modemd: handle preferred-mode set without allowed-mode

Setting just preferred-mode in YANG (no allowed-mode leaf-list) built an
invalid mode string with an empty allowed:

  Mode 'allowed: ; preferred: 4g' is not supported

The empty allowed: can never match anything in the modem's supported-modes
list, so the user got a cryptic 'is not supported' even when their preferred
mode was, in principle, supported.

When only preferred-mode is configured, walk the modem's supported-modes list
for an entry that already has that preferred, and reuse its allowed set.  If
no supported entry has that preferred mode, fail with a message that lists
every combination the modem does support, easier to diagnose than the silent
'empty allowed' case.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

.github/workflows/add-issue-to-project.yml

@@ -10,7 +10,7 @@ jobs:
     name: Add issue to project Infix&co
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@v2
         with:
           project-url: https://github.com/orgs/kernelkit/projects/3
           github-token: ${{ secrets.ADD_TO_PROJECT }}

.github/workflows/build-boot.yml

@@ -108,7 +108,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           pattern: "artifact-*"
           merge-multiple: true

.github/workflows/check-kernel-release.yml

@@ -103,7 +103,7 @@ jobs:
 
       - name: Create pull request
         if: steps.check.outputs.new_release == 'true'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
           script: |

.github/workflows/publish.yml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: "artifact-*"
           merge-multiple: true

.github/workflows/release.yml

@@ -78,7 +78,7 @@ jobs:
           echo "pre=${{ steps.rel.outputs.pre }}"
           echo "latest=${{ steps.rel.outputs.latest }}"
 
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           pattern: "artifact-*"
           merge-multiple: true

.github/workflows/test.yml

@@ -98,7 +98,7 @@ jobs:
         run: |
           make ${{ env.TARGET }}_defconfig
 
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           pattern: "artifact-*"
           merge-multiple: true

.github/workflows/weekly.yml

@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v8
         with:
           pattern: "artifact-*"
           merge-multiple: true

board/aarch64/bananapi-bpi-r4/README.md

@@ -87,6 +87,45 @@ Infix ships with the following factory defaults.
 > are bridged into the LAN as access points.  WiFi is not included with the board
 > and is not part of the factory default configuration.
 
+## SIM Card Installation
+
+The BPI-R4 has three SIM holders, one per PCIe slot:
+
+| Slot     | PCIe socket | Typical use              |
+|----------|-------------|--------------------------|
+| **SIM1** | M.2 Key-B   | 4G/5G WWAN modem         |
+| **SIM2** | mPCIe #1    | Cellular or other modem  |
+| **SIM3** | mPCIe #2    | Cellular or other modem  |
+
+All three take **nano-SIM (4FF)** cards.
+
+> [!NOTE]
+> The official Banana Pi pages show an older board revision with a sliding
+> "sled" holder.  Newer boards ship with a fixed friction-fit holder instead:
+> there is no lid to lift and no spring eject.  The [closest matching photo on
+> bananapi.org][15] shows the current mechanism.
+
+### Inserting a SIM
+
+1. Orient the card with the gold contacts facing the PCB (printed
+   side up) and the cut corner pointing toward the M.2/mPCIe socket,
+   which on this board is also toward the outer edge.  The silkscreen
+   next to each holder shows the same outline.
+2. Push the SIM straight in until it is fully seated.  There is no
+   click and the holder is not spring-loaded, so press firmly until
+   the contacts engage and the rear edge of the card sits flush with
+   the holder.
+3. A SIM that still protrudes is not fully inserted; push again.
+
+### Removing a SIM
+
+The friction grip on these holders is tight.  Gently pry the card out
+with a fingernail or a thin plastic spudger.  Avoid metal tweezers
+near the contacts.  Removing the front panel of the metal case is
+absolutely necessary to access the SIM holder.
+
+For software configuration once the modem is recognised, see the
+[Cellular Modem User's Guide][16].
 
 ## Getting Started
 
@@ -358,3 +397,6 @@ make aarch64
 [12]: https://github.com/frank-w/u-boot/releases
 [13]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2026-01-bpi-2026.01-2026-01-15_2013/bpi-r4_spim-nand_bl2.img
 [14]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2026-01-bpi-2026.01-2026-01-15_2013/bpi-r4_spim-nand_fip.bin
+[15]: https://docs.banana-pi.org/bpi-r4/bpi-r4_4g5g_2.jpg
+[16]: https://www.kernelkit.org/infix/latest/modem/
+

board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4-2g5/etc/factory-config.cfg

@@ -10,6 +10,13 @@
         "state": {
           "admin-state": "unlocked"
         }
+      },
+      {
+        "name": "USB2",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
       }
     ]
   },
@@ -366,7 +373,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.8"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4/etc/factory-config.cfg

@@ -10,6 +10,13 @@
         "state": {
           "admin-state": "unlocked"
         }
+      },
+      {
+        "name": "USB2",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
       }
     ]
   },
@@ -358,7 +365,7 @@
     ]
   },
   "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.8"
   },
   "infix-services:mdns": {
     "enabled": true

board/common/rootfs/etc/default/confd

@@ -1 +1,5 @@
 CONFD_TIMEOUT=60
+#DEBUG=1
+
+# -v debug
+CONFD_ARGS=""

board/common/rootfs/etc/finit.d/available/hostapd@.conf

@@ -1,3 +0,0 @@
-service <!> name:hostapd :%i \
-	[2345] hostapd -P/var/run/hostapd-%i.pid  /etc/hostapd-%i.conf \
-	-- Wi-Fi Access Point @%i

board/common/rootfs/etc/finit.d/available/mesh@.conf

@@ -0,0 +1,3 @@
+service name:wpa_supplicant :%i \
+	[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+	-- Wi-Fi Mesh @%i

board/common/rootfs/etc/iproute2/rt_addrprotos

@@ -5,3 +5,4 @@
 4 static
 5 dhcp
 6 random
+7 wwan

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -620,6 +620,73 @@ def probe_ptp_capabilities(out):
         out.setdefault("interfaces", {}).update(ifaces)
 
 
+def _usb_root_from_sysfs(dev_path):
+    p = dev_path
+    while p not in ("/", "/sys"):
+        parent = os.path.realpath(os.path.join(p, ".."))
+        basename = os.path.basename(parent)
+        if basename.startswith("usb") and basename[3:].isdigit():
+            return parent
+        p = parent
+    return None
+
+
+def _read_usb_vid_pid(dev_path):
+    p = dev_path
+    while p not in ("/", "/sys"):
+        try:
+            vid = open(os.path.join(p, "idVendor")).read().strip()
+            pid = open(os.path.join(p, "idProduct")).read().strip()
+            return vid, pid
+        except OSError:
+            pass
+        p = os.path.dirname(p)
+    return "", ""
+
+
+def probe_modems(out):
+    """devpath is the USB bus root; ModemManager matches by path prefix.
+    seen_roots deduplicates cdc-wdm and ttyUSB ports of the same physical modem."""
+    seen_roots = set()
+    modems = []
+    idx = 0
+
+    def add_modem(dev_path):
+        nonlocal idx
+        usb_root = _usb_root_from_sysfs(dev_path)
+        if usb_root is None or usb_root in seen_roots:
+            return
+        seen_roots.add(usb_root)
+        vid, pid = _read_usb_vid_pid(dev_path)
+        modems.append({
+            "index": idx,
+            "name": "modem%d" % idx,
+            "devpath": usb_root,
+            "vid": vid,
+            "pid": pid,
+        })
+        idx += 1
+
+    for cls_dir, prefix in (("/sys/class/usbmisc", "cdc-wdm"),
+                             ("/sys/class/tty", "ttyUSB")):
+        try:
+            entries = os.listdir(cls_dir)
+        except OSError:
+            continue
+        for entry in entries:
+            if not entry.startswith(prefix):
+                continue
+            try:
+                dev_path = os.path.realpath(
+                    os.path.join(cls_dir, entry, "device"))
+                add_modem(dev_path)
+            except OSError:
+                pass
+
+    if modems:
+        out["modem"] = modems
+
+
 def main():
     out = {
         "vendor": None,
@@ -647,6 +714,7 @@ def main():
 
     probe_wifi_radios(out)
     probe_ptp_capabilities(out)
+    probe_modems(out)
 
     if not out["factory-password-hash"]:
         sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +

board/common/rootfs/usr/libexec/infix/iw.py

@@ -257,15 +257,15 @@ def parse_interface_info(ifname):
     for line in output.splitlines():
         stripped = line.strip()
 
-        # Interface type
+        # Interface type (can be multi-word, e.g. "mesh point")
         if stripped.startswith('type '):
-            result['iftype'] = stripped.split()[1]
+            result['iftype'] = ' '.join(stripped.split()[1:])
 
         # MAC address
         elif stripped.startswith('addr '):
             result['mac'] = stripped.split()[1]
 
-        # SSID
+        # SSID (AP mode) or mesh-id (mesh point mode) — kernel uses same attr
         elif stripped.startswith('ssid '):
             result['ssid'] = decode_iw_ssid(' '.join(stripped.split()[1:]))
 
@@ -538,6 +538,43 @@ def parse_link(ifname):
     return result
 
 
+def parse_phy_caps(phy_name):
+    """
+    Parse 'iw phy <name> info' for HT and VHT capability bitmasks.
+    Returns: {ht_cap: int, vht_cap: int}
+
+    iw phy info output format:
+        Capabilities: 0x1ef
+            ...
+        VHT Capabilities (0x339071b2):
+            ...
+    """
+    actual_phy = normalize_phy_name(phy_name)
+    output = run_iw('phy', actual_phy, 'info')
+    if not output:
+        output = run_iw(actual_phy, 'info')
+    if not output:
+        return {'ht_cap': 0, 'vht_cap': 0}
+
+    ht_cap = 0
+    vht_cap = 0
+
+    for line in output.splitlines():
+        stripped = line.strip()
+
+        # HT Capabilities: "Capabilities: 0x1ef"
+        ht_match = re.match(r'Capabilities:\s+(0x[0-9a-fA-F]+)', stripped)
+        if ht_match:
+            ht_cap = int(ht_match.group(1), 16)
+
+        # VHT Capabilities: "VHT Capabilities (0x339071b2):"
+        vht_match = re.match(r'VHT Capabilities\s+\((0x[0-9a-fA-F]+)\)', stripped)
+        if vht_match:
+            vht_cap = int(vht_match.group(1), 16)
+
+    return {'ht_cap': ht_cap, 'vht_cap': vht_cap}
+
+
 def main():
     if len(sys.argv) < 2:
         print(json.dumps({
@@ -548,7 +585,8 @@ def main():
                 'info': 'Get PHY or interface information (requires device)',
                 'survey': 'Get channel survey data (requires interface)',
                 'station': 'Get connected stations in AP mode (requires interface)',
-                'link': 'Get link info in station mode (requires interface)'
+                'link': 'Get link info in station mode (requires interface)',
+                'caps': 'Get HT/VHT capability bitmasks (requires PHY/radio)'
             },
             'examples': [
                 'iw.py list',
@@ -557,7 +595,8 @@ def main():
                 'iw.py info wlan0',
                 'iw.py station wifi0',
                 'iw.py link wlan0',
-                'iw.py survey wlan0'
+                'iw.py survey wlan0',
+                'iw.py caps radio0'
             ]
         }, indent=2))
         sys.exit(1)
@@ -594,6 +633,11 @@ def main():
                 data = {'error': 'survey command requires interface argument'}
             else:
                 data = parse_survey(sys.argv[2])
+        elif command == 'caps':
+            if len(sys.argv) < 3:
+                data = {'error': 'caps command requires PHY/radio argument'}
+            else:
+                data = parse_phy_caps(sys.argv[2])
         else:
             data = {'error': f'Unknown command: {command}'}
 

configs/aarch64_defconfig

@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.33"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -149,6 +149,7 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
+BR2_PACKAGE_FEATURE_MODEM=y
 BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
 BR2_PACKAGE_FEATURE_WIFI_QUALCOMM=y

