Merge pull request #1448 from kernelkit/cand/v26.02.x

Move local GitHub actions to kernelkit/actions repo
.github: move local actions to kernelkit/actions repo
2026-07-26 18:53:01 +02:00 · 2026-03-16 16:09:54 +01:00 · 2026-03-16 16:01:33 +01:00 · 2026-03-13 08:27:24 +01:00 · 2026-03-13 07:33:15 +01:00 · 2026-03-12 23:33:21 +01:00
332 changed files with 6754 additions and 10933 deletions
@@ -1,10 +1,8 @@
 Limited free support is only available using the online resources of the
-project on GitHub, and Discord, see <https://github.com/kernelkit/infix>:
+project on GitHub, and Discord, see <https://github.com/kernelkit>:

-&nbsp;&nbsp; :house: <https://www.kernelkit.org> — home page, blog, news, howto's and tutorials  
-&nbsp;&nbsp; :package: <https://github.com/kernelkit/infix/releases/latest> — latest release  
 &nbsp;&nbsp; :speech_balloon: <https://github.com/orgs/kernelkit/discussions>  
-&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>  
+&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>

 Support contracts, development of new features, fast-tracking of reviews
 and contributions, customer branding of Infix, and even customer specific
@@ -19,8 +19,6 @@ jobs:
          - aarch64_qemu_boot
          - bpi_r3_sd_boot
          - bpi_r3_emmc_boot
-          - bpi_r64_sd_boot
-          - bpi_r64_emmc_boot
          - cn9130_crb_boot
          - fireant_boot
          - nanopi_r2s_boot
@@ -11,7 +11,6 @@ on:
          - raspberrypi-rpi2
          - raspberrypi-rpi64
          - bananapi-bpi-r3
-          - bananapi-bpi-r64
          - friendlyarm-nanopi-r2s
          - microchip-sama7g54-ek
        default: 'raspberrypi-rpi64'
@@ -68,12 +67,6 @@ jobs:
              echo "ARCH=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=true" >> $GITHUB_ENV
              ;;
-            bananapi-bpi-r64)
-              echo "BOOTLOADER_SD=bpi-r64-sd-boot" >> $GITHUB_ENV
-              echo "BOOTLOADER_EMMC=bpi-r64-emmc-boot" >> $GITHUB_ENV
-              echo "ARCH=aarch64" >> $GITHUB_ENV
-              echo "BUILD_EMMC=true" >> $GITHUB_ENV
-              ;;
            friendlyarm-nanopi-r2s)
              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
              echo "ARCH=aarch64" >> $GITHUB_ENV
@@ -8,8 +8,6 @@ on:
 env:
  PROJECT_NAME: Infix
  CONTACT_EMAIL: troglobit@gmail.com
-  LIBYANG_VERSION: 4.2.2
-  SYSREPO_VERSION: 4.2.10

 jobs:
  coverity:
@@ -57,24 +55,16 @@ jobs:
          sudo apt-get -y update
          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                       libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev libavahi-client-dev
+                       libuev-dev

      - name: Build dependencies
        run: |
-          git clone -b v${LIBYANG_VERSION} --depth 1 https://github.com/CESNET/libyang.git
-          for p in patches/libyang/${LIBYANG_VERSION}/*.patch; do
-            git -C libyang apply < "$p"
-          done
+          git clone https://github.com/CESNET/libyang.git
          mkdir libyang/build
          (cd libyang/build && cmake .. && make all && sudo make install)
-
-          git clone -b v${SYSREPO_VERSION} --depth 1 https://github.com/sysrepo/sysrepo.git
-          for p in patches/sysrepo/${SYSREPO_VERSION}/*.patch; do
-            git -C sysrepo apply < "$p"
-          done
+          git clone https://github.com/sysrepo/sysrepo.git
          mkdir sysrepo/build
          (cd sysrepo/build && cmake .. && make all && sudo make install)
-
          git clone https://github.com/troglobit/libite.git
          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
          make dep
@@ -85,12 +85,12 @@ interfaces {
 admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
 admin@infix-12-34-56:/> <b>show interfaces</b>
 <u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
-lo              ethernet   UP          00:00:00:00:00:00
-                ipv4                   127.0.0.1/8 (static)
-                ipv6                   ::1/128 (static)
 eth0            ethernet   UP          52:54:00:12:34:56
                ipv4                   192.168.2.200/24 (static)
                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
 admin@infix-12-34-56:/> <b>copy running startup</b>
 </code></pre>

@@ -114,7 +114,6 @@ containers for any custom functionality you need.
 - **x86_64** - Run in VMs or on mini PCs for development and testing
 - **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
 - **Microchip SparX-5i** - Enterprise switching capabilities
- **Microchip SAMA7G54-EK** - ARM Cortex-A7
 - **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
 - **StarFive VisionFive2** - RISC-V architecture support

@@ -170,11 +169,11 @@ APIs.
 [2]: https://www.sysrepo.org/ "Sysrepo Homepage"
 [3]: https://www.kernelkit.org/infix/latest/cli/introduction/
 [4]: https://www.kernelkit.org/infix/
-[5]: https://github.com/kernelkit/infix/releases/latest
+[5]: https://github.com/kernelkit/infix/releases
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
-[Release]:         https://github.com/kernelkit/infix/releases/latest
+[Release]:         https://github.com/kernelkit/infix/releases
 [Release Badge]:   https://img.shields.io/github/v/release/kernelkit/infix 
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/
 [GitHub Status]:   https://github.com/kernelkit/infix/actions/workflows/build.yml/badge.svg
@@ -2,7 +2,6 @@ if BR2_aarch64

 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/freescale-imx8mp-evk/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/friendlyarm-nanopi-r2s/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-cn9130-crb/Config.in"
@@ -4,8 +4,7 @@ aarch64
 Board Specific Documentation
 ----------------------------

- [Banana Pi BPi-R3](banana-pi-r3/)
- [Banana Pi BPi-R64](banana-pi-r64/)
+- [Banana Pi R3](banana-pi-r3/)
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
 - [NanoPi R2S](r2s/)
@@ -8,22 +8,7 @@
 		};
 	};
 };
-/*
-From 236317dd4e55512933dcdaec3d0b4a0824f5e5bd Mon Sep 17 00:00:00 2001
-From: Shiji Yang <yangshiji66@outlook.com>
-Date: Sun, 10 Aug 2025 18:11:01 +0800
-Subject: [PATCH] arm64: dts: mediatek: mt7986: increase ATF reserved memory to
- 256 kiB

