    make menuconfig
-         -> System configuration
-            -> [*]Enable root login with password
+    make apply-dev
+
+See [Configuration Snippets](#configuration-snippets) for more details.

 > [!IMPORTANT]
 > Please see the [Contributing](#contributing) section, below, for
@@ -122,13 +122,21 @@ recommend using `pipx` to install the necessary tooling:
 ```bash
 $ sudo apt install pipx
 $ pipx install mkdocs
-$ pipx inject mkdocs mkdocs-material pymdown-extensions mkdocs-callouts mike mkdocs-to-pdf
+$ pipx inject mkdocs mkdocs-material pymdown-extensions mkdocs-callouts mike mkdocs-to-pdf mkdocs-glightbox
 ```

-The last two packages, `mike` and `mkdocs-to-pdf`, are used for online
-versioning and PDF generation by GitHub Actions, but since they are in
-the `mkdocs.yml` file, everyone who wants to preview the documentation
-have to install all the tooling.
+The `mike` and `mkdocs-to-pdf` packages are used for online versioning
+and PDF generation by GitHub Actions, but since every plugin is listed
+in `mkdocs.yml`, anyone who wants to preview the documentation has to
+install all the tooling.
+
+> [!IMPORTANT]
+> MkDocs is also required to **build a WebUI image**.  The build bundles
+> the User's Guide into the image (served on-device at `/guide/`), so
+> `make` runs `mkdocs build` from `post-build.sh` when the `webui`
+> package is selected.  If MkDocs is missing the build still succeeds,
+> but the image ships without the on-device guide.  Minimal images and
+> any build without the `webui` package skip this step entirely.

 Preview with:

@@ -166,6 +174,36 @@ on Buildroot to finalize the target filesystem and generate the images.
 The final `run` argument is explained below.


+### Configuration Snippets
+
+Infix ships a set of Kconfig fragments in `configs/snippets/` that can
+be merged into your active `.config` on demand.  This avoids polluting
+defconfigs with settings that are only useful during development.
+
+To see what snippets are available:
+
+    make list-snippets
+
+To apply a single snippet to the current output directory:
+
+    make apply-dev          # enable root login
+    make apply-ext4         # build an ext4 rootfs (needed for boards
+                            # whose bootloader lacks squashfs support,
+                            # e.g. Marvell ESPRESSObin)
+
+The `apply-*` targets require an existing `.config` (i.e. you must have
+already run a `make <board>_defconfig`).  The snippet is merged using
+Buildroot's `merge_config.sh`, so it behaves like `make menuconfig`:
+unrelated settings are preserved, conflicting ones are overridden.
+
+To apply **all** snippets at once and then build:
+
+    make dev
+
+This is the recommended one-shot command for setting up a development
+build from a freshly selected defconfig.
+
+
 ### YANG Model

 When making changes to the `confd` and `statd` services, you will often
@@ -109,11 +109,11 @@ When configuring, e.g., `dns-server`, or `router` options with the value
 `auto`, the system uses the IP address from the interface matching the
 subnet.  For example:

-<pre class="cli"><code>admin@example:/> <b>show interfaces</b>
-<span class="header">INTERFACE       PROTOCOL   STATE       DATA                                    </span>
-eth0            ethernet   UP          02:00:00:00:00:00
+<pre class="cli"><code>admin@example:/> <b>show interface</b>
+<span class="header">INTERFACE       PROTOCOL      STATE       DATA                                    </span>
+eth0            ethernet      UP          02:00:00:00:00:00
                ipv4                   192.168.1.1/24 (static)
-eth1            ethernet   UP          02:00:00:00:00:01
+eth1            ethernet      UP          02:00:00:00:00:01
                ipv4                   192.168.2.1/24 (static)

 admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> <b>edit option dns-server</b>
@@ -1,52 +1,8 @@
 # Ethernet Interfaces

