modemd: handle preferred-mode set without allowed-mode

Setting just preferred-mode in YANG (no allowed-mode leaf-list) built an invalid mode string with an empty allowed: Mode 'allowed: ; preferred: 4g' is not supported The empty allowed: can never match anything in the modem's supported-modes list, so the user got a cryptic 'is not supported' even when their preferred mode was, in principle, supported. When only preferred-mode is configured, walk the modem's supported-modes list for an entry that already has that preferred, and reuse its allowed set. If no supported entry has that preferred mode, fail with a message that lists every combination the modem does support, easier to diagnose than the silent 'empty allowed' case. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
modemd: stop retrying mmcli --reset when the modem rejects it
2026-07-22 17:23:00 +02:00 · 2026-06-07 20:51:04 +02:00 · 2026-06-07 20:51:03 +02:00 · 2026-06-07 20:51:03 +02:00 · 2026-06-07 20:51:02 +02:00 · 2026-06-07 20:51:02 +02:00
443 changed files with 8884 additions and 50768 deletions
@@ -272,7 +272,7 @@ other contributions that are not aligned to this Code of Conduct."*
 [PEP-8]:    https://peps.python.org/pep-0008/
 [RDD]:      https://tom.preston-werner.com/2010/08/23/readme-driven-development
 [cbeams]:   https://cbea.ms/git-commit/#seven-rules
-[conduct]:    CODE_OF_CONDUCT.md
+[conduct]:    CODE-OF-CONDUCT.md
 [DCO]:        https://developercertificate.org/
 [closing]:    https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
 [gpg-verify]: https://docs.github.com/en/authentication/managing-commit-signature-verification
@@ -1,15 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: gomod
-    directory: /src/webui
-    schedule:
-      interval: weekly
-    # goyang is pinned to our kernelkit fork via a replace directive and
-    # stepped by hand when we add patches; leave it for Dependabot to ignore.
-    ignore:
-      - dependency-name: github.com/openconfig/goyang
-
-  - package-ecosystem: gomod
-    directory: /src/netbrowse
-    schedule:
-      interval: weekly
@@ -113,6 +113,12 @@ jobs:
          pattern: "artifact-*"
          merge-multiple: true

+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
      - uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
@@ -122,7 +128,7 @@ jobs:
          prerelease: true
          tag: "latest-boot"
          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz"
+          artifacts: "*.tar.gz*"

      - name: Summary
        run: |
@@ -223,6 +223,15 @@ jobs:
            output/images/*-emmc.img*
          retention-days: 30

+      - name: Create checksums
+        run: |
+          cd output/images/
+          for file in *-sdcard.img *-emmc.img; do
+            if [ -f "$file" ]; then
+              sha256sum "$file" > "$file.sha256"
+            fi
+          done
+
      - name: Upload to release
        uses: ncipollo/release-action@v1
        with:
@@ -233,7 +242,7 @@ jobs:
          prerelease: true
          tag: "latest-boot"
          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "output/images/*-sdcard.img,output/images/*-emmc.img"
+          artifacts: "output/images/*-sdcard.img*,output/images/*-emmc.img*"

      - name: Generate summary
        run: |
@@ -45,9 +45,6 @@ jobs:
          target: ${{ matrix.target }}
          enabled: ${{ inputs.use_cache }}

-      # WebUI images bundle the mkdocs User's Guide via post-build.sh.
-      - uses: kernelkit/actions/setup-mkdocs@v1.2
-
      - name: Configure & Build
        env:
          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
@@ -124,9 +124,6 @@ jobs:
        with:
          target: ${{ env.TARGET }}

