confd: Add support to upload images directly

This add support for upgrading images with curl only, without FTP or similiar. The image needs to be base64 encoded. Example: TEMP_JSON=/tmp/restconf.txt echo -n '{"infix-system:input":{"image":"' > "$TEMP_JSON" base64 -w 0 "$BUNDLE_FILE" >> "$TEMP_JSON" echo '"}}' >> "$TEMP_JSON" curl -k \ -X POST \ -u "admin:admin" \ -H "Content-Type: application/yang-data+json" \ -H "Accept: application/yang-data+json" \ -d @"$TEMP_JSON" \ "https://192.168.30.1/restconf/operations/infix-system:install-bundle"
confd: Coding style
2026-07-22 09:13:01 +02:00 · 2025-07-11 16:33:02 +02:00 · 2025-07-11 16:33:01 +02:00 · 2025-07-11 16:26:33 +02:00 · 2025-07-11 13:40:58 +02:00 · 2025-07-09 11:52:54 +02:00
130 changed files with 3203 additions and 407 deletions
@@ -1,30 +1,51 @@
-name: Bob the Builder
+name: Build

 on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches:
-      - main
  workflow_dispatch:
    inputs:
-      minimal:
-        description: 'Build minimal defconfigs'
+      flavor:
+        description: 'Optional build flavor (e.g. _minimal)'
        required: false
-        default: true
-        type: boolean
-      parallell:
+        default: ''
+        type: string
+      parallel:
        description: 'Massive parallel build of each image'
        required: false
        default: true
        type: boolean
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        required: false
+        default: kernelkit/infix
+        type: string
+
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      flavor:
+        required: false
+        type: string
+        default: ''
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+
+env:
+  FLV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.flavor || inputs.flavor }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+
 jobs:
  build:
-    name: Build Infix ${{ matrix.target }}
+    name: Build ${{ inputs.name }} ${{ inputs.target }}
    runs-on: [ self-hosted, latest ]
    strategy:
-      matrix:
-        target: [aarch64, x86_64]
      fail-fast: false
    outputs:
      build_id: ${{ steps.vars.outputs.INFIX_BUILD_ID }}
@@ -36,8 +57,11 @@ jobs:
          rm -rf ./.??* || true
          ls -la ./

-      - uses: actions/checkout@v4
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
        with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ github.ref }}
          clean: true
          fetch-depth: 0
          submodules: recursive
@@ -55,26 +79,13 @@ jobs:
                  "${{ github.event.number }}" "${{ github.event.pull_request.head.sha }}" \
                  | tee -a $GITHUB_OUTPUT $GITHUB_ENV
          fi
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-              if [ "${{ github.event.inputs.minimal }}" == "true" ]; then
-                  flavor="_minimal"
-              fi
-          else
-              # Ensure 'release' job get the proper image when building main
-              if [ "$GITHUB_REF_NAME" != "main" ]; then
-                  flavor="_minimal"
-              else
-                  flavor=""
-              fi
-              if ${{ contains(github.event.pull_request.labels.*.name, 'ci:main') }}; then
-                  flavor=""
-              fi
-          fi
-          target=${{ matrix.target }}
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-          echo "flv=$flavor"              >> $GITHUB_OUTPUT
-          echo "Building target ${target}${flavor}_defconfig"
+
+          target=${{ inputs.target }}
+          name=${{ inputs.name }}
+          echo "dir=${name}-${target}"        >> $GITHUB_OUTPUT
+          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
+          echo "flv=$FLV"              >> $GITHUB_OUTPUT
+          echo "Building target ${target}${FLV}_defconfig"

      - name: Restore Cache of dl/
        uses: actions/cache@v4
@@ -88,16 +99,16 @@ jobs:
        uses: actions/cache@v4
        with:
          path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ inputs.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
          restore-keys: |
-            ccache-${{ matrix.target }}-
+            ccache-${{ inputs.target }}-
            ccache-

-      - name: Configure ${{ matrix.target }}${{ steps.vars.outputs.flv }}
+      - name: Configure ${{ inputs.target }}${{ steps.vars.outputs.flv }}
        run: |
-          make ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig
+          make ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig

-      - name: Unit Test ${{ matrix.target }}
+      - name: Unit Test ${{ inputs.target }}
        run: |
          make test-unit

@@ -115,9 +126,9 @@ jobs:
          fi
          echo "MAKE=$MAKE" >> $GITHUB_OUTPUT

-      - name: Build ${{ matrix.target }}${{ steps.vars.outputs.flv }}
+      - name: Build ${{ inputs.target }}${{ steps.vars.outputs.flv }}
        run: |
-          echo "Building ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
+          echo "Building ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
          eval "${{ steps.parallel.outputs.MAKE }}"

      - name:  Check SBOM from Build
@@ -139,7 +150,7 @@ jobs:
          printf "Size of output/images/: "
          ls -l output/images/

-      - name: Prepare ${{ matrix.target }} Artifact
+      - name: Prepare ${{ inputs.target }} Artifact
        run: |
          cd output/
          mv images ${{ steps.vars.outputs.dir }}
@@ -149,111 +160,4 @@ jobs:
      - uses: actions/upload-artifact@v4
        with:
          path: output/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ matrix.target }}
-
-  test:
-    name: Regression Test of Infix x86_64
-    needs: build
-    runs-on: [ self-hosted, regression ]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          clean: true
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
-              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
-                   >>$GITHUB_ENV
-          fi
-
-          if [ "$GITHUB_REF_NAME" != "main" ]; then
-              flavor="_minimal"
-          else
-              flavor=""
-          fi
-          echo "flv=$flavor"              >> $GITHUB_OUTPUT
-
-      - name: Configure x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          make x86_64${{ steps.vars.outputs.flv }}_defconfig
-
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
-        run: |
-          ls -l
-          mkdir -p output
-          mv infix-x86_64.tar.gz output/
-          cd output/
-          tar xf infix-x86_64.tar.gz
-          ln -s infix-x86_64 images
-
-      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          make test
-
-      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: cat test/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: |
-          asciidoctor-pdf \
-          --theme test/9pm/report/theme.yml \
-          -a pdf-fontsdir=test/9pm/report/fonts \
-          test/.log/last/report.adoc \
-          -o test/.log/last/report.pdf
-
-      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-report
-          path: test/.log/last/report.pdf
-
-  release:
-    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
-    name: Upload Latest Build
-    needs: test
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
-      - uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Latest Build Complete! :rocket:
-
-          For the public download links of these build artifacts, please see:
-           <https://github.com/kernelkit/infix/releases/tag/latest>
-          EOF
+          name: artifact-${{ inputs.target }}
@@ -0,0 +1,43 @@
+name: Publish latest Infix
+
+on:
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  publish:
+    name: Upload Latest Build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          omitName: true
+          omitBody: true
+          omitBodyDuringUpdate: true
+          prerelease: true
+          tag: "latest"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          artifacts: "*.tar.gz*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Latest Build Complete! :rocket:
+
+          For the public download links of these build artifacts, please see:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+          EOF
@@ -0,0 +1,116 @@
+name: Test Infix
+
+on:
+  workflow_dispatch:
+    inputs:
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        required: false
+        default: kernelkit/infix
+        type: string
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      flavor:
+        required: false
+        type: string
+        default: ''
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+      ninepm-conf:
+        required: false
+        type: string
+        default: ''
+      test-path:
+        required: false
+        type: string
+        default: 'test'
+
+env:
+  FLV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.flavor || inputs.flavor }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
+  TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}
+
+jobs:
+  test:
+    name: Regression Test ${{ inputs.name }} ${{ inputs.target }}
+    runs-on: [ self-hosted, regression ]
+    steps:
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ github.ref }}
+          clean: true
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set Build Variables
+        id: vars
+        run: |
+          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
+              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
+                   >>$GITHUB_ENV
+          fi
+
+          echo "flv=$FLV" >> $GITHUB_OUTPUT
+
+      - name: Configure ${{ inputs.target }}${{ steps.vars.outputs.flv }}
+        run: |
+          make ${{ inputs.target }}${{ steps.vars.outputs.flv }}_defconfig
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
+        run: |
+          target=${{ inputs.target }}
+          name=${{ inputs.name }}
+
+          ls -l
+          mkdir -p output
+          mv ${name}-${target}.tar.gz output/
+          cd output/
+          tar xf ${name}-${target}.tar.gz
+          ln -s ${name}-${target} images
+
+      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
+        run: |
+          if [ -n "$NINEPM_CONF" ]; then
+            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
+            echo "DEBUG: NINEPM_PROJ_CONFIG is '$NINEPM_PROJ_CONFIG'"
+          fi
+          make test
+
+      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+
+      - name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: |
+          asciidoctor-pdf \
+          --theme $TEST_PATH/9pm/report/theme.yml \
+          -a pdf-fontsdir=$TEST_PATH/9pm/report/fonts \
+          $TEST_PATH/.log/last/report.adoc \
+          -o $TEST_PATH/.log/last/report.pdf
+
+      - name: Upload Test Report as Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-report
+          path: ${{ env.TEST_PATH }}/.log/last/report.pdf
+
@@ -0,0 +1,37 @@
+name: Self Trigger
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches:
+      - main
+      - ci-workflow-redesign
+  workflow_dispatch:
+
+jobs:
+  build-x86_64:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: "x86_64"
+      name: "infix"
+      flavor: "_minimal"
+
+  build-aarch64:
+    uses: ./.github/workflows/build.yml
+    with:
+      target: "aarch64"
+      name: "infix"
+      flavor: "_minimal"
+
+  test-run-x86_64:
+    needs: build-x86_64
+    uses: ./.github/workflows/test.yml
+    with:
+      target: "x86_64"
+      name: "infix"
+
+  test-publish-x86_64:
+    needs: test-run-x86_64
+    uses: ./.github/workflows/publish.yml
+
@@ -65,7 +65,7 @@ config INFIX_COMPATIBLE

 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix -- a Network Operating System"
+	default "Infix OS — Immutable.Friendly.Secure"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.
@@ -2,11 +2,11 @@

 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>

-Infix is a free, Linux based, immutable Network Operating System (NOS)
-built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
-porting to different platforms, simplify long-term maintenance, and
-provide made-easy management using NETCONF, RESTCONF[^2], or the
-built-in command line interface (CLI) from a console or SSH login.
+Infix is a free, Linux-based, immutable operating system built around
+[Buildroot][1] and [sysrepo][2].  A powerful mix that ease porting to
+different platforms, simplify long-term maintenance, and provide
+made-easy management using NETCONF, RESTCONF[^2], or the built-in
+command line interface (CLI) from a console or SSH login.

 > Click the **▶ Example CLI Session** foldout below for an example, or
 > head on over to the [Infix Documentation](doc/README.md) for more
@@ -27,13 +27,15 @@ it maintenance-free.  Configuration and data, e.g, containers, is stored
 on separate partitions to ensure complete separation from system files
 and allow for seamless backup, restore, and provisioning.

-In itself, Infix is perfectly suited for dedicated networking tasks, and
-with native support for Docker containers, the operating system provides
-a versatile platform that can easily be adapted to any customer need.
-Be it legacy applications, network protocols, process monitoring, or
-edge data analysis, it can run close to end equipment.  Either directly
-connected on dedicated Ethernet ports or indirectly using virtual
-network cables to exist on the same LAN as other connected equipment.
+In itself, Infix is perfectly suited for dedicated networking tasks,
+such as routing, switching, and monitoring.  This is how it started, as
+a network focused operating system.  Now, with native support for Docker
+containers, it provides a versatile platform that can easily be adapted
+to any customer need.  Be it legacy applications, network protocols,
+process monitoring, or edge data analysis, it can run close to end
+equipment.  Either directly connected on dedicated Ethernet ports or
+indirectly using virtual network cables to exist on the same LAN as
+other connected equipment.

 The simple design of Infix provides complete control over both system
 and data, minimal cognitive burden, and makes it incredibly easy to get
@@ -45,11 +45,11 @@ The default credentials for the demo builds is
    login: admin
    password: admin

-    Infix -- a Network Operating System v24.09.0-rc1 (hvc0)
+    Infix OS — Immutable.Friendly.Secure v24.09.0-rc1 (hvc0)
    infix-00-00-00 login: admin
    Password: 
    .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
    |-. v .-| https://kernelkit.org
    '-'---'-'

@@ -122,9 +122,9 @@ There's a lot of tutorials and guides online, start here:
 About
 -----

-Infix is a free, Linux based, immutable Network Operating System (NOS)
-built on Buildroot, and sysrepo.  A powerful mix that ease porting to
-different platforms, simplify long-term maintenance, and provide easy
-management using NETCONF, RESTCONF, or the built-in command line
-interface (CLI) from a console or SSH login.
+Infix is a free, Linux-based, immutable operating system built around
+Buildroot, and sysrepo.  A powerful mix that ease porting to different
+platforms, simplify long-term maintenance, and provide easy management
+using NETCONF, RESTCONF, or the built-in command line interface (CLI)
+from a console or SSH login.

@@ -78,7 +78,7 @@ config QEMU_MACHINE

 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
-	default "384M"
+	default "448M"
 	help
 	  The default, 384 MiB, works for most configurations.  However,
 	  if you get kernel panic with: "System is deadlocked on memory",
@@ -0,0 +1,5 @@
+service name:wpa_supplicant :%i \
+			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+			       -- WPA supplicant @%i
+
+task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i
@@ -1,4 +1,4 @@
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'
@@ -1,5 +1,11 @@
 # /telemetry/optics is for streaming (not used atm)
+# Proxy buffer settings for large files
+proxy_buffering off;                 # Disable buffering for streaming
+proxy_request_buffering off;         # Stream request body immediately
+proxy_max_temp_file_size 0;         # No temp files
 location ~ ^/(restconf|yang|.well-known)/ {
+    client_max_body_size 200M;
+    client_body_buffer_size 1M;
    grpc_pass grpc://[::1]:10080;
    grpc_set_header Host $host;
    grpc_set_header X-Real-IP $remote_addr;
@@ -0,0 +1 @@
+SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+if [ $# -ne 1 ]; then
+	echo "usage: $0 <ifname>"
+	exit 1
+fi
+ifname=$1
+
+TIMEOUT=300
+status=$(wpa_cli -i $ifname scan)
+while [ "$status" != "OK" ]; do
+	status=$(wpa_cli -i $ifname scan)
+	TIMEOUT=$((TIMEOUT-1))
+	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
+	sleep 0.5
+done
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -126,7 +126,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -165,6 +165,8 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -108,7 +108,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -29,7 +29,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
@@ -170,7 +170,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-r2s"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -162,7 +162,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -29,7 +29,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_PATCH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711-rpi-4-b-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711_defconfig"
@@ -163,7 +163,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-rpi4"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -132,7 +132,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -167,6 +167,8 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -115,7 +115,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -3,6 +3,31 @@ Change Log

 All notable changes to the project are documented in this file.

+[v25.06.0][] - 2025-07-01
+-------------------------
+
+### Changes
+- Upgrade Buildroot to 2025.02.4 (LTS)
+- Upgrade Linux kernel to 6.12.35 (LTS)
+- Upgrade curiOS built-in containers to v25.06.0
+- Add support for setting mode of a container content mount, issue #1070
+- Add Wi-Fi client support and add support for some USB-Wi-Fi cards
+- New slogan: Infix OS — Immutable.Friendly.Secure
+
+### Fixes
+- cli: fix by-word movement, detect word barrier using non-alphanum chars
+- cli: fix delete word left/right, make sure to save word in kill buffer
+
+
+[v25.05.1][] - 2025-06-12
+-------------------------
+
+### Changes
+- Upgrade Linux kernel to 6.12.32 (LTS)
+
+### Fixes
+- Fix #1060: Restore of missing CLI commands, regression in Infix v25.05.0
+
 [v25.05.0][] - 2025-05-27
 -------------------------

@@ -1569,7 +1594,8 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.05.0...HEAD
+[v25.06.0]:   https://github.com/kernelkit/infix/compare/v25.05.1...v26.06.0
+[v25.05.1]:   https://github.com/kernelkit/infix/compare/v25.05.0...v25.05.1
 [v25.05.0]:   https://github.com/kernelkit/infix/compare/v25.04.0...v25.05.0
 [v25.04.0]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
 [v25.03.0]:   https://github.com/kernelkit/infix/compare/v25.02.0...v25.03.0
@@ -1,7 +1,7 @@
 <img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>

-Welcome to Infix, your friendly Network Operating System!  On these
-pages you can find both user and developer documentation.
+Welcome to Infix, your immutable, friendly, and secure operating system!
+On these pages you can find both user and developer documentation.

 Most topics on configuring the system include CLI examples, but every
 setting, as well as status read-back from the operational datastore, is
@@ -214,7 +214,7 @@ text file without line breaks (`-w0`):
 ```bash
 $ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" |base64 -d
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.github.io
 '-'---'-'
 ```
@@ -168,36 +168,36 @@ Now you can rebuild `confd`, just as described above, and restart Infix:

 ### `statd`

-The Infix status daemon, `src/statd`, is responsible for populating the 
-sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions, 
-but unlike `confd`, it relies entirely on `yanger`, a Python script that 
+The Infix status daemon, `src/statd`, is responsible for populating the
+sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions,
+but unlike `confd`, it relies entirely on `yanger`, a Python script that
 gathers data from local linux services and feeds it into sysrepo.

