Merge pull request #1068 from kernelkit/raspberry-pi

Raspberry pi
rpi4: Move to a board package and normal aarch64 build
2026-07-24 09:43:02 +02:00 · 2025-07-12 11:23:12 +02:00 · 2025-07-11 17:06:39 +02:00 · 2025-07-11 17:06:38 +02:00 · 2025-07-11 17:06:37 +02:00 · 2025-07-11 17:06:36 +02:00
153 changed files with 3513 additions and 2267 deletions
@@ -1,30 +1,51 @@
-name: Bob the Builder
+name: Build

 on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches:
-      - main
  workflow_dispatch:
    inputs:
-      minimal:
-        description: 'Build minimal defconfigs'
+      flavor:
+        description: 'Optional build flavor (e.g. _minimal)'
        required: false
-        default: true
-        type: boolean
-      parallell:
+        default: ''
+        type: string
+      parallel:
        description: 'Massive parallel build of each image'
        required: false
        default: true
        type: boolean
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        required: false
+        default: kernelkit/infix
+        type: string
+
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      flavor:
+        required: false
+        type: string
+        default: ''
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+
+env:
+  FLV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.flavor || inputs.flavor }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+
 jobs:
  build:
-    name: Build Infix ${{ matrix.target }}
+    name: Build ${{ inputs.name }} ${{ inputs.target }}
    runs-on: [ self-hosted, latest ]
    strategy:
-      matrix:
-        target: [aarch64, x86_64]
      fail-fast: false
    outputs:
      build_id: ${{ steps.vars.outputs.INFIX_BUILD_ID }}
@@ -36,8 +57,11 @@ jobs:
          rm -rf ./.??* || true
          ls -la ./

-      - uses: actions/checkout@v4
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
        with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ github.ref }}
          clean: true
          fetch-depth: 0
          submodules: recursive
@@ -55,26 +79,13 @@ jobs:
                  "${{ github.event.number }}" "${{ github.event.pull_request.head.sha }}" \
                  | tee -a $GITHUB_OUTPUT $GITHUB_ENV
          fi
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-              if [ "${{ github.event.inputs.minimal }}" == "true" ]; then
-                  flavor="_minimal"
-              fi
-          else
-              # Ensure 'release' job get the proper image when building main
-              if [ "$GITHUB_REF_NAME" != "main" ]; then
-                  flavor="_minimal"
-              else
-                  flavor=""
-              fi
-              if ${{ contains(github.event.pull_request.labels.*.name, 'ci:main') }}; then
-                  flavor=""
-              fi
-          fi
-          target=${{ matrix.target }}
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-          echo "flv=$flavor"              >> $GITHUB_OUTPUT
-          echo "Building target ${target}${flavor}_defconfig"
+
+          target=${{ inputs.target }}
+          name=${{ inputs.name }}
+          echo "dir=${name}-${target}"        >> $GITHUB_OUTPUT
+          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
+          echo "flv=$FLV"              >> $GITHUB_OUTPUT
+          echo "Building target ${target}${FLV}_defconfig"

      - name: Restore Cache of dl/
        uses: actions/cache@v4
@@ -88,16 +99,16 @@ jobs:
        uses: actions/cache@v4
        with:
          path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ inputs.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
          restore-keys: |
-            ccache-${{ matrix.target }}-
+            ccache-${{ inputs.target }}-
            ccache-

-      - name: Configure ${{ matrix.target }}${{ steps.vars.outputs.flv }}
+      - name: Configure ${{ inputs.target }}${{ steps.vars.outputs.flv }}
        run: |
-          make ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig
+          make ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig

-      - name: Unit Test ${{ matrix.target }}
+      - name: Unit Test ${{ inputs.target }}
        run: |
          make test-unit

@@ -115,9 +126,9 @@ jobs:
          fi
          echo "MAKE=$MAKE" >> $GITHUB_OUTPUT

-      - name: Build ${{ matrix.target }}${{ steps.vars.outputs.flv }}
+      - name: Build ${{ inputs.target }}${{ steps.vars.outputs.flv }}
        run: |
-          echo "Building ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
+          echo "Building ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
          eval "${{ steps.parallel.outputs.MAKE }}"

      - name:  Check SBOM from Build
@@ -139,7 +150,7 @@ jobs:
          printf "Size of output/images/: "
          ls -l output/images/

-      - name: Prepare ${{ matrix.target }} Artifact
+      - name: Prepare ${{ inputs.target }} Artifact
        run: |
          cd output/
          mv images ${{ steps.vars.outputs.dir }}
@@ -149,111 +160,4 @@ jobs:
      - uses: actions/upload-artifact@v4
        with:
          path: output/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ matrix.target }}
-
-  test:
-    name: Regression Test of Infix x86_64
-    needs: build
-    runs-on: [ self-hosted, regression ]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          clean: true
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
-              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
-                   >>$GITHUB_ENV
-          fi
-
-          if [ "$GITHUB_REF_NAME" != "main" ]; then
-              flavor="_minimal"
-          else
-              flavor=""
-          fi
-          echo "flv=$flavor"              >> $GITHUB_OUTPUT
-
-      - name: Configure x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          make x86_64${{ steps.vars.outputs.flv }}_defconfig
-
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
-        run: |
-          ls -l
-          mkdir -p output
-          mv infix-x86_64.tar.gz output/
-          cd output/
-          tar xf infix-x86_64.tar.gz
-          ln -s infix-x86_64 images
-
-      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          make test
-
-      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: cat test/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: |
-          asciidoctor-pdf \
-          --theme test/9pm/report/theme.yml \
-          -a pdf-fontsdir=test/9pm/report/fonts \
-          test/.log/last/report.adoc \
-          -o test/.log/last/report.pdf
-
-      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-report
-          path: test/.log/last/report.pdf
-
-  release:
-    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
-    name: Upload Latest Build
-    needs: test
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
-      - uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Latest Build Complete! :rocket:
-
-          For the public download links of these build artifacts, please see:
-           <https://github.com/kernelkit/infix/releases/tag/latest>
-          EOF
+          name: artifact-${{ inputs.target }}
@@ -0,0 +1,43 @@
+name: Publish latest Infix
+
+on:
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  publish:
+    name: Upload Latest Build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          omitName: true
+          omitBody: true
+          omitBodyDuringUpdate: true
+          prerelease: true
+          tag: "latest"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          artifacts: "*.tar.gz*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Latest Build Complete! :rocket:
+
+          For the public download links of these build artifacts, please see:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+          EOF
@@ -0,0 +1,116 @@
+name: Test Infix
+
+on:
+  workflow_dispatch:
+    inputs:
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        required: false
+        default: kernelkit/infix
+        type: string
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      flavor:
+        required: false
+        type: string
+        default: ''
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+      ninepm-conf:
+        required: false
+        type: string
+        default: ''
+      test-path:
+        required: false
+        type: string
+        default: 'test'
+
+env:
+  FLV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.flavor || inputs.flavor }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
+  TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}
+
+jobs:
+  test:
+    name: Regression Test ${{ inputs.name }} ${{ inputs.target }}
+    runs-on: [ self-hosted, regression ]
+    steps:
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ github.ref }}
+          clean: true
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set Build Variables
+        id: vars
+        run: |
+          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
+              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
+                   >>$GITHUB_ENV
+          fi
+
+          echo "flv=$FLV" >> $GITHUB_OUTPUT
+
+      - name: Configure ${{ inputs.target }}${{ steps.vars.outputs.flv }}
+        run: |
+          make ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
+        run: |
+          target=${{ inputs.target }}
+          name=${{ inputs.name }}
+
+          ls -l
+          mkdir -p output
+          mv ${name}-${target}.tar.gz output/
+          cd output/
+          tar xf ${name}-${target}.tar.gz
+          ln -s ${name}-${target} images
+
+      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          if [ -n "$NINEPM_CONF" ]; then
+            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
+            echo "DEBUG: NINEPM_PROJ_CONFIG is '$NINEPM_PROJ_CONFIG'"
+          fi
+          make test
+
+      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+
+      - name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: |
+          asciidoctor-pdf \
+          --theme $TEST_PATH/9pm/report/theme.yml \
+          -a pdf-fontsdir=$TEST_PATH/9pm/report/fonts \
+          $TEST_PATH/.log/last/report.adoc \
+          -o $TEST_PATH/.log/last/report.pdf
+
+      - name: Upload Test Report as Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-report
+          path: ${{ env.TEST_PATH }}/.log/last/report.pdf
+
@@ -0,0 +1,37 @@
+name: Self Trigger
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches:
+      - main
+      - ci-workflow-redesign
+  workflow_dispatch:
+
+jobs:
+  build-x86_64:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: "x86_64"
+      name: "infix"
+      flavor: "_minimal"
+
+  build-aarch64:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: "aarch64"
+      name: "infix"
+      flavor: "_minimal"
+
+  test-run-x86_64:
+    needs: build-x86_64
+    uses: ./.github/workflows/test.yml
+    with:
+      target: "x86_64"
+      name: "infix"
+
+  test-publish-x86_64:
+    needs: test-run-x86_64
+    uses: ./.github/workflows/publish.yml
+
@@ -65,7 +65,7 @@ config INFIX_COMPATIBLE

 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix -- a Network Operating System"
+	default "Infix OS — Immutable.Friendly.Secure"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.
@@ -2,11 +2,11 @@

 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>

-Infix is a free, Linux based, immutable Network Operating System (NOS)
-built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
-porting to different platforms, simplify long-term maintenance, and
-provide made-easy management using NETCONF, RESTCONF[^2], or the
-built-in command line interface (CLI) from a console or SSH login.
+Infix is a free, Linux-based, immutable operating system built around
+[Buildroot][1] and [sysrepo][2].  A powerful mix that ease porting to
+different platforms, simplify long-term maintenance, and provide
+made-easy management using NETCONF, RESTCONF[^2], or the built-in
+command line interface (CLI) from a console or SSH login.

 > Click the **▶ Example CLI Session** foldout below for an example, or
 > head on over to the [Infix Documentation](doc/README.md) for more
@@ -27,13 +27,15 @@ it maintenance-free.  Configuration and data, e.g, containers, is stored
 on separate partitions to ensure complete separation from system files
 and allow for seamless backup, restore, and provisioning.

-In itself, Infix is perfectly suited for dedicated networking tasks, and
-with native support for Docker containers, the operating system provides
-a versatile platform that can easily be adapted to any customer need.
-Be it legacy applications, network protocols, process monitoring, or
-edge data analysis, it can run close to end equipment.  Either directly
-connected on dedicated Ethernet ports or indirectly using virtual
-network cables to exist on the same LAN as other connected equipment.
+In itself, Infix is perfectly suited for dedicated networking tasks,
+such as routing, switching, and monitoring.  This is how it started, as
+a network focused operating system.  Now, with native support for Docker
+containers, it provides a versatile platform that can easily be adapted
+to any customer need.  Be it legacy applications, network protocols,
+process monitoring, or edge data analysis, it can run close to end
+equipment.  Either directly connected on dedicated Ethernet ports or
+indirectly using virtual network cables to exist on the same LAN as
+other connected equipment.

 The simple design of Infix provides complete control over both system
 and data, minimal cognitive burden, and makes it incredibly easy to get
@@ -1,14 +0,0 @@
--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts	2025-04-28 00:13:06.880003668 +0200
-+++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts	2025-04-28 00:14:17.708941263 +0200
-@@ -14,6 +14,11 @@
- 	chosen {
- 		/* 8250 auxiliary UART instead of pl011 */
- 		stdout-path = "serial1:115200n8";
-+
-+		infix {
-+			/* Default admin user password: 'admin' */
-+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
-+		};
- 	};
- 
- 	cam1_reg: regulator-cam1 {
@@ -1,16 +0,0 @@
-default rpi4b
-menu title Boot Menu
-prompt 1
-timeout 30
-
-label rpi4b
-        menu label Infix on Raspberry Pi 4B
-	kernel /boot/Image
-	devicetree /boot/broadcom/bcm2711-rpi-4-b.dtb
-	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}
-
-label rpi400
-	menu label Infix on Raspberry Pi 400
-	kernel /boot/Image
-	devicetree /boot/broadcom/bcm2711-rpi-400.dtb
-	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}
@@ -1,6 +0,0 @@
-# Broadcom BCM2835 Watchdog timer
-device /dev/watchdog0 {
-    timeout    = 60
-    interval   = 5
-    safe-exit  = true
-}
@@ -45,11 +45,11 @@ The default credentials for the demo builds is
    login: admin
    password: admin

-    Infix -- a Network Operating System v24.09.0-rc1 (hvc0)
+    Infix OS — Immutable.Friendly.Secure v24.09.0-rc1 (hvc0)
    infix-00-00-00 login: admin
    Password: 
    .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
    |-. v .-| https://kernelkit.org
    '-'---'-'

@@ -122,9 +122,9 @@ There's a lot of tutorials and guides online, start here:
 About
 -----

-Infix is a free, Linux based, immutable Network Operating System (NOS)
-built on Buildroot, and sysrepo.  A powerful mix that ease porting to
-different platforms, simplify long-term maintenance, and provide easy
-management using NETCONF, RESTCONF, or the built-in command line
-interface (CLI) from a console or SSH login.
+Infix is a free, Linux-based, immutable operating system built around
+Buildroot, and sysrepo.  A powerful mix that ease porting to different
+platforms, simplify long-term maintenance, and provide easy management
+using NETCONF, RESTCONF, or the built-in command line interface (CLI)
+from a console or SSH login.