-      # WebUI images bundle the mkdocs User's Guide via post-build.sh.
-      - uses: kernelkit/actions/setup-mkdocs@v1.2
-
      - name: Configure ${{ env.TARGET }}
        run: |
          make ${{ env.TARGET }}_defconfig
@@ -1,68 +0,0 @@
-name: Go Vulnerability Scan
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'src/webui/**'
-      - 'src/netbrowse/**'
-      - '.github/workflows/govulncheck.yml'
-  pull_request:
-    paths:
-      - 'src/webui/**'
-      - 'src/netbrowse/**'
-      - '.github/workflows/govulncheck.yml'
-  schedule:
-    - cron: '5 0 * * 6'  # Saturday at 00:05 UTC, same as Coverity
-  workflow_dispatch:
-
-jobs:
-  govulncheck:
-    if: ${{ github.repository_owner == 'kernelkit' }}
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        module:
-          - src/webui
-          - src/netbrowse
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: stable
-
-      - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@latest
-
-      - name: Scan ${{ matrix.module }}
-        working-directory: ${{ matrix.module }}
-        run: |
-          # Full report, for the run summary.  govulncheck exits non-zero
-          # whenever it finds anything, so don't let it fail the step here.
-          {
-            echo "## govulncheck: ${{ matrix.module }}"
-            echo '```'
-            govulncheck ./... || true
-            echo '```'
-          } | tee -a "$GITHUB_STEP_SUMMARY"
-
-          # Gate on vulnerabilities reachable from our code through a
-          # dependency.  govulncheck's call-graph analysis is transitive,
-          # so indirect use counts too (we call a dep that calls the bad
-          # symbol).  trace[0] is the vulnerable symbol; we key on the
-          # module it lives in.  A chain that bottoms out in stdlib is
-          # fixed by bumping the Buildroot host Go, not this module's
-          # go.mod, so it's reported above but doesn't fail the build.
-          # Keep the json scan and jq unguarded so a tool failure fails the
-          # gate closed; only grep's no-match exit (all-clear) is tolerated.
-          govulncheck -format json ./... > scan.json || true
-          called=$(jq -r 'select(.finding.trace[0].function != null) |
-                          .finding.trace[0].module' scan.json | sort -u)
-          vulns=$(printf '%s' "$called" | grep -vx stdlib || true)
-          if [ -n "$vulns" ]; then
-            echo "::error::Called vulnerabilities in dependencies: $(echo "$vulns" | paste -sd, -)"
-            exit 1
-          fi
@@ -0,0 +1,88 @@
+name: Manny the Manager
+
+on:
+  workflow_dispatch:
+    inputs:
+      checkout:
+        required: true
+        type: boolean
+      cleanup:
+        required: true
+        type: boolean
+      peek:
+        required: true
+        type: boolean
+
+jobs:
+  inventory:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Disk usage ...
+        run: |
+          cd
+          du -hs .[^.]*
+      - name: Disk inventory (1/2) ...
+        run: |
+          echo "df -h ========================================================================="
+          df -h
+          echo "mounts ========================================================================"
+          mount
+      - name: File inventory (1/2) ...
+        run: |
+          echo "Current directory: $(pwd)"
+          echo "Files in $HOME ================================================================"
+          ls $HOME
+          echo "Find $HOME ===================================================================="
+          find $HOME
+      - name: Container inventory ...
+        run: |
+          echo "Available container images: ==================================================="
+          docker images
+          echo "Available containers: ========================================================="
+          docker ps -a
+
+  checkout:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: kernelkit/actions/cache-restore@v1
+        with:
+          target: x86_64
+          dl-prefix: dl-netconf
+      - name: Disk inventory (2/2) ...
+        run: |
+          echo "df -h ========================================================================="
+          df -h
+          echo "mounts ========================================================================"
+          mount
+      - name: File inventory (2/2) ...
+        run: |
+          echo "Current directory: $(pwd)"
+          echo "Files in $HOME ================================================================"
+          ls $HOME
+          echo "Find $HOME ===================================================================="
+          find $HOME
+
+  peeky:
+    if: ${{ inputs.peek }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Peek & Poke ...
+        run: |
+          whoami
+          ls -l /mnt/
+          cat /mnt/DATALOSS_WARNING_README.txt
+          sudo mkdir /mnt/x-aarch64
+          sudo chown $(id -un):$(id -gn) /mnt/x-aarch64
+          ls -l /mnt/
+
+  cleanup:
+    if: ${{ inputs.cleanup }}
+    needs: [inventory, peeky]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Cleaning up cruft ...
+        run: |
+          docker image prune -af
+          docker volume prune -f
+          docker container prune -f
@@ -16,6 +16,12 @@ jobs:
          pattern: "artifact-*"
          merge-multiple: true

+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
      - uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
@@ -26,7 +32,7 @@ jobs:
          prerelease: true
          tag: "latest"
          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz"
+          artifacts: "*.tar.gz*"