 To apply changes, rebuild the image:

    make python-statd-rebuild statd-rebuild all

-Rebuilding the image and testing on target for every change during 
-development process can be tedious. Instead, `yanger` allows remote 
-execution, running the script directly on the host system (test 
+Rebuilding the image and testing on target for every change during
+development process can be tedious. Instead, `yanger` allows remote
+execution, running the script directly on the host system (test
 container):

    infamy0:test # ../src/statd/python/yanger/yanger -x "../utils/ixll -A ssh d3a" ieee802-dot1ab-lldp

 `ixll` is a utility script that lets you run network commands using an
-**interface name** instead of a hostname. It makes operations like 
+**interface name** instead of a hostname. It makes operations like
 `ssh`, `scp`, and network discovery easier.

-Normally, `yanger` runs commands **locally** to retrieve data 
-(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when 
-executed with `-x "../utils/ixll -A ssh d3a"` it redirects these 
-commands to a remote system connected to the local `d3a` interface via 
-SSH. This setup is used for running `yanger` in an 
+Normally, `yanger` runs commands **locally** to retrieve data
+(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when
+executed with `-x "../utils/ixll -A ssh d3a"` it redirects these
+commands to a remote system connected to the local `d3a` interface via
+SSH. This setup is used for running `yanger` in an
 [interactive test environment](testing.md#interactive-usage). The yanger
-script runs on the `host` system, but key commands are executed on the 
+script runs on the `host` system, but key commands are executed on the
 `target` system.

-For debugging or testing, you can capture system command output and 
+For debugging or testing, you can capture system command output and
 replay it later without needing a live system.

 To capture:
@@ -211,12 +211,173 @@ To replay:
 This is especially useful when working in isolated environments or debugging
 issues without direct access to the DUT.

+### Upgrading Packages
+
+#### Buildroot
+
+Kernelkit maintains an internal [fork of
+Buildroot](https://github.com/kernelkit/buildroot), with branches
+following the naming scheme `YYYY.MM.patch-kkit`
+e.g. `2025.02.1-kkit`, which means a new branch should be created
+whenever Buildroot is updated. These branches should contain **only**
+changes to existing packages (but no new patches), modifications to
+Buildroot itself or upstream backports.
+
+KernelKit track the latest Buildroot LTS (Long-Term Support) release
+and updates. The upgrade of LTS minor releases is expected to have low
+impact and should be done as soon there is a patch release of
+Buildroot LTS is available.
+
+> **Depending on your setup, follow the appropriate steps below.**
+
+🔁 If you **already have** the Buildroot repo locally
+
+1. Navigate to the Buildroot directory
+   ```bash
+    $ cd buildroot
+   ```
+2. Pull the latest changes from KernelKit
+   ```bash
+   $ git pull
+   ```
+3. Fetch the latest tags from upstream
+   ```bash
+   $ git fetch upstream --tags
+   ```
+
+
+🆕 If you don't have the repo locally
+
+1. Clone the Kernelkit Buildroot repository
+   ```bash
+   $ git clone git@github.com:kernelkit/buildroot.git
+   ```
+
+2. Add the upstream remote
+   ```bash
+   $ git remote add upstream https://gitlab.com/buildroot.org/buildroot.git
+   ```
+3. Checkout old KernelKit branch
+   ```bash
+   $ git checkout 2025.02.1-kkit
+   ```
+
+
+🛠  Continue from here (applies to both cases):
+
+4. Create a new branch based on the **previous** KernelKit Buildroot
+   release (e.g.  `2025.02.1-kkit`) and name it according to the naming scheme (e.g. `2025.02.2-kkit`)
+   ```bash
+   $ git checkout -b 2025.02.2-kkit
+   ```
+5. Rebase the new branch onto the corresponding upstream release
+   ```bash
+   $ git rebase 2025.02.2
+   ```
+> [!NOTE] It is **not** allowed to rebase the branch when bumped in Infix.
+
+6. Push the new branch and tags
+   ```bash
+   $ git push origin 2025.02.2-kkit --tags
+   ```
+7. In Infix, checkout new branch of Buildroot
+   ```bash
+   $ cd buildroot
+   $ git fetch
+   $ git checkout 2025.02.2-kkit
+   ```
+8. Push changes
+Commit and push the changes. Don’t forget to update the changelog.
+
+9. Create a pull request.
+
+> [!NOTE] Remember to set the pull request label to `ci:main` to ensure full CI coverage.
+
+
+#### Linux kernel
+
+KernelKit maintains an internal [fork of Linux
+kernel](https://github.com/kernelkit/linux), with branches following
+the naming scheme `kkit-linux-[version].y`, e.g. `kkit-6.12.y`, which
+means a new branch should be created whenever the major kernel version
+is updated. This branch should contain *all* kernel patches used by
+Infix.
+
+KernelKit track the latest Linux kernel LTS (Long-Term Support)
+release and updates. The upgrade of LTS minor releases is expected to
+have low impact and should be done as soon as a patch release of the
+LTS Linux kernel is available.
+
+
+🔁 If you **already have** the Linux kernel repo locally
+
+1. Navigate to the Linux kernel directory
+   ```bash
+   $ cd linux
+   ```
+2. Get latest changes from KernelKit
+   ```bash
+   $ git pull
+   ```
+3. Fetch the latest tags from upstream
+   ```bash
+   $ git fetch upstream --tags
+   ```
+
+🆕 If you don't have the repo locally
+
+1. Clone the KernelKit Linux kernel repository
+   ```bash
+   $ git clone git@github.com:kernelkit/linux.git
+	```
+2. Add the upstream remote
+   ```bash
+   $ git remote add upstream git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+   ```
+
+3. Checkout correct kernel branch
+   ```bash
+   $ git checkout kkit-linux-6.12.y
+   ```
+
+🛠  Continue from here (applies to both cases)
+
+
+4. Rebase on the upstream release
+   ```bash
+   $ git rebase v6.12.29
+   ```
+
+6. Push changes and the tags
+   ```bash
+
+   $ git push -f origin kkit-linux-6.12.y --tags
+   ```
+
+**Move to your infix directory**
+
+7. Generate patches
+   ```bash
+   $ make x86_64_defconfig
+   $ cd output
+   $ ../utils/kernel-refresh.sh -k /path/to/linux -o 6.12.28 -t v6.12.29
+   ```
+   > [!NOTE] See help of `kernel-refresh.sh` script for more information
+
+
+8. Push changes
+   Commit and push the changes. Don’t forget to update the s:changelog:doc/ChangeLog.md.
+
+9. Create a pull request.
+   > [!NOTE] Remember to set the pull request label to `ci:main` to ensure full CI coverage.
+
+
 ### Agree on YANG Model

 When making changes to the `confd` and `statd` services, you will often need to update
-the YANG models. If you are adding a new YANG module, it's best to follow the 
+the YANG models. If you are adding a new YANG module, it's best to follow the
 structure of an existing one. However, before making any changes, **always discuss
-them with the Infix core team**. This helps avoid issues later in development and 
+them with the Infix core team**. This helps avoid issues later in development and
 makes pull request reviews smoother.


@@ -294,7 +294,7 @@ rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
 linux-pc:# ssh admin@infix-c0-ff-ee.local
 (admin@infix-c0-ff-ee.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-

@@ -334,7 +334,7 @@ rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
 linux-pc:# ssh admin@infix.local
 (admin@infix.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-

@@ -79,11 +79,11 @@ typically setup to run at 115200 baud, 8N1.


 ```
-Infix -- a Network Operating System v24.11.1 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v24.11.1 (ttyS0)
 example login: admin
 Password:
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -92,7 +92,7 @@ Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
 Warning: Permanently added 'fe80::ff:fe00:0%eth0' (ED25519) to the list of known hosts.
 admin@fe80::ff:fe00:0%eth0's password: *****
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -1263,7 +1263,7 @@ It should now be possible to access the switch from the PC via SSH (or NETCONF).
 ~ $ ssh admin@fe80::0053:00ff:fe06:1101%eth1
 admin@fe80::0053:00ff:fe06:1101%eth1's password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -427,11 +427,11 @@ admin@example:/> reboot
 [ OK ] Update DNS configuration
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.03.1 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.03.1 (ttyS0)
 example login: admin
 Password:
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -638,7 +638,7 @@ admin@example:/> reboot
 [ OK ] Verifying self-signed https certificate
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
 example login:
 ```
 > [!NOTE]
@@ -695,7 +695,7 @@ admin@example:/> reboot
 [ OK ] Verifying self-signed https certificate
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)

 ERROR: Corrupt startup-config, system has reverted to default login credentials
 failed-00-00-00 login:
@@ -738,7 +738,7 @@ Reboot now to perform reset, (y/N)? y

 Please press Enter to activate this console.

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
 example login:
 ```

@@ -123,11 +123,11 @@ there is another helper script in Infamy for this:
    Trying 127.0.0.1...
    Connected to 127.0.0.1.

-    Infix -- a Network Operating System v23.11.0-226-g0c144da (console)
+    Infix OS — Immutable.Friendly.Secure v23.11.0-226-g0c144da (console)
    infix-00-00-00 login: admin
    Password:
    .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
    |-. v .-| https://kernelkit.org
    '-'---'-'

@@ -0,0 +1,152 @@
+# Wi-Fi (Wireless LAN)
+
+Infix includes built-in Wi-Fi client support for connecting to
+wireless networks. When a compatible Wi-Fi adapter is detected, the
+system automatically begins scanning for available networks.
+
+## Current Limitations
+
+- Only client mode is supported (no access point functionality)
+- USB hotplug is not supported - adapters must be present at boot
+- Interface naming may be inconsistent with multiple USB Wi-Fi adapters
+
+## Supported Wi-Fi Adapters
+
+Wi-Fi support is primarily tested with Realtek chipset-based adapters.
+
+### Known Working Chipsets
+
+- RTL8821CU
+- Other Realtek chipsets may work but are not guaranteed
+
+
+> [!NOTE]  Some Realtek chipsets require proprietary drivers not included in the standard kernel
+>          Firmware requirements vary by chipset
+>          Check kernel logs if your adapter is not detected
+
+## Configuration
+
+Add a supported Wi-Fi network device. To verify that it has been
+detected, look for `wifi0` in `show interfaces`
+
+```
+admin@example:/>  show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   DOWN        f0:09:0d:36:5f:86
+                wifi                   ssid: ------, signal: ------
+
+```
+Add the new Wi-Fi interface to the configuration to start scanning.
+```
+admin@example:/config/> set interface wifi0
+admin@example:/config/> leave
+```
+Now the system will now start scanning in the background. To
+see the result read the operational datastore for interface `wifi0` or
+use the CLI
+
+```
+admin@infix-00-00-00:/> show interfaces name wifi0
+name                : wifi0
+type                : wifi
+index               : 3
+mtu                 : 1500
+operational status  : down
+physical address    : f0:09:0d:36:5f:86
+ipv4 addresses      :
+ipv6 addresses      :
+SSID                : ----
+Signal              : ----
+
+SSID                                    ENCRYPTION                    SIGNAL
+ssid1                                   WPA2-Personal                 excellent
+ssid2                                   WPA2-Personal                 excellent
+ssid3                                   WPA2-Personal                 excellent
+ssid4                                   WPA2-Personal                 good
+ssid5                                   WPA2-Personal                 good
+ssid6                                   WPA2-Personal                 good
+```
+
+In the CLI, signal strength is reported as: excellent, good, poor or
+bad. For precise values, use NETCONF or RESTCONF, where the RSSI (in
+dBm) is available in the operational datastore.
+
+Configure your Wi-Fi secret in the keystore, it should be between 8
+and 63 characters
+
+```
+admin@example:/> configure
+admin@example:/config/> edit keystore symmetric-key example
+admin@example:/config/keystore/symmetric-key/example/> set key-format wifi-preshared-key-format
+admin@example:/config/keystore/symmetric-key/example/> set cleartext-key mysecret
+admin@example:/config/keystore/symmetric-key/example/> leave
+admin@example:/>
+```
+
+Configure the Wi-Fi settings, set secret to the name selected above
+for the symmetric key, in this case `example`.
+
+WPA2 or WPA3 encryption will be automatically selected based on what
+the access point supports. No manual selection is required unless
+connecting to an open network. No support for certificate based
+authentication yet.
+
+Unencrypted network is also supported, to connect to an unencrypted
+network (generally not recommended):
+```
+admin@example:/config/interface/wifi0/> set wifi encryption disabled
+```
+
+A valid `country-code` is also required for regulatory compliance, the
+valid codes are documented in the YANG model `infix-wifi-country-codes`
+
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface wifi0
+admin@example:/config/interface/wifi0/>
+admin@example:/config/interface/wifi0/> set wifi ssid ssid1
+admin@example:/config/interface/wifi0/> set wifi secret example
+admin@example:/config/interface/wifi0/> set wifi country-code SE
+admin@example:/config/interface/wifi0/> leave
+```
+
+The Wi-Fi negotiation should now start immediately, provided that the
+SSID and pre-shared key are correct. You can verify the connection by
+running `show interfaces` again.
+
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   UP          f0:09:0d:36:5f:86
+                wifi                   ssid: ssid1, signal: excellent
+
+admin@example:/>
+```
+
+## Troubleshooting Connection Issues
+
+Use `show wifi scan wifi0` and `show interfaces` to verify signal strength
+and connection status. If issues arise, try the following
+troubleshooting steps:
+
+1. **Verify signal strength**: Check that the target network shows "good" or "excellent" signal
+2. **Check credentials**: Verify the preshared key in `ietf-keystore`
+3. **Review logs**: Check system logs with `show log` for Wi-Fi related errors
+4. **Regulatory compliance**: Ensure the country-code matches your location
+5. **Hardware detection**: Confirm the adapter appears in `show interfaces`
+
+If issues persist, check the system log for specific error messages that can help identify the root cause.
@@ -2,6 +2,7 @@ menu "Packages"

 comment "Hardware Support"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/feature-wifi/Config.in"

 comment "Software Packages"
 source "$BR2_EXTERNAL_INFIX_PATH/package/bin/Config.in"
@@ -42,5 +43,4 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rauc-installation-status/Config.in"
-
 endmenu
@@ -25,6 +25,11 @@ else
 CONFD_CONF_OPTS += --disable-containers
 endif

+ifeq ($(BR2_PACKAGE_FEATURE_WIFI),y)
+CONFD_CONF_OPTS += --enable-wifi
+else
+CONFD_CONF_OPTS += --disable-wifi
+endif
 define CONFD_INSTALL_EXTRA
 	for fn in confd.conf resolvconf.conf; do \
 		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
@@ -69,6 +74,12 @@ define CONFD_INSTALL_YANG_MODULES_CONTAINERS
 	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/containers.inc
 endef
 endif
+ifeq ($(BR2_PACKAGE_FEATURE_WIFI),y)
+define CONFD_INSTALL_YANG_MODULES_WIFI
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/wifi.inc
+endef
+endif

 # PER_PACKAGE_DIR
 # Since the last package in the dependency chain that runs sysrepoctl is confd, we need to
@@ -97,6 +108,7 @@ CONFD_PRE_BUILD_HOOKS += CONFD_CLEANUP
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_EXTRA
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WIFI
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_IN_ROMFS
 CONFD_TARGET_FINALIZE_HOOKS += CONFD_CLEANUP