@@ -114,6 +114,12 @@ grep -qsE '^/bin/true$$' "$TARGET_DIR/etc/shells" \
 grep -qsE '^/bin/false$$' "$TARGET_DIR/etc/shells" \
        || echo "/bin/false" >> "$TARGET_DIR/etc/shells"

+boards=$(${BR2_EXTERNAL_INFIX_PATH}/board/common/selected-boards.sh ${BR2_EXTERNAL_INFIX_PATH} ${O})
+
+for board in $boards; do
+	[ ! -f "${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh" ] && continue
+	${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh
+done
 # Allow clish (symlink to /usr/bin/klish) to be a login shell
 grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
        || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"
@@ -108,3 +108,11 @@ rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"

 # Quick intro for beginners, with links to more information
 cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"
+
+boards=$(${BR2_EXTERNAL_INFIX_PATH}/board/common/selected-boards.sh ${BR2_EXTERNAL_INFIX_PATH} ${O})
+for board in $boards; do
+	[ ! -f "${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-image.sh" ] && continue
+	RELEASE=$(ver)
+	export INFIX_ID RELEASE
+	${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-image.sh
+done
@@ -78,7 +78,7 @@ config QEMU_MACHINE

 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
-	default "384M"
+	default "448M"
 	help
 	  The default, 384 MiB, works for most configurations.  However,
 	  if you get kernel panic with: "System is deadlocked on memory",
@@ -0,0 +1,5 @@
+service name:wpa_supplicant :%i \
+			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+			       -- WPA supplicant @%i
+
+task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i
@@ -1,4 +1,4 @@
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'
@@ -0,0 +1 @@
+SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"
@@ -0,0 +1,165 @@
+# /etc/watchdogd.conf sample
+# Commented out values are program defaults.
+#
+# The checker/monitor `warning` and `critical` levels are 0.00-1.00,
+# i.e. 0-100%, except for load average which can vary a lot between
+# systems and use-cases, not just because of the number of CPU cores.
+# Use the `script = ...` setting to call script when `warning` and
+# `critical` are reached for a monitor.  In `critical` the monitor
+# otherwise triggers an unconditional reboot.
+#
+# NOTE: `critical` is optional, omitting it disables the reboot action.
+#
+
+### Watchdogs ##########################################################
+# Global settings that can be overridden per watchdog
+
+# Do not set WDT timeout and kick interval too low, the daemon runs at
+# SCHED_OTHER level with all other tasks, unless the process supervisor
+# is enabled.  The monitor plugins (below) need CPU time as well.
+#timeout   = 20
+#interval  = 10
+
+# With safe-exit enabled (true) the daemon will ask the driver disable
+# the WDT before exiting (SIGINT).  However, some WDT drivers (or HW)
+# may not support this.
+#safe-exit = true
+
+# Multiple watchdogs can be kicked, the default, even if no .conf file
+# is found or device node given on the command line, is /dev/watchdog
+device /dev/watchdog {
+    timeout    = 60
+    interval   = 5
+    safe-exit  = true
+}
+
+#device /dev/watchdog2 {
+#    timeout    = 20
+#    interval   = 10
+#    safe-exit  = true
+#}
+
+### Supervisor #########################################################
+# Instrumented processes can have their main loop supervised.  Processes
+# subscribe to this service using the libwdog API, see the docs for more
+# on this.  When the supervisor is enabled and the priority is set to a
+# value > 0, watchdogd runs as a SCHED_RR process with elevated realtime
+# priority.  When disabled, or the priority is set to zero (0), it runs
+# as a regular SCHED_OTHER process, this is the default.
+#
+# When a supervised process fails to meet its deadline, the daemon will
+# perform an unconditional reset having saved the reset reason.  If a
+# script is provided in this section it will be called instead.  The
+# script is called as:
+#
+#    script.sh supervisor CODE PID LABEL
+#
+# Availabel CODEs for the reset reason are avilable in wdog.h
+#
+#supervisor {
+#    !!!REMEMBER TO ENABLE reset-reason (below) AS WELL!!!
+#    enabled  = true
+#    priority = 98
+#    script = "/path/to/supervisor-script.sh"
+#}
+
+### Reset reason #######################################################
+# The following section controls if/how the reset reason & reset counter
+# is tracked.  By default this is disabled, since not all systems allow
+# writing to disk, e.g. embedded systems using MTD devices with limited
+# number of write cycles.
+#
+# The default file setting is a non-volatile path, according to the FHS.
+# It can be changed to another location, but make sure that location is
+# writable first.
+reset-reason {
+    enabled = true
+    file    = "/var/lib/misc/watchdogd.state"
+}
+
+### Checkers/Monitors ##################################################
+#
+# Script or command to run instead of reboot when a monitor plugin
+# reaches any of its critical or warning level.  Setting this will
+# disable the built-in reboot on critical, it is therefore up to the
+# script to perform reboot, if needed.  The script is called as:
+#
+#    script.sh {filenr, fsmon, loadavg, meminfo} {crit, warn} VALUE
+#
+#script = "/path/to/reboot-action.sh"
+
+# Monitors file descriptor leaks based on /proc/sys/fs/file-nr
+filenr {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 0.9
+    critical = 1.0
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
+# Monitors a file system, blocks and inode usage against watermarks
+# The script is called with fsmon as the first argument and there
+# are two environment variables FSMON_NAME, for the monitored path,
+# and FSMON_TYPE indicating either 'blocks' or 'inodes'.
+#fsmon /var {
+#    enabled = true
+#    interval = 300
+#    logmark  = false
+#    warning  = 0.95
+#    critical = 1.0
+#    script = "/path/to/alt-reboot-action.sh"
+#}
+
+# Monitors load average based on sysinfo() from /proc/loadavg
+# The level is composed from the average of the 1 and 5 min marks.
+loadavg {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 1.0
+    critical = 2.0
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
+# Monitors free RAM based on data from /proc/meminfo
+meminfo {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 0.9
+    critical = 0.95
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
+# Monitor temperature.  The critical value is unset by default, so no
+# action is taken at that watermark (by default).  Both the critical and
+# warning watermarks are relative to the trip/critical/max value from
+# sysfs.  The warning is default 0.9, i.e., 90% of critical.  Use script
+# to to reset the fan controller or poweroff(8) the system.
+#
+# Each temp monitor caches the last 10 values, calculates the mean, and
+# compares that to the warning and critical levels.  Logging is only
+# done every 10 x interval (if enabled).
+#tempmon /sys/class/hwmon/hwmon0/temp1_input {
+#    enabled  = true
+#    interval = 30
+#    warning  = 0.9
+#    critical = 0.95
+#    logmark  = true
+#    script   = "/script/to/log/and/poweroff.sh"
+#}
+
+# Monitor a generic script, executes 'monitor-script' every 'interval'
+# seconds, with a max runtime of 'timeout' seconds.  When the exit code
+# of the monitor script is above the critical level watchdogd either
+# starts the reboot, or calls the alternate 'script' to determin the
+# next cause of action.
+#generic /path/to/monitor-script.sh {
+#    enabled = true
+#    interval = 300
+#    timeout = 60
+#    warning  = 1
+#    critical = 10
+#    script = "/path/to/alt-reboot-action.sh"
+#}
@@ -308,16 +308,52 @@ def probe_qemusystem(out):
    subprocess.run("initctl -nbq cond set qemu".split(), check=False)
    return 0

+def rasberry_pi_4_usb_ports(out):
+    out["usb-ports"] = [
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized_default"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-1/authorized",
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-0:1.0/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized_default"
+        },
+        {
+            "name": "USB3",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/2-0:1.0/authorized"
+        }
+    ]

 def probe_dtsystem(out):
    """Probe DTS based system, expects a VPD in ONIE PROM format."""
    dtsys = DTSystem()
    vpds = dtsys.infix_vpds()
-    dtsys.infix_usb_devices(out)
+
    model = dtsys.base.str("model")
    if model:
        out["product-name"] = model

+    # Since rpi4 has USB on PCIe, there is no phandle reference
+    if model and model.startswith("Raspberry Pi 4"):
+        rasberry_pi_4_usb_ports(out)
+    else:
+        dtsys.infix_usb_devices(out)
    out["compatible"] = dtsys.base.str_array("compatible")

    staticpw = dtsys.infix.str("factory-password-hash")
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+if [ $# -ne 1 ]; then
+	echo "usage: $0 <ifname>"
+	exit 1
+fi
+ifname=$1
+
+TIMEOUT=300
+status=$(wpa_cli -i $ifname scan)
+while [ "$status" != "OK" ]; do
+	status=$(wpa_cli -i $ifname scan)
+	TIMEOUT=$((TIMEOUT-1))
+	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
+	sleep 0.5
+done
@@ -0,0 +1,61 @@
+#!/bin/bash
+#
+# Check if an infix board is selected
+
+if [ $# -ne 2 ]; then
+	echo "usage: $0 <INFIX-DIR> <OUTPUT>"
+	exit 1
+fi
+ROOT=$1
+O=$2
+BOARD_SRC_DIR="${ROOT}/src/board"
+BOARD_PACKAGE_DIR="${ROOT}/package/board"
+CONFIG_FILE="${O}/.config"
+
+is_board_enabled() {
+    local symbol=$1
+
+    if [ -f "$CONFIG_FILE" ]; then
+        if grep -q "^${symbol}=y" "$CONFIG_FILE" 2>/dev/null; then
+            return 0  # enabled
+        else
+            return 1  # disabled or not set
+        fi
+    else
+        echo "Warning: No .config file found. Run 'make menuconfig' first."
+        return 1
+    fi
+}
+
+get_actual_config_symbol() {
+    local board_name=$1
+    local config_file="${BOARD_PACKAGE_DIR}/$board_name/Config.in"
+
+    if [ -f "$config_file" ]; then
+        # Extract the first config symbol from the Config.in file
+        local symbol=$(grep -m1 "^config " "$config_file" 2>/dev/null | awk '{print $2}')
+        if [ -n "$symbol" ]; then
+            echo "$symbol"
+            return 0
+        fi
+    fi
+
+    # Fallback to predicted symbol if no Config.in found
+    echo "BR2_PACKAGE_BOARD_$(echo "$board_name" | tr '[:lower:]' '[:upper:]' | tr '-' '_')"
+    return 1
+}
+
+boards=""
+
+for board_path in "$BOARD_SRC_DIR"/*; do
+    if [ -d "$board_path" ]; then
+        board_name=$(basename "$board_path")
+        config_symbol=$(get_actual_config_symbol "$board_name")
+
+        if is_board_enabled "$config_symbol"; then
+	    boards="$boards $board_name"
+        fi
+    fi
+done
+
+echo "$boards"
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -126,7 +126,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -134,6 +134,7 @@ BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
+BR2_PACKAGE_RASPBERRY_PI_4=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
@@ -165,6 +166,8 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -108,7 +108,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -29,7 +29,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
@@ -170,7 +170,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-r2s"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -162,7 +162,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -1,201 +0,0 @@
-BR2_aarch64=y
-BR2_cortex_a72=y
-BR2_ARM_FPU_VFPV4=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
-BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
-BR2_GLOBAL_PATCH_DIR="board/raspberrypi/patches ${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_TARGET_GENERIC_HOSTNAME="infix"
-BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
-BR2_INIT_FINIT=y
-BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
-BR2_SYSTEM_BIN_SH_BASH=y
-BR2_TARGET_GENERIC_GETTY_PORT="@console"
-BR2_TARGET_GENERIC_GETTY_TERM="xterm"
-BR2_SYSTEM_DHCP="eth0"
-BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
-BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
-BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
-BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-image.sh"
-BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
-BR2_LINUX_KERNEL_PATCH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711-rpi-4-b-dts.patch"
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711_defconfig"
-BR2_LINUX_KERNEL_DTS_SUPPORT=y
-BR2_LINUX_KERNEL_INTREE_DTS_NAME="broadcom/bcm2711-rpi-4-b broadcom/bcm2711-rpi-400"
-BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
-BR2_LINUX_KERNEL_INSTALL_TARGET=y
-BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
-BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
-BR2_PACKAGE_XZ=y
-BR2_PACKAGE_STRACE=y
-BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_JQ=y
-BR2_PACKAGE_E2FSPROGS=y
-BR2_PACKAGE_ARMBIAN_FIRMWARE=y
-BR2_PACKAGE_ARMBIAN_FIRMWARE_AP6255=y
-BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI=y
-BR2_PACKAGE_LINUX_FIRMWARE=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XXX=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366B1=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366C0=y
-BR2_PACKAGE_RPI_FIRMWARE=y
-BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4=y
-BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4_X=y
-BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/config.txt"
-BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/cmdline.txt"
-BR2_PACKAGE_DBUS_CXX=y
-BR2_PACKAGE_DBUS_GLIB=y
-BR2_PACKAGE_DBUS_TRIGGERD=y
-BR2_PACKAGE_EUDEV_RULES_GEN=y
-# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
-BR2_PACKAGE_EVEMU=y
-BR2_PACKAGE_EVTEST=y
-BR2_PACKAGE_GPTFDISK=y
-BR2_PACKAGE_GPTFDISK_SGDISK=y
-BR2_PACKAGE_INPUT_EVENT_DAEMON=y
-BR2_PACKAGE_MDIO_TOOLS=y
-BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
-BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
-BR2_PACKAGE_LIBSSH_OPENSSL=y
-BR2_PACKAGE_LIBSSH2=y
-BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBOPENSSL_BIN=y
-BR2_PACKAGE_LIBINPUT=y
-BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_NETOPEER2_CLI=y
-BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_LINUX_PAM=y
-BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
-BR2_PACKAGE_ONIGURUMA=y
-BR2_PACKAGE_AVAHI_DAEMON=y
-BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
-BR2_PACKAGE_CHRONY=y
-BR2_PACKAGE_CONNTRACK_TOOLS=y
-BR2_PACKAGE_DNSMASQ=y
-BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FRR=y
-BR2_PACKAGE_HOSTAPD=y
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPROUTE2=y
-BR2_PACKAGE_IPTABLES_NFTABLES=y
-BR2_PACKAGE_IPUTILS=y
-BR2_PACKAGE_IW=y
-BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_MSTPD=y
-BR2_PACKAGE_NETCALC=y
-BR2_PACKAGE_NETCAT_OPENBSD=y
-BR2_PACKAGE_NETSNMP=y
-BR2_PACKAGE_NFTABLES=y
-BR2_PACKAGE_NGINX=y
-BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_NMAP=y
-BR2_PACKAGE_NMAP_NCAT=y
-BR2_PACKAGE_NMAP_NMAP=y
-BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_OPENRESOLV=y
-BR2_PACKAGE_OPENSSH=y
-BR2_PACKAGE_SOCAT=y
-BR2_PACKAGE_TCPDUMP=y
-BR2_PACKAGE_TRACEROUTE=y
-BR2_PACKAGE_ULOGD=y
-BR2_PACKAGE_WHOIS=y
-BR2_PACKAGE_WIRELESS_REGDB=y
-BR2_PACKAGE_WIRELESS_TOOLS=y
-BR2_PACKAGE_WPA_SUPPLICANT=y
-BR2_PACKAGE_BASH_COMPLETION=y
-BR2_PACKAGE_SUDO=y
-BR2_PACKAGE_TTYD=y
-BR2_PACKAGE_GETENT=y
-BR2_PACKAGE_HTOP=y
-BR2_PACKAGE_IRQBALANCE=y
-BR2_PACKAGE_KMOD_TOOLS=y
-BR2_PACKAGE_PWGEN=y
-BR2_PACKAGE_RAUC=y
-BR2_PACKAGE_RAUC_DBUS=y
-BR2_PACKAGE_RAUC_GPT=y
-BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_JSON=y
-BR2_PACKAGE_SYSKLOGD=y
-BR2_PACKAGE_SYSKLOGD_LOGGER=y
-BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_LESS=y
-BR2_PACKAGE_MG=y
-BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_arm64"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/extras.config"
-BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
-BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
-BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/rpi-env.dtso"
-BR2_PACKAGE_HOST_DOSFSTOOLS=y
-BR2_PACKAGE_HOST_E2FSPROGS=y
-BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
-BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_KMOD_XZ=y
-BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_IMAGE_ID="${INFIX_ID}-rpi4"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
-BR2_PACKAGE_CONFD=y
-BR2_PACKAGE_GENCERT=y
-BR2_PACKAGE_STATD=y
-BR2_PACKAGE_FACTORY=y
-BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
-BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
-BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
-BR2_PACKAGE_FINIT_PLUGIN_RTC=y
-BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
-BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
-BR2_PACKAGE_FINIT_PLUGIN_TTY=y
-BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_IITO=y
-BR2_PACKAGE_KEYACK=y
-BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
-BR2_PACKAGE_LOWDOWN=y
-BR2_PACKAGE_MCD=y
-BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_NETBROWSE=y
-BR2_PACKAGE_PODMAN=y
-BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
-BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
-BR2_PACKAGE_PODMAN_DRIVER_VFS=y
-BR2_PACKAGE_SHOW=y
-BR2_PACKAGE_TETRIS=y
-BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
-SDCARD_AUX=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -132,7 +132,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -167,6 +167,8 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -115,7 +115,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -3,6 +3,40 @@ Change Log

