Merge pull request #1463 from kernelkit/fix-dhcp-client-test

test: dhcp: client_default_gw: Add longer timeout for test
doc: bump release date
2026-07-22 09:13:01 +02:00 · 2026-03-31 15:49:55 +02:00 · 2026-03-31 15:41:08 +02:00 · 2026-03-31 12:26:46 +02:00 · 2026-03-31 11:36:17 +02:00 · 2026-03-31 10:37:26 +02:00
350 changed files with 11069 additions and 6855 deletions
@@ -1,8 +1,10 @@
 Limited free support is only available using the online resources of the
-project on GitHub, and Discord, see <https://github.com/kernelkit>:
+project on GitHub, and Discord, see <https://github.com/kernelkit/infix>:

+&nbsp;&nbsp; :house: <https://www.kernelkit.org> — home page, blog, news, howto's and tutorials  
+&nbsp;&nbsp; :package: <https://github.com/kernelkit/infix/releases/latest> — latest release  
 &nbsp;&nbsp; :speech_balloon: <https://github.com/orgs/kernelkit/discussions>  
-&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>
+&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>  

 Support contracts, development of new features, fast-tracking of reviews
 and contributions, customer branding of Infix, and even customer specific
@@ -1,41 +0,0 @@
-name: 'Restore Build Caches'
-description: 'Restore dl/ and .ccache/ caches for Buildroot builds'
-inputs:
-  target:
-    description: 'Build target for cache key differentiation'
-    required: true
-  dl-prefix:
-    description: 'Prefix for dl/ cache key (e.g., "dl", "dl-boot")'
-    required: false
-    default: 'dl'
-  ccache-prefix:
-    description: 'Prefix for .ccache/ cache key (e.g., "ccache", "ccache-boot")'
-    required: false
-    default: 'ccache'
-  enabled:
-    description: 'Set to false to skip cache restoration'
-    required: false
-    default: 'true'
-runs:
-  using: 'composite'
-  steps:
-    - name: Restore Cache of dl/
-      if: ${{ inputs.enabled == 'true' }}
-      uses: actions/cache@v4
-      with:
-        path: dl/
-        key: ${{ inputs.dl-prefix }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-        restore-keys: |
-          ${{ inputs.dl-prefix }}-
-          dl-
-
-    - name: Restore Cache of .ccache/
-      if: ${{ inputs.enabled == 'true' }}
-      uses: actions/cache@v4
-      with:
-        path: .ccache/
-        key: ${{ inputs.ccache-prefix }}-${{ inputs.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-        restore-keys: |
-          ${{ inputs.ccache-prefix }}-${{ inputs.target }}-
-          ${{ inputs.ccache-prefix }}-
-          ccache-
@@ -1,15 +0,0 @@
-name: 'Podman Cleanup'
-description: 'Clean up stale podman state from previous runs'
-runs:
-  using: 'composite'
-  steps:
-    - name: Cleanup podman state
-      shell: bash
-      run: |
-        set -x
-        podman ps -a              || true
-        podman stop -a            || true
-        podman rm -a -f           || true
-        podman volume prune -f    || true
-        podman system prune -a -f || true
-        podman system migrate     || true
@@ -19,6 +19,8 @@ jobs:
          - aarch64_qemu_boot
          - bpi_r3_sd_boot
          - bpi_r3_emmc_boot
+          - bpi_r64_sd_boot
+          - bpi_r64_emmc_boot
          - cn9130_crb_boot
          - fireant_boot
          - nanopi_r2s_boot
@@ -66,7 +68,7 @@ jobs:

          echo "Building ${defconfig}_defconfig, version ${version}-${rev}, artifact ${archive} ..."

-      - uses: ./.github/actions/cache-restore
+      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: ${{ matrix.defconfig }}
          dl-prefix: dl-boot
@@ -11,6 +11,7 @@ on:
          - raspberrypi-rpi2
          - raspberrypi-rpi64
          - bananapi-bpi-r3
+          - bananapi-bpi-r64
          - friendlyarm-nanopi-r2s
          - microchip-sama7g54-ek
        default: 'raspberrypi-rpi64'
@@ -67,6 +68,12 @@ jobs:
              echo "ARCH=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=true" >> $GITHUB_ENV
              ;;
+            bananapi-bpi-r64)
+              echo "BOOTLOADER_SD=bpi-r64-sd-boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi-r64-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              ;;
            friendlyarm-nanopi-r2s)
              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
              echo "ARCH=aarch64" >> $GITHUB_ENV
@@ -28,7 +28,7 @@ jobs:
          clean: true
          submodules: recursive

-      - uses: ./.github/actions/podman-cleanup
+      - uses: kernelkit/actions/podman-cleanup@v1

      - name: Set Release Variables
        id: vars
@@ -40,7 +40,7 @@ jobs:
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT

-      - uses: ./.github/actions/cache-restore
+      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: ${{ matrix.target }}
          enabled: ${{ inputs.use_cache }}
@@ -89,7 +89,7 @@ jobs:
          submodules: recursive
          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}

-      - uses: ./.github/actions/podman-cleanup
+      - uses: kernelkit/actions/podman-cleanup@v1

      - name: Run pre-build script
        if: ${{ inputs.pre_build_script != '' }}
@@ -120,7 +120,7 @@ jobs:
          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
          echo "Building target ${target}_defconfig"

-      - uses: ./.github/actions/cache-restore
+      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: ${{ env.TARGET }}

@@ -8,6 +8,8 @@ on:
 env:
  PROJECT_NAME: Infix
  CONTACT_EMAIL: troglobit@gmail.com
+  LIBYANG_VERSION: 4.2.2
+  SYSREPO_VERSION: 4.2.10

 jobs:
  coverity:
@@ -55,16 +57,24 @@ jobs:
          sudo apt-get -y update
          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                       libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev
+                       libuev-dev libavahi-client-dev

      - name: Build dependencies
        run: |
-          git clone https://github.com/CESNET/libyang.git
+          git clone -b v${LIBYANG_VERSION} --depth 1 https://github.com/CESNET/libyang.git
+          for p in patches/libyang/${LIBYANG_VERSION}/*.patch; do
+            git -C libyang apply < "$p"
+          done
          mkdir libyang/build
          (cd libyang/build && cmake .. && make all && sudo make install)
-          git clone https://github.com/sysrepo/sysrepo.git
+
+          git clone -b v${SYSREPO_VERSION} --depth 1 https://github.com/sysrepo/sysrepo.git
+          for p in patches/sysrepo/${SYSREPO_VERSION}/*.patch; do
+            git -C sysrepo apply < "$p"
+          done
          mkdir sysrepo/build
          (cd sysrepo/build && cmake .. && make all && sudo make install)
+
          git clone https://github.com/troglobit/libite.git
          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
          make dep
@@ -45,7 +45,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: ./.github/actions/cache-restore
+      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: x86_64
          dl-prefix: dl-netconf
@@ -52,7 +52,7 @@ jobs:
        with:
          submodules: 'true'

-      - uses: ./.github/actions/podman-cleanup
+      - uses: kernelkit/actions/podman-cleanup@v1

      - name: Set Release Variables
        id: rel
@@ -70,7 +70,7 @@ jobs:
          submodules: recursive
          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}

-      - uses: ./.github/actions/podman-cleanup
+      - uses: kernelkit/actions/podman-cleanup@v1

      - name: Run pre-test script
        if: ${{ inputs.pre_test_script != '' }}
@@ -87,7 +87,7 @@ jobs:
          submodules: recursive
          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}

-      - uses: ./.github/actions/podman-cleanup
+      - uses: kernelkit/actions/podman-cleanup@v1

      - name: Run pre-build script
        if: ${{ inputs.pre_build_script != '' }}
@@ -98,7 +98,7 @@ jobs:
          chmod +x ./pre-build.sh
          bash ./pre-build.sh

-      - uses: ./.github/actions/cache-restore
+      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: ${{ env.TARGET }}

@@ -85,12 +85,12 @@ interfaces {
 admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
 admin@infix-12-34-56:/> <b>show interfaces</b>
 <u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
-eth0            ethernet   UP          52:54:00:12:34:56
-                ipv4                   192.168.2.200/24 (static)
-                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                ipv4                   127.0.0.1/8 (static)
                ipv6                   ::1/128 (static)
+eth0            ethernet   UP          52:54:00:12:34:56
+                ipv4                   192.168.2.200/24 (static)
+                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 admin@infix-12-34-56:/> <b>copy running startup</b>
 </code></pre>

@@ -114,6 +114,7 @@ containers for any custom functionality you need.
 - **x86_64** - Run in VMs or on mini PCs for development and testing
 - **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
 - **Microchip SparX-5i** - Enterprise switching capabilities
+- **Microchip SAMA7G54-EK** - ARM Cortex-A7
 - **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
 - **StarFive VisionFive2** - RISC-V architecture support

@@ -169,11 +170,11 @@ APIs.
 [2]: https://www.sysrepo.org/ "Sysrepo Homepage"
 [3]: https://www.kernelkit.org/infix/latest/cli/introduction/
 [4]: https://www.kernelkit.org/infix/
-[5]: https://github.com/kernelkit/infix/releases
+[5]: https://github.com/kernelkit/infix/releases/latest
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
-[Release]:         https://github.com/kernelkit/infix/releases
+[Release]:         https://github.com/kernelkit/infix/releases/latest
 [Release Badge]:   https://img.shields.io/github/v/release/kernelkit/infix 
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/
 [GitHub Status]:   https://github.com/kernelkit/infix/actions/workflows/build.yml/badge.svg
@@ -2,6 +2,7 @@ if BR2_aarch64

 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/freescale-imx8mp-evk/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/friendlyarm-nanopi-r2s/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-cn9130-crb/Config.in"
@@ -4,7 +4,8 @@ aarch64
 Board Specific Documentation
 ----------------------------

- [Banana Pi R3](banana-pi-r3/)
+- [Banana Pi BPi-R3](banana-pi-r3/)
+- [Banana Pi BPi-R64](banana-pi-r64/)
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
 - [NanoPi R2S](r2s/)
@@ -8,7 +8,22 @@
 		};
 	};
 };
+/*
+From 236317dd4e55512933dcdaec3d0b4a0824f5e5bd Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 10 Aug 2025 18:11:01 +0800
+Subject: [PATCH] arm64: dts: mediatek: mt7986: increase ATF reserved memory to
+ 256 kiB