@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  3e7f777a054fbc29173bcdafe50ca096a8abf9e556bec9f52617c9881c9ce3e3  curios-httpd-oci-arm64-v24.11.0.tar.gz
-sha256  bfa52f712301427a21b89cfee31ca315e1404973affaf34b23978a70a3ec4f63  curios-httpd-oci-amd64-v24.11.0.tar.gz
+sha256  c4995c0a7a96d5273c97c7c026c03ff5e2a42cade6d66808fdeba0fae9a343d8  curios-httpd-oci-arm64-v25.06.0.tar.gz
+sha256  4d48a03b38eabe558052ecbab7560e6d9f995311eb91b90ddaac336b5f001a5e  curios-httpd-oci-amd64-v25.06.0.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CURIOS_HTTPD_VERSION = v24.11.0
+CURIOS_HTTPD_VERSION = v25.06.0
 CURIOS_HTTPD_SOURCE = curios-httpd-oci-$(GO_GOARCH)-$(CURIOS_HTTPD_VERSION).tar.gz
 CURIOS_HTTPD_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_HTTPD_VERSION)
 CURIOS_HTTPD_LICENSE = GPL
@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  95b3625587738cb0a8cc6e9eb41d10a0b2f77ae99dbb1d9b213148d35268eb75  curios-nftables-oci-arm64-v24.11.0.tar.gz
-sha256  4f61ccef90721b8f95a5c7b77b69ccccb5dbd215b9c38986d20e5b245244e902  curios-nftables-oci-amd64-v24.11.0.tar.gz
+sha256  94c7173fe4b8e64dcb1e0f67b974c23753ccce73bc07212a87e35f41a41ae5b8  curios-nftables-oci-arm64-v25.06.0.tar.gz
+sha256  feceb82327cccb4433db63e469f6ed115c10c0266242f0171b85ae1a88472757  curios-nftables-oci-amd64-v25.06.0.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CURIOS_NFTABLES_VERSION = v24.11.0
+CURIOS_NFTABLES_VERSION = v25.06.0
 CURIOS_NFTABLES_SOURCE = curios-nftables-oci-$(GO_GOARCH)-$(CURIOS_NFTABLES_VERSION).tar.gz
 CURIOS_NFTABLES_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_NFTABLES_VERSION)
 CURIOS_NFTABLES_LICENSE = GPL
@@ -0,0 +1,20 @@
+config BR2_PACKAGE_FEATURE_WIFI
+	bool "Feature Wi-Fi"
+	select BR2_PACKAGE_WPA_SUPPLICANT
+	select BR2_PACKAGE_WPA_SUPPLICANT_WPA3
+	select BR2_PACKAGE_WPA_SUPPLICANT_DEBUG_SYSLOG
+	select BR2_PACKAGE_WPA_SUPPLICANT_AUTOSCAN
+	select BR2_PACKAGE_WPA_SUPPLICANT_CLI
+	select BR2_PACKAGE_WIRELESS_REGDB
+	select BR2_PACKAGE_IW
+	help
+	  Enables WiFi in Infix. Enables all requried applications.
+
+config BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK
+       bool "Realtek USB WiFi Dongles"
+       depends on BR2_PACKAGE_FEATURE_WIFI
+       select BR2_PACKAGE_LINUX_FIRMWARE
+       select BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88
+       select BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW89
+       help
+         Enables Support for RTW88 and RTW89 USB dongles.
@@ -0,0 +1,42 @@
+################################################################################
+#
+# Wi-Fi support
+#
+################################################################################
+
+FEATURE_WIFI_PACKAGE_VERSION = 1.0
+FEATURE_WIFI_PACKAGE_LICENSE = MIT
+
+define FEATURE_WIFI_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_WLAN)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RFKILL)
+	$(call KCONFIG_SET_OPT,CONFIG_MAC80211,m)
+	$(call KCONFIG_SET_OPT,CONFIG_CFG80211,m)
+
+	$(if $(filter y,$(BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK)),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_WLAN_VENDOR_REALTEK)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW89)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8703B)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723CS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723D)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723X)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821C)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822B)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822C)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822CU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822CE)
+	)
+endef
+
+
+$(eval $(generic-package))
@@ -28,7 +28,6 @@ KLISH_PLUGIN_INFIX_CONF_OPTS += --enable-shell
 else
 KLISH_PLUGIN_INFIX_CONF_OPTS += --disable-shell
 endif
-
 ifeq ($(BR2_PACKAGE_BASH),y)
 KLISH_PLUGIN_INFIX_CONF_OPTS += --with-shell=/bin/bash
 else
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  79c9b16b227320fea358114738933ea25be33f8f263d3eec1f83fb603c0c0b22  klish-019ebd2704e322b5d500f5687d526431e535eec8-git4.tar.gz
+sha256  eff4cc740c6cfe2c03f7aeee2092f16616575d1462b1ad67d9f476463a6bf3fe  klish-1c5ae4bbb49a0d7e1425ca1afe8518b873ee84cb-git4.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-KLISH_VERSION = 019ebd2704e322b5d500f5687d526431e535eec8
+KLISH_VERSION = 1c5ae4bbb49a0d7e1425ca1afe8518b873ee84cb
 KLISH_SITE = https://github.com/kernelkit/klish.git
 #KLISH_VERSION = tags/3.0.0
 #KLISH_SITE = https://src.libcode.org/pkun/klish.git
@@ -1,5 +1,5 @@
 # From https://github.com/troglobit/tetris/releases/
-sha256 2c6e17f927d4b73dca97c7d280d3848a515a87ca70ecdf072808561e47bf757c  tetris-1.4.0.tar.gz
+sha256 c19b3e5eea43891d55481de5530f5824131974a85fc2a18b8a977bcebcba8223  tetris-1.5.0.tar.gz

 # Locally calculated
 sha256 a84e2b5247b2013a69496eecdd16e6051c04f1f3cb259b5f6ca8e671101a1f94  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-TETRIS_VERSION = 1.4.0
+TETRIS_VERSION = 1.5.0
 TETRIS_SITE = https://github.com/troglobit/tetris/releases/download/$(TETRIS_VERSION)
 TETRIS_LICENSE = ISC
 TETRIS_LICENSE_FILES = LICENSE
@@ -1,8 +1,9 @@
-From 735a3f8537b65fbe5d2fe5e97beb485cffa1bbbe Mon Sep 17 00:00:00 2001
+From 072c2f0732bc1a55aaeb9b5319a71bb472e2fd7d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 01/27] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
 PPU on 6393X
+Organization: Wires

 In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,
@@ -1,8 +1,9 @@
-From a9cadaebc7868f3f37c343642e631e3db2ea27db Mon Sep 17 00:00:00 2001
+From 7b18b787450759f1c2507c7b65c81c3686040c90 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 02/27] net: dsa: mv88e6xxx: Improve indirect register access
 perf on 6393
+Organization: Wires

 When operating in multi-chip mode, the 6393 family maps a subset of
 commonly used global registers to the outermost address space (in
@@ -1,8 +1,9 @@
-From 5f8612dc0445ca95a7428bf7b837612406875b07 Mon Sep 17 00:00:00 2001
+From 379dd2a00dc647b034befead65b26e467e63ae75 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 03/27] net: dsa: mv88e6xxx: Honor ports being managed via
 in-band-status
+Organization: Wires

 Keep all link parameters in their unforced states when the port is
 declared as being managed via in-band-status, and let the MAC
@@ -1,8 +1,9 @@
-From 730dfa9a57604ff0b099cc5e244e42fdbebbe0d9 Mon Sep 17 00:00:00 2001
+From fd676f49b5aa5a1d372446be9ee01d1f126bcd54 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 04/27] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
 ports on 6393X
+Organization: Wires

 For packets with a DA in the IEEE reserved L2 group range, originating
 from a CPU, forward it as normal, rather than classifying it as
@@ -1,7 +1,8 @@
-From 8ce7a3a19676c148e6c247641000a5d5b86c6a3d Mon Sep 17 00:00:00 2001
+From 2aeb87ab82b7b9fb37e6b1c830dec5374158aa5d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 19:44:32 +0100
 Subject: [PATCH 05/27] net: dsa: mv88e6xxx: Add LED infrastructure
+Organization: Wires

 Parse DT for LEDs and register them for devices that support it,
 though no actual implementations exist yet.
@@ -1,7 +1,8 @@
-From 79741bd8278bf1958ef6f414e89d7052d1c9486b Mon Sep 17 00:00:00 2001
+From 3de6f58239d6b09c3fe1e0978a556481be8f3a95 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 21:59:35 +0100
 Subject: [PATCH 06/27] net: dsa: mv88e6xxx: Add LED support for 6393X
+Organization: Wires

 Trigger support:
 - "none"
@@ -1,8 +1,9 @@
-From 4ada7a3d2fa1fdb0abe4485a8f80a50c699d2607 Mon Sep 17 00:00:00 2001
+From f28803088158ddf97186f143f4bdc516e42e9354 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 07/27] net: dsa: tag_dsa: Use tag priority as initial
 skb->priority
+Organization: Wires

 Use the 3-bit priority field from the DSA tag as the initial packet
 priority on ingress to the CPU.
@@ -1,8 +1,9 @@
-From ef42cca1aee6a3756f6995368bf740d6c92e8ab4 Mon Sep 17 00:00:00 2001
+From bbbf265610459ec49afcde923d1872ca3e2ad679 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 08/27] net: dsa: Support MDB memberships whose L2 addresses
 overlap
+Organization: Wires

 Multiple IP multicast groups (32 for v4, 2^80 for v6) map to the same
 L2 address. This means that switchdev drivers may receive multiple MDB
@@ -1,7 +1,8 @@
-From 927b942567ad59e71b44095c054e1565e2e1a01f Mon Sep 17 00:00:00 2001
+From 797ed124853b8f0ef6d110e1633be2637c97c31d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 09/27] net: dsa: Support EtherType based priority overrides
+Organization: Wires

 ---
 include/net/dsa.h |  4 ++++
@@ -1,8 +1,9 @@
-From ef919d2970639d542534b6f27605c0a7d053e57f Mon Sep 17 00:00:00 2001
+From ea2d865a2101317e22c60143e891d643feac8e8c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 10/27] net: dsa: mv88e6xxx: Support EtherType based priority
 overrides
+Organization: Wires

 ---
 drivers/net/dsa/mv88e6xxx/chip.c    | 64 +++++++++++++++++++++++++++++
@@ -1,7 +1,8 @@
-From 06cf0fc089d4b4f4d0d00384d0b38bb87dca0494 Mon Sep 17 00:00:00 2001
+From a239baf492b7c4a1280562bb9478006627b73036 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 11/27] net: dsa: mv88e6xxx: Add mqprio qdisc support
+Organization: Wires

 Add support for attaching mqprio qdisc's to mv88e6xxx ports and use
 the packet's traffic class as the outgoing priority when no PCP bits
@@ -1,8 +1,9 @@
-From 44ff969f4646f5d6987c6c6afb33c9894116687d Mon Sep 17 00:00:00 2001
+From 60ac4461cef9b2024df52c23a040b100093ba1d7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 12/27] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
 are available
+Organization: Wires

 Switch the priority sourcing precdence to prefer VLAN PCP over IP
 DSCP, when both are available.
@@ -1,8 +1,9 @@
-From 868a65caca9a649616a9aef0e319f3744bda3df3 Mon Sep 17 00:00:00 2001
+From d3b20e07514928830034d4af2eb7660bfcacc1e0 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 13/27] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
 VLANs
+Organization: Wires

 Before this change, in a setup like the following, packets assigned to
 VLAN 10 were forwarded between the switch ports, even though the
@@ -1,8 +1,9 @@
-From 7e3b3153f5edfdcc7c4460744efbd3f8c0f4bf4b Mon Sep 17 00:00:00 2001
+From b4870c7df5d6659da439e8f1322dd5496a15445e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 14/27] net: phy: marvell10g: Support firmware loading on
 88X3310
+Organization: Wires

 When probing, if a device is waiting for firmware to be loaded into
 its RAM, ask userspace for the binary and load it over XMDIO.
@@ -1,8 +1,9 @@
-From 7769ff987e8619d012863851eb14dec613bee3fa Mon Sep 17 00:00:00 2001
+From 6161b59334064ebfc0b80b0214fa12e6d042400e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 15/27] net: phy: marvell10g: Fix power-up when strapped to
 start powered down
+Organization: Wires

 On devices which are hardware strapped to start powered down (PDSTATE
 == 1), make sure that we clear the power-down bit on all units
@@ -1,7 +1,8 @@
-From 3b64cbe7764bb3cb77953c8d0b8676c685c9f0b5 Mon Sep 17 00:00:00 2001
+From 403075caa172cf8e5c50346a86698b0a909a9263 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 16/27] net: phy: marvell10g: Add LED support for 88X3310
+Organization: Wires

 Pickup the LEDs from the state in which the hardware reset or
 bootloader left them, but also support further configuration via
@@ -1,8 +1,9 @@
-From 9b6d4099be8eb492d1ff46561b74f30688e53aef Mon Sep 17 00:00:00 2001
+From 84ca381445809f1d796c461a5b085ff4a3b7f93e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 17/27] net: phy: marvell10g: Support LEDs tied to a single
 media side
+Organization: Wires

 In a combo-port setup, i.e. where both the copper and fiber interface
 are available to the user, the LEDs may be physically located either
@@ -1,7 +1,8 @@
-From 8ca0ef48d4530da5cb6b807fd8b0901c916b0e8c Mon Sep 17 00:00:00 2001
+From 47eddfb80fd6bbbc186b0d8a93697c36840168e8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 18/27] net: phy: Do not resume PHY when attaching
+Organization: Wires

 The PHY should not start negotiating with its link-partner until
 explicitly instructed to do so.
@@ -19,7 +20,7 @@ administratively down.
 1 file changed, 1 deletion(-)

 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 8af44224480f..a2e386e9fafc 100644
+index 13dea33d86ff..25d0face304a 100644
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
@@ -1661,7 +1661,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
@@ -1,8 +1,9 @@
-From 848fdabbb0cd804dceac4ea34d47a422a65e7227 Mon Sep 17 00:00:00 2001
+From 761e5315fc2bac3809258e9719efd1475a73ac14 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 19/27] net: bridge: avoid classifying unknown multicast as
 mrouters_only
+Organization: Wires

 Unknown multicast, MAC/IPv4/IPv6, should always be flooded according to
 the per-port mcast_flood setting, as well as to detected and configured
@@ -152,10 +153,10 @@ index ceaa5a89b947..e54d648db7de 100644
 			br_multicast_flood(mdst, skb, brmctx, local_rcv, false);
 	}
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index b2ae0d2434d2..3137c1fcfc6a 100644
+index 733ff6b758f6..b1799e03403f 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
-@@ -3774,6 +3774,11 @@ static void br_multicast_err_count(const struct net_bridge *br,
+@@ -3835,6 +3835,11 @@ static void br_multicast_err_count(const struct net_bridge *br,
 	u64_stats_update_end(&pstats->syncp);
 }
 
@@ -167,7 +168,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 static void br_multicast_pim(struct net_bridge_mcast *brmctx,
 			     struct net_bridge_mcast_port *pmctx,
 			     const struct sk_buff *skb)
-@@ -3820,7 +3825,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
+@@ -3881,7 +3886,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
 
 	if (err == -ENOMSG) {
 		if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
@@ -177,7 +178,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 		} else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
 			if (ip_hdr(skb)->protocol == IPPROTO_PIM)
 				br_multicast_pim(brmctx, pmctx, skb);
-@@ -3889,7 +3895,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
+@@ -3950,7 +3956,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
 
 	if (err == -ENOMSG || err == -ENODATA) {
 		if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
@@ -188,7 +189,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 		    ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
 			br_ip6_multicast_mrd_rcv(brmctx, pmctx, skb);
 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index 041f6e571a20..40651b07df94 100644
+index 6a1bce8959af..ed5325c6add9 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
@@ -483,6 +483,7 @@ enum net_bridge_opts {
@@ -199,7 +200,7 @@ index 041f6e571a20..40651b07df94 100644
 };
 
 struct net_bridge {
-@@ -886,8 +887,8 @@ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb,
+@@ -887,8 +888,8 @@ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb,
 		bool local_rcv, bool local_orig);
 int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
 void br_flood(struct net_bridge *br, struct sk_buff *skb,
@@ -210,7 +211,7 @@ index 041f6e571a20..40651b07df94 100644
 
 /* return true if both source port and dest port are isolated */
 static inline bool br_skb_isolated(const struct net_bridge_port *to,
-@@ -1408,6 +1409,19 @@ static inline void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
+@@ -1410,6 +1411,19 @@ static inline void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
 {
 }
 
@@ -1,8 +1,9 @@
-From 930edf3bd31e77703ca805d816ed7b2cac695e44 Mon Sep 17 00:00:00 2001
+From 41c6eeb5c4042027eac70243dd28bcaf963ac6b8 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 20/27] net: bridge: Ignore router ports when forwarding L2
 multicast
+Organization: Wires

 Multicast router ports are either statically configured or learned from
 control protocol traffic (IGMP/MLD/PIM).  These protocols regulate IP
@@ -16,10 +17,10 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 1 file changed, 4 insertions(+), 1 deletion(-)

 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index 40651b07df94..e90b4f5cab76 100644
+index ed5325c6add9..0afb886b9a30 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
-@@ -1086,7 +1086,10 @@ br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
+@@ -1088,7 +1088,10 @@ br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
 	if (skb->protocol == htons(ETH_P_IPV6))
 		return rcu_dereference(hlist_first_rcu(&brmctx->ip6_mc_router_list));
 #endif
@@ -1,8 +1,9 @@
-From ec644e878010241f593bfccb2f7127dec6f69294 Mon Sep 17 00:00:00 2001
+From f831362d0a5717cbb18a9173defca6ec4d886377 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 21/27] net: bridge: drop delay for applying strict multicast
 filtering
+Organization: Wires

 This *local* patch drops the initial delay before applying strict multicast
 filtering, introduced in [1] and recently updated in [2].
@@ -24,7 +25,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2 files changed, 8 insertions(+), 38 deletions(-)

 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 3137c1fcfc6a..34be07a1fd00 100644
+index b1799e03403f..282105bdca85 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
@@ -1762,10 +1762,6 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t)
@@ -38,7 +39,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx,
 					    struct br_ip *ip,
 					    struct sk_buff *skb)
-@@ -3196,12 +3192,8 @@ int br_multicast_dump_querier_state(struct sk_buff *skb,
+@@ -3257,12 +3253,8 @@ int br_multicast_dump_querier_state(struct sk_buff *skb,
 
 static void
 br_multicast_update_query_timer(struct net_bridge_mcast *brmctx,
@@ -52,7 +53,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval);
 }
 
-@@ -3392,13 +3384,12 @@ static void
+@@ -3453,13 +3445,12 @@ static void
 br_ip4_multicast_query_received(struct net_bridge_mcast *brmctx,
 				struct net_bridge_mcast_port *pmctx,
 				struct bridge_mcast_other_query *query,
@@ -68,7 +69,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	br_ip4_multicast_mark_router(brmctx, pmctx);
 }
 
-@@ -3407,13 +3398,12 @@ static void
+@@ -3468,13 +3459,12 @@ static void
 br_ip6_multicast_query_received(struct net_bridge_mcast *brmctx,
 				struct net_bridge_mcast_port *pmctx,
 				struct bridge_mcast_other_query *query,
@@ -84,7 +85,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	br_ip6_multicast_mark_router(brmctx, pmctx);
 }
 #endif
-@@ -3467,7 +3457,7 @@ static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
+@@ -3528,7 +3518,7 @@ static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
 
 		br_ip4_multicast_query_received(brmctx, pmctx,
 						&brmctx->ip4_other_query,
@@ -93,7 +94,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 		goto out;
 	}
 