 All notable changes to the project are documented in this file.

+[v25.07.0][UNRELEASED] -
+-------------------------
+
+### Changes
+- Raspberry Pi 4 is now a part of the aarch64 image, as well as a SDcard
+  image for initial deployments.
+
+
+### Fixes
+[v25.06.0][] - 2025-07-01
+-------------------------
+
+### Changes
+- Upgrade Buildroot to 2025.02.4 (LTS)
+- Upgrade Linux kernel to 6.12.35 (LTS)
+- Upgrade curiOS built-in containers to v25.06.0
+- Add support for setting mode of a container content mount, issue #1070
+- Add Wi-Fi client support and add support for some USB-Wi-Fi cards
+- New slogan: Infix OS — Immutable.Friendly.Secure
+
+### Fixes
+- cli: fix by-word movement, detect word barrier using non-alphanum chars
+- cli: fix delete word left/right, make sure to save word in kill buffer
+
+
+[v25.05.1][] - 2025-06-12
+-------------------------
+
+### Changes
+- Upgrade Linux kernel to 6.12.32 (LTS)
+
+### Fixes
+- Fix #1060: Restore of missing CLI commands, regression in Infix v25.05.0
+
 [v25.05.0][] - 2025-05-27
 -------------------------

@@ -1569,7 +1603,9 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.05.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.06.1...HEAD
+[v25.06.0]:   https://github.com/kernelkit/infix/compare/v25.05.1...v26.06.0
+[v25.05.1]:   https://github.com/kernelkit/infix/compare/v25.05.0...v25.05.1
 [v25.05.0]:   https://github.com/kernelkit/infix/compare/v25.04.0...v25.05.0
 [v25.04.0]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
 [v25.03.0]:   https://github.com/kernelkit/infix/compare/v25.02.0...v25.03.0
@@ -1,7 +1,7 @@
 <img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>

-Welcome to Infix, your friendly Network Operating System!  On these
-pages you can find both user and developer documentation.
+Welcome to Infix, your immutable, friendly, and secure operating system!
+On these pages you can find both user and developer documentation.

 Most topics on configuring the system include CLI examples, but every
 setting, as well as status read-back from the operational datastore, is
@@ -214,7 +214,7 @@ text file without line breaks (`-w0`):
 ```bash
 $ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" |base64 -d
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.github.io
 '-'---'-'
 ```
@@ -67,7 +67,8 @@ $ sudo apt install bc binutils build-essential bzip2 cpio \
                   diffutils file findutils git gzip      \
                   libncurses-dev libssl-dev perl patch   \
                   python3 rsync sed tar unzip wget       \
-                   autopoint bison flex autoconf automake
+                   autopoint bison flex autoconf automake \
+                   mtools
 ```

 > For details, see the Getting Started and System Requirements sections
@@ -168,36 +169,36 @@ Now you can rebuild `confd`, just as described above, and restart Infix:

 ### `statd`

-The Infix status daemon, `src/statd`, is responsible for populating the 
-sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions, 
-but unlike `confd`, it relies entirely on `yanger`, a Python script that 
+The Infix status daemon, `src/statd`, is responsible for populating the
+sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions,
+but unlike `confd`, it relies entirely on `yanger`, a Python script that
 gathers data from local linux services and feeds it into sysrepo.

 To apply changes, rebuild the image:

    make python-statd-rebuild statd-rebuild all

-Rebuilding the image and testing on target for every change during 
-development process can be tedious. Instead, `yanger` allows remote 
-execution, running the script directly on the host system (test 
+Rebuilding the image and testing on target for every change during
+development process can be tedious. Instead, `yanger` allows remote
+execution, running the script directly on the host system (test
 container):

    infamy0:test # ../src/statd/python/yanger/yanger -x "../utils/ixll -A ssh d3a" ieee802-dot1ab-lldp

 `ixll` is a utility script that lets you run network commands using an
-**interface name** instead of a hostname. It makes operations like 
+**interface name** instead of a hostname. It makes operations like
 `ssh`, `scp`, and network discovery easier.

-Normally, `yanger` runs commands **locally** to retrieve data 
-(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when 
-executed with `-x "../utils/ixll -A ssh d3a"` it redirects these 
-commands to a remote system connected to the local `d3a` interface via 
-SSH. This setup is used for running `yanger` in an 
+Normally, `yanger` runs commands **locally** to retrieve data
+(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when
+executed with `-x "../utils/ixll -A ssh d3a"` it redirects these
+commands to a remote system connected to the local `d3a` interface via
+SSH. This setup is used for running `yanger` in an
 [interactive test environment](testing.md#interactive-usage). The yanger
-script runs on the `host` system, but key commands are executed on the 
+script runs on the `host` system, but key commands are executed on the
 `target` system.

-For debugging or testing, you can capture system command output and 
+For debugging or testing, you can capture system command output and
 replay it later without needing a live system.

 To capture:
@@ -211,12 +212,173 @@ To replay:
 This is especially useful when working in isolated environments or debugging
 issues without direct access to the DUT.

+### Upgrading Packages
+
+#### Buildroot
+
+Kernelkit maintains an internal [fork of
+Buildroot](https://github.com/kernelkit/buildroot), with branches
+following the naming scheme `YYYY.MM.patch-kkit`
+e.g. `2025.02.1-kkit`, which means a new branch should be created
+whenever Buildroot is updated. These branches should contain **only**
+changes to existing packages (but no new patches), modifications to
+Buildroot itself or upstream backports.
+
+KernelKit track the latest Buildroot LTS (Long-Term Support) release
+and updates. The upgrade of LTS minor releases is expected to have low
+impact and should be done as soon there is a patch release of
+Buildroot LTS is available.
+
+> **Depending on your setup, follow the appropriate steps below.**
+
+🔁 If you **already have** the Buildroot repo locally
+
+1. Navigate to the Buildroot directory
+   ```bash
+    $ cd buildroot
+   ```
+2. Pull the latest changes from KernelKit
+   ```bash
+   $ git pull
+   ```
+3. Fetch the latest tags from upstream
+   ```bash
+   $ git fetch upstream --tags
+   ```
+
+
+🆕 If you don't have the repo locally
+
+1. Clone the Kernelkit Buildroot repository
+   ```bash
+   $ git clone git@github.com:kernelkit/buildroot.git
+   ```
+
+2. Add the upstream remote
+   ```bash
+   $ git remote add upstream https://gitlab.com/buildroot.org/buildroot.git
+   ```
+3. Checkout old KernelKit branch
+   ```bash
+   $ git checkout 2025.02.1-kkit
+   ```
+
+
+🛠  Continue from here (applies to both cases):
+
+4. Create a new branch based on the **previous** KernelKit Buildroot
+   release (e.g.  `2025.02.1-kkit`) and name it according to the naming scheme (e.g. `2025.02.2-kkit`)
+   ```bash
+   $ git checkout -b 2025.02.2-kkit
+   ```
+5. Rebase the new branch onto the corresponding upstream release
+   ```bash
+   $ git rebase 2025.02.2
+   ```
+> [!NOTE] It is **not** allowed to rebase the branch when bumped in Infix.
+
+6. Push the new branch and tags
+   ```bash
+   $ git push origin 2025.02.2-kkit --tags
+   ```
+7. In Infix, checkout new branch of Buildroot
+   ```bash
+   $ cd buildroot
+   $ git fetch
+   $ git checkout 2025.02.2-kkit
+   ```
+8. Push changes
+Commit and push the changes. Don’t forget to update the changelog.
+
+9. Create a pull request.
+
+> [!NOTE] Remember to set the pull request label to `ci:main` to ensure full CI coverage.
+
+
+#### Linux kernel
+
+KernelKit maintains an internal [fork of Linux
+kernel](https://github.com/kernelkit/linux), with branches following
+the naming scheme `kkit-linux-[version].y`, e.g. `kkit-6.12.y`, which
+means a new branch should be created whenever the major kernel version
+is updated. This branch should contain *all* kernel patches used by
+Infix.
+
+KernelKit track the latest Linux kernel LTS (Long-Term Support)
+release and updates. The upgrade of LTS minor releases is expected to
+have low impact and should be done as soon as a patch release of the
+LTS Linux kernel is available.
+
+
+🔁 If you **already have** the Linux kernel repo locally
+
+1. Navigate to the Linux kernel directory
+   ```bash
+   $ cd linux
+   ```
+2. Get latest changes from KernelKit
+   ```bash
+   $ git pull
+   ```
+3. Fetch the latest tags from upstream
+   ```bash
+   $ git fetch upstream --tags
+   ```
+
+🆕 If you don't have the repo locally
+
+1. Clone the KernelKit Linux kernel repository
+   ```bash
+   $ git clone git@github.com:kernelkit/linux.git
+	```
+2. Add the upstream remote
+   ```bash
+   $ git remote add upstream git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+   ```
+
+3. Checkout correct kernel branch
+   ```bash
+   $ git checkout kkit-linux-6.12.y
+   ```
+
+🛠  Continue from here (applies to both cases)
+
+
+4. Rebase on the upstream release
+   ```bash
+   $ git rebase v6.12.29
+   ```
+
+6. Push changes and the tags
+   ```bash
+
+   $ git push -f origin kkit-linux-6.12.y --tags
+   ```
+
+**Move to your infix directory**
+
+7. Generate patches
+   ```bash
+   $ make x86_64_defconfig
+   $ cd output
+   $ ../utils/kernel-refresh.sh -k /path/to/linux -o 6.12.28 -t v6.12.29
+   ```
+   > [!NOTE] See help of `kernel-refresh.sh` script for more information
+
+
+8. Push changes
+   Commit and push the changes. Don’t forget to update the s:changelog:doc/ChangeLog.md.
+
+9. Create a pull request.
+   > [!NOTE] Remember to set the pull request label to `ci:main` to ensure full CI coverage.
+
+
 ### Agree on YANG Model

 When making changes to the `confd` and `statd` services, you will often need to update
-the YANG models. If you are adding a new YANG module, it's best to follow the 
+the YANG models. If you are adding a new YANG module, it's best to follow the
 structure of an existing one. However, before making any changes, **always discuss
-them with the Infix core team**. This helps avoid issues later in development and 
+them with the Infix core team**. This helps avoid issues later in development and
 makes pull request reviews smoother.