configs/aarch64_minimal_defconfig

@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.33"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y

configs/arm_defconfig

@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.33"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y

configs/arm_minimal_defconfig

@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.33"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y

configs/x86_64_defconfig

@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.33"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y

configs/x86_64_minimal_defconfig

@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.33"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y

doc/ChangeLog.md

@@ -3,6 +3,34 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
+[v26.06.0][UNRELEASED]
+--------------
+
+### Changes
+
+- Add Wi-Fi roaming for fast, seamless handoff between access points that
+  share an SSID: 802.11k, 802.11v and 802.11r (over-the-air FT).  See the
+  [Wi-Fi User's Guide][wifi] for details
+- Add Wi-Fi 802.11s mesh support, letting access points form a wireless
+  backhaul between each other without cabling
+- Add band steering for dual-band access points, nudging dual-band
+  clients onto the faster 5/6 GHz band
+- Add `legacy-rates` option to re-enable 802.11b rates on 2.4 GHz for
+  old IoT devices (disabled by default)
+- Add cellular modem (WWAN) support for USB-attached MBIM/QMI modems,
+  including USB dongles, mPCIe cards, and M.2 Key-B modules.  Multiple
+  APNs per modem, SIM PIN configuration, and NMEA routing from modem
+  GPS to gpsd.  See the [Modem User's Guide][modem] for details
+
+### Fixes
+
+- Firewall masquerade no longer enables the global IPv4/IPv6 forwarding
+  sysctls.  You must now enable IP forwarding explicitly on the interfaces
+  that should route traffic; enabling NAT alone is no longer enough
+
+[wifi]:  https://www.kernelkit.org/infix/latest/wifi/
+[modem]: https://www.kernelkit.org/infix/latest/modem/
+
 [v26.05.0][] - 2026-05-29
 -------------------------
 
@@ -60,9 +88,9 @@ All notable changes to the project are documented in this file.
   show`, which were not expanded, so `show interface` and other operational
   reads failed.  Ranges are now expanded and listed correctly
 
-[ethernet]: ethernet.md#restricting-advertised-link-modes
+[ethernet]: https://www.kernelkit.org/infix/latest/ethernet/#restricting-advertised-link-modes
 [BPI-R3]:   https://docs.banana-pi.org/en/BPI-R3/BananaPi_BPI-R3
-[AcerConnectVero]: ../board/aarch64/acer-connect-vero-w6m/
+[AcerConnectVero]: https://github.com/kernelkit/infix/tree/main/board/aarch64/acer-connect-vero-w6m/
 
 [v26.04.0][] - 2026-04-30
 -------------------------

doc/README.md

@@ -21,7 +21,9 @@ regression test system solely relies on NETCONF and RESTCONF.
    - [Introduction](introduction.md)
    - [System Configuration](system.md)
    - [Network Configuration](networking.md)
+   - [Wi-Fi](wifi.md)
    - [DHCP Server](dhcp.md)
+   - [Cellular Modem (WWAN)](modem.md)
    - [Syslog Support](syslog.md)
  - **Infix In-Depth**
    - [Boot Procedure](boot.md)

doc/modem.md

@@ -0,0 +1,438 @@
+# Cellular Modem (WWAN)
+
+Infix supports cellular modem connectivity via modems that expose a
+QMI or MBIM control interface over USB.  Form factor does not matter:
+USB dongles, mPCIe cards, and M.2 Key-B modules all work as long as
+the modem chipset uses USB on the connector (the typical case for
+4G/LTE modems).  See *Supported Modems* below for the exceptions.
+
+Setup involves three configuration items:
+
+- A `modem0` hardware component for the physical modem
+- A `sim0` hardware component for the SIM card slot
+- A `wwan0` network interface that references both and carries the
+  bearer (APN) configuration
+
+## Architecture
+
+Infix uses a three-layer architecture for cellular modem support:
+
+1. **Modem hardware component (modem0)**: the physical modem
+     - Configured via `ietf-hardware` with class `infix-hardware:modem`
+     - `admin-state` controls whether ModemManager and modemd are active
+     - Holds physical-layer config: allowed bands, preferred mode, location
+     - Auto-discovered into factory-default config when the modem is
+       present at first boot
+
+2. **SIM hardware component (sim0)**: the SIM card slot
+     - Configured via `ietf-hardware` with class `infix-hardware:sim`
+     - Holds PIN/PUK credentials and carrier profile
+     - Auto-discovered into factory-default config alongside the modem
+
+3. **Network interface (wwan0)**: data bearer to the cellular network
+     - Configured via `ietf-interfaces` with type `infix-if-type:modem`
+     - References a modem component and a SIM component
+     - Holds bearer config: APN, IP type, roaming, route preference,
+       authentication
+     - Always added by the user, never auto-created
+
+## Naming Conventions
+
+| **Name Pattern** | **Type**             | **Description**                                 |
+|------------------|----------------------|-------------------------------------------------|
+| `modemN`         | Modem hardware       | Hardware component for the physical modem       |
+| `simN`           | SIM hardware         | Hardware component for the SIM card slot        |
+| `wwanN`          | Modem interface      | Network interface for cellular data             |
+
+Where `N` is a number (0, 1, 2, ...).
+
+> [!TIP]
+> Using these naming conventions simplifies configuration since type and
+> class are automatically inferred.  Creating a hardware component named
+> `modem0` automatically sets its class to `infix-hardware:modem`, and
+> creating an interface named `wwan0` automatically sets its type to
+> `infix-if-type:modem`.
+>
+> **Note:** This inference only works via the CLI.  When configuring
+> over NETCONF or RESTCONF the class and type must be set explicitly.
+
+## Multi-Bearer (Multiple APNs)
+
+Multiple wwan interfaces can reference the same modem component, each
+with a different APN.  Same idea as multi-SSID on a WiFi radio: one
+hardware modem, several independent data connections.
+
+Configure `wwan0` and `wwan1` both pointing to `modem0`:
+
+```
+edit interface wwan0 wwan
+set modem modem0
+set bearer apn internet
+
+edit interface wwan1 wwan
+set modem modem0
+set bearer apn corporate.vpn.apn
+```
+
+## Current Limitations
+
+- The modem must be present at boot.  Hot-plug is not supported.
+- If the modem is absent at boot, and no `probe-timeout` is set, a
+  dummy `wwan0` placeholder is created immediately so IP configuration
+  can proceed.  A reboot is required once the hardware is inserted.
+
+## Supported Modems
+
+Modems exposing a CDC-WDM control interface over USB are supported,
+regardless of physical form factor.  Two protocols are handled by
+ModemManager:
+
+- **MBIM**: Mobile Broadband Interface Model (e.g. Sierra Wireless,
+  Quectel EM06/EM12)
+- **QMI**: Qualcomm MSM Interface (e.g. Sierra Wireless EM7xxx,
+  Quectel EM/RMxxx)
+
+Most 4G/LTE modules (USB dongles, mPCIe cards, M.2 Key-B) use USB on
+the connector even when the slot also carries PCIe lanes.  From Infix's
+view they are all USB modems.  PCIe-only modems (some 5G NR modules)
+are not supported, since the modemd / ModemManager pipeline assumes a
+USB-attached control interface.
+
+## Step-by-step Setup
+
+### 1. Hardware Detection
+
+At first boot, USB modems detected by the kernel are written to
+`/run/system.json` and added as hardware components in the
+factory-default configuration.  Verify the modem appears:
+
+<pre class="cli"><code>admin@example:/> <b>show modem</b>
+──────────────────────────────────────────────────────────────
+<span class="title">Cellular Modems</span>
+NAME    MANUFACTURER  MODEL   STATE       NETWORK  SIGNAL
+modem0  Quectel       EM06-E  registered  lte      good
+──────────────────────────────────────────────────────────────
+<span class="title">SIM Cards</span>
+NAME  SLOT  STATE     OPERATOR
+sim0  1     unlocked  Tele2
+</code></pre>
+
+The `STATE`, `SIM STATE`, and `SIGNAL` columns are color-coded so the
+healthy / attention / problem cases are visible at a glance: green for
+`registered`, `connected`, `unlocked`, `excellent`, `good`; yellow for
+transient or attention states like `enabling`, `pin-required`, `poor`;
+red for `failed`, `not-inserted`, `bad`.
+
+If `modem0` does not appear:
+
+- Verify the kernel sees the modem (`dmesg | grep -i mbim` or
+  `dmesg | grep -i qmi`).  Without a kernel driver no further setup
+  is possible.
+- On boards with a custom factory configuration, or after replacing
+  hardware on a running system, the components may need to be added
+  manually.  See Step 2.
+
+### 2. Hardware Components
+
+If `show modem` already lists `modem0` and `sim0`, the components were
+auto-discovered into the factory-default configuration and you can skip
+ahead to Step 3.
+
+Otherwise, add them manually.  The class is inferred from the component
+name (`modemN` → `infix-hardware:modem`, `simN` → `infix-hardware:sim`).
+The `admin-state` must be set explicitly.  There is no implicit default,
+and without `unlocked` confd will not start ModemManager or modemd:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit hardware component modem0</b>
+admin@example:/config/hardware/component/modem0/> <b>set state admin-state unlocked</b>
+admin@example:/config/hardware/component/modem0/> <b>end</b>
+admin@example:/config/hardware/> <b>edit component sim0</b>
+admin@example:/config/hardware/component/sim0/> <b>set state admin-state unlocked</b>
+admin@example:/config/hardware/component/sim0/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+To take the modem offline cleanly without removing the configuration,
+set `admin-state locked`.  All related services are stopped and the
+bearer is torn down before the modem goes offline:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit hardware component modem0</b>
+admin@example:/config/hardware/component/modem0/> <b>set state admin-state locked</b>
+admin@example:/config/hardware/component/modem0/> <b>leave</b>
+</code></pre>
+
+#### Slow USB Modems
+
+USB modems can be slow to enumerate at boot.  The kernel wwan interface
+may not appear until several seconds after confd starts applying
+configuration.  The `probe-timeout` leaf inside the `modem` hardware
+configuration container controls how long confd waits.  It defaults to
+30 seconds when the container is present.
+
+To enable the timeout, create the modem configuration container (this
+also lets you configure bands, preferred mode, etc.):
+
+<pre class="cli"><code>admin@example:/config/> <b>edit hardware component modem0 modem</b>
+admin@example:/config/hardware/component/modem0/modem/> <b>leave</b>
+</code></pre>
+
+With `probe-timeout` at its default of 30, confd waits up to 30 seconds
+for the wwan interface to appear before proceeding.  For most modems it
+is ready in 2-5 seconds.  If the modem has not appeared within the
+timeout, a dummy placeholder interface is created and a reboot is
+required for the real interface to take over.  Set `probe-timeout 0`
+to disable waiting entirely.
+
+> [!NOTE]
+> Some Quectel modules (e.g. EM05) re-enumerate the USB device several
+> times during a cold-boot firmware-init sequence that takes around 50
+> to 60 seconds.  Bump `probe-timeout` to 90 for those, otherwise the
+> dummy placeholder fires before the modem settles and the real
+> interface ends up with a different name (`wwan1` instead of `wwan0`).
+
+### 3. Configure the Bearer (APN)
+
+Bearer configuration lives on the `wwan0` interface.  Reference the
+modem hardware component and set the APN:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface wwan0</b>
+admin@example:/config/interface/wwan0/> <b>set wwan modem modem0</b>
+admin@example:/config/interface/wwan0/> <b>set wwan sim sim0</b>
+admin@example:/config/interface/wwan0/> <b>set wwan bearer apn internet</b>
+admin@example:/config/interface/wwan0/> <b>leave</b>
+</code></pre>
+
+The modem will connect automatically once the bearer is configured and
+the hardware is unlocked.
+
+**Key bearer parameters:**
+
+- `apn`: Access Point Name, required, provided by your operator
+  (e.g. `internet`, `data.vodafone.com`, `web.tele2.se`)
+- `route-preference`: Administrative distance for the default route
+  (default: `200`).  Higher value = lower priority.  The default of 200
+  places cellular behind wired Ethernet (distance 5) and WiFi, so
+  cellular acts as a failover when the wired link is up
+- `roaming`: Allow data when roaming on a foreign network
+  (default: `false`)
+- `ip-type`: `ipv4`, `ipv6`, or `ipv4v6` dual-stack
+  (default: `ipv4v6`)
+
+### 4. Configure Authentication
+
+Most consumer APNs connect without credentials.  If your operator
+requires authentication, first store the password in the keystore, then
+reference it from the bearer.
+
+Create the keystore entry for the APN password:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit keystore symmetric-key apn-pass</b>
+admin@example:/config/keystore/…/apn-pass/> <b>set key-format passphrase-key-format</b>
+admin@example:/config/keystore/…/apn-pass/> <b>change cleartext-symmetric-key</b>
+Passphrase: ************
+Retype passphrase: ************
+admin@example:/config/keystore/…/apn-pass/> <b>leave</b>
+</code></pre>
+
+Then point the bearer's authentication at it:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface wwan0 wwan bearer</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>set authentication username myuser</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>set authentication password apn-pass</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>leave</b>
+</code></pre>
+
+Setting any leaf inside `authentication` creates the container, which
+enables authentication.  The `password` leaf is a reference to a
+symmetric key in the keystore, not the plaintext password itself.
+
+The authentication protocol defaults to `chap`.  To use PAP instead:
+
+<pre class="cli"><code>admin@example:/config/interface/wwan0/wwan/bearer/> <b>set authentication type pap</b>
+</code></pre>
+
+### 5. Configure SIM PIN
+
+If the SIM requires a PIN to unlock, configure it on the SIM hardware
+component:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit hardware component sim0</b>
+admin@example:/config/hardware/component/sim0/> <b>set sim pin 1234</b>
+admin@example:/config/hardware/component/sim0/> <b>leave</b>
+</code></pre>
+
+### 6. Verify Connectivity
+
+Once connected, the `wwan0` interface receives an IP address from the
+carrier and modemd installs the default route:
+
+<pre class="cli"><code>admin@example:/> <b>show interface wwan0</b>
+name                : wwan0
+type                : modem
+index               : 5
+mtu                 : 1500
+operational status  : up
+ip forwarding       : enabled
+physical address    : 12:34:56:78:9a:bc
+ipv4 addresses      : 10.142.87.33/30 (wwan)
+ipv6 addresses      : 2001:db8:1:2::1/64 (wwan)
+in-octets           : 84213
+out-octets          : 31456
+</code></pre>
+
+Check the full modem state including signal quality and registration:
+
+<pre class="cli"><code>admin@example:/> <b>show modem modem0</b>
+<span class="header">MODEM: modem0                                                 </span>
+──────────────────────────────────────────────────────────────
+<span class="title">Hardware Information</span>
+  Manufacturer        : Quectel
+  Model               : EM06-E
+  Firmware Version    : EM06ELAR04A07M4G
+  Serial Number       : 352753090141905
+  IMSI                : 240021234567890
+  ICCID               : 8946020000001234567
+──────────────────────────────────────────────────────────────
+<span class="title">Status</span>
+  State               : connected
+  Power State         : on
+  Signal              : Quality: 72% good  RSSI: -59 dBm  RSRP: -95 dBm  RSRQ: -11.0 dB
+──────────────────────────────────────────────────────────────
+<span class="title">Cellular</span>
+  Registration        : home
+  Service State       : attached
+  Operator            : Tele2
+  Operator ID         : 23002
+  Network Type        : lte
+──────────────────────────────────────────────────────────────
+<span class="title">SIM Card</span>
+  Name                : sim0
+  Slot                : 1
+  Lock State          : unlocked
+  Operator            : Tele2
+</code></pre>
+
+When the modem is in trouble, the same view shows why.  A
+`State: failed` line is followed by `Failed Reason` (e.g.
+`sim-missing`), and the `SIM Card` section's `Lock State` reads
+`not-inserted` or `pin-required` to match.
+
+## Cellular Failover
+
+The default `route-preference` (200) is deliberately higher than the
+distances used by wired Ethernet (udhcpc default: 5) and WiFi.  When a
+wired link is up it takes precedence automatically; cellular becomes
+the active path only if higher-priority routes are withdrawn.
+
+A default route via the bearer is always installed when the bearer
+connects.  To adjust the failover priority between two cellular modems,
+or to prefer cellular over WiFi, set `route-preference` explicitly:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit interface wwan0 wwan bearer</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>set route-preference 100</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>leave</b>
+</code></pre>
+
+Lower `route-preference` = higher priority.
+
+## Roaming
+
+Data roaming is disabled by default.  To allow the modem to connect
+when on a foreign (roaming) network:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit interface wwan0 wwan bearer</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>set roaming true</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>leave</b>
+</code></pre>
+
+> [!IMPORTANT]
+> Enabling roaming may incur significant charges depending on your
+> mobile subscription.  Check with your operator before enabling.
+
+## Management Commands
+
+### Restart Bearer
+
+Disconnect and reconnect all bearers without resetting the modem
+hardware.  Use this after changing APN or authentication settings:
+
+<pre class="cli"><code>admin@example:/> <b>modem restart modem0</b>
+</code></pre>
+
+### Reset Modem
+
+Factory-reset the modem firmware.  This clears all modem-internal
+settings and takes longer than a restart.  Only use it if the modem is
+in a bad state that a bearer restart cannot fix:
+
+<pre class="cli"><code>admin@example:/> <b>modem reset modem0</b>
+</code></pre>
+
+> [!NOTE]
+> Not all modules accept `--reset` from ModemManager.  Quectel EM05,
+> for example, rejects both `--reset` and `--factory-reset`.  The only
+> way to recover from a hung firmware on these is a physical power
+> cycle.  When the modem reports the rejection, modemd logs it once and
+> stops retrying.
+
+### Send SMS
+
+Send an SMS message via the signalling plane.  No active data bearer
+is required; the modem only needs to be registered on the network:
+
+<pre class="cli"><code>admin@example:/> <b>modem sms modem0 +46701234567 "Hello from Infix"</b>
+</code></pre>
+
+> [!NOTE]
+> Some SIM cards have Fixed Dialing Number (FDN) enabled, which
+> restricts outgoing SMS and calls to a pre-configured whitelist.  If
+> `modem sms` fails, check whether FDN is active with `mmcli -m 0` and
+> look for `enabled locks: fixed-dialing` in the output.
+
+## Troubleshooting
+
+**Modem not detected (`show modem` shows no modem entry)**
+
+- Verify the modem is connected and recognized by the kernel: check
+  `dmesg` for `cdc_mbim` or `qmi_wwan` driver messages
+- Confirm `/sys/class/usbmisc/` contains a `cdc-wdm*` entry
+- The modem must be present at boot; hotplug after boot is not
+  supported
+
+**`wwan0` shows as `down` or has no IP address**
+
+- Check `show modem modem0`.  The State should show `registered` or
+  `connected`, not `failed`
+- If the State is `failed`, look at the `Failed Reason` line that
+  immediately follows:
+    - `sim-missing`: the SIM Card section will also show
+      `Lock State: not-inserted`.  Power off the device, insert the
+      SIM, power back on.  A warm reboot is not enough; on most M.2
+      slots the SIM tray stays powered through reboot, so the modem
+      keeps the original not-inserted reading
+    - `unlock-required`: the SIM Card section will show
+      `Lock State: pin-required`.  Configure the PIN with
+      `set hardware component sim0 sim pin <code>`
+    - `sim-wrong` / `sim-error`: the SIM is not compatible or is
+      damaged.  Try a different SIM
+- Verify the APN is correct for your operator
+- Check system logs with `show log` for modemd or ModemManager
+  messages
+
+**`wwan0` interface is a dummy (no data flows, no carrier address)**
+
+- The modem was not enumerated by the kernel before confd applied
+  config
+- Create the modem hardware configuration container (see Step 2),
+  which enables the default 30-second probe-timeout so confd waits for
+  the wwan interface before falling back to a dummy placeholder
+
+**High latency or poor signal**
+
+- Use `show modem modem0` to check signal quality and RSRP
+- Signal below -110 dBm RSRP typically indicates poor coverage
+- Consider repositioning the antenna or the device