-The latest Mediatek open-source Trusted Firmware-A project has
-reserved 256 KiB for BL2 and BL31. It is better to increase the
-reserved memory region in the Linux kernel to protect the data.
-
-https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/patches-6.12/199-arm64-dts-mediatek-mt7986-increase-ATF-reserved-memo.patch
-*/
-&secmon_reserved {
-	reg = <0 0x43000000 0 0x40000>;
-};
 &cpu_thermal {
 	/delete-node/ trips;
 	/delete-node/ cooling-maps;
@@ -21,21 +21,21 @@
      {
        "name": "radio0",
        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "DE",
-          "band": "2.4GHz",
-          "channel": "auto"
-        }
-      },
-      {
-        "name": "radio1",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "DE",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+	  "band": "2.4GHz",
+	  "channel": "auto"
+	 }
+     },
+     {
+	"name": "radio1",
+	"class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
          "band": "5GHz",
          "channel": "auto"
-        }
      }
+    }
    ]
  },
  "ietf-interfaces:interfaces": {
@@ -130,8 +130,7 @@
                "id": "domain"
              },
              {
-                "id": "hostname",
-                "value": "auto"
+                "id": "hostname"
              },
              {
                "id": "dns-server"
@@ -180,7 +179,7 @@
            }
          }
        },
-        "infix-interfaces:bridge-port": {
+	"infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      },
@@ -196,7 +195,7 @@
            }
          }
        },
-        "infix-interfaces:bridge-port": {
+       "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      }
@@ -21,21 +21,21 @@
      {
        "name": "radio0",
        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "DE",
-          "band": "2.4GHz",
-          "channel": "auto"
-        }
-      },
-      {
-        "name": "radio1",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "DE",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
+	  "band": "2.4GHz",
+	  "channel": "auto"
+	 }
+     },
+     {
+	"name": "radio1",
+	"class": "infix-hardware:wifi",
+	"infix-hardware:wifi-radio": {
+	  "country-code": "DE",
          "band": "5GHz",
          "channel": "auto"
-        }
      }
+    }
    ]
  },
  "ietf-interfaces:interfaces": {
@@ -96,8 +96,7 @@
                "id": "domain"
              },
              {
-                "id": "hostname",
-                "value": "auto"
+                "id": "hostname"
              },
              {
                "id": "dns-server"
@@ -146,7 +145,7 @@
            }
          }
        },
-        "infix-interfaces:bridge-port": {
+	"infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      },
@@ -162,7 +161,7 @@
            }
          }
        },
-        "infix-interfaces:bridge-port": {
+       "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      }
@@ -1,7 +0,0 @@
-config BR2_PACKAGE_BANANAPI_BPI_R64
-	bool "Banana Pi R64"
-	depends on BR2_aarch64
-	select BR2_PACKAGE_FEATURE_WIFI
-	select SDCARD_AUX
-	help
-	  Build Banana PI R64 support
@@ -1,13 +0,0 @@
-Copyright (c) 2026 The KernelKit Authors
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -1,143 +0,0 @@
-# Banana Pi BPI-R64
-
-## Overview
-
-<img align="right" src="banana_pi_bpi-r64_interface.jpg" alt="Board Overview" width=400 padding=10>
-
-The Banana Pi BPI-R64 is a networking board based on the MediaTek MT7622
-(dual Cortex-A53, AArch64) SoC.
-
-### Hardware Features
-
- MediaTek MT7622 ARM Cortex-A53 dual-core processor @ 1.35 GHz
- 1 GB DDR3L RAM
- 8 GB eMMC storage
- microSD card slot
- MT7531 Gigabit Ethernet switch (4x LAN + 1x WAN)
- MT7603E built-in 2.4 GHz WiFi
- USB 3.0 port
- 2x Mini PCIe slots
-
-### Default Network Configuration
-
-Infix comes preconfigured with:
-
- **LAN ports** (lan0-lan3): Bridged for internal networking
- **WAN port**: DHCP client enabled for internet connectivity
- **WiFi** (wifi0-ap): Bridged to LAN (MT7615 PCIe card if fitted, otherwise MT7603E)
-
-## Boot Switch Reference
-
-<img align="right" src="bpi-r64-sw1.png" alt="SW1 Boot Switch" width=90 padding=10>
-
-The BPI-R64 uses a 2-position DIP switch (SW1) to select the boot device
-order.  The MT7622 Boot ROM tries devices in the order listed and falls
-back to the next if no valid BL2 is found at the expected location.
-
-| SW1 | Boot device | Use case                   |
-|-----|-------------|----------------------------|
-| OFF | eMMC        | Production eMMC boot       |
-| ON  | SD card     | SD card boot / development |
-
-> [!NOTE]
-> SinoVoip has exposed only one bit of the MT7622's two-bit `BOOT_SEL[1:0]`
-> strapping field via SW1, with `BOOT_SEL[1]` hardwired high.  This limits the
-> board to eMMC (`10b`) and SD (`11b`) boot; the SPI-NOR and SPI-NAND modes
-> available on the MT7622 reference board (`00b`, `01b`) are not selectable.
-
-## Getting Started
-
-### Quick Start with SD Card
-
-1. **Flash the image to an SD card** (the filename includes the version, e.g.
-   `infix-25.01-bpi-r64-sdcard.img`):
-
-<img align="right" src="debug-uart.png" alt="Debug UART" width=100 padding=10>
-
-   ```sh
-   dd if=infix-*-bpi-r64-sdcard.img of=/dev/sdX bs=4M status=progress
-   ```
-
-2. **Set boot switch:** SW1 ON (SD card boot)
-3. **Insert SD card and power on**
-4. **Connect console:** 115200 8N1 — use the dedicated Debug UART header
-   just below the 40-pin GPIO header; pins are labeled GND, RX, TX on the board
-5. **Default login:** `admin` / `admin`
-
-## Installing to eMMC
-
-Unlike the BPI-R3 (where SD and eMMC share a bus, requiring a NAND intermediate
-step), the BPI-R64 has separate controllers for SD (mmc1/MSDC1) and eMMC
-(mmc0/MSDC0).  You can write directly to eMMC while booted from SD.
-
-### eMMC Boot ROM Behaviour
-
-> [!IMPORTANT]
-> The MT7622 Boot ROM reads BL2 from the eMMC BOOT0 hardware partition (offset
-> 0), not from the User Data Area where the main disk image lives.  The
-> installation procedure below writes BL2 to BOOT0 separately to handle this.
-
-### Procedure
-
-Boot from SD and write the eMMC image from U-Boot using a FAT32-formatted USB
-drive.
-
-#### Step 1: Boot from SD card
-
-1. Set SW1 to ON (SD boot)
-2. Insert SD card with Infix
-3. Power on and break into U-Boot (press Ctrl-C during boot)
-
-#### Step 2: Write the eMMC image from U-Boot
-
-Place `infix-bpi-r64-emmc.img` and `bl2.img` on a FAT32-formatted USB drive,
-then from the U-Boot prompt:
-
-```
-usb start
-fatload usb 0:1 0x44000000 infix-bpi-r64-emmc.img
-setexpr blocks ${filesize} / 0x200
-mmc dev 0
-mmc write 0x44000000 0x0 ${blocks}
-```
-
-#### Step 3: Write BL2 to eMMC BOOT0
-
-```
-fatload usb 0:1 0x44000000 bl2.img
-mmc partconf 0 1 1 1
-setexpr blkcnt ${filesize} + 0x1ff
-setexpr blkcnt ${blkcnt} / 0x200
-mmc write 0x44000000 0x0 ${blkcnt}
-mmc partconf 0 1 1 0
-```
-
-#### Step 4: Boot from eMMC
-
-1. Power off the board
-2. Set SW1 to OFF (eMMC boot)
-3. Remove SD card and USB drive
-4. Power on
-
-## Platform Notes
-
-### mmc0 = eMMC, mmc1 = SD
-
-On MT7622, MSDC0 (mmc0) is the 8-bit eMMC controller and MSDC1 (mmc1) is the
-4-bit SD card controller — the reverse of many other platforms.
-
-## Building
-
-```sh
-# Bootloader only (SD)
-make O=x-boot-bpir64-sd bpi_r64_sd_boot_defconfig && make O=x-boot-bpir64-sd
-
-# Bootloader only (eMMC)
-make O=x-boot-bpir64-emmc bpi_r64_emmc_boot_defconfig && make O=x-boot-bpir64-emmc
-
-# Compose SD image (pass the Infix rootfs output directory)
-utils/mkimage.sh -b x-boot-bpir64-sd -r x-aarch64/images bananapi-bpi-r64
-
-# Compose eMMC image
-utils/mkimage.sh -b x-boot-bpir64-emmc -r x-aarch64/images -t emmc bananapi-bpi-r64
-```
@@ -1,35 +0,0 @@
-define BANANAPI_BPI_R64_LINUX_CONFIG_FIXUPS
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MEDIATEK)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MACH_MT7622)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_MT7622)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_MT6577)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
-	# Ethernet subsystem clock controller — required for the eth MAC,
-	# MT7531 DSA switch, and HSDMA to get their clocks from &ethsys.
-	# Without this, eth probe fails and the switch is never detected.
-	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_MT7622_ETHSYS)
-	# HIF subsystem clock controller — required for PCIe and USB.
-	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_MT7622_HIFSYS)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
-	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)
-	$(call KCONFIG_SET_OPT,CONFIG_MT7603E,m)
-	$(call KCONFIG_SET_OPT,CONFIG_PCIE_MEDIATEK,m)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_MTK)
-	$(call KCONFIG_SET_OPT,CONFIG_USB_XHCI_MTK,m)
-	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_TPHY,m)
-	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
-	$(call KCONFIG_SET_OPT,CONFIG_MTK_SOC_THERMAL,m)
-	$(call KCONFIG_SET_OPT,CONFIG_I2C_MT65XX,m)
-	$(call KCONFIG_SET_OPT,CONFIG_PWM_MEDIATEK,m)
-	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_MT6380,m)
-	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_MTK_EFUSE,m)
-	$(call KCONFIG_SET_OPT,CONFIG_CRYPTO_DEV_SAFEXCEL,m)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_DRV_MT7622)
-endef
-
-$(eval $(ix-board))
-$(eval $(generic-package))
@@ -1 +0,0 @@
-dtb-y += mediatek/mt7622-bananapi-bpi-r64.dtb
@@ -1,3 +0,0 @@
-#include <arm64/mediatek/mt7622-bananapi-bpi-r64.dts>
-
-#include "mt7622-bananapi-bpi-r64.dtsi"
@@ -1,10 +0,0 @@
-/ {
-	chosen {
-		infix {
-			/* Default admin user password: 'admin' */
-			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
-			usb-ports = <&ssusb>;
-			usb-port-names = "USB";
-		};
-	};
-};
@@ -1,89 +0,0 @@
-image cfg.ext4 {
-        empty = true
-        temporary = true
-        size = 128M
-        ext4 {
-                label = "cfg"
-                use-mke2fs = true
-                features = "uninit_bg"
-                extraargs = "-m 0 -i 4096"
-        }
-}
-
-# The /var partition will be expanded automatically at first boot
-# to use the full size of the SD-card or eMMC media.
-image var.ext4 {
-        empty = true
-        temporary = true
-        size = 128M
-        ext4 {
-                label = "var"
-                use-mke2fs = true
-                features = "uninit_bg"
-                extraargs = "-m 0 -i 4096"
-        }
-}
-
-image #INFIX_ID##VERSION#-bpi-r64-#TARGET#.img {
-        hdimage {
-                partition-table-type = "hybrid"
-                # MT7622 TF-A partition driver detects GPT by checking MBR[0]
-                # for the 0xEE protective entry.  Place it first so that BL2
-                # (with partition-type = 0x83) lands at MBR slot 1.
-                gpt-protective-first = true
-        }
-
-        # BL2 bootloader at sector 1024 (0x80000). The MT7622 Boot ROM scans
-        # the hybrid MBR for a bootable entry and loads BL2 from its offset.
-        # partition-type makes it visible in the MBR at slot 1 (slot 0 holds
-        # the 0xEE protective entry required by the TF-A partition driver).
-        partition bl2 {
-                partition-type = 0x83
-                image = "bl2.img"
-                offset = 1024s
-                size = 1024s
-                bootable = true
-        }
-
-        # Factory/calibration data at fixed offset
-        partition factory {
-                offset = 4608K
-                size = 2M
-        }
-
-        # FIP partition - BL31 + U-Boot
-        partition fip {
-                image = "fip.bin"
-                offset = 13312s
-                size = 4096s
-        }
-
-        partition aux {
-                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
-                image = "aux.ext4"
-        }
-
-        partition primary {
-                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
-                bootable = true
-                size = 250M
-                image = "rootfs.squashfs"
-        }
-
-        partition secondary {
-                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
-                bootable = true
-                size = 250M
-                image = "rootfs.squashfs"
-        }
-
-        partition cfg {
-                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
-                image = "cfg.ext4"
-        }
-
-        partition var {
-                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
-                image = "var.ext4"
-        }
-}
@@ -1,438 +0,0 @@
-{
-  "ieee802-dot1ab-lldp:lldp": {
-    "infix-lldp:enabled": true
-  },
-  "ietf-hardware:hardware": {
-    "component": [
-      {
-        "name": "USB",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "DE",
-          "band": "2.4GHz",
-          "channel": "auto"
-        }
-      }
-    ]
-  },
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "br0",
-        "type": "infix-if-type:bridge",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "192.168.0.1",
-              "prefix-length": 24
-            }
-          ]
-        }
-      },
-      {
-        "name": "lan0",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lan1",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lan2",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lan3",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      },
-      {
-        "name": "lo",
-        "type": "infix-if-type:loopback",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "127.0.0.1",
-              "prefix-length": 8
-            }
-          ]
-        },
-        "ietf-ip:ipv6": {
-          "address": [
-            {
-              "ip": "::1",
-              "prefix-length": 128
-            }
-          ]
-        }
-      },
-      {
-        "name": "wan",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv4": {
-          "infix-dhcp-client:dhcp": {
-            "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname",
-                "value": "auto"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Banana Pi BPI-R64"
-              }
-            ]
-          }
-        },
-        "ietf-ip:ipv6": {
-          "infix-dhcpv6-client:dhcp": {
-            "option": [
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "client-fqdn"
-              },
-              {
-                "id": "domain-search"
-              },
-              {
-                "id": "dns-server"
-              }
-            ]
-          }
-        }
-      },
-      {
-        "name": "wifi0-ap",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0",
-          "access-point": {
-            "ssid": "Infix",
-            "security": {
-              "secret": "wifi"
-            }
-          }
-        },
-        "infix-interfaces:bridge-port": {
-          "bridge": "br0"
-        }
-      }
-    ]
-  },
-  "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
-        }
-      ]
-    },
-    "symmetric-keys": {
-      "symmetric-key": [
-        {
-          "name": "wifi",
-          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
-          "key-format": "infix-crypto-types:passphrase-key-format"
-        }
-      ]
-    }
-  },
-  "ietf-netconf-acm:nacm": {
-    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
-    "groups": {
-      "group": [
-        {
-          "name": "admin",
-          "user-name": [
-            "admin"
-          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
-        }
-      ]
-    },
-    "rule-list": [
-      {
-        "name": "admin-acl",
-        "group": [
-          "admin"
-        ],
-        "rule": [
-          {
-            "name": "permit-all",
-            "module-name": "*",
-            "access-operations": "*",
-            "action": "permit",
-            "comment": "Allow 'admin' group complete access to all operations and data."
-          }
-        ]
-      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
-      {
-        "name": "default-deny-all",
-        "group": [
-          "*"
-        ],
-        "rule": [
-          {
-            "name": "deny-password-access",
-            "path": "/ietf-system:system/authentication/user/password",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
-          }
-        ]
-      }
-    ]
-  },
-  "ietf-netconf-server:netconf-server": {
-    "listen": {
-      "endpoints": {
-        "endpoint": [
-          {
-            "name": "default-ssh",
-            "ssh": {
-              "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
-              },
-              "ssh-server-parameters": {
-                "server-identity": {
-                  "host-key": [
-                    {
-                      "name": "default-key",
-                      "public-key": {
-                        "central-keystore-reference": "genkey"
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        ]
-      }
-    }
-  },
-  "ietf-system:system": {
-    "hostname": "bpi-%m",
-    "ntp": {
-      "server": [
-        {
-          "name": "default",
-          "udp": {
-            "address": "pool.ntp.org"
-          }
-        }
-      ]
-    },
-    "authentication": {
-      "user": [
-        {
-          "name": "admin",
-          "password": "$factory$",
-          "infix-system:shell": "bash"
-        }
-      ]
-    },
-    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
-  },
-  "infix-dhcp-server:dhcp-server": {
-    "option": [
-      {
-        "id": "ntp-server",
-        "address": "auto"
-      },
-      {
-        "id": "dns-server",
-        "address": "auto"
-      },
-      {
-        "id": "router",
-        "address": "auto"
-      }
-    ],
-    "subnet": [
-      {
-        "subnet": "192.168.0.0/24",
-        "pool": {
-          "start-address": "192.168.0.100",
-          "end-address": "192.168.0.250"
-        }
-      }
-    ]
-  },
-  "infix-firewall:firewall": {
-    "default": "wan",
-    "zone": [
-      {
-        "name": "lan",
-        "action": "accept",
-        "interface": [
-          "br0"
-        ]
-      },
-      {
-        "name": "wan",
-        "action": "drop",
-        "interface": [
-          "wan"
-        ],
-        "service": [
-          "dhcpv6-client"
-        ]
-      }
-    ],
-    "policy": [
-      {
-        "name": "lan-to-wan",
-        "action": "accept",
-        "ingress": [
-          "lan"
-        ],
-        "egress": [
-          "wan"
-        ],
-        "masquerade": true
-      }
-    ]
-  },
-  "infix-meta:meta": {
-    "version": "1.7"
-  },
-  "infix-services:mdns": {
-    "enabled": true
-  },
-  "infix-services:ssh": {
-    "enabled": true,
-    "hostkey": [
-      "genkey"
-    ],
-    "listen": [
-      {
-        "name": "ipv4",
-        "address": "0.0.0.0",
-        "port": 22
-      },
-      {
-        "name": "ipv6",
-        "address": "::",
-        "port": 22
-      }
-    ]
-  },
-  "infix-services:web": {
-    "enabled": true,
-    "console": {
-      "enabled": true
-    },
-    "netbrowse": {
-      "enabled": true
-    },
-    "restconf": {
-      "enabled": true
-    }
-  }
-}
@@ -1,14 +0,0 @@
-# Rename MT7531 external switch ports by DT node path.
-
-# The DTS already contains this but it has been observed in the wild
-# that we may end up with names like lan118 rather than by DTS label,
-# so this set of rules, that run after most other rules, match on the
-# OF_FULLNAME which is a stable reference.
-#
-# MT7622 / BPI-R64 switch topology (switch@1f, ports):
-#   port@0 = wan, port@1..4 = lan0..lan3, port@5,6 = cpu
-ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@0", NAME="wan"
-ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@1", NAME="lan0"
-ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@2", NAME="lan1"
-ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@3", NAME="lan2"
-ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@4", NAME="lan3"
@@ -1,2 +0,0 @@
-CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-emmc-env.dtsi"
-CONFIG_SUPPORT_EMMC_BOOT=y
@@ -1,19 +0,0 @@
-CONFIG_AUTOBOOT=y
-CONFIG_BOOTDELAY=2
-# CONFIG_MMC_PCI is not set
-CONFIG_ENV_IS_NOWHERE=y
-# CONFIG_ENV_IS_IN_MMC is not set
-
-CONFIG_USB=y
-CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_XHCI_MTK=y
-CONFIG_PHY=y
-CONFIG_PHY_MTK_TPHY=y
-
-CONFIG_DM_MDIO=y
-CONFIG_DM_ETH_PHY=y
-CONFIG_PHY_ETHERNET_ID=y
-
-CONFIG_CMD_MDIO=y
-CONFIG_CMD_USB=y
-CONFIG_CMD_DM=y
@@ -1,5 +0,0 @@
-#include <mt7622-env.dtsi>
-
-&env {
-	fdtfile = "mediatek/mt7622-bananapi-bpi-r64.dtb";
-};
@@ -1,18 +0,0 @@
-/ {
-	config {
-		env: environment {
-			bootcmd = "run ixboot";
-			boot_targets = "mmc0";
-			ethprime = "eth0";
-			fdt_addr_r = "0x43f00000";
-			kernel_addr_r = "0x44000000";
-			scriptaddr = "0x48000000";
-			ramdisk_addr_r = "0x4A000000";
-
-			/* This is a development platform, keep
-			 * developer mode statically enabled.
-			 */
-			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
-		};
-	};
-};
@@ -1,6 +0,0 @@
-#include <mt7622-env.dtsi>
-
-&env {
-	boot_targets = "mmc1";   /* SD = mmc1 on MT7622 */
-	fdtfile = "mediatek/mt7622-bananapi-bpi-r64.dtb";
-};
@@ -1 +0,0 @@
-CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-sd-env.dtsi"
@@ -71,8 +71,7 @@
                "id": "domain"
              },
              {
-                "id": "hostname",
-                "value": "auto"
+                "id": "hostname"
              },
              {
                "id": "dns-server"
@@ -502,7 +502,6 @@ CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
 CONFIG_USB_EHCI_HCD=m
-CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_HCD_PLATFORM=m
 CONFIG_USB_OHCI_HCD=m
 CONFIG_USB_OHCI_HCD_PLATFORM=m
@@ -2,6 +2,9 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	bool "Raspberry Pi 64-bit (RPi3 and later)"
 	depends on BR2_aarch64
 	select SDCARD_AUX
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
@@ -35,4 +35,7 @@ fixup_file=fixup4.dat
 dtoverlay=vc4-kms-v3d-pi4
 lcd_rotate=2

+# Prevent console on DSI
+console=map:0
+
 gpu_mem=256
@@ -43,8 +43,8 @@ image #INFIX_ID##VERSION#-rpi64-sdcard.img {

 	partition boot {
 		partition-type = 0xc
-		image = "boot.vfat"
 		bootable = "true"
+		image = "boot.vfat"
 	}

 	partition aux {
@@ -54,14 +54,16 @@ image #INFIX_ID##VERSION#-rpi64-sdcard.img {

 	partition primary {
 		partition-type-uuid = linux
-		image = "rootfs.squashfs"
+		bootable = "true"
 		size = 250M
+		image = "rootfs.squashfs"
 	}

 	partition secondary {
 		partition-type-uuid = linux
-		image = "rootfs.squashfs"
+		bootable = "true"
 		size = 250M
+		image = "rootfs.squashfs"
 	}

 	partition cfg {
@@ -62,8 +62,7 @@
                "id": "domain"
              },
              {
-                "id": "hostname",
-                "value": "auto"
+                "id": "hostname"
              },
              {
                "id": "dns-server"
@@ -1,313 +0,0 @@
-{
-  "ieee802-dot1ab-lldp:lldp": {
-    "infix-lldp:enabled": true
-  },
-  "ietf-hardware:hardware": {
-    "component": [
-      {
-        "name": "USB1",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "name": "USB2",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "name": "USB3",
-        "class": "infix-hardware:usb",
-        "state": {
-          "admin-state": "unlocked"
-        }
-      },
-      {
-        "name": "radio0",
-        "class": "infix-hardware:wifi",
-        "infix-hardware:wifi-radio": {
-          "country-code": "00"
-        }
-      }
-    ]
-  },
-  "ietf-interfaces:interfaces": {
-    "interface": [
-      {
-        "name": "lo",
-        "type": "infix-if-type:loopback",
-        "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "127.0.0.1",
-              "prefix-length": 8
-            }
-          ]
-        },
-        "ietf-ip:ipv6": {
-          "address": [
-            {
-              "ip": "::1",
-              "prefix-length": 128
-            }
-          ]
-        }
-      },
-      {
-        "name": "eth0",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {},
-        "ietf-ip:ipv4": {
-          "infix-dhcp-client:dhcp": {
-            "option": [
-              {
-                "id": "netmask"
-              },
-              {
-                "id": "broadcast"
-              },
-              {
-                "id": "router"
-              },
-              {
-                "id": "domain"
-              },
-              {
-                "id": "hostname",
-                "value": "auto"
-              },
-              {
-                "id": "dns-server"
-              },
-              {
-                "id": "ntp-server"
-              },
-              {
-                "id": "vendor-class",
-                "value": "Raspberry Pi 400"
-              }
-            ]
-          }
-        }
-      },
-      {
-        "name": "wifi0",
-        "type": "infix-if-type:wifi",
-        "infix-interfaces:wifi": {
-          "radio": "radio0"
-        }
-      }
-    ]
-  },
-  "ietf-keystore:keystore": {
-    "asymmetric-keys": {
-      "asymmetric-key": [
-        {
-          "name": "genkey",
-          "public-key-format": "infix-crypto-types:ssh-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {}
-        }
-      ]
-    }
-  },
-  "ietf-netconf-acm:nacm": {
-    "enable-nacm": true,
-    "read-default": "permit",
-    "write-default": "permit",
-    "exec-default": "permit",
-    "groups": {
-      "group": [
-        {
-          "name": "admin",
-          "user-name": [
-            "admin"
-          ]
-        },
-        {
-          "name": "operator",
-          "user-name": []
-        },
-        {
-          "name": "guest",
-          "user-name": []
-        }
-      ]
-    },
-    "rule-list": [
-      {
-        "name": "admin-acl",
-        "group": [
-          "admin"
-        ],
-        "rule": [
-          {
-            "name": "permit-all",
-            "module-name": "*",
-            "access-operations": "*",
-            "action": "permit",
-            "comment": "Allow 'admin' group complete access to all operations and data."
-          }
-        ]
-      },
-      {
-        "name": "operator-acl",
-        "group": [
-          "operator"
-        ],
-        "rule": [
-          {
-            "name": "permit-system-rpcs",
-            "module-name": "ietf-system",
-            "rpc-name": "*",
-            "access-operations": "exec",
-            "action": "permit",
-            "comment": "Operators can reboot, shutdown, and set system time."
-          }
-        ]
-      },
-      {
-        "name": "guest-acl",
-        "group": [
-          "guest"
-        ],
-        "rule": [
-          {
-            "name": "deny-all-write+exec",
-            "module-name": "*",
-            "access-operations": "create update delete exec",
-            "action": "deny",
-            "comment": "Guests cannot change anything or exec rpcs."
-          }
-        ]
-      },
-      {
-        "name": "default-deny-all",
-        "group": [
-          "*"
-        ],
-        "rule": [
-          {
-            "name": "deny-password-access",
-            "path": "/ietf-system:system/authentication/user/password",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access password hashes."
-          },
-          {
-            "name": "deny-keystore-access",
-            "module-name": "ietf-keystore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access cryptographic keys."
-          },
-          {
-            "name": "deny-truststore-access",
-            "module-name": "ietf-truststore",
-            "access-operations": "*",
-            "action": "deny",
-            "comment": "No user except admins can access trust store."
-          }
-        ]
-      }
-    ]
-  },
-  "ietf-netconf-server:netconf-server": {
-    "listen": {
-      "endpoints": {
-        "endpoint": [
-          {
-            "name": "default-ssh",
-            "ssh": {
-              "tcp-server-parameters": {
-                "local-bind": [
-                  {
-                    "local-address": "::"
-                  }
-                ]
-              },
-              "ssh-server-parameters": {
-                "server-identity": {
-                  "host-key": [
-                    {
-                      "name": "default-key",
-                      "public-key": {
-                        "central-keystore-reference": "genkey"
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        ]
-      }
-    }
-  },
-  "ietf-system:system": {
-    "hostname": "rpi-%m",
-    "ntp": {
-      "enabled": true,
-      "server": [
-        {
-          "name": "ntp.org",
-          "udp": {
-            "address": "pool.ntp.org"
-          },
-          "iburst": true
-        }
-      ]
-    },
-    "authentication": {
-      "user": [
-        {
-          "name": "admin",
-          "password": "$factory$",
-          "infix-system:shell": "bash"
-        }
-      ]
-    },
-    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
-  },
-  "infix-meta:meta": {
-    "version": "1.7"
-  },
-  "infix-services:mdns": {
-    "enabled": true
-  },
-  "infix-services:web": {
-    "enabled": true,
-    "console": {
-      "enabled": true
-    },
-    "netbrowse": {
-      "enabled": true
-    },
-    "restconf": {
-      "enabled": true
-    }
-  },
-  "infix-services:ssh": {
-    "enabled": true,
-    "hostkey": [
-      "genkey"
-    ],
-    "listen": [
-      {
-        "name": "ipv4",
-        "address": "0.0.0.0",
-        "port": 22
-      },
-      {
-        "name": "ipv6",
-        "address": "::",
-        "port": 22
-      }
-    ]
-  }
-}
@@ -1,10 +0,0 @@
-{
-    "eth0": {
-	"comment": "Primary Ethernet controller, native on BCM2711, and smsc95xx on BCM2837",
-	"phy-detached-when-down": true
-    },
-    "@ethtool:driver=smsc95xx": {
-	"comment": "BCM2837 smsc95xx driver does not support disabling flow control",
-        "broken-flow-control": true
-    }
-}
@@ -4,5 +4,4 @@ Arm 32-bit
 Board Specific Documentation
 ----------------------------