@@ -294,7 +294,7 @@ rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
 linux-pc:# ssh admin@infix-c0-ff-ee.local
 (admin@infix-c0-ff-ee.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-

@@ -334,7 +334,7 @@ rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
 linux-pc:# ssh admin@infix.local
 (admin@infix.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-

@@ -79,11 +79,11 @@ typically setup to run at 115200 baud, 8N1.


 ```
-Infix -- a Network Operating System v24.11.1 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v24.11.1 (ttyS0)
 example login: admin
 Password:
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -92,7 +92,7 @@ Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
 Warning: Permanently added 'fe80::ff:fe00:0%eth0' (ED25519) to the list of known hosts.
 admin@fe80::ff:fe00:0%eth0's password: *****
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -1263,7 +1263,7 @@ It should now be possible to access the switch from the PC via SSH (or NETCONF).
 ~ $ ssh admin@fe80::0053:00ff:fe06:1101%eth1
 admin@fe80::0053:00ff:fe06:1101%eth1's password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -427,11 +427,11 @@ admin@example:/> reboot
 [ OK ] Update DNS configuration
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.03.1 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.03.1 (ttyS0)
 example login: admin
 Password:
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -638,7 +638,7 @@ admin@example:/> reboot
 [ OK ] Verifying self-signed https certificate
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
 example login:
 ```
 > [!NOTE]
@@ -695,7 +695,7 @@ admin@example:/> reboot
 [ OK ] Verifying self-signed https certificate
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)

 ERROR: Corrupt startup-config, system has reverted to default login credentials
 failed-00-00-00 login:
@@ -738,7 +738,7 @@ Reboot now to perform reset, (y/N)? y

 Please press Enter to activate this console.