doc/wifi.md

@@ -156,6 +156,11 @@ admin@example:/config/hardware/component/radio0/wifi-radio/> <b>leave</b>
 - `channel-width`: AP channel bandwidth.  Supported values are `auto`, `20MHz`,
   `40MHz`, `80MHz`, and `160MHz`.  Wider channels require matching hardware,
   regulatory approval, and are only available on 5GHz/6GHz where supported.
+- `legacy-rates`: Allow legacy 802.11b rates (1, 2, 5.5, 11 Mbps) on 2.4GHz
+  (default: disabled).  Slow 802.11b clients consume excessive airtime and
+  degrade throughput for all stations, so the rates are normally suppressed.
+  Enable only when old 2.4GHz-only IoT devices need them to associate.  No
+  effect on 5GHz/6GHz.
 - `probe-timeout`: Seconds to wait for PHY detection at boot (default: 0).  Set
   to a non-zero value (e.g., 30) for USB WiFi dongles that are slow to
   initialize due to firmware loading
@@ -165,6 +170,69 @@ admin@example:/config/hardware/component/radio0/wifi-radio/> <b>leave</b>
 > constraints and hardware capabilities.  Channel width can now be set
 > explicitly for AP mode, or left at `auto` to let the driver choose.
 
+### Bands and Channels
+
+Each band strikes a different balance between range and capacity.  The
+`country-code` decides which channels are legal in your location; the
+lists below are the common allocations, and your regulatory domain may
+allow fewer.
+
+**2.4 GHz**
+
+Channels 1-13 are available in most of the world, 1-11 in the US and
+Canada, and 14 in Japan (802.11b only).  At 20 MHz only three channels
+avoid overlap: 1, 6, and 11.  A 40 MHz channel takes up most of the
+band, so it is seldom worth using here.
+
+Drawbacks:
+
+- This is the most crowded band.  It is shared with Bluetooth, Zigbee,
+  cordless phones, microwave ovens, and most of the neighboring Wi-Fi.
+- Narrow channels and constant contention hold real throughput well
+  below 5 and 6 GHz.
+- The upside is range: 2.4 GHz reaches further and passes through walls
+  better, which keeps it useful for distant clients and 2.4 GHz-only
+  IoT devices.
+
+**5 GHz**
+
+UNII-1 (channels 36-48) and UNII-3 (149-165) need no radar checks.
+UNII-2 (channels 52-64 and 100-144) shares spectrum with radar and
+requires DFS.  ETSI regions such as the EU do not include UNII-3, so the
+only non-DFS 5 GHz channels there are 36-48.  This band supports 20, 40,
+80, and 160 MHz, so it is the one to use for wide, fast channels.
+
+Drawbacks:
+
+- Shorter range than 2.4 GHz, and a weaker signal through walls and
+  floors.
+- A DFS channel must be monitored for radar for 60 seconds (up to 10
+  minutes near some weather radars) before the AP may transmit, which
+  delays start-up.  If radar appears later, the AP has to leave the
+  channel within 10 seconds and avoid it for 30 minutes, dropping
+  clients during the move.
+- The widest 80 and 160 MHz channels almost always sit on DFS spectrum,
+  so the same radar rules apply to them.
+
+**6 GHz**
+
+The FCC regions open 59 channels (1, 5, 9 ... 233) across 5925-7125 MHz.
+ETSI regions, including the EU, currently open only the lower part,
+5945-6425 MHz (channels 1-93), for indoor use.  Clients find networks on
+the 15 Preferred Scanning Channels (5, 21, 37 ... 229) spaced every
+80 MHz, and `auto` selects channel 37.  There is no DFS in 6 GHz, so
+there is no radar start-up delay.
+
+Drawbacks:
+
+- The shortest range and the weakest wall penetration of the three
+  bands.
+- Only Wi-Fi 6E and newer clients can use it; older phones and IoT
+  devices cannot see the band at all.
+- AP operation requires WPA3-Personal (SAE) with management frame
+  protection, so WPA2-only and open networks are rejected.
+- Indoor power limits cap coverage further.
+
 ### WiFi 6 Support
 
 WiFi 6 (802.11ax) is always enabled in AP mode on all bands, providing improved
@@ -486,20 +554,253 @@ radio settings, and `show interface` to see all active AP interfaces.
 > AP and Station modes cannot be mixed on the same radio. All virtual interfaces
 > on a radio must be the same mode (all APs or all Stations).
 