+The latest Mediatek open-source Trusted Firmware-A project has
+reserved 256 KiB for BL2 and BL31. It is better to increase the
+reserved memory region in the Linux kernel to protect the data.
+
+https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/patches-6.12/199-arm64-dts-mediatek-mt7986-increase-ATF-reserved-memo.patch
+*/
+&secmon_reserved {
+	reg = <0 0x43000000 0 0x40000>;
+};
 &cpu_thermal {
 	/delete-node/ trips;
 	/delete-node/ cooling-maps;
@@ -21,21 +21,21 @@
      {
        "name": "radio0",
        "class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-	  "band": "2.4GHz",
-	  "channel": "auto"
-	 }
-     },
-     {
-	"name": "radio1",
-	"class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      },
+      {
+        "name": "radio1",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
          "band": "5GHz",
          "channel": "auto"
+        }
      }
-    }
    ]
  },
  "ietf-interfaces:interfaces": {
@@ -130,7 +130,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -179,7 +180,7 @@
            }
          }
        },
-	"infix-interfaces:bridge-port": {
+        "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      },
@@ -195,7 +196,7 @@
            }
          }
        },
-       "infix-interfaces:bridge-port": {
+        "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      }
@@ -21,21 +21,21 @@
      {
        "name": "radio0",
        "class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-	  "band": "2.4GHz",
-	  "channel": "auto"
-	 }
-     },
-     {
-	"name": "radio1",
-	"class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      },
+      {
+        "name": "radio1",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
          "band": "5GHz",
          "channel": "auto"
+        }
      }
-    }
    ]
  },
  "ietf-interfaces:interfaces": {
@@ -96,7 +96,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -145,7 +146,7 @@
            }
          }
        },
-	"infix-interfaces:bridge-port": {
+        "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      },
@@ -161,7 +162,7 @@
            }
          }
        },
-       "infix-interfaces:bridge-port": {
+        "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      }
@@ -0,0 +1,7 @@
+config BR2_PACKAGE_BANANAPI_BPI_R64
+	bool "Banana Pi R64"
+	depends on BR2_aarch64
+	select BR2_PACKAGE_FEATURE_WIFI
+	select SDCARD_AUX
+	help
+	  Build Banana PI R64 support
@@ -0,0 +1,13 @@
+Copyright (c) 2026 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -0,0 +1,143 @@
+# Banana Pi BPI-R64
+
+## Overview
+
+<img align="right" src="banana_pi_bpi-r64_interface.jpg" alt="Board Overview" width=400 padding=10>
+
+The Banana Pi BPI-R64 is a networking board based on the MediaTek MT7622
+(dual Cortex-A53, AArch64) SoC.
+
+### Hardware Features
+
+- MediaTek MT7622 ARM Cortex-A53 dual-core processor @ 1.35 GHz
+- 1 GB DDR3L RAM
+- 8 GB eMMC storage
+- microSD card slot
+- MT7531 Gigabit Ethernet switch (4x LAN + 1x WAN)
+- MT7603E built-in 2.4 GHz WiFi
+- USB 3.0 port
+- 2x Mini PCIe slots
+
+### Default Network Configuration
+
+Infix comes preconfigured with:
+
+- **LAN ports** (lan0-lan3): Bridged for internal networking
+- **WAN port**: DHCP client enabled for internet connectivity
+- **WiFi** (wifi0-ap): Bridged to LAN (MT7615 PCIe card if fitted, otherwise MT7603E)
+
+## Boot Switch Reference
+
+<img align="right" src="bpi-r64-sw1.png" alt="SW1 Boot Switch" width=90 padding=10>
+
+The BPI-R64 uses a 2-position DIP switch (SW1) to select the boot device
+order.  The MT7622 Boot ROM tries devices in the order listed and falls
+back to the next if no valid BL2 is found at the expected location.
+
+| SW1 | Boot device | Use case                   |
+|-----|-------------|----------------------------|
+| OFF | eMMC        | Production eMMC boot       |
+| ON  | SD card     | SD card boot / development |
+
+> [!NOTE]
+> SinoVoip has exposed only one bit of the MT7622's two-bit `BOOT_SEL[1:0]`
+> strapping field via SW1, with `BOOT_SEL[1]` hardwired high.  This limits the
+> board to eMMC (`10b`) and SD (`11b`) boot; the SPI-NOR and SPI-NAND modes
+> available on the MT7622 reference board (`00b`, `01b`) are not selectable.
+
+## Getting Started
+
+### Quick Start with SD Card
+
+1. **Flash the image to an SD card** (the filename includes the version, e.g.
+   `infix-25.01-bpi-r64-sdcard.img`):
+
+<img align="right" src="debug-uart.png" alt="Debug UART" width=100 padding=10>
+
+   ```sh
+   dd if=infix-*-bpi-r64-sdcard.img of=/dev/sdX bs=4M status=progress
+   ```
+
+2. **Set boot switch:** SW1 ON (SD card boot)
+3. **Insert SD card and power on**
+4. **Connect console:** 115200 8N1 — use the dedicated Debug UART header
+   just below the 40-pin GPIO header; pins are labeled GND, RX, TX on the board
+5. **Default login:** `admin` / `admin`
+
+## Installing to eMMC
+
+Unlike the BPI-R3 (where SD and eMMC share a bus, requiring a NAND intermediate
+step), the BPI-R64 has separate controllers for SD (mmc1/MSDC1) and eMMC
+(mmc0/MSDC0).  You can write directly to eMMC while booted from SD.
+
+### eMMC Boot ROM Behaviour
+
+> [!IMPORTANT]
+> The MT7622 Boot ROM reads BL2 from the eMMC BOOT0 hardware partition (offset
+> 0), not from the User Data Area where the main disk image lives.  The
+> installation procedure below writes BL2 to BOOT0 separately to handle this.
+
+### Procedure
+
+Boot from SD and write the eMMC image from U-Boot using a FAT32-formatted USB
+drive.
+
+#### Step 1: Boot from SD card
+
+1. Set SW1 to ON (SD boot)
+2. Insert SD card with Infix
+3. Power on and break into U-Boot (press Ctrl-C during boot)
+
+#### Step 2: Write the eMMC image from U-Boot
+
+Place `infix-bpi-r64-emmc.img` and `bl2.img` on a FAT32-formatted USB drive,
+then from the U-Boot prompt:
+
+```
+usb start
+fatload usb 0:1 0x44000000 infix-bpi-r64-emmc.img
+setexpr blocks ${filesize} / 0x200
+mmc dev 0
+mmc write 0x44000000 0x0 ${blocks}
+```
+
+#### Step 3: Write BL2 to eMMC BOOT0
+
+```
+fatload usb 0:1 0x44000000 bl2.img
+mmc partconf 0 1 1 1
+setexpr blkcnt ${filesize} + 0x1ff
+setexpr blkcnt ${blkcnt} / 0x200
+mmc write 0x44000000 0x0 ${blkcnt}
+mmc partconf 0 1 1 0
+```
+
+#### Step 4: Boot from eMMC
+
+1. Power off the board
+2. Set SW1 to OFF (eMMC boot)
+3. Remove SD card and USB drive
+4. Power on
+
+## Platform Notes
+
+### mmc0 = eMMC, mmc1 = SD
+
+On MT7622, MSDC0 (mmc0) is the 8-bit eMMC controller and MSDC1 (mmc1) is the
+4-bit SD card controller — the reverse of many other platforms.
+
+## Building
+
+```sh
+# Bootloader only (SD)
+make O=x-boot-bpir64-sd bpi_r64_sd_boot_defconfig && make O=x-boot-bpir64-sd
+
+# Bootloader only (eMMC)
+make O=x-boot-bpir64-emmc bpi_r64_emmc_boot_defconfig && make O=x-boot-bpir64-emmc
+
+# Compose SD image (pass the Infix rootfs output directory)
+utils/mkimage.sh -b x-boot-bpir64-sd -r x-aarch64/images bananapi-bpi-r64
+
+# Compose eMMC image
+utils/mkimage.sh -b x-boot-bpir64-emmc -r x-aarch64/images -t emmc bananapi-bpi-r64
+```
@@ -0,0 +1,35 @@
+define BANANAPI_BPI_R64_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MEDIATEK)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MACH_MT7622)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_MT7622)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_MT6577)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
+	# Ethernet subsystem clock controller — required for the eth MAC,
+	# MT7531 DSA switch, and HSDMA to get their clocks from &ethsys.
+	# Without this, eth probe fails and the switch is never detected.
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_MT7622_ETHSYS)
+	# HIF subsystem clock controller — required for PCIe and USB.
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_MT7622_HIFSYS)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
+	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MT7603E,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PCIE_MEDIATEK,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_MTK)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_XHCI_MTK,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_TPHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MTK_SOC_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_I2C_MT65XX,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PWM_MEDIATEK,m)
+	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_MT6380,m)
+	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_MTK_EFUSE,m)
+	$(call KCONFIG_SET_OPT,CONFIG_CRYPTO_DEV_SAFEXCEL,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_DRV_MT7622)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))
@@ -0,0 +1 @@
+dtb-y += mediatek/mt7622-bananapi-bpi-r64.dtb
@@ -0,0 +1,3 @@
+#include <arm64/mediatek/mt7622-bananapi-bpi-r64.dts>
+
+#include "mt7622-bananapi-bpi-r64.dtsi"
@@ -0,0 +1,10 @@
+/ {
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+			usb-ports = <&ssusb>;
+			usb-port-names = "USB";
+		};
+	};
+};
@@ -0,0 +1,89 @@
+image cfg.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
+image var.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image #INFIX_ID##VERSION#-bpi-r64-#TARGET#.img {
+        hdimage {
+                partition-table-type = "hybrid"
+                # MT7622 TF-A partition driver detects GPT by checking MBR[0]
+                # for the 0xEE protective entry.  Place it first so that BL2
+                # (with partition-type = 0x83) lands at MBR slot 1.
+                gpt-protective-first = true
+        }
+
+        # BL2 bootloader at sector 1024 (0x80000). The MT7622 Boot ROM scans
+        # the hybrid MBR for a bootable entry and loads BL2 from its offset.
+        # partition-type makes it visible in the MBR at slot 1 (slot 0 holds
+        # the 0xEE protective entry required by the TF-A partition driver).
+        partition bl2 {
+                partition-type = 0x83
+                image = "bl2.img"
+                offset = 1024s
+                size = 1024s
+                bootable = true
+        }
+
+        # Factory/calibration data at fixed offset
+        partition factory {
+                offset = 4608K
+                size = 2M
+        }
+
+        # FIP partition - BL31 + U-Boot
+        partition fip {
+                image = "fip.bin"
+                offset = 13312s
+                size = 4096s
+        }
+
+        partition aux {
+                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+                image = "aux.ext4"
+        }
+
+        partition primary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition secondary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition cfg {
+                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+                image = "cfg.ext4"
+        }
+
+        partition var {
+                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+                image = "var.ext4"
+        }
+}
@@ -0,0 +1,438 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan0",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R64"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1,14 @@
+# Rename MT7531 external switch ports by DT node path.
+
+# The DTS already contains this but it has been observed in the wild
+# that we may end up with names like lan118 rather than by DTS label,
+# so this set of rules, that run after most other rules, match on the
+# OF_FULLNAME which is a stable reference.
+#
+# MT7622 / BPI-R64 switch topology (switch@1f, ports):
+#   port@0 = wan, port@1..4 = lan0..lan3, port@5,6 = cpu
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@0", NAME="wan"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@1", NAME="lan0"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@2", NAME="lan1"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@3", NAME="lan2"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@4", NAME="lan3"
@@ -0,0 +1,2 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-emmc-env.dtsi"
+CONFIG_SUPPORT_EMMC_BOOT=y
@@ -0,0 +1,19 @@
+CONFIG_AUTOBOOT=y
+CONFIG_BOOTDELAY=2
+# CONFIG_MMC_PCI is not set
+CONFIG_ENV_IS_NOWHERE=y
+# CONFIG_ENV_IS_IN_MMC is not set
+
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_MTK=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+
+CONFIG_DM_MDIO=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_PHY_ETHERNET_ID=y
+
+CONFIG_CMD_MDIO=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_DM=y
@@ -0,0 +1,5 @@
+#include <mt7622-env.dtsi>
+
+&env {
+	fdtfile = "mediatek/mt7622-bananapi-bpi-r64.dtb";
+};
@@ -0,0 +1,18 @@
+/ {
+	config {
+		env: environment {
+			bootcmd = "run ixboot";
+			boot_targets = "mmc0";
+			ethprime = "eth0";
+			fdt_addr_r = "0x43f00000";
+			kernel_addr_r = "0x44000000";
+			scriptaddr = "0x48000000";
+			ramdisk_addr_r = "0x4A000000";
+
+			/* This is a development platform, keep
+			 * developer mode statically enabled.
+			 */
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+		};
+	};
+};
@@ -0,0 +1,6 @@
+#include <mt7622-env.dtsi>
+
+&env {
+	boot_targets = "mmc1";   /* SD = mmc1 on MT7622 */
+	fdtfile = "mediatek/mt7622-bananapi-bpi-r64.dtb";
+};
@@ -0,0 +1 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-sd-env.dtsi"
@@ -71,7 +71,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -502,6 +502,7 @@ CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
 CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_HCD_PLATFORM=m
 CONFIG_USB_OHCI_HCD=m
 CONFIG_USB_OHCI_HCD_PLATFORM=m
@@ -2,9 +2,6 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	bool "Raspberry Pi 64-bit (RPi3 and later)"
 	depends on BR2_aarch64
 	select SDCARD_AUX
-	select BR2_PACKAGE_FEATURE_WIFI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
@@ -35,7 +35,4 @@ fixup_file=fixup4.dat
 dtoverlay=vc4-kms-v3d-pi4
 lcd_rotate=2

-# Prevent console on DSI
-console=map:0
-
 gpu_mem=256
@@ -43,8 +43,8 @@ image #INFIX_ID##VERSION#-rpi64-sdcard.img {

 	partition boot {
 		partition-type = 0xc
-		bootable = "true"
 		image = "boot.vfat"
+		bootable = "true"
 	}

 	partition aux {
@@ -54,16 +54,14 @@ image #INFIX_ID##VERSION#-rpi64-sdcard.img {

 	partition primary {
 		partition-type-uuid = linux
-		bootable = "true"
-		size = 250M
 		image = "rootfs.squashfs"
+		size = 250M
 	}

 	partition secondary {
 		partition-type-uuid = linux
-		bootable = "true"
-		size = 250M
 		image = "rootfs.squashfs"
+		size = 250M
 	}

 	partition cfg {
@@ -62,7 +62,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -0,0 +1,313 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB1",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "USB2",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "USB3",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "00"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "eth0",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Raspberry Pi 400"
+              }
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0"
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "rpi-%m",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          },
+          "iburst": true
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  }
+}
@@ -0,0 +1,10 @@
+{
+    "eth0": {
+	"comment": "Primary Ethernet controller, native on BCM2711, and smsc95xx on BCM2837",
+	"phy-detached-when-down": true
+    },
+    "@ethtool:driver=smsc95xx": {
+	"comment": "BCM2837 smsc95xx driver does not support disabling flow control",
+        "broken-flow-control": true
+    }
+}
@@ -4,4 +4,5 @@ Arm 32-bit
 Board Specific Documentation
 ----------------------------