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
 example login:
 ```

@@ -123,11 +123,11 @@ there is another helper script in Infamy for this:
    Trying 127.0.0.1...
    Connected to 127.0.0.1.

-    Infix -- a Network Operating System v23.11.0-226-g0c144da (console)
+    Infix OS — Immutable.Friendly.Secure v23.11.0-226-g0c144da (console)
    infix-00-00-00 login: admin
    Password:
    .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
    |-. v .-| https://kernelkit.org
    '-'---'-'

@@ -0,0 +1,152 @@
+# Wi-Fi (Wireless LAN)
+
+Infix includes built-in Wi-Fi client support for connecting to
+wireless networks. When a compatible Wi-Fi adapter is detected, the
+system automatically begins scanning for available networks.
+
+## Current Limitations
+
+- Only client mode is supported (no access point functionality)
+- USB hotplug is not supported - adapters must be present at boot
+- Interface naming may be inconsistent with multiple USB Wi-Fi adapters
+
+## Supported Wi-Fi Adapters
+
+Wi-Fi support is primarily tested with Realtek chipset-based adapters.
+
+### Known Working Chipsets
+
+- RTL8821CU
+- Other Realtek chipsets may work but are not guaranteed
+
+
+> [!NOTE]  Some Realtek chipsets require proprietary drivers not included in the standard kernel
+>          Firmware requirements vary by chipset
+>          Check kernel logs if your adapter is not detected
+
+## Configuration
+
+Add a supported Wi-Fi network device. To verify that it has been
+detected, look for `wifi0` in `show interfaces`
+
+```
+admin@example:/>  show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   DOWN        f0:09:0d:36:5f:86
+                wifi                   ssid: ------, signal: ------
+
+```
+Add the new Wi-Fi interface to the configuration to start scanning.
+```
+admin@example:/config/> set interface wifi0
+admin@example:/config/> leave
+```
+Now the system will now start scanning in the background. To
+see the result read the operational datastore for interface `wifi0` or
+use the CLI
+
+```
+admin@infix-00-00-00:/> show interfaces name wifi0
+name                : wifi0
+type                : wifi
+index               : 3
+mtu                 : 1500
+operational status  : down
+physical address    : f0:09:0d:36:5f:86
+ipv4 addresses      :
+ipv6 addresses      :
+SSID                : ----
+Signal              : ----
+
+SSID                                    ENCRYPTION                    SIGNAL
+ssid1                                   WPA2-Personal                 excellent
+ssid2                                   WPA2-Personal                 excellent
+ssid3                                   WPA2-Personal                 excellent
+ssid4                                   WPA2-Personal                 good
+ssid5                                   WPA2-Personal                 good
+ssid6                                   WPA2-Personal                 good
+```
+
+In the CLI, signal strength is reported as: excellent, good, poor or
+bad. For precise values, use NETCONF or RESTCONF, where the RSSI (in
+dBm) is available in the operational datastore.
+
+Configure your Wi-Fi secret in the keystore, it should be between 8
+and 63 characters
+
+```
+admin@example:/> configure
+admin@example:/config/> edit keystore symmetric-key example
+admin@example:/config/keystore/symmetric-key/example/> set key-format wifi-preshared-key-format
+admin@example:/config/keystore/symmetric-key/example/> set cleartext-key mysecret
+admin@example:/config/keystore/symmetric-key/example/> leave
+admin@example:/>
+```
+
+Configure the Wi-Fi settings, set secret to the name selected above
+for the symmetric key, in this case `example`.
+
+WPA2 or WPA3 encryption will be automatically selected based on what
+the access point supports. No manual selection is required unless
+connecting to an open network. No support for certificate based
+authentication yet.
+
+Unencrypted network is also supported, to connect to an unencrypted
+network (generally not recommended):
+```
+admin@example:/config/interface/wifi0/> set wifi encryption disabled
+```
+
+A valid `country-code` is also required for regulatory compliance, the
+valid codes are documented in the YANG model `infix-wifi-country-codes`
+
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface wifi0
+admin@example:/config/interface/wifi0/>
+admin@example:/config/interface/wifi0/> set wifi ssid ssid1
+admin@example:/config/interface/wifi0/> set wifi secret example
+admin@example:/config/interface/wifi0/> set wifi country-code SE
+admin@example:/config/interface/wifi0/> leave
+```
+
+The Wi-Fi negotiation should now start immediately, provided that the
+SSID and pre-shared key are correct. You can verify the connection by
+running `show interfaces` again.
+
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   UP          f0:09:0d:36:5f:86
+                wifi                   ssid: ssid1, signal: excellent
+
+admin@example:/>
+```
+
+## Troubleshooting Connection Issues
+
+Use `show wifi scan wifi0` and `show interfaces` to verify signal strength
+and connection status. If issues arise, try the following
+troubleshooting steps:
+
+1. **Verify signal strength**: Check that the target network shows "good" or "excellent" signal
+2. **Check credentials**: Verify the preshared key in `ietf-keystore`
+3. **Review logs**: Check system logs with `show log` for Wi-Fi related errors
+4. **Regulatory compliance**: Ensure the country-code matches your location
+5. **Hardware detection**: Confirm the adapter appears in `show interfaces`
+
+If issues persist, check the system log for specific error messages that can help identify the root cause.
@@ -2,6 +2,7 @@ menu "Packages"

 comment "Hardware Support"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/feature-wifi/Config.in"

 comment "Software Packages"
 source "$BR2_EXTERNAL_INFIX_PATH/package/bin/Config.in"
@@ -42,5 +43,4 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rauc-installation-status/Config.in"
-
 endmenu
@@ -6,5 +6,6 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/board/marvell-cn9130-crb/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/marvell-espressobin/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/microchip-sparx5-pcb135/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/styx-dcp-sc-28p/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/board/raspberry-pi-4/Config.in"

 endmenu
@@ -0,0 +1,41 @@
+config BR2_PACKAGE_RASPBERRY_PI_4
+	bool "Raspberry Pi 4"
+	depends on BR2_aarch64
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+
+	select BR2_PACKAGE_RPI_FIRMWARE
+	select BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4
+	select BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4_X
+	select SDCARD_AUX
+	select BR2_TARGET_UBOOT
+	select BR2_TARGET_UBOOT_FORMAT_CUSTOM
+	select BR2_TARGET_UBOOT_NEEDS_DTC
+	select BR2_TARGET_UBOOT_NEEDS_UBOOT_TOOLS
+	select BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG
+	help
+	  Raspberry pi 4
+
+# Don't redefine - just set conditional defaults
+if BR2_PACKAGE_RASPBERRY_PI_4
+
+config BR2_TARGET_UBOOT_BOARD_DEFCONFIG
+	default "rpi_arm64"
+
+config BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/uboot/extras.config"
+
+config BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME
+	default "arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
+
+config BR2_TARGET_UBOOT_CUSTOM_DTS_PATH
+	default "${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/uboot/rpi-env.dtso"
+
+config BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE
+	default "${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/config.txt"
+
+config BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE
+	default "${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/cmdline.txt"
+
+endif
@@ -0,0 +1,46 @@
+define RASPBERRY_PI_4_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_V3D,m)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_VC4,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_VC4_HDMI_CEC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_LOAD_EDID_FIRMWARE)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_FBDEV_EMULATION)
+
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_TOUCHSCREEN)
+	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN,m)
+
+# RPI
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BRCMSTB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_MBOX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_BCM2835)
+	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_I2C_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_IPROC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2711_THERMAL)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_BCM2835AUX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCMGENET)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))
@@ -25,6 +25,11 @@ else
 CONFD_CONF_OPTS += --disable-containers
 endif

+ifeq ($(BR2_PACKAGE_FEATURE_WIFI),y)
+CONFD_CONF_OPTS += --enable-wifi
+else
+CONFD_CONF_OPTS += --disable-wifi
+endif
 define CONFD_INSTALL_EXTRA
 	for fn in confd.conf resolvconf.conf; do \
 		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
@@ -69,6 +74,12 @@ define CONFD_INSTALL_YANG_MODULES_CONTAINERS
 	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/containers.inc
 endef
 endif
+ifeq ($(BR2_PACKAGE_FEATURE_WIFI),y)
+define CONFD_INSTALL_YANG_MODULES_WIFI
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/wifi.inc
+endef
+endif

 # PER_PACKAGE_DIR
 # Since the last package in the dependency chain that runs sysrepoctl is confd, we need to
@@ -97,6 +108,7 @@ CONFD_PRE_BUILD_HOOKS += CONFD_CLEANUP
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_EXTRA
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WIFI
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_IN_ROMFS
 CONFD_TARGET_FINALIZE_HOOKS += CONFD_CLEANUP

@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  3e7f777a054fbc29173bcdafe50ca096a8abf9e556bec9f52617c9881c9ce3e3  curios-httpd-oci-arm64-v24.11.0.tar.gz
-sha256  bfa52f712301427a21b89cfee31ca315e1404973affaf34b23978a70a3ec4f63  curios-httpd-oci-amd64-v24.11.0.tar.gz
+sha256  c4995c0a7a96d5273c97c7c026c03ff5e2a42cade6d66808fdeba0fae9a343d8  curios-httpd-oci-arm64-v25.06.0.tar.gz
+sha256  4d48a03b38eabe558052ecbab7560e6d9f995311eb91b90ddaac336b5f001a5e  curios-httpd-oci-amd64-v25.06.0.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CURIOS_HTTPD_VERSION = v24.11.0
+CURIOS_HTTPD_VERSION = v25.06.0
 CURIOS_HTTPD_SOURCE = curios-httpd-oci-$(GO_GOARCH)-$(CURIOS_HTTPD_VERSION).tar.gz
 CURIOS_HTTPD_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_HTTPD_VERSION)
 CURIOS_HTTPD_LICENSE = GPL
@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  95b3625587738cb0a8cc6e9eb41d10a0b2f77ae99dbb1d9b213148d35268eb75  curios-nftables-oci-arm64-v24.11.0.tar.gz
-sha256  4f61ccef90721b8f95a5c7b77b69ccccb5dbd215b9c38986d20e5b245244e902  curios-nftables-oci-amd64-v24.11.0.tar.gz
+sha256  94c7173fe4b8e64dcb1e0f67b974c23753ccce73bc07212a87e35f41a41ae5b8  curios-nftables-oci-arm64-v25.06.0.tar.gz
+sha256  feceb82327cccb4433db63e469f6ed115c10c0266242f0171b85ae1a88472757  curios-nftables-oci-amd64-v25.06.0.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CURIOS_NFTABLES_VERSION = v24.11.0
+CURIOS_NFTABLES_VERSION = v25.06.0
 CURIOS_NFTABLES_SOURCE = curios-nftables-oci-$(GO_GOARCH)-$(CURIOS_NFTABLES_VERSION).tar.gz
 CURIOS_NFTABLES_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_NFTABLES_VERSION)
 CURIOS_NFTABLES_LICENSE = GPL
@@ -0,0 +1,20 @@
+config BR2_PACKAGE_FEATURE_WIFI
+	bool "Feature Wi-Fi"
+	select BR2_PACKAGE_WPA_SUPPLICANT
+	select BR2_PACKAGE_WPA_SUPPLICANT_WPA3
+	select BR2_PACKAGE_WPA_SUPPLICANT_DEBUG_SYSLOG
+	select BR2_PACKAGE_WPA_SUPPLICANT_AUTOSCAN
+	select BR2_PACKAGE_WPA_SUPPLICANT_CLI
+	select BR2_PACKAGE_WIRELESS_REGDB
+	select BR2_PACKAGE_IW
+	help
+	  Enables WiFi in Infix. Enables all requried applications.
+
+config BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK
+       bool "Realtek USB WiFi Dongles"
+       depends on BR2_PACKAGE_FEATURE_WIFI
+       select BR2_PACKAGE_LINUX_FIRMWARE
+       select BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88
+       select BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW89
+       help
+         Enables Support for RTW88 and RTW89 USB dongles.
@@ -0,0 +1,42 @@
+################################################################################
+#
+# Wi-Fi support
+#
+################################################################################
+
+FEATURE_WIFI_PACKAGE_VERSION = 1.0
+FEATURE_WIFI_PACKAGE_LICENSE = MIT
+
+define FEATURE_WIFI_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_WLAN)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RFKILL)
+	$(call KCONFIG_SET_OPT,CONFIG_MAC80211,m)
+	$(call KCONFIG_SET_OPT,CONFIG_CFG80211,m)
+
+	$(if $(filter y,$(BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK)),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_WLAN_VENDOR_REALTEK)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW89)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8703B)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723CS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723D)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723X)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821C)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822B)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822C)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822CU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822CE)
+	)
+endef
+
+
+$(eval $(generic-package))
@@ -28,7 +28,6 @@ KLISH_PLUGIN_INFIX_CONF_OPTS += --enable-shell
 else
 KLISH_PLUGIN_INFIX_CONF_OPTS += --disable-shell
 endif
-
 ifeq ($(BR2_PACKAGE_BASH),y)
 KLISH_PLUGIN_INFIX_CONF_OPTS += --with-shell=/bin/bash
 else
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  79c9b16b227320fea358114738933ea25be33f8f263d3eec1f83fb603c0c0b22  klish-019ebd2704e322b5d500f5687d526431e535eec8-git4.tar.gz
+sha256  eff4cc740c6cfe2c03f7aeee2092f16616575d1462b1ad67d9f476463a6bf3fe  klish-1c5ae4bbb49a0d7e1425ca1afe8518b873ee84cb-git4.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-KLISH_VERSION = 019ebd2704e322b5d500f5687d526431e535eec8
+KLISH_VERSION = 1c5ae4bbb49a0d7e1425ca1afe8518b873ee84cb
 KLISH_SITE = https://github.com/kernelkit/klish.git
 #KLISH_VERSION = tags/3.0.0
 #KLISH_SITE = https://src.libcode.org/pkun/klish.git
@@ -1,5 +1,5 @@
 # From https://github.com/troglobit/tetris/releases/
-sha256 2c6e17f927d4b73dca97c7d280d3848a515a87ca70ecdf072808561e47bf757c  tetris-1.4.0.tar.gz
+sha256 c19b3e5eea43891d55481de5530f5824131974a85fc2a18b8a977bcebcba8223  tetris-1.5.0.tar.gz

 # Locally calculated
 sha256 a84e2b5247b2013a69496eecdd16e6051c04f1f3cb259b5f6ca8e671101a1f94  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-TETRIS_VERSION = 1.4.0
+TETRIS_VERSION = 1.5.0
 TETRIS_SITE = https://github.com/troglobit/tetris/releases/download/$(TETRIS_VERSION)
 TETRIS_LICENSE = ISC
 TETRIS_LICENSE_FILES = LICENSE
@@ -1,8 +1,9 @@
-From 735a3f8537b65fbe5d2fe5e97beb485cffa1bbbe Mon Sep 17 00:00:00 2001
+From 072c2f0732bc1a55aaeb9b5319a71bb472e2fd7d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 01/27] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