-### AP as Bridge Port
+## Fast Roaming Between Access Points
 
-WiFi AP interfaces can be added to bridges to integrate wireless devices
-into your LAN:
+Fast roaming enables seamless client handoff between access points through
+802.11k/r/v standards. These features can be enabled individually based on
+your requirements.
+
+### 802.11r - Fast BSS Transition
+
+Enable 802.11r for fast handoff (<50ms) between APs with the same SSID:
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11r
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11r mobility-domain 4f57
+```
+
+**Requirements:**
+- All APs in roaming group must have **identical** SSID
+- All APs must have **identical** passphrase (same keystore secret)
+- All APs must use the **same mobility-domain** identifier
+
+**Mobility Domain Options:**
+- Explicit 4-character hex value (e.g., `4f57`) - default if not specified
+- `hash` - Automatically derive from SSID using MD5 (OpenWrt-compatible)
+
+Using `hash` allows multiple APs with the same SSID to automatically share
+the same mobility domain without manual configuration:
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11r mobility-domain hash
+```
+
+The NAS-Identifier (Network Access Server Identifier) is a string that
+uniquely identifies each AP within the 802.11r mobility domain.  APs
+exchange this identifier during fast BSS transition so they can look up
+the correct PMK-R1 key for the roaming client.  It must be unique per AP
+BSS and stable across reboots.
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11r nas-identifier auto
+```
+
+`auto` derives the identifier as:
+
+`<interface-name>-<hostname>.<mobility-domain>`
+
+Or set an explicit string:
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11r nas-identifier ap01.wifi0.4f57
+```
+
+### 802.11k - Radio Resource Management
+
+Enable 802.11k for client neighbor discovery and better roaming decisions:
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11k
+```
+
+Enables neighbor reports and beacon reports, allowing clients to discover
+nearby APs before roaming.
+
+### 802.11v - BSS Transition Management
+
+Enable 802.11v for network-assisted roaming:
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11v
+```
+
+Allows APs to suggest better APs to clients, improving roaming decisions.
+
+#### Band Steering (MBO)
+
+Enabling `dot11v` also turns on MBO (Multi-Band Operation), advertised in
+beacons and association responses.  MBO lets a dual-band client see that
+the same SSID exists on another band and decide for itself when to move,
+while 802.11v BSS Transition Management lets the AP suggest a better
+target.
+
+On top of the client-cooperative hints, the AP applies active steering:
+on a 2.4 GHz access-point it suppresses probe responses to clients that
+were recently seen on the same SSID on the 5/6 GHz band, nudging
+dual-band clients onto the higher band.  MBO is **enabled by default**
+whenever `dot11v` is enabled:
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11v
+```
+
+To turn it off while keeping BSS Transition Management:
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11v band-steering false
+```
+
+> [!NOTE]
+> Band steering only matters when the same SSID is offered on two or more
+> bands (one access-point per radio).  On a single-band network there is
+> no other band to move to, so it has no effect.
+
+### Opportunistic Key Caching (OKC)
+
+OKC reduces re-authentication time for roaming clients that do not
+support 802.11r.  The AP caches the PMK from previous associations and
+shares it with other APs in the same mobility group.  It is **enabled by
+default** and only activates when both AP and client support it:
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming okc false
+```
+
+### Recommended Configuration
+
+For optimal roaming experience, enable all three features:
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11k
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11r
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11v
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11r mobility-domain 4f57
+```
+
+Or use `hash` for automatic mobility domain derivation from SSID:
+
+```
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11k
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11r
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11v
+admin@example:/config/interface/wifi0/> set wifi access-point roaming dot11r mobility-domain hash
+```
+
+Repeat for all APs that should participate in the roaming group.
+
+> [!NOTE]
+> Not all client devices support all roaming features. Modern devices typically
+> support 802.11k/r/v, but older devices may only support basic roaming without
+> fast transition.
+
+## 802.11s Mesh Point Mode
+
+IEEE 802.11s is a wireless mesh networking standard operating at Layer 2.
+Mesh nodes form peer links directly with each other and route traffic
+using HWMP (Hybrid Wireless Mesh Protocol), which is built into the
+Linux mac80211 subsystem.  There is no central controller; nodes
+discover peers and find paths on their own.
+
+The standard defines two node roles:
+
+- **Mesh Point (MP)** - a basic mesh node that forwards traffic within
+  the mesh
+- **Mesh Portal (MPP)** - a mesh node that bridges traffic between the
+  mesh and an external network (e.g., a wired LAN)
+
+In practice, a node bridging the mesh interface to a LAN acts as a mesh
+portal.
+
+> [!NOTE]
+> Not all WiFi hardware supports 802.11s mesh.  The driver must implement
+> mesh point mode in mac80211.  Check your adapter's capabilities with
+> `iw phy <phy> info` and look for "mesh point" under "Supported interface
+> modes".
+
+### 802.11s vs EasyMesh
+
+|                             | **802.11s**              | **EasyMesh**                   |
+|-----------------------------|--------------------------|--------------------------------|
+| **Standard**                | IEEE (open, ratified)    | Wi-Fi Alliance (certification) |
+| **Topology**                | Peer-to-peer, any-to-any | Controller-based tree          |
+| **Single point of failure** | None                     | Controller                     |
+| **Multi-hop**               | True N-hop               | Limited (1-2 hops)             |
+| **Vendor lock-in**          | None                     | Common                         |
+| **Linux support**           | Kernel-native (mac80211) | Requires proprietary firmware  |
+
+Infix uses 802.11s because it runs entirely in the kernel with no
+proprietary components.
+
+### Mesh configuration
+
+A mesh point requires the radio to have `band`, `channel`, and a valid
+`country-code` configured. Mesh and AP modes cannot coexist on the same
+radio.
+
+**Step 1: Configure the radio**
 
 <pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit interface br0</b>
-admin@example:/config/interface/br0/> <b>set type bridge</b>
-
-admin@example:/config/> <b>edit interface wifi0</b>
-admin@example:/config/interface/wifi0/> <b>set bridge-port bridge br0</b>
-admin@example:/config/interface/wifi0/> <b>leave</b>
+admin@example:/config/> <b>edit hardware component radio1 wifi-radio</b>
+admin@example:/config/hardware/component/radio1/wifi-radio/> <b>set country-code DE</b>
+admin@example:/config/hardware/component/radio1/wifi-radio/> <b>set band 5GHz</b>
+admin@example:/config/hardware/component/radio1/wifi-radio/> <b>set channel 36</b>
+admin@example:/config/hardware/component/radio1/wifi-radio/> <b>leave</b>
 </code></pre>
 
+**Step 2: Create keystore entry for mesh security**
+
+All mesh links use WPA3-SAE encryption. All nodes in the same mesh
+network must share the same passphrase:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit keystore symmetric-key mesh-secret</b>
+admin@example:/config/keystore/…/mesh-secret/> <b>set key-format passphrase-key-format</b>
+admin@example:/config/keystore/…/mesh-secret/> <b>change cleartext-symmetric-key</b>
+Passphrase: ************
+Retype passphrase: ************
+admin@example:/config/keystore/…/mesh-secret/> <b>end</b>
+</code></pre>
+
+**Step 3: Configure the mesh interface**
+
+<pre class="cli"><code>admin@example:/config/> <b>edit interface wifi-mesh</b>
+admin@example:/config/interface/wifi-mesh/> <b>set type wifi</b>
+admin@example:/config/interface/wifi-mesh/> <b>set wifi radio radio1</b>
+admin@example:/config/interface/wifi-mesh/> <b>set wifi mesh-point mesh-id my-mesh</b>
+admin@example:/config/interface/wifi-mesh/> <b>set wifi mesh-point security secret mesh-secret</b>
+admin@example:/config/interface/wifi-mesh/> <b>leave</b>
+</code></pre>
+
+**Mesh parameters:**
+
+- `mesh-id`: Network identifier, 1-32 characters.  All nodes in the mesh
+  must use the same mesh ID
+- `forwarding`: L2 mesh forwarding (default: true).  When enabled, the
+  interface can be added to a bridge as a mesh portal
+- `security secret`: Keystore reference for the WPA3-SAE passphrase
+
+### Mesh portal (bridge integration)
+
+To connect the wireless mesh to a wired LAN, add the mesh interface to
+a bridge:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit interface wifi-mesh</b>
+admin@example:/config/interface/wifi-mesh/> <b>set bridge-port bridge br0</b>
+admin@example:/config/interface/wifi-mesh/> <b>leave</b>
+</code></pre>
+
+### Mesh with roaming APs
+
+You can combine 802.11s mesh backhaul with roaming-enabled access
+points.  Each node has a mesh interface for backhaul on one radio and
+AP interfaces for clients on another:
+
+![802.11s mesh backhaul with roaming-enabled access points](img/wifi-mesh-roaming.svg)
+
+With 802.11r/k/v roaming enabled on the APs (same SSID, same
+passphrase, same mobility domain), clients hand off between nodes while
+the mesh carries backhaul traffic.
+
 ## Troubleshooting
 
 Use `show interface wifi0` to verify signal strength and connection status.

mkdocs.yml

@@ -44,6 +44,7 @@ nav:
           - Overview: vpn.md
           - WireGuard: vpn-wireguard.md
       - Wireless LAN (WiFi): wifi.md
+      - Cellular Modem (wwan): modem.md
   - Services:
       - Device Discovery: discovery.md
       - DHCP Server: dhcp.md

package/Config.in

@@ -2,6 +2,7 @@ menu "Packages"
 
 comment "Hardware Support"
 source "$BR2_EXTERNAL_INFIX_PATH/package/feature-gps/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/feature-modem/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/feature-wifi/Config.in"
 
 comment "Software Packages"
@@ -30,6 +31,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/landing/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/libsrx/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/lowdown/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/mcd/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/modemd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/mdns-alias/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/netbrowse/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/onieprom/Config.in"

package/confd/confd.conf

@@ -1,11 +1,9 @@
-#set DEBUG=1
-
 # Single daemon handles gen-config, datastore init, config load, and plugins
-#  log:prio:daemon.err
-service log:console env:/etc/default/confd           \
+service log:console env:/etc/default/confd        \
 	[S12345] <usr/ixinit> confd -f -v warning \
-		-F /etc/factory-config.cfg \
-		-S /cfg/startup-config.cfg \
-		-E /etc/failure-config.cfg \
-		-t $CONFD_TIMEOUT \
+		-F /etc/factory-config.cfg        \
+		-S /cfg/startup-config.cfg        \
+		-E /etc/failure-config.cfg        \
+		-t $CONFD_TIMEOUT                 \
+		$CONFD_ARGS                       \
 	-- Configuration daemon

package/confd/confd.mk

@@ -91,6 +91,12 @@ define CONFD_INSTALL_YANG_MODULES_GPS
 	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/gps.inc
 endef
 endif
+ifeq ($(BR2_PACKAGE_FEATURE_MODEM),y)
+define CONFD_INSTALL_YANG_MODULES_MODEM
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/modem.inc
+endef
+endif
 