-@@ -3555,7 +3545,7 @@ static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
+@@ -3616,7 +3606,7 @@ static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
 
 		br_ip6_multicast_query_received(brmctx, pmctx,
 						&brmctx->ip6_other_query,
@@ -102,7 +103,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 		goto out;
 	} else if (!group) {
 		goto out;
-@@ -4063,8 +4053,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
+@@ -4124,8 +4114,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
 		    br_ip4_multicast_local_router_expired, 0);
 	timer_setup(&brmctx->ip4_other_query.timer,
 		    br_ip4_multicast_querier_expired, 0);
@@ -111,7 +112,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	timer_setup(&brmctx->ip4_own_query.timer,
 		    br_ip4_multicast_query_expired, 0);
 #if IS_ENABLED(CONFIG_IPV6)
-@@ -4072,8 +4060,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
+@@ -4133,8 +4121,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
 		    br_ip6_multicast_local_router_expired, 0);
 	timer_setup(&brmctx->ip6_other_query.timer,
 		    br_ip6_multicast_querier_expired, 0);
@@ -120,7 +121,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	timer_setup(&brmctx->ip6_own_query.timer,
 		    br_ip6_multicast_query_expired, 0);
 #endif
-@@ -4208,12 +4194,10 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
+@@ -4269,12 +4255,10 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
 {
 	del_timer_sync(&brmctx->ip4_mc_router_timer);
 	del_timer_sync(&brmctx->ip4_other_query.timer);
@@ -133,7 +134,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	del_timer_sync(&brmctx->ip6_own_query.timer);
 #endif
 }
-@@ -4641,8 +4625,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
+@@ -4728,8 +4712,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
 
 int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
 {
@@ -142,7 +143,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	val = !!val;
 
 	spin_lock_bh(&brmctx->br->multicast_lock);
-@@ -4653,19 +4635,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
+@@ -4740,19 +4722,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
 	if (!val)
 		goto unlock;
 
@@ -163,7 +164,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 #endif
 
 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index e90b4f5cab76..73b78c594564 100644
+index 0afb886b9a30..5b5b2c2442a5 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
@@ -78,7 +78,6 @@ struct bridge_mcast_own_query {
@@ -174,7 +175,7 @@ index e90b4f5cab76..73b78c594564 100644
 };
 
 /* selected querier */
-@@ -1164,8 +1163,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
+@@ -1166,8 +1165,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
 		own_querier_enabled = false;
 	}
 
@@ -1,8 +1,9 @@
-From d46286898fbadf40a2fe1f4e449a3acdaede788b Mon Sep 17 00:00:00 2001
+From 1e0eb62180058e98c7d18e3e04540925801e34b5 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 22/27] net: bridge: Differentiate MDB additions from
 modifications
+Organization: Wires

 Before this change, the reception of an IGMPv3 report (and analogously
 for MLDv2) that adds a new group, would trigger two MDB RTM_NEWMDB
@@ -40,7 +41,7 @@ index db7254d52d93..63508279df47 100644
 	RTM_NEWNSID = 88,
 #define RTM_NEWNSID RTM_NEWNSID
 diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
-index 1a52a0bca086..d5757ab72d2f 100644
+index 7e1ad229e133..3b1873e7c499 100644
 --- a/net/bridge/br_mdb.c
 +++ b/net/bridge/br_mdb.c
@@ -734,7 +734,7 @@ static int br_mdb_replace_group_sg(const struct br_mdb_config *cfg,
@@ -62,7 +63,7 @@ index 1a52a0bca086..d5757ab72d2f 100644
 	if (br_multicast_should_handle_mode(brmctx, cfg->group.proto))
 		br_multicast_star_g_handle_mode(pg, cfg->filter_mode);
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 34be07a1fd00..9c8bf38e0079 100644
+index 282105bdca85..aa97b07ed528 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
@@ -619,7 +619,7 @@ static void br_multicast_fwd_src_handle(struct net_bridge_group_src *src)
@@ -83,7 +84,7 @@ index 34be07a1fd00..9c8bf38e0079 100644
 	}
 out:
 	spin_unlock(&br->multicast_lock);
-@@ -2887,7 +2887,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge_mcast *brmctx,
+@@ -2948,7 +2948,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge_mcast *brmctx,
 			break;
 		}
 		if (changed)
@@ -92,7 +93,7 @@ index 34be07a1fd00..9c8bf38e0079 100644
 unlock_continue:
 		spin_unlock(&brmctx->br->multicast_lock);
 	}
-@@ -3029,7 +3029,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge_mcast *brmctx,
+@@ -3090,7 +3090,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge_mcast *brmctx,
 			break;
 		}
 		if (changed)
@@ -1,8 +1,9 @@
-From cd8e2556f6b220fd6795779a37fbd6ff3159dcaf Mon Sep 17 00:00:00 2001
+From 86a738ca46e019a8913d100138d8972681a65b4b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 23/27] nvmem: layouts: onie-tlv: Let device probe even when
 TLV is invalid
+Organization: Wires

 Before this change, probing an NVMEM device, expected to contain a
 valid TLV, would fail if it had not been provisioned yet. But an
@@ -1,7 +1,8 @@
-From bbd05c87d8a872731eb2f46ffc63bcddf80bbfca Mon Sep 17 00:00:00 2001
+From df19ceb2579bd87d58f2caab739d8ba678785f5c Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 29 Apr 2024 15:14:51 +0200
 Subject: [PATCH 24/27] usb: core: adjust log level for unauthorized devices
+Organization: Wires

 The fact that a USB device currently is not authorized is not an error,
 so let's adjust the log level so these messages slip below radar for the
@@ -1,8 +1,9 @@
-From 6612adb18ad9ec35d81b131ebcff0b358a993a62 Mon Sep 17 00:00:00 2001
+From eea7cb00b2e657445de9913736ff38b99ed0f9a5 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 16 Jan 2025 12:35:12 +0100
 Subject: [PATCH 25/27] net: dsa: mv88e6xxx: collapse disabled state into
 blocking
+Organization: Wires

 This patch changes the behavior of switchcore ports wrt. the port state.
 Instead of disabling the port, the driver now treats the disabled state
@@ -1,8 +1,9 @@
-From c95150639c61db088df0c7c2f9b0e18c0ef64550 Mon Sep 17 00:00:00 2001
+From 0e24579e619a9d3ebb03293822092e03d16d6ad2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 12 Feb 2025 22:03:14 +0100
 Subject: [PATCH 26/27] net: dsa: mv88e6xxx: Only activate LAG offloading when
 bridged
+Organization: Wires

 The current port isolation scheme for mv88e6xxx is detailed here:
 https://lore.kernel.org/netdev/20220203101657.990241-1-tobias@waldekranz.com/
@@ -1,8 +1,9 @@
-From 18d9518aba9afbd190e90a2661525bd4bf6d02d0 Mon Sep 17 00:00:00 2001
+From 73b60d31a3318344428842c7368b2f1eb0c05596 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 27/27] net: usb: r8152: add r8153b support for link/activity
 LEDs
+Organization: Wires

 This patch adds support for the link/activity LEDs on the NanoPi R2S
 and OrangePi R1 Plus.
@@ -18,7 +19,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 1 file changed, 8 insertions(+)

 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index 96fa3857d8e2..cddb025aa56b 100644
+index 2cab046749a9..c9947ad320ff 100644
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
@@ -41,6 +41,11 @@
@@ -1,2 +1,2 @@
 # Calculated with ../utils/kernel-refresh.sh
-sha256   df046a48971e40ce0b2e003e7e55b6b1e7da2912120eb216d5d6c8450c9cf82e  linux-6.12.30.tar.xz
+sha256   05f4e0b01dde578c3328eb539d305cccec7b84e939f6dd5f21fdaf5f313da748  linux-6.12.35.tar.xz
@@ -0,0 +1,232 @@
+From 9df1957e656940a50b844da879911ab5981ad1a9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= <lazzer@gmail.com>
+Date: Wed, 18 Jun 2025 21:21:18 +0200
+Subject: [PATCH] Add pidfile support when not daemonize
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Organization: Wires
+
+Adds pidfile.c from libite
+
+Signed-off-by: Mattias Walström <lazzer@gmail.com>
+---
+ wpa_supplicant/Makefile         |   1 +
+ wpa_supplicant/pidfile.c        | 153 ++++++++++++++++++++++++++++++++
+ wpa_supplicant/wpa_supplicant.c |   7 +-
+ 3 files changed, 160 insertions(+), 1 deletion(-)
+ create mode 100644 wpa_supplicant/pidfile.c
+
+diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
+index fd7d7a0bd..e14c7732a 100644
+--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
+@@ -104,6 +104,7 @@ endif
+ OBJS = config.o
+ OBJS += notify.o
+ OBJS += bss.o
+OBJS += pidfile.o
+ OBJS += eap_register.o
+ OBJS += ../src/utils/common.o
+ OBJS += ../src/utils/config.o
+diff --git a/wpa_supplicant/pidfile.c b/wpa_supplicant/pidfile.c
+new file mode 100644
+index 000000000..29dfbe242
+--- /dev/null
+++ b/wpa_supplicant/pidfile.c
+@@ -0,0 +1,153 @@
+/*	Updated by troglobit for libite/finit/uftpd projects 2016/07/04 */
+/*	$OpenBSD: pidfile.c,v 1.11 2015/06/03 02:24:36 millert Exp $	*/
+/*	$NetBSD: pidfile.c,v 1.4 2001/02/19 22:43:42 cgd Exp $	*/
+
+/*-
+ * Copyright (c) 1999 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Jason R. Thorpe.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file pidfile.c
+ * @author NetBSD Foundation Inc.
+ * @date 1999
+ * @copyright 2-clause BSD License
+ */
+
+#include <sys/stat.h>		/* utimensat() */
+#include <sys/time.h>		/* utimensat() on *BSD */
+#include <sys/types.h>
+#include <errno.h>
+#include <paths.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifndef pidfile
+static char *pidfile_path = NULL;
+static pid_t pidfile_pid  = 0;
+
+static void pidfile_cleanup(void);
+
+const  char *__pidfile_path = _PATH_VARRUN; /* Note: includes trailing slash '/' */
+const  char *__pidfile_name = NULL;
+extern char *__progname;
+
+/**
+ * Create or update mtime of process PID file.
+ * @param basename  Program name, or @c NULL, may start with '/'
+ *
+ * This function is intended to be used by UNIX daemons to save the PID of the main process
+ * responsible for handling signals.  If @p basename is @c NULL the implicit @a __progname
+ * variable from the C-library is used.  The @p basename may also start with '/', in which
+ * case it is interpreted as the absolute path to the PID file.
+ *
+ * @returns POSIX OK(0) on success, otherwise non-zero on error.
+ */
+int pidfile(const char *basename)
+{
+	int save_errno;
+	int atexit_already;
+	pid_t pid;
+	FILE *f;
+
+	if (basename == NULL)
+		basename = __progname;
+
+	pid = getpid();
+	atexit_already = 0;
+
+	if (pidfile_path != NULL) {
+		if (!access(pidfile_path, R_OK) && pid == pidfile_pid) {
+			utimensat(0, pidfile_path, NULL, 0);
+			return (0);
+		}
+		free(pidfile_path);
+		pidfile_path = NULL;
+		__pidfile_name = NULL;
+		atexit_already = 1;
+	}
+
+	if (basename[0] != '/') {
+		if (asprintf(&pidfile_path, "%s.pid", basename) == -1)
+			return (-1);
+	} else {
+		if (asprintf(&pidfile_path, "%s", basename) == -1)
+			return (-1);
+	}
+
+	if ((f = fopen(pidfile_path, "w")) == NULL) {
+		save_errno = errno;
+		free(pidfile_path);
+		pidfile_path = NULL;
+		errno = save_errno;
+		return (-1);
+	}
+
+	if (fprintf(f, "%ld\n", (long)pid) <= 0 || fflush(f) != 0) {
+		save_errno = errno;
+		(void) fclose(f);
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+		errno = save_errno;
+		return (-1);
+	}
+	(void) fclose(f);
+	__pidfile_name = pidfile_path;
+
+	/*
+	 * LITE extension, no need to set up another atexit() handler
+	 * if user only called us to update the mtime of the PID file
+	 */
+	if (atexit_already)
+		return (0);
+
+	pidfile_pid = pid;
+	if (atexit(pidfile_cleanup) < 0) {
+		save_errno = errno;
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+		pidfile_pid = 0;
+		errno = save_errno;
+		return (-1);
+	}
+
+	return (0);
+}
+
+static void
+pidfile_cleanup(void)
+{
+	if (pidfile_path != NULL && pidfile_pid == getpid()) {
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+	}
+}
+#endif
+diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
+index dfbd63163..3a762ebc2 100644
+--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
+@@ -123,6 +123,7 @@ const char *const wpa_supplicant_full_license5 =
+ "\n";
+ #endif /* CONFIG_NO_STDOUT_DEBUG */
+ 
+int pidfile(const char *basename);
+ 
+ static void wpa_bss_tmp_disallow_timeout(void *eloop_ctx, void *timeout_ctx);
+ static void wpas_verify_ssid_beacon(void *eloop_ctx, void *timeout_ctx);
+@@ -1490,6 +1491,9 @@ static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
+ 		/* Ignore errors since we cannot really do much to fix this */
+ 		wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
+ 	}
+
+	if (!global->params.daemonize)
+		pidfile(global->params.pid_file);
+ }
+ 
+ 
+@@ -8555,7 +8559,6 @@ struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
+ 	return global;
+ }
+ 
+-
+ /**
+  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
+  * @global: Pointer to global data from wpa_supplicant_init()
+@@ -8589,6 +8592,8 @@ int wpa_supplicant_run(struct wpa_global *global)
+ 	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
+ 	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
+ 
+	if (!global->params.daemonize)
+		pidfile(global->params.pid_file);
+ 	eloop_run();
+ 
+ 	return 0;
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
 pkglibexec_SCRIPTS = bootstrap error load gen-service gen-hostname \
 		     gen-interfaces gen-motd gen-hardware gen-version \
-		     mstpd-wait-online
+		     mstpd-wait-online wait-interface
 sbin_SCRIPTS       = dagger migrate
@@ -0,0 +1,21 @@
+#!/bin/sh
+if [ $# -lt 2 ]; then
+	echo "usage: $0 <ifname> <timeout>"
+	exit 1
+fi
+
+ifname=$1
+timeout=$2
+while true; do
+    if ip link show $ifname &>/dev/null; then
+        break
+    fi
+
+    retries=$(($retries + 1))
+    if [ $retries -ge $timeout ]; then
+        logger -t wait-interface "Timeout: Interface $ifname not found after $timeout seconds"
+        exit 1
+    fi
+
+    sleep 1
+done
@@ -41,6 +41,10 @@ AC_ARG_ENABLE(containers,
        AS_HELP_STRING([--enable-containers], [Enable support for containers]),,[
 	enable_containers=no])

+AC_ARG_ENABLE(wifi,
+        AS_HELP_STRING([--enable-wifi], [Enable support for Wi-Fi]),,[
+	enable_wifi=no])
+
 AC_ARG_WITH(login-shell,
        AS_HELP_STRING([--with-login-shell=shell], [Login shell for new users, default: /bin/false]),
 	[login_shell=$withval], [login_shell=yes])
@@ -52,6 +56,9 @@ AC_ARG_WITH(crypt,
 AS_IF([test "x$enable_containers" = "xyes"], [
        AC_DEFINE(CONTAINERS, 1, [Built with container support])])

+AS_IF([test "x$enable_wifi" = "xyes"], [
+        AC_DEFINE(HAVE_WIFI, 1, [Built with Wi-Fi support])])
+
 AS_IF([test "x$with_login_shell" != "xno"], [
 	AS_IF([test "x$login_shell" = "xyes"], [login_shell=/bin/false])
 	AC_DEFINE_UNQUOTED(LOGIN_SHELL, "$login_shell", [Default: /bin/false])],[
@@ -71,6 +78,7 @@ PKG_CHECK_MODULES([jansson], [jansson >= 2.0.0])
 PKG_CHECK_MODULES([libite],  [libite >= 2.6.1])
 PKG_CHECK_MODULES([sysrepo], [sysrepo >= 2.2.36])
 PKG_CHECK_MODULES([libsrx],  [libsrx >= 1.0.0])
+PKG_CHECK_MODULES([libssl],  [libssl >= 1.0.0])

 # Control build with automake flags
 AM_CONDITIONAL(CONTAINERS,   [test "x$enable_containers" != "xno"])
@@ -122,6 +130,7 @@ cat <<EOF

 Optional features:
  Container support ....: $enable_containers
+  Wi-Fi support ........: $enable_wifi
  Login shell ..........: $login_shell
  Default crypt algo ...: $crypt

@@ -12,6 +12,7 @@ confd_plugin_la_CFLAGS  =			\
 	$(libite_CFLAGS)			\
 	$(sysrepo_CFLAGS)			\
 	$(libsrx_CFLAGS)			\
+	$(libssl_CFLAGS)			\
 	$(CFLAGS)

 confd_plugin_la_LIBADD  =			\
@@ -20,7 +21,8 @@ confd_plugin_la_LIBADD  =			\
 	$(jansson_LIBS)				\
 	$(libite_LIBS)				\
 	$(sysrepo_LIBS)				\
-	$(libsrx_LIBS)
+	$(libsrx_LIBS)				\
+	$(libssl_LIBS)

 confd_plugin_la_SOURCES =			\
 	base64.c		base64.h	\
@@ -37,6 +39,7 @@ confd_plugin_la_SOURCES =			\
 	  infix-if-vlan.c			\
 	  infix-if-gre.c			\
 	  infix-if-vxlan.c			\
+	  infix-if-wifi.c			\
 	ietf-keystore.c				\
 	ietf-system.c				\
 	ietf-syslog.c				\
@@ -12,6 +12,7 @@
 #include <sys/time.h>
 #include <sys/param.h>
 #include <unistd.h>
+#include <stdbool.h>