      - name: Summary
        run: |
@@ -83,6 +83,17 @@ jobs:
          pattern: "artifact-*"
          merge-multiple: true

+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+          if ls *.qcow2 &>/dev/null; then
+            for file in *.qcow2; do
+              sha256sum "$file" > "$file.sha256"
+            done
+          fi
+
      - name: Extract ChangeLog entry ...
        run: |
          cat doc/ChangeLog.md | ./utils/extract-changelog.sh > release.md
@@ -95,7 +106,7 @@ jobs:
          makeLatest: ${{ steps.rel.outputs.latest }}
          discussionCategory: ${{ steps.rel.outputs.cat }}
          bodyFile: release.md
-          artifacts: "*.tar.gz,*.qcow2"
+          artifacts: "*.tar.gz*,*.qcow2*"

      - name: Summary
        run: |
@@ -143,15 +143,3 @@ jobs:
        with:
          name: test-report
          path: output/images/test-report.pdf
-
-      - name: Generate XPath Coverage Report for ${{ env.TARGET }}
-        if: always()
-        run: |
-          make test-dir="$(pwd)/$TEST_PATH" xpath-coverage-report
-
-      - name: Upload XPath Coverage Report as Artifact
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: xpath-coverage-report
-          path: output/images/xpath-coverage-report.pdf
@@ -27,6 +27,17 @@ jobs:
          pattern: "artifact-*"
          merge-multiple: true

+      - name: Create checksums
+        run: |
+          for file in *.tar.gz; do
+            sha256sum $file > $file.sha256
+          done
+          if ls *.qcow2 &>/dev/null; then
+            for file in *.qcow2; do
+              sha256sum "$file" > "$file.sha256"
+            done
+          fi
+
      - uses: ncipollo/release-action@v1
        with:
          tag: latest
@@ -43,7 +54,7 @@ jobs:

            **Commit:** ${{ github.sha }}
            **Built:** ${{ github.run_id }}
-          artifacts: "*.tar.gz,*.qcow2"
+          artifacts: "*.tar.gz*,*.qcow2*"

      - name: Summary
        run: |
@@ -110,10 +110,9 @@ config INFIX_OEM_PATH
 	  directory (absolute path) and the Infix post-build.sh will call `git
 	  describe -C $INFIX_OEM_PATH`.

-	  Note: the OS version (VERSION, VERSION_ID, BUILD_ID in
-	  /etc/os-release) is always derived from `git describe`.  The global
-	  variable INFIX_RELEASE does not change it; it only labels the release
-	  channel (IMAGE_VERSION) and names the published artifacts.
+	  Note: for release builds the global variable INFIX_RELEASE overrides
+	  the version information derived from `git describe`.  However, the
+	  GIT version is always saved as the BUILD_ID in /etc/os-releases.

 endmenu

@@ -1,21 +1,63 @@
-[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Discord][discord-badge]][discord-url]
+[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]

-<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=380 padding=10>
+<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=480 padding=10>

-Infix turns an ARM or x86 device into a managed network appliance.  The
-same OS runs on a $35 Raspberry Pi and on enterprise switching hardware,
-so you can build a router, an IoT gateway, or an edge device on whatever
-you have on hand.
+Turn any ARM or x86 device into a powerful, manageable network appliance
+in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
+routers, IoT gateways, edge devices, or custom network solutions that
+just work.

-More in-depth material is available in our blog and User Guide:
+## Our Values

- <https://www.kernelkit.org/>
- <https://www.kernelkit.org/infix/>
+**🔒 Immutable**  
+Your system never breaks.  Read-only filesystem with atomic upgrades
+means no configuration drift, no corrupted updates, and instant rollback
+if something goes wrong.  Deploy once, trust forever.

-## See it in action
+**🤝 Friendly**  
+Actually easy to use. Auto-generated CLI from standard YANG models comes
+with built-in help for every command — just hit <kbd>?</kbd> or
+<kbd>TAB</kbd> for context-aware assistance.