-This document covers VLAN interfaces, physical Ethernet interfaces,
-and virtual Ethernet (VETH) pairs.
-
-
-## VLAN Interfaces
-
-Creating a VLAN can be done in many ways.  This section assumes VLAN
-interfaces created atop another Linux interface.  E.g., the VLAN
-interfaces created on top of the Ethernet interface or bridge in the
-picture below.
-
-![VLAN interface on top of Ethernet or Bridge interfaces](img/interface-vlan-variants.svg)
-
-A VLAN interface is basically a filtering abstraction. When you run
-`tcpdump` on a VLAN interface you will only see the frames matching the
-VLAN ID of the interface, compared to *all* the VLAN IDs if you run
-`tcpdump` on the lower-layer interface.
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit interface eth0.20</b>
-admin@example:/config/interface/eth0.20/> <b>show</b>
-type vlan;
-vlan {
-  tag-type c-vlan;
-  id 20;
-  lower-layer-if eth0;
-}
-admin@example:/config/interface/eth0.20/> <b>leave</b>
-</code></pre>
-
-The example below assumes bridge br0 is already created, see [VLAN
-Filtering Bridge](bridging.md#vlan-filtering-bridge).
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit interface vlan10</b>
-admin@example:/config/interface/vlan10/> <b>set vlan id 10</b>
-admin@example:/config/interface/vlan10/> <b>set vlan lower-layer-if br0</b>
-admin@example:/config/interface/vlan10/> <b>leave</b>
-</code></pre>
-
-As conventions, a VLAN interface for VID 20 on top of an Ethernet
-interface *eth0* is named *eth0.20*, and a VLAN interface for VID 10 on
-top of a bridge interface *br0* is named *vlan10*.
-
-> [!NOTE]
-> If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a
-> number, the CLI infers the interface type automatically.
+This document covers physical Ethernet interfaces and virtual Ethernet
+(VETH) pairs.  For VLAN interfaces stacked on top of an Ethernet port
+or bridge, see [VLAN Interfaces](vlan.md).


 ## Physical Ethernet Interfaces
@@ -56,111 +12,219 @@ top of a bridge interface *br0* is named *vlan10*.
 Physical Ethernet interfaces provide low-level settings for speed/duplex as
 well as packet status and [statistics](#ethernet-statistics).

-By default, Ethernet interfaces defaults to auto-negotiating
-speed/duplex modes, advertising all speed and duplex modes available.
-In the example below, the switch would by default auto-negotiate speed
-1 Gbit/s on port eth1 and 100 Mbit/s on port eth4, as those are the
-highest speeds supported by H1 and H2 respectively.
+By default, Ethernet interfaces defaults to auto-negotiating speed/duplex
+modes, advertising all speed and duplex modes available.  In the example
+below, the switch would by default auto-negotiate speed 1 Gbps on port eth1
+and 100 Mbps on port eth4, as those are the highest speeds supported by H1 and
+H2 respectively.

 ![4-port Gbit/s switch connected to Gbit and Fast Ethernet Hosts](img/ethernet-autoneg.svg)

-The speed and duplex status for the links can be listed as shown
-below, assuming the link operational status is 'up'.
+A quick at-a-glance view of the physical link is available in the summary
+listing.  When a port is up, a physical-layer row appears above the ethernet
+row, naming the IEEE PMD type (e.g. `1000baseT`, `10GbaseLR`) in the PROTOCOL
+column and the negotiated duplex in DATA.  When the link is down the row is
+omitted and the interface name falls onto the ethernet row.
+
+<pre class="cli"><code>admin@example:/> <b>show interface</b>
+<span class="header">INTERFACE       PROTOCOL      STATE       DATA             </span>
+eth1            1000baseT     UP          duplex: full
+                ethernet                  00:53:00:06:11:01
+eth2            1000baseT     UP          duplex: full
+                ethernet                  00:53:00:06:11:02
+eth3            ethernet      DOWN        00:53:00:06:11:03
+eth4            100baseTX     UP          duplex: full
+                ethernet                  00:53:00:06:11:04
+...
+</code></pre>
+
+The detail view spells everything out, including auto-negotiation
+state and the speed in Mbit/s.