 #include <libite/lite.h>
 #include <libite/queue.h>
@@ -137,9 +138,20 @@ static inline int register_change(sr_session_ctx_t *session, const char *module,
 	int flags, sr_module_change_cb cb, void *arg, sr_subscription_ctx_t **sub)
 {
 	struct confd *ptr = (struct confd *)arg;
+	bool need_core_hooks;
 	int rc;

-	if (!flags) {
+	/*
+	 * For standard subscribtions we hook into the callback chain
+	 * for all modules to figure out, per changeset, which of the
+	 * callbacks is the last one.  This is where we want to call the
+	 * global commit-done hook for candidate -> running changes and
+	 * the startup-save hook for running -> startup copying.
+	 */
+
+	need_core_hooks = !(flags & SR_SUBSCR_UPDATE);
+
+	if (need_core_hooks) {
 		sr_module_change_subscribe(ptr->session, module, xpath, core_pre_hook, NULL,
 				0, SR_SUBSCR_PASSIVE, sub);
 	}
@@ -151,14 +163,7 @@ static inline int register_change(sr_session_ctx_t *session, const char *module,
 		return rc;
 	}

-	/*
-	 * For standard subscribtions we hook into the callback chain
-	 * for all modules to figure out, per changeset, which of the
-	 * callbacks is the last one.  This is where we want to call the
-	 * global commit-done hook for candidate -> running changes and
-	 * the startup-save hook for running -> startup copying.
-	 */
-	if (!flags) {
+	if (need_core_hooks) {
 		sr_module_change_subscribe(ptr->session, module, xpath, core_post_hook, NULL,
 				core_hook_prio(), SR_SUBSCR_PASSIVE, sub);
 		sr_module_change_subscribe(ptr->startup, module, xpath, core_startup_save, NULL,
@@ -52,6 +52,9 @@ enum netdag_exit {
 };

 enum netdag_init {
+	/* Timeout for slow interfaces */
+	NETDAG_INIT_TIMEOUT = 00,
+
 	/* Configure link layer */
 	NETDAG_INIT_PHYS = 10,

@@ -114,23 +114,6 @@ int netdag_gen_ethtool(struct dagger *net, struct lyd_node *cif, struct lyd_node
 	struct lyd_node *eth = lydx_get_child(dif, "ethernet");
 	int err;

-	/*
-	 * Story time: when assigning a physical interface to a container, and then
-	 *             removing it, even though our type may be 'etherlike' we will
-	 *             get the following from sysrepo:
-	 *
-	 *               "ieee802-ethernet-interface:ethernet": {
-	 *                 "@": {
-	 *                   "yang:operation": "delete"
-	 *                 },
-	 *                 "duplex": "full"
-	 *               },
-	 *
-	 *             Hence this "redundant" check.
-	 */
-	if (iftype_from_iface(cif) != IFT_ETH)
-		return 0;
-
 	if (!eth)
 		return 0;

@@ -9,8 +9,11 @@
 #include <srx/common.h>
 #include <srx/lyx.h>
 #include <srx/srx_val.h>
+#include <libyang/libyang.h>

 #include "ietf-interfaces.h"
+#define  IFACE_PROBE_TIMEOUT 40
+

 bool iface_has_quirk(const char *ifname, const char *quirkname)
 {
@@ -27,6 +30,7 @@ bool iface_has_quirk(const char *ifname, const char *quirkname)

 	return quirk ? json_is_true(quirk) : false;
 }
+
 static bool iface_is_phys(const char *ifname)
 {
 	bool is_phys = false;
@@ -84,7 +88,9 @@ static int ifchange_cand_infer_type(sr_session_ctx_t *session, const char *path)
 		goto out;
 	}

-	if (iface_is_phys(ifname))
+	if (!fnmatch("wifi+([0-9])", ifname, FNM_EXTMATCH))
+		inferred.data.string_val = "infix-if-type:wifi";
+	else if (iface_is_phys(ifname))
 		inferred.data.string_val = "infix-if-type:ethernet";
 	else if (!fnmatch("br+([0-9])", ifname, FNM_EXTMATCH))
 		inferred.data.string_val = "infix-if-type:bridge";
@@ -112,6 +118,7 @@ static int ifchange_cand_infer_type(sr_session_ctx_t *session, const char *path)
 		inferred.data.string_val = "infix-if-type:gretap";
 	else if (!fnmatch("vxlan+([0-9])", ifname, FNM_EXTMATCH))
 		inferred.data.string_val = "infix-if-type:vxlan";
+
 	free(ifname);

 	if (inferred.data.string_val)
@@ -416,9 +423,13 @@ static int netdag_gen_afspec_add(sr_session_ctx_t *session, struct dagger *net,
 		return vlan_gen(NULL, cif, ip);
 	case IFT_VXLAN:
 		return vxlan_gen(NULL, cif, ip);
-
+	case IFT_WIFI:
+		return wifi_gen(NULL, cif, net);
 	case IFT_ETH:
+		return netdag_gen_ethtool(net, cif, dif);
 	case IFT_LO:
+		return 0;
+
 	case IFT_UNKNOWN:
 		sr_session_set_error_message(net->session, "%s: unsupported interface type \"%s\"",
 					     ifname, lydx_get_cattr(cif, "type"));
@@ -440,16 +451,18 @@ static int netdag_gen_afspec_set(sr_session_ctx_t *session, struct dagger *net,
 		return lag_gen(dif, cif, ip, 0);
 	case IFT_VLAN:
 		return vlan_gen(dif, cif, ip);
-
+	case IFT_ETH:
+		return netdag_gen_ethtool(net, cif, dif);
+	case IFT_WIFI:
+		return wifi_gen(dif, cif, net);
 	case IFT_DUMMY:
 	case IFT_GRE:
 	case IFT_GRETAP:
 	case IFT_VETH:
 	case IFT_VXLAN:
+	case IFT_LO:
 		return 0;

-	case IFT_ETH:
-	case IFT_LO:
 	case IFT_UNKNOWN:
 		return ERR_IFACE(cif, -ENOSYS, "unsupported interface type \"%s\"",
 				 lydx_get_cattr(cif, "type"));
@@ -466,10 +479,11 @@ static bool netdag_must_del(struct lyd_node *dif, struct lyd_node *cif)
 	case IFT_DUMMY:
 	case IFT_LO:
 		break;
+
+	case IFT_WIFI:
 	case IFT_ETH:
-	/* case IFT_LAG: */
-	/* 	... REMEMBER WHEN ADDING BOND SUPPORT ... */
 		return lydx_get_child(dif, "custom-phys-address");
+
 	case IFT_GRE:
 	case IFT_GRETAP:
 		return lydx_get_descendant(lyd_child(dif), "gre", NULL);
@@ -519,12 +533,12 @@ static int link_gen_del(struct lyd_node *dif, FILE *ip)
 	return 0;
 }

-static int veth_gen_del(struct lyd_node *dif, FILE *ip)
+static int veth_gen_del(struct lyd_node *dif, FILE *sh)
 {
 	if (!veth_is_primary(dif))
 		return 0;

-	return link_gen_del(dif, ip);
+	return link_gen_del(dif, sh);
 }

 static int netdag_gen_iface_del(struct dagger *net, struct lyd_node *dif,
@@ -554,6 +568,10 @@ static int netdag_gen_iface_del(struct dagger *net, struct lyd_node *dif,
 	case IFT_LO:
 		eth_gen_del(dif, ip);
 		break;
+	case IFT_WIFI:
+		eth_gen_del(dif, ip);
+		wifi_gen_del(dif, net);
+		break;
 	case IFT_VETH:
 		veth_gen_del(dif, ip);
 		break;
@@ -573,16 +591,35 @@ static int netdag_gen_iface_del(struct dagger *net, struct lyd_node *dif,
 	return 0;
 }

+static sr_error_t netdag_gen_iface_timeout(struct dagger *net, const char *ifname, const char *iftype)
+{
+	if (!strcmp(iftype, "infix-if-type:ethernet") || !strcmp(iftype, "infix-if-type:wifi")) {
+		FILE *wait = dagger_fopen_net_init(net, ifname, NETDAG_INIT_TIMEOUT, "wait-interface.sh");
+		if (!wait) {
+			return -EIO;
+		}
+
+		fprintf(wait, "/usr/libexec/confd/wait-interface %s %d\n", ifname, IFACE_PROBE_TIMEOUT);
+		fclose(wait);
+	 }
+	return SR_ERR_OK;
+}
+
 static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net,
 				   struct lyd_node *dif, struct lyd_node *cif)
 {
 	const char *ifname = lydx_get_cattr(dif, "name");
+	const char *iftype = lydx_get_cattr(dif, "type")?:lydx_get_cattr(cif, "type");
 	enum lydx_op op = lydx_get_op(dif);
 	const char *attr;
 	int err = 0;
-	bool fixed;
 	FILE *ip;

+
+	err = netdag_gen_iface_timeout(net, ifname, iftype);
+	if (err)
+		goto err;
+
 	if ((err = cni_netdag_gen_iface(net, ifname, dif, cif))) {
 		/* error or managed by CNI/podman */
 		if (err > 0)
@@ -590,9 +627,7 @@ static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net
 		goto err;
 	}

-	fixed = iface_is_phys(ifname) || !strcmp(ifname, "lo");
-
-	DEBUG("%s(%s) %s", ifname, fixed ? "fixed" : "dynamic",
+	DEBUG("%s %s", ifname,
 	      (op == LYDX_OP_NONE) ? "mod" : ((op == LYDX_OP_CREATE) ? "add" : "del"));

 	if (op == LYDX_OP_DELETE) {
@@ -630,7 +665,7 @@ static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net
 		goto err;
 	}

-	if (!fixed && op == LYDX_OP_CREATE) {
+	if (op == LYDX_OP_CREATE) {
 		err = netdag_gen_afspec_add(session, net, dif, cif, ip);
 		if (err)
 			goto err_close_ip;
@@ -655,7 +690,7 @@ static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net
 		goto err_close_ip;

 	/* Set type specific attributes */
-	if (!fixed && op != LYDX_OP_CREATE) {
+	if (op != LYDX_OP_CREATE) {
 		err = netdag_gen_afspec_set(session, net, dif, cif, ip);
 		if (err)
 			goto err_close_ip;
@@ -679,8 +714,6 @@ static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net

 	err = err ? : netdag_gen_sysctl(net, cif, dif);

-	err = err ? : netdag_gen_ethtool(net, cif, dif);
-
 err_close_ip:
 	fclose(ip);
 err:
@@ -710,6 +743,7 @@ static int netdag_init_iface(struct lyd_node *cif)

 	case IFT_DUMMY:
 	case IFT_ETH:
+	case IFT_WIFI:
 	case IFT_GRE:
 	case IFT_GRETAP:
 	case IFT_LO:
@@ -790,7 +824,7 @@ static int ifchange(sr_session_ctx_t *session, uint32_t sub_id, const char *modu
 	if (err)
 		return err;

-	err = sr_get_data(session, "/interfaces/interface", 0, 0, 0, &cfg);
+	err = sr_get_data(session, "//.", 0, 0, 0, &cfg);
 	if (err || !cfg)
 		goto err_abandon;

@@ -800,7 +834,6 @@ static int ifchange(sr_session_ctx_t *session, uint32_t sub_id, const char *modu

 	cifs = lydx_get_descendant(cfg->tree, "interfaces", "interface", NULL);
 	difs = lydx_get_descendant(diff, "interfaces", "interface", NULL);
-
 	err = netdag_init(session, &confd->netdag, cifs, difs);
 	if (err)
 		goto err_free_diff;
@@ -829,15 +862,72 @@ err_abandon:
 	return err;
 }

+static int keystorecb(sr_session_ctx_t *session, uint32_t sub_id, const char *module,
+		    const char *xpath, sr_event_t event, unsigned request_id, void *_confd)
+{
+	const struct lyd_node *diff;
+	const char *secret_name;
+	struct confd *confd = _confd;
+	struct lyd_node *interfaces, *interface, *dkeys, *dkey, *wifi;
+	sr_data_t *cfg = NULL;
+        int err = SR_ERR_OK;
+
+	switch (event) {
+	case SR_EV_CHANGE:
+		break;
+	default:
+		return SR_ERR_OK;
+	}
+
+	err = sr_get_data(session, "/interfaces/interface", 0, 0, 0, &cfg);
+	if (err || !cfg)
+		return err;
+
+	diff = sr_get_change_diff(session);
+	if (!diff)
+		goto cleanup;
+
+	interfaces = lydx_get_descendant(cfg->tree, "interfaces", "interface", NULL);
+	dkeys = lydx_get_descendant((struct lyd_node*) diff, "keystore", "symmetric-keys", "symmetric-key", NULL);
+
+	LYX_LIST_FOR_EACH(dkeys, dkey, "symmetric-key") {
+		secret_name = lydx_get_cattr(dkey, "name");
+		if (!secret_name)
+			continue;
+
+		LYX_LIST_FOR_EACH(interfaces, interface, "interface") {
+			const char *name;
+
+			if (iftype_from_iface(interface) != IFT_WIFI)
+				continue;
+
+			wifi = lydx_get_child(interface, "wifi");
+			if (!wifi)
+				continue;
+
+			name = lydx_get_cattr(wifi, "secret");
+			if (!name || strcmp(name, secret_name))
+				continue;
+			wifi_gen(NULL, interface, &confd->netdag);
+		}
+	}
+
+cleanup:
+	if (cfg)
+		sr_release_data(cfg);
+	return err;
+}
+
 int ietf_interfaces_init(struct confd *confd)
 {
 	int rc;

 	REGISTER_CHANGE(confd->session, "ietf-interfaces", "/ietf-interfaces:interfaces//.",
-			0, ifchange, confd, &confd->sub);
+			SR_SUBSCR_CHANGE_ALL_MODULES, ifchange, confd, &confd->sub);
+	REGISTER_CHANGE(confd->session, "ietf-keystore", "//*",
+			SR_SUBSCR_CHANGE_ALL_MODULES, keystorecb, confd, &confd->sub);
 	REGISTER_CHANGE(confd->cand, "ietf-interfaces", "/ietf-interfaces:interfaces//.",
 			SR_SUBSCR_UPDATE, ifchange_cand, confd, &confd->sub);
-
 	return SR_ERR_OK;
 fail:
 	ERROR("failed, error %d: %s", rc, sr_strerror(rc));
@@ -25,6 +25,7 @@
 	_map(IFT_BRIDGE, "infix-if-type:bridge")	\
 	_map(IFT_DUMMY,  "infix-if-type:dummy")		\
 	_map(IFT_ETH,    "infix-if-type:ethernet")	\
+	_map(IFT_WIFI,   "infix-if-type:wifi")	        \
 	_map(IFT_GRE,    "infix-if-type:gre")		\
 	_map(IFT_GRETAP, "infix-if-type:gretap")	\
 	_map(IFT_LAG,    "infix-if-type:lag")	\
@@ -119,6 +120,10 @@ int bridge_mcd_gen(struct lyd_node *cifs);
 /* infix-if-bridge-port.c */
 int bridge_port_gen(struct lyd_node *dif, struct lyd_node *cif, FILE *ip);

+/* infix-if-wifi.c */
+int wifi_gen(struct lyd_node *dif, struct lyd_node *cif, struct dagger *net);
+int wifi_gen_del(struct lyd_node *dif,  struct dagger *net);
+
 /* infix-if-gre.c */
 int gre_gen(struct lyd_node *dif, struct lyd_node *cif, FILE *ip);

@@ -113,10 +113,25 @@ static int add(const char *name, struct lyd_node *cif)

 		/* Content mount: create a unique file with 'content' and bind mount */
 		if (data) {
+			const char *mode = lydx_get_cattr(node, "mode");
 			const char *contdir = "/run/containers/files";
+			mode_t file_mode = 0644;
 			char cmd[256];
+			int pos, fd;
 			FILE *pp;
-			int pos;
+
+			if (mode) {
+				unsigned long val;
+				char *endptr;
+
+				val = strtoul(mode, &endptr, 8);
+				if (*endptr != '\0' || val > 07777) {
+					ERROR("%s: invalid file mode '%s'", nm, mode);
+					continue;
+				}
+
+				file_mode = (mode_t)val;
+			}

 			/*
 			 * prefix file name with container name, shared namespace,
@@ -129,6 +144,27 @@ static int add(const char *name, struct lyd_node *cif)
 					nm[i] = '-';
 			}