 # PER_PACKAGE_DIR
 # Since the last package in the dependency chain that runs sysrepoctl is confd, we need to
@@ -121,6 +127,7 @@ CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WIFI
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_GPS
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_MODEM
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_IN_ROMFS
 CONFD_TARGET_FINALIZE_HOOKS += CONFD_CLEANUP
 

package/feature-modem/Config.in

@@ -0,0 +1,25 @@
+config BR2_PACKAGE_FEATURE_MODEM
+	bool "Feature Modem"
+	select BR2_PACKAGE_MODEMD
+	select BR2_PACKAGE_MODEM_MANAGER
+	select BR2_PACKAGE_MODEM_MANAGER_ATVIADBUS
+	select BR2_PACKAGE_MODEM_MANAGER_LIBMBIM
+	select BR2_PACKAGE_MODEM_MANAGER_LIBQMI
+	select BR2_PACKAGE_MODEM_MANAGER_LIBQRTR
+	help
+	  Enables cellular modem support in Infix via ModemManager and
+	  the modemd management daemon.  Includes drivers for common
+	  USB option modems and QMI/MBIM-based devices.
+
+	  ATVIADBUS allows raw AT commands over D-Bus (used by modemd to
+	  enable GPS NMEA output via vendor-specific AT commands such as
+	  AT+QGPS=1) without needing to start ModemManager in --debug
+	  mode.
+
+config BR2_PACKAGE_FEATURE_MODEM_QUALCOMM
+	bool "Qualcomm-based modems (QMI/QRTR/MHI)"
+	depends on BR2_PACKAGE_FEATURE_MODEM
+	help
+	  Adds kernel support for Qualcomm-based cellular modems that use
+	  the MHI bus and QRTR IPC router (e.g. Sierra Wireless EM7xxx,
+	  Quectel EM/RMxxx, Telit LN9xx).

package/feature-modem/feature-modem.mk

@@ -0,0 +1,26 @@
+################################################################################
+#
+# Cellular modem support
+#
+################################################################################
+
+FEATURE_MODEM_PACKAGE_VERSION = 1.0
+FEATURE_MODEM_PACKAGE_LICENSE = MIT
+
+define FEATURE_MODEM_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_SERIAL)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_SERIAL_WWAN)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_SERIAL_OPTION)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_WDM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_NET_QMI_WWAN)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_CDC_MBIM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_NET_CDC_MBIM)
+
+	$(if $(filter y,$(BR2_PACKAGE_FEATURE_MODEM_QUALCOMM)),
+		$(call KCONFIG_SET_OPT,CONFIG_QRTR,m)
+		$(call KCONFIG_SET_OPT,CONFIG_MHI_BUS,m)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_QRTR_MHI)
+	)
+endef
+
+$(eval $(generic-package))

package/feature-wifi/Config.in

@@ -5,11 +5,15 @@ config BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_WPA_SUPPLICANT_DEBUG_SYSLOG
 	select BR2_PACKAGE_WPA_SUPPLICANT_AUTOSCAN
 	select BR2_PACKAGE_WPA_SUPPLICANT_CLI
+	select BR2_PACKAGE_WPA_SUPPLICANT_AP_SUPPORT
+	select BR2_PACKAGE_WPA_SUPPLICANT_MESH_NETWORKING
 	select BR2_PACKAGE_WIRELESS_REGDB
         select BR2_PACKAGE_HOSTAPD
         select BR2_PACKAGE_HOSTAPD_DRIVER_NL80211
         select BR2_PACKAGE_HOSTAPD_WPA3
         select BR2_PACKAGE_HOSTAPD_WPS
+        select BR2_PACKAGE_HOSTAPD_WNM
+        select BR2_PACKAGE_HOSTAPD_MBO
 	select BR2_PACKAGE_IW
 	help
 	  Enables WiFi in Infix. Enables all requried applications.

package/feature-wifi/feature-wifi.mk

@@ -69,7 +69,7 @@ define FEATURE_WIFI_LINUX_CONFIG_FIXUPS
 endef
 
 define FEATURE_WIFI_INSTALL_IN_ROMFS
-        mkdir -p $(TARGET_DIR)/etc/modprobe.d $(TARGET_DIR)/etc/udev/rules.d
+        mkdir -p $(TARGET_DIR)/etc/modprobe.d $(TARGET_DIR)/etc/udev/rules.d $(TARGET_DIR)/usr/libexec
         cp $(FEATURE_WIFI_PKGDIR)/mt7915e.conf $(TARGET_DIR)/etc/modprobe.d/mt7915e.conf
         cp $(FEATURE_WIFI_PKGDIR)/60-rename-wifi-phy.rules $(TARGET_DIR)/etc/udev/rules.d/60-rename-wifi-phy.rules
         cp $(FEATURE_WIFI_PKGDIR)/70-remove-virtual-wifi-interfaces.rules $(TARGET_DIR)/etc/udev/rules.d/70-remove-virtual-wifi-interfaces.rules

package/modemd/Config.in

@@ -0,0 +1,6 @@
+config BR2_PACKAGE_MODEMD
+	bool "modemd"
+	select BR2_PACKAGE_MODEM_MANAGER
+	select BR2_PACKAGE_PYTHON3
+	help
+	  Daemon which manages modems.

package/modemd/modemd.hash

@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  25b33026a661c4c550374cfcba6890a4363bf19db0c1c31a6e65b5edd113ecf0  LICENSE

package/modemd/modemd.mk

@@ -0,0 +1,56 @@
+################################################################################
+#
+# modemd
+#
+################################################################################
+
+MODEMD_VERSION = 1.0
+MODEMD_SITE_METHOD = local
+MODEMD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/modemd
+MODEMD_LICENSE = BSD-3-Clause
+MODEMD_LICENSE_FILES = LICENSE
+MODEMD_REDISTRIBUTE = NO
+MODEMD_DEPENDENCIES = modem-manager jansson python3 \
+	host-python3 host-python-pypa-build host-python-installer \
+	host-python-poetry-core
+
+define MODEMD_BUILD_CMDS
+    $(TARGET_CC) $(TARGET_CFLAGS) $(TARGET_LDFLAGS) \
+        $(MODEMD_DIR)/modem-command.c -o $(MODEMD_DIR)/modem-command -ljansson
+endef
+
+define MODEMD_BUILD_PYTHON
+	cd $(MODEMD_SITE) && \
+		$(PKG_PYTHON_PEP517_ENV) $(HOST_DIR)/bin/python3 $(PKG_PYTHON_PEP517_BUILD_CMD) -o $(@D)/dist
+	mkdir -p $(TARGET_DIR)/usr/libexec/modemd
+	rm -f $(TARGET_DIR)/usr/libexec/modemd/modemd \
+		$(TARGET_DIR)/usr/libexec/modemd/modem-* \
+		$(TARGET_DIR)/usr/libexec/modemd/sim-setup
+	cd $(@D) && \
+		$(HOST_DIR)/bin/python3 $(TOPDIR)/support/scripts/pyinstaller.py \
+			dist/*.whl \
+			--interpreter=/usr/bin/python3 \
+			--script-kind=posix \
+			--purelib=$(TARGET_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages \
+			--headers=$(TARGET_DIR)/usr/include/python$(PYTHON3_VERSION_MAJOR) \
+			--scripts=$(TARGET_DIR)/usr/libexec/modemd \
+			--data=$(TARGET_DIR)
+endef
+MODEMD_POST_INSTALL_TARGET_HOOKS += MODEMD_BUILD_PYTHON
+
+define MODEMD_INSTALL_TARGET_CMDS
+	mkdir -p $(TARGET_DIR)/usr/libexec/modemd
+	mkdir -p $(TARGET_DIR)/lib/udev/rules.d
+	mkdir -p $(FINIT_D)/available/
+	mkdir -p $(TARGET_DIR)/sbin
+	$(INSTALL) -D -m 0644 $(MODEMD_DIR)/finit.conf $(FINIT_D)/available/modemd.conf
+	install -m 644 $(MODEMD_DIR)/modemd.rules $(TARGET_DIR)/lib/udev/rules.d/90-modemd.rules
+	install -m 644 $(MODEMD_DIR)/qmi-wwan-ids.rules $(TARGET_DIR)/lib/udev/rules.d/91-qmi-wwan-ids.rules
+	install -m 644 $(MODEMD_DIR)/77-mm-dell-port-types.rules $(TARGET_DIR)/etc/udev/rules.d/77-mm-dell-port-types.rules
+	install -m 644 $(MODEMD_DIR)/77-mm-modem-gps.rules $(TARGET_DIR)/etc/udev/rules.d/77-mm-modem-gps.rules
+	install -D -m 644 $(MODEMD_DIR)/modemd.modules-load $(TARGET_DIR)/etc/modules-load.d/modemd.conf
+	install -m 755 $(MODEMD_DIR)/modem-command $(TARGET_DIR)/sbin/modem-command
+	ln -sf /usr/libexec/modemd/modemd $(TARGET_DIR)/sbin/modemd
+endef
+
+$(eval $(generic-package))

package/skeleton-init-finit/skeleton/etc/finit.d/available/modem-manager.conf

@@ -0,0 +1 @@
+service [2345789] ModemManager -- ModemManager daemon

patches/firewalld/2.3.1/0003-fix-functions-do-not-touch-global-ip_forward-sysctl.patch

@@ -0,0 +1,54 @@
+From 9899169d6dcb07aaecdde09c77ef59b56f66e3e5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= <lazzer@gmail.com>
+Date: Fri, 5 Jun 2026 09:10:15 +0200
+Subject: [PATCH 3/3] fix(functions): do not touch global ip_forward sysctl
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Organization: Wires
+
+Infix manages IPv4/IPv6 forwarding per-interface via the sysctls
+net.ipv4.conf.<iface>.forwarding and net.ipv6.conf.<iface>.forwarding.
+firewalld's enable_ip_forwarding() instead writes the *global*
+net.ipv4.ip_forward and net.ipv6.conf.all.forwarding knobs.  The kernel
+propagates those global values to every interface, which clobbers the
+per-interface forwarding configuration Infix sets.
+
+Make enable_ip_forwarding() a no-op.  The backends still install the
+masquerade and forward-port nftables rules; the per-packet forwarding
+decision is governed by the inbound interface's forwarding flag, so
+routing keeps working on the interfaces where Infix enabled it while
+the global knob is left untouched.
+
+Signed-off-by: Mattias Walström <lazzer@gmail.com>
+---
+ src/firewall/functions.py | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/src/firewall/functions.py b/src/firewall/functions.py
+index 1b8a32c..cd87f5d 100644
+--- a/src/firewall/functions.py
++++ b/src/firewall/functions.py
+@@ -495,11 +495,14 @@ def writefile(filename, line):
+ 
+ 
+ def enable_ip_forwarding(ipv):
+-    if ipv == "ipv4":
+-        return writefile("/proc/sys/net/ipv4/ip_forward", "1\n")
+-    elif ipv == "ipv6":
+-        return writefile("/proc/sys/net/ipv6/conf/all/forwarding", "1\n")
+-    return False
++    # Infix manages IP forwarding per-interface via the sysctls
++    # net.ipv4.conf.<iface>.forwarding and net.ipv6.conf.<iface>.forwarding.
++    # Writing the global net.ipv4.ip_forward / net.ipv6.conf.all.forwarding
++    # knobs would clobber those per-interface settings, since the kernel
++    # propagates the global value to every interface.  Make this a no-op:
++    # firewalld still installs the masquerade and forward-port nft rules, and
++    # forwarding works on the interfaces where Infix has enabled it.
++    return True
+ 
+ 
+ def get_nf_conntrack_short_name(module):
+-- 
+2.43.0
+

patches/hostapd/0003-more-limit-bssid-mask.patch

@@ -0,0 +1,17 @@
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 72a0bf503..9bdc2b41d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -916,12 +916,6 @@ static int hostapd_validate_bssid_configuration(struct hostapd_iface *iface)
+ 	if (bits < j)
+ 		bits = j;
+ 
+-	if (bits > 40) {
+-		wpa_printf(MSG_ERROR, "Too many bits in the BSSID mask (%u)",
+-			   bits);
+-		return -1;
+-	}
+-
+ 	os_memset(mask, 0xff, ETH_ALEN);
+ 	j = bits / 8;
+ 	for (i = 5; i > 5 - j; i--)

patches/libqmi/0001-Ignore-sysfs-for-download-mode.patch

@@ -0,0 +1,21 @@
+diff --git a/src/qmi-firmware-update/qfu-helpers-udev.c b/src/qmi-firmware-update/qfu-helpers-udev.c
+index bda9106..40d648f 100644
+--- a/src/qmi-firmware-update/qfu-helpers-udev.c
++++ b/src/qmi-firmware-update/qfu-helpers-udev.c
+@@ -364,8 +364,14 @@ device_matches (GUdevDevice          *device,
+     if (!device_sysfs_path)
+         goto out;
+ 
+-    if (g_strcmp0 (device_sysfs_path, sysfs_path) != 0)
+-        goto out;
++    /*
++     * don't compare sysfs path for download mode as it
++     * changes from USB4 to USB3 and thus may use a different host controller
++     */
++    if (mode != QFU_HELPERS_DEVICE_MODE_DOWNLOAD) {
++        if (g_strcmp0 (device_sysfs_path, sysfs_path) != 0)
++            goto out;
++    }
+ 
+     if (device_mode != mode)
+         return NULL;

patches/linux/6.18.34/0001-net-phy-marvell10g-Support-firmware-loading-on-88X33.patch