 <pre class="cli"><code>admin@example:/> <b>show interface eth1</b>
-name                : eth1
-index               : 2
-mtu                 : 1500
-operational status  : up
-auto-negotiation    : on
-duplex              : full
-speed               : 1000
-physical address    : 00:53:00:06:11:01
-ipv4 addresses      :
-ipv6 addresses      :
-in-octets           : 75581
-out-octets          : 43130
+name               : eth1
+index              : 2
+mtu                : 1500
+operational status : up
+link mode          : 1000baseT
+auto-negotiation   : on
+duplex             : full
+speed              : 1000
+physical address   : 00:53:00:06:11:01
+ipv4 addresses     :
+ipv6 addresses     :
+in-octets          : 75581
+out-octets         : 43130
 ...
 admin@example:/> <b>show interface eth4</b>
-name                : eth4
-index               : 5
-mtu                 : 1500
-operational status  : up
-auto-negotiation    : on
-duplex              : full
-speed               : 100
-physical address    : 00:53:00:06:11:04
-ipv4 addresses      :
-ipv6 addresses      :
-in-octets           : 75439
-out-octets          : 550704
+name               : eth4
+index              : 5
+mtu                : 1500
+operational status : up
+link mode          : 100baseTX
+auto-negotiation   : on
+duplex             : full
+speed              : 100
+physical address   : 00:53:00:06:11:04
+ipv4 addresses     :
+ipv6 addresses     :
+in-octets          : 75439
+out-octets         : 550704
 ...
 admin@example:/>
 </code></pre>

-### Configuring fixed speed and duplex
+### Restricting advertised link modes

-Auto-negotiation of speed/duplex mode is desired in almost all
-use-cases, but it is possible to disable auto-negotiation and specify
-a fixed speed and duplex mode.
+Auto-negotiation is the right default for almost all links, but sometimes a
+port has to come up at a fixed speed, usually when talking to old hardware
+that won't auto-negotiate or does it badly.  IEEE Std 802.3.2-2025 dropped
+the old "turn off auto-negotiation, then set a fixed speed and duplex"
+approach.  Instead you restrict the set of PMD types the port may advertise:
+list a single PMD and the link pins to that mode against any peer that
+supports it.

-> [!IMPORTANT]
-> When setting a fixed speed and duplex mode, ensure both sides of the
-> link have matching configuration.  If speed does not match, the link
-> will not come up.  If duplex mode does not match, the result is
-> reported collisions and/or bad throughput.
+> [!NOTE]
+> Earlier Infix releases needed `enable false` plus explicit `speed` and
+> `duplex` leaves.  IEEE Std 802.3.2-2025 retired the `eth:speed` leaf, so
+> the speed now comes from the `advertised-pmd-types` entry instead.
+> Existing `startup-config.cfg` files are migrated automatically on upgrade.

-The example below configures port eth3 to fixed speed 100 Mbit/s
-half-duplex mode.
+Each entry in `auto-negotiation/advertised-pmd-types` is an IEEE PMD-type
+identity (`ieee802-ethernet-phy-type:pmd-type-*`).  The separate `duplex`
+leaf controls half vs full duplex.
+
+The example below pins port `eth3` to 100 Mbit/s half-duplex.

 <pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit interface eth3 ethernet</b>
-admin@example:/config/interface/eth3/ethernet/> <b>set speed 0.1</b>
+admin@example:/config/interface/eth3/ethernet/> <b>set auto-negotiation advertised-pmd-types pmd-type-100BASE-TX</b>
 admin@example:/config/interface/eth3/ethernet/> <b>set duplex half</b>
-admin@example:/config/interface/eth3/ethernet/> <b>set auto-negotiation enable false</b>
 admin@example:/config/interface/eth3/ethernet/> <b>show</b>
 auto-negotiation {
-  enable false;
+  advertised-pmd-types [ ieee802-ethernet-phy-type:pmd-type-100BASE-TX ];
 }
 duplex half;
-speed 0.1;
 admin@example:/config/interface/eth3/ethernet/> <b>leave</b>
 admin@example:/>
 </code></pre>