 PPU on 6393X
+Organization: Wires

 In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,
@@ -1,8 +1,9 @@
-From a9cadaebc7868f3f37c343642e631e3db2ea27db Mon Sep 17 00:00:00 2001
+From 7b18b787450759f1c2507c7b65c81c3686040c90 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 02/27] net: dsa: mv88e6xxx: Improve indirect register access
 perf on 6393
+Organization: Wires

 When operating in multi-chip mode, the 6393 family maps a subset of
 commonly used global registers to the outermost address space (in
@@ -1,8 +1,9 @@
-From 5f8612dc0445ca95a7428bf7b837612406875b07 Mon Sep 17 00:00:00 2001
+From 379dd2a00dc647b034befead65b26e467e63ae75 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 03/27] net: dsa: mv88e6xxx: Honor ports being managed via
 in-band-status
+Organization: Wires

 Keep all link parameters in their unforced states when the port is
 declared as being managed via in-band-status, and let the MAC
@@ -1,8 +1,9 @@
-From 730dfa9a57604ff0b099cc5e244e42fdbebbe0d9 Mon Sep 17 00:00:00 2001
+From fd676f49b5aa5a1d372446be9ee01d1f126bcd54 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 04/27] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
 ports on 6393X
+Organization: Wires

 For packets with a DA in the IEEE reserved L2 group range, originating
 from a CPU, forward it as normal, rather than classifying it as
@@ -1,7 +1,8 @@
-From 8ce7a3a19676c148e6c247641000a5d5b86c6a3d Mon Sep 17 00:00:00 2001
+From 2aeb87ab82b7b9fb37e6b1c830dec5374158aa5d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 19:44:32 +0100
 Subject: [PATCH 05/27] net: dsa: mv88e6xxx: Add LED infrastructure
+Organization: Wires

 Parse DT for LEDs and register them for devices that support it,
 though no actual implementations exist yet.
@@ -1,7 +1,8 @@
-From 79741bd8278bf1958ef6f414e89d7052d1c9486b Mon Sep 17 00:00:00 2001
+From 3de6f58239d6b09c3fe1e0978a556481be8f3a95 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 21:59:35 +0100
 Subject: [PATCH 06/27] net: dsa: mv88e6xxx: Add LED support for 6393X
+Organization: Wires

 Trigger support:
 - "none"
@@ -1,8 +1,9 @@
-From 4ada7a3d2fa1fdb0abe4485a8f80a50c699d2607 Mon Sep 17 00:00:00 2001
+From f28803088158ddf97186f143f4bdc516e42e9354 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 07/27] net: dsa: tag_dsa: Use tag priority as initial
 skb->priority
+Organization: Wires

 Use the 3-bit priority field from the DSA tag as the initial packet
 priority on ingress to the CPU.
@@ -1,8 +1,9 @@
-From ef42cca1aee6a3756f6995368bf740d6c92e8ab4 Mon Sep 17 00:00:00 2001
+From bbbf265610459ec49afcde923d1872ca3e2ad679 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 08/27] net: dsa: Support MDB memberships whose L2 addresses
 overlap
+Organization: Wires

 Multiple IP multicast groups (32 for v4, 2^80 for v6) map to the same
 L2 address. This means that switchdev drivers may receive multiple MDB
@@ -1,7 +1,8 @@
-From 927b942567ad59e71b44095c054e1565e2e1a01f Mon Sep 17 00:00:00 2001
+From 797ed124853b8f0ef6d110e1633be2637c97c31d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 09/27] net: dsa: Support EtherType based priority overrides
+Organization: Wires

 ---
 include/net/dsa.h |  4 ++++
@@ -1,8 +1,9 @@
-From ef919d2970639d542534b6f27605c0a7d053e57f Mon Sep 17 00:00:00 2001
+From ea2d865a2101317e22c60143e891d643feac8e8c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 10/27] net: dsa: mv88e6xxx: Support EtherType based priority
 overrides
+Organization: Wires

 ---
 drivers/net/dsa/mv88e6xxx/chip.c    | 64 +++++++++++++++++++++++++++++
@@ -1,7 +1,8 @@
-From 06cf0fc089d4b4f4d0d00384d0b38bb87dca0494 Mon Sep 17 00:00:00 2001
+From a239baf492b7c4a1280562bb9478006627b73036 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 11/27] net: dsa: mv88e6xxx: Add mqprio qdisc support
+Organization: Wires

 Add support for attaching mqprio qdisc's to mv88e6xxx ports and use
 the packet's traffic class as the outgoing priority when no PCP bits
@@ -1,8 +1,9 @@
-From 44ff969f4646f5d6987c6c6afb33c9894116687d Mon Sep 17 00:00:00 2001
+From 60ac4461cef9b2024df52c23a040b100093ba1d7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 12/27] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
 are available
+Organization: Wires

 Switch the priority sourcing precdence to prefer VLAN PCP over IP
 DSCP, when both are available.
@@ -1,8 +1,9 @@
-From 868a65caca9a649616a9aef0e319f3744bda3df3 Mon Sep 17 00:00:00 2001
+From d3b20e07514928830034d4af2eb7660bfcacc1e0 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 13/27] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
 VLANs
+Organization: Wires

 Before this change, in a setup like the following, packets assigned to
 VLAN 10 were forwarded between the switch ports, even though the
@@ -1,8 +1,9 @@
-From 7e3b3153f5edfdcc7c4460744efbd3f8c0f4bf4b Mon Sep 17 00:00:00 2001
+From b4870c7df5d6659da439e8f1322dd5496a15445e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 14/27] net: phy: marvell10g: Support firmware loading on
 88X3310
+Organization: Wires

 When probing, if a device is waiting for firmware to be loaded into
 its RAM, ask userspace for the binary and load it over XMDIO.
@@ -1,8 +1,9 @@
-From 7769ff987e8619d012863851eb14dec613bee3fa Mon Sep 17 00:00:00 2001
+From 6161b59334064ebfc0b80b0214fa12e6d042400e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 15/27] net: phy: marvell10g: Fix power-up when strapped to
 start powered down
+Organization: Wires

 On devices which are hardware strapped to start powered down (PDSTATE
 == 1), make sure that we clear the power-down bit on all units
@@ -1,7 +1,8 @@
-From 3b64cbe7764bb3cb77953c8d0b8676c685c9f0b5 Mon Sep 17 00:00:00 2001
+From 403075caa172cf8e5c50346a86698b0a909a9263 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 16/27] net: phy: marvell10g: Add LED support for 88X3310
+Organization: Wires

 Pickup the LEDs from the state in which the hardware reset or
 bootloader left them, but also support further configuration via
@@ -1,8 +1,9 @@
-From 9b6d4099be8eb492d1ff46561b74f30688e53aef Mon Sep 17 00:00:00 2001
+From 84ca381445809f1d796c461a5b085ff4a3b7f93e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 17/27] net: phy: marvell10g: Support LEDs tied to a single
 media side
+Organization: Wires

 In a combo-port setup, i.e. where both the copper and fiber interface
 are available to the user, the LEDs may be physically located either
@@ -1,7 +1,8 @@
-From 8ca0ef48d4530da5cb6b807fd8b0901c916b0e8c Mon Sep 17 00:00:00 2001
+From 47eddfb80fd6bbbc186b0d8a93697c36840168e8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 18/27] net: phy: Do not resume PHY when attaching
+Organization: Wires

 The PHY should not start negotiating with its link-partner until
 explicitly instructed to do so.
@@ -19,7 +20,7 @@ administratively down.
 1 file changed, 1 deletion(-)

 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 8af44224480f..a2e386e9fafc 100644
+index 13dea33d86ff..25d0face304a 100644
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
@@ -1661,7 +1661,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
@@ -1,8 +1,9 @@
-From 848fdabbb0cd804dceac4ea34d47a422a65e7227 Mon Sep 17 00:00:00 2001
+From 761e5315fc2bac3809258e9719efd1475a73ac14 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 19/27] net: bridge: avoid classifying unknown multicast as
 mrouters_only
+Organization: Wires

 Unknown multicast, MAC/IPv4/IPv6, should always be flooded according to
 the per-port mcast_flood setting, as well as to detected and configured
@@ -152,10 +153,10 @@ index ceaa5a89b947..e54d648db7de 100644
 			br_multicast_flood(mdst, skb, brmctx, local_rcv, false);
 	}
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index b2ae0d2434d2..3137c1fcfc6a 100644
+index 733ff6b758f6..b1799e03403f 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
-@@ -3774,6 +3774,11 @@ static void br_multicast_err_count(const struct net_bridge *br,
+@@ -3835,6 +3835,11 @@ static void br_multicast_err_count(const struct net_bridge *br,
 	u64_stats_update_end(&pstats->syncp);
 }
 
@@ -167,7 +168,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 static void br_multicast_pim(struct net_bridge_mcast *brmctx,
 			     struct net_bridge_mcast_port *pmctx,
 			     const struct sk_buff *skb)
-@@ -3820,7 +3825,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
+@@ -3881,7 +3886,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
 
 	if (err == -ENOMSG) {
 		if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
@@ -177,7 +178,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 		} else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
 			if (ip_hdr(skb)->protocol == IPPROTO_PIM)
 				br_multicast_pim(brmctx, pmctx, skb);
-@@ -3889,7 +3895,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
+@@ -3950,7 +3956,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
 
 	if (err == -ENOMSG || err == -ENODATA) {
 		if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
@@ -188,7 +189,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 		    ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
 			br_ip6_multicast_mrd_rcv(brmctx, pmctx, skb);
 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index 041f6e571a20..40651b07df94 100644
+index 6a1bce8959af..ed5325c6add9 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
@@ -483,6 +483,7 @@ enum net_bridge_opts {
@@ -199,7 +200,7 @@ index 041f6e571a20..40651b07df94 100644
 };
 
 struct net_bridge {
-@@ -886,8 +887,8 @@ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb,
+@@ -887,8 +888,8 @@ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb,
 		bool local_rcv, bool local_orig);
 int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
 void br_flood(struct net_bridge *br, struct sk_buff *skb,
@@ -210,7 +211,7 @@ index 041f6e571a20..40651b07df94 100644
 
 /* return true if both source port and dest port are isolated */
 static inline bool br_skb_isolated(const struct net_bridge_port *to,
-@@ -1408,6 +1409,19 @@ static inline void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
+@@ -1410,6 +1411,19 @@ static inline void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
 {
 }
 
@@ -1,8 +1,9 @@
-From 930edf3bd31e77703ca805d816ed7b2cac695e44 Mon Sep 17 00:00:00 2001
+From 41c6eeb5c4042027eac70243dd28bcaf963ac6b8 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 20/27] net: bridge: Ignore router ports when forwarding L2
 multicast
+Organization: Wires

 Multicast router ports are either statically configured or learned from
 control protocol traffic (IGMP/MLD/PIM).  These protocols regulate IP
@@ -16,10 +17,10 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 1 file changed, 4 insertions(+), 1 deletion(-)

 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index 40651b07df94..e90b4f5cab76 100644
+index ed5325c6add9..0afb886b9a30 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
-@@ -1086,7 +1086,10 @@ br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
+@@ -1088,7 +1088,10 @@ br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
 	if (skb->protocol == htons(ETH_P_IPV6))
 		return rcu_dereference(hlist_first_rcu(&brmctx->ip6_mc_router_list));
 #endif
@@ -1,8 +1,9 @@
-From ec644e878010241f593bfccb2f7127dec6f69294 Mon Sep 17 00:00:00 2001
+From f831362d0a5717cbb18a9173defca6ec4d886377 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 21/27] net: bridge: drop delay for applying strict multicast
 filtering
+Organization: Wires

 This *local* patch drops the initial delay before applying strict multicast
 filtering, introduced in [1] and recently updated in [2].
@@ -24,7 +25,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2 files changed, 8 insertions(+), 38 deletions(-)

 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 3137c1fcfc6a..34be07a1fd00 100644
+index b1799e03403f..282105bdca85 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
@@ -1762,10 +1762,6 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t)
@@ -38,7 +39,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx,
 					    struct br_ip *ip,
 					    struct sk_buff *skb)
-@@ -3196,12 +3192,8 @@ int br_multicast_dump_querier_state(struct sk_buff *skb,
+@@ -3257,12 +3253,8 @@ int br_multicast_dump_querier_state(struct sk_buff *skb,
 
 static void
 br_multicast_update_query_timer(struct net_bridge_mcast *brmctx,
@@ -52,7 +53,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval);
 }
 
-@@ -3392,13 +3384,12 @@ static void
+@@ -3453,13 +3445,12 @@ static void
 br_ip4_multicast_query_received(struct net_bridge_mcast *brmctx,
 				struct net_bridge_mcast_port *pmctx,
 				struct bridge_mcast_other_query *query,
@@ -68,7 +69,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	br_ip4_multicast_mark_router(brmctx, pmctx);
 }
 
-@@ -3407,13 +3398,12 @@ static void
+@@ -3468,13 +3459,12 @@ static void
 br_ip6_multicast_query_received(struct net_bridge_mcast *brmctx,
 				struct net_bridge_mcast_port *pmctx,
 				struct bridge_mcast_other_query *query,
@@ -84,7 +85,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	br_ip6_multicast_mark_router(brmctx, pmctx);
 }
 #endif
-@@ -3467,7 +3457,7 @@ static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
+@@ -3528,7 +3518,7 @@ static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
 
 		br_ip4_multicast_query_received(brmctx, pmctx,
 						&brmctx->ip4_other_query,
@@ -93,7 +94,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 		goto out;
 	}
 
-@@ -3555,7 +3545,7 @@ static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
+@@ -3616,7 +3606,7 @@ static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
 
 		br_ip6_multicast_query_received(brmctx, pmctx,
 						&brmctx->ip6_other_query,
@@ -102,7 +103,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 		goto out;
 	} else if (!group) {
 		goto out;
-@@ -4063,8 +4053,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
+@@ -4124,8 +4114,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
 		    br_ip4_multicast_local_router_expired, 0);
 	timer_setup(&brmctx->ip4_other_query.timer,
 		    br_ip4_multicast_querier_expired, 0);
@@ -111,7 +112,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	timer_setup(&brmctx->ip4_own_query.timer,
 		    br_ip4_multicast_query_expired, 0);
 #if IS_ENABLED(CONFIG_IPV6)
-@@ -4072,8 +4060,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
+@@ -4133,8 +4121,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
 		    br_ip6_multicast_local_router_expired, 0);
 	timer_setup(&brmctx->ip6_other_query.timer,
 		    br_ip6_multicast_querier_expired, 0);
@@ -120,7 +121,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	timer_setup(&brmctx->ip6_own_query.timer,
 		    br_ip6_multicast_query_expired, 0);
 #endif
-@@ -4208,12 +4194,10 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
+@@ -4269,12 +4255,10 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
 {
 	del_timer_sync(&brmctx->ip4_mc_router_timer);
 	del_timer_sync(&brmctx->ip4_other_query.timer);
@@ -133,7 +134,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	del_timer_sync(&brmctx->ip6_own_query.timer);
 #endif
 }
-@@ -4641,8 +4625,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