+- [Microchip SAMA7G54-EK (32-bit)](microchip-sama7g54-ek/)
 - [Raspberry Pi 2 Model B (32-bit)](raspberrypi-rpi2/)
@@ -1,20 +1,19 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
-CONFIG_AUDIT=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_BPF_JIT=y
-CONFIG_PREEMPT=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
 CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
+# CONFIG_CPU_ISOLATION is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=18
+CONFIG_LOG_BUF_SHIFT=16
 CONFIG_MEMCG=y
 CONFIG_BLK_CGROUP=y
 CONFIG_CFS_BANDWIDTH=y
@@ -31,19 +30,15 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
-CONFIG_ARCH_MULTI_V6=y
-CONFIG_ARCH_VIRT=y
-CONFIG_ARCH_BCM=y
-CONFIG_ARCH_BCM2835=y
+# CONFIG_ARM_ERRATA_643719 is not set
 CONFIG_SMP=y
 CONFIG_CPU_FREQ=y
-CONFIG_CPU_FREQ_STAT=y
-CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
 CONFIG_CPUFREQ_DT=y
-CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -55,7 +50,11 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_PARTITION_ADVANCED=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_ZSWAP=y
+CONFIG_ZSWAP_DEFAULT_ON=y
+CONFIG_ZSWAP_SHRINKER_DEFAULT_ON=y
 # CONFIG_COMPAT_BRK is not set
+# CONFIG_BALLOON_COMPACTION is not set
 CONFIG_KSM=y
 CONFIG_CMA=y
 CONFIG_NET=y
@@ -259,7 +258,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
-CONFIG_RASPBERRYPI_FIRMWARE=y
 CONFIG_FW_CFG_SYSFS=y
 CONFIG_FW_CFG_SYSFS_CMDLINE=y
 CONFIG_OF_OVERLAY=y
@@ -301,63 +299,29 @@ CONFIG_VETH=m
 CONFIG_VIRTIO_NET=y
 CONFIG_NLMON=y
 CONFIG_NET_VRF=y
-CONFIG_BCMGENET=y
-CONFIG_SMSC911X=y
-CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
-CONFIG_USB_NET_SMSC95XX=y
-CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
-CONFIG_INPUT_TOUCHSCREEN=y
-CONFIG_TOUCHSCREEN_EDT_FT5X06=m
 # CONFIG_LEGACY_PTYS is not set
-CONFIG_SERIAL_8250=y
-CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_EXTENDED=y
-CONFIG_SERIAL_8250_SHARE_IRQ=y
-CONFIG_SERIAL_8250_BCM2835AUX=y
-CONFIG_SERIAL_AMBA_PL011=y
-CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
-CONFIG_SPI_BCM2835=y
-CONFIG_SPI_BCM2835AUX=y
-CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
-CONFIG_BCM2711_THERMAL=y
-CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
-CONFIG_BCM2835_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
-CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
-CONFIG_DRM=y
-CONFIG_DRM_LOAD_EDID_FIRMWARE=y
-CONFIG_DRM_SIMPLEDRM=y
-CONFIG_DRM_PANEL_SIMPLE=m
-CONFIG_DRM_TOSHIBA_TC358762=m
-CONFIG_DRM_V3D=m
-CONFIG_DRM_VC4=m
-CONFIG_DRM_VC4_HDMI_CEC=y
-CONFIG_FB=y
-CONFIG_BACKLIGHT_CLASS_DEVICE=y
-CONFIG_SOUND=y
-CONFIG_SND=y
-CONFIG_SND_SOC=y
-CONFIG_SND_BCM2835_SOC_I2S=y
-CONFIG_HID_GENERIC=m
 CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
+CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
+CONFIG_USB_EHCI_HCD_PLATFORM=m
+CONFIG_USB_OHCI_HCD=m
+CONFIG_USB_OHCI_HCD_PLATFORM=m
 CONFIG_USB_STORAGE=y
-CONFIG_USB_DWC2=y
-CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_ETH=m
 CONFIG_USB_ETH_EEM=y
@@ -365,8 +329,6 @@ CONFIG_USB_G_SERIAL=m
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
-CONFIG_MMC_SDHCI_IPROC=y
-CONFIG_MMC_BCM2835=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
@@ -380,20 +342,13 @@ CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_LEDS_TRIGGER_TRANSIENT=y
 CONFIG_LEDS_TRIGGER_CAMERA=y
 CONFIG_DMADEVICES=y
-CONFIG_DMA_BCM2835=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
-CONFIG_STAGING=y
-CONFIG_SND_BCM2835=m
-CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
-CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
-CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT4_FS=y
@@ -426,18 +381,13 @@ CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_HARDLOCKUP_DETECTOR=y
 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
 CONFIG_TEST_LOCKUP=m
-# CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
-CONFIG_MEMTEST=y
+# CONFIG_RUNTIME_TESTING_MENU is not set
@@ -16,3 +16,28 @@
 &thermal_sensor {
 	status = "disabled";
 };
+
+/*
+ * Enable SDMMC high speed mode, please note that neither 'mmc-ddr-1_8v'
+ * or 'mmc-hs200-1_8v' work, even though [1] states they are supported,
+ * the errata [2] tells a different story: "Using mode SDR104, HS200 or
+ * HS400 may lead to tuning issues, data read errors or clock switching
+ * failures." — empirical testing has proved this on a rev 5 board.
+ *
+ * [1]: https://github.com/linux4sam/linux-at91/commit/5b35500
+ * [2]: https://ww1.microchip.com/downloads/en/DeviceDoc/SAMA7G5-Series-Silicon-Errata-and-Data-Sheet-Clarification-DS80001016A.pdf
+ */
+&sdmmc0 {
+	/delete-property/ sdhci-caps-mask;
+	cap-mmc-highspeed;
+	cap-mmc-hw-reset;
+};
+
+&sdmmc1 {
+	/delete-property/ no-1-8-v;
+	/delete-property/ sdhci-caps-mask;
+};
+
+&sdmmc2 {
+	/delete-property/ sdhci-caps-mask;
+};
@@ -1,12 +0,0 @@
-[system]
-compatible=infix-sama7g54-ek
-bootloader=uboot
-statusfile=/mnt/aux/rauc.status
-
-[slot.rootfs.0]
-device=/dev/disk/by-partlabel/primary
-bootname=primary
-
-[slot.rootfs.1]
-device=/dev/disk/by-partlabel/secondary
-bootname=secondary
@@ -1,6 +1,8 @@
 # Common U-Boot extras for SAMA7G54-EK
 CONFIG_EFI_PARTITION=y
 CONFIG_ENV_IMPORT_FDT=y
+# CONFIG_ENV_IS_IN_FAT is not set
+CONFIG_ENV_IS_NOWHERE=y
 CONFIG_FIT=y
 CONFIG_FIT_SIGNATURE=y
 CONFIG_RSA=y
@@ -2,9 +2,6 @@ config BR2_PACKAGE_RASPBERRYPI_RPI2
 	bool "Raspberry Pi 2 Model B (32-bit ARMv7)"
 	depends on BR2_arm
 	select SDCARD_AUX
-	select BR2_PACKAGE_FEATURE_WIFI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
 	help
 	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
 	  (SBC) with BCM2836 quad-core Cortex-A7 processor.
@@ -1,13 +1,19 @@
 # Raspberry Pi 2 Model B specific kernel configuration
 define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
+
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SOUND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835_SOC_I2S,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_KEYBOARD)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_TOUCHSCREEN)
 	$(call KCONFIG_SET_OPT,CONFIG_INPUT_MOUSEDEV,m)
 	$(call KCONFIG_SET_OPT,CONFIG_HID_GENERIC,m)
+	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)

 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
@@ -15,46 +21,58 @@ define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DMA_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARM_RASPBERRYPI_CPUFREQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PWM_BCM2835)
 	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_BCM2835,m)
+	$(call KCONFIG_SET_OPT,CONFIG_SPI_BCM2835,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SPI_BCM2835AUX,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SENSORS_RASPBERRYPI_HWMON,m)
+	$(call KCONFIG_SET_OPT,CONFIG_BCM2711_THERMAL,y)
 	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_SET_OPT,CONFIG_MMC_SDHCI_IPROC,y)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_BCM2835AUX)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_AMBA_PL011)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_AMBA_PL011_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
+	$(call KCONFIG_SET_OPT,CONFIG_BCMGENET,y)
 	$(call KCONFIG_SET_OPT,CONFIG_SMSC911X,y)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_USBNET)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_LAN78XX,y)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_NET_SMSC95XX,y)
 	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,y)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_KMS_HELPER)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_SIMPLEDRM,y)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_V3D,m)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_VC4,m)
-	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)
-	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
-
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_VC4_HDMI_CEC)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_LOAD_EDID_FIRMWARE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_PANEL_BRIDGE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_BRIDGE)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_TOSHIBA_TC358762,m)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_PANEL_SIMPLE,m)
+	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)

 	$(call KCONFIG_ENABLE_OPT,CONFIG_FB)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_FBDEV_EMULATION)
-
-	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
-
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC2)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NOP_USB_XCEIV)
 endef

 $(eval $(ix-board))
@@ -54,7 +54,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -0,0 +1,28 @@
+[system]
+compatible=infix-arm
+bootloader=uboot
+statusfile=/mnt/aux/rauc.status
+mountprefix=/var/lib/rauc/mnt
+bundle-formats=-plain
+max-bundle-download-size=1073741824
+
+[log.event-log]
+filename=/var/log/upgrade-json.log
+format=json-pretty
+max-size=1M
+max-files=5
+
+[keyring]
+directory=/etc/rauc/keys
+
+[slot.rootfs.0]
+device=/dev/disk/by-partlabel/primary
+bootname=primary
+
+[slot.rootfs.1]
+device=/dev/disk/by-partlabel/secondary
+bootname=secondary
+
+[slot.net.0]
+device=/dev/ram0
+bootname=net
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.36.1
-# Sun Feb  9 12:25:37 2025
+# Busybox version: 1.37.0
+# Mon Feb  9 07:51:08 2026
 #
 CONFIG_HAVE_DOT_CONFIG=y

@@ -17,6 +17,7 @@ CONFIG_SHOW_USAGE=y
 CONFIG_FEATURE_VERBOSE_USAGE=y
 # CONFIG_FEATURE_COMPRESS_USAGE is not set
 CONFIG_LFS=y
+CONFIG_TIME64=y
 CONFIG_PAM=y
 CONFIG_FEATURE_DEVPTS=y
 CONFIG_FEATURE_UTMP=y
@@ -469,6 +470,7 @@ CONFIG_FEATURE_FIND_NEWER=y
 CONFIG_FEATURE_FIND_SAMEFILE=y
 CONFIG_FEATURE_FIND_EXEC=y
 CONFIG_FEATURE_FIND_EXEC_PLUS=y
+CONFIG_FEATURE_FIND_EXEC_OK=y
 CONFIG_FEATURE_FIND_USER=y
 CONFIG_FEATURE_FIND_GROUP=y
 CONFIG_FEATURE_FIND_NOT=y
@@ -795,6 +797,7 @@ CONFIG_FLASH_ERASEALL=y
 CONFIG_FLASH_LOCK=y
 CONFIG_FLASH_UNLOCK=y
 CONFIG_FLASHCP=y
+CONFIG_GETFATTR=y
 CONFIG_HDPARM=y
 CONFIG_FEATURE_HDPARM_GET_IDENTITY=y
 # CONFIG_FEATURE_HDPARM_HDIO_SCAN_HWIF is not set
@@ -933,6 +936,7 @@ CONFIG_IPRULE=y
 CONFIG_IPNEIGH=y
 CONFIG_FEATURE_IP_ADDRESS=y
 CONFIG_FEATURE_IP_LINK=y
+CONFIG_FEATURE_IP_LINK_CAN=y
 CONFIG_FEATURE_IP_ROUTE=y
 CONFIG_FEATURE_IP_ROUTE_DIR="/etc/iproute2"
 CONFIG_FEATURE_IP_TUNNEL=y
@@ -1007,6 +1011,7 @@ CONFIG_FEATURE_WGET_HTTPS=y
 CONFIG_WHOIS=y
 CONFIG_ZCIP=y
 CONFIG_UDHCPD=y
+CONFIG_FEATURE_UDHCPD_BOOTP=y
 CONFIG_FEATURE_UDHCPD_BASE_IP_ON_MAC=y
 CONFIG_FEATURE_UDHCPD_WRITE_LEASES_EARLY=y
 CONFIG_DHCPD_LEASES_FILE="/var/lib/misc/udhcpd.leases"
@@ -1016,7 +1021,12 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
+CONFIG_UDHCPC6_DEFAULT_SCRIPT=""
 # CONFIG_UDHCPC6 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC3646 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC4704 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC4833 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC5970 is not set

 #
 # Common options for DHCP applets
@@ -1027,7 +1037,7 @@ CONFIG_UDHCP_DEBUG=0
 CONFIG_UDHCPC_SLACK_FOR_BUGGY_SERVERS=80
 CONFIG_FEATURE_UDHCP_RFC3397=y
 CONFIG_FEATURE_UDHCP_8021Q=y
-CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS="-b -R -n -O search"
+CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS=""

 #
 # Print Utilities
@@ -1132,7 +1142,7 @@ CONFIG_SH_IS_ASH=y
 CONFIG_BASH_IS_NONE=y
 CONFIG_SHELL_ASH=y
 CONFIG_ASH=y
-CONFIG_ASH_OPTIMIZE_FOR_SIZE=y
+# CONFIG_ASH_OPTIMIZE_FOR_SIZE is not set
 CONFIG_ASH_INTERNAL_GLOB=y
 CONFIG_ASH_BASH_COMPAT=y
 # CONFIG_ASH_BASH_SOURCE_CURDIR is not set
@@ -1146,7 +1156,6 @@ CONFIG_ASH_IDLE_TIMEOUT=y
 CONFIG_ASH_ECHO=y
 CONFIG_ASH_PRINTF=y
 CONFIG_ASH_TEST=y
-CONFIG_ASH_SLEEP=y
 CONFIG_ASH_HELP=y
 CONFIG_ASH_GETOPTS=y
 CONFIG_ASH_CMDCMD=y
@@ -1197,7 +1206,7 @@ CONFIG_FEATURE_SH_MATH_64=y
 CONFIG_FEATURE_SH_MATH_BASE=y
 CONFIG_FEATURE_SH_EXTRA_QUIET=y
 # CONFIG_FEATURE_SH_STANDALONE is not set
-# CONFIG_FEATURE_SH_NOFORK is not set
+CONFIG_FEATURE_SH_NOFORK=y
 CONFIG_FEATURE_SH_READ_FRAC=y
 # CONFIG_FEATURE_SH_HISTFILESIZE is not set
 CONFIG_FEATURE_SH_EMBEDDED_SCRIPTS=y
@@ -44,6 +44,10 @@ if [ -n "${ID_LIKE}" ]; then
    ID="${ID} ${ID_LIKE}"
 fi

+# Initialize default hostname for hostname.d pattern
+mkdir -p "$TARGET_DIR/etc/hostname.d"
+cp "$TARGET_DIR/etc/hostname" "$TARGET_DIR/etc/hostname.d/10-default"
+
 # This is a symlink to /usr/lib/os-release, so we remove this to keep
 # original Buildroot information.
 ixmsg "Creating /etc/os-release"
@@ -2,6 +2,7 @@
 # managed by openresolv.  DHCP lease, VPN tunnel establishment,
 # and similar events feed servers and configuration to dnsmasq.
 domain-needed
+dhcp-authoritative