-Speed metric is in Gbit/s.  Auto-negotiation needs to be disabled in
-order for fixed speed/duplex to apply. Only speeds `0.1`(100 Mbit/s)
-and `0.01` (10 Mbit/s) can be specified. 1 Gbit/s and higher speeds
-require auto-negotiation to be enabled.
+List several PMDs to advertise all of them; auto-negotiation then settles
+on the highest mode both ends support.
+
+> [!IMPORTANT]
+> When pinning a link mode, make sure both ends share at least one common
+> (PMD, duplex) combination, otherwise the link will not come up.
+
+#### Duplex and advertised modes
+
+A PMD type like `10BASE-T` or `100BASE-TX` says nothing about duplex on its
+own, but the kernel tracks half and full duplex as separate link modes.
+Infix advertises both variants of every PMD you list, then narrows to one
+duplex when the `duplex` leaf is set:
+
+| `advertised-pmd-types`     | `duplex` | Resulting advertised modes               |
+|----------------------------|----------|------------------------------------------|
+| `[10BASE-T]`               | _unset_  | `10baseT/Half` + `10baseT/Full`          |
+| `[10BASE-T]`               | `full`   | `10baseT/Full`                           |
+| `[10BASE-T]`               | `half`   | `10baseT/Half`                           |
+| `[10BASE-T, 100BASE-TX]`   | _unset_  | all four half/full combinations          |
+| `[10BASE-T, 100BASE-TX]`   | `full`   | `10baseT/Full` + `100baseT/Full`         |
+| _unset_                    | _unset_  | every mode the PHY supports (default)    |
+
+So `duplex` filters the PMDs you listed.  PMDs with no half-duplex variant
+(everything above 1 Gbps) only ever advertise full.
+
+#### Disabling auto-negotiation
+
+The method above keeps auto-negotiation on and only limits what it
+advertises, so the peer still negotiates as usual.  That doesn't help with
+gear that won't negotiate at all, like some old switches or a back-to-back
+copper link.  For those, set `auto-negotiation/enable false` together with a
+single `advertised-pmd-types` entry to force a fixed speed and duplex with
+negotiation off:
+
+<pre class="cli"><code>admin@example:/config/interface/eth3/ethernet/> <b>set auto-negotiation enable false</b>
+admin@example:/config/interface/eth3/ethernet/> <b>set auto-negotiation advertised-pmd-types pmd-type-100BASE-TX</b>
+admin@example:/config/interface/eth3/ethernet/> <b>set duplex full</b>
+</code></pre>
+
+With `enable false` you must list exactly one PMD: it sets the speed, and
+the `duplex` leaf sets half or full.  Leave `duplex` out and Infix uses
+whatever the PMD supports, normally full.
+
+Auto-MDIX usually rides along with auto-negotiation, so turning negotiation
+off can leave both ends picking the same MDI/MDI-X pinout.  The link then
+comes up electrically but carries no traffic.  When that happens, force
+opposite pinouts with the `mdi-x` leaf — set one end true (MDI-X) and the
+other false (MDI):
+
+<pre class="cli"><code>admin@example:/config/interface/eth3/ethernet/> <b>set mdi-x false</b>
+</code></pre>
+
+Leaving `mdi-x` unset keeps Auto-MDIX in charge, which is correct whenever
+auto-negotiation is on.
+
+> [!NOTE]
+> Whether `enable false` reaches the external PHY depends on the driver.
+> Direct-attach NICs handle it directly.  Switch user ports go through the
+> switch driver, and some accept the request at the MAC but leave the PHY
+> auto-negotiating: the kernel reports the configured speed while the wire
+> runs at whatever was negotiated, and traffic stalls.  If that happens,
+> read the PHY's BMCR register (e.g. with `mdio` from `mdiotools`) to see
+> what the PHY is actually doing.
+
+The detail view exposes a `supported` block (operational state,
+backed by the `supported-pmd-types` leaf-list) listing the PMD types
+the kernel currently believes the interface can operate at.  For
+SFP/SFP+ cages this set reflects the inserted module: plug in a 10G
+LR optic and `supported` will narrow to `10GbaseLR` only.  Combined
+with the operational `link mode` row above it, this makes it trivial
+to confirm what an unknown transceiver actually is — no `ethtool -m`
+round-trip needed.
+
+<pre class="cli"><code>admin@example:/> <b>show interface eth13</b>
+name               : eth13
+type               : ethernet
+operational status : up
+link mode          : 10GbaseLR
+auto-negotiation   : off
+supported          : 10GbaseLR
+duplex             : full
+speed              : 10000
+...
+</code></pre>

 ### Ethernet statistics

 Ethernet packet statistics[^1] can be listed as shown below.