@@ -1,4 +1,4 @@
-From 2fe4584b70875e1624053f90cecfff25d55925ea Mon Sep 17 00:00:00 2001
+From 2b86219131c6bed9658c75334e0b2748d4b68c04 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 01/50] net: phy: marvell10g: Support firmware loading on

patches/linux/6.18.34/0002-net-phy-marvell10g-Fix-power-up-when-strapped-to-sta.patch

@@ -1,4 +1,4 @@
-From 7a8bc364e2a1fe55aef7eb189405a799f69bc848 Mon Sep 17 00:00:00 2001
+From 9eb5c192c3c76f9141b344d3bbbc954a0e4be50e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 02/50] net: phy: marvell10g: Fix power-up when strapped to

patches/linux/6.18.34/0003-net-phy-marvell10g-Add-LED-support-for-88X3310.patch

@@ -1,4 +1,4 @@
-From 6d4aa58ed9394b0b842e89fb4f7e080491e75bed Mon Sep 17 00:00:00 2001
+From c08724121dc4d08ac783333a2ac38178649c918c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 03/50] net: phy: marvell10g: Add LED support for 88X3310

patches/linux/6.18.34/0004-net-phy-marvell10g-Support-LEDs-tied-to-a-single-med.patch

@@ -1,4 +1,4 @@
-From deb7af02b1600f51052bca3d7f566019966062aa Mon Sep 17 00:00:00 2001
+From cd914eb2ac2b86240294108f4d4ab18b0bfbb44b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 04/50] net: phy: marvell10g: Support LEDs tied to a single

patches/linux/6.18.34/0005-net-phy-Do-not-resume-PHY-when-attaching.patch

@@ -1,4 +1,4 @@
-From 0777c7502a8c98c1f0987a58019ec43d230768eb Mon Sep 17 00:00:00 2001
+From 25d84725be05967330bbeaac957fade38e338e40 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 05/50] net: phy: Do not resume PHY when attaching
@@ -19,7 +19,7 @@ administratively down.
  1 file changed, 1 deletion(-)
 
 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index dea8b94286d1..f8c376c26fac 100644
+index 78cf05a17f8f..ddf47a586a5a 100644
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
 @@ -1750,7 +1750,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,

patches/linux/6.18.34/0006-net-bridge-avoid-classifying-unknown-multicast-as-mr.patch

@@ -1,4 +1,4 @@
-From 7e47e0fdb4b1d95f58e75d3ee1fd52d2d64866c9 Mon Sep 17 00:00:00 2001
+From cb1dbb66184b3a07f8da93d8a52a56e77d97b98f Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 06/50] net: bridge: avoid classifying unknown multicast as
@@ -170,7 +170,7 @@ index 2cbae0f9ae1f..0c539bf4bebe 100644
  			br_multicast_flood(mdst, skb, brmctx, local_rcv, false);
  	}
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 5855eb050208..06641afb99a8 100644
+index b77b3250afbd..f27cb9b54211 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
 @@ -3836,6 +3836,11 @@ static void br_multicast_err_count(const struct net_bridge *br,

patches/linux/6.18.34/0007-net-bridge-Ignore-router-ports-when-forwarding-L2-mu.patch

@@ -1,4 +1,4 @@
-From 099962fe582c35da76fee0b88ac0051050270e66 Mon Sep 17 00:00:00 2001
+From 66e1ca5038625bc0feb132edf07953b2e6c350da Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 07/50] net: bridge: Ignore router ports when forwarding L2

patches/linux/6.18.34/0008-net-bridge-drop-delay-for-applying-strict-multicast-.patch

@@ -1,4 +1,4 @@
-From 003a394f39682faabb14d968a32504306a5a97b5 Mon Sep 17 00:00:00 2001
+From 31bfb62384ef4b09238f93db137547d0d6d63663 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 08/50] net: bridge: drop delay for applying strict multicast
@@ -24,7 +24,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
  2 files changed, 8 insertions(+), 38 deletions(-)
 
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 06641afb99a8..bacff6c2e968 100644
+index f27cb9b54211..bfb38b18c1da 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
 @@ -1760,10 +1760,6 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t)
@@ -133,7 +133,7 @@ index 06641afb99a8..bacff6c2e968 100644
  	timer_delete_sync(&brmctx->ip6_own_query.timer);
  #endif
  }
-@@ -4726,8 +4710,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
+@@ -4747,8 +4731,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
  
  int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
  {
@@ -142,7 +142,7 @@ index 06641afb99a8..bacff6c2e968 100644
  	val = !!val;
  
  	spin_lock_bh(&brmctx->br->multicast_lock);
-@@ -4738,19 +4720,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
+@@ -4759,19 +4741,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
  	if (!val)
  		goto unlock;
  

patches/linux/6.18.34/0009-net-bridge-Differentiate-MDB-additions-from-modifica.patch

@@ -1,4 +1,4 @@
-From 2d870ee42b147399d95dee79144195919dabb2fe Mon Sep 17 00:00:00 2001
+From c16b809eb7ef941870dcfb6ecceab83570fcd223 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 09/50] net: bridge: Differentiate MDB additions from
@@ -62,7 +62,7 @@ index 400eb872b403..cd7a2cd0911a 100644
  	if (br_multicast_should_handle_mode(brmctx, cfg->group.proto))
  		br_multicast_star_g_handle_mode(pg, cfg->filter_mode);
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index bacff6c2e968..a5f3e4935edc 100644
+index bfb38b18c1da..cc7ce7fc6580 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
 @@ -616,7 +616,7 @@ static void br_multicast_fwd_src_handle(struct net_bridge_group_src *src)

patches/linux/6.18.34/0010-nvmem-layouts-onie-tlv-Let-device-probe-even-when-TL.patch

@@ -1,4 +1,4 @@
-From 763289c999ed2b0a9ecdb417b32c9d5a2f6b104a Mon Sep 17 00:00:00 2001
+From 4ba33d783110e4559b5abfcfd8c095f0e71befc5 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 10/50] nvmem: layouts: onie-tlv: Let device probe even when

patches/linux/6.18.34/0011-net-usb-r8152-add-r8153b-support-for-link-activity-L.patch

@@ -1,4 +1,4 @@
-From 7e779610739e75b5d1e3b66bc8b0aa0c8ad68c9f Mon Sep 17 00:00:00 2001
+From f19c6a56de0743c906cbef917bc201d0c5a74c99 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 11/50] net: usb: r8152: add r8153b support for link/activity

patches/linux/6.18.34/0012-arm64-dts-mediatek-mt7986a-rename-BPi-R3-ports-to-ma.patch

@@ -1,4 +1,4 @@
-From fe101bb64d6f6c558c679630733d76bdf4ab3b5f Mon Sep 17 00:00:00 2001
+From daed6dc750e19a316a1a3db62df42ca31f830bd9 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 10 Aug 2025 18:52:54 +0200
 Subject: [PATCH 12/50] arm64: dts: mediatek: mt7986a: rename BPi R3 ports to

patches/linux/6.18.34/0013-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch

@@ -1,4 +1,4 @@
-From 672339f6b4a1b8849cf96fe9b6150bd6a49b15b4 Mon Sep 17 00:00:00 2001
+From 42a6936aeb6ed136f7ce7524551307d6eecb3d95 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 20 Aug 2025 21:38:24 +0200
 Subject: [PATCH 13/50] drm/panel-simple: Add a timing for the Raspberry Pi 7"

patches/linux/6.18.34/0014-input-touchscreen-edt-ft5x06-Add-polled-mode.patch

@@ -1,4 +1,4 @@
-From 9ece9e9fc5269cfadeb53d6e8cafc124217f606f Mon Sep 17 00:00:00 2001
+From c83feafa1899f66855f13b8a5c63a3f04b037686 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 21 Aug 2025 11:20:23 +0200
 Subject: [PATCH 14/50] input:touchscreen:edt-ft5x06: Add polled mode

patches/linux/6.18.34/0015-FIX-net-dsa-mv88e6xxx-Fix-timeout-on-waiting-for-PPU.patch

@@ -1,4 +1,4 @@
-From 3eecd843969fec2c1532c32b39f5e81bb51425b3 Mon Sep 17 00:00:00 2001
+From cb3652859a4c5f0ffad4b4cae5d112370829f9ad Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 15/50] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for

patches/linux/6.18.34/0016-net-dsa-mv88e6xxx-Improve-indirect-register-access-p.patch

@@ -1,4 +1,4 @@
-From 861654c5d7ce2180cc633517221eac516988c813 Mon Sep 17 00:00:00 2001
+From abe555c35cf1f2c35f0b9b05917abb5f5470564e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 16/50] net: dsa: mv88e6xxx: Improve indirect register access

patches/linux/6.18.34/0017-net-dsa-mv88e6xxx-Honor-ports-being-managed-via-in-b.patch

@@ -1,4 +1,4 @@
-From 6b84a1215d87bd03432ed6b79bd55e08d84e5125 Mon Sep 17 00:00:00 2001
+From 1e0374357606ce86a7fad14d3eedbf650cab2f31 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 17/50] net: dsa: mv88e6xxx: Honor ports being managed via

patches/linux/6.18.34/0018-net-dsa-mv88e6xxx-Limit-rsvd2cpu-policy-to-user-port.patch

@@ -1,4 +1,4 @@
-From aaa6dce534b6c509f8e36055660bd670d2bc2758 Mon Sep 17 00:00:00 2001
+From f3a986c8529106e426b0fb5ecafdb0a852a0f344 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 18/50] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user

patches/linux/6.18.34/0019-net-dsa-tag_dsa-Use-tag-priority-as-initial-skb-prio.patch

@@ -1,4 +1,4 @@
-From f00c52f509a093dc503d14854cc8ae4ae2b5be11 Mon Sep 17 00:00:00 2001
+From 8eaf45f3a3c527db200164eb44a234a33bea0024 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 19/50] net: dsa: tag_dsa: Use tag priority as initial

patches/linux/6.18.34/0020-net-dsa-Support-MDB-memberships-whose-L2-addresses-o.patch

@@ -1,4 +1,4 @@
-From 64c5a7544da9777934ff971ec4b3c46e97e653ae Mon Sep 17 00:00:00 2001
+From 01af01f03f4bbaeead33d32f5f8b340a02aca16c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 20/50] net: dsa: Support MDB memberships whose L2 addresses

patches/linux/6.18.34/0021-net-dsa-Support-EtherType-based-priority-overrides.patch

@@ -1,4 +1,4 @@
-From 6d9c872aafa7ec5a330778c82af2dde46e0959b1 Mon Sep 17 00:00:00 2001
+From ee554d75ddc33549f25c132f394ce346dc661cf9 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 21/50] net: dsa: Support EtherType based priority overrides

patches/linux/6.18.34/0022-net-dsa-mv88e6xxx-Support-EtherType-based-priority-o.patch