 # Allow configuration and cache clear over D-Bus
 enable-dbus
@@ -10,8 +11,6 @@ enable-dbus
 #dhcp-option=option:netmask
 #dhcp-option=28			# option:broadcast
 #dhcp-option=option:domain-name
-dhcp-option=option:router
-dhcp-option=option:dns-server
 dhcp-option=12			# option:hostname

 # Generated by openresolv
@@ -1,3 +1,3 @@
-task name:ixinit log:tag:ixinit [S] <pid/syslogd> \
+task name:ixinit [S] <pid/syslogd> \
 	/usr/libexec/finit/runparts -bp /usr/libexec/infix/init.d \
 	-- Probing system
@@ -1 +0,0 @@
-task [S] <service/confd/ready> /usr/libexec/infix/mkcert -- Verifying self-signed https certificate
@@ -1,3 +1,3 @@
-service name:netopeer notify:none log env:/etc/default/confd \
-	[12345] <pid/confd> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
+service name:netopeer notify:none log:null env:/etc/default/confd      \
+	[12345] <pid/confd,usr/bootstrap> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
 	-- NETCONF server
@@ -1,3 +1,3 @@
-service name:rousette notify:none log:null <pid/confd> env:/etc/default/confd \
-	[12345] rousette --syslog -t $CONFD_TIMEOUT \
+service <!pid/confd,usr/bootstrap> notify:none log:null env:/etc/default/confd \
+	[12345] rousette --syslog --log-level info -t $CONFD_TIMEOUT           \
 	-- RESTCONF server
@@ -1,5 +1,5 @@
 # Override Finit plugin
 service cgroup.system name:dbus notify:none pid:!/run/messagebus.pid \
-	[S123456789] <pid/syslogd> /usr/bin/dbus-daemon --nofork --system --syslog-only \
+	[S123456789] <usr/bootstrap> /usr/bin/dbus-daemon --nofork --system --syslog-only \
 	-- D-Bus message bus daemon

@@ -1 +0,0 @@
-../available/mkcert.conf
@@ -1,3 +1,13 @@
+server {
+    listen       80;
+    listen       [::]:80;
+    server_name  network.local;
+
+    location / {
+        include /etc/nginx/netbrowse.conf;
+    }
+}
+
 server {
    listen       443 ssl;
    listen       [::]:443 ssl;
@@ -0,0 +1,19 @@
+# Authorize USB devices on buses that Infix has unlocked (authorized_default=1).
+#
+# With usbcore.authorized_default=2 only DT-marked hard-wired ports are
+# auto-authorized by the kernel.  When confd unlocks a bus it sets
+# authorized_default=1 on the root hub and uses nftw to authorize already-
+# present devices.  However, devices behind an intermediate hub may appear
+# asynchronously — after nftw has already finished — because hub port probing
+# is slow.  This rule catches those out-of-band additions: if a device arrives
+# unauthorized (authorized=0) on a bus where confd has set authorized_default=1
+# on any ancestor root hub, authorize it immediately.
+#
+# Note: ATTRS{} matches the attribute on the device itself or any parent,
+# so authorized_default=1 on the root hub (usbN) is found even for devices
+# connected through one or more intermediate hubs.  Locked buses keep
+# authorized_default=0, so this rule correctly leaves them alone.
+ACTION=="add", SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", \
+	ATTR{authorized}=="0", \
+	ATTRS{authorized_default}=="1", \
+	RUN+="/bin/sh -c 'echo 1 > /sys%p/authorized'"
@@ -10,49 +10,43 @@

 HOSTNAME_D="/etc/hostname.d"

-# Ensure directory exists
-mkdir -p "$HOSTNAME_D"
-
-# Find the highest priority file (reverse sort, take first)
-hostname_file=$(ls -1 "$HOSTNAME_D" 2>/dev/null | sort -r | head -1)
-
-if [ -z "$hostname_file" ]; then
+# Find highest priority file (reverse lexicographic)
+set -- "$HOSTNAME_D"/*
+if [ ! -e "$1" ]; then
    logger -it confd "No hostname sources found in $HOSTNAME_D"
    exit 1
 fi

-# Read hostname from the file (first line only, strip whitespace)
-new_hostname=$(cat "$HOSTNAME_D/$hostname_file" | head -1 | tr -d '\n\r\t ')
-if [ -z "$new_hostname" ]; then
-    logger -it confd "Empty hostname in $hostname_file"
+file=$(printf '%s\n' "$@" | sort -r | head -n1)
+IFS= read -r new < "$file"
+new=$(printf '%s' "$new" | tr -d '\r\n\t ')
+if [ -z "$new" ]; then
+    logger -it confd "Empty hostname in $file"
    exit 1
 fi

-if [ ${#new_hostname} -gt 64 ]; then
-    logger -it confd "Hostname too long (${#new_hostname} > 64) in $hostname_file"
+if [ ${#new} -gt 64 ]; then
+    logger -it confd "Hostname too long (${#new} > 64) in $file"
    exit 1
 fi

 # Check if hostname has actually changed
-current_hostname=$(hostname)
-if [ "$new_hostname" = "$current_hostname" ]; then
+if [ "$new" = "$(hostname)" ]; then
    # No change needed, exit silently
    exit 0
 fi

 # Set the hostname
-logger -it confd "Setting hostname to '$new_hostname' from $hostname_file"
-hostname "$new_hostname"
-
-# Update /etc/hostname (for persistence across reboots)
-echo "$new_hostname" > /etc/hostname
+if hostname "$new"; then
+    echo "$new" > /etc/hostname
+fi

 # Update /etc/hosts (127.0.1.1 entry for proper name resolution)
 if grep -q "^127\.0\.1\.1" /etc/hosts; then
-    sed -i -E "s/^(127\.0\.1\.1\s+).*/\1$new_hostname/" /etc/hosts
+    sed -i -E "s/^(127\.0\.1\.1\s+).*/\1$new/" /etc/hosts
 else
    # Add entry if it doesn't exist
-    echo "127.0.1.1	$new_hostname" >> /etc/hosts
+    echo "127.0.1.1	$new" >> /etc/hosts
 fi

 # Notify services of hostname change, skip while in bootstrap
@@ -62,8 +56,7 @@ if ! runlevel >/dev/null 2>&1; then
 fi

 initctl -bq status lldpd && lldpcli configure system hostname "$new_hostname" 2>/dev/null
-initctl -bq status mdns  && avahi-set-host-name "$new_hostname" 2>/dev/null
-initctl -bq touch netbrowse 2>/dev/null
+initctl -bq touch mdns-alias 2>/dev/null

 # If called from dhcp script we need to reload to activate new name in syslogd
 # Otherwise we're called from confd, which does the reload when all is done.
@@ -433,7 +433,13 @@ def probe_qemusystem(out):


 def generic_usb_ports(out):
-    """Generic USB port discovery - works for all systems"""
+    """Generic USB port discovery - works for all systems.
+
+    Each root hub gets its own uniquely-named entry so it can be independently
+    enabled or disabled.  Boards that need explicit per-port control (e.g. to
+    exclude internal buses) should annotate their DT with usb-ports /
+    usb-port-names in the chosen/infix node instead.
+    """
    ports = []
    usb_base = "/sys/bus/usb/devices"

@@ -441,26 +447,22 @@ def generic_usb_ports(out):
        return

    for entry in sorted(os.listdir(usb_base)):
-        # Only look at root hubs (usbN)
        if not entry.startswith("usb"):
            continue
-
        device_path = os.path.join(usb_base, entry)
-        # Check if this is a root hub (has authorized files)
-        if os.path.exists(os.path.join(device_path, "authorized")):
-            # Extract number from usbN
-            num = entry.replace("usb", "")
-            ports.append({
-                "num": num,
-                "path": device_path
-            })
+        if not os.path.exists(os.path.join(device_path, "authorized")):
+            continue
+        num = entry.replace("usb", "")
+        ports.append({"num": num, "path": device_path})

-    # Name ports: "USB" for single port, "USB1", "USB2", etc. for multiple
-    if ports:
-        if len(ports) == 1:
-            out["usb-ports"] = [{"name": "USB", "path": ports[0]["path"]}]
-        else:
-            out["usb-ports"] = [{"name": f"USB{p['num']}", "path": p["path"]} for p in ports]
+    if not ports:
+        return
+
+    # Single bus → "USB"; multiple → "USB1", "USB2", ... (by bus number)
+    if len(ports) == 1:
+        out["usb-ports"] = [{"name": "USB", "path": ports[0]["path"]}]
+    else:
+        out["usb-ports"] = [{"name": f"USB{p['num']}", "path": p["path"]} for p in ports]


 def probe_dmisystem(out):
@@ -519,6 +521,52 @@ def probe_dtsystem(out):
    return 0


+def probe_wifi_radios(out):
+    """Probe wifi radios via sysfs/iw and store in output dict."""
+    # feature-wifi is the only Buildroot package that enables CONFIG_MAC80211/
+    # CONFIG_CFG80211, so this directory exists iff WiFi support is built in.
+    # feature-wifi also selects BR2_PACKAGE_IW, so iw(8) is always available
+    # when this directory exists -- no separate iw check needed.
+    ieee80211 = "/sys/class/ieee80211"
+    if not os.path.exists(ieee80211):
+        return
+
+    radios = sorted(os.listdir(ieee80211))
+    if not radios:
+        return
+
+    out["wifi-radios"] = []
+    for phy in radios:
+        info = {"name": phy, "bands": []}
+        try:
+            result = subprocess.run(
+                ["iw", "phy", phy, "info"],
+                capture_output=True, text=True, timeout=5
+            )
+            if result.returncode != 0:
+                continue
+        except Exception:
+            continue
+
+        freqs = []
+        for line in result.stdout.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("* ") and "MHz" in stripped:
+                try:
+                    freqs.append(int(float(stripped.split()[1])))
+                except (ValueError, IndexError):
+                    pass
+
+        if any(2400 <= f <= 2500 for f in freqs):
+            info["bands"].append({"name": "2.4GHz"})
+        if any(5150 <= f <= 5900 for f in freqs):
+            info["bands"].append({"name": "5GHz"})
+        if any(5955 <= f <= 7115 for f in freqs):
+            info["bands"].append({"name": "6GHz"})
+
+        out["wifi-radios"].append(info)
+
+
 def main():
    out = {
        "vendor": None,
@@ -544,6 +592,8 @@ def main():
    if err:
        return err

+    probe_wifi_radios(out)
+
    if not out["factory-password-hash"]:
        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +
                         "NO FACTORY PASSWORD FOUND\033[0m\n\n")
@@ -1,18 +0,0 @@
-#!/bin/sh
-# Initialize default hostname for hostname.d pattern
-# This runs very early in boot to set up the default hostname entry
-
-HOSTNAME_D="/etc/hostname.d"
-
-# Ensure directory exists
-mkdir -p "$HOSTNAME_D"
-
-# If no default exists yet, create it from /etc/hostname (from squashfs)
-if [ ! -f "$HOSTNAME_D/10-default" ] && [ -f /etc/hostname ]; then
-    cp /etc/hostname "$HOSTNAME_D/10-default"
-fi
-
-# Apply hostname using the deterministic helper
-if [ -x /usr/libexec/infix/hostname ]; then
-    /usr/libexec/infix/hostname
-fi
@@ -5,24 +5,21 @@
 # interfaces at boot, such that physical interfaces will start from
 # the same point as virtual ones.
 tmp=$(mktemp)
-fil=$(mktemp)
+out=$(mktemp)

 # Ignore unreadable entries, like net.ipv6.conf.default.stable_secret
 sysctl net.ipv4.conf.default  >"$tmp" 2>/dev/null
 sysctl net.ipv6.conf.default >>"$tmp" 2>/dev/null

-# Filter out read-only entries like net.ipv4.conf.default.mc_forwarding
-# to prevent misleading error messages in syslog
-while IFS= read -r line; do
-    entry=$(echo "$line" | awk '{print $1}')
-    path="/proc/sys/$(echo "$entry" | tr . /)"
-    if [ -w "$path" ]; then
-        echo "$line" >> "$fil"
-    fi
-done < "$tmp"
-
-for iface in $(ip -j link show | jq -r .[].ifname); do
-    sed -e "s/.default./.${iface}./g" "$fil" | sysctl -q -p -
+# Build a single sysctl input with settings for all interfaces
+for dir in /sys/class/net/*/; do
+    iface=${dir%/}
+    iface=${iface##*/}
+    sed "s/.default./.${iface}./g" "$tmp" >> "$out"
 done

-rm "$tmp" "$fil"
+# Apply all at once, suppress errors from read-only entries
+# (e.g., net.ipv4.conf.*.mc_forwarding)
+sysctl -q -p - < "$out" 2>/dev/null
+
+rm "$tmp" "$out"
@@ -1,20 +0,0 @@
-#!/bin/sh
-# Check if /cfg/startup-config.cfg needs to be migrated to new syntax.
-# Backup of the original is created in /cfg/backup/ for old versions,
-# the migrate tool inserts old version in name before .cfg extension.
-CONFIG_FILE="/cfg/startup-config.cfg"
-BACKUP_FILE="/cfg/backup/startup-config.cfg"
-BACKUP_DIR="$(dirname "$BACKUP_FILE")"
-
-mkdir -p         "$BACKUP_DIR"
-chown root:wheel "$BACKUP_DIR"
-chmod 0770       "$BACKUP_DIR"
-
-if [ ! -f "$CONFIG_FILE" ]; then
-    logger -I $$ -k -p user.notice -t $(basename "$0")  "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
-    exit 0
-elif migrate -cq "$CONFIG_FILE"; then
-    exit 0
-fi
-
-migrate -i -b "$BACKUP_FILE" "$CONFIG_FILE"
@@ -1,7 +1,12 @@
 #!/bin/sh
+# Generate a self-signed TLS certificate.  Called from confd keystore
+# on first boot (or factory reset) when the gencert entry has empty
+# keys.  Output is written to a temporary directory that confd reads
+# and then removes after importing into the keystore.