 <pre class="cli"><code>admin@example:/> <b>show interface eth1</b>
-name                : eth1
-index               : 2
-mtu                 : 1500
-operational status  : up
-auto-negotiation    : on
-duplex              : full
-speed               : 1000
-physical address    : 00:53:00:06:11:0a
-ipv4 addresses      :
-ipv6 addresses      :
-in-octets           : 75581
-out-octets          : 43130
-
-eth-in-frames                : 434
-eth-in-multicast-frames      : 296
-eth-in-broadcast-frames      : 138
-eth-in-error-fcs-frames      : 0
-eth-in-error-oversize-frames : 0
-eth-out-frames               : 310
-eth-out-multicast-frames     : 310
-eth-out-broadcast-frames     : 0
-eth-out-good-octets          : 76821
-eth-in-good-octets           : 60598
+name               : eth1
+index              : 2
+mtu                : 1500
+operational status : up
+link mode          : 1000baseT
+auto-negotiation   : on
+duplex             : full
+speed              : 1000
+physical address   : 00:53:00:06:11:0a
+ipv4 addresses     :
+ipv6 addresses     :
+in-octets          : 75581
+out-octets         : 43130
+───────────────────
+<b>Ethernet Statistics</b>
+in-frames                : 434
+in-multicast-frames      : 296
+in-broadcast-frames      : 138
+in-error-fcs-frames      : 0
+in-error-oversize-frames : 0
+out-frames               : 310
+out-multicast-frames     : 310
+out-broadcast-frames     : 0
+out-good-octets          : 76821
+in-good-octets           : 60598
 admin@example:/>
 </code></pre>

@@ -1,3 +1,90 @@
+/* Chirpy-style typography (must precede all other rules).
+ * Source Sans Pro was renamed "Source Sans 3" on Google Fonts; it is the
+ * same typeface. Lato is used for headings, matching www.kernelkit.org. */
+@import url('https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&family=Source+Sans+3:ital,wght@0,400;0,600;0,700;1,400&display=swap');
+
+/* ---- Fonts ---------------------------------------------------------------
+ * theme.font is disabled in mkdocs.yml, so we set Material's font vars here.
+ * Body: Source Sans 3, code: system monospace (same stack Chirpy uses). */
+:root {
+  --md-text-font: "Source Sans 3";
+  --md-code-font: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New";
+}
+
+body {
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+/* Lato for all headings and the masthead site title. */
+.md-typeset h1,
+.md-typeset h2,
+.md-typeset h3,
+.md-typeset h4,
+.md-typeset h5,
+.md-typeset h6,
+.md-header__title,
+.md-nav__title {
+  font-family: "Lato", "Microsoft Yahei", sans-serif;
+}
+
+/* ---- Light mode (Chirpy "default" palette) ------------------------------- */
+[data-md-color-scheme="default"] {
+  --md-typeset-color: #34343c;
+  --md-typeset-a-color: #0056b2;     /* Chirpy blue links */
+  --md-accent-fg-color: #0056b2;     /* link hover / active TOC */
+  --md-code-bg-color: #f6f8fa;
+  --md-code-fg-color: #3a3a3a;
+}
+
+[data-md-color-scheme="default"] .md-typeset h1,
+[data-md-color-scheme="default"] .md-typeset h2,
+[data-md-color-scheme="default"] .md-typeset h3,
+[data-md-color-scheme="default"] .md-typeset h4,
+[data-md-color-scheme="default"] .md-typeset h5,
+[data-md-color-scheme="default"] .md-typeset h6 {
+  color: #2a2a2a;
+}
+
+/* Subtle tinted sidebars (left nav + right TOC), as on the blog. */
+[data-md-color-scheme="default"] .md-sidebar {
+  background-color: #f6f8fa;
+}
+
+/* ---- Dark mode (Chirpy "dark" palette over Material's slate) ------------- */
+[data-md-color-scheme="slate"] {
+  --md-default-bg-color: rgb(27 27 30);          /* neutral near-black */
+  --md-default-fg-color: rgb(207 208 209);       /* UI text */
+  --md-default-fg-color--light: rgb(175 176 177);
+  --md-default-fg-color--lighter: rgb(175 176 177 / 45%);
+  --md-default-fg-color--lightest: rgb(175 176 177 / 18%);
+  --md-typeset-color: rgb(175 176 177);          /* body text */
+  --md-code-bg-color: #151515;
+  --md-code-fg-color: #b0b0b0;
+  --md-typeset-a-color: rgb(138 180 248);        /* Chirpy blue links */
+  --md-accent-fg-color: rgb(168 199 250);        /* brighter blue on hover */
+}
+
+[data-md-color-scheme="slate"] .md-typeset h1,
+[data-md-color-scheme="slate"] .md-typeset h2,
+[data-md-color-scheme="slate"] .md-typeset h3,
+[data-md-color-scheme="slate"] .md-typeset h4,
+[data-md-color-scheme="slate"] .md-typeset h5,
+[data-md-color-scheme="slate"] .md-typeset h6 {
+  color: #cccccc;
+}
+
+/* Sidebars slightly lighter than the main background, as on the blog. */
+[data-md-color-scheme="slate"] .md-sidebar {
+  background-color: #1e1e1e;
+}
+
+/* Inline code reads as a faint highlight rather than a dark block. */
+[data-md-color-scheme="slate"] .md-typeset :not(pre) > code {
+  background-color: rgb(255 255 255 / 6%);
+}
+
+/* ---- Existing project styling -------------------------------------------- */
 .md-header__title {
    font-size: 1.1rem;
    line-height: 2.6rem;
@@ -61,13 +61,19 @@ admin@example:/config/interface/eth0/> <b>leave</b>
 The operational status can be inspected to see both administrative and
 actual link state:

-<pre class="cli"><code>admin@example:/> <b>show interfaces</b>
-INTERFACE       PROTOCOL   STATE       DATA
-eth0            ethernet   <b>DISABLED</b>    02:00:00:00:00:00
-eth1            ethernet   UP          02:00:00:00:00:01
+<pre class="cli"><code>admin@example:/> <b>show interface</b>
+<span class="header">INTERFACE       PROTOCOL      STATE       DATA             </span>
+eth0            ethernet      <b>DISABLED</b>    02:00:00:00:00:00
+eth1            1000baseT     UP          duplex: full
+                ethernet                  02:00:00:00:00:01
 ...
 </code></pre>

+The rows are layered bottom-up by protocol: a physical-medium row (only
+emitted when the link is up) on top, then the ethernet row carrying the
+bare MAC, then any ipv4/ipv6 sub-rows.  See [Ethernet](ethernet.md) for the
+full set of summary fields.
+

 ## Description

@@ -84,9 +90,9 @@ The description is visible in the operational datastore and in `show`
 commands:

 <pre class="cli"><code>admin@example:/> <b>show interface eth0</b>
-name                : eth0
-description         : Uplink to core switch
-index               : 2
+name               : eth0
+description        : Uplink to core switch
+index              : 2
 ...
 </code></pre>

@@ -138,6 +144,49 @@ admin@example:/config/interface/veth0a/> <b>set custom-phys-address chassis offs
 </code></pre>


+## Dummy Interface
+
+A dummy interface is a virtual interface that is always administratively
+and operationally UP, regardless of any physical link state.  It can
+hold IP addresses just like any other interface.
+
+The two most common uses are:
+
+- **Stable OSPF router-ID**: OSPF picks its router-ID from an interface
+  address.  If that interface goes down, adjacencies can flap.  Binding
+  the router-ID to a /32 address on a dummy avoids this.
+- **Stable management address**: A /32 on a dummy gives the device a
+  permanent identity on the network, reachable as long as at least one
+  uplink is up and the address is redistributed into the routing domain.
+
+> [!TIP]
+> WiFi interfaces also use dummies as placeholders when the radio
+> hardware is not detected at boot (e.g., a USB dongle that was
+> unplugged).  See [WiFi](wifi.md) for details.
+
+### Example: Stable OSPF Router-ID
+
+Create a dummy interface with a /32 address and use it as the OSPF
+router-ID so that the ID never changes when physical ports bounce:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface lo0</b>
+admin@example:/config/interface/lo0/> <b>set type dummy</b>
+admin@example:/config/interface/lo0/> <b>set ipv4 address 192.0.2.1 prefix-length 32</b>
+admin@example:/config/interface/lo0/> <b>leave</b>
+admin@example:/config/> <b>edit routing control-plane-protocol ospfv2 name default ospf</b>
+admin@example:/config/routing/…/ospf/> <b>set explicit-router-id 192.0.2.1</b>
+admin@example:/config/routing/…/ospf/> <b>leave</b>
+admin@example:/> <b>copy running-config startup-config</b>
+</code></pre>
+
+To also make the address reachable by other routers, redistribute
+connected routes (or add `lo0` as an OSPF interface):
+
+<pre class="cli"><code>admin@example:/config/routing/…/ospf/> <b>set redistribute connected</b>
+</code></pre>
+
+
 [^1]: A YANG deviation was previously used to make it possible to set
    `phys-address`, but this has been replaced with the more flexible
    `custom-phys-address`.
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`dtb-y += mediatek/mt7986a-acer-connect-vero-w6m.dtb`