-The CLI is generated from the [YANG models][inside], so it guides you with
-built-in help.  Here's setting an IP address on an interface:
+Familiar NETCONF & RESTCONF APIs and [comprehensive documentation][4]
+mean you're never stuck.  Whether you're learning networking or managing
+enterprise infrastructure.
+
+**🛡️ Secure**  
+Built with security as a foundation, not an afterthought.  Minimal
+attack surface, separation between system and data, and container
+isolation.  Sleep better knowing your infrastructure is protected.
+
+## Why Choose Infix
+
+**Hardware Flexibility**: Start with a $35 Raspberry Pi, scale to
+enterprise switching hardware.  Same OS, same tools, same reliability.
+
+**Standards-Based**: Built around YANG models and IETF standards. Learn
+once, use everywhere - no vendor lock-in.
+
+**Container Ready**: Run your applications alongside networking
+functions.  GPIO access, dedicated Ethernet ports, custom protocols —
+your device, your rules.
+
+## Use Cases
+
+1. **Home Labs & Hobbyists**:  
+   Transform a Raspberry Pi into a full-featured router with WiFi  
+1. **IoT & Edge Computing**:  
+   Bridge devices to the cloud with reliable, updatable gateways  
+1. **Small Business Networks**:  
+   Enterprise-grade features without the complexity or cost  
+1. **Developers & Makers**:  
+   Test networking concepts, prototype IoT solutions, or build custom
+   appliances
+1. **Network Professionals**:  
+   Consistent tooling from development to production deployment.  
+   How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
+
+## Quick Example
+
+Configure an interface in seconds - the CLI guides you with built-in help:

 <pre><code>admin@infix-12-34-56:/> <b>configure</b>
 admin@infix-12-34-56:/config/> <b>edit interface eth0</b>
@@ -52,94 +94,38 @@ eth0            ethernet   UP          52:54:00:12:34:56
 admin@infix-12-34-56:/> <b>copy running startup</b>
 </code></pre>

-<kbd>TAB</kbd> completes available options and <kbd>?</kbd> shows online help
-for each option and argument. `show` displays the current config, and `diff`
-shows exactly what changed before you commit it with `leave`.  See the [CLI
-documentation][3] for more.
+Notice how <kbd>TAB</kbd> completion shows available options, `show`
+displays current config, and `diff` shows exactly what changed before
+you commit your changes with the `leave` command.

-## Web interface
+For more information, see [CLI documentation][3].

-If the CLI isn't your style, the same configuration is available through the
-web interface.  Log in from a browser, keep an eye on your device from the
-Status dashboard and use the Configure > Interface setup wizard to create more
-advanced setups, or just fold out an interface to add an IP address.
+## Get Started

-<p>
-  <a href="doc/img/webui-login.png"><img src="doc/img/webui-login.png" alt="Login" align="top" width=220></a>
-  <a href="doc/img/webui-dashboard.png"><img src="doc/img/webui-dashboard.png" alt="Dashboard" width=290></a>
-  <a href="doc/img/webui-wizard.png"><img src="doc/img/webui-wizard.png" alt="Setup wizard" width=260></a>
-</p>
+Get [pre-built images][5] for your hardware.  Use the CLI, web
+interface, or standard NETCONF/RESTCONF tools, e.g., `curl`.  Add
+containers for any custom functionality you need.

-The web interface is built on the same concepts as the CLI, so operational
-status and state are kept separate from configuration and commands.
+### Supported Platforms

-## Try it in 5 minutes
+- **Raspberry Pi 2B/3B/4B/CM4** - Perfect for home labs, learning, and prototyping
+- **Banana Pi-R3** - Your next home router and gateway
+- **NanoPi R2S** - Compact dual-port router in a tiny package
+- **x86_64** - Run in VMs or on mini PCs for development and testing
+- **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
+- **Microchip SparX-5i** - Enterprise switching capabilities
+- **Microchip SAMA7G54-EK** - ARM Cortex-A7
+- **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
+- **StarFive VisionFive2** - RISC-V architecture support

-You don't need hardware to get started:
+*Why start with Raspberry Pi?* It's affordable, widely available, has
+built-in WiFi + Ethernet, and runs the exact same Infix OS you'd deploy
+in production. Perfect for learning, prototyping, or even small-scale
+deployments.