-KEY=/cfg/ssl/private/self-signed.key
-CRT=/cfg/ssl/certs/self-signed.crt
+TMPDIR=/tmp/ssl
+KEY=$TMPDIR/self-signed.key
+CRT=$TMPDIR/self-signed.crt

 country=US
 state=California
@@ -20,23 +25,11 @@ if [ -z "$cn" ]; then
    fi
 fi

-generate()
-{
-    mkdir -p  /cfg/ssl/private /cfg/ssl/certs
-    chmod 700 /cfg/ssl/private
+mkdir -p "$TMPDIR"
+chmod 700 "$TMPDIR"

-    gencert --country "$country" --state "$state" --city "$city" --organisation "$org" \
-	    --organisation-unit "$unit" --common-name "$cn" \
-	    --out-certificate $CRT --out-key $KEY
-}
+gencert --country "$country" --state "$state" --city "$city" --organisation "$org" \
+	--organisation-unit "$unit" --common-name "$cn" \
+	--out-certificate "$CRT" --out-key "$KEY"

-CN=$(openssl x509 -noout -subject -in "${CRT}" 2>/dev/null |sed 's/.*CN=//')
-if [ -z "$CN" ] || [ "$CN" != "$cn" ]; then
-    generate "$cn"
-fi
-
-cp "${KEY}" "/etc/ssl/private/"
-cp "${CRT}" "/etc/ssl/certs/"
-initctl cond set mkcert
-
-exit 0
+exit $?
@@ -59,17 +59,9 @@ is_mmc()
 {
    [ -n "$mmc" ] && return $mmc

-    # Check if primary or secondary partition (our rootfs) is on MMC
-    for label in primary secondary; do
-        devname=$(find_partition_by_label "$label" 2>/dev/null)
-        if [ -n "$devname" ]; then
-            case "$devname" in
-                mmcblk*)
-		    mmc=0
-                    return 0
-                    ;;
-            esac
-        fi
+    # Fast sysfs check — avoids triggering the slow partition scan
+    for d in /sys/class/block/mmcblk[0-9]; do
+	[ -d "$d" ] && mmc=0 && return 0
    done

    mmc=1
@@ -78,77 +70,67 @@ is_mmc()

 wait_mmc()
 {
-    # Try up to 50 times with 0.2s sleep = 10 second timeout
-    for _ in $(seq 50); do
-        if ls /dev/mmcblk* >/dev/null 2>&1; then
-            logger $opt -p user.notice -t "$nm" "MMC device available after delay"
-            return 0
-        fi
-        sleep .2
+    tries=50
+    while [ $tries -gt 0 ]; do
+	for d in /dev/mmcblk[0-9]; do
+	    if [ -b "$d" ]; then
+		logger $opt -p user.notice -t "$nm" "MMC device available after delay"
+		return 0
+	    fi
+	done
+	sleep .2
+	tries=$((tries - 1))
    done

    logger $opt -p user.warn -t "$nm" "Timeout waiting for MMC device"
    return 1
 }

-# This early on we don't have the luxury of /dev/disk/by-label/$1
+# Read filesystem label from an ext2/3/4 formatted whole disk.
+# Superblock is at byte 1024, magic 0xEF53 at offset 56, label at 120.
+# Handles both LE and BE byte order (bi-endian MIPS, etc.)
+read_ext_label()
+{
+    magic=$(dd if="$1" bs=1 skip=1080 count=2 2>/dev/null \
+		| od -t x2 -An | tr -d ' \n')
+    case "$magic" in
+	ef53|53ef) ;;
+	*) return 1 ;;
+    esac
+
+    dd if="$1" bs=1 skip=1144 count=16 2>/dev/null | tr -d '\000'
+}
+
+# Look up a block device by its GPT partition name using the kernel's
+# sysfs uevent data (zero forks).  Falls back to reading the ext2/3/4
+# superblock for whole disks without GPT (e.g., virtual or USB setups).
 find_partition_by_label()
 {
-    label="$1"
-
-    for diskpath in /sys/class/block/*; do
-	devname=$(basename "$diskpath")
-
-	# Skip partitions, only check whole disks
-	[ -f "$diskpath/partition" ] && continue
-
-	# Skip ram, loop, and other virtual devices
-	case "$devname" in
-	    ram*|loop*|nullb*|dm-*) continue ;;
-	esac
-
-	disk="/dev/$devname"
-
-	#
-	# 1. Try GPT/MBR partition label using sgdisk
-	#
-	result=$(sgdisk -p "$disk" 2>/dev/null | awk -v label="$label" -v devname="$devname" '
-	    /^ *[0-9]/ {
-		if ($7 == label) {
-		    if (devname ~ /^(mmcblk|nvme|loop)/)
-			print devname "p" $1;
-		    else
-			print devname $1;
-		    exit 0;
-		}
-	    }
-	')
-
-	if [ -n "$result" ]; then
-	    echo "$result"
-	    return 0
-	fi
-
-	#
-	# 2. Fallback: Check if the whole disk is an ext4/ext2/ext3 filesystem
-	#
-
-	# Check for ext4/ext2/ext3 magic number (0xEF53) at offset 1080 (1024+56).
-	magic_number=$(dd if="$disk" bs=1 skip=1080 count=2 2>/dev/null | od -t x2 -A n | tr -d ' \n')
-
-	# Check for both Little-Endian ('53ef') and Big-Endian ('ef53') interpretations of 0xEF53.
-	# This supports bi-endian architectures like MIPS that may run in BE mode,
-	# as well as the LE mode which is standard for RISC-V and ext filesystems.
-	if [ "$magic_number" = "ef53" ] || [ "$magic_number" = "53ef" ]; then
-
-	    # Read the volume label from offset 1144 (1024+120)
-	    fslabel=$(dd if="$disk" bs=1 skip=1144 count=16 2>/dev/null | tr -d '\000')
-	    logger $opt -p user.notice -t "$nm" "Found label $fslabel on disk $disk ..."
-
-	    if [ "$fslabel" = "$label" ]; then
-		echo "$devname"
-		return 0
+    # The kernel exposes GPT partition names as PARTNAME in uevent
+    for uevent in /sys/class/block/*/uevent; do
+	while IFS='=' read -r key val; do
+	    if [ "$key" = "PARTNAME" ]; then
+		if [ "$val" = "$1" ]; then
+		    devname="${uevent%/uevent}"
+		    echo "${devname##*/}"
+		    return 0
+		fi
+		break
 	    fi
+	done < "$uevent"
+    done
+
+    # Fallback: ext filesystem label on whole disk
+    for diskpath in /sys/class/block/*; do
+	[ -f "$diskpath/partition" ] && continue
+	devname="${diskpath##*/}"
+	case "$devname" in
+	    ram*|loop*|nullb*|dm-*|*boot[0-9]*|*rpmb) continue ;;
+	esac
+	fslabel=$(read_ext_label "/dev/$devname")
+	if [ "$fslabel" = "$1" ]; then
+	    echo "$devname"
+	    return 0
 	fi
    done

@@ -319,12 +301,6 @@ mount_rw()
 	fi
    fi

-    # TODO: Also look for UBI partitions
-
-    # Disable periodic fsck, yet keeping safety checks on ext4
-    if grep "LABEL=$label" /etc/fstab |grep -q ext4; then
-	tune2fs -c 0 -i 0 LABEL="$1" 2>/dev/null
-    fi
    mount LABEL="$1" 2>/dev/null && return 0

    return 1
@@ -7,7 +7,7 @@ ACTION="$1"
 IP_CACHE="/var/lib/misc/${interface}.cache"
 RESOLV_CONF="/run/resolvconf/interfaces/${interface}.conf"
 NTPFILE="/run/chrony/dhcp-sources.d/${interface}.sources"
-NAME="/etc/netd/conf.d/${interface}-dhcp.conf"
+NAME="/etc/net.d/${interface}-dhcp.conf"
 NEXT="${NAME}+"

 [ -n "$broadcast" ] && BROADCAST="broadcast $broadcast"
@@ -118,8 +118,6 @@ set_dhcp_routes()
    # Reduce changes needed by comparing with previous route(s)
    cmp -s "$NAME" "$NEXT" && return
    mv "$NEXT" "$NAME"
-
-    initctl reload netd
 }

 clr_dhcp_routes()
@@ -127,8 +125,6 @@ clr_dhcp_routes()
    log "deleting DHCP routes"
    [ -f "$NAME" ] || return
    rm "$NAME"
-
-    initctl reload netd
 }

 clr_dhcp_addresses()
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.16"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -50,7 +50,6 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
@@ -135,6 +134,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
+BR2_PACKAGE_BANANAPI_BPI_R64=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
@@ -146,8 +146,11 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
+BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
 BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
+BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI=y
+BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.16"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -113,6 +113,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
+BR2_PACKAGE_BANANAPI_BPI_R64=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.16"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -52,7 +52,6 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.16"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -0,0 +1,42 @@
+BR2_aarch64=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
+BR2_SSP_NONE=y
+BR2_INIT_NONE=y
+BR2_SYSTEM_BIN_SH_NONE=y
+# BR2_PACKAGE_BUSYBOX is not set
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/mtk-openwrt/arm-trusted-firmware-mtk.git"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="78a0dfd927bb00ce973a1f8eb4079df0f755887a"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="mt7622"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_FIP=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_UBOOT_AS_BL33=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES="BOOT_DEVICE=emmc DDR3_FLYBY=1 DEVICE_HEADER_OFFSET=0x0 USE_MKIMAGE=1"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="*.img *.bin"
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mt7622_bpir64_emmc"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/emmc-extras.config"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+BR2_TARGET_UBOOT_FORMAT_DTB=y
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/*.dtsi"
+BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
@@ -0,0 +1,42 @@
+BR2_aarch64=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
+BR2_SSP_NONE=y
+BR2_INIT_NONE=y
+BR2_SYSTEM_BIN_SH_NONE=y
+# BR2_PACKAGE_BUSYBOX is not set
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/mtk-openwrt/arm-trusted-firmware-mtk.git"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="78a0dfd927bb00ce973a1f8eb4079df0f755887a"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="mt7622"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_FIP=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_UBOOT_AS_BL33=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES="BOOT_DEVICE=sdmmc DDR3_FLYBY=1 DEVICE_HEADER_OFFSET=0x80000 USE_MKIMAGE=1"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="*.img *.bin"
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mt7622_bpir64_sd"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/sd-extras.config"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+BR2_TARGET_UBOOT_FORMAT_DTB=y
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/*.dtsi"
+BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
@@ -60,7 +60,6 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
@@ -20,9 +20,8 @@ BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL=y
 BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,at91bootstrap,v4.0.9)/at91bootstrap-v4.0.9.tar.gz"
 BR2_TARGET_AT91BOOTSTRAP3_DEFCONFIG="sama7g5ekemmc_uboot"
 BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
-BR2_TARGET_UBOOT_CUSTOM_TARBALL=y
-BR2_TARGET_UBOOT_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,u-boot-at91,linux4microchip-2025.04)/u-boot-at91-linux4microchip-2025.04.tar.gz"
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="sama7g5ek_mmc"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/emmc-extras.config"
 BR2_TARGET_UBOOT_NEEDS_DTC=y
@@ -20,9 +20,8 @@ BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL=y
 BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,at91bootstrap,v4.0.9)/at91bootstrap-v4.0.9.tar.gz"
 BR2_TARGET_AT91BOOTSTRAP3_DEFCONFIG="sama7g5eksd_uboot"
 BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
-BR2_TARGET_UBOOT_CUSTOM_TARBALL=y
-BR2_TARGET_UBOOT_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,u-boot-at91,linux4microchip-2025.04)/u-boot-at91-linux4microchip-2025.04.tar.gz"
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="sama7g5ek_mmc1"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/sd-extras.config"
 BR2_TARGET_UBOOT_NEEDS_DTC=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.16"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -49,7 +49,6 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.16"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -3,23 +3,83 @@ Change Log

 All notable changes to the project are documented in this file.