@@ -1,4 +1,4 @@
-From ff0b28ef9545851cf670d2786e71db7868fb310f Mon Sep 17 00:00:00 2001
+From f98cab13a16a82fe236ce37c2c82a18e4a23b09e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 22/50] net: dsa: mv88e6xxx: Support EtherType based priority

patches/linux/6.18.34/0023-net-dsa-mv88e6xxx-Add-mqprio-qdisc-support.patch

@@ -1,4 +1,4 @@
-From d92fe419bd632fcd07254b95a11f5a2ada340555 Mon Sep 17 00:00:00 2001
+From 638afa80161cc8f42ba8836c05a707fe648eca80 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 23/50] net: dsa: mv88e6xxx: Add mqprio qdisc support

patches/linux/6.18.34/0024-net-dsa-mv88e6xxx-Use-VLAN-prio-over-IP-when-both-ar.patch

@@ -1,4 +1,4 @@
-From 71ad38fb7f6bde1dedc16f1939ce2d224feb7e60 Mon Sep 17 00:00:00 2001
+From 25b86dcdf614b83ffdb105d401fffcc81c4a9a8c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 24/50] net: dsa: mv88e6xxx: Use VLAN prio over IP when both

patches/linux/6.18.34/0025-FIX-net-dsa-mv88e6xxx-Trap-locally-terminated-VLANs.patch

@@ -1,4 +1,4 @@
-From dd65f95bbbe1897452ddb520699a0c758f0a495c Mon Sep 17 00:00:00 2001
+From 3e66363612ee2fe156f645df9b2755a12ff3bbb9 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 25/50] [FIX] net: dsa: mv88e6xxx: Trap locally terminated

patches/linux/6.18.34/0026-net-dsa-mv88e6xxx-collapse-disabled-state-into-block.patch

@@ -1,4 +1,4 @@
-From 79f68061eb996858459b131ffed45e3abeaf37df Mon Sep 17 00:00:00 2001
+From 0eb8674921110e40d540fec2f66862bb7a377d9a Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 16 Jan 2025 12:35:12 +0100
 Subject: [PATCH 26/50] net: dsa: mv88e6xxx: collapse disabled state into

patches/linux/6.18.34/0027-net-dsa-mv88e6xxx-Only-activate-LAG-offloading-when-.patch

@@ -1,4 +1,4 @@
-From baeccc8d6402fca534a9706e1343e35bd04eb505 Mon Sep 17 00:00:00 2001
+From 107a289d4867d42b9ac8d780707e2492a6eec415 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 12 Feb 2025 22:03:14 +0100
 Subject: [PATCH 27/50] net: dsa: mv88e6xxx: Only activate LAG offloading when

patches/linux/6.18.34/0028-net-dsa-mv88e6xxx-Add-LED-support-for-6393X.patch

@@ -1,4 +1,4 @@
-From e1f1e6e36c398652f5bf121f4ae4c5b0c5af3e8a Mon Sep 17 00:00:00 2001
+From 12f57474f41cbf2ff076fcbcb218b6fdf6ae95a1 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 14 Jan 2026 18:22:41 +0100
 Subject: [PATCH 28/50] net: dsa: mv88e6xxx: Add LED support for 6393X

patches/linux/6.18.34/0029-wifi-brcmfmac-support-deletion-and-recreation-of-pri.patch

@@ -1,4 +1,4 @@
-From 787b93706592b82184bb5d2cf38ebd6ebc33068c Mon Sep 17 00:00:00 2001
+From 81798fe8ca0fdd8f45b110abc47caa5c42f7b383 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 15 Jan 2026 22:47:37 +0100
 Subject: [PATCH 29/50] wifi: brcmfmac: support deletion and recreation of

patches/linux/6.18.34/0030-wifi-brcmfmac-check-connection-state-before-querying.patch

@@ -1,4 +1,4 @@
-From 362d691d8554b1deb7973d622cb5e264422c71d0 Mon Sep 17 00:00:00 2001
+From 78f0ed92b27420a7c4ac639b39ac84c8106744d4 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Mon, 19 Jan 2026 13:06:53 +0100
 Subject: [PATCH 30/50] wifi: brcmfmac: check connection state before querying

patches/linux/6.18.34/0031-wifi-brcmfmac-suppress-log-spam-for-regulatory-restr.patch

@@ -1,4 +1,4 @@
-From 68421f2b9eb236a92faf983869513384c2f710d2 Mon Sep 17 00:00:00 2001
+From 8517f96105f0bad1fb74640fc5dc9a5d6bc161f3 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Tue, 20 Jan 2026 20:12:10 +0100
 Subject: [PATCH 31/50] wifi: brcmfmac: suppress log spam for

patches/linux/6.18.34/0032-wifi-brcmfmac-reduce-log-noise-during-AP-to-station-.patch

@@ -1,4 +1,4 @@
-From d56be4ebfa036e2947c83b72a409deaa6cc19cf6 Mon Sep 17 00:00:00 2001
+From 185b4ae0e255c1d4b46c4be50170a927b741c4fe Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Tue, 20 Jan 2026 20:18:45 +0100
 Subject: [PATCH 32/50] wifi: brcmfmac: reduce log noise during AP to station

patches/linux/6.18.34/0033-net-phy-air_en8811h-add-OF-device-table-for-auto-loa.patch

@@ -1,4 +1,4 @@
-From 7748aa9623b1118451faa821a7e10fedda62d1a0 Mon Sep 17 00:00:00 2001
+From a80f482d3b7809a69d244846a90e83609bb38cde Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Tue, 17 Feb 2026 21:59:59 +0100
 Subject: [PATCH 33/50] net: phy: air_en8811h: add OF device table for

patches/linux/6.18.34/0034-drm-vc4-dsi-enable-video-and-then-retry-failed-trans.patch

@@ -1,4 +1,4 @@
-From 90cf1591f68e8008679418a20605a784d90f1d8a Mon Sep 17 00:00:00 2001
+From 7a89babfeaf4b9e17053b38b675fc7c25af2d3cb Mon Sep 17 00:00:00 2001
 From: Dave Stevenson <dave.stevenson@raspberrypi.com>
 Date: Fri, 20 Sep 2024 12:05:18 +0100
 Subject: [PATCH 34/50] drm: vc4: dsi: enable video and then retry failed

patches/linux/6.18.34/0035-drm-vc4-dsi-Clocks-should-be-running-before-reset.patch

@@ -1,4 +1,4 @@
-From 2d326923d4009abd4966ca037f471b223ff7e415 Mon Sep 17 00:00:00 2001
+From 59817df77fa2ee3190886e21e0dfe5d00d4cbf82 Mon Sep 17 00:00:00 2001
 From: Dave Stevenson <dave.stevenson@raspberrypi.com>
 Date: Wed, 8 Jun 2022 17:23:47 +0100
 Subject: [PATCH 35/50] drm: vc4: dsi: Clocks should be running before reset

patches/linux/6.18.34/0036-drm-vc4-Ensure-DSI-is-enabled-for-FIFO-resets.patch

@@ -1,4 +1,4 @@
-From 9d757c815316dd31c4e1507907d0d455e0681a94 Mon Sep 17 00:00:00 2001
+From faa29209c79497337bfc5fa00bd9047ab19c45a2 Mon Sep 17 00:00:00 2001
 From: Dave Stevenson <dave.stevenson@raspberrypi.com>
 Date: Fri, 5 Apr 2024 17:51:55 +0100
 Subject: [PATCH 36/50] drm/vc4: Ensure DSI is enabled for FIFO resets

patches/linux/6.18.34/0037-drm-vc4-Reset-DSI-AFE-on-disable.patch

@@ -1,4 +1,4 @@
-From e080c511038635989631ac5cdb17ec279d622560 Mon Sep 17 00:00:00 2001
+From acfd9da7be673c601216263859ac6fae9667ecd1 Mon Sep 17 00:00:00 2001
 From: Dave Stevenson <dave.stevenson@raspberrypi.com>
 Date: Thu, 26 May 2022 18:56:19 +0100
 Subject: [PATCH 37/50] drm: vc4: Reset DSI AFE on disable

patches/linux/6.18.34/0038-drm-vc4-dsi-Handle-the-different-command-FIFO-widths.patch

@@ -1,4 +1,4 @@
-From 5f90b134d655db7ba304f474c0bea07f0d70b210 Mon Sep 17 00:00:00 2001
+From 69006a9bd14ff43a2e7fd954576e717b7e849cb3 Mon Sep 17 00:00:00 2001
 From: Dave Stevenson <dave.stevenson@raspberrypi.com>
 Date: Wed, 20 Nov 2024 13:58:08 +0000
 Subject: [PATCH 38/50] drm: vc4: dsi: Handle the different command FIFO widths

patches/linux/6.18.34/0039-drm-bridge-tc358762-Program-the-DPI-mode-into-the-ch.patch

@@ -1,4 +1,4 @@
-From 4b540455f16b7534ba4315e7ed0f24ef28c54a12 Mon Sep 17 00:00:00 2001
+From 5b8e2b8009eba95697784f99fed93bd9704bc8b0 Mon Sep 17 00:00:00 2001
 From: Dave Stevenson <dave.stevenson@raspberrypi.com>
 Date: Tue, 9 Jan 2024 17:37:00 +0000
 Subject: [PATCH 39/50] drm/bridge: tc358762: Program the DPI mode into the

patches/linux/6.18.34/0040-drm-bridge-tc358762-revert-move-ops-to-enable.patch

@@ -1,4 +1,4 @@
-From 43486d84870b3c17e7cbfcc657d4f1c212b965df Mon Sep 17 00:00:00 2001
+From 66a72dd6f3b5e7a612472e8ba15ee1647a247dac Mon Sep 17 00:00:00 2001
 From: Dave Stevenson <dave.stevenson@raspberrypi.com>
 Date: Tue, 9 Jan 2024 18:44:49 +0000
 Subject: [PATCH 40/50] drm/bridge: tc358762: revert move ops to enable

patches/linux/6.18.34/0041-drm-bridge-tc358762-Set-pre_enabled-on-pre_enable-to.patch

@@ -1,4 +1,4 @@
-From d884542501e5aca327dd899aa07ee4a8db671378 Mon Sep 17 00:00:00 2001
+From 817f4985552b29fbc4719df29d9490246884c90b Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Sat, 4 Apr 2026 18:04:19 +0200
 Subject: [PATCH 41/50] drm/bridge: tc358762: Set pre_enabled on pre_enable to

patches/linux/6.18.34/0042-net-pcs-add-standalone-PCS-registration-infrastructu.patch

@@ -1,4 +1,4 @@
-From 65babbd17fdf8a4f9a39dee4495e47e8d99b4fb3 Mon Sep 17 00:00:00 2001
+From b4a9446549eff73971b2ec62cc67cb5deb238b8e Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 5 Apr 2026 11:33:00 +0200
 Subject: [PATCH 42/50] net/pcs: add standalone PCS registration infrastructure

patches/linux/6.18.34/0043-net-pcs-add-MediaTek-MT7988-USXGMII-PCS-driver.patch

@@ -1,4 +1,4 @@
-From 6b81b7a7a5a88a6cb59bb1f1864c3301e6d7328e Mon Sep 17 00:00:00 2001
+From d91934120c59819f386276c2ae0198ef9b7d6146 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 6 Apr 2026 14:14:23 +0200
 Subject: [PATCH 43/50] net/pcs: add MediaTek MT7988 USXGMII PCS driver

patches/linux/6.18.34/0044-net-ethernet-mediatek-add-USXGMII-support-for-MT7988.patch

@@ -1,4 +1,4 @@
-From 744074b3c1fc86e346e5f4246c3530ea834d9e69 Mon Sep 17 00:00:00 2001
+From c0223db92587d9c9a32a59c7a8d13cbf3cdafb41 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 6 Apr 2026 14:15:43 +0200
 Subject: [PATCH 44/50] net: ethernet: mediatek: add USXGMII support for MT7988

patches/linux/6.18.34/0045-arm64-dts-mediatek-mt7988a-add-USXGMII-PCS-nodes.patch