- **In a virtual lab** — run a full topology in [GNS3][gns3-post] and test
-  networks entirely in software.
- **From source** — [build it and `make run`][build-post] to boot Infix in
-  QEMU, from `git clone` to pinging the internet.
- **On real hardware** — grab a [pre-built image][5] for your board, or run
-  the `x86_64` image in any VM.
-
-Log in with `admin` / `admin` on the virtual and pre-built images.  On
-shipped products the factory-reset credentials are customizable — we
-typically provision a unique per-device password stored in EEPROM/VPD.
-
-## Supported hardware
-
- **Raspberry Pi 2B/3B/4B/CM4** - a good starting point; built-in WiFi and Ethernet
- **Banana Pi-R64/R3/R3 Mini/R4** - multi-port routers and gateways
- **NanoPi R2S** - compact dual-port router
- **x86_64** - VMs and mini PCs, for development or production
- **Marvell CN9130 CRB, EspressoBIN** - ARM64 development boards
- **Microchip SparX-5i** - enterprise switching
- **Microchip SAMA7G54-EK** - ARM Cortex-A7 evaluation kit
- **NXP i.MX8MP EVK** - ARM64 SoC evaluation kit
- **StarFive VisionFive2** - RISC-V board
-
-*Why start with Raspberry Pi?* It's cheap, easy to get hold of, has
-built-in WiFi and Ethernet, and runs the same Infix you'd deploy in
-production — so what you learn on it carries straight over.
-
-> [!TIP]
 > 📖 **[Complete documentation][4]** • 💬 **[Join our Discord][discord-url]**

-## Why Infix
-
-**🔒 Immutable**  
-Read-only filesystem with atomic upgrades.  An update either applies
-cleanly or rolls back, so a failed upgrade or a power cut midway through
-won't leave you with a half-broken system.
-
-**🤝 Friendly**  
-The CLI is generated from the YANG models, so every command carries its
-own help — hit <kbd>?</kbd> or <kbd>TAB</kbd> to see what's available.
-The same models are reachable over NETCONF and RESTCONF, with
-[documentation][4] for when you get stuck.
-
-**🛡️ Secure**  
-A small attack surface, separation between system and data, and
-container isolation.  Since the system partition is read-only, a
-compromised service or container can't rewrite the OS underneath it.
-
-## Use cases
-
-1. **Home labs & hobbyists**:  
-   Turn a Raspberry Pi into a router with WiFi  
-1. **IoT & edge**:  
-   Build gateways you can update in the field  
-1. **Small business networks**:  
-   Routing, firewalling, and VLANs on affordable hardware  
-1. **Developers & makers**:  
-   Prototype networking ideas, or build a custom appliance with containers  
-1. **Network professionals**:  
-   The same tooling from lab to production — spin up a digital twin in raw
-   Qemu or [GNS3](https://gns3.com/infix)
-
-## Under the hood
+## Technical Details

 <a href="https://bitsign.se">
  <picture>
@@ -149,29 +135,27 @@ compromised service or container can't rewrite the OS underneath it.
  </picture>
 </a>

-Built on [Linux][0], [Buildroot][1], and [sysrepo][2]:
+Built on proven open-source foundations: [Linux][0], [Buildroot][1], and
+[sysrepo][2] — for reliability you can trust:

- **Immutable OS**: read-only filesystem, atomic updates, rollback on failure
- **YANG configuration**: standard models with an auto-generated CLI and APIs
- **Hardware acceleration**: switchdev offload for wire-speed forwarding
- **Container integration**: Docker, with access to host network and hardware
- **Memory efficient**: runs on devices with as little as 256 MB RAM
- **Code signing**: releases are cryptographically signed
+- **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
+- **YANG Configuration**: Industry-standard models with auto-generated tooling
+- **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
+- **Container Integration**: Docker support with flexible network and hardware access
+- **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
+- **Code Signing**: Releases are cryptographically signed for integrity verification

-Because the whole system is modeled in YANG, every setting is reachable
-the same way: from the CLI over console or SSH, or remotely over the
-native NETCONF and RESTCONF APIs.  The same models drive development,
-testing, and day-to-day monitoring.
+Perfect for everything from resource-constrained edge devices to
+high-throughput network appliances.
+
+With the entire system modeled in YANG, scalability is no longer an
+issue, be it in development, testing, or end users deploying and
+monitoring their devices.  All knobs and dials are accessible from the
+CLI (console/SSH), or remotely using the native NETCONF or RESTCONF
+APIs.

 > Check the *[Latest Build][]* for bleeding-edge features.