-[v26.02.1][] - 2026-03-11
+[v26.03.0][] - 2026-03-31
 -------------------------

 ### Changes

- Upgrade Linux kernel to 6.18.16 (LTS)
- Add support for disabling WiFi and GPS features in builds
+- Upgrade Linux kernel to 6.18.20 (LTS)
+- Upgrade Buildroot to 2025.02.12 (LTS)
+- Upgrade FRR to 10.5.3
+- Add support for [Banana Pi R64 Mini][BPI-R64], 5 port router with WiFi 5
+- Add support for [Raspberry Pi 400][RPI-400], an RPi 4B built into a keyboard
+- Significant boot time improvements, issue #1284.  The [InitViz][] boot
+  profiling tool is now included for users who want to visualize and measure
+  the boot process on their own hardware
 - Add OSPF point-to-multipoint (P2MP) and hybrid interface type support.  This
  also includes support for setting static neighbors, issue #1426
+- **Revamped <http://network.local> device browser**.  Device cards now
+  show the IP address, product name, and firmware version from mDNS TXT
+  records.  the mDNS browser is now also available over plain HTTP
+- mDNS service records now embed the per-device hostname (using avahi's `%h`
+  wildcard), so devices avoid the `#2`, `#3` suffix collisions on service names
+  when multiple Infix devices share the same LAN
+- Add configurable mDNS hostname: set `services mdns hostname` to override the
+  mDNS name advertised in A/AAAA records.  Supports `%h` (default hostname),
+  `%i` (hardware ID), and `%m` (MAC address) format specifiers
+- cli: new `show mdns` command to list  mDNS-discovered devices on the LAN,
+  with addresses and product model
+- Add SSH client commands to the CLI:
+   - `ssh [user <name>] [port <num>] <host>` — connect to a remote device
+   - `set ssh known-hosts <host> <keytype> <pubkey>` — pre-enroll a host key
+     received out-of-band, e.g. after a factory reset
+   - `no ssh known-hosts <host>` — remove a stale or changed host key entry
+- Add support for user-configurable HTTPS certificate: select any certificate
+  stored in the keystore via `services web certificate <name>`.  The default
+  auto-generated self-signed certificate is now stored in the keystore rather
+  than in `/cfg/ssl` and existing certificates are auto-migrated on upgrade
+- Add NTP `stratum-weight` setting to fine-tune server selection when multiple
+  NTP sources are available with different stratum levels
+- Enable HDMI console output on Raspberry Pi 4 and Pi 400.  Previously the
+  display was suppressed; a login prompt now appears on the HDMI monitor

 ### Fixes

- Fix #1389: legacy name limit in firewalld triggered problems with policy names
+- Fix #892: suppress rousette RESTCONF server warnings from syslog
+- Fix #1122: add missing migration script for the YANG validation introduced
+  in v25.10.0 that disallows IP addresses on bridge member ports.  Without
+  this script, upgrading with such a `startup-config` would prevent the device
+  from booting.  The migration removes all IP addresses from bridge member
+  ports; any addresses that should be kept must be re-added to the bridge
+  interface itself after upgrade
+- Fix #1387: `infix.local` now resolves to exactly one device per LAN.  Previously
+  all Infix devices claimed both `hostname.local` and `infix.local`, causing avahi
+  to append `#2`, `#3` suffixes to the shared alias on busy networks.  Assignment
+  is now first-come-first-served using standard mDNS conflict resolution
+- Fix #1389: firewall policies with names longer than 17 characters were
+  silently rejected
 - Fix #1416: `show firewall` command show an error when the firewall is disabled
- Fix instabilities in Zebra route manager after Frr upgrade in v26.02.0
+- Fix #1438: default route from DHCP client not set at boot, regression in v26.02.0
+- Fix #1446: suppress netopeer2-server NETCONF server warnings from syslog
+- Fix #1456: update project links in SUPPORT.md and README.md to point to
+  the home page and blog at <https://www.kernelkit.org>, and update the
+  release link to always resolve to the latest stable release
 - Fix regression in MVEBU SafeXcel Crypto Engine for Marvell Armada SOCs (37xx,
  7k, 8k, and CN913x series).  Firmware package lost in v26.01.0
+- Fix DHCP client not sending hostname to server (e.g. for `dnsmasq` lease
+  registration).  All board factory configs had the hostname option without
+  `value: auto`, so `udhcpc` only requested the option instead of sending it.
+  Setting up a DHCP client manually was not affected.  Also, the hostname
+  format string (e.g. `rpi-%m`) was not expanded to the actual system hostname
+  before being passed to `udhcpc`
+- Fix dnsmasq logging spurious "Ignoring duplicate dhcp-option" warnings for
+  options 3 (router) and 6 (dns-server) on every DHCP transaction.  Add
+  `dhcp-authoritative` so clients with unexpired leases are not NAKed after
+  a router crash or factory reset that clears the lease database
+
+[BPI-R64]:  https://docs.banana-pi.org/en/BPI-R64/BananaPi_BPI-R64
+[RPI-400]:  https://www.raspberrypi.com/products/raspberry-pi-400/
+[InitViz]:  https://github.com/finit-project/InitViz

 [v26.02.0][] - 2026-03-01
 -------------------------
@@ -108,6 +168,12 @@ Noteworthy changes and additions in this release are marked below in bold text.
  latter now also require the use of `sudo` for `admin` level users
 - Enhanced `copy` command with XPath filtering support
 - Kernel now announces details of new USB devices
+- New `show keystore` admin-exec command to inspect stored keys and
+  certificates without entering configure context
+- `show system` now displays CPU/SoC temperature on all supported platforms,
+  including those that report it under the `soc` or `core` sensor name
+- CN913x (Marvell Octeon) platforms now use the hardware SBSA watchdog,
+  ensuring the device recovers automatically from software lockups

 ### Fixes

@@ -116,6 +182,8 @@ Noteworthy changes and additions in this release are marked below in bold text.
  similar to IPv4, correctly mapping to the ietf-ip.yang model semantics
 - Fix #1082: Wi-Fi interfaces always scanned, introduce a `scan-mode` to the
  Wi-Fi concept in Infix
+- Fix #1292: watchdog not working on NanoPi R2S due to a broken DesignWare
+  WDT on the RK3328 SoC; the hardware watchdog is now disabled on this board
 - Fix #1313: Container is not restarted if environment variable is changed
 - Fix #1314: Raspberry Pi 4B with 1 or 8 GiB RAM does not boot.  This was due
  newer EEPROM firmware in newer boards require a newer rpi-firmware package
@@ -125,8 +193,16 @@ Noteworthy changes and additions in this release are marked below in bold text.
  not include a dtb.  Please note, the platform has now been renamed to `arm`
 - Fix default password hash in `do password encrypt` command.  New hash is the
  same as the more commonly used `change password` command, *yescrypt*
+- Fix BPI-R3 hardware watchdog, wrong kernel config option used — the device
+  would not recover automatically from a software lockup
+- Fix WiFi signal strength display showing inverted quality labels (`excellent`
+  shown for weak signals, `bad` for strong)
+- Fix `follow` command (both shell and CLI) not properly handling log rotation;
+  it now shows the full log and tails it correctly across rotations
 - Prevent MOTD from showing on non-shell user login attempts
- Fix mDNS reflector.
+- Fix mDNS reflector never actually enabling — the avahi config was written
+  with `on`/`off` instead of the correct `yes`/`no` values, so enabling the
+  reflector in the configuration had no effect

 [wifi]: https://www.kernelkit.org/infix/latest/wifi/
 [sd card image]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
@@ -1950,7 +2026,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:

 [buildroot]:  https://buildroot.org/
 [UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.02.0...HEAD
-[v26.02.1]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.02.1
+[v26.03.0]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.03.0
 [v26.02.0]:   https://github.com/kernelkit/infix/compare/v26.01.0...v26.02.0
 [v26.01.0]:   https://github.com/kernelkit/infix/compare/v25.11.0...v26.01.0
 [v25.11.0]:   https://github.com/kernelkit/infix/compare/v25.10.0...v25.11.0
@@ -59,6 +59,8 @@ them:
  XPath: `/ietf-system:system/authentication/user/password`
 - **Default SSH and NETCONF hostkey:** `genkey` (regenerated at factory reset)
  XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
+- **Default HTTPS certificate:** `gencert` (self-signed, regenerated at factory reset)
+  XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='gencert']`
 - **Hostname format specifiers:**  
  XPath: `/ietf-system:system/hostname`
   - `%i`: OS ID, from `/etc/os-release`, from Menuconfig branding
@@ -219,8 +221,12 @@ Notice how both the public and private keys are left empty here, this
 cause them to be always automatically regenerated after each factory reset.
 Keeping the `factory-config` snippet like this means we can use the same
 file on multiple devices, without risking them sharing the same host
-keys.  Sometimes you may want the same host keys, but that is the easy
-use-case and not documented here.
+keys or TLS certificates.  Sometimes you may want the same keys, but
+that is the easy use-case and not documented here.
+
+The `genkey` entry is the default SSH host key, and `gencert` is the
+default self-signed HTTPS certificate used by the web server (nginx).
+Both are regenerated on factory reset when their keys are empty.

 ```json
  "ietf-keystore:keystore": {
@@ -233,6 +239,18 @@ use-case and not documented here.
          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
          "cleartext-private-key": "",
          "certificates": {}
+        },
+        {
+          "name": "gencert",
+          "public-key-format": "infix-crypto-types:x509-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {
+            "certificate": [
+              { "name": "self-signed", "cert-data": "" }
+            ]
+          }
        }
      ]
    }
@@ -292,9 +310,22 @@ use-case and not documented here.
        "port": 22
      }
    ]
+  },
+  "infix-services:web": {
+    "certificate": "gencert",
+    "enabled": true,
+    "console": { "enabled": true },
+    "netbrowse": { "enabled": true },
+    "restconf": { "enabled": true }
  }
 ```

+The `certificate` leaf references an asymmetric key in the keystore
+that has an associated certificate.  The default `gencert` entry uses
+a self-signed certificate.  To use a custom (e.g., CA-signed)
+certificate, create a new keystore entry with
+`x509-public-key-format` and point the web `certificate` leaf to it.
+
 ## Integration

 When integrating your software stack with Infix there may be protocols
@@ -40,16 +40,14 @@ admin@host:/config/interface/eth0/> up
 admin@host:/config/>
 ```

----
-
-> **Note:** commands in configure context are automatically generated
-> from the system's YANG models, hence different products likely have a
-> different set of commands.  However, both the `ietf-interfaces.yang`
-> and `ietf-ip.yang` models, for instance, that provide the networking
+> **Note**
+>
+> Commands in configure context are automatically generated from the
+> system's YANG models, hence different products likely have a different
+> set of commands.  However, both the `ietf-interfaces.yang` and
+> `ietf-ip.yang` models, for instance, that provide the networking
 > support are common to all systems.

----
-
 ## Set IP Address on an Interface

 ```
@@ -74,7 +72,6 @@ interfaces {
 }
 ```

-
 ## Saving Changes

 Apply the changes (from candidate to `running-config`):
@@ -85,12 +82,12 @@ admin@host:/> show running-config
 ...
 interfaces {
  interface eth0 {
-	type ethernetCsmacd;
-	ipv4 {
-	  address 192.168.2.200 {
-		prefix-length 24;
-	  }
-	}
+    type ethernetCsmacd;
+    ipv4 {
+      address 192.168.2.200 {
+        prefix-length 24;
+      }
+    }
  }
 ...
 ```
@@ -106,12 +103,10 @@ admin@host:/> copy running-config startup-config
 The `startup-config` can also be inspected with the `show` command to
 verify the changes are saved.

----
-
-> **Note:** all commands need to be spelled out, no short forms are
-> allowed in the CLI.  Use the `TAB` key to make your life easier.
-
----
+> **Important**
+>
+> All commands need to be spelled out, no short forms are allowed in the
+> CLI.  Use the `TAB` key to make your life easier.

 ## Changing Hostname

@@ -128,12 +123,10 @@ admin@example:/>
 Notice how the hostname in the prompt does not change until the change
 is committed.

----
-
-> **Note:** critical services like syslog, mDNS, LLDP, and similar that
-> advertise the hostname, are restarted when the hostname is changed.
-
----
+> **Note**
+>
+> Critical services like syslog, mDNS, LLDP, and similar that advertise
+> the hostname, are restarted when the hostname is changed.

 ## Changing Password

@@ -142,14 +135,14 @@ User management, including passwords, is also a part of `ietf-system`.
 ```
 admin@host:/config/> edit system authentication user admin
 admin@host:/config/system/authentication/user/admin/> change password
-New password: 
-Retype password: 
+New password:
+Retype password:
 admin@host:/config/system/authentication/user/admin/> leave
 ```

 The `change password` command starts an interactive dialogue that asks
 for the new password, with a confirmation, and then salts and encrypts
-the password with sha512crypt. 
+the password with sha512crypt.

 It is also possible to use the `set password ...` command.  This allows
 setting an already hashed password.  To manually hash a password, use
@@ -157,13 +150,11 @@ the `do password encrypt` command.  This launches the admin-exec command
 to hash, and optionally salt, your password.  This encrypted string can
 then be used with `set password ...`.

----
-
-> **Tip:** if you are having trouble thinking of a password, there is
-> also `do password generate`, which generates random but readable
-> strings using the UNIX command `pwgen`.
-
----
+> **Tip**
+>
+> If you are having trouble thinking of a password, there is also `do
+> password generate`, which generates random but readable strings using
+> the UNIX command `pwgen`.

 ## SSH Authorized Key

@@ -185,11 +176,11 @@ key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTT
 admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> leave
 ```

----
-
-> **Note:** the `ssh-keygen` program already base64 encodes the public
-> key data, so there is no need to use the `text-editor` command, `set`
-> does the job.
+> **Note**
+>
+> The `ssh-keygen` program already base64 encodes the public key data,
+> so there is no need to use the `text-editor` command, `set` does the
+> job.

 ----

@@ -229,13 +220,12 @@ admin@host:/config/> leave

 See the bridging example below for more.

----
-
-> **Note:** in the CLI you do not have to create the `veth0b` interface.
-> The system _infers_ this for you.  When setting up a VETH pair using
-> NETCONF, however, you must include the `veth0b` interface.
-
----
+> **Tip**
+>
+> In the CLI you do not have to create the `veth0b` interface.  The
+> system _infers_ this for you.  This does not apply when setting up a
+> VETH pair using NETCONF or RESTCONF, then you must submit a complete
+> configuration.

 ## Creating a Bridge

@@ -291,10 +281,8 @@ the VETH pair from the previous example) are now bridged.  Any traffic
 ingressing one port will egress the other.  Only reserved IEEE multicast
 is filtered, except LLDP frames as shown above.

----
-
-> **Note:** the bridge can be named anything, provided the interface
-> name is not already taken.  However, for any name outside the pattern
-> `br[0-9]+`, you have to set the interface type manually to `bridge`.
-
----
+> **Important**
+>
+> The bridge can be named anything, provided the interface name is not
+> already taken.  However, for any name outside the pattern `br[0-9]+`,
+> you have to set the interface type manually to `bridge`.
@@ -34,13 +34,11 @@ admin@host-12-34-56:/> show                   # Try: Tab or ?
 admin@host-12-34-56:/>                        # Try: Tab or ?
 ```

----
-
-> **Note:** even on an empty command line, you can tap the `Tab` or `?` keys.  
+> **Tip**
+>
+> Even on an empty command line, you can tap the `Tab` or `?` keys.  
 > See [`help keybindings`](keybindings.md) for more tips!