@@ -1,4 +1,4 @@
-From 04a740b0daa21c8c62d067a2e62d187d3f103c6d Mon Sep 17 00:00:00 2001
+From aa80e887aa598322476c3659107689e84c929f7f Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 6 Apr 2026 14:15:56 +0200
 Subject: [PATCH 45/50] arm64: dts: mediatek: mt7988a: add USXGMII PCS nodes

patches/linux/6.18.34/0046-arm64-dts-mediatek-bananapi-bpi-r4-enable-SFP-ports-.patch

@@ -1,4 +1,4 @@
-From 34b430d91c7dbb2a7ec8e217bb32d72e43b2f105 Mon Sep 17 00:00:00 2001
+From 3bd699ab24b9fa4022ec573c2b62a0145264b72c Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 6 Apr 2026 14:16:11 +0200
 Subject: [PATCH 46/50] arm64: dts: mediatek: bananapi-bpi-r4: enable SFP+

patches/linux/6.18.34/0047-net-phy-sfp-add-OEM-SFP-10G-T-I-quirk.patch

@@ -1,4 +1,4 @@
-From ec2568715d3197879ebb47facab73a88a240880d Mon Sep 17 00:00:00 2001
+From ec62bb8dc231ffc6b43b9789811640288ff0837a Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 7 Apr 2026 07:34:52 +0200
 Subject: [PATCH 47/50] net: phy: sfp: add OEM SFP-10G-T-I quirk

patches/linux/6.18.34/0048-net-dsa-mv88e6xxx-Trap-PTP-frames-on-timestamping-po.patch

@@ -1,4 +1,4 @@
-From be296df15c04d30920c957787d54a052f9ca4646 Mon Sep 17 00:00:00 2001
+From 45c4be49a1faefedf6410bcf40530dd0fe20c5b8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 17 Apr 2026 09:13:04 +0000
 Subject: [PATCH 48/50] net: dsa: mv88e6xxx: Trap PTP frames on timestamping

patches/linux/6.18.34/0049-wifi-mt76-mt7615-add-MODULE_DEVICE_TABLE-for-mt7622-.patch

@@ -1,4 +1,4 @@
-From 45d014b26d561e7269b29a0acd82e429a5f67707 Mon Sep 17 00:00:00 2001
+From 56a7c45fd3ccedd31e64eb610f109dbc316c4b3e Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 28 Apr 2026 15:30:01 +0200
 Subject: [PATCH 49/50] wifi: mt76: mt7615: add MODULE_DEVICE_TABLE for mt7622

patches/linux/6.18.34/0050-PCI-mediatek-gen3-Fix-PERST-control-timing-during-sy.patch

@@ -1,4 +1,4 @@
-From 5d94f9f38b3c554581830e070a58536845c47a6a Mon Sep 17 00:00:00 2001
+From b80a89be72f654c0d14709acf20a614fb792a4b9 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 22 Apr 2026 10:24:43 +0200
 Subject: [PATCH 50/50] PCI: mediatek-gen3: Fix PERST# control timing during

patches/linux/linux.hash

@@ -1,2 +1,2 @@
 # Calculated with utils/kernel-refresh.sh
-sha256   6f16ff302599f6fe34742890322cf0775703105fbd8767449682fca6af0fb782  linux-6.18.33.tar.xz
+sha256   640c4732fb42842166db97e032c1fe7e5ff72c85a8982c75b40f74be3555d760  linux-6.18.34.tar.xz

patches/modem-manager/0000-udevdir.patch

@@ -0,0 +1,13 @@
+diff --git a/meson.build b/meson.build
+index 8cddf77..e97f862 100644
+--- a/meson.build
++++ b/meson.build
+@@ -188,7 +188,7 @@ endif
+ config_h.set('WITH_UDEV', enable_udev)
+
+ # udev base directory (required to install rules even when udev support is disabled)
+-udev_udevdir = get_option('udevdir')
++udev_udevdir = '/lib/udev'
+ if udev_udevdir == ''
+   assert(enable_udev, 'udevdir must be explicitly given if udev support is disabled')
+   udev_udevdir = dependency('udev').get_pkgconfig_variable('udevdir')

patches/modem-manager/0002-multiplex-interface-name.patch

@@ -0,0 +1,17 @@
+diff --git a/src/mm-bearer-qmi.c b/src/mm-bearer-qmi.c
+index 54f2e93..3c4df7b 100644
+--- a/src/mm-bearer-qmi.c
++++ b/src/mm-bearer-qmi.c
+@@ -2494,7 +2494,11 @@ load_settings_from_bearer (MMBearerQmi         *self,
+         }
+ 
+         /* The link prefix hint given must be modem-specific */
+-        ctx->link_prefix_hint = g_strdup_printf ("qmapmux%u.", mm_base_modem_get_dbus_id (MM_BASE_MODEM (modem)));
++        const gchar *name = mm_port_get_device (MM_PORT (ctx->data));
++        if (name)
++                ctx->link_prefix_hint = g_strdup_printf ("%s.", name);
++        else
++                ctx->link_prefix_hint = g_strdup_printf ("qmapmux%u.", mm_base_modem_get_dbus_id (MM_BASE_MODEM (modem)));
+     }
+ 
+     /* If profile id is given, we'll launch the connection specifying the profile id in use

patches/modem-manager/0003-port-probe-trust-ID_MM_PORT_TYPE_MBIM-udev-hint.patch

@@ -0,0 +1,29 @@
+When a udev rule explicitly sets ID_MM_PORT_TYPE_MBIM=1 for a port,
+treat it as definitive and skip the active MBIM open/probe.  This
+mirrors the way ID_MM_PORT_TYPE_GPS is handled (set via is_gps, a
+direct result field rather than a "maybe" hint).
+
+The active MBIM probe attempts to open the WDM device and send an
+MBIM OPEN message.  Some modems (e.g. Dell DW5811e / Sierra Wireless
+EM7455 in USB composition 8) persistently send QMI/QMUX-framed
+notifications on the MBIM control channel before ever responding to
+MBIM OPEN, causing the probe to time out (~50 s).  The probe failure
+causes mm_port_probe_list_has_mbim_port() to return FALSE, so the
+Dell plugin creates a non-MBIM modem object that cannot handle the
+usbmisc/MBIM port, resulting in "unhandled port type".
+
+Since the udev rule already encodes the vendor/product/interface
+specificity required to identify the port, the active probe adds no
+information in this case.
+
+diff --git a/src/mm-port-probe.c b/src/mm-port-probe.c
+--- a/src/mm-port-probe.c
++++ b/src/mm-port-probe.c
+@@ -1529,6 +1529,7 @@ mm_port_probe_run (MMPortProbe *self,
+     /* If this is a port flagged as being a MBIM port, don't do any other probing */
+     if (self->priv->maybe_mbim) {
+         mm_obj_dbg (self, "no AT/QCDM/QMI probing in possible MBIM port");
++        mm_port_probe_set_result_mbim (self, TRUE);
+         mm_port_probe_set_result_at   (self, FALSE);
+         mm_port_probe_set_result_qcdm (self, FALSE);
+         mm_port_probe_set_result_qmi  (self, FALSE);

src/bin/show/__init__.py

@@ -81,6 +81,30 @@ def hardware(args: List[str]) -> None:
     cli_pretty(data, "show-hardware")
 
 
+def modem(args: List[str]) -> None:
+    ref = args[0] if args else None
+
+    data = get_json("/ietf-hardware:hardware")
+    if not data:
+        print("No modem data available.")
+        return
+
+    # Merge bearer-state from wwan interfaces (lives under ietf-interfaces).
+    # Quiet on miss — a system without wwan interfaces still shows modems.
+    iface_data = get_json("/ietf-interfaces:interfaces", quiet=True)
+    if iface_data:
+        data.update(iface_data)
+
+    if RAW_OUTPUT:
+        print(json.dumps(data, indent=2))
+        return
+
+    if ref:
+        cli_pretty(data, "show-modem-detail", ref)
+    else:
+        cli_pretty(data, "show-modem")
+
+
 def ntp(args: List[str]) -> None:
     # Create argument parser for ntp subcommands
     parser = argparse.ArgumentParser(prog='show ntp', add_help=False)
@@ -558,8 +582,9 @@ def system(args: List[str]) -> None:
     runtime = {}
 
     # Extract CPU temperature and fan speed from hardware components
-    cpu_temp = None
+    cpu_temps = []
     fan_rpm = None
+    _cpu_prefixes = ("cpu", "soc", "core")
     if hardware_data and "ietf-hardware:hardware" in hardware_data:
         components = hardware_data.get("ietf-hardware:hardware", {}).get("component", [])
         for component in components:
@@ -570,18 +595,16 @@ def system(args: List[str]) -> None:
             name = component.get("name", "")
             value_type = sensor_data.get("value-type")
 
-            # Only capture CPU/SoC temperature (ignore phy, sfp, etc.)
-            # Different platforms use different names: cpu, soc, core, etc.
-            if value_type == "celsius" and name in ("cpu", "soc", "core") and cpu_temp is None:
-                temp_millidegrees = sensor_data.get("value", 0)
-                cpu_temp = temp_millidegrees / 1000.0
+            # Capture all CPU/SoC temperatures (handles cpu, cpu1, soc, core0, etc.)
+            if value_type == "celsius" and any(name == p or name.startswith(p) for p in _cpu_prefixes):
+                cpu_temps.append(sensor_data.get("value", 0) / 1000.0)
 
             # Capture fan speed if available
             elif value_type == "rpm" and fan_rpm is None:
                 fan_rpm = sensor_data.get("value", 0)
 
-    if cpu_temp is not None:
-        runtime["cpu_temp"] = cpu_temp
+    if cpu_temps:
+        runtime["cpu_temp"] = max(cpu_temps)
     if fan_rpm is not None:
         runtime["fan_rpm"] = fan_rpm
 
@@ -745,6 +768,7 @@ def execute_command(command: str, args: List[str]):
         'keystore': keystore,
         'lldp': lldp,
         'mdns': mdns,
+        'modem': modem,
         'nacm': nacm,
         'ntp': ntp,
         'ospf': ospf,

src/confd/bin/gen-hardware

@@ -11,6 +11,11 @@ if jq -e '.["wifi-radios"]' /run/system.json > /dev/null 2>&1; then
 else
     wifi_radios=""
 fi
+if jq -e '.["modem"]' /run/system.json > /dev/null 2>&1; then
+    modem_names=$(jq -r '.["modem"][].name' /run/system.json)
+else
+    modem_names=""
+fi
 
 
 gen_port()
@@ -61,6 +66,20 @@ gen_radio()
 EOF
 }
 
+gen_modem()
+{
+    modem="$1"
+    cat <<EOF
+{
+    "name": "$modem",
+    "class": "infix-hardware:modem",
+    "state": {
+	"admin-state": "unlocked"
+    }
+}
+EOF
+}
+
 first=1
 cat <<EOF
 {
@@ -81,6 +100,13 @@ for radio in $wifi_radios; do
     first=0;
     gen_radio $radio
 done
+for modem in $modem_names; do
+    if [ $first -eq 0 ]; then
+	echo -n ','
+    fi
+    first=0;
+    gen_modem "$modem"
+done
 cat <<EOF
 ]}
 }

src/confd/configure.ac

@@ -89,6 +89,7 @@ PKG_CHECK_MODULES([libite],  [libite >= 2.6.1])
 PKG_CHECK_MODULES([sysrepo], [sysrepo >= 4.2.10])
 PKG_CHECK_MODULES([libyang], [libyang >= 4.2.2])
 PKG_CHECK_MODULES([libsrx],  [libsrx >= 1.0.0])
+PKG_CHECK_MODULES([libcrypto], [libcrypto])
 
 AC_CHECK_HEADER([ev.h],
     [saved_LIBS="$LIBS"