-## Contributing
-
-Bug reports, ideas, and pull requests are welcome.  Start with
-[CONTRIBUTING][contributing] and the [code of conduct][coc].  Found a
-security issue?  Follow the [security policy][security].  Need a hand?
-See [support options][support] or [join us on Discord][discord-url].
-
 ---

 <div align="center">
@@ -187,13 +171,6 @@ See [support options][support] or [join us on Discord][discord-url].
 [3]: https://www.kernelkit.org/infix/latest/cli/introduction/
 [4]: https://www.kernelkit.org/infix/
 [5]: https://github.com/kernelkit/infix/releases/latest
-[inside]:          https://www.kernelkit.org/posts/inside-infix/
-[gns3-post]:       https://www.kernelkit.org/posts/infix-in-gns3/
-[build-post]:      https://www.kernelkit.org/posts/building-infix-from-source/
-[contributing]:    .github/CONTRIBUTING.md
-[coc]:             .github/CODE_OF_CONDUCT.md
-[security]:        .github/SECURITY.md
-[support]:         .github/SUPPORT.md
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
@@ -87,6 +87,45 @@ Infix ships with the following factory defaults.
 > are bridged into the LAN as access points.  WiFi is not included with the board
 > and is not part of the factory default configuration.

+## SIM Card Installation
+
+The BPI-R4 has three SIM holders, one per PCIe slot:
+
+| Slot     | PCIe socket | Typical use              |
+|----------|-------------|--------------------------|
+| **SIM1** | M.2 Key-B   | 4G/5G WWAN modem         |
+| **SIM2** | mPCIe #1    | Cellular or other modem  |
+| **SIM3** | mPCIe #2    | Cellular or other modem  |
+
+All three take **nano-SIM (4FF)** cards.
+
+> [!NOTE]
+> The official Banana Pi pages show an older board revision with a sliding
+> "sled" holder.  Newer boards ship with a fixed friction-fit holder instead:
+> there is no lid to lift and no spring eject.  The [closest matching photo on
+> bananapi.org][15] shows the current mechanism.
+
+### Inserting a SIM
+
+1. Orient the card with the gold contacts facing the PCB (printed
+   side up) and the cut corner pointing toward the M.2/mPCIe socket,
+   which on this board is also toward the outer edge.  The silkscreen
+   next to each holder shows the same outline.
+2. Push the SIM straight in until it is fully seated.  There is no
+   click and the holder is not spring-loaded, so press firmly until
+   the contacts engage and the rear edge of the card sits flush with
+   the holder.
+3. A SIM that still protrudes is not fully inserted; push again.
+
+### Removing a SIM
+
+The friction grip on these holders is tight.  Gently pry the card out
+with a fingernail or a thin plastic spudger.  Avoid metal tweezers
+near the contacts.  Removing the front panel of the metal case is
+absolutely necessary to access the SIM holder.
+
+For software configuration once the modem is recognised, see the
+[Cellular Modem User's Guide][16].

 ## Getting Started

@@ -358,3 +397,6 @@ make aarch64
 [12]: https://github.com/frank-w/u-boot/releases
 [13]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2026-01-bpi-2026.01-2026-01-15_2013/bpi-r4_spim-nand_bl2.img
 [14]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2026-01-bpi-2026.01-2026-01-15_2013/bpi-r4_spim-nand_fip.bin
+[15]: https://docs.banana-pi.org/bpi-r4/bpi-r4_4g5g_2.jpg
+[16]: https://www.kernelkit.org/infix/latest/modem/
+
@@ -10,6 +10,13 @@
        "state": {
          "admin-state": "unlocked"
        }
+      },
+      {
+        "name": "USB2",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
      }
    ]
  },
@@ -366,7 +373,7 @@
    ]
  },
  "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.8"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -10,6 +10,13 @@
        "state": {
          "admin-state": "unlocked"
        }
+      },
+      {
+        "name": "USB2",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
      }
    ]
  },
@@ -358,7 +365,7 @@
    ]
  },
  "infix-meta:meta": {
-    "version": "1.7"
+    "version": "1.8"
  },
  "infix-services:mdns": {
    "enabled": true
@@ -120,29 +120,3 @@ grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
 if [ "$BR2_PACKAGE_HOST_PYTHON_YANGDOC" = "y" ]; then
   mkyangdoc "$BINARIES_DIR/yangdoc.html"
 fi
-
-# Bundle the mkdocs User's Guide into the rootfs, served by the WebUI's
-# nginx at /guide/.  Only when the WebUI is present (nothing serves it
-# otherwise, and it keeps minimal images small) and mkdocs is on the build
-# host.  Best-effort: a failed build warns but does not abort the image
-# build, and the WebUI hides its User Guide entry when the docs are absent.
-mkuserguide()
-{
-    local cfg dst
-    cfg="$(readlink -f "$common/../..")/mkdocs.yml"
-    dst="$TARGET_DIR/var/www/guide"
-
-    if ! command -v mkdocs >/dev/null 2>&1; then
-        ixmsg "mkdocs not found, skipping User's Guide bundling"
-        return
-    fi
-    ixmsg "Building User's Guide into $dst"
-    if ! mkdocs build -f "$cfg" -d "$dst" --clean --quiet; then
-        ixmsg "WARNING: mkdocs build failed, shipping without on-device User's Guide"
-        rm -rf "$dst"
-    fi
-}
-
-if [ "$BR2_PACKAGE_WEBUI" = "y" ]; then
-    mkuserguide
-fi
@@ -1 +1,5 @@
 CONFD_TIMEOUT=60
+#DEBUG=1
+
+# -v debug
+CONFD_ARGS=""
@@ -1,5 +0,0 @@
-RESTCONF_URL=https://127.0.0.1/restconf
-INSECURE_TLS=1
-# Spool firmware uploads (and any other temp files) to persistent storage
-# instead of the RAM-backed /tmp to enable push-upgrades on low-memory systems.
-TMPDIR=/var/tmp
@@ -5,3 +5,4 @@
 4 static
 5 dhcp
 6 random
+7 wwan
@@ -1 +0,0 @@
-../restconf.app
@@ -1,3 +0,0 @@
-allow 127.0.0.1;
-allow ::1;
-deny all;
@@ -1 +0,0 @@
-restconf-access-local.conf
@@ -1,6 +1,5 @@
 # /telemetry/optics is for streaming (not used atm)
 location ~ ^/(restconf|yang|.well-known)/ {
-    include /etc/nginx/restconf-access.conf;
    grpc_pass grpc://[::1]:10080;
    grpc_set_header Host $host;
    grpc_set_header X-Real-IP $remote_addr;
@@ -1,3 +0,0 @@
-if [ -s /run/os-update ]; then
-    printf '\n\033[1;33m *** %s ***\033[0m\n\n' "$(cat /run/os-update)"
-fi
@@ -1 +0,0 @@
-f  /run/os-update  0666 admin admin
@@ -620,6 +620,73 @@ def probe_ptp_capabilities(out):
        out.setdefault("interfaces", {}).update(ifaces)


+def _usb_root_from_sysfs(dev_path):
+    p = dev_path
+    while p not in ("/", "/sys"):
+        parent = os.path.realpath(os.path.join(p, ".."))
+        basename = os.path.basename(parent)
+        if basename.startswith("usb") and basename[3:].isdigit():
+            return parent
+        p = parent
+    return None
+
+
+def _read_usb_vid_pid(dev_path):
+    p = dev_path
+    while p not in ("/", "/sys"):
+        try:
+            vid = open(os.path.join(p, "idVendor")).read().strip()
+            pid = open(os.path.join(p, "idProduct")).read().strip()
+            return vid, pid
+        except OSError:
+            pass
+        p = os.path.dirname(p)
+    return "", ""
+
+
+def probe_modems(out):
+    """devpath is the USB bus root; ModemManager matches by path prefix.
+    seen_roots deduplicates cdc-wdm and ttyUSB ports of the same physical modem."""
+    seen_roots = set()
+    modems = []
+    idx = 0
+
+    def add_modem(dev_path):
+        nonlocal idx
+        usb_root = _usb_root_from_sysfs(dev_path)
+        if usb_root is None or usb_root in seen_roots:
+            return
+        seen_roots.add(usb_root)
+        vid, pid = _read_usb_vid_pid(dev_path)
+        modems.append({
+            "index": idx,
+            "name": "modem%d" % idx,
+            "devpath": usb_root,
+            "vid": vid,
+            "pid": pid,
+        })
+        idx += 1
+
+    for cls_dir, prefix in