----
-
 ## Key Concepts

 The two modes in the CLI are the admin-exec and the configure context.
@@ -78,15 +76,15 @@ and *running* that can be managed and inspected using the `copy`,
 `show`, and `configure` commands.  The traditional names used in the CLI
 for these are listed below:

- - `factory-config` the default configuration from factory for the
-   device, i.e., what the system returns to after a `factory-reset`
- - `startup-config` created from `factory-config` at first boot after
-   factory reset.  Loaded as the system configuration on each boot
- - `running-config` what is actively running on the system.  If no
-   changes have been made since boot, it is the same as `startup-config`
- - `candidate-config` is created from `running-config` when entering the
-   configure context.  Any changes made here can be discarded (`abort`,
-   `rollback`) or committed (`commit`, `leave`) to `running-config`
+- `factory-config` the default configuration from factory for the
+  device, i.e., what the system returns to after a `factory-reset`
+- `startup-config` created from `factory-config` at first boot after
+  factory reset.  Loaded as the system configuration on each boot
+- `running-config` what is actively running on the system.  If no
+  changes have been made since boot, it is the same as `startup-config`
+- `candidate-config` is created from `running-config` when entering the
+  configure context.  Any changes made here can be discarded (`abort`,
+  `rollback`) or committed (`commit`, `leave`) to `running-config`

 Edit the *running* configuration using the `configure` command.  This
 copies *running* to *candidate*, a temporary datastore, where changes
@@ -131,16 +129,13 @@ In *configure context* the following commands are available:
 | `do command`      | Call admin-exec command: `do show log`                 |
 | `commit`          |                                                        |

-
 ## Example Session

----
-
+> **Tip**
+>
 > Remember to use the `TAB` and `?` keys to speed up your navigation.  
 > See [`help keybindings`](keybindings.md) for more tips!

----
-
 In this example we enter configure context to add an IPv4 address to
 interface `eth0`, then we apply the changes using the `leave` command.

@@ -151,8 +146,8 @@ save the changes for the next reboot.
 admin@host-12-34-56:/> configure
 admin@host-12-34-56:/config/> edit interface eth0
 admin@host-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
-      address     autoconf bind-ni-name      enabled
-	  forwarding  mtu      neighbor
+      address     autoconf      bind-ni-name     dhcp 
+      enabled     forwarding    mtu              neighbor
 admin@host-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
 admin@host-12-34-56:/config/interface/eth0/> show
 type ethernetCsmacd;
@@ -193,10 +188,12 @@ admin@host-12-34-56:/> copy startup-config running-config

 Or restart the device, for example if the change to the configuration
 caused you to lose contact with the system (it happens to the best of
-us).  The system will start up from the last "save gave".
+us).  The system will start up from the last "save game".

-> **Tip:** when restoring a backup of a configuration, or having manually
-> edited a config file, you can validate it using system's YANG models,
-> it is *not* applied if validation is successful:
+> **Tip:** Restoring Backups
+>
+> When restoring a backup of a configuration, or having manually edited
+> a config file, you can validate it using the system's YANG models, it
+> is *not* applied if validation is successful:
 >
 > `copy /media/backup/old.cfg running-config validate`
@@ -33,7 +33,7 @@ CLI has several keybindings, most significant first:
 | Ctrl-t  |                | Transpose/Swap characters before and at cursor   |
 | Meta-#  | Alt-Shift-3    | Prepend # to current line and submit to history  |

-## What is Meta?
+## What is Meta

 The Meta key is called Alt on most modern keyboards.  If you have
 neither, first tap the Esc key instead of holding down Alt/Meta.
@@ -53,4 +53,3 @@ See possible arguments, with brief help text, to a command:
    ...

 Type the command, then tap the `?` key.
-
@@ -18,7 +18,6 @@ A subnet can be entered in two ways:
 An optional `split LEN` can be given as argument, the new length value
 must be bigger than the current prefix length.  See example below.

-
 ## Examples

 Its most commonly used features are to understand how many addresses an
@@ -23,10 +23,8 @@ keybindings are really useful to learn!
 | `help text-editor`  | Help with the built-in text-editor command         |
 | `help keybindings`  | Lists available keybindings & other helpful tricks |

----
-
-> In `configure` context the `help setting` command shows the YANG
+> **Tip:** Online Help
+>
+> In `configure` context the `help <setting>` command shows the YANG
 > description text for each node and container.  To reach the admin
 > exec help from configure context, e.g., `do help text-editor`
-
----
@@ -10,7 +10,7 @@ use the `upgrade` command and a URI to a ftp/tftp/sftp or http/https server
 that hosts the file:

 ```
-admin@host:/> upgrade tftp://192.168.122.1/firmware-x86_64-v23.11.pkg
+admin@example:/> upgrade tftp://192.168.122.1/firmware-x86_64-v23.11.pkg
 installing
  0% Installing
  0% Determining slot states
@@ -31,7 +31,7 @@ installing
 99% Updating slots done.
 100% Installing done.
 Installing `tftp://192.168.122.1/firmware-x86_64-v23.11.pkg` succeeded
-admin@host:/>
+admin@example:/>
 ```

 The secondary partition (`rootfs.1`) has now been upgraded and will be used as
@@ -175,6 +175,28 @@ making any changes, **always discuss them with the Infix core team**.
 This helps avoid issues later in development and makes pull request
 reviews smoother.

+### Configuration Migration
+
+> [!IMPORTANT]
+> Whenever a YANG model change makes existing `startup-config` files
+> incompatible — removing a node, renaming a key, restructuring a
+> container — you **must** include a migration script so that devices
+> upgrading in the field are not left unbootable.
+
+Migration scripts live in `src/confd/share/migrate/<version>/` where
+`<version>` is the confd version (defined in `src/confd/configure.ac`)
+that introduces the breaking change.  Each script receives the path to
+the startup configuration file as its first argument and must edit it
+in-place.  Scripts are run in lexicographic order, so prefix them with
+a number (e.g. `40-my-change.sh`).
+
+See `src/confd/share/migrate/1.6/40-bridge-port-remove-ip.sh` for a
+worked example, and the [Configuration Migration][upgrade-migration]
+section of the Upgrade documentation for the user-facing side of this
+mechanism.
+
+[upgrade-migration]: upgrade.md#configuration-migration
+
 ### `confd`

 The Infix `src/confd/` is the engine of the system.  Currently it is a
@@ -18,8 +18,7 @@ link-local IPv6 address is then seen in the response.  In the following
 example, the PC here uses *tap0* as *if1*, Infix responds with address
 *fe80::ff:fec0:ffed*.

-```
-linux-pc:# ping -6 -L -c 3 ff02::1%tap0
+<pre class="cli"><code>linux-pc:# <b>ping -6 -L -c 3 ff02::1%tap0</b>
 PING ff02::1%tap0(ff02::1%tap0) 56 data bytes
 64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=1 ttl=64 time=0.558 ms
 64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=2 ttl=64 time=0.419 ms
@@ -28,8 +27,8 @@ PING ff02::1%tap0(ff02::1%tap0) 56 data bytes
 --- ff02::1%tap0 ping statistics ---
 3 packets transmitted, 3 received, 0% packet loss, time 2043ms
 rtt min/avg/max/mdev = 0.389/0.455/0.558/0.073 ms
-linux-pc:# 
-```
+linux-pc:#
+</code></pre>

 > [!TIP]
 > The `-L` option ignores local responses from the PC.
@@ -37,12 +36,32 @@ linux-pc:#
 This address can then be used to connect to the device, e.g., using SSH.
 Notice the syntax `username@address%interface`:

-```
-linux-pc:# ssh admin@fe80::ff:fec0:ffed%tap0
+<pre class="cli"><code>linux-pc:# <b>ssh admin@fe80::ff:fec0:ffed%tap0</b>
 admin@fe80::ff:fec0:ffed%tap0's password: admin
-admin@infix-c0-ff-ee:~$ 
-```
+admin@infix-c0-ff-ee:~$
+</code></pre>

+### Windows
+
+Infix advertises a `_workstation._tcp` DNS-SD record alongside its other
+mDNS services.  Windows 10 (build 1709+) and Windows 11 recognise this
+record and show the device in **File Explorer → Network** automatically —
+no extra software required.
+
+From the command line, use the `.local` hostname directly:
+
+<pre class="cli"><code>C:\> <b>ping infix-c0-ff-ee.local</b>
+C:\> <b>ssh admin@infix-c0-ff-ee.local</b>
+</code></pre>
+
+> [!NOTE]
+> IPv6 multicast ping (`ping ff02::1%if1`) may not display responses on
+> Windows even though the Infix device replies correctly.  If you need to
+> confirm connectivity, Wireshark will show the ICMPv6 echo replies
+> arriving.  Use mDNS (see [mDNS-SD](#mdns-sd) below) as the reliable
+> alternative.
+>
+> ![Wireshark showing IPv6 ping responses](img/windows-ipv6-ping-reply.png)

 ## LLDP

@@ -50,8 +69,7 @@ Infix supports LLDP (IEEE 802.1AB). For a device with factory default
 settings, the link-local IPv6 address can be read from the Management
 Address TLV using *tcpdump* or other sniffing tools[^1]:

-```
-linux-pc:# tcpdump -i tap0 -Qin -v ether proto 0x88cc
+<pre class="cli"><code>linux-pc:# <b>tcpdump -i tap0 -Qin -v ether proto 0x88cc</b>
 tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
 15:51:52.061071 LLDP, length 193
    Chassis ID TLV (1), length 7
@@ -80,8 +98,8 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
    End TLV (0), length 0
 ^C
 1 packet captured
-linux-pc:# 
-```
+linux-pc:#
+</code></pre>

 If the device has an IPv4 address assigned, it is shown in an additional
 Management Address TLV.
@@ -93,8 +111,7 @@ Management Address TLV.
 In the example below, the IPv4 address (10.0.1.1) happens to be
 assigned to *eth0*, while the IPv6 address (2001:db8::1) is not.

-```
-linux-pc:# sudo tcpdump -i tap0 -Qin -v ether proto 0x88cc
+<pre class="cli"><code>linux-pc:# <b>sudo tcpdump -i tap0 -Qin -v ether proto 0x88cc</b>
 tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
 15:46:07.908665 LLDP, length 207
    Chassis ID TLV (1), length 7
@@ -129,7 +146,7 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
 2 packets received by filter
 0 packets dropped by kernel
 linux-pc:#
-```
+</code></pre>

 The following capabilities are available via NETCONF/RESTCONF or the Infix CLI.

@@ -137,19 +154,17 @@ The following capabilities are available via NETCONF/RESTCONF or the Infix CLI.

 The LLDP service can be disabled using the following commands.

-```
-admin@infix-c0-ff-ee:/> configure
-admin@infix-c0-ff-ee:/config/> no lldp 
-admin@infix-c0-ff-ee:/config/> leave
-admin@infix-c0-ff-ee:/> 
-```
+<pre class="cli"><code>admin@infix-c0-ff-ee:/> <b>configure</b>
+admin@infix-c0-ff-ee:/config/> <b>no lldp</b>
+admin@infix-c0-ff-ee:/config/> <b>leave</b>
+admin@infix-c0-ff-ee:/>
+</code></pre>

 To reenable it from the CLI config mode:

-```
-admin@test-00-01-00:/config/> set lldp enabled 
-admin@test-00-01-00:/config/> leave
-```
+<pre class="cli"><code>admin@test-00-01-00:/config/> <b>set lldp enabled</b>
+admin@test-00-01-00:/config/> <b>leave</b>
+</code></pre>

 ### LLDP Message Transmission Interval

@@ -157,15 +172,14 @@ By default, LLDP uses a `message-tx-interval` of 30 seconds, as defined
 by the IEEE standard. Infix allows this value to be customized.
 To change it using the CLI:

-```
-admin@test-00-01-00:/config/> set lldp message-tx-interval 1
-admin@test-00-01-00:/config/> leave
-```
+<pre class="cli"><code>admin@test-00-01-00:/config/> <b>set lldp message-tx-interval 1</b>
+admin@test-00-01-00:/config/> <b>leave</b>
+</code></pre>

 ### LLDP Administrative Status per Interface

 Infix supports configuring the LLDP administrative status on a per-port
-basis. The default mode is `tx-and-rx`, but the following options are 
+basis. The default mode is `tx-and-rx`, but the following options are
 also supported:

 - `rx-only` – Receive LLDP packets only
@@ -174,15 +188,14 @@ also supported:

 Example configuration:

-```
-admin@test-00-01-00:/config/> set lldp port e8 dest-mac-address 01:80:C2:00:00:0E admin-status disabled
-admin@test-00-01-00:/config/> set lldp port e5 dest-mac-address 01:80:C2:00:00:0E admin-status rx-only 
-admin@test-00-01-00:/config/> set lldp port e6 dest-mac-address 01:80:C2:00:00:0E admin-status tx-only
-admin@test-00-01-00:/config/> leave
-```
+<pre class="cli"><code>admin@test-00-01-00:/config/> <b>set lldp port e8 dest-mac-address 01:80:C2:00:00:0E admin-status disabled</b>
+admin@test-00-01-00:/config/> <b>set lldp port e5 dest-mac-address 01:80:C2:00:00:0E admin-status rx-only</b>
+admin@test-00-01-00:/config/> <b>set lldp port e6 dest-mac-address 01:80:C2:00:00:0E admin-status tx-only</b>
+admin@test-00-01-00:/config/> <b>leave</b>
+</code></pre>

 > [!NOTE]
-> The destination MAC address must be the standard LLDP multicast 
+> The destination MAC address must be the standard LLDP multicast
 > address: `01:80:C2:00:00:0E`.