- [Microchip SAMA7G54-EK (32-bit)](microchip-sama7g54-ek/)
 - [Raspberry Pi 2 Model B (32-bit)](raspberrypi-rpi2/)
@@ -1,19 +1,20 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
 CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
-# CONFIG_CPU_ISOLATION is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=16
+CONFIG_LOG_BUF_SHIFT=18
 CONFIG_MEMCG=y
 CONFIG_BLK_CGROUP=y
 CONFIG_CFS_BANDWIDTH=y
@@ -30,15 +31,19 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
-# CONFIG_ARM_ERRATA_643719 is not set
+CONFIG_ARCH_MULTI_V6=y
+CONFIG_ARCH_VIRT=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
 CONFIG_SMP=y
 CONFIG_CPU_FREQ=y
-CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
-CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
 CONFIG_CPUFREQ_DT=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -50,11 +55,7 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_PARTITION_ADVANCED=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
-CONFIG_ZSWAP=y
-CONFIG_ZSWAP_DEFAULT_ON=y
-CONFIG_ZSWAP_SHRINKER_DEFAULT_ON=y
 # CONFIG_COMPAT_BRK is not set
-# CONFIG_BALLOON_COMPACTION is not set
 CONFIG_KSM=y
 CONFIG_CMA=y
 CONFIG_NET=y
@@ -258,6 +259,7 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
+CONFIG_RASPBERRYPI_FIRMWARE=y
 CONFIG_FW_CFG_SYSFS=y
 CONFIG_FW_CFG_SYSFS_CMDLINE=y
 CONFIG_OF_OVERLAY=y
@@ -299,29 +301,63 @@ CONFIG_VETH=m
 CONFIG_VIRTIO_NET=y
 CONFIG_NLMON=y
 CONFIG_NET_VRF=y
+CONFIG_BCMGENET=y
+CONFIG_SMSC911X=y
+CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
 # CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
+CONFIG_SPI_BCM2835=y
+CONFIG_SPI_BCM2835AUX=y
+CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
+CONFIG_BCM2711_THERMAL=y
+CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
+CONFIG_BCM2835_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
+CONFIG_DRM=y
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_SIMPLEDRM=y
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_TOSHIBA_TC358762=m
+CONFIG_DRM_V3D=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_VC4_HDMI_CEC=y
+CONFIG_FB=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_SOC=y
+CONFIG_SND_BCM2835_SOC_I2S=y
+CONFIG_HID_GENERIC=m
 CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
-CONFIG_USB_EHCI_HCD=m
-CONFIG_USB_EHCI_ROOT_HUB_TT=y
-CONFIG_USB_EHCI_HCD_PLATFORM=m
-CONFIG_USB_OHCI_HCD=m
-CONFIG_USB_OHCI_HCD_PLATFORM=m
 CONFIG_USB_STORAGE=y
+CONFIG_USB_DWC2=y
+CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_ETH=m
 CONFIG_USB_ETH_EEM=y
@@ -329,6 +365,8 @@ CONFIG_USB_G_SERIAL=m
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_IPROC=y
+CONFIG_MMC_BCM2835=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
@@ -342,13 +380,20 @@ CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_LEDS_TRIGGER_TRANSIENT=y
 CONFIG_LEDS_TRIGGER_CAMERA=y
 CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
+CONFIG_STAGING=y
+CONFIG_SND_BCM2835=m
+CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT4_FS=y
@@ -381,13 +426,18 @@ CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_HARDLOCKUP_DETECTOR=y
 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 CONFIG_WQ_WATCHDOG=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
 CONFIG_TEST_LOCKUP=m
+# CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
-# CONFIG_RUNTIME_TESTING_MENU is not set
+CONFIG_MEMTEST=y
@@ -16,28 +16,3 @@
 &thermal_sensor {
 	status = "disabled";
 };
-
-/*
- * Enable SDMMC high speed mode, please note that neither 'mmc-ddr-1_8v'
- * or 'mmc-hs200-1_8v' work, even though [1] states they are supported,
- * the errata [2] tells a different story: "Using mode SDR104, HS200 or
- * HS400 may lead to tuning issues, data read errors or clock switching
- * failures." — empirical testing has proved this on a rev 5 board.
- *
- * [1]: https://github.com/linux4sam/linux-at91/commit/5b35500
- * [2]: https://ww1.microchip.com/downloads/en/DeviceDoc/SAMA7G5-Series-Silicon-Errata-and-Data-Sheet-Clarification-DS80001016A.pdf
- */
-&sdmmc0 {
-	/delete-property/ sdhci-caps-mask;
-	cap-mmc-highspeed;
-	cap-mmc-hw-reset;
-};
-
-&sdmmc1 {
-	/delete-property/ no-1-8-v;
-	/delete-property/ sdhci-caps-mask;
-};
-
-&sdmmc2 {
-	/delete-property/ sdhci-caps-mask;
-};
@@ -0,0 +1,12 @@
+[system]
+compatible=infix-sama7g54-ek
+bootloader=uboot
+statusfile=/mnt/aux/rauc.status
+
+[slot.rootfs.0]
+device=/dev/disk/by-partlabel/primary
+bootname=primary
+
+[slot.rootfs.1]
+device=/dev/disk/by-partlabel/secondary
+bootname=secondary
@@ -1,8 +1,6 @@
 # Common U-Boot extras for SAMA7G54-EK
 CONFIG_EFI_PARTITION=y
 CONFIG_ENV_IMPORT_FDT=y
-# CONFIG_ENV_IS_IN_FAT is not set
-CONFIG_ENV_IS_NOWHERE=y
 CONFIG_FIT=y
 CONFIG_FIT_SIGNATURE=y
 CONFIG_RSA=y
@@ -2,6 +2,9 @@ config BR2_PACKAGE_RASPBERRYPI_RPI2
 	bool "Raspberry Pi 2 Model B (32-bit ARMv7)"
 	depends on BR2_arm
 	select SDCARD_AUX
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
 	help
 	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
 	  (SBC) with BCM2836 quad-core Cortex-A7 processor.
@@ -1,19 +1,13 @@
 # Raspberry Pi 2 Model B specific kernel configuration
 define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
-
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SOUND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
-	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835_SOC_I2S,y)
-	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_KEYBOARD)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_TOUCHSCREEN)
 	$(call KCONFIG_SET_OPT,CONFIG_INPUT_MOUSEDEV,m)
 	$(call KCONFIG_SET_OPT,CONFIG_HID_GENERIC,m)
-	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)

 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
@@ -21,58 +15,46 @@ define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DMA_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_FIRMWARE)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ARM_RASPBERRYPI_CPUFREQ)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_BCM2835)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_PWM_BCM2835)
 	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_BCM2835,m)
-	$(call KCONFIG_SET_OPT,CONFIG_SPI_BCM2835,y)
-	$(call KCONFIG_SET_OPT,CONFIG_SPI_BCM2835AUX,y)
-	$(call KCONFIG_SET_OPT,CONFIG_SENSORS_RASPBERRYPI_HWMON,m)
-	$(call KCONFIG_SET_OPT,CONFIG_BCM2711_THERMAL,y)
 	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
-	$(call KCONFIG_SET_OPT,CONFIG_MMC_SDHCI_IPROC,y)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_BCM2835AUX)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_AMBA_PL011)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_AMBA_PL011_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
-	$(call KCONFIG_SET_OPT,CONFIG_BCMGENET,y)
 	$(call KCONFIG_SET_OPT,CONFIG_SMSC911X,y)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_USBNET)
-	$(call KCONFIG_SET_OPT,CONFIG_USB_LAN78XX,y)
-	$(call KCONFIG_SET_OPT,CONFIG_USB_NET_SMSC95XX,y)
 	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,y)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_KMS_HELPER)
-	$(call KCONFIG_SET_OPT,CONFIG_DRM_SIMPLEDRM,y)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_V3D,m)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_VC4,m)
+	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
+
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_VC4_HDMI_CEC)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_LOAD_EDID_FIRMWARE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_PANEL_BRIDGE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_BRIDGE)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_TOSHIBA_TC358762,m)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_PANEL_SIMPLE,m)
-	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)

 	$(call KCONFIG_ENABLE_OPT,CONFIG_FB)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_FBDEV_EMULATION)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)

-	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC2)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_NOP_USB_XCEIV)
+	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)
 endef

 $(eval $(ix-board))
@@ -54,8 +54,7 @@
                "id": "domain"
              },
              {
-                "id": "hostname",
-                "value": "auto"
+                "id": "hostname"
              },
              {
                "id": "dns-server"
@@ -1,28 +0,0 @@
-[system]
-compatible=infix-arm
-bootloader=uboot
-statusfile=/mnt/aux/rauc.status
-mountprefix=/var/lib/rauc/mnt
-bundle-formats=-plain
-max-bundle-download-size=1073741824
-
-[log.event-log]
-filename=/var/log/upgrade-json.log
-format=json-pretty
-max-size=1M
-max-files=5
-
-[keyring]
-directory=/etc/rauc/keys
-
-[slot.rootfs.0]
-device=/dev/disk/by-partlabel/primary
-bootname=primary
-
-[slot.rootfs.1]
-device=/dev/disk/by-partlabel/secondary
-bootname=secondary
-
-[slot.net.0]
-device=/dev/ram0
-bootname=net
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.37.0
-# Mon Feb  9 07:51:08 2026
+# Busybox version: 1.36.1
+# Sun Feb  9 12:25:37 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y

@@ -17,7 +17,6 @@ CONFIG_SHOW_USAGE=y
 CONFIG_FEATURE_VERBOSE_USAGE=y
 # CONFIG_FEATURE_COMPRESS_USAGE is not set
 CONFIG_LFS=y
-CONFIG_TIME64=y
 CONFIG_PAM=y
 CONFIG_FEATURE_DEVPTS=y
 CONFIG_FEATURE_UTMP=y
@@ -470,7 +469,6 @@ CONFIG_FEATURE_FIND_NEWER=y
 CONFIG_FEATURE_FIND_SAMEFILE=y
 CONFIG_FEATURE_FIND_EXEC=y
 CONFIG_FEATURE_FIND_EXEC_PLUS=y
-CONFIG_FEATURE_FIND_EXEC_OK=y
 CONFIG_FEATURE_FIND_USER=y
 CONFIG_FEATURE_FIND_GROUP=y
 CONFIG_FEATURE_FIND_NOT=y
@@ -797,7 +795,6 @@ CONFIG_FLASH_ERASEALL=y
 CONFIG_FLASH_LOCK=y
 CONFIG_FLASH_UNLOCK=y
 CONFIG_FLASHCP=y
-CONFIG_GETFATTR=y
 CONFIG_HDPARM=y
 CONFIG_FEATURE_HDPARM_GET_IDENTITY=y
 # CONFIG_FEATURE_HDPARM_HDIO_SCAN_HWIF is not set
@@ -936,7 +933,6 @@ CONFIG_IPRULE=y
 CONFIG_IPNEIGH=y
 CONFIG_FEATURE_IP_ADDRESS=y
 CONFIG_FEATURE_IP_LINK=y
-CONFIG_FEATURE_IP_LINK_CAN=y
 CONFIG_FEATURE_IP_ROUTE=y
 CONFIG_FEATURE_IP_ROUTE_DIR="/etc/iproute2"
 CONFIG_FEATURE_IP_TUNNEL=y
@@ -1011,7 +1007,6 @@ CONFIG_FEATURE_WGET_HTTPS=y
 CONFIG_WHOIS=y
 CONFIG_ZCIP=y
 CONFIG_UDHCPD=y
-CONFIG_FEATURE_UDHCPD_BOOTP=y
 CONFIG_FEATURE_UDHCPD_BASE_IP_ON_MAC=y
 CONFIG_FEATURE_UDHCPD_WRITE_LEASES_EARLY=y
 CONFIG_DHCPD_LEASES_FILE="/var/lib/misc/udhcpd.leases"
@@ -1021,12 +1016,7 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
-CONFIG_UDHCPC6_DEFAULT_SCRIPT=""
 # CONFIG_UDHCPC6 is not set
-# CONFIG_FEATURE_UDHCPC6_RFC3646 is not set
-# CONFIG_FEATURE_UDHCPC6_RFC4704 is not set
-# CONFIG_FEATURE_UDHCPC6_RFC4833 is not set
-# CONFIG_FEATURE_UDHCPC6_RFC5970 is not set

 #
 # Common options for DHCP applets
@@ -1037,7 +1027,7 @@ CONFIG_UDHCP_DEBUG=0
 CONFIG_UDHCPC_SLACK_FOR_BUGGY_SERVERS=80
 CONFIG_FEATURE_UDHCP_RFC3397=y
 CONFIG_FEATURE_UDHCP_8021Q=y
-CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS=""
+CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS="-b -R -n -O search"

 #
 # Print Utilities
@@ -1142,7 +1132,7 @@ CONFIG_SH_IS_ASH=y
 CONFIG_BASH_IS_NONE=y
 CONFIG_SHELL_ASH=y
 CONFIG_ASH=y
-# CONFIG_ASH_OPTIMIZE_FOR_SIZE is not set
+CONFIG_ASH_OPTIMIZE_FOR_SIZE=y
 CONFIG_ASH_INTERNAL_GLOB=y
 CONFIG_ASH_BASH_COMPAT=y
 # CONFIG_ASH_BASH_SOURCE_CURDIR is not set
@@ -1156,6 +1146,7 @@ CONFIG_ASH_IDLE_TIMEOUT=y
 CONFIG_ASH_ECHO=y
 CONFIG_ASH_PRINTF=y
 CONFIG_ASH_TEST=y
+CONFIG_ASH_SLEEP=y
 CONFIG_ASH_HELP=y
 CONFIG_ASH_GETOPTS=y
 CONFIG_ASH_CMDCMD=y
@@ -1206,7 +1197,7 @@ CONFIG_FEATURE_SH_MATH_64=y
 CONFIG_FEATURE_SH_MATH_BASE=y
 CONFIG_FEATURE_SH_EXTRA_QUIET=y
 # CONFIG_FEATURE_SH_STANDALONE is not set
-CONFIG_FEATURE_SH_NOFORK=y
+# CONFIG_FEATURE_SH_NOFORK is not set
 CONFIG_FEATURE_SH_READ_FRAC=y
 # CONFIG_FEATURE_SH_HISTFILESIZE is not set
 CONFIG_FEATURE_SH_EMBEDDED_SCRIPTS=y
@@ -44,10 +44,6 @@ if [ -n "${ID_LIKE}" ]; then
    ID="${ID} ${ID_LIKE}"
 fi

-# Initialize default hostname for hostname.d pattern
-mkdir -p "$TARGET_DIR/etc/hostname.d"
-cp "$TARGET_DIR/etc/hostname" "$TARGET_DIR/etc/hostname.d/10-default"
-
 # This is a symlink to /usr/lib/os-release, so we remove this to keep
 # original Buildroot information.
 ixmsg "Creating /etc/os-release"
@@ -2,7 +2,6 @@
 # managed by openresolv.  DHCP lease, VPN tunnel establishment,
 # and similar events feed servers and configuration to dnsmasq.
 domain-needed
-dhcp-authoritative