+@@ -4728,8 +4712,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
 
 int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
 {
@@ -142,7 +143,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	val = !!val;
 
 	spin_lock_bh(&brmctx->br->multicast_lock);
-@@ -4653,19 +4635,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
+@@ -4740,19 +4722,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
 	if (!val)
 		goto unlock;
 
@@ -163,7 +164,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 #endif
 
 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index e90b4f5cab76..73b78c594564 100644
+index 0afb886b9a30..5b5b2c2442a5 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
@@ -78,7 +78,6 @@ struct bridge_mcast_own_query {
@@ -174,7 +175,7 @@ index e90b4f5cab76..73b78c594564 100644
 };
 
 /* selected querier */
-@@ -1164,8 +1163,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
+@@ -1166,8 +1165,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
 		own_querier_enabled = false;
 	}
 
@@ -1,8 +1,9 @@
-From d46286898fbadf40a2fe1f4e449a3acdaede788b Mon Sep 17 00:00:00 2001
+From 1e0eb62180058e98c7d18e3e04540925801e34b5 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 22/27] net: bridge: Differentiate MDB additions from
 modifications
+Organization: Wires

 Before this change, the reception of an IGMPv3 report (and analogously
 for MLDv2) that adds a new group, would trigger two MDB RTM_NEWMDB
@@ -40,7 +41,7 @@ index db7254d52d93..63508279df47 100644
 	RTM_NEWNSID = 88,
 #define RTM_NEWNSID RTM_NEWNSID
 diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
-index 1a52a0bca086..d5757ab72d2f 100644
+index 7e1ad229e133..3b1873e7c499 100644
 --- a/net/bridge/br_mdb.c
 +++ b/net/bridge/br_mdb.c
@@ -734,7 +734,7 @@ static int br_mdb_replace_group_sg(const struct br_mdb_config *cfg,
@@ -62,7 +63,7 @@ index 1a52a0bca086..d5757ab72d2f 100644
 	if (br_multicast_should_handle_mode(brmctx, cfg->group.proto))
 		br_multicast_star_g_handle_mode(pg, cfg->filter_mode);
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 34be07a1fd00..9c8bf38e0079 100644
+index 282105bdca85..aa97b07ed528 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
@@ -619,7 +619,7 @@ static void br_multicast_fwd_src_handle(struct net_bridge_group_src *src)
@@ -83,7 +84,7 @@ index 34be07a1fd00..9c8bf38e0079 100644
 	}
 out:
 	spin_unlock(&br->multicast_lock);
-@@ -2887,7 +2887,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge_mcast *brmctx,
+@@ -2948,7 +2948,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge_mcast *brmctx,
 			break;
 		}
 		if (changed)
@@ -92,7 +93,7 @@ index 34be07a1fd00..9c8bf38e0079 100644
 unlock_continue:
 		spin_unlock(&brmctx->br->multicast_lock);
 	}
-@@ -3029,7 +3029,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge_mcast *brmctx,
+@@ -3090,7 +3090,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge_mcast *brmctx,
 			break;
 		}
 		if (changed)
@@ -1,8 +1,9 @@
-From cd8e2556f6b220fd6795779a37fbd6ff3159dcaf Mon Sep 17 00:00:00 2001
+From 86a738ca46e019a8913d100138d8972681a65b4b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 23/27] nvmem: layouts: onie-tlv: Let device probe even when
 TLV is invalid
+Organization: Wires

 Before this change, probing an NVMEM device, expected to contain a
 valid TLV, would fail if it had not been provisioned yet. But an
@@ -1,7 +1,8 @@
-From bbd05c87d8a872731eb2f46ffc63bcddf80bbfca Mon Sep 17 00:00:00 2001
+From df19ceb2579bd87d58f2caab739d8ba678785f5c Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 29 Apr 2024 15:14:51 +0200
 Subject: [PATCH 24/27] usb: core: adjust log level for unauthorized devices
+Organization: Wires

 The fact that a USB device currently is not authorized is not an error,
 so let's adjust the log level so these messages slip below radar for the
@@ -1,8 +1,9 @@
-From 6612adb18ad9ec35d81b131ebcff0b358a993a62 Mon Sep 17 00:00:00 2001
+From eea7cb00b2e657445de9913736ff38b99ed0f9a5 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 16 Jan 2025 12:35:12 +0100
 Subject: [PATCH 25/27] net: dsa: mv88e6xxx: collapse disabled state into
 blocking
+Organization: Wires

 This patch changes the behavior of switchcore ports wrt. the port state.
 Instead of disabling the port, the driver now treats the disabled state
@@ -1,8 +1,9 @@
-From c95150639c61db088df0c7c2f9b0e18c0ef64550 Mon Sep 17 00:00:00 2001
+From 0e24579e619a9d3ebb03293822092e03d16d6ad2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 12 Feb 2025 22:03:14 +0100
 Subject: [PATCH 26/27] net: dsa: mv88e6xxx: Only activate LAG offloading when
 bridged
+Organization: Wires

 The current port isolation scheme for mv88e6xxx is detailed here:
 https://lore.kernel.org/netdev/20220203101657.990241-1-tobias@waldekranz.com/
@@ -1,8 +1,9 @@
-From 18d9518aba9afbd190e90a2661525bd4bf6d02d0 Mon Sep 17 00:00:00 2001
+From 73b60d31a3318344428842c7368b2f1eb0c05596 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 27/27] net: usb: r8152: add r8153b support for link/activity
 LEDs
+Organization: Wires

 This patch adds support for the link/activity LEDs on the NanoPi R2S
 and OrangePi R1 Plus.
@@ -18,7 +19,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 1 file changed, 8 insertions(+)

 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index 96fa3857d8e2..cddb025aa56b 100644
+index 2cab046749a9..c9947ad320ff 100644
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
@@ -41,6 +41,11 @@
@@ -1,2 +1,2 @@
 # Calculated with ../utils/kernel-refresh.sh
-sha256   df046a48971e40ce0b2e003e7e55b6b1e7da2912120eb216d5d6c8450c9cf82e  linux-6.12.30.tar.xz
+sha256   05f4e0b01dde578c3328eb539d305cccec7b84e939f6dd5f21fdaf5f313da748  linux-6.12.35.tar.xz
@@ -0,0 +1,232 @@
+From 9df1957e656940a50b844da879911ab5981ad1a9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= <lazzer@gmail.com>
+Date: Wed, 18 Jun 2025 21:21:18 +0200
+Subject: [PATCH] Add pidfile support when not daemonize
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Organization: Wires
+
+Adds pidfile.c from libite
+
+Signed-off-by: Mattias Walström <lazzer@gmail.com>
+---
+ wpa_supplicant/Makefile         |   1 +
+ wpa_supplicant/pidfile.c        | 153 ++++++++++++++++++++++++++++++++
+ wpa_supplicant/wpa_supplicant.c |   7 +-
+ 3 files changed, 160 insertions(+), 1 deletion(-)
+ create mode 100644 wpa_supplicant/pidfile.c
+
+diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
+index fd7d7a0bd..e14c7732a 100644
+--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
+@@ -104,6 +104,7 @@ endif
+ OBJS = config.o
+ OBJS += notify.o
+ OBJS += bss.o
+OBJS += pidfile.o
+ OBJS += eap_register.o
+ OBJS += ../src/utils/common.o
+ OBJS += ../src/utils/config.o
+diff --git a/wpa_supplicant/pidfile.c b/wpa_supplicant/pidfile.c
+new file mode 100644
+index 000000000..29dfbe242
+--- /dev/null
+++ b/wpa_supplicant/pidfile.c
+@@ -0,0 +1,153 @@
+/*	Updated by troglobit for libite/finit/uftpd projects 2016/07/04 */
+/*	$OpenBSD: pidfile.c,v 1.11 2015/06/03 02:24:36 millert Exp $	*/
+/*	$NetBSD: pidfile.c,v 1.4 2001/02/19 22:43:42 cgd Exp $	*/
+
+/*-
+ * Copyright (c) 1999 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Jason R. Thorpe.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file pidfile.c
+ * @author NetBSD Foundation Inc.
+ * @date 1999
+ * @copyright 2-clause BSD License
+ */
+
+#include <sys/stat.h>		/* utimensat() */
+#include <sys/time.h>		/* utimensat() on *BSD */
+#include <sys/types.h>
+#include <errno.h>
+#include <paths.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifndef pidfile
+static char *pidfile_path = NULL;
+static pid_t pidfile_pid  = 0;
+
+static void pidfile_cleanup(void);
+
+const  char *__pidfile_path = _PATH_VARRUN; /* Note: includes trailing slash '/' */
+const  char *__pidfile_name = NULL;
+extern char *__progname;
+
+/**
+ * Create or update mtime of process PID file.
+ * @param basename  Program name, or @c NULL, may start with '/'
+ *
+ * This function is intended to be used by UNIX daemons to save the PID of the main process
+ * responsible for handling signals.  If @p basename is @c NULL the implicit @a __progname
+ * variable from the C-library is used.  The @p basename may also start with '/', in which
+ * case it is interpreted as the absolute path to the PID file.
+ *
+ * @returns POSIX OK(0) on success, otherwise non-zero on error.
+ */
+int pidfile(const char *basename)
+{
+	int save_errno;
+	int atexit_already;
+	pid_t pid;
+	FILE *f;
+
+	if (basename == NULL)
+		basename = __progname;
+
+	pid = getpid();
+	atexit_already = 0;
+
+	if (pidfile_path != NULL) {
+		if (!access(pidfile_path, R_OK) && pid == pidfile_pid) {
+			utimensat(0, pidfile_path, NULL, 0);
+			return (0);
+		}
+		free(pidfile_path);
+		pidfile_path = NULL;
+		__pidfile_name = NULL;
+		atexit_already = 1;
+	}
+
+	if (basename[0] != '/') {
+		if (asprintf(&pidfile_path, "%s.pid", basename) == -1)
+			return (-1);
+	} else {
+		if (asprintf(&pidfile_path, "%s", basename) == -1)
+			return (-1);
+	}
+
+	if ((f = fopen(pidfile_path, "w")) == NULL) {
+		save_errno = errno;
+		free(pidfile_path);
+		pidfile_path = NULL;
+		errno = save_errno;
+		return (-1);
+	}
+
+	if (fprintf(f, "%ld\n", (long)pid) <= 0 || fflush(f) != 0) {
+		save_errno = errno;
+		(void) fclose(f);
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+		errno = save_errno;
+		return (-1);
+	}
+	(void) fclose(f);
+	__pidfile_name = pidfile_path;
+
+	/*
+	 * LITE extension, no need to set up another atexit() handler
+	 * if user only called us to update the mtime of the PID file
+	 */
+	if (atexit_already)
+		return (0);
+
+	pidfile_pid = pid;
+	if (atexit(pidfile_cleanup) < 0) {
+		save_errno = errno;
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+		pidfile_pid = 0;
+		errno = save_errno;
+		return (-1);
+	}
+
+	return (0);
+}
+
+static void
+pidfile_cleanup(void)
+{
+	if (pidfile_path != NULL && pidfile_pid == getpid()) {
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+	}
+}
+#endif
+diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
+index dfbd63163..3a762ebc2 100644
+--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
+@@ -123,6 +123,7 @@ const char *const wpa_supplicant_full_license5 =
+ "\n";
+ #endif /* CONFIG_NO_STDOUT_DEBUG */
+ 
+int pidfile(const char *basename);
+ 
+ static void wpa_bss_tmp_disallow_timeout(void *eloop_ctx, void *timeout_ctx);
+ static void wpas_verify_ssid_beacon(void *eloop_ctx, void *timeout_ctx);
+@@ -1490,6 +1491,9 @@ static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
+ 		/* Ignore errors since we cannot really do much to fix this */
+ 		wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
+ 	}
+
+	if (!global->params.daemonize)
+		pidfile(global->params.pid_file);
+ }
+ 
+ 
+@@ -8555,7 +8559,6 @@ struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
+ 	return global;
+ }
+ 
+-
+ /**
+  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
+  * @global: Pointer to global data from wpa_supplicant_init()
+@@ -8589,6 +8592,8 @@ int wpa_supplicant_run(struct wpa_global *global)
+ 	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
+ 	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
+ 
+	if (!global->params.daemonize)
+		pidfile(global->params.pid_file);
+ 	eloop_run();
+ 
+ 	return 0;
+-- 
+2.43.0
+
@@ -0,0 +1,13 @@
+Copyright (c) 2025 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -12,6 +12,8 @@ kernel=u-boot.bin
 device_tree=bcm2711-rpi-4-b.dtb
 dtoverlay=rpi-env
 dtoverlay=infix-key
+dtoverlay=vc4-kms-v3d-pi4
+dtoverlay=vc4-kms-dsi-ili9881-7inch

 # To use an external initramfs file
 #initramfs rootfs.cpio.gz
@@ -20,11 +22,7 @@ dtoverlay=infix-key
 # If the text shown on the screen disappears off the edge, comment this out
 disable_overscan=1

-# How much memory in MB to assign to the GPU on Pi models having
-# 256, 512 or 1024 MB total memory
-gpu_mem_256=100
-gpu_mem_512=100
-gpu_mem_1024=100
+gpu_mem=256

 # Enable UART0 for serial console on ttyAMA0
 enable_uart=1
@@ -0,0 +1 @@
+dtb-y += broadcom/bcm2711-rpi-4-b.dtb
@@ -0,0 +1,22 @@
+#include <arm64/broadcom/bcm2711-rpi-4-b.dts>
+
+/ {
+	framebuffer@3e402000 {
+		compatible = "simple-framebuffer";
+		reg = <0x3e402000 0x1000>;
+		width = <800>;
+		height = <480>;
+		stride = <1600>;
+		format = "r5g6b5";
+		status = "okay";
+	};
+	chosen {
+		/* 8250 auxiliary UART instead of pl011 */
+		stdout-path = "serial1:115200n8";
+
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+	};
+};
@@ -29,7 +29,7 @@ image var.ext4 {
 	}
 }

-image sdcard.img {
+image #INFIX_ID##VERSION#-rpi4-sdcard.img {
 	hdimage {
 		partition-table-type = "gpt"
 	}
@@ -1,5 +1,6 @@
 #!/bin/sh
 set -e
+#. "$BR2_CONFIG" 2>/dev/null

 BOARD_DIR=$(dirname "$0")
 GENIMAGE_CFG="${BUILD_DIR}/genimage.cfg"
@@ -18,17 +19,22 @@ find "${BINARIES_DIR}" -type f -name '*.dtbo' -exec mv '{}' "${BINARIES_DIR}/rpi

 # Create FILES array for the genimage.cfg generation
 FILES=""
-for f in "${BINARIES_DIR}"/*.dtb "${BINARIES_DIR}"/rpi-firmware/*; do
+for f in "${BINARIES_DIR}"/rpi-firmware/*; do
    case "$f" in
        *~|*.bak) continue ;;
    esac
+    echo "${FILES}" | grep -q `basename $f` && continue # If already exist it has been added by us.
    FILES="${FILES}\t\t\t\"${f#"${BINARIES_DIR}/"}\",\n"
 done

+echo $FILES
 KERNEL=$(sed -n 's/^kernel=//p' "${BINARIES_DIR}/rpi-firmware/config.txt")
 FILES="${FILES}\t\t\t\"${KERNEL}\""

-sed "s|#BOOT_FILES#|${FILES}|" "${BOARD_DIR}/genimage.cfg.in" > "${GENIMAGE_CFG}"
+
+sed "s|#BOOT_FILES#|${FILES}|" "${BOARD_DIR}/genimage.cfg.in" | \
+sed "s|#VERSION#|${RELEASE}|"  | \
+sed "s|#INFIX_ID#|${INFIX_ID}|" > "${GENIMAGE_CFG}"

 ROOTPATH_TMP=$(mktemp -d)
 trap 'rm -rf \"$ROOTPATH_TMP\"' EXIT
@@ -2,6 +2,17 @@
  "ieee802-dot1ab-lldp:lldp": {
    "infix-lldp:enabled": true
  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
  "ietf-interfaces:interfaces": {
    "interface": [
      {
@@ -27,6 +38,10 @@
      {
        "name": "eth0",
        "type": "infix-if-type:ethernet"
+      },
+      {
+        "name": "wifi0",
+        "type": "infix-if-type:wifi"
      }
    ]
  },
@@ -35,9 +50,9 @@
      "asymmetric-key": [
        {
          "name": "genkey",
-          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
          "public-key": "",
-          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
          "cleartext-private-key": "",
          "certificates": {}
        }
@@ -79,7 +94,7 @@
        ],
        "rule": [
          {
-            "name":  "deny-password-read",
+            "name": "deny-password-read",
            "module-name": "ietf-system",
            "path": "/ietf-system:system/authentication/user/password",
            "access-operations": "*",
@@ -127,7 +142,7 @@
          "udp": {
            "address": "pool.ntp.org"
          },
-	  "iburst": true
+          "iburst": true
        }
      ]
    },
@@ -173,7 +188,7 @@
    ]
  },
  "infix-meta:meta": {
-    "infix-meta:version": "1.2"
+    "version": "1.5"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -189,5 +204,23 @@
    "restconf": {
      "enabled": true
    }
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
  }
 }
@@ -0,0 +1,6 @@
+cat <<EOF
+   {
+        "name": "wifi0",
+        "type": "infix-if-type:wifi",
+   }
+EOF
@@ -9,7 +9,7 @@
 			ixbootdelay = "0.5";