+			/*
+			 * Always create with secure permissions, then immediately
+			 * set final mode.  This takes care of both new files and
+			 * updates to existing files atomically.
+			 */
+			fd = open(nm, O_CREAT | O_WRONLY | O_TRUNC, 0600);
+			if (fd < 0) {
+				ERRNO("%s: failed creating file %s", name, nm);
+				continue;
+			}
+
+			/* Set final permissions */
+			if (fchmod(fd, file_mode) < 0) {
+				ERRNO("%s: failed setting file mode %s", nm, mode);
+				close(fd);
+				unlink(nm);
+				continue;
+			}
+			close(fd);
+
+			/* Now decode base64 content into the properly secured file */
 			snprintf(cmd, sizeof(cmd), "base64 -d > %s", nm);
 			pp = popen(cmd, "w");
 			if (!pp || fputs(data, pp) < 0) {
@@ -137,8 +173,8 @@ static int add(const char *name, struct lyd_node *cif)
 					pclose(pp);
 				continue;
 			}
-
 			pclose(pp);
+
 			type = "bind"; /* discard any configured setting */
 			src = nm;      /* discard any source, not used for content mounts */
 		}
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+#include <srx/lyx.h>
+
+#include "ietf-interfaces.h"
+
+#define WPA_SUPPLICANT_FINIT_CONF "/etc/finit.d/available/wpa_supplicant-%s.conf"
+#define WPA_SUPPLICANT_CONF       "/etc/wpa_supplicant-%s.conf"
+
+static int wifi_gen_config(const char *ifname, const char *ssid, const char *country, const char *secret, const char* encryption, struct dagger *net)
+{
+	FILE *wpa_supplicant = NULL, *wpa = NULL;
+	char *encryption_str;
+	int rc = SR_ERR_OK;
+
+	if (!secret && (ssid && country && encryption)) {
+		/* Not an error, updated from two ways, interface cb and keystore cb. */
+		return 0;
+	}
+
+	wpa = dagger_fopen_net_init(net, ifname, NETDAG_INIT_POST, "wpa_supplicant.sh");
+	if (!wpa) {
+		rc = SR_ERR_INTERNAL;
+		goto out;
+	}
+
+	fprintf(wpa, "# Generated by Infix confd\n");
+
+	fprintf(wpa, "if [ -f '/etc/finit.d/enabled/wifi@%s.conf' ];then\n", ifname);
+	fprintf(wpa, "initctl -bfqn touch wifi@%s\n", ifname);
+	fprintf(wpa, "else\n");
+	fprintf(wpa, "initctl -bfqn enable wifi@%s\n", ifname);
+	fprintf(wpa, "fi\n");
+	fclose(wpa);
+
+	wpa_supplicant = fopenf("w", WPA_SUPPLICANT_CONF, ifname);
+	if (!wpa_supplicant) {
+		rc = SR_ERR_INTERNAL;
+		goto out;
+	}
+
+	if (!secret || !ssid || !country || !encryption) {
+		fprintf(wpa_supplicant,
+			"ctrl_interface=/run/wpa_supplicant\n"
+			"autoscan=periodic:10\n"
+			"ap_scan=1\n");
+	} else {
+		if (!strcmp(encryption, "disabled")) {
+			asprintf(&encryption_str, "key_mgmt=NONE");
+		} else {
+			asprintf(&encryption_str, "key_mgmt=SAE WPA-PSK\npsk=\"%s\"", secret);
+		}
+		fprintf(wpa_supplicant,
+			"country=%s\n"
+			"ctrl_interface=/run/wpa_supplicant\n"
+			"autoscan=periodic:10\n"
+			"ap_scan=1\n"
+			"network={\n"
+			"bgscan=\"simple: 30:-45:300\"\n"
+			"ssid=\"%s\"\n"
+			"%s\n"
+			"}\n", country, ssid, encryption_str);
+			free(encryption_str);
+	}
+	fclose(wpa_supplicant);
+
+out:
+	return rc;
+
+}
+int wifi_gen(struct lyd_node *dif, struct lyd_node *cif, struct dagger *net)
+{
+	const char *ssid, *secret_name, *secret, *ifname, *country, *encryption;
+	struct lyd_node *wifi, *secret_node;
+
+	bool enabled;
+	ifname      = lydx_get_cattr(cif, "name");
+
+	if (cif && !lydx_get_child(cif, "wifi")) {
+		return wifi_gen_config(ifname, NULL, NULL, NULL, NULL, net);
+	}
+
+	enabled     = lydx_get_bool(cif, "enabled");
+	wifi        = lydx_get_child(cif, "wifi");
+
+	ssid        = lydx_get_cattr(wifi, "ssid");
+	secret_name = lydx_get_cattr(wifi, "secret");
+	country     = lydx_get_cattr(wifi, "country-code");
+	encryption  = lydx_get_cattr(wifi, "encryption");
+	secret_node = lydx_get_xpathf(cif, "../../keystore/symmetric-keys/symmetric-key[name='%s']", secret_name);
+	secret      = lydx_get_cattr(secret_node, "cleartext-key");
+
+	if (!enabled)
+		return wifi_gen_del(cif, net);
+
+	return wifi_gen_config(ifname, ssid, country, secret, encryption, net);
+}
+
+int wifi_gen_del(struct lyd_node *dif,  struct dagger *net)
+{
+	const char *ifname = lydx_get_cattr(dif, "name");
+	FILE *iw = dagger_fopen_net_exit(net, ifname, NETDAG_EXIT_PRE, "iw.sh");
+
+	fprintf(iw, "# Generated by Infix confd\n");
+	fprintf(iw, "iw dev %s disconnect\n", ifname);
+	fprintf(iw, "initctl -bfqn disable wifi@%s\n", ifname);
+	fclose(iw);
+	erasef(WPA_SUPPLICANT_CONF, ifname);
+
+	return SR_ERR_OK;
+}
@@ -1,6 +1,9 @@
 /* SPDX-License-Identifier: BSD-3-Clause */
 #include <srx/common.h>
 #include <srx/lyx.h>
+#include <openssl/bio.h>
+#include <openssl/evp.h>
+#include <sys/statvfs.h>

 #include "core.h"
 #include "rauc-installer.h"
@@ -21,24 +24,111 @@ static RaucInstaller *infix_system_sw_new_rauc(void)
 	return rauc;
 }

+static int base64_decode_inplace(char *input, size_t input_len, size_t *output_len)
+{
+	BIO *bio, *b64;
+	int decode_len;
+
+	bio = BIO_new_mem_buf(input, input_len);
+	if (!bio) {
+		return -1;
+	}
+
+	b64 = BIO_new(BIO_f_base64());
+	if (!b64) {
+		BIO_free(bio);
+		return -1;
+	}
+
+	BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
+	bio = BIO_push(b64, bio);
+
+	/* Decode directly into the same buffer */
+	decode_len = BIO_read(bio, input, input_len);
+	BIO_free_all(bio);
+
+	if (decode_len < 0) {
+		return -1;
+	}
+
+	*output_len = decode_len;
+	return 0;
+}
+
 static int infix_system_sw_install(sr_session_ctx_t *session, uint32_t sub_id,
 				   const char *path, const sr_val_t *input,
 				   const size_t input_cnt, sr_event_t event,
 				   unsigned request_id, sr_val_t **output,
 				   size_t *output_cnt, void *priv)
 {
-	char *url = input->data.string_val;
 	sr_error_t srerr = SR_ERR_OK;
 	GError *raucerr = NULL;
-	RaucInstaller *rauc;
+	RaucInstaller *rauc = NULL;
+	char *install_source = NULL;

-	DEBUG("url:%s", url);
+	const char *url = NULL;
+	char *binary_data = NULL;
+	size_t binary_len = 0;
+	size_t decoded_len = 0;
+
+	for (size_t i = 0; i < input_cnt; i++) {
+		if (strcmp(input[i].xpath, "/infix-system:install-bundle/url") == 0) {
+			if (input[i].type == SR_STRING_T) {
+				url = input[i].data.string_val;
+			}
+		} else if (strcmp(input[i].xpath, "/infix-system:install-bundle/image") == 0) {
+			if (input[i].type == SR_BINARY_T) {
+				binary_data = (char *)input[i].data.binary_val;  // Cast away const for in-place decode
+				binary_len = strlen(binary_data);  // Length of base64 string
+			}
+		}
+	}
+
+	if (url) {
+		DEBUG("Installing from URL: %s", url);
+		install_source = (char *)url;
+
+	} else if (binary_data) {
+		const char *temp_dir = "/tmp";
+		char path[256];
+		FILE *fp;
+
+		DEBUG("Installing from uploaded binary data (%zu bytes base64)", binary_len);
+
+		if (base64_decode_inplace(binary_data, binary_len, &decoded_len) != 0) {
+			sr_session_set_netconf_error(session, "application", "invalid-value",
+						     NULL, NULL, "Failed to decode base64 image data", 0);
+			srerr = SR_ERR_INVAL_ARG;
+			goto cleanup;
+		}
+
+		fmkpath(0775, "%s/images", temp_dir);
+		snprintf(path, sizeof(path), "%s/images/install_bundle", temp_dir);
+
+		fp = fopen(path, "wb");
+		if (!fp) {
+			ERROR("Could not open %s", path);
+			return SR_ERR_NO_MEMORY;
+		}
+
+		fwrite(binary_data, sizeof(char), decoded_len, fp);
+		fclose(fp);
+		install_source = path;
+
+	} else {
+		ERROR("Unknown source");
+		return 0;
+	}

 	rauc = infix_system_sw_new_rauc();
-	if (!rauc)
-		return SR_ERR_INTERNAL;
+	if (!rauc) {
+		sr_session_set_netconf_error(session, "application", "operation-failed",
+					     NULL, NULL, "Failed to initialize RAUC installer", 0);
+		srerr = SR_ERR_INTERNAL;
+		goto cleanup;
+	}

-	rauc_installer_call_install_sync(rauc, url, NULL, &raucerr);
+	rauc_installer_call_install_sync(rauc, install_source, NULL, &raucerr);
 	if (raucerr) {
 		sr_session_set_netconf_error(session, "application", "operation-failed",
 					     NULL, NULL, raucerr->message, 0);
@@ -46,13 +136,18 @@ static int infix_system_sw_install(sr_session_ctx_t *session, uint32_t sub_id,
 		srerr = SR_ERR_OPERATION_FAILED;
 	}

-	g_object_unref(rauc);
+cleanup:
+	if (rauc) {
+		g_object_unref(rauc);
+	}
+
 	return srerr;
 }

+
 /*
  boot order can only be: primary, secondary and net, limited by model
- */
+*/
 static int infix_system_sw_set_boot_order(sr_session_ctx_t *session, uint32_t sub_id,
 					  const char *path, const sr_val_t *input,
 					  const size_t input_cnt, sr_event_t event,
@@ -63,24 +158,24 @@ static int infix_system_sw_set_boot_order(sr_session_ctx_t *session, uint32_t su
 		const sr_val_t *val = &input[i];

 		if (i != 0)
-			 strlcat(boot_order, " ", sizeof(boot_order));
-		 strlcat(boot_order, val->data.string_val, sizeof(boot_order));
-	 }
+			strlcat(boot_order, " ", sizeof(boot_order));
+		strlcat(boot_order, val->data.string_val, sizeof(boot_order));
+	}

-	 if (fexist("/sys/firmware/devicetree/base/chosen/u-boot,version")) {
-		 if (systemf("fw_setenv BOOT_ORDER %s", boot_order)) {
-			 ERROR("Set-boot-order: Failed to set boot order in U-Boot");
-			 return SR_ERR_INTERNAL;
-		 }
-	 } else if (fexist("/mnt/aux/grub/grubenv")) {
-		 if (systemf("grub-editenv /mnt/aux/grub/grubenv set ORDER=\"%s\"", boot_order)) {
-			 ERROR("Set-boot-order: Failed to set boot order in Grub");
-			 return SR_ERR_INTERNAL;
-		 }
-	 } else {
-		 ERROR("No supported boot loader found");
-		 return SR_ERR_UNSUPPORTED;
-	 }
+	if (fexist("/sys/firmware/devicetree/base/chosen/u-boot,version")) {
+		if (systemf("fw_setenv BOOT_ORDER %s", boot_order)) {
+			ERROR("Set-boot-order: Failed to set boot order in U-Boot");
+			return SR_ERR_INTERNAL;
+		}
+	} else if (fexist("/mnt/aux/grub/grubenv")) {
+		if (systemf("grub-editenv /mnt/aux/grub/grubenv set ORDER=\"%s\"", boot_order)) {
+			ERROR("Set-boot-order: Failed to set boot order in Grub");
+			return SR_ERR_INTERNAL;
+		}
+	} else {
+		ERROR("No supported boot loader found");
+		return SR_ERR_UNSUPPORTED;
+	}

 	return SR_ERR_OK;
 }
@@ -1,5 +1,4 @@
 # -*- sh -*-
-# REMEMBER TO UPDATE infix-interfaces ALSO IN containers.inc

 MODULES=(
 	"ietf-system@2014-08-06.yang -e authentication -e local-users -e ntp -e ntp-udp-port -e timezone-name"
@@ -35,7 +34,9 @@ MODULES=(
 	"ieee802-ethernet-interface@2019-06-21.yang"
 	"infix-ethernet-interface@2024-02-27.yang"
 	"infix-factory-default@2023-06-28.yang"
-	"infix-interfaces@2025-01-09.yang -e vlan-filtering"
-	"infix-crypto-types@2025-02-04.yang"
-	"infix-keystore@2025-02-04.yang"
+	"infix-interfaces@2025-06-17.yang -e vlan-filtering"
+	"ietf-crypto-types -e cleartext-symmetric-keys"
+	"infix-crypto-types@2025-06-17.yang"
+	"ietf-keystore -e symmetric-keys"
+	"infix-keystore@2025-06-17.yang"
 )
@@ -22,6 +22,11 @@ module infix-containers {
    prefix infix-sys;
  }

+  revision 2025-06-25 {
+    description "Add file mode option to content mounts, allows creating scripts.";
+    reference "internal";
+  }
+
  revision 2025-05-14 {
    description
      "Validation improvement:
@@ -390,6 +395,16 @@ module infix-containers {
          }
        }

+        leaf mode {
+          description "File permissions for content mounts (not used for source mounts).
+
+                       Octal notation (e.g., '755', '0644', '4755').  When not specified,
+                       the mode will be '0644'.";
+          type string {
+            pattern '0?[0-7]{3,4}';
+          }
+        }
+
        leaf read-only {
          description "All mounts are read-only by default.
                       Use this option to allow containers to write to files
@@ -5,6 +5,10 @@ module infix-crypto-types {
  import ietf-crypto-types {
    prefix ct;
  }
+
+  revision 2025-06-17 {
+    description "Add Wi-Fi secret support.";
+  }
  revision 2025-02-04 {
    description "Initial";
  }
@@ -24,4 +28,14 @@ module infix-crypto-types {
    base public-key-format;
    base ct:ssh-public-key-format;
  }
+  identity symmetric-key-format {
+    description
+      "Base for symmetric key format";
+  }
+  identity wifi-preshared-key-format {
+    base ct:symmetric-key-format;
+    base symmetric-key-format;
+    description
+      "WiFi secret key";
+  }
 }
@@ -38,6 +38,14 @@ module infix-if-type {
    reference "internal";
  }

+  /*
+   * Features
+   */
+
+  feature wifi {
+    description "WiFi support is an optional build-time feature in Infix.";
+  }
+
  /*
   * Identities
   */
@@ -98,4 +106,10 @@ module infix-if-type {
    base ianaift:l2vlan;
    description "Layer 2 Virtual LAN using 802.1Q.";
  }
+  identity wifi {
+    if-feature wifi;
+    base infix-interface-type;
+    base ianaift:ieee80211;
+    description "WiFi interface";
+  }
 }
@@ -0,0 +1,185 @@
+submodule infix-if-wifi {
+  yang-version 1.1;
+  belongs-to infix-interfaces {
+    prefix infix-if;
+  }
+  import ietf-interfaces {
+    prefix if;
+  }
+  import ietf-yang-types {
+    prefix yang;
+  }
+  import ietf-netconf-acm {
+    prefix nacm;
+  }
+  import ietf-keystore {
+    prefix ks;
+  }
+  import infix-crypto-types {
+    prefix ixct;
+  }
+  import infix-if-type {
+    prefix infixift;
+  }
+  import infix-wifi-country-codes {
+    prefix iwcc;
+  }
+
+  organization "KernelKit";
+  contact      "kernelkit@googlegroups.com";
+  description
+    "WiFi-specific extensions to the standard IETF interfaces model.
+
+     This submodule defines configuration and operational data relevant to
+     WiFi interfaces, including security settings, network
+     discovery, and regulatory compliance.
+
+     It supports WiFi client mode and enables comprehensive management of
+     wireless connections, including encryption, country codes, and scanning.";
+
+  revision 2025-05-27 {
+    description "Initial revision.";
+    reference "internal";
+  }
+
+  feature wifi {
+    description "WiFi support is an optional build-time feature in Infix.";
+  }
+
+  typedef encryption {
+    type enumeration {
+      enum auto {
+        description
+          "Enables WPA/WPA2/WPA3 encryption with automatic protocol
+           negotiation. The system uses the strongest supported variant supported by Access Point.";
+      }
+      enum disabled {
+        description
+          "Disables encryption for an open network.
+
+           WARNING: Open networks transmit data unencrypted and should only
+           be used in trusted environments.";
+      }
+    }
+    description
+      "Encryption modes available for WiFi connections.
+
+       - auto: Secure connection using WPA3/WPA2/WPA (auto-selected)
+       - disabled: Open network (unencrypted)";
+  }
+
+
+  augment "/if:interfaces/if:interface" {
+    when "derived-from-or-self(if:type, 'infixift:wifi')" {
+      description
+        "Applies only to interfaces of type 'wifi'.";
+    }
+
+    container wifi {
+      if-feature wifi;
+      presence "Configure Wi-Fi settings";
+
+      description
+        "WiFi-specific configuration and operational data.";
+
+      leaf country-code {
+        type iwcc:country-code;
+        mandatory true;
+        description
+          "Two-letter ISO 3166-1 country code for regulatory compliance.
+
+           Examples: 'US', 'DE', 'JP'.
+
+           WARNING: Incorrect values may violate local laws.";
+
+
+      }
+
+      leaf encryption {
+        default auto;
+        type encryption;
+
+        description
+          "WiFi encryption method.
+
+           - auto (default): Enables WPA2/WPA3 auto-negotiation
+           - disabled: Disables encryption (open network)";
+      }
+
+      leaf ssid {
+        type string {
+          length "1..32";
+        }
+        mandatory true;
+
+        description
+          "WiFi network name (SSID).
+
+           Case-sensitive, must match the target network.
+
+           Length: 1–32 characters.";
+      }
+
+      leaf secret {
+        type ks:symmetric-key-ref;
+        mandatory true;
+        must "../encryption != 'disabled'" {
+           error-message
+            "Pre-shared key required unless encryption is disabled.";
+        }
+
+        description
+          "Pre-shared key (PSK) for WPA-secured networks.";
+      }
+
+      leaf rssi {
+        config false;
+        type int16;
+        units "dBm";
+        description
+          "Current received signal strength (RSSI) in dBm.
+
+           Lower (more negative) values indicate stronger signals.";
+      }
+
+      list scan-results {
+        config false;
+        key ssid;
+        description
+          "List of discovered networks.";
+
+        leaf ssid {
+          type string;
+          description
+            "SSID of the discovered network.";
+        }
+
+        leaf bssid {
+          type string;
+          description
+            "BSSID of the discovered network.";
+        }
+
+        leaf rssi {
+          type int16;
+          units "dBm";
+          description
+            "Signal strength of the network.";
+        }
+
+        leaf channel {
+          type int16;
+          description
+            "Channel on which the network was detected.";
+        }
+
+        leaf-list encryption {
+          ordered-by user;
+          type string;
+          description
+            "Human-readable description of the detected security.";
+        }
+      }
+    }
+  }
+}
@@ -0,0 +1 @@
+infix-if-wifi.yang
@@ -3,9 +3,6 @@ module infix-interfaces {
  namespace "urn:infix:interfaces:ns:yang:1.0";
  prefix infix-if;