 ###  Displaying LLDP Neighbor Information
@@ -190,13 +203,12 @@ admin@test-00-01-00:/config/> leave
 In CLI mode, Infix also provides a convenient `show lldp` command to
 list LLDP neighbors detected on each interface:

-```
-admin@test-00-01-00:/> show lldp 
-INTERFACE       REM-IDX   TIME        CHASSIS-ID          PORT-ID             
-e5              1         902         00:a0:85:00:04:01   00:a0:85:00:04:07   
-e6              3         897         00:a0:85:00:03:01   00:a0:85:00:03:07   
+<pre class="cli"><code>admin@test-00-01-00:/> <b>show lldp</b>
+<span class="header">INTERFACE       REM-IDX   TIME        CHASSIS-ID          PORT-ID                           </span>
+e5              1         902         00:a0:85:00:04:01   00:a0:85:00:04:07
+e6              3         897         00:a0:85:00:03:01   00:a0:85:00:03:07
 e8              2         901         00:a0:85:00:02:01   00:a0:85:00:02:05
-```
+</code></pre>

 ## mDNS-SD

@@ -204,34 +216,44 @@ DNS-SD/mDNS-SD can be used to discover Infix devices and services.  By
 default, Infix use the `.local` domain for advertising services.  Some
 networks use `.lan` instead, so this configurable:

-```
-admin@infix-c0-ff-ee:/> configure
-admin@infix-c0-ff-ee:/config/> edit mdns
-admin@infix-c0-ff-ee:/config/mdns/> set domain lan
-```
+<pre class="cli"><code>admin@infix-c0-ff-ee:/> <b>configure</b>
+admin@infix-c0-ff-ee:/config/> <b>edit mdns</b>
+admin@infix-c0-ff-ee:/config/mdns/> <b>set domain lan</b>
+</code></pre>

 Other available settings include limiting the interfaces mDNS responder
-acts on:
+acts on, `allow`:

-```
-admin@infix-c0-ff-ee:/config/> set interfaces allow e1
-```
+<pre class="cli"><code>admin@infix-c0-ff-ee:/config/> <b>set interfaces allow e1</b>
+</code></pre>

-or
+or `deny`.  The `allow` and `deny` settings are complementary, `deny` always wins.

-```
-admin@infix-c0-ff-ee:/config/> set interfaces deny wan
-```
+<pre class="cli"><code>admin@infix-c0-ff-ee:/config/> <b>set interfaces deny wan</b>
+</code></pre>

-The `allow` and `deny` settings are complementary, `deny` always wins.
+Use `leave` to activate the new settings, then inspect the operational
+state and any detected neighbors with `show mdns` from admin-exec
+context:
+
+<pre class="cli"><code>admin@gateway:/> <b>show mdns</b>
+Enabled         : yes
+Domain          : local
+Deny            : wan
+
+<span class="header">HOSTNAME           ADDRESS        LAST SEEN  SERVICES                                       </span>
+Living-Room.local  192.168.0.139  17:28:43   trel(59813) sleep-proxy(61936) raop(7000) srpl-tls(853)
+firefly-4.local    192.168.0.122  17:28:37   workstation(9)
+gimli.local        192.168.0.180  17:28:37   smb(445)
+infix.local        192.168.0.1    17:28:38   https(443) workstation(9) ssh(22) https(443)
+</code></pre>

 ----

 In Linux, tools such as *avahi-browse* or *mdns-scan*[^2] can be used to
 search for devices advertising their services via mDNS.

-```
-linux-pc:# avahi-browse -ar
+<pre class="cli"><code>linux-pc:# <b>avahi-browse -ar</b>
 +   tap0 IPv6 infix-c0-ff-ee                                SFTP File Transfer   local
 +   tap0 IPv4 infix-c0-ff-ee                                SFTP File Transfer   local
 +   tap0 IPv6 infix-c0-ff-ee                                SSH Remote Terminal  local
@@ -258,7 +280,7 @@ linux-pc:# avahi-browse -ar
   txt = []
 ^C
 linux-pc:#
-```
+</code></pre>

 > [!TIP]
 > The `-t` option is also very useful, it stops browsing automatically
@@ -271,17 +293,15 @@ name mappings for IP addresses.  By default, it translates from IPv4
 addresses.  This function allows users to confirm that addresses are
 mapped correctly.

-```
-linux-pc:# avahi-resolve-host-name infix-c0-ff-ee.local
+<pre class="cli"><code>linux-pc:# <b>avahi-resolve-host-name infix-c0-ff-ee.local</b>
 infix-c0-ff-ee.local	10.0.1.1
 linux-pc:#
-```
+</code></pre>

 Thanks to mDNS we can use the advertised name instead of the IP
 address for operations like `ping` and `ssh` as shown below:

-```
-linux-pc:# ping infix-c0-ff-ee.local -c 3
+<pre class="cli"><code>linux-pc:# <b>ping infix-c0-ff-ee.local -c 3</b>
 PING infix-c0-ff-ee.local (10.0.1.1) 56(84) bytes of data.
 64 bytes from 10.0.1.1: icmp_seq=1 ttl=64 time=0.852 ms
 64 bytes from 10.0.1.1: icmp_seq=2 ttl=64 time=1.12 ms
@@ -291,8 +311,8 @@ PING infix-c0-ff-ee.local (10.0.1.1) 56(84) bytes of data.
 3 packets transmitted, 3 received, 0% packet loss, time 2003ms
 rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms

-linux-pc:# ssh admin@infix-c0-ff-ee.local
-(admin@infix-c0-ff-ee.local) Password: 
+linux-pc:# <b>ssh admin@infix-c0-ff-ee.local</b>
+(admin@infix-c0-ff-ee.local) Password:
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://www.kernelkit.org
@@ -301,27 +321,25 @@ linux-pc:# ssh admin@infix-c0-ff-ee.local
 Run the command 'cli' for interactive OAM

 linux-pc:#
-```
+</code></pre>

 To disable mDNS/mDNS-SD, type the commands:

-```
-admin@infix-c0-ff-ee:/> configure 
-admin@infix-c0-ff-ee:/config/> no mdns
-admin@infix-c0-ff-ee:/config/> leave
-```
+<pre class="cli"><code>admin@infix-c0-ff-ee:/> <b>configure</b>
+admin@infix-c0-ff-ee:/config/> <b>no mdns</b>
+admin@infix-c0-ff-ee:/config/> <b>leave</b>
+</code></pre>

 ### Human-Friendly Hostname Alias

-Each Infix deviuce advertise itself as *infix.local*, in addition to its
+Each Infix device advertises itself as *infix.local*, in addition to its
 full hostname (e.g., *infix-c0-ff-ee.local* or *foo.local*).  This alias
 works seamlessly on a network with a single Infix device, and makes it
 easy to connect when the exact hostname is not known in advance.  The
 examples below show how the alias can be used for actions such as
 pinging or establishing an SSH connection:

-```
-linux-pc:# ping infix.local -c 3
+<pre class="cli"><code>linux-pc:# <b>ping infix.local -c 3</b>
 PING infix.local (10.0.1.1) 56(84) bytes of data.
 64 bytes from 10.0.1.1: icmp_seq=1 ttl=64 time=0.751 ms
 64 bytes from 10.0.1.1: icmp_seq=2 ttl=64 time=2.28 ms
@@ -331,8 +349,8 @@ PING infix.local (10.0.1.1) 56(84) bytes of data.
 3 packets transmitted, 3 received, 0% packet loss, time 2003ms
 rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms

-linux-pc:# ssh admin@infix.local
-(admin@infix.local) Password: 
+linux-pc:# <b>ssh admin@infix.local</b>
+(admin@infix.local) Password:
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://www.kernelkit.org
@@ -341,7 +359,7 @@ linux-pc:# ssh admin@infix.local
 Run the command 'cli' for interactive OAM

 admin@infix-c0-ff-ee:~$
-```
+</code></pre>

 When multiple Infix devices are present on the LAN the alias will not
 uniquely identify a device; *infix.local* will refer to any of the
@@ -367,12 +385,11 @@ portal to access all others, if it goes down another takes its place.
 To disable the netbrowse service, and the *network.local* alias, the
 following commands can be used:

-```
-admin@infix-c0-ff-ee:/> configure 
-admin@infix-c0-ff-ee:/config/> edit web
-admin@infix-c0-ff-ee:/config/web/> no netbrowse
-admin@infix-c0-ff-ee:/config/web/> leave
-```
+<pre class="cli"><code>admin@infix-c0-ff-ee:/> <b>configure</b>
+admin@infix-c0-ff-ee:/config/> <b>edit web</b>
+admin@infix-c0-ff-ee:/config/web/> <b>no netbrowse</b>
+admin@infix-c0-ff-ee:/config/web/> <b>leave</b>
+</code></pre>


 [^1]: E.g., [lldpd](https://github.com/lldp/lldpd) which includes the
@@ -18,6 +18,14 @@ This document provides an introduction of key concepts, details how
 the system boots, including failure modes, and provides links to
 other documents for further study.

+## Project Links
+
+| **Topic**                                   | **URL**                                              |
+|---------------------------------------------|------------------------------------------------------|
+| :fontawesome-solid-house: Home page & blog  | <https://www.kernelkit.org>                          |
+| :fontawesome-brands-github: GitHub          | <https://github.com/kernelkit/infix>                 |
+| :fontawesome-solid-box-open: Latest release | <https://github.com/kernelkit/infix/releases/latest> |
+
 ## Command Line Interface

 The command line interface (CLI, see-ell-i) is the traditional way of
@@ -11,6 +11,7 @@ The keystore supports two types of cryptographic keys:

 1. **Asymmetric Keys** — public/private key pairs used for:
    - SSH host authentication (RSA keys)
+    - HTTPS/TLS certificates (X.509 keys)
    - WireGuard VPN tunnels (X25519 keys)

 2. **Symmetric Keys** — shared secrets used for:
@@ -22,10 +23,11 @@ managed via CLI, NETCONF, or RESTCONF.

 ### Supported Formats

-| **Asymmetric Key Format**                                | **Use Case**  | **Key Type** |
-|----------------------------------------------------------|---------------|--------------|
-| `rsa-private-key-format` / `ssh-public-key-format`       | SSH host keys | RSA          |
-| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN | Curve25519   |
+| **Asymmetric Key Format**                                | **Use Case**       | **Key Type** |
+|----------------------------------------------------------|--------------------|--------------|
+| `rsa-private-key-format` / `ssh-public-key-format`       | SSH host keys      | RSA          |
+| `rsa-private-key-format` / `x509-public-key-format`      | TLS certificates   | RSA + X.509  |
+| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN      | Curve25519   |

 | **Symmetric Key Format**        | **Use Case**                          |
 |-----------------------------|-----------------------------------|
@@ -46,6 +48,53 @@ keystore with the name `genkey`.
 See [SSH Management](management.md) for details on generating and importing
 custom SSH host keys.

+### TLS Certificates
+
+TLS certificates are used by the web server (nginx) for HTTPS connections.
+The default certificate is a self-signed certificate automatically generated
+on first boot and stored in the keystore with the name `gencert`.  Like SSH
+host keys, the certificate is regenerated on factory reset when its keys are
+empty.
+
+The web server's `certificate` leaf references which keystore entry to use:
+
+```json
+"infix-services:web": {
+    "certificate": "gencert",
+    "enabled": true
+}
+```
+
+To use a custom (e.g., CA-signed) certificate, create a new asymmetric key
+entry with `x509-public-key-format`, populate it with your certificate and
+private key, then point the web `certificate` leaf to it:
+
+```json
+"ietf-keystore:keystore": {
+    "asymmetric-keys": {
+        "asymmetric-key": [
+            {
+                "name": "my-cert",
+                "public-key-format": "infix-crypto-types:x509-public-key-format",
+                "public-key": "<base64-encoded-cert>",
+                "private-key-format": "infix-crypto-types:rsa-private-key-format",
+                "cleartext-private-key": "<base64-encoded-key>",
+                "certificates": {
+                    "certificate": [
+                        { "name": "ca-signed", "cert-data": "<base64-encoded-cert>" }
+                    ]
+                }
+            }
+        ]
+    }
+}
+```
+
+> [!NOTE]
+> The `public-key` and `cert-data` fields contain base64-encoded PEM data
+> with the `-----BEGIN/END-----` markers stripped.  The system reconstructs
+> the PEM files when writing them to disk for nginx.
+
 ### WireGuard Keys

 WireGuard uses X25519 elliptic curve cryptography for key exchange.  Each
@@ -116,6 +165,7 @@ wg-psk                       octet-string  zYr83O4Ykj9i1gN+/aaosJxQx...
 <span class="title">Asymmetric Keys</span>
 <span class="header">NAME                         TYPE    PUBLIC KEY                         </span>
 genkey                       rsa     MIIBCgKCAQEAnj0YinjhYDgYbEGuh7...
+gencert                      x509    MIIDXTCCAkWgAwIBAgIJAJC1HiIAZA...
 wg-tunnel                    x25519  bN1CwZ1lTP6KsrCwZ1lTP6KsrCwZ1...
 </code></pre>

--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`dtb-y += mediatek/mt7622-bananapi-bpi-r64.dtb`
				`@@ -0,0 +1 @@`
				`CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-sd-env.dtsi"`
				`@@ -1 +0,0 @@`
				`task [S] <service/confd/ready> /usr/libexec/infix/mkcert -- Verifying self-signed https certificate`