 			bootdelay = "-2";
 			bootmenu_delay = "10";
-			boot_targets = "mmc1";
+			boot_targets = "mmc0";
 			ethprime = "eth0";
 			bootcmd = "run ixboot";

@@ -1,4 +1,4 @@
 pkglibexec_SCRIPTS = bootstrap error load gen-service gen-hostname \
 		     gen-interfaces gen-motd gen-hardware gen-version \
-		     mstpd-wait-online
+		     mstpd-wait-online wait-interface
 sbin_SCRIPTS       = dagger migrate
@@ -97,6 +97,7 @@ filter_iface_ports()
    for phy in $ifaces; do
        found=""
        for port in $ports; do
+            [ -d "/sys/class/net/${port}/wireless" ] && continue
            if [ "$port" = "$phy" ]; then
               found=true
               break
@@ -147,7 +148,6 @@ ports=$(ip -d -j link show group port | jq -r '

 # Remaining external interfaces not classified as switch ports
 ifaces="$(filter_iface_ports "$phys_ifaces" "$ports")"
-
 cat <<EOF
 {
  "ietf-interfaces:interfaces": {
@@ -193,7 +193,7 @@ cat <<EOF
      }
 $(for iface in $ifaces; do gen_iface_json "$iface"; done)
 $(for iface in $ports;  do gen_iface_json "$iface" "$bridge"; done)
-    ]
+      ]
 EOF
 if [ "$dhcp" = "true" ] && [ -n "$bridge" ]; then
 cat <<EOF
@@ -0,0 +1,21 @@
+#!/bin/sh
+if [ $# -lt 2 ]; then
+	echo "usage: $0 <ifname> <timeout>"
+	exit 1
+fi
+
+ifname=$1
+timeout=$2
+while true; do
+    if ip link show $ifname &>/dev/null; then
+        break
+    fi
+
+    retries=$(($retries + 1))
+    if [ $retries -ge $timeout ]; then
+        logger -t wait-interface "Timeout: Interface $ifname not found after $timeout seconds"
+        exit 1
+    fi
+
+    sleep 1
+done
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Mattias WalströmandGitHub	dadb90a6d8	Merge pull request #1068 from kernelkit/raspberry-pi Raspberry pi	2025-07-12 11:23:12 +02:00
Mattias Walström	d5d3eef08b	rpi4: Move to a board package and normal aarch64 build Features availible on RPI4 so far is: * WiFi * USB * (Graphics, untested)	2025-07-11 17:06:39 +02:00
Mattias Walström	14fb93f5cf	developers-guide: Add new builddep (for raspberry pi) Add mtools	2025-07-11 17:06:38 +02:00
Mattias Walström	7b3cd7d663	probe: Add USB support for RPI4 Need some special handling for RPI, since RPI does not present a phandle for the USB in sysfs (PCI device)	2025-07-11 17:06:37 +02:00
Mattias Walström	67817a182c	board: common: Add a watchdogd configuration Also increase the timeout and kick more often (required by RPI4)	2025-07-11 17:06:36 +02:00
Joachim WibergandGitHub	692fa166d1	Merge pull request #1049 from kernelkit/document-kernel-buildroot-update Document process about upgrade buildroot and kernel Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-07-11 13:40:58 +02:00
Joachim WibergandGitHub	c5d9a7c8b3	Merge pull request #1078 from kernelkit/ci-workflow-redesign Redesign CI to use workflow calls Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-07-09 11:52:54 +02:00
Richard Alpe	45c588567d	.github: fix parallel typo in dispatch Fixes: `874c0a54` Use massive parallel in workflow for PRs Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-09 10:42:40 +02:00
Richard Alpe	2a8580edcc	.github: allow workflow caller to pass test dir Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-07 09:53:06 +02:00
Richard Alpe	ffd0c05f41	.github: allow workflow caller to pass 9pm config	2025-07-07 09:53:05 +02:00
Richard Alpe	9271c2439f	.github: add name when calling test from self trigger	2025-07-07 09:53:04 +02:00
Richard Alpe	7295077f27	.github: update test.yml to support workflow call	2025-07-07 09:53:03 +02:00
Richard Alpe	b3d76de8f3	.github: quote workflow call variables in trigger	2025-07-07 09:53:02 +02:00
Richard Alpe	56f14ff520	.github: build _minimal on self-trigger Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-07 09:53:01 +02:00
Richard Alpe	9845e3b0c7	.github: make flavor selection into a env option	2025-07-07 09:53:00 +02:00
Richard Alpe	08e6833266	.github: allow repo checkout override Needed when called by spins inside different organizations.	2025-07-07 09:52:59 +02:00
Richard Alpe	df54982978	.github: simplify flavor selection	2025-07-07 09:52:58 +02:00
Richard Alpe	efd6cce842	.github: pass (Infix) name as workflow_call input Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-07 09:52:57 +02:00
Richard Alpe	1dc84af095	.github: use workflow calls to build and test Redesign how GH actions are triggered. This new design uses a self-trigger to start jobs which are only started via workflow_calls. The main benefit of this is to be able to start workflows from various Infix Spins without needing to duplicate the workflow files in them. Upcoming patches are intended to parameterize to allow Spins to pass different architectures, brand names and such. Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-07 09:52:55 +02:00
Tobias WaldekranzandGitHub	d6c0d4bea7	Merge pull request #1042 from kernelkit/ixbin ixbin: Add util script to update image contents	2025-07-04 11:23:33 +02:00
Tobias Waldekranz	85c4b579d3	ixbin: Add util script to update image contents [skip-ci]	2025-07-04 11:20:46 +02:00
Joachim WibergandGitHub	1f268a7b90	Merge pull request #1079 from kernelkit/gen-test-spec Minor Test Update	2025-07-03 14:51:04 +02:00
Ahmed Karic	562fd253c4	test: Update description in speed/duplex test	2025-07-03 14:01:27 +02:00
Ahmed Karic	be547ba9a8	test: Generate forgotten test-spec - container_host_commands test is missing .adoc and .svg files	2025-07-03 13:59:55 +02:00
Richard AlpeandGitHub	40e94883c6	Merge pull request #1076 from kernelkit/update-changelog doc: update changelog date for v25.06	2025-07-01 14:19:41 +02:00
Richard Alpe	9f268606e4	doc: update changelog date for v25.06 Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-01 11:29:04 +02:00
Jon-Olov VatnandGitHub	de113503ea	Merge pull request #1075 from kernelkit/update-changelog-v25.06.0 Update Changelog for Infix v25.06.0	2025-06-30 09:48:30 +02:00
Jon-Olov Vatn	6f203b1c78	Update Changelog for Infix v25.06.0 [skip ci]	2025-06-30 08:40:45 +02:00
Mattias WalströmandGitHub	c31bbbefa9	Merge pull request #1074 from kernelkit/wifi-fixes	2025-06-29 22:24:23 +02:00
Mattias Walström	0d03f874ee	confd: wifi: Fix several bugs in WiFi implemenation * Did not work to reconfigure * Was not possible to run from startup * Othe minor things.	2025-06-29 21:07:10 +02:00
Mattias Walström	51176c7d26	feature: wifi: Allow to set regulation setting (country-code) We was missing the firmware required for this, and for this to work cfg80211 needs to be as module since the rootfs is not loaded when it is loaded if compiled in kernel. And add iw since it very useful for debugging.	2025-06-29 21:06:33 +02:00
Mattias WalströmandGitHub	88958a0b1f	Merge pull request #1073 from kernelkit/upgrade-kernel Bump kernel to 6.12.35 (LTS)	2025-06-27 15:04:49 +02:00
Mattias Walström	e3f87799b6	utils/kernel-refresh.sh: Stage defconfigs Everything else got staged, but not defconfigs	2025-06-27 13:39:31 +02:00
Mattias Walström	ebcb38be37	Bump kernel to 6.12.35 (LTS)	2025-06-27 13:36:41 +02:00
Ahmed KaricandGitHub	889fb3eb79	Merge pull request #1072 from kernelkit/container-remote-exec Verify Host Command Execution from Container	2025-06-26 14:11:28 +02:00
Ahmed Karic	2a6e7e5208	test: Verify host command execution Add test to verify a container on Infix can execute commands on the host by mounting a script to `/etc/rc.local` with proper permissions. The test confirms host hostname change using `nsenter` from inside a privileged container. Resolves #1024	2025-06-26 13:10:43 +02:00
Joachim WibergandGitHub	9629e2eef4	Merge pull request #1071 from kernelkit/mount-mode Add support for setting mode of a container content mount	2025-06-26 12:35:02 +02:00
Joachim Wiberg	a0c48e7b5f	Add support for setting mode of a container content mount Fixes #1070 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-25 19:49:47 +02:00
Ahmed KaricandGitHub	edd2e60dd5	Merge pull request #1059 from kernelkit/speed_duplex Verify auto-negotiated speed/duplex	2025-06-25 10:00:10 +02:00
Ahmed Karic	ec82d68a9f	test: Verify auto-negotiated speed/duplex (copper)	2025-06-25 08:54:33 +02:00
Ahmed Karic	20d5426935	test/docker: Upgrade docker image to include ethtool Add `ethtool` to the Docker test environment to support interface auto-negotiation tests.	2025-06-25 08:01:13 +02:00
Mattias WalströmandGitHub	9d6d0e2388	Merge pull request #1069 from kernelkit/upgrade-buildroot	2025-06-24 19:55:41 +02:00
Joachim WibergandGitHub	6167f2a6a4	Merge pull request #1067 from kernelkit/misc New slogan and updated containers Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 15:11:06 +02:00
Joachim Wiberg	4ad2664b78	doc: update changelog for v25.06 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:54 +02:00
Joachim Wiberg	fe031f1a10	package/klish: fix by-word movement and kill buffer support - Fix by-word movement, detect word barrier using non-alphanum chars - Fix delete word left/right, make sure to save word in kill buffer Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:54 +02:00
Joachim Wiberg	0a3277caf2	package/curious-*: bump to v25.06.0 - Buildroot updated to v25.02.3 - Tefactor of nftables container The nftables container now includes BusyBox, a shell with vi and some basic filesystem tools, as well as nsenter and unshare, suitable for testing and other more advanced tasks. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:53 +02:00
Joachim Wiberg	cac357458c	Rebranding, make slogan more inclusive, Infix is more now ... Fixes #1052 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:53 +02:00
Mattias Walström	7b8bc43bca	Bump buildroot to 2025.02.4 (LTS)	2025-06-24 13:36:36 +02:00
Joachim Wiberg	5c7fc3f570	package/tetris: bump to v1.5.0 ChangeLog https://github.com/troglobit/tetris/releases/tag/1.5.0 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-22 21:12:50 +02:00
Joachim WibergandGitHub	bae70ec85a	Merge pull request #1066 from kernelkit/upgrade-kernel Upgrade Linux kernel to 6.12.34 (LTS) Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-20 09:52:54 +02:00
Mattias Walström	eeb10b0f07	Upgrade Linux kernel to 6.12.34 (LTS)	2025-06-19 21:14:30 +02:00
Mattias WalströmandGitHub	b92c9daedd	Merge pull request #1058 from kernelkit/wifi-support	2025-06-19 18:34:35 +02:00
Mattias Walström	eabaaac7c2	Document process about upgrade buildroot and kernel	2025-06-19 15:47:54 +02:00
Mattias Walström	de33df14e2	test: case: ietf_syslog/remote: Fix typo of interface type Has not been triggered before because we ignored operations on fixed interfaces.	2025-06-19 15:23:32 +02:00
Mattias Walström	5eeed0e743	changelog: Update with Wi-Fi client Also add kernel update to correct release.	2025-06-19 15:23:31 +02:00
Mattias Walström	24852caad0	doc: Add Wi-Fi Documention	2025-06-19 15:23:31 +02:00
Mattias Walström	08f4207277	configs: Enable Wi-Fi support	2025-06-19 15:23:30 +02:00
Mattias Walström	5fbb30fed5	Wi-Fi: Add Wi-Fi information to operational and CLI output * show wifi scan <ifname> to see located SSIDs * interface status	2025-06-19 15:23:30 +02:00
Mattias Walström	f25f0ab050	Wi-Fi: Add template finit service for wpa_supplicant	2025-06-19 15:23:29 +02:00
Mattias Walström	b53c1612f0	confd: Add basic Wi-Fi client support Support implemented: * WPA2/3 support * scanning (in background, results in operational) * Unencrypted networks No certificate support, only PSK only client so far, no AP	2025-06-19 15:23:28 +02:00
Mattias Walström	57d5bf1577	confd: Add script to wait for an interface usage: wait-interface wlan0 30	2025-06-19 15:23:27 +02:00
Mattias Walström	0ad8fab5c7	wpa_supplicant: Add support for pidfile when not daemonize	2025-06-19 15:23:27 +02:00
Mattias Walström	ecabce86c7	Add meta-package for adding Wi-Fi support Helps adding everything that needs to be compiled to get Wi-Fi support working. Both modules, firmware and applications are selected here	2025-06-19 15:23:26 +02:00
Mattias Walström	a7e72a46d9	confd: Simplify enabling features in YANG models If a extra infix feature require features to be added to an already loaded module. Instead of have the exact module definition in multiple places (with date), this will allow a much more flexible sytax: MODULES=( "infix-interfaces -e containers" ) This require that the infix-interfaces is loaded before this file is run.	2025-06-19 15:23:25 +02:00
Mattias Walström	915bef2dd4	udev: Rename all wlan interfaces wifiN and start scanning This since the feature is called 'wifi' in Infix, this makes the naming consistent over the system. Also trigger start of a wpa_supplicant, for scanning in the background. The scanning results is available operational.	2025-06-19 15:23:24 +02:00
Mattias Walström	7f9a1df6f7	qemu: Increase memory for virtual machine Image is too big, more memory is required	2025-06-19 15:23:24 +02:00
Mattias Walström	67a6fc18d5	confd: Always run netdag_gen_afspec_set and netdag_gen_afspec_add on all iftypes If an iftype does not need to do anything, just return 0. This makes the code much more easy to follow.	2025-06-19 15:23:23 +02:00
Mattias Walström	8538888069	confd: core: Allow all other flags then SR_SUBSCR_UPDATE Other flags may be load-bearing in some modules, but SR_SUBSCR_UPDATE, we never want to keep track on in the core hooks.	2025-06-19 10:34:46 +02:00
Mattias WalströmandGitHub	5a1cf7f9f8	Merge pull request #1063 from kernelkit/upgrade-kernel Upgrade Linux kernel to v6.12.33 (LTS)	2025-06-18 07:56:21 +02:00
Ahmed Karic	6755011b25	Upgrade Linux kernel to 6.12.33 (LTS)	2025-06-16 10:49:02 +02:00
Mattias WalströmandGitHub	e5a8514fa0	Merge pull request #1061 from kernelkit/update-changelog-v25.05.1 Update changelog for Infix v25.05.1	2025-06-12 15:03:41 +02:00
Jon-Olov Vatn	82c3eb1ee7	Update changelog for Infix v25.05.1	2025-06-12 12:31:35 +02:00
Jon-Olov VatnandGitHub	159135786a	Merge pull request #1060 from kernelkit/fix-missing-cmd-regression Restore missing CLI commands moved to show context	2025-06-11 09:14:09 +02:00
Richard Alpe	8a9415f0b4	klish-plugin-infix: restore missing CLI commands moved to show context Some CLI commands where inadvertently moved from the global CLI context into the show context. For example the upgrade command. As a result, commands like upgrade were unavailable at the top-level prompt:admin@ix-00-00-00:/> upgrade ? Error: Command not found, or incomplete. However, these commands remained accessible under the "show" context as a temporary workaround: admin@ix-00-00-00:/> show upgrade ? URI [(ftp\|tftp\|http\|https\|ftp)://(dns.name \| ip.address)/path/to/]upgrade-bundle.pkg This patch restores the affected commands to the global CLI context so that commands like upgrade function as intended at the root prompt. Fixes: `9c0a8e39` klish-plugin-infix: fix indentation in infix.xml Signed-off-by: Richard Alpe <richard@bit42.se>	2025-06-10 16:06:12 +02:00
Mattias WalströmandGitHub	93cffaedde	Merge pull request #1057 from kernelkit/upgrade-kernel	2025-06-04 21:22:39 +02:00
Ahmed Karic	991364b411	Upgrade linux kernel to v6.12.32 (LTS)	2025-06-04 18:21:11 +02:00
Mattias WalströmandGitHub	22cf97fdbd	Merge pull request #1056 from kernelkit/upgrade-kernel	2025-05-30 12:49:48 +02:00
Ahmed Karic	16c1b50349	Upgrade Linux kernel to 6.12.31 (LTS)	2025-05-30 11:26:53 +02:00
				`@@ -0,0 +1 @@`
				`SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"`