-  import infix-if-type {
-    prefix infix-ift;
-  }
  import ietf-interfaces {
    prefix if;
  }
@@ -15,6 +12,12 @@ module infix-interfaces {
  import ietf-inet-types {
    prefix inet;
  }
+  import ietf-keystore {
+    prefix ks;
+  }
+  import infix-if-type {
+    prefix infix-ift;
+  }

  include infix-if-base;
  include infix-if-bridge;
@@ -24,12 +27,18 @@ module infix-interfaces {
  include infix-if-vlan;
  include infix-if-gre;
  include infix-if-vxlan;
+  include infix-if-wifi;

  organization "KernelKit";
  contact      "kernelkit@googlegroups.com";
  description  "Linux bridge and lag extensions for ietf-interfaces.";

-  revision 2025-01-09 {
+  revision 2025-06-17 {
+    description "Add support for Wi-Fi client.";
+    reference "internal";
+  }
+
+ revision 2025-01-09 {
    description "Add support for link aggregation, static and LACP.";
    reference "internal";
  }
@@ -5,9 +5,15 @@ module infix-keystore {
  import ietf-keystore {
    prefix ks;
  }
+  import ietf-crypto-types {
+    prefix ct;
+  }
  import infix-crypto-types {
    prefix infix-ct;
  }
+  revision 2025-06-17 {
+    description "Add Wi-Fi secrets support";
+  }
  revision 2025-02-04 {
    description "Initial";
  }
@@ -25,4 +31,35 @@ module infix-keystore {
      }
    }
  }
+  deviation "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:key-format" {
+    deviate not-supported;
+  }
+  augment "/ks:keystore/ks:symmetric-keys/ks:symmetric-key" {
+    leaf key-format {
+      type identityref {
+        base infix-ct:symmetric-key-format;
+      }
+      description
+        "Identifies the symmetric key's format
+
+        Valid symmetric key formats are:
+        wifi-preshared-key-format  - WiFi preshared key";
+    }
+  }
+  deviation "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:key-type/ks:cleartext-key/ks:cleartext-key" {
+    deviate not-supported;
+  }
+  augment "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:key-type" {
+    case cleartext-key {
+      leaf cleartext-key {
+        type string;
+        must "../../ks:key-format != 'infix-ct:wifi-preshared-key-format' or " +
+          "(string-length(.) >= 8 and string-length(.) <= 63)" {
+          error-message "WiFi pre-shared key must be 8-63 characters long";
+        }
+        description "WiFi pre-shared key: 8-63 printable ASCII characters";
+
+      }
+    }
+  }
 }
@@ -3,10 +3,15 @@ module infix-meta {
  namespace "urn:infix:meta:ns:yang:1.0";
  prefix infix-meta;

+  import ietf-yang-metadata {
+    prefix md;
+  }
+
  organization "KernelKit";
  contact      "kernelkit@googlegroups.com";
  description  "Infix metadata.";

+
  revision 2024-10-18 {
    description "Mark entire meta container obsolete.";
    reference "internal";
@@ -16,6 +21,12 @@ module infix-meta {
    reference "internal";
  }