 # Allow configuration and cache clear over D-Bus
 enable-dbus
@@ -11,6 +10,8 @@ enable-dbus
 #dhcp-option=option:netmask
 #dhcp-option=28			# option:broadcast
 #dhcp-option=option:domain-name
+dhcp-option=option:router
+dhcp-option=option:dns-server
 dhcp-option=12			# option:hostname

 # Generated by openresolv
@@ -1,3 +1,3 @@
-task name:ixinit [S] <pid/syslogd> \
+task name:ixinit log:tag:ixinit [S] <pid/syslogd> \
 	/usr/libexec/finit/runparts -bp /usr/libexec/infix/init.d \
 	-- Probing system
@@ -0,0 +1 @@
+task [S] <service/confd/ready> /usr/libexec/infix/mkcert -- Verifying self-signed https certificate
@@ -1,3 +1,3 @@
-service name:netopeer notify:none log:null env:/etc/default/confd      \
-	[12345] <pid/confd,usr/bootstrap> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
+service name:netopeer notify:none log env:/etc/default/confd \
+	[12345] <pid/confd> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
 	-- NETCONF server
@@ -1,3 +1,3 @@
-service <!pid/confd,usr/bootstrap> notify:none log:null env:/etc/default/confd \
-	[12345] rousette --syslog --log-level info -t $CONFD_TIMEOUT           \
+service name:rousette notify:none log:null <pid/confd> env:/etc/default/confd \
+	[12345] rousette --syslog -t $CONFD_TIMEOUT \
 	-- RESTCONF server
@@ -1,5 +1,5 @@
 # Override Finit plugin
 service cgroup.system name:dbus notify:none pid:!/run/messagebus.pid \
-	[S123456789] <usr/bootstrap> /usr/bin/dbus-daemon --nofork --system --syslog-only \
+	[S123456789] <pid/syslogd> /usr/bin/dbus-daemon --nofork --system --syslog-only \
 	-- D-Bus message bus daemon

@@ -0,0 +1 @@
+../available/mkcert.conf
@@ -1,13 +1,3 @@
-server {
-    listen       80;
-    listen       [::]:80;
-    server_name  network.local;
-
-    location / {
-        include /etc/nginx/netbrowse.conf;
-    }
-}
-
 server {
    listen       443 ssl;
    listen       [::]:443 ssl;
@@ -1,19 +0,0 @@
-# Authorize USB devices on buses that Infix has unlocked (authorized_default=1).
-#
-# With usbcore.authorized_default=2 only DT-marked hard-wired ports are
-# auto-authorized by the kernel.  When confd unlocks a bus it sets
-# authorized_default=1 on the root hub and uses nftw to authorize already-
-# present devices.  However, devices behind an intermediate hub may appear
-# asynchronously — after nftw has already finished — because hub port probing
-# is slow.  This rule catches those out-of-band additions: if a device arrives
-# unauthorized (authorized=0) on a bus where confd has set authorized_default=1
-# on any ancestor root hub, authorize it immediately.
-#
-# Note: ATTRS{} matches the attribute on the device itself or any parent,
-# so authorized_default=1 on the root hub (usbN) is found even for devices
-# connected through one or more intermediate hubs.  Locked buses keep
-# authorized_default=0, so this rule correctly leaves them alone.
-ACTION=="add", SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", \
-	ATTR{authorized}=="0", \
-	ATTRS{authorized_default}=="1", \
-	RUN+="/bin/sh -c 'echo 1 > /sys%p/authorized'"
@@ -10,43 +10,49 @@

 HOSTNAME_D="/etc/hostname.d"

-# Find highest priority file (reverse lexicographic)
-set -- "$HOSTNAME_D"/*
-if [ ! -e "$1" ]; then
+# Ensure directory exists
+mkdir -p "$HOSTNAME_D"
+
+# Find the highest priority file (reverse sort, take first)
+hostname_file=$(ls -1 "$HOSTNAME_D" 2>/dev/null | sort -r | head -1)
+
+if [ -z "$hostname_file" ]; then
    logger -it confd "No hostname sources found in $HOSTNAME_D"
    exit 1
 fi

-file=$(printf '%s\n' "$@" | sort -r | head -n1)
-IFS= read -r new < "$file"
-new=$(printf '%s' "$new" | tr -d '\r\n\t ')
-if [ -z "$new" ]; then
-    logger -it confd "Empty hostname in $file"
+# Read hostname from the file (first line only, strip whitespace)
+new_hostname=$(cat "$HOSTNAME_D/$hostname_file" | head -1 | tr -d '\n\r\t ')
+if [ -z "$new_hostname" ]; then
+    logger -it confd "Empty hostname in $hostname_file"
    exit 1
 fi

-if [ ${#new} -gt 64 ]; then
-    logger -it confd "Hostname too long (${#new} > 64) in $file"
+if [ ${#new_hostname} -gt 64 ]; then
+    logger -it confd "Hostname too long (${#new_hostname} > 64) in $hostname_file"
    exit 1
 fi

 # Check if hostname has actually changed
-if [ "$new" = "$(hostname)" ]; then
+current_hostname=$(hostname)
+if [ "$new_hostname" = "$current_hostname" ]; then
    # No change needed, exit silently
    exit 0
 fi

 # Set the hostname
-if hostname "$new"; then
-    echo "$new" > /etc/hostname
-fi
+logger -it confd "Setting hostname to '$new_hostname' from $hostname_file"
+hostname "$new_hostname"
+
+# Update /etc/hostname (for persistence across reboots)
+echo "$new_hostname" > /etc/hostname

 # Update /etc/hosts (127.0.1.1 entry for proper name resolution)
 if grep -q "^127\.0\.1\.1" /etc/hosts; then
-    sed -i -E "s/^(127\.0\.1\.1\s+).*/\1$new/" /etc/hosts
+    sed -i -E "s/^(127\.0\.1\.1\s+).*/\1$new_hostname/" /etc/hosts
 else
    # Add entry if it doesn't exist
-    echo "127.0.1.1	$new" >> /etc/hosts
+    echo "127.0.1.1	$new_hostname" >> /etc/hosts
 fi

 # Notify services of hostname change, skip while in bootstrap
@@ -56,7 +62,8 @@ if ! runlevel >/dev/null 2>&1; then
 fi

 initctl -bq status lldpd && lldpcli configure system hostname "$new_hostname" 2>/dev/null
-initctl -bq touch mdns-alias 2>/dev/null
+initctl -bq status mdns  && avahi-set-host-name "$new_hostname" 2>/dev/null
+initctl -bq touch netbrowse 2>/dev/null

 # If called from dhcp script we need to reload to activate new name in syslogd
 # Otherwise we're called from confd, which does the reload when all is done.
@@ -433,13 +433,7 @@ def probe_qemusystem(out):


 def generic_usb_ports(out):
-    """Generic USB port discovery - works for all systems.
-
-    Each root hub gets its own uniquely-named entry so it can be independently
-    enabled or disabled.  Boards that need explicit per-port control (e.g. to
-    exclude internal buses) should annotate their DT with usb-ports /
-    usb-port-names in the chosen/infix node instead.
-    """
+    """Generic USB port discovery - works for all systems"""
    ports = []
    usb_base = "/sys/bus/usb/devices"

@@ -447,22 +441,26 @@ def generic_usb_ports(out):
        return

    for entry in sorted(os.listdir(usb_base)):
+        # Only look at root hubs (usbN)
        if not entry.startswith("usb"):
            continue
+
        device_path = os.path.join(usb_base, entry)
-        if not os.path.exists(os.path.join(device_path, "authorized")):
-            continue
-        num = entry.replace("usb", "")
-        ports.append({"num": num, "path": device_path})
+        # Check if this is a root hub (has authorized files)
+        if os.path.exists(os.path.join(device_path, "authorized")):
+            # Extract number from usbN
+            num = entry.replace("usb", "")
+            ports.append({
+                "num": num,
+                "path": device_path
+            })

-    if not ports:
-        return
-
-    # Single bus → "USB"; multiple → "USB1", "USB2", ... (by bus number)
-    if len(ports) == 1:
-        out["usb-ports"] = [{"name": "USB", "path": ports[0]["path"]}]
-    else:
-        out["usb-ports"] = [{"name": f"USB{p['num']}", "path": p["path"]} for p in ports]
+    # Name ports: "USB" for single port, "USB1", "USB2", etc. for multiple
+    if ports:
+        if len(ports) == 1:
+            out["usb-ports"] = [{"name": "USB", "path": ports[0]["path"]}]
+        else:
+            out["usb-ports"] = [{"name": f"USB{p['num']}", "path": p["path"]} for p in ports]


 def probe_dmisystem(out):
@@ -521,52 +519,6 @@ def probe_dtsystem(out):
    return 0


-def probe_wifi_radios(out):
-    """Probe wifi radios via sysfs/iw and store in output dict."""
-    # feature-wifi is the only Buildroot package that enables CONFIG_MAC80211/
-    # CONFIG_CFG80211, so this directory exists iff WiFi support is built in.
-    # feature-wifi also selects BR2_PACKAGE_IW, so iw(8) is always available
-    # when this directory exists -- no separate iw check needed.
-    ieee80211 = "/sys/class/ieee80211"
-    if not os.path.exists(ieee80211):
-        return
-
-    radios = sorted(os.listdir(ieee80211))
-    if not radios:
-        return
-
-    out["wifi-radios"] = []
-    for phy in radios:
-        info = {"name": phy, "bands": []}
-        try:
-            result = subprocess.run(
-                ["iw", "phy", phy, "info"],
-                capture_output=True, text=True, timeout=5
-            )
-            if result.returncode != 0:
-                continue
-        except Exception:
-            continue
-
-        freqs = []
-        for line in result.stdout.splitlines():
-            stripped = line.strip()
-            if stripped.startswith("* ") and "MHz" in stripped:
-                try:
-                    freqs.append(int(float(stripped.split()[1])))
-                except (ValueError, IndexError):
-                    pass
-
-        if any(2400 <= f <= 2500 for f in freqs):
-            info["bands"].append({"name": "2.4GHz"})
-        if any(5150 <= f <= 5900 for f in freqs):
-            info["bands"].append({"name": "5GHz"})
-        if any(5955 <= f <= 7115 for f in freqs):
-            info["bands"].append({"name": "6GHz"})
-
-        out["wifi-radios"].append(info)
-
-
 def main():
    out = {
        "vendor": None,
@@ -592,8 +544,6 @@ def main():
    if err:
        return err

-    probe_wifi_radios(out)
-
    if not out["factory-password-hash"]:
        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +
                         "NO FACTORY PASSWORD FOUND\033[0m\n\n")
@@ -0,0 +1,18 @@
+#!/bin/sh
+# Initialize default hostname for hostname.d pattern
+# This runs very early in boot to set up the default hostname entry
+
+HOSTNAME_D="/etc/hostname.d"
+
+# Ensure directory exists
+mkdir -p "$HOSTNAME_D"
+
+# If no default exists yet, create it from /etc/hostname (from squashfs)
+if [ ! -f "$HOSTNAME_D/10-default" ] && [ -f /etc/hostname ]; then
+    cp /etc/hostname "$HOSTNAME_D/10-default"
+fi
+
+# Apply hostname using the deterministic helper
+if [ -x /usr/libexec/infix/hostname ]; then
+    /usr/libexec/infix/hostname
+fi
@@ -5,21 +5,24 @@
 # interfaces at boot, such that physical interfaces will start from
 # the same point as virtual ones.
 tmp=$(mktemp)
-out=$(mktemp)
+fil=$(mktemp)

 # Ignore unreadable entries, like net.ipv6.conf.default.stable_secret
 sysctl net.ipv4.conf.default  >"$tmp" 2>/dev/null
 sysctl net.ipv6.conf.default >>"$tmp" 2>/dev/null

-# Build a single sysctl input with settings for all interfaces
-for dir in /sys/class/net/*/; do
-    iface=${dir%/}
-    iface=${iface##*/}
-    sed "s/.default./.${iface}./g" "$tmp" >> "$out"
+# Filter out read-only entries like net.ipv4.conf.default.mc_forwarding
+# to prevent misleading error messages in syslog
+while IFS= read -r line; do
+    entry=$(echo "$line" | awk '{print $1}')
+    path="/proc/sys/$(echo "$entry" | tr . /)"
+    if [ -w "$path" ]; then
+        echo "$line" >> "$fil"
+    fi
+done < "$tmp"
+
+for iface in $(ip -j link show | jq -r .[].ifname); do
+    sed -e "s/.default./.${iface}./g" "$fil" | sysctl -q -p -
 done

-# Apply all at once, suppress errors from read-only entries
-# (e.g., net.ipv4.conf.*.mc_forwarding)
-sysctl -q -p - < "$out" 2>/dev/null
-
-rm "$tmp" "$out"
+rm "$tmp" "$fil"
@@ -0,0 +1,20 @@
+#!/bin/sh
+# Check if /cfg/startup-config.cfg needs to be migrated to new syntax.
+# Backup of the original is created in /cfg/backup/ for old versions,
+# the migrate tool inserts old version in name before .cfg extension.
+CONFIG_FILE="/cfg/startup-config.cfg"
+BACKUP_FILE="/cfg/backup/startup-config.cfg"
+BACKUP_DIR="$(dirname "$BACKUP_FILE")"
+
+mkdir -p         "$BACKUP_DIR"
+chown root:wheel "$BACKUP_DIR"
+chmod 0770       "$BACKUP_DIR"
+
+if [ ! -f "$CONFIG_FILE" ]; then
+    logger -I $$ -k -p user.notice -t $(basename "$0")  "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
+    exit 0
+elif migrate -cq "$CONFIG_FILE"; then
+    exit 0
+fi
+
+migrate -i -b "$BACKUP_FILE" "$CONFIG_FILE"
@@ -1,12 +1,7 @@
 #!/bin/sh
-# Generate a self-signed TLS certificate.  Called from confd keystore
-# on first boot (or factory reset) when the gencert entry has empty
-# keys.  Output is written to a temporary directory that confd reads
-# and then removes after importing into the keystore.

-TMPDIR=/tmp/ssl
-KEY=$TMPDIR/self-signed.key
-CRT=$TMPDIR/self-signed.crt
+KEY=/cfg/ssl/private/self-signed.key
+CRT=/cfg/ssl/certs/self-signed.crt

 country=US
 state=California
@@ -25,11 +20,23 @@ if [ -z "$cn" ]; then
    fi
 fi

-mkdir -p "$TMPDIR"
-chmod 700 "$TMPDIR"
+generate()
+{
+    mkdir -p  /cfg/ssl/private /cfg/ssl/certs
+    chmod 700 /cfg/ssl/private

-gencert --country "$country" --state "$state" --city "$city" --organisation "$org" \
-	--organisation-unit "$unit" --common-name "$cn" \
-	--out-certificate "$CRT" --out-key "$KEY"
+    gencert --country "$country" --state "$state" --city "$city" --organisation "$org" \
+	    --organisation-unit "$unit" --common-name "$cn" \
+	    --out-certificate $CRT --out-key $KEY
+}

-exit $?
+CN=$(openssl x509 -noout -subject -in "${CRT}" 2>/dev/null |sed 's/.*CN=//')
+if [ -z "$CN" ] || [ "$CN" != "$cn" ]; then
+    generate "$cn"
+fi
+
+cp "${KEY}" "/etc/ssl/private/"
+cp "${CRT}" "/etc/ssl/certs/"
+initctl cond set mkcert
+
+exit 0
@@ -59,9 +59,17 @@ is_mmc()
 {
    [ -n "$mmc" ] && return $mmc

-    # Fast sysfs check — avoids triggering the slow partition scan
-    for d in /sys/class/block/mmcblk[0-9]; do
-	[ -d "$d" ] && mmc=0 && return 0
+    # Check if primary or secondary partition (our rootfs) is on MMC
+    for label in primary secondary; do
+        devname=$(find_partition_by_label "$label" 2>/dev/null)
+        if [ -n "$devname" ]; then
+            case "$devname" in
+                mmcblk*)
+		    mmc=0
+                    return 0
+                    ;;
+            esac
+        fi
    done

    mmc=1
@@ -70,68 +78,78 @@ is_mmc()

 wait_mmc()
 {
-    tries=50
-    while [ $tries -gt 0 ]; do
-	for d in /dev/mmcblk[0-9]; do
-	    if [ -b "$d" ]; then
-		logger $opt -p user.notice -t "$nm" "MMC device available after delay"
-		return 0
-	    fi
-	done
-	sleep .2
-	tries=$((tries - 1))
+    # Try up to 50 times with 0.2s sleep = 10 second timeout
+    for _ in $(seq 50); do
+        if ls /dev/mmcblk* >/dev/null 2>&1; then
+            logger $opt -p user.notice -t "$nm" "MMC device available after delay"
+            return 0
+        fi
+        sleep .2
    done

    logger $opt -p user.warn -t "$nm" "Timeout waiting for MMC device"
    return 1
 }

-# Read filesystem label from an ext2/3/4 formatted whole disk.
-# Superblock is at byte 1024, magic 0xEF53 at offset 56, label at 120.
-# Handles both LE and BE byte order (bi-endian MIPS, etc.)
-read_ext_label()
-{
-    magic=$(dd if="$1" bs=1 skip=1080 count=2 2>/dev/null \
-		| od -t x2 -An | tr -d ' \n')
-    case "$magic" in
-	ef53|53ef) ;;
-	*) return 1 ;;
-    esac
-
-    dd if="$1" bs=1 skip=1144 count=16 2>/dev/null | tr -d '\000'
-}
-
-# Look up a block device by its GPT partition name using the kernel's
-# sysfs uevent data (zero forks).  Falls back to reading the ext2/3/4
-# superblock for whole disks without GPT (e.g., virtual or USB setups).
+# This early on we don't have the luxury of /dev/disk/by-label/$1
 find_partition_by_label()
 {
-    # The kernel exposes GPT partition names as PARTNAME in uevent
-    for uevent in /sys/class/block/*/uevent; do
-	while IFS='=' read -r key val; do
-	    if [ "$key" = "PARTNAME" ]; then
-		if [ "$val" = "$1" ]; then
-		    devname="${uevent%/uevent}"
-		    echo "${devname##*/}"
-		    return 0
-		fi
-		break
-	    fi
-	done < "$uevent"
-    done
+    label="$1"

-    # Fallback: ext filesystem label on whole disk
    for diskpath in /sys/class/block/*; do
+	devname=$(basename "$diskpath")
+
+	# Skip partitions, only check whole disks
 	[ -f "$diskpath/partition" ] && continue
-	devname="${diskpath##*/}"
+
+	# Skip ram, loop, and other virtual devices
 	case "$devname" in
-	    ram*|loop*|nullb*|dm-*|*boot[0-9]*|*rpmb) continue ;;
+	    ram*|loop*|nullb*|dm-*) continue ;;
 	esac
-	fslabel=$(read_ext_label "/dev/$devname")
-	if [ "$fslabel" = "$1" ]; then
-	    echo "$devname"
+
+	disk="/dev/$devname"
+
+	#
+	# 1. Try GPT/MBR partition label using sgdisk
+	#
+	result=$(sgdisk -p "$disk" 2>/dev/null | awk -v label="$label" -v devname="$devname" '
+	    /^ *[0-9]/ {
+		if ($7 == label) {
+		    if (devname ~ /^(mmcblk|nvme|loop)/)
+			print devname "p" $1;
+		    else
+			print devname $1;
+		    exit 0;
+		}
+	    }
+	')
+
+	if [ -n "$result" ]; then
+	    echo "$result"
 	    return 0
 	fi
+
+	#
+	# 2. Fallback: Check if the whole disk is an ext4/ext2/ext3 filesystem
+	#
+
+	# Check for ext4/ext2/ext3 magic number (0xEF53) at offset 1080 (1024+56).
+	magic_number=$(dd if="$disk" bs=1 skip=1080 count=2 2>/dev/null | od -t x2 -A n | tr -d ' \n')
+
+	# Check for both Little-Endian ('53ef') and Big-Endian ('ef53') interpretations of 0xEF53.
+	# This supports bi-endian architectures like MIPS that may run in BE mode,
+	# as well as the LE mode which is standard for RISC-V and ext filesystems.
+	if [ "$magic_number" = "ef53" ] || [ "$magic_number" = "53ef" ]; then
+
+	    # Read the volume label from offset 1144 (1024+120)
+	    fslabel=$(dd if="$disk" bs=1 skip=1144 count=16 2>/dev/null | tr -d '\000')
+	    logger $opt -p user.notice -t "$nm" "Found label $fslabel on disk $disk ..."
+
+	    if [ "$fslabel" = "$label" ]; then
+		echo "$devname"
+		return 0
+	    fi
+	fi
    done

    return 1
@@ -301,6 +319,12 @@ mount_rw()
 	fi
    fi

+    # TODO: Also look for UBI partitions
+
+    # Disable periodic fsck, yet keeping safety checks on ext4
+    if grep "LABEL=$label" /etc/fstab |grep -q ext4; then
+	tune2fs -c 0 -i 0 LABEL="$1" 2>/dev/null
+    fi
    mount LABEL="$1" 2>/dev/null && return 0

    return 1
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -50,6 +50,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
@@ -134,7 +135,6 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
-BR2_PACKAGE_BANANAPI_BPI_R64=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
@@ -146,11 +146,8 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
-BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
 BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
-BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI=y
-BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -113,7 +113,6 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
-BR2_PACKAGE_BANANAPI_BPI_R64=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -52,6 +52,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -1,42 +0,0 @@
-BR2_aarch64=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
-BR2_ENABLE_DEBUG=y
-BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
-BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
-BR2_SSP_NONE=y
-BR2_INIT_NONE=y
-BR2_SYSTEM_BIN_SH_NONE=y
-# BR2_PACKAGE_BUSYBOX is not set
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/mtk-openwrt/arm-trusted-firmware-mtk.git"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="78a0dfd927bb00ce973a1f8eb4079df0f755887a"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="mt7622"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_FIP=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_UBOOT_AS_BL33=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES="BOOT_DEVICE=emmc DDR3_FLYBY=1 DEVICE_HEADER_OFFSET=0x0 USE_MKIMAGE=1"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="*.img *.bin"
-BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
-BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mt7622_bpir64_emmc"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/emmc-extras.config"
-BR2_TARGET_UBOOT_NEEDS_DTC=y
-BR2_TARGET_UBOOT_FORMAT_DTB=y
-BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/*.dtsi"
-BR2_PACKAGE_HOST_BMAP_TOOLS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
@@ -1,42 +0,0 @@
-BR2_aarch64=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
-BR2_ENABLE_DEBUG=y
-BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
-BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
-BR2_SSP_NONE=y
-BR2_INIT_NONE=y
-BR2_SYSTEM_BIN_SH_NONE=y
-# BR2_PACKAGE_BUSYBOX is not set
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/mtk-openwrt/arm-trusted-firmware-mtk.git"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="78a0dfd927bb00ce973a1f8eb4079df0f755887a"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="mt7622"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_FIP=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_UBOOT_AS_BL33=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES="BOOT_DEVICE=sdmmc DDR3_FLYBY=1 DEVICE_HEADER_OFFSET=0x80000 USE_MKIMAGE=1"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="*.img *.bin"
-BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
-BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mt7622_bpir64_sd"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/sd-extras.config"
-BR2_TARGET_UBOOT_NEEDS_DTC=y
-BR2_TARGET_UBOOT_FORMAT_DTB=y
-BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r64/uboot/*.dtsi"
-BR2_PACKAGE_HOST_BMAP_TOOLS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
@@ -60,6 +60,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
@@ -20,8 +20,9 @@ BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL=y
 BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,at91bootstrap,v4.0.9)/at91bootstrap-v4.0.9.tar.gz"
 BR2_TARGET_AT91BOOTSTRAP3_DEFCONFIG="sama7g5ekemmc_uboot"
 BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_TARBALL=y
+BR2_TARGET_UBOOT_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,u-boot-at91,linux4microchip-2025.04)/u-boot-at91-linux4microchip-2025.04.tar.gz"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="sama7g5ek_mmc"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/emmc-extras.config"
 BR2_TARGET_UBOOT_NEEDS_DTC=y
@@ -20,8 +20,9 @@ BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL=y
 BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,at91bootstrap,v4.0.9)/at91bootstrap-v4.0.9.tar.gz"
 BR2_TARGET_AT91BOOTSTRAP3_DEFCONFIG="sama7g5eksd_uboot"
 BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_TARBALL=y
+BR2_TARGET_UBOOT_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,u-boot-at91,linux4microchip-2025.04)/u-boot-at91-linux4microchip-2025.04.tar.gz"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="sama7g5ek_mmc1"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/sd-extras.config"
 BR2_TARGET_UBOOT_NEEDS_DTC=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -49,6 +49,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.17"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -3,83 +3,24 @@ Change Log

 All notable changes to the project are documented in this file.

-[v26.03.0][] - 2026-03-31
+[v26.02.1][] - 2026-03-13
 -------------------------

 ### Changes

- Upgrade Linux kernel to 6.18.20 (LTS)
- Upgrade Buildroot to 2025.02.12 (LTS)
- Upgrade FRR to 10.5.3
- Add support for [Banana Pi R64 Mini][BPI-R64], 5 port router with WiFi 5
- Add support for [Raspberry Pi 400][RPI-400], an RPi 4B built into a keyboard
- Significant boot time improvements, issue #1284.  The [InitViz][] boot
-  profiling tool is now included for users who want to visualize and measure
-  the boot process on their own hardware
+- Upgrade Linux kernel to 6.18.17 (LTS)
+- Add support for disabling WiFi and GPS features in builds
 - Add OSPF point-to-multipoint (P2MP) and hybrid interface type support.  This
  also includes support for setting static neighbors, issue #1426
- **Revamped <http://network.local> device browser**.  Device cards now
-  show the IP address, product name, and firmware version from mDNS TXT
-  records.  the mDNS browser is now also available over plain HTTP
- mDNS service records now embed the per-device hostname (using avahi's `%h`
-  wildcard), so devices avoid the `#2`, `#3` suffix collisions on service names
-  when multiple Infix devices share the same LAN
- Add configurable mDNS hostname: set `services mdns hostname` to override the
-  mDNS name advertised in A/AAAA records.  Supports `%h` (default hostname),
-  `%i` (hardware ID), and `%m` (MAC address) format specifiers
- cli: new `show mdns` command to list  mDNS-discovered devices on the LAN,
-  with addresses and product model
- Add SSH client commands to the CLI:
-   - `ssh [user <name>] [port <num>] <host>` — connect to a remote device
-   - `set ssh known-hosts <host> <keytype> <pubkey>` — pre-enroll a host key
-     received out-of-band, e.g. after a factory reset
-   - `no ssh known-hosts <host>` — remove a stale or changed host key entry
- Add support for user-configurable HTTPS certificate: select any certificate
-  stored in the keystore via `services web certificate <name>`.  The default
-  auto-generated self-signed certificate is now stored in the keystore rather
-  than in `/cfg/ssl` and existing certificates are auto-migrated on upgrade
- Add NTP `stratum-weight` setting to fine-tune server selection when multiple
-  NTP sources are available with different stratum levels
- Enable HDMI console output on Raspberry Pi 4 and Pi 400.  Previously the
-  display was suppressed; a login prompt now appears on the HDMI monitor

 ### Fixes

- Fix #892: suppress rousette RESTCONF server warnings from syslog
- Fix #1122: add missing migration script for the YANG validation introduced
-  in v25.10.0 that disallows IP addresses on bridge member ports.  Without
-  this script, upgrading with such a `startup-config` would prevent the device
-  from booting.  The migration removes all IP addresses from bridge member
-  ports; any addresses that should be kept must be re-added to the bridge
-  interface itself after upgrade
- Fix #1387: `infix.local` now resolves to exactly one device per LAN.  Previously
-  all Infix devices claimed both `hostname.local` and `infix.local`, causing avahi
-  to append `#2`, `#3` suffixes to the shared alias on busy networks.  Assignment
-  is now first-come-first-served using standard mDNS conflict resolution
- Fix #1389: firewall policies with names longer than 17 characters were
-  silently rejected
+- Fix #1389: legacy name limit in firewalld triggered problems with policy names
 - Fix #1416: `show firewall` command show an error when the firewall is disabled
 - Fix #1438: default route from DHCP client not set at boot, regression in v26.02.0
- Fix #1446: suppress netopeer2-server NETCONF server warnings from syslog
- Fix #1456: update project links in SUPPORT.md and README.md to point to
-  the home page and blog at <https://www.kernelkit.org>, and update the
-  release link to always resolve to the latest stable release
+- Fix instabilities in Zebra route manager after Frr upgrade in v26.02.0
 - Fix regression in MVEBU SafeXcel Crypto Engine for Marvell Armada SOCs (37xx,
  7k, 8k, and CN913x series).  Firmware package lost in v26.01.0
- Fix DHCP client not sending hostname to server (e.g. for `dnsmasq` lease
-  registration).  All board factory configs had the hostname option without
-  `value: auto`, so `udhcpc` only requested the option instead of sending it.
-  Setting up a DHCP client manually was not affected.  Also, the hostname
-  format string (e.g. `rpi-%m`) was not expanded to the actual system hostname
-  before being passed to `udhcpc`
- Fix dnsmasq logging spurious "Ignoring duplicate dhcp-option" warnings for
-  options 3 (router) and 6 (dns-server) on every DHCP transaction.  Add
-  `dhcp-authoritative` so clients with unexpired leases are not NAKed after
-  a router crash or factory reset that clears the lease database
-
-[BPI-R64]:  https://docs.banana-pi.org/en/BPI-R64/BananaPi_BPI-R64
-[RPI-400]:  https://www.raspberrypi.com/products/raspberry-pi-400/
-[InitViz]:  https://github.com/finit-project/InitViz

 [v26.02.0][] - 2026-03-01
 -------------------------
@@ -168,12 +109,6 @@ Noteworthy changes and additions in this release are marked below in bold text.
  latter now also require the use of `sudo` for `admin` level users
 - Enhanced `copy` command with XPath filtering support
 - Kernel now announces details of new USB devices
- New `show keystore` admin-exec command to inspect stored keys and
-  certificates without entering configure context
- `show system` now displays CPU/SoC temperature on all supported platforms,
-  including those that report it under the `soc` or `core` sensor name
- CN913x (Marvell Octeon) platforms now use the hardware SBSA watchdog,
-  ensuring the device recovers automatically from software lockups

 ### Fixes

@@ -182,8 +117,6 @@ Noteworthy changes and additions in this release are marked below in bold text.
  similar to IPv4, correctly mapping to the ietf-ip.yang model semantics
 - Fix #1082: Wi-Fi interfaces always scanned, introduce a `scan-mode` to the
  Wi-Fi concept in Infix
- Fix #1292: watchdog not working on NanoPi R2S due to a broken DesignWare
-  WDT on the RK3328 SoC; the hardware watchdog is now disabled on this board
 - Fix #1313: Container is not restarted if environment variable is changed
 - Fix #1314: Raspberry Pi 4B with 1 or 8 GiB RAM does not boot.  This was due
  newer EEPROM firmware in newer boards require a newer rpi-firmware package
@@ -193,16 +126,8 @@ Noteworthy changes and additions in this release are marked below in bold text.
  not include a dtb.  Please note, the platform has now been renamed to `arm`
 - Fix default password hash in `do password encrypt` command.  New hash is the
  same as the more commonly used `change password` command, *yescrypt*
- Fix BPI-R3 hardware watchdog, wrong kernel config option used — the device
-  would not recover automatically from a software lockup
- Fix WiFi signal strength display showing inverted quality labels (`excellent`
-  shown for weak signals, `bad` for strong)
- Fix `follow` command (both shell and CLI) not properly handling log rotation;
-  it now shows the full log and tails it correctly across rotations
 - Prevent MOTD from showing on non-shell user login attempts
- Fix mDNS reflector never actually enabling — the avahi config was written
-  with `on`/`off` instead of the correct `yes`/`no` values, so enabling the
-  reflector in the configuration had no effect
+- Fix mDNS reflector.

 [wifi]: https://www.kernelkit.org/infix/latest/wifi/
 [sd card image]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
@@ -2026,7 +1951,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:

 [buildroot]:  https://buildroot.org/
 [UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.02.0...HEAD
-[v26.03.0]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.03.0
+[v26.02.1]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.02.1
 [v26.02.0]:   https://github.com/kernelkit/infix/compare/v26.01.0...v26.02.0
 [v26.01.0]:   https://github.com/kernelkit/infix/compare/v25.11.0...v26.01.0
 [v25.11.0]:   https://github.com/kernelkit/infix/compare/v25.10.0...v25.11.0
@@ -59,8 +59,6 @@ them:
  XPath: `/ietf-system:system/authentication/user/password`
 - **Default SSH and NETCONF hostkey:** `genkey` (regenerated at factory reset)
  XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
- **Default HTTPS certificate:** `gencert` (self-signed, regenerated at factory reset)
-  XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='gencert']`
 - **Hostname format specifiers:**  
  XPath: `/ietf-system:system/hostname`
   - `%i`: OS ID, from `/etc/os-release`, from Menuconfig branding
@@ -221,12 +219,8 @@ Notice how both the public and private keys are left empty here, this
 cause them to be always automatically regenerated after each factory reset.
 Keeping the `factory-config` snippet like this means we can use the same
 file on multiple devices, without risking them sharing the same host
-keys or TLS certificates.  Sometimes you may want the same keys, but
-that is the easy use-case and not documented here.
-
-The `genkey` entry is the default SSH host key, and `gencert` is the
-default self-signed HTTPS certificate used by the web server (nginx).
-Both are regenerated on factory reset when their keys are empty.
+keys.  Sometimes you may want the same host keys, but that is the easy
+use-case and not documented here.

 ```json
  "ietf-keystore:keystore": {
@@ -239,18 +233,6 @@ Both are regenerated on factory reset when their keys are empty.
          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
          "cleartext-private-key": "",
          "certificates": {}
-        },
-        {
-          "name": "gencert",
-          "public-key-format": "infix-crypto-types:x509-public-key-format",
-          "public-key": "",
-          "private-key-format": "infix-crypto-types:rsa-private-key-format",
-          "cleartext-private-key": "",
-          "certificates": {
-            "certificate": [
-              { "name": "self-signed", "cert-data": "" }
-            ]
-          }
        }
      ]
    }
@@ -310,22 +292,9 @@ Both are regenerated on factory reset when their keys are empty.
        "port": 22
      }
    ]
-  },
-  "infix-services:web": {
-    "certificate": "gencert",
-    "enabled": true,
-    "console": { "enabled": true },
-    "netbrowse": { "enabled": true },
-    "restconf": { "enabled": true }
  }
 ```

-The `certificate` leaf references an asymmetric key in the keystore
-that has an associated certificate.  The default `gencert` entry uses
-a self-signed certificate.  To use a custom (e.g., CA-signed)
-certificate, create a new keystore entry with
-`x509-public-key-format` and point the web `certificate` leaf to it.
-
 ## Integration

 When integrating your software stack with Infix there may be protocols
@@ -40,14 +40,16 @@ admin@host:/config/interface/eth0/> up
 admin@host:/config/>
 ```

-> **Note**
->
-> Commands in configure context are automatically generated from the
-> system's YANG models, hence different products likely have a different
-> set of commands.  However, both the `ietf-interfaces.yang` and
-> `ietf-ip.yang` models, for instance, that provide the networking
+----
+
+> **Note:** commands in configure context are automatically generated
+> from the system's YANG models, hence different products likely have a
+> different set of commands.  However, both the `ietf-interfaces.yang`
+> and `ietf-ip.yang` models, for instance, that provide the networking
 > support are common to all systems.

+----
+
 ## Set IP Address on an Interface

 ```
@@ -72,6 +74,7 @@ interfaces {
 }
 ```

+
 ## Saving Changes

 Apply the changes (from candidate to `running-config`):
@@ -82,12 +85,12 @@ admin@host:/> show running-config
 ...
 interfaces {
  interface eth0 {
-    type ethernetCsmacd;
-    ipv4 {
-      address 192.168.2.200 {
-        prefix-length 24;
-      }
-    }
+	type ethernetCsmacd;
+	ipv4 {
+	  address 192.168.2.200 {
+		prefix-length 24;
+	  }
+	}
  }
 ...
 ```
@@ -103,10 +106,12 @@ admin@host:/> copy running-config startup-config
 The `startup-config` can also be inspected with the `show` command to
 verify the changes are saved.

-> **Important**
->
-> All commands need to be spelled out, no short forms are allowed in the
-> CLI.  Use the `TAB` key to make your life easier.
+----
+
+> **Note:** all commands need to be spelled out, no short forms are
+> allowed in the CLI.  Use the `TAB` key to make your life easier.
+
+----

 ## Changing Hostname

@@ -123,10 +128,12 @@ admin@example:/>
 Notice how the hostname in the prompt does not change until the change
 is committed.

-> **Note**
->
-> Critical services like syslog, mDNS, LLDP, and similar that advertise
-> the hostname, are restarted when the hostname is changed.
+----
+
+> **Note:** critical services like syslog, mDNS, LLDP, and similar that
+> advertise the hostname, are restarted when the hostname is changed.
+
+----

 ## Changing Password

@@ -135,14 +142,14 @@ User management, including passwords, is also a part of `ietf-system`.
 ```
 admin@host:/config/> edit system authentication user admin
 admin@host:/config/system/authentication/user/admin/> change password
-New password:
-Retype password:
+New password: 
+Retype password: 
 admin@host:/config/system/authentication/user/admin/> leave
 ```

 The `change password` command starts an interactive dialogue that asks
 for the new password, with a confirmation, and then salts and encrypts
-the password with sha512crypt.
+the password with sha512crypt. 

 It is also possible to use the `set password ...` command.  This allows
 setting an already hashed password.  To manually hash a password, use
@@ -150,11 +157,13 @@ the `do password encrypt` command.  This launches the admin-exec command
 to hash, and optionally salt, your password.  This encrypted string can
 then be used with `set password ...`.

-> **Tip**
->
-> If you are having trouble thinking of a password, there is also `do
-> password generate`, which generates random but readable strings using
-> the UNIX command `pwgen`.
+----
+
+> **Tip:** if you are having trouble thinking of a password, there is
+> also `do password generate`, which generates random but readable
+> strings using the UNIX command `pwgen`.
+
+----

 ## SSH Authorized Key

@@ -176,11 +185,11 @@ key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTT
 admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> leave
 ```

-> **Note**
->
-> The `ssh-keygen` program already base64 encodes the public key data,
-> so there is no need to use the `text-editor` command, `set` does the
-> job.
+----
+
+> **Note:** the `ssh-keygen` program already base64 encodes the public
+> key data, so there is no need to use the `text-editor` command, `set`
+> does the job.

 ----

@@ -220,12 +229,13 @@ admin@host:/config/> leave

 See the bridging example below for more.

-> **Tip**
->
-> In the CLI you do not have to create the `veth0b` interface.  The
-> system _infers_ this for you.  This does not apply when setting up a
-> VETH pair using NETCONF or RESTCONF, then you must submit a complete
-> configuration.
+----
+
+> **Note:** in the CLI you do not have to create the `veth0b` interface.
+> The system _infers_ this for you.  When setting up a VETH pair using
+> NETCONF, however, you must include the `veth0b` interface.
+
+----

 ## Creating a Bridge

@@ -281,8 +291,10 @@ the VETH pair from the previous example) are now bridged.  Any traffic
 ingressing one port will egress the other.  Only reserved IEEE multicast
 is filtered, except LLDP frames as shown above.

-> **Important**
->
-> The bridge can be named anything, provided the interface name is not
-> already taken.  However, for any name outside the pattern `br[0-9]+`,
-> you have to set the interface type manually to `bridge`.
+----
+
+> **Note:** the bridge can be named anything, provided the interface
+> name is not already taken.  However, for any name outside the pattern
+> `br[0-9]+`, you have to set the interface type manually to `bridge`.
+
+----
@@ -34,11 +34,13 @@ admin@host-12-34-56:/> show                   # Try: Tab or ?
 admin@host-12-34-56:/>                        # Try: Tab or ?
 ```

-> **Tip**
->
-> Even on an empty command line, you can tap the `Tab` or `?` keys.  
+----
+
+> **Note:** even on an empty command line, you can tap the `Tab` or `?` keys.  
 > See [`help keybindings`](keybindings.md) for more tips!

+----
+
 ## Key Concepts

 The two modes in the CLI are the admin-exec and the configure context.
@@ -76,15 +78,15 @@ and *running* that can be managed and inspected using the `copy`,
 `show`, and `configure` commands.  The traditional names used in the CLI
 for these are listed below:

- `factory-config` the default configuration from factory for the
-  device, i.e., what the system returns to after a `factory-reset`
- `startup-config` created from `factory-config` at first boot after
-  factory reset.  Loaded as the system configuration on each boot
- `running-config` what is actively running on the system.  If no
-  changes have been made since boot, it is the same as `startup-config`
- `candidate-config` is created from `running-config` when entering the
-  configure context.  Any changes made here can be discarded (`abort`,
-  `rollback`) or committed (`commit`, `leave`) to `running-config`
+ - `factory-config` the default configuration from factory for the
+   device, i.e., what the system returns to after a `factory-reset`
+ - `startup-config` created from `factory-config` at first boot after
+   factory reset.  Loaded as the system configuration on each boot
+ - `running-config` what is actively running on the system.  If no
+   changes have been made since boot, it is the same as `startup-config`
+ - `candidate-config` is created from `running-config` when entering the
+   configure context.  Any changes made here can be discarded (`abort`,
+   `rollback`) or committed (`commit`, `leave`) to `running-config`

 Edit the *running* configuration using the `configure` command.  This
 copies *running* to *candidate*, a temporary datastore, where changes
@@ -129,13 +131,16 @@ In *configure context* the following commands are available:
 | `do command`      | Call admin-exec command: `do show log`                 |
 | `commit`          |                                                        |

+
 ## Example Session

-> **Tip**
->
+----
+
 > Remember to use the `TAB` and `?` keys to speed up your navigation.  
 > See [`help keybindings`](keybindings.md) for more tips!

+----
+
 In this example we enter configure context to add an IPv4 address to
 interface `eth0`, then we apply the changes using the `leave` command.

@@ -146,8 +151,8 @@ save the changes for the next reboot.
 admin@host-12-34-56:/> configure
 admin@host-12-34-56:/config/> edit interface eth0
 admin@host-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
-      address     autoconf      bind-ni-name     dhcp 
-      enabled     forwarding    mtu              neighbor
+      address     autoconf bind-ni-name      enabled
+	  forwarding  mtu      neighbor
 admin@host-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
 admin@host-12-34-56:/config/interface/eth0/> show
 type ethernetCsmacd;
@@ -188,12 +193,10 @@ admin@host-12-34-56:/> copy startup-config running-config

 Or restart the device, for example if the change to the configuration
 caused you to lose contact with the system (it happens to the best of
-us).  The system will start up from the last "save game".
+us).  The system will start up from the last "save gave".

-> **Tip:** Restoring Backups
->
-> When restoring a backup of a configuration, or having manually edited
-> a config file, you can validate it using the system's YANG models, it
-> is *not* applied if validation is successful:
+> **Tip:** when restoring a backup of a configuration, or having manually
+> edited a config file, you can validate it using system's YANG models,
+> it is *not* applied if validation is successful:
 >
 > `copy /media/backup/old.cfg running-config validate`
@@ -33,7 +33,7 @@ CLI has several keybindings, most significant first:
 | Ctrl-t  |                | Transpose/Swap characters before and at cursor   |
 | Meta-#  | Alt-Shift-3    | Prepend # to current line and submit to history  |

-## What is Meta
+## What is Meta?

 The Meta key is called Alt on most modern keyboards.  If you have
 neither, first tap the Esc key instead of holding down Alt/Meta.
@@ -53,3 +53,4 @@ See possible arguments, with brief help text, to a command:
    ...

 Type the command, then tap the `?` key.
+
@@ -18,6 +18,7 @@ A subnet can be entered in two ways:
 An optional `split LEN` can be given as argument, the new length value
 must be bigger than the current prefix length.  See example below.

+
 ## Examples

 Its most commonly used features are to understand how many addresses an
@@ -23,8 +23,10 @@ keybindings are really useful to learn!
 | `help text-editor`  | Help with the built-in text-editor command         |
 | `help keybindings`  | Lists available keybindings & other helpful tricks |

-> **Tip:** Online Help
->
-> In `configure` context the `help <setting>` command shows the YANG
+----
+
+> In `configure` context the `help setting` command shows the YANG
 > description text for each node and container.  To reach the admin
 > exec help from configure context, e.g., `do help text-editor`
+
+----
@@ -10,7 +10,7 @@ use the `upgrade` command and a URI to a ftp/tftp/sftp or http/https server
 that hosts the file:

 ```
-admin@example:/> upgrade tftp://192.168.122.1/firmware-x86_64-v23.11.pkg
+admin@host:/> upgrade tftp://192.168.122.1/firmware-x86_64-v23.11.pkg
 installing
  0% Installing
  0% Determining slot states
@@ -31,7 +31,7 @@ installing
 99% Updating slots done.
 100% Installing done.
 Installing `tftp://192.168.122.1/firmware-x86_64-v23.11.pkg` succeeded
-admin@example:/>
+admin@host:/>
 ```

 The secondary partition (`rootfs.1`) has now been upgraded and will be used as
@@ -175,28 +175,6 @@ making any changes, **always discuss them with the Infix core team**.
 This helps avoid issues later in development and makes pull request
 reviews smoother.

-### Configuration Migration
-
-> [!IMPORTANT]
-> Whenever a YANG model change makes existing `startup-config` files
-> incompatible — removing a node, renaming a key, restructuring a
-> container — you **must** include a migration script so that devices
-> upgrading in the field are not left unbootable.
-
-Migration scripts live in `src/confd/share/migrate/<version>/` where
-`<version>` is the confd version (defined in `src/confd/configure.ac`)
-that introduces the breaking change.  Each script receives the path to
-the startup configuration file as its first argument and must edit it
-in-place.  Scripts are run in lexicographic order, so prefix them with
-a number (e.g. `40-my-change.sh`).
-
-See `src/confd/share/migrate/1.6/40-bridge-port-remove-ip.sh` for a
-worked example, and the [Configuration Migration][upgrade-migration]
-section of the Upgrade documentation for the user-facing side of this
-mechanism.
-
-[upgrade-migration]: upgrade.md#configuration-migration
-
 ### `confd`

 The Infix `src/confd/` is the engine of the system.  Currently it is a
@@ -18,7 +18,8 @@ link-local IPv6 address is then seen in the response.  In the following
 example, the PC here uses *tap0* as *if1*, Infix responds with address
 *fe80::ff:fec0:ffed*.

-<pre class="cli"><code>linux-pc:# <b>ping -6 -L -c 3 ff02::1%tap0</b>
+```
+linux-pc:# ping -6 -L -c 3 ff02::1%tap0
 PING ff02::1%tap0(ff02::1%tap0) 56 data bytes
 64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=1 ttl=64 time=0.558 ms
 64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=2 ttl=64 time=0.419 ms
@@ -27,8 +28,8 @@ PING ff02::1%tap0(ff02::1%tap0) 56 data bytes
 --- ff02::1%tap0 ping statistics ---
 3 packets transmitted, 3 received, 0% packet loss, time 2043ms
 rtt min/avg/max/mdev = 0.389/0.455/0.558/0.073 ms
-linux-pc:#
-</code></pre>
+linux-pc:# 
+```

 > [!TIP]
 > The `-L` option ignores local responses from the PC.
@@ -36,32 +37,12 @@ linux-pc:#
 This address can then be used to connect to the device, e.g., using SSH.
 Notice the syntax `username@address%interface`:

-<pre class="cli"><code>linux-pc:# <b>ssh admin@fe80::ff:fec0:ffed%tap0</b>
+```
+linux-pc:# ssh admin@fe80::ff:fec0:ffed%tap0
 admin@fe80::ff:fec0:ffed%tap0's password: admin
-admin@infix-c0-ff-ee:~$
-</code></pre>
+admin@infix-c0-ff-ee:~$ 
+```

-### Windows
-
-Infix advertises a `_workstation._tcp` DNS-SD record alongside its other
-mDNS services.  Windows 10 (build 1709+) and Windows 11 recognise this
-record and show the device in **File Explorer → Network** automatically —
-no extra software required.
-
-From the command line, use the `.local` hostname directly:
-
-<pre class="cli"><code>C:\> <b>ping infix-c0-ff-ee.local</b>
-C:\> <b>ssh admin@infix-c0-ff-ee.local</b>
-</code></pre>
-
-> [!NOTE]
-> IPv6 multicast ping (`ping ff02::1%if1`) may not display responses on
-> Windows even though the Infix device replies correctly.  If you need to
-> confirm connectivity, Wireshark will show the ICMPv6 echo replies
-> arriving.  Use mDNS (see [mDNS-SD](#mdns-sd) below) as the reliable
-> alternative.
->
-> ![Wireshark showing IPv6 ping responses](img/windows-ipv6-ping-reply.png)

 ## LLDP

@@ -69,7 +50,8 @@ Infix supports LLDP (IEEE 802.1AB). For a device with factory default
 settings, the link-local IPv6 address can be read from the Management
 Address TLV using *tcpdump* or other sniffing tools[^1]:

-<pre class="cli"><code>linux-pc:# <b>tcpdump -i tap0 -Qin -v ether proto 0x88cc</b>
+```
+linux-pc:# tcpdump -i tap0 -Qin -v ether proto 0x88cc
 tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
 15:51:52.061071 LLDP, length 193
    Chassis ID TLV (1), length 7
@@ -98,8 +80,8 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
    End TLV (0), length 0
 ^C
 1 packet captured
-linux-pc:#
-</code></pre>
+linux-pc:# 
+```

 If the device has an IPv4 address assigned, it is shown in an additional
 Management Address TLV.
@@ -111,7 +93,8 @@ Management Address TLV.
 In the example below, the IPv4 address (10.0.1.1) happens to be
 assigned to *eth0*, while the IPv6 address (2001:db8::1) is not.

-<pre class="cli"><code>linux-pc:# <b>sudo tcpdump -i tap0 -Qin -v ether proto 0x88cc</b>
+```
+linux-pc:# sudo tcpdump -i tap0 -Qin -v ether proto 0x88cc
 tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
 15:46:07.908665 LLDP, length 207
    Chassis ID TLV (1), length 7
@@ -146,7 +129,7 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
 2 packets received by filter
 0 packets dropped by kernel
 linux-pc:#
-</code></pre>
+```

 The following capabilities are available via NETCONF/RESTCONF or the Infix CLI.

@@ -154,17 +137,19 @@ The following capabilities are available via NETCONF/RESTCONF or the Infix CLI.

 The LLDP service can be disabled using the following commands.

-<pre class="cli"><code>admin@infix-c0-ff-ee:/> <b>configure</b>
-admin@infix-c0-ff-ee:/config/> <b>no lldp</b>
-admin@infix-c0-ff-ee:/config/> <b>leave</b>
-admin@infix-c0-ff-ee:/>
-</code></pre>
+```
+admin@infix-c0-ff-ee:/> configure
+admin@infix-c0-ff-ee:/config/> no lldp 
+admin@infix-c0-ff-ee:/config/> leave
+admin@infix-c0-ff-ee:/> 
+```

 To reenable it from the CLI config mode:

-<pre class="cli"><code>admin@test-00-01-00:/config/> <b>set lldp enabled</b>
-admin@test-00-01-00:/config/> <b>leave</b>
-</code></pre>
+```
+admin@test-00-01-00:/config/> set lldp enabled 
+admin@test-00-01-00:/config/> leave
+```

 ### LLDP Message Transmission Interval

@@ -172,14 +157,15 @@ By default, LLDP uses a `message-tx-interval` of 30 seconds, as defined
 by the IEEE standard. Infix allows this value to be customized.
 To change it using the CLI:

-<pre class="cli"><code>admin@test-00-01-00:/config/> <b>set lldp message-tx-interval 1</b>
-admin@test-00-01-00:/config/> <b>leave</b>
-</code></pre>
+```
+admin@test-00-01-00:/config/> set lldp message-tx-interval 1
+admin@test-00-01-00:/config/> leave
+```

 ### LLDP Administrative Status per Interface

 Infix supports configuring the LLDP administrative status on a per-port
-basis. The default mode is `tx-and-rx`, but the following options are
+basis. The default mode is `tx-and-rx`, but the following options are 
 also supported:

 - `rx-only` – Receive LLDP packets only
@@ -188,14 +174,15 @@ also supported:

 Example configuration:

-<pre class="cli"><code>admin@test-00-01-00:/config/> <b>set lldp port e8 dest-mac-address 01:80:C2:00:00:0E admin-status disabled</b>
-admin@test-00-01-00:/config/> <b>set lldp port e5 dest-mac-address 01:80:C2:00:00:0E admin-status rx-only</b>
-admin@test-00-01-00:/config/> <b>set lldp port e6 dest-mac-address 01:80:C2:00:00:0E admin-status tx-only</b>
-admin@test-00-01-00:/config/> <b>leave</b>
-</code></pre>
+```
+admin@test-00-01-00:/config/> set lldp port e8 dest-mac-address 01:80:C2:00:00:0E admin-status disabled
+admin@test-00-01-00:/config/> set lldp port e5 dest-mac-address 01:80:C2:00:00:0E admin-status rx-only 
+admin@test-00-01-00:/config/> set lldp port e6 dest-mac-address 01:80:C2:00:00:0E admin-status tx-only
+admin@test-00-01-00:/config/> leave
+```

 > [!NOTE]
-> The destination MAC address must be the standard LLDP multicast
+> The destination MAC address must be the standard LLDP multicast 
 > address: `01:80:C2:00:00:0E`.

 ###  Displaying LLDP Neighbor Information
@@ -203,12 +190,13 @@ admin@test-00-01-00:/config/> <b>leave</b>
 In CLI mode, Infix also provides a convenient `show lldp` command to
 list LLDP neighbors detected on each interface:

-<pre class="cli"><code>admin@test-00-01-00:/> <b>show lldp</b>
-<span class="header">INTERFACE       REM-IDX   TIME        CHASSIS-ID          PORT-ID                           </span>
-e5              1         902         00:a0:85:00:04:01   00:a0:85:00:04:07
-e6              3         897         00:a0:85:00:03:01   00:a0:85:00:03:07
+```
+admin@test-00-01-00:/> show lldp 
+INTERFACE       REM-IDX   TIME        CHASSIS-ID          PORT-ID             
+e5              1         902         00:a0:85:00:04:01   00:a0:85:00:04:07   
+e6              3         897         00:a0:85:00:03:01   00:a0:85:00:03:07   
 e8              2         901         00:a0:85:00:02:01   00:a0:85:00:02:05
-</code></pre>
+```

 ## mDNS-SD

@@ -216,44 +204,34 @@ DNS-SD/mDNS-SD can be used to discover Infix devices and services.  By
 default, Infix use the `.local` domain for advertising services.  Some
 networks use `.lan` instead, so this configurable:

-<pre class="cli"><code>admin@infix-c0-ff-ee:/> <b>configure</b>
-admin@infix-c0-ff-ee:/config/> <b>edit mdns</b>
-admin@infix-c0-ff-ee:/config/mdns/> <b>set domain lan</b>
-</code></pre>
+```
+admin@infix-c0-ff-ee:/> configure
+admin@infix-c0-ff-ee:/config/> edit mdns
+admin@infix-c0-ff-ee:/config/mdns/> set domain lan
+```

 Other available settings include limiting the interfaces mDNS responder
-acts on, `allow`:
+acts on:

-<pre class="cli"><code>admin@infix-c0-ff-ee:/config/> <b>set interfaces allow e1</b>
-</code></pre>
+```
+admin@infix-c0-ff-ee:/config/> set interfaces allow e1
+```

-or `deny`.  The `allow` and `deny` settings are complementary, `deny` always wins.
+or

-<pre class="cli"><code>admin@infix-c0-ff-ee:/config/> <b>set interfaces deny wan</b>
-</code></pre>
+```
+admin@infix-c0-ff-ee:/config/> set interfaces deny wan
+```

-Use `leave` to activate the new settings, then inspect the operational
-state and any detected neighbors with `show mdns` from admin-exec
-context:
-
-<pre class="cli"><code>admin@gateway:/> <b>show mdns</b>
-Enabled         : yes
-Domain          : local
-Deny            : wan
-
-<span class="header">HOSTNAME           ADDRESS        LAST SEEN  SERVICES                                       </span>
-Living-Room.local  192.168.0.139  17:28:43   trel(59813) sleep-proxy(61936) raop(7000) srpl-tls(853)
-firefly-4.local    192.168.0.122  17:28:37   workstation(9)
-gimli.local        192.168.0.180  17:28:37   smb(445)
-infix.local        192.168.0.1    17:28:38   https(443) workstation(9) ssh(22) https(443)
-</code></pre>
+The `allow` and `deny` settings are complementary, `deny` always wins.

 ----

 In Linux, tools such as *avahi-browse* or *mdns-scan*[^2] can be used to
 search for devices advertising their services via mDNS.

-<pre class="cli"><code>linux-pc:# <b>avahi-browse -ar</b>
+```
+linux-pc:# avahi-browse -ar
 +   tap0 IPv6 infix-c0-ff-ee                                SFTP File Transfer   local
 +   tap0 IPv4 infix-c0-ff-ee                                SFTP File Transfer   local
 +   tap0 IPv6 infix-c0-ff-ee                                SSH Remote Terminal  local
@@ -280,7 +258,7 @@ search for devices advertising their services via mDNS.
   txt = []
 ^C
 linux-pc:#
-</code></pre>
+```

 > [!TIP]
 > The `-t` option is also very useful, it stops browsing automatically
@@ -293,15 +271,17 @@ name mappings for IP addresses.  By default, it translates from IPv4
 addresses.  This function allows users to confirm that addresses are
 mapped correctly.

-<pre class="cli"><code>linux-pc:# <b>avahi-resolve-host-name infix-c0-ff-ee.local</b>
+```
+linux-pc:# avahi-resolve-host-name infix-c0-ff-ee.local
 infix-c0-ff-ee.local	10.0.1.1
 linux-pc:#
-</code></pre>
+```

 Thanks to mDNS we can use the advertised name instead of the IP
 address for operations like `ping` and `ssh` as shown below:

-<pre class="cli"><code>linux-pc:# <b>ping infix-c0-ff-ee.local -c 3</b>
+```
+linux-pc:# ping infix-c0-ff-ee.local -c 3
 PING infix-c0-ff-ee.local (10.0.1.1) 56(84) bytes of data.
 64 bytes from 10.0.1.1: icmp_seq=1 ttl=64 time=0.852 ms
 64 bytes from 10.0.1.1: icmp_seq=2 ttl=64 time=1.12 ms
@@ -311,8 +291,8 @@ PING infix-c0-ff-ee.local (10.0.1.1) 56(84) bytes of data.
 3 packets transmitted, 3 received, 0% packet loss, time 2003ms
 rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms

-linux-pc:# <b>ssh admin@infix-c0-ff-ee.local</b>
-(admin@infix-c0-ff-ee.local) Password:
+linux-pc:# ssh admin@infix-c0-ff-ee.local
+(admin@infix-c0-ff-ee.local) Password: 
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://www.kernelkit.org
@@ -321,25 +301,27 @@ linux-pc:# <b>ssh admin@infix-c0-ff-ee.local</b>
 Run the command 'cli' for interactive OAM

 linux-pc:#
-</code></pre>
+```

 To disable mDNS/mDNS-SD, type the commands:

-<pre class="cli"><code>admin@infix-c0-ff-ee:/> <b>configure</b>
-admin@infix-c0-ff-ee:/config/> <b>no mdns</b>
-admin@infix-c0-ff-ee:/config/> <b>leave</b>
-</code></pre>
+```
+admin@infix-c0-ff-ee:/> configure 
+admin@infix-c0-ff-ee:/config/> no mdns
+admin@infix-c0-ff-ee:/config/> leave
+```

 ### Human-Friendly Hostname Alias

-Each Infix device advertises itself as *infix.local*, in addition to its
+Each Infix deviuce advertise itself as *infix.local*, in addition to its
 full hostname (e.g., *infix-c0-ff-ee.local* or *foo.local*).  This alias
 works seamlessly on a network with a single Infix device, and makes it
 easy to connect when the exact hostname is not known in advance.  The
 examples below show how the alias can be used for actions such as
 pinging or establishing an SSH connection:

-<pre class="cli"><code>linux-pc:# <b>ping infix.local -c 3</b>
+```
+linux-pc:# ping infix.local -c 3
 PING infix.local (10.0.1.1) 56(84) bytes of data.
 64 bytes from 10.0.1.1: icmp_seq=1 ttl=64 time=0.751 ms
 64 bytes from 10.0.1.1: icmp_seq=2 ttl=64 time=2.28 ms
@@ -349,8 +331,8 @@ PING infix.local (10.0.1.1) 56(84) bytes of data.
 3 packets transmitted, 3 received, 0% packet loss, time 2003ms
 rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms

-linux-pc:# <b>ssh admin@infix.local</b>
-(admin@infix.local) Password:
+linux-pc:# ssh admin@infix.local
+(admin@infix.local) Password: 
 .-------.
 |  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://www.kernelkit.org
@@ -359,7 +341,7 @@ linux-pc:# <b>ssh admin@infix.local</b>
 Run the command 'cli' for interactive OAM

 admin@infix-c0-ff-ee:~$
-</code></pre>
+```

 When multiple Infix devices are present on the LAN the alias will not
 uniquely identify a device; *infix.local* will refer to any of the
@@ -385,11 +367,12 @@ portal to access all others, if it goes down another takes its place.
 To disable the netbrowse service, and the *network.local* alias, the
 following commands can be used:

-<pre class="cli"><code>admin@infix-c0-ff-ee:/> <b>configure</b>
-admin@infix-c0-ff-ee:/config/> <b>edit web</b>
-admin@infix-c0-ff-ee:/config/web/> <b>no netbrowse</b>
-admin@infix-c0-ff-ee:/config/web/> <b>leave</b>
-</code></pre>
+```
+admin@infix-c0-ff-ee:/> configure 
+admin@infix-c0-ff-ee:/config/> edit web
+admin@infix-c0-ff-ee:/config/web/> no netbrowse
+admin@infix-c0-ff-ee:/config/web/> leave
+```


 [^1]: E.g., [lldpd](https://github.com/lldp/lldpd) which includes the
@@ -18,14 +18,6 @@ This document provides an introduction of key concepts, details how
 the system boots, including failure modes, and provides links to
 other documents for further study.

-## Project Links
-
-| **Topic**                                   | **URL**                                              |
-|---------------------------------------------|------------------------------------------------------|
-| :fontawesome-solid-house: Home page & blog  | <https://www.kernelkit.org>                          |
-| :fontawesome-brands-github: GitHub          | <https://github.com/kernelkit/infix>                 |
-| :fontawesome-solid-box-open: Latest release | <https://github.com/kernelkit/infix/releases/latest> |
-
 ## Command Line Interface

 The command line interface (CLI, see-ell-i) is the traditional way of
@@ -11,7 +11,6 @@ The keystore supports two types of cryptographic keys:

 1. **Asymmetric Keys** — public/private key pairs used for:
    - SSH host authentication (RSA keys)
-    - HTTPS/TLS certificates (X.509 keys)
    - WireGuard VPN tunnels (X25519 keys)

 2. **Symmetric Keys** — shared secrets used for:
@@ -23,11 +22,10 @@ managed via CLI, NETCONF, or RESTCONF.

 ### Supported Formats

-| **Asymmetric Key Format**                                | **Use Case**       | **Key Type** |
-|----------------------------------------------------------|--------------------|--------------|
-| `rsa-private-key-format` / `ssh-public-key-format`       | SSH host keys      | RSA          |
-| `rsa-private-key-format` / `x509-public-key-format`      | TLS certificates   | RSA + X.509  |
-| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN      | Curve25519   |
+| **Asymmetric Key Format**                                | **Use Case**  | **Key Type** |
+|----------------------------------------------------------|---------------|--------------|
+| `rsa-private-key-format` / `ssh-public-key-format`       | SSH host keys | RSA          |
+| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN | Curve25519   |

 | **Symmetric Key Format**        | **Use Case**                          |
 |-----------------------------|-----------------------------------|
@@ -48,53 +46,6 @@ keystore with the name `genkey`.
 See [SSH Management](management.md) for details on generating and importing
 custom SSH host keys.

-### TLS Certificates
-
-TLS certificates are used by the web server (nginx) for HTTPS connections.
-The default certificate is a self-signed certificate automatically generated
-on first boot and stored in the keystore with the name `gencert`.  Like SSH
-host keys, the certificate is regenerated on factory reset when its keys are
-empty.
-
-The web server's `certificate` leaf references which keystore entry to use:
-
-```json
-"infix-services:web": {
-    "certificate": "gencert",
-    "enabled": true
-}
-```
-
-To use a custom (e.g., CA-signed) certificate, create a new asymmetric key
-entry with `x509-public-key-format`, populate it with your certificate and
-private key, then point the web `certificate` leaf to it:
-
-```json
-"ietf-keystore:keystore": {
-    "asymmetric-keys": {
-        "asymmetric-key": [
-            {
-                "name": "my-cert",
-                "public-key-format": "infix-crypto-types:x509-public-key-format",
-                "public-key": "<base64-encoded-cert>",
-                "private-key-format": "infix-crypto-types:rsa-private-key-format",
-                "cleartext-private-key": "<base64-encoded-key>",
-                "certificates": {
-                    "certificate": [
-                        { "name": "ca-signed", "cert-data": "<base64-encoded-cert>" }
-                    ]
-                }
-            }
-        ]
-    }
-}
-```
-
-> [!NOTE]
-> The `public-key` and `cert-data` fields contain base64-encoded PEM data
-> with the `-----BEGIN/END-----` markers stripped.  The system reconstructs
-> the PEM files when writing them to disk for nginx.
-
 ### WireGuard Keys

 WireGuard uses X25519 elliptic curve cryptography for key exchange.  Each
@@ -165,7 +116,6 @@ wg-psk                       octet-string  zYr83O4Ykj9i1gN+/aaosJxQx...
 <span class="title">Asymmetric Keys</span>
 <span class="header">NAME                         TYPE    PUBLIC KEY                         </span>
 genkey                       rsa     MIIBCgKCAQEAnj0YinjhYDgYbEGuh7...
-gencert                      x509    MIIDXTCCAkWgAwIBAgIJAJC1HiIAZA...
 wg-tunnel                    x25519  bN1CwZ1lTP6KsrCwZ1lTP6KsrCwZ1...
 </code></pre>

@@ -136,7 +136,6 @@ the unit's neighbors, collected via mDNS (see
 <pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit web</b>
 admin@example:/config/web/> <b>help</b>
-  certificate                       Reference to asymmetric key in central keystore.
  enabled                           Enable or disable on all web services.
  console                           Web console interface.
  netbrowse                         mDNS Network Browser.
@@ -192,23 +191,6 @@ admin@example:/config/web/restconf/> <b>no enabled</b>
 admin@example:/config/web/restconf/>
 </code></pre>

-### HTTPS Certificate
-
-The Web server uses a TLS certificate from the central
-[keystore](keystore.md).  By default it uses `gencert`, a self-signed
-certificate that is automatically generated on first boot.
-
-To use a different certificate, e.g., one signed by a CA, first add
-it to the keystore as an asymmetric key with `x509-public-key-format`,
-then point the web `certificate` leaf to it:
-
-<pre class="cli"><code>admin@example:/config/web/> <b>set certificate my-cert</b>
-admin@example:/config/web/>
-</code></pre>
-
-See [Keystore](keystore.md#tls-certificates) for details on managing
-TLS certificates.
-
 ## System Upgrade

 See [Upgrade & Boot Order](upgrade.md) for information on upgrading.
@@ -27,16 +27,6 @@ The standard IETF model for static routes reside under the `static`
 control plane protocol.  For our examples we use the instance name
 `default`, you can use any name.

-The most common case when using a static IP setup is adding a default
-route (i.e., the default gateway):
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit routing control-plane-protocol static name default ipv4</b>
-admin@example:/config/routing/…/ipv4/> <b>set route 0.0.0.0/0 next-hop next-hop-address 192.168.1.1</b>
-admin@example:/config/routing/…/ipv4/> <b>leave</b>
-admin@example:/>
-</code></pre>
-
 For a route with destination 192.168.200.0/24 via 192.168.1.1:

 <pre class="cli"><code>admin@example:/> <b>configure</b>
@@ -63,17 +53,6 @@ admin@example:/>

 ## IPv6 Static routes

-Default route via an IPv6 gateway:
-
-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit routing control-plane-protocol static name default ipv6</b>
-admin@example:/config/routing/…/ipv6/> <b>set route ::/0 next-hop next-hop-address 2001:db8:3c4d:1::1</b>
-admin@example:/config/routing/…/ipv6/> <b>leave</b>
-admin@example:/>
-</code></pre>
-
-For a route with destination 2001:db8:3c4d:200::/64 via 2001:db8:3c4d:1::1:
-
 <pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit routing control-plane-protocol static name default ipv6</b>
 admin@example:/config/routing/…/ipv6/> <b>set route 2001:db8:3c4d:200::/64 next-hop next-hop-address 2001:db8:3c4d:1::1</b>
@@ -243,59 +243,20 @@ spanning tree matches the expected one.

 Integration to Infix
 --------------------
+When the test environment is started with Qeneth, it doesn't use the 
+base image directly. Instead, it creates a copy and inserts a `test-mode`
+flag into it. During the bootstrap phase, the system checks for the 
+presence of the test-mode flag (file).

-### Test Mode
+If the flag exists, a 'test-config.cfg' file is generated. In the 
+following step, the system loads the 'test-config' instead of the
+standard `startup-config` (or `factory-config`). This configuration
+is simple and safe, equivalent to the one used in 'Secure Mode' 
+(also known as 'failure-config').

-Infix supports a *test mode* that makes devices safe and predictable to
-test against.  When active, each boot starts from a known-good
-`test-config` (equivalent to the failure/secure config) instead of the
-stored startup or factory configuration.  This prevents any persistent
-configuration from interfering with tests and avoids L2 loops that a
-factory config might create.  It also enables two extra RPCs used by
-Infamy:
-
- `infix-test:test/reset` — reload the `test-config` into the running
-  datastore (called by `env.attach()` at the start of each test)
- `infix-test:test/override-startup` — boot from the startup datastore
-  once, instead of the `test-config` (used by tests that verify
-  save-and-reboot behaviour)
-
-Test mode is activated by the presence of an empty file named
-`test-mode` on the device's `aux` partition (`/mnt/aux/test-mode`).
-
-### Test Mode on Virtual Devices
-
-When the test environment is started with Qeneth, the `inject-test-mode`
-script (`test/inject-test-mode`) is run automatically.  It copies the
-base disk image and writes the `test-mode` marker into the `aux`
-partition of that copy, which is then used as the Qeneth backing image.
-
-### Test Mode on Physical Devices
-
-For a physical device, log in as `root` (or `admin`) and create the
-marker file on the `aux` partition, then reboot:
-
-```
-# touch /mnt/aux/test-mode
-# reboot
-```
-
-Alternatively, if you want to prepare the disk image before flashing,
-use the `inject-test-mode` script:
-
-```
-$ test/inject-test-mode -b infix-<board>.img -o infix-<board>-test.img
-```
-
-Flash `infix-<board>-test.img` to the device instead of the plain
-image.  The device will boot into test mode on first power-on.
-
-> [!NOTE]
-> Test mode persists across reboots until the marker file is removed
-> (`rm /mnt/aux/test-mode`).  A device in test mode always starts from
-> the `test-config`, so any configuration changes are lost on reboot
-> unless `startup_override()` is called first (or the marker is removed
-> and a normal startup config is saved).
+Additionally, the configuration enables extra RPCs related to system 
+restart and configuration overrides, allowing tests to be run even on 
+systems where the factory configuration may potentially create L2 loops. 

 [9PM]:    https://github.com/rical/9pm
 [Qeneth]: https://github.com/wkz/qeneth
@@ -37,7 +37,7 @@ $ make TEST_MODE=host test
 ...
 ```

-This is typically used when testing on physical hardware. By default the
+This typically used when testing on physical hardware. By default the
 topology will be sourced from `/etc/infamy.dot`, but this can be
 overwritten by setting the `TOPOLOGY` variable:

@@ -46,12 +46,6 @@ $ make TEST_MODE=host TOPOLOGY=~/my-topology.dot test
 ...
 ```

-> [!IMPORTANT]
-> Physical devices must be put into *test mode* before running tests.
-> See [Test Mode](test-arch.md#test-mode) in the architecture document
-> for details.  The short version: log in to the device and run
-> `touch /mnt/aux/test-mode && reboot`.
-
 ### `make run` Devices

 Some tests only require a single DUT.  These can therefore be run
@@ -129,9 +129,6 @@ markdown_extensions:
  - pymdownx.highlight:
      anchor_linenums: true
  - pymdownx.inlinehilite
-  - pymdownx.emoji:
-      emoji_index: !!python/name:material.extensions.emoji.twemoji
-      emoji_generator: !!python/name:material.extensions.emoji.to_svg
  - pymdownx.snippets
  - pymdownx.tabbed:
      alternate_style: true
@@ -20,7 +20,6 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/firewall/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/greenpak-programmer/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/ifupdown-ng/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/iito/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/initviz/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/k8s-logger/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/keyack/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/klish-plugin-infix/Config.in"
@@ -1,11 +1,27 @@
 #set DEBUG=1

-# Single daemon handles gen-config, datastore init, config load, and plugins
-#  log:prio:daemon.err
-service log:console env:/etc/default/confd           \
-	[S12345] <usr/ixinit> confd -f -v warning \
-		-F /etc/factory-config.cfg \
-		-S /cfg/startup-config.cfg \
-		-E /etc/failure-config.cfg \
-		-t $CONFD_TIMEOUT \
+run name:bootstrap log:prio:user.notice norestart <usr/ixinit> \
+	[S] /usr/libexec/confd/bootstrap \
+	-- Bootstrapping YANG datastore
+
+run name:error :1 log:console norestart if:<run/bootstrap/failure> \
+	[S] /usr/libexec/confd/error --
+
+service name:confd log:prio:daemon.err <run/bootstrap/success> \
+	[S12345] sysrepo-plugind -f -p /run/confd.pid -n -v warning \
 	-- Configuration daemon
+
+# Bootstrap system with startup-config
+run name:startup log:prio:user.notice norestart <pid/confd> env:/etc/default/confd \
+	[S] /usr/libexec/confd/load -t $CONFD_TIMEOUT startup-config \
+	-- Loading startup-config
+
+# Run if loading startup-config fails for some reason
+run	name:failure log:prio:user.crit norestart env:/etc/default/confd \
+	if:<run/startup/failure> \
+	[S] <pid/confd> /usr/libexec/confd/load -t $CONFD_TIMEOUT failure-config \
+	-- Loading failure-config
+
+run	name:error :2 log:console norestart \
+	if:<run/failure/failure> \
+	[S] /usr/libexec/confd/error --
@@ -4,13 +4,13 @@
 #
 ################################################################################

-CONFD_VERSION = 1.8
+CONFD_VERSION = 1.7
 CONFD_SITE_METHOD = local
 CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
 CONFD_LICENSE = BSD-3-Clause
 CONFD_LICENSE_FILES = LICENSE
 CONFD_REDISTRIBUTE = NO
-CONFD_DEPENDENCIES = host-sysrepo sysrepo rousette netopeer2 jansson libite sysrepo libsrx libglib2 libev
+CONFD_DEPENDENCIES = host-sysrepo sysrepo rousette netopeer2 jansson libite sysrepo libsrx libglib2
 CONFD_AUTORECONF = YES
 CONFD_CONF_OPTS += --disable-silent-rules --with-crypt=$(BR2_PACKAGE_CONFD_DEFAULT_CRYPT)
 CONFD_SYSREPO_SHM_PREFIX = sr_buildroot$(subst /,_,$(CONFIG_DIR))_confd
@@ -42,7 +42,7 @@ define CONFD_INSTALL_EXTRA
 	done
 	cp $(CONFD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/etc/tmpfiles.d/confd.conf
 	mkdir -p $(TARGET_DIR)/etc/avahi/services
-	cp $(CONFD_PKGDIR)/netconf.service $(TARGET_DIR)/etc/avahi/services/
+	cp $(CONFD_PKGDIR)/avahi.service $(TARGET_DIR)/etc/avahi/services/netconf.service
 endef

 NETOPEER2_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/netopeer2/
@@ -1,2 +1,3 @@
-# Update /etc/resolv.conf after successful bootstrap and reconf.
-task [S12345] <usr/bootstrap,pid/dnsmasq> resolvconf -u --
+# Create initial /etc/resolv.conf after successful bootstrap, regardless
+# of startup-config or failure-config.  Condition set by confd.
+task [S12345] <usr/bootstrap> resolvconf -u -- Update DNS configuration
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Mattias WalströmandGitHub	1cc84e95e4	Merge pull request #1448 from kernelkit/cand/v26.02.x Move local GitHub actions to kernelkit/actions repo	2026-03-16 16:09:54 +01:00
Joachim WibergandClaude Sonnet 4.6	62adf55270	.github: move local actions to kernelkit/actions repo Fixes a regression from `0c11cea` where local composite actions (.github/actions/) were referenced with relative paths. When spins reuse our reusable workflows, GitHub resolves relative action paths in the context of the calling repo, not infix — breaking the build. Replace all uses of ./.github/actions/{cache-restore,podman-cleanup} with kernelkit/actions/{cache-restore,podman-cleanup}@v1 (new repo). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-16 16:01:33 +01:00
Mattias WalströmandGitHub	7176666340	Merge pull request #1445 from kernelkit/lts-kernel-backport LTS kernel backport + net.d tmpfiles fix	2026-03-13 08:27:24 +01:00
Joachim Wiberg	0b475a7ce6	Update ChangeLog for v26.02.1 GA Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-13 07:33:15 +01:00
Joachim Wiberg	2e9e5858b9	package/netd: ensure /etc/net.d exists at boot Before netd starts confd might want to create .conf file for it to run, so we sort of depend on /etc/net.d existing at boot. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-12 23:33:21 +01:00
Mattias WalströmandJoachim Wiberg	4c8b62d1b1	Upgrade Linux kernel to 6.18.17 Signed-off-by: Mattias Walström <lazzer@gmail.com>	2026-03-12 19:47:33 +01:00
Joachim WibergandGitHub	e17780f197	Merge pull request #1442 from kernelkit/netd-backport Backport fix to critical v26.02.0 regression	2026-03-12 16:10:14 +01:00
Joachim Wiberg	b4ea26961f	Update ChangeLog for v26.02.1 GA Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-12 13:53:38 +01:00
Joachim Wiberg	be3891c2f0	netd: watch conf.d with inotify, retry on backend failure Two races could prevent DHCP-learned default routes from being installed at boot: 1. The signal from the DHCP client script could be lost leaving conf.d updated but frr.conf stale. 2. Even when the signal was received, 'vtysh -b' could fail because the FRR daemon chain (mgmtd→zebra→staticd) writes PID files before being fully operational, causing netd to give up with no retry. Fix both by refactoring netd to use libev: - Use an inotify watch of CONF_DIR, so netd reacts directly to file changes without depending on signal delivery. - On backend_apply() failure, schedule a retry in 5s and call pidfile() unconditionally so dependent services are not blocked waiting for the Finit condition 'pid/netd' to be satisfied. We also take this opportunity to rename /etc/netd/conf.d/ to /etc/net.d/ The extra /etc/netd/ directory level served no purpose — nothing else lives there. Flatten to /etc/net.d/ which reads more naturally as the drop-in directory for network configuration snippets. Also, reduce logging a bit since each netd backend already logs success or fail which is sufficient to know that a configuration change has been applied or not. Finally, with the new inotify processing in netd it's redundant to call 'initctl reload netd' from the udhcpc script, in fact it will only cause unnecessary overhead, so we drop it. Fixes #1438 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-12 13:50:01 +01:00
Joachim WibergandGitHub	f6f6381eaf	Merge pull request #1433 from kernelkit/cand/v26.02.x v26.02.1 Release Candidate	2026-03-11 14:07:13 +01:00
Joachim Wiberg	e5754b4001	doc: prepare for v26.02.1 release Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-11 12:36:17 +01:00
Joachim Wiberg	6838cc9c25	confd: follow-up to OSPF point-to-multipoint Add a must expression to ensure users do not set static neighbors when the interface type is not point-to-multipoint or non-broadcast. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-11 12:36:17 +01:00
Mattias WalströmandJoachim Wiberg	d869f6c478	Followup OSPF point-to-multipoint [skip ci]	2026-03-11 12:36:16 +01:00
Mattias WalströmandJoachim Wiberg	f37d29aa21	ospf: add point-to-multipoint and hybrid interface type support Signed-off-by: Mattias Walström <lazzer@gmail.com>	2026-03-11 12:36:16 +01:00
ael-botandJoachim Wiberg	982a754472	Upgrade Linux kernel to 6.18.16	2026-03-10 14:33:33 +01:00
Joachim Wiberg	931ae71019	board: relocate SafeXcel firmware selection to Marvell BSPs The MVEBU SafeXcel Crypto Engine firmware (linux-firmware minifw) was originally added in `70c12c3` to the generic aarch64 defconfigs to silence kernel probe failures on Marvell Armada SoCs (37xx, 7k, 8k, CN913x): crypto-safexcel f2800000.crypto: Firmware load failed. crypto-safexcel f2800000.crypto: HW init failed (-2) It was then accidentally dropped in `0e2d12e` (kernel upgrade to 6.18), which rebased on a tree that predated the firmware addition. Rather than restoring it to the generic defconfigs, move it to the two Marvell board Config.in files where it actually belongs — consistent with how RTL8169 firmware was handled for the Raspberry Pi CM4 IoT Router Board Mini in `68313773`. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-10 14:27:31 +01:00
Joachim Wiberg	c69a617ecb	patches: lift iptables name length limit in firewalld A legacy name length limit in firewalld triggered problems with longer policy names. This patch to firewalld lifts that limit by checking the backend in use, no limit for nftables. Fixes #1389 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-10 14:27:31 +01:00
Joachim Wiberg	c79beea4ec	statd: silence 'show firewall' when firewall is disabled Fixes #1416 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-10 14:27:30 +01:00
Joachim Wiberg	cf1e81c8d1	package/skeleton-init-fint: increase zebra netlink buffer Increase Zebra NETLINK buffer to fix reported issues with zebra being out of sync with kernel routes and interface changes. Also, try '-a' option to allow other processes to delete zebra routes. Other changes in this commit: - Minor fixes to Finit service files for consistency - Empty daemon.conf stub files to silence bogus mgmtd errors at startup - Relocate all skeleton files from board/common to separate from files that are actual Infix additions and what's package system integration Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-10 14:27:30 +01:00
Mattias WalströmandJoachim Wiberg	e04937a0f7	GPS: Disable GPS in _minimal config	2026-03-10 14:27:30 +01:00
Mattias WalströmandJoachim Wiberg	e838f6dfd8	yang: add feature flags for wifi and gps in infix-hardware	2026-03-10 14:27:27 +01:00
				`@@ -1 +0,0 @@`
				`dtb-y += mediatek/mt7622-bananapi-bpi-r64.dtb`
				`@@ -1 +0,0 @@`
				`CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-sd-env.dtsi"`
				`@@ -0,0 +1 @@`
				`task [S] <service/confd/ready> /usr/libexec/infix/mkcert -- Verifying self-signed https certificate`