+  md:annotation dirty {
+    type string;
+    description
+      "data";
+  }
+
  container meta {
    description "Meta data";
    status obsolete;
@@ -204,16 +204,42 @@ submodule infix-system-software {
     description
       "Upgrade the system's software by installing the specified bundle.";
     input {
-       leaf url {
-         type string;
+       choice source {
         mandatory true;
         description
-           "The location of the software bundle, specified as a Uniform
-           Resource Locator (URL).  Currently supported protocols include
-           FTP, HTTP(S) and SCP.";
+           "Source of the software bundle to install.";
+         case url {
+           leaf url {
+             type string;
+             description
+               "The location of the software bundle, specified as a Uniform
+               Resource Locator (URL). Currently supported protocols include
+               FTP, HTTP(S) and SCP.";
+           }
+         }
+
+         case upload {
+           leaf image {
+             type binary;
+             description
+               "The image data to install, provided as base64-encoded binary data.";
+           }
+         }
       }
     }
  }
+  rpc install-upload-bundle {
+    nacm:default-deny-all;
+    description "Upgrade the system's software by installing from a supplied blob.";
+    input {
+      leaf image {
+        type binary;
+        mandatory true;
+        description "The image to install";
+      }
+    }
+  }
+
  rpc set-boot-order {
    nacm:default-deny-all;
    description
@@ -0,0 +1,287 @@
+module infix-wifi-country-codes {
+  yang-version 1.1;
+  namespace "urn:infix:wifi-country-codes";
+  prefix iwcc;
+
+  organization   "KernelKit";
+
+  contact        "kernelkit@googlegroups.com";
+
+  description
+    "This module defines country codes for WiFi regulatory domain
+     configuration based on ISO 3166-1 alpha-2 standard.
+
+     This model provides country code definitions for use in
+     802.11 wireless LAN regulatory compliance configuration.
+
+     The regulatory domain configuration follows the principles
+     established in IETF RFCs for wireless access point management.";
+
+  revision 2025-06-02 {
+    description
+      "Initial revision for WiFi country code support.";
+    reference
+      "RFC 5415: Control And Provisioning of Wireless Access Points (CAPWAP) Protocol Specification
+       RFC 5416: Control and Provisioning of Wireless Access Points (CAPWAP) Protocol Binding for IEEE 802.11";
+  }
+
+  typedef country-code {
+    type enumeration {
+      enum "AD" { description "Andorra"; }
+      enum "AE" { description "United Arab Emirates"; }
+      enum "AF" { description "Afghanistan"; }
+      enum "AG" { description "Antigua and Barbuda"; }
+      enum "AI" { description "Anguilla"; }
+      enum "AL" { description "Albania"; }
+      enum "AM" { description "Armenia"; }
+      enum "AO" { description "Angola"; }
+      enum "AQ" { description "Antarctica"; }
+      enum "AR" { description "Argentina"; }
+      enum "AS" { description "American Samoa"; }
+      enum "AT" { description "Austria"; }
+      enum "AU" { description "Australia"; }
+      enum "AW" { description "Aruba"; }
+      enum "AX" { description "Åland Islands"; }
+      enum "AZ" { description "Azerbaijan"; }
+      enum "BA" { description "Bosnia and Herzegovina"; }
+      enum "BB" { description "Barbados"; }
+      enum "BD" { description "Bangladesh"; }
+      enum "BE" { description "Belgium"; }
+      enum "BF" { description "Burkina Faso"; }
+      enum "BG" { description "Bulgaria"; }
+      enum "BH" { description "Bahrain"; }
+      enum "BI" { description "Burundi"; }
+      enum "BJ" { description "Benin"; }
+      enum "BL" { description "Saint Barthélemy"; }
+      enum "BM" { description "Bermuda"; }
+      enum "BN" { description "Brunei Darussalam"; }
+      enum "BO" { description "Bolivia"; }
+      enum "BQ" { description "Bonaire, Sint Eustatius and Saba"; }
+      enum "BR" { description "Brazil"; }
+      enum "BS" { description "Bahamas"; }
+      enum "BT" { description "Bhutan"; }
+      enum "BV" { description "Bouvet Island"; }
+      enum "BW" { description "Botswana"; }
+      enum "BY" { description "Belarus"; }
+      enum "BZ" { description "Belize"; }
+      enum "CA" { description "Canada"; }
+      enum "CC" { description "Cocos (Keeling) Islands"; }
+      enum "CD" { description "Congo, Democratic Republic of the"; }
+      enum "CF" { description "Central African Republic"; }
+      enum "CG" { description "Congo"; }
+      enum "CH" { description "Switzerland"; }
+      enum "CI" { description "Côte d'Ivoire"; }
+      enum "CK" { description "Cook Islands"; }
+      enum "CL" { description "Chile"; }
+      enum "CM" { description "Cameroon"; }
+      enum "CN" { description "China"; }
+      enum "CO" { description "Colombia"; }
+      enum "CR" { description "Costa Rica"; }
+      enum "CU" { description "Cuba"; }
+      enum "CV" { description "Cabo Verde"; }
+      enum "CW" { description "Curaçao"; }
+      enum "CX" { description "Christmas Island"; }
+      enum "CY" { description "Cyprus"; }
+      enum "CZ" { description "Czechia"; }
+      enum "DE" { description "Germany"; }
+      enum "DJ" { description "Djibouti"; }
+      enum "DK" { description "Denmark"; }
+      enum "DM" { description "Dominica"; }
+      enum "DO" { description "Dominican Republic"; }
+      enum "DZ" { description "Algeria"; }
+      enum "EC" { description "Ecuador"; }
+      enum "EE" { description "Estonia"; }
+      enum "EG" { description "Egypt"; }
+      enum "EH" { description "Western Sahara"; }
+      enum "ER" { description "Eritrea"; }
+      enum "ES" { description "Spain"; }
+      enum "ET" { description "Ethiopia"; }
+      enum "FI" { description "Finland"; }
+      enum "FJ" { description "Fiji"; }
+      enum "FK" { description "Falkland Islands (Malvinas)"; }
+      enum "FM" { description "Micronesia"; }
+      enum "FO" { description "Faroe Islands"; }
+      enum "FR" { description "France"; }
+      enum "GA" { description "Gabon"; }
+      enum "GB" { description "United Kingdom"; }
+      enum "GD" { description "Grenada"; }
+      enum "GE" { description "Georgia"; }
+      enum "GF" { description "French Guiana"; }
+      enum "GG" { description "Guernsey"; }
+      enum "GH" { description "Ghana"; }
+      enum "GI" { description "Gibraltar"; }
+      enum "GL" { description "Greenland"; }
+      enum "GM" { description "Gambia"; }
+      enum "GN" { description "Guinea"; }
+      enum "GP" { description "Guadeloupe"; }
+      enum "GQ" { description "Equatorial Guinea"; }
+      enum "GR" { description "Greece"; }
+      enum "GS" { description "South Georgia and the South Sandwich Islands"; }
+      enum "GT" { description "Guatemala"; }
+      enum "GU" { description "Guam"; }
+      enum "GW" { description "Guinea-Bissau"; }
+      enum "GY" { description "Guyana"; }
+      enum "HK" { description "Hong Kong"; }
+      enum "HM" { description "Heard Island and McDonald Islands"; }
+      enum "HN" { description "Honduras"; }
+      enum "HR" { description "Croatia"; }
+      enum "HT" { description "Haiti"; }
+      enum "HU" { description "Hungary"; }
+      enum "ID" { description "Indonesia"; }
+      enum "IE" { description "Ireland"; }
+      enum "IL" { description "Israel"; }
+      enum "IM" { description "Isle of Man"; }
+      enum "IN" { description "India"; }
+      enum "IO" { description "British Indian Ocean Territory"; }
+      enum "IQ" { description "Iraq"; }
+      enum "IR" { description "Iran"; }
+      enum "IS" { description "Iceland"; }
+      enum "IT" { description "Italy"; }
+      enum "JE" { description "Jersey"; }
+      enum "JM" { description "Jamaica"; }
+      enum "JO" { description "Jordan"; }
+      enum "JP" { description "Japan"; }
+      enum "KE" { description "Kenya"; }
+      enum "KG" { description "Kyrgyzstan"; }
+      enum "KH" { description "Cambodia"; }
+      enum "KI" { description "Kiribati"; }
+      enum "KM" { description "Comoros"; }
+      enum "KN" { description "Saint Kitts and Nevis"; }
+      enum "KP" { description "Korea, Democratic People's Republic of"; }
+      enum "KR" { description "Korea, Republic of"; }
+      enum "KW" { description "Kuwait"; }
+      enum "KY" { description "Cayman Islands"; }
+      enum "KZ" { description "Kazakhstan"; }
+      enum "LA" { description "Lao People's Democratic Republic"; }
+      enum "LB" { description "Lebanon"; }
+      enum "LC" { description "Saint Lucia"; }
+      enum "LI" { description "Liechtenstein"; }
+      enum "LK" { description "Sri Lanka"; }
+      enum "LR" { description "Liberia"; }
+      enum "LS" { description "Lesotho"; }
+      enum "LT" { description "Lithuania"; }
+      enum "LU" { description "Luxembourg"; }
+      enum "LV" { description "Latvia"; }
+      enum "LY" { description "Libya"; }
+      enum "MA" { description "Morocco"; }
+      enum "MC" { description "Monaco"; }
+      enum "MD" { description "Moldova"; }
+      enum "ME" { description "Montenegro"; }
+      enum "MF" { description "Saint Martin (French part)"; }
+      enum "MG" { description "Madagascar"; }
+      enum "MH" { description "Marshall Islands"; }
+      enum "MK" { description "North Macedonia"; }
+      enum "ML" { description "Mali"; }
+      enum "MM" { description "Myanmar"; }
+      enum "MN" { description "Mongolia"; }
+      enum "MO" { description "Macao"; }
+      enum "MP" { description "Northern Mariana Islands"; }
+      enum "MQ" { description "Martinique"; }
+      enum "MR" { description "Mauritania"; }
+      enum "MS" { description "Montserrat"; }
+      enum "MT" { description "Malta"; }
+      enum "MU" { description "Mauritius"; }
+      enum "MV" { description "Maldives"; }
+      enum "MW" { description "Malawi"; }
+      enum "MX" { description "Mexico"; }
+      enum "MY" { description "Malaysia"; }
+      enum "MZ" { description "Mozambique"; }
+      enum "NA" { description "Namibia"; }
+      enum "NC" { description "New Caledonia"; }
+      enum "NE" { description "Niger"; }
+      enum "NF" { description "Norfolk Island"; }
+      enum "NG" { description "Nigeria"; }
+      enum "NI" { description "Nicaragua"; }
+      enum "NL" { description "Netherlands"; }
+      enum "NO" { description "Norway"; }
+      enum "NP" { description "Nepal"; }
+      enum "NR" { description "Nauru"; }
+      enum "NU" { description "Niue"; }
+      enum "NZ" { description "New Zealand"; }
+      enum "OM" { description "Oman"; }
+      enum "PA" { description "Panama"; }
+      enum "PE" { description "Peru"; }
+      enum "PF" { description "French Polynesia"; }
+      enum "PG" { description "Papua New Guinea"; }
+      enum "PH" { description "Philippines"; }
+      enum "PK" { description "Pakistan"; }
+      enum "PL" { description "Poland"; }
+      enum "PM" { description "Saint Pierre and Miquelon"; }
+      enum "PN" { description "Pitcairn"; }
+      enum "PR" { description "Puerto Rico"; }
+      enum "PS" { description "Palestine, State of"; }
+      enum "PT" { description "Portugal"; }
+      enum "PW" { description "Palau"; }
+      enum "PY" { description "Paraguay"; }
+      enum "QA" { description "Qatar"; }
+      enum "RE" { description "Réunion"; }
+      enum "RO" { description "Romania"; }
+      enum "RS" { description "Serbia"; }
+      enum "RU" { description "Russian Federation"; }
+      enum "RW" { description "Rwanda"; }
+      enum "SA" { description "Saudi Arabia"; }
+      enum "SB" { description "Solomon Islands"; }
+      enum "SC" { description "Seychelles"; }
+      enum "SD" { description "Sudan"; }
+      enum "SE" { description "Sweden"; }
+      enum "SG" { description "Singapore"; }
+      enum "SH" { description "Saint Helena, Ascension and Tristan da Cunha"; }
+      enum "SI" { description "Slovenia"; }
+      enum "SJ" { description "Svalbard and Jan Mayen"; }
+      enum "SK" { description "Slovakia"; }
+      enum "SL" { description "Sierra Leone"; }
+      enum "SM" { description "San Marino"; }
+      enum "SN" { description "Senegal"; }
+      enum "SO" { description "Somalia"; }
+      enum "SR" { description "Suriname"; }
+      enum "SS" { description "South Sudan"; }
+      enum "ST" { description "Sao Tome and Principe"; }
+      enum "SV" { description "El Salvador"; }
+      enum "SX" { description "Sint Maarten (Dutch part)"; }
+      enum "SY" { description "Syrian Arab Republic"; }
+      enum "SZ" { description "Eswatini"; }
+      enum "TC" { description "Turks and Caicos Islands"; }
+      enum "TD" { description "Chad"; }
+      enum "TF" { description "French Southern Territories"; }
+      enum "TG" { description "Togo"; }
+      enum "TH" { description "Thailand"; }
+      enum "TJ" { description "Tajikistan"; }
+      enum "TK" { description "Tokelau"; }
+      enum "TL" { description "Timor-Leste"; }
+      enum "TM" { description "Turkmenistan"; }
+      enum "TN" { description "Tunisia"; }
+      enum "TO" { description "Tonga"; }
+      enum "TR" { description "Turkey"; }
+      enum "TT" { description "Trinidad and Tobago"; }
+      enum "TV" { description "Tuvalu"; }
+      enum "TW" { description "Taiwan"; }
+      enum "TZ" { description "Tanzania"; }
+      enum "UA" { description "Ukraine"; }
+      enum "UG" { description "Uganda"; }
+      enum "UM" { description "United States Minor Outlying Islands"; }
+      enum "US" { description "United States of America"; }
+      enum "UY" { description "Uruguay"; }
+      enum "UZ" { description "Uzbekistan"; }
+      enum "VA" { description "Holy See (Vatican City State)"; }
+      enum "VC" { description "Saint Vincent and the Grenadines"; }
+      enum "VE" { description "Venezuela"; }
+      enum "VG" { description "Virgin Islands, British"; }
+      enum "VI" { description "Virgin Islands, U.S."; }
+      enum "VN" { description "Viet Nam"; }
+      enum "VU" { description "Vanuatu"; }
+      enum "WF" { description "Wallis and Futuna"; }
+      enum "WS" { description "Samoa"; }
+      enum "YE" { description "Yemen"; }
+      enum "YT" { description "Mayotte"; }
+      enum "ZA" { description "South Africa"; }
+      enum "ZM" { description "Zambia"; }
+      enum "ZW" { description "Zimbabwe"; }
+    }
+    description
+      "Complete list of ISO 3166-1 alpha-2 country codes for
+       regulatory domain configuration.";
+    reference
+      "ISO 3166-1:2020 Codes for the representation of names of countries
+       and their subdivisions -- Part 1: Country codes";
+  }
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Mattias Walström	cc0edaf59c	confd: Add support to upload images directly This add support for upgrading images with curl only, without FTP or similiar. The image needs to be base64 encoded. Example: TEMP_JSON=/tmp/restconf.txt echo -n '{"infix-system:input":{"image":"' > "$TEMP_JSON" base64 -w 0 "$BUNDLE_FILE" >> "$TEMP_JSON" echo '"}}' >> "$TEMP_JSON" curl -k \ -X POST \ -u "admin:admin" \ -H "Content-Type: application/yang-data+json" \ -H "Accept: application/yang-data+json" \ -d @"$TEMP_JSON" \ "https://192.168.30.1/restconf/operations/infix-system:install-bundle"	2025-07-11 16:33:02 +02:00
Mattias Walström	60b3a97f0e	confd: Coding style	2025-07-11 16:33:01 +02:00
Mattias Walström	e534c0bd2d	nginx: Add support for large files in restconf app.	2025-07-11 16:26:33 +02:00
Joachim WibergandGitHub	692fa166d1	Merge pull request #1049 from kernelkit/document-kernel-buildroot-update Document process about upgrade buildroot and kernel Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-07-11 13:40:58 +02:00
Joachim WibergandGitHub	c5d9a7c8b3	Merge pull request #1078 from kernelkit/ci-workflow-redesign Redesign CI to use workflow calls Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-07-09 11:52:54 +02:00
Richard Alpe	45c588567d	.github: fix parallel typo in dispatch Fixes: `874c0a54` Use massive parallel in workflow for PRs Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-09 10:42:40 +02:00
Richard Alpe	2a8580edcc	.github: allow workflow caller to pass test dir Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-07 09:53:06 +02:00
Richard Alpe	ffd0c05f41	.github: allow workflow caller to pass 9pm config	2025-07-07 09:53:05 +02:00
Richard Alpe	9271c2439f	.github: add name when calling test from self trigger	2025-07-07 09:53:04 +02:00
Richard Alpe	7295077f27	.github: update test.yml to support workflow call	2025-07-07 09:53:03 +02:00
Richard Alpe	b3d76de8f3	.github: quote workflow call variables in trigger	2025-07-07 09:53:02 +02:00
Richard Alpe	56f14ff520	.github: build _minimal on self-trigger Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-07 09:53:01 +02:00
Richard Alpe	9845e3b0c7	.github: make flavor selection into a env option	2025-07-07 09:53:00 +02:00
Richard Alpe	08e6833266	.github: allow repo checkout override Needed when called by spins inside different organizations.	2025-07-07 09:52:59 +02:00
Richard Alpe	df54982978	.github: simplify flavor selection	2025-07-07 09:52:58 +02:00
Richard Alpe	efd6cce842	.github: pass (Infix) name as workflow_call input Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-07 09:52:57 +02:00
Richard Alpe	1dc84af095	.github: use workflow calls to build and test Redesign how GH actions are triggered. This new design uses a self-trigger to start jobs which are only started via workflow_calls. The main benefit of this is to be able to start workflows from various Infix Spins without needing to duplicate the workflow files in them. Upcoming patches are intended to parameterize to allow Spins to pass different architectures, brand names and such. Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-07 09:52:55 +02:00
Tobias WaldekranzandGitHub	d6c0d4bea7	Merge pull request #1042 from kernelkit/ixbin ixbin: Add util script to update image contents	2025-07-04 11:23:33 +02:00
Tobias Waldekranz	85c4b579d3	ixbin: Add util script to update image contents [skip-ci]	2025-07-04 11:20:46 +02:00
Joachim WibergandGitHub	1f268a7b90	Merge pull request #1079 from kernelkit/gen-test-spec Minor Test Update	2025-07-03 14:51:04 +02:00
Ahmed Karic	562fd253c4	test: Update description in speed/duplex test	2025-07-03 14:01:27 +02:00
Ahmed Karic	be547ba9a8	test: Generate forgotten test-spec - container_host_commands test is missing .adoc and .svg files	2025-07-03 13:59:55 +02:00
Richard AlpeandGitHub	40e94883c6	Merge pull request #1076 from kernelkit/update-changelog doc: update changelog date for v25.06	2025-07-01 14:19:41 +02:00
Richard Alpe	9f268606e4	doc: update changelog date for v25.06 Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-01 11:29:04 +02:00
Jon-Olov VatnandGitHub	de113503ea	Merge pull request #1075 from kernelkit/update-changelog-v25.06.0 Update Changelog for Infix v25.06.0	2025-06-30 09:48:30 +02:00
Jon-Olov Vatn	6f203b1c78	Update Changelog for Infix v25.06.0 [skip ci]	2025-06-30 08:40:45 +02:00
Mattias WalströmandGitHub	c31bbbefa9	Merge pull request #1074 from kernelkit/wifi-fixes	2025-06-29 22:24:23 +02:00
Mattias Walström	0d03f874ee	confd: wifi: Fix several bugs in WiFi implemenation * Did not work to reconfigure * Was not possible to run from startup * Othe minor things.	2025-06-29 21:07:10 +02:00
Mattias Walström	51176c7d26	feature: wifi: Allow to set regulation setting (country-code) We was missing the firmware required for this, and for this to work cfg80211 needs to be as module since the rootfs is not loaded when it is loaded if compiled in kernel. And add iw since it very useful for debugging.	2025-06-29 21:06:33 +02:00
Mattias WalströmandGitHub	88958a0b1f	Merge pull request #1073 from kernelkit/upgrade-kernel Bump kernel to 6.12.35 (LTS)	2025-06-27 15:04:49 +02:00
Mattias Walström	e3f87799b6	utils/kernel-refresh.sh: Stage defconfigs Everything else got staged, but not defconfigs	2025-06-27 13:39:31 +02:00
Mattias Walström	ebcb38be37	Bump kernel to 6.12.35 (LTS)	2025-06-27 13:36:41 +02:00
Ahmed KaricandGitHub	889fb3eb79	Merge pull request #1072 from kernelkit/container-remote-exec Verify Host Command Execution from Container	2025-06-26 14:11:28 +02:00
Ahmed Karic	2a6e7e5208	test: Verify host command execution Add test to verify a container on Infix can execute commands on the host by mounting a script to `/etc/rc.local` with proper permissions. The test confirms host hostname change using `nsenter` from inside a privileged container. Resolves #1024	2025-06-26 13:10:43 +02:00
Joachim WibergandGitHub	9629e2eef4	Merge pull request #1071 from kernelkit/mount-mode Add support for setting mode of a container content mount	2025-06-26 12:35:02 +02:00
Joachim Wiberg	a0c48e7b5f	Add support for setting mode of a container content mount Fixes #1070 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-25 19:49:47 +02:00
Ahmed KaricandGitHub	edd2e60dd5	Merge pull request #1059 from kernelkit/speed_duplex Verify auto-negotiated speed/duplex	2025-06-25 10:00:10 +02:00
Ahmed Karic	ec82d68a9f	test: Verify auto-negotiated speed/duplex (copper)	2025-06-25 08:54:33 +02:00
Ahmed Karic	20d5426935	test/docker: Upgrade docker image to include ethtool Add `ethtool` to the Docker test environment to support interface auto-negotiation tests.	2025-06-25 08:01:13 +02:00
Mattias WalströmandGitHub	9d6d0e2388	Merge pull request #1069 from kernelkit/upgrade-buildroot	2025-06-24 19:55:41 +02:00
Joachim WibergandGitHub	6167f2a6a4	Merge pull request #1067 from kernelkit/misc New slogan and updated containers Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 15:11:06 +02:00
Joachim Wiberg	4ad2664b78	doc: update changelog for v25.06 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:54 +02:00
Joachim Wiberg	fe031f1a10	package/klish: fix by-word movement and kill buffer support - Fix by-word movement, detect word barrier using non-alphanum chars - Fix delete word left/right, make sure to save word in kill buffer Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:54 +02:00
Joachim Wiberg	0a3277caf2	package/curious-*: bump to v25.06.0 - Buildroot updated to v25.02.3 - Tefactor of nftables container The nftables container now includes BusyBox, a shell with vi and some basic filesystem tools, as well as nsenter and unshare, suitable for testing and other more advanced tasks. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:53 +02:00
Joachim Wiberg	cac357458c	Rebranding, make slogan more inclusive, Infix is more now ... Fixes #1052 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:53 +02:00
Mattias Walström	7b8bc43bca	Bump buildroot to 2025.02.4 (LTS)	2025-06-24 13:36:36 +02:00
Joachim Wiberg	5c7fc3f570	package/tetris: bump to v1.5.0 ChangeLog https://github.com/troglobit/tetris/releases/tag/1.5.0 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-22 21:12:50 +02:00
Joachim WibergandGitHub	bae70ec85a	Merge pull request #1066 from kernelkit/upgrade-kernel Upgrade Linux kernel to 6.12.34 (LTS) Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-20 09:52:54 +02:00
Mattias Walström	eeb10b0f07	Upgrade Linux kernel to 6.12.34 (LTS)	2025-06-19 21:14:30 +02:00
Mattias WalströmandGitHub	b92c9daedd	Merge pull request #1058 from kernelkit/wifi-support	2025-06-19 18:34:35 +02:00
Mattias Walström	eabaaac7c2	Document process about upgrade buildroot and kernel	2025-06-19 15:47:54 +02:00
Mattias Walström	de33df14e2	test: case: ietf_syslog/remote: Fix typo of interface type Has not been triggered before because we ignored operations on fixed interfaces.	2025-06-19 15:23:32 +02:00
Mattias Walström	5eeed0e743	changelog: Update with Wi-Fi client Also add kernel update to correct release.	2025-06-19 15:23:31 +02:00
Mattias Walström	24852caad0	doc: Add Wi-Fi Documention	2025-06-19 15:23:31 +02:00
Mattias Walström	08f4207277	configs: Enable Wi-Fi support	2025-06-19 15:23:30 +02:00
Mattias Walström	5fbb30fed5	Wi-Fi: Add Wi-Fi information to operational and CLI output * show wifi scan <ifname> to see located SSIDs * interface status	2025-06-19 15:23:30 +02:00
Mattias Walström	f25f0ab050	Wi-Fi: Add template finit service for wpa_supplicant	2025-06-19 15:23:29 +02:00
Mattias Walström	b53c1612f0	confd: Add basic Wi-Fi client support Support implemented: * WPA2/3 support * scanning (in background, results in operational) * Unencrypted networks No certificate support, only PSK only client so far, no AP	2025-06-19 15:23:28 +02:00
Mattias Walström	57d5bf1577	confd: Add script to wait for an interface usage: wait-interface wlan0 30	2025-06-19 15:23:27 +02:00
Mattias Walström	0ad8fab5c7	wpa_supplicant: Add support for pidfile when not daemonize	2025-06-19 15:23:27 +02:00
Mattias Walström	ecabce86c7	Add meta-package for adding Wi-Fi support Helps adding everything that needs to be compiled to get Wi-Fi support working. Both modules, firmware and applications are selected here	2025-06-19 15:23:26 +02:00
Mattias Walström	a7e72a46d9	confd: Simplify enabling features in YANG models If a extra infix feature require features to be added to an already loaded module. Instead of have the exact module definition in multiple places (with date), this will allow a much more flexible sytax: MODULES=( "infix-interfaces -e containers" ) This require that the infix-interfaces is loaded before this file is run.	2025-06-19 15:23:25 +02:00
Mattias Walström	915bef2dd4	udev: Rename all wlan interfaces wifiN and start scanning This since the feature is called 'wifi' in Infix, this makes the naming consistent over the system. Also trigger start of a wpa_supplicant, for scanning in the background. The scanning results is available operational.	2025-06-19 15:23:24 +02:00
Mattias Walström	7f9a1df6f7	qemu: Increase memory for virtual machine Image is too big, more memory is required	2025-06-19 15:23:24 +02:00
Mattias Walström	67a6fc18d5	confd: Always run netdag_gen_afspec_set and netdag_gen_afspec_add on all iftypes If an iftype does not need to do anything, just return 0. This makes the code much more easy to follow.	2025-06-19 15:23:23 +02:00
Mattias Walström	8538888069	confd: core: Allow all other flags then SR_SUBSCR_UPDATE Other flags may be load-bearing in some modules, but SR_SUBSCR_UPDATE, we never want to keep track on in the core hooks.	2025-06-19 10:34:46 +02:00
Mattias WalströmandGitHub	5a1cf7f9f8	Merge pull request #1063 from kernelkit/upgrade-kernel Upgrade Linux kernel to v6.12.33 (LTS)	2025-06-18 07:56:21 +02:00
Ahmed Karic	6755011b25	Upgrade Linux kernel to 6.12.33 (LTS)	2025-06-16 10:49:02 +02:00
Mattias WalströmandGitHub	e5a8514fa0	Merge pull request #1061 from kernelkit/update-changelog-v25.05.1 Update changelog for Infix v25.05.1	2025-06-12 15:03:41 +02:00
Jon-Olov Vatn	82c3eb1ee7	Update changelog for Infix v25.05.1	2025-06-12 12:31:35 +02:00
Jon-Olov VatnandGitHub	159135786a	Merge pull request #1060 from kernelkit/fix-missing-cmd-regression Restore missing CLI commands moved to show context	2025-06-11 09:14:09 +02:00
Richard Alpe	8a9415f0b4	klish-plugin-infix: restore missing CLI commands moved to show context Some CLI commands where inadvertently moved from the global CLI context into the show context. For example the upgrade command. As a result, commands like upgrade were unavailable at the top-level prompt:admin@ix-00-00-00:/> upgrade ? Error: Command not found, or incomplete. However, these commands remained accessible under the "show" context as a temporary workaround: admin@ix-00-00-00:/> show upgrade ? URI [(ftp\|tftp\|http\|https\|ftp)://(dns.name \| ip.address)/path/to/]upgrade-bundle.pkg This patch restores the affected commands to the global CLI context so that commands like upgrade function as intended at the root prompt. Fixes: `9c0a8e39` klish-plugin-infix: fix indentation in infix.xml Signed-off-by: Richard Alpe <richard@bit42.se>	2025-06-10 16:06:12 +02:00
Mattias WalströmandGitHub	93cffaedde	Merge pull request #1057 from kernelkit/upgrade-kernel	2025-06-04 21:22:39 +02:00
Ahmed Karic	991364b411	Upgrade linux kernel to v6.12.32 (LTS)	2025-06-04 18:21:11 +02:00
Mattias WalströmandGitHub	22cf97fdbd	Merge pull request #1056 from kernelkit/upgrade-kernel	2025-05-30 12:49:48 +02:00
Ahmed Karic	16c1b50349	Upgrade Linux kernel to 6.12.31 (LTS)	2025-05-30 11:26:53 +02:00
				`@@ -0,0 +1 @@`
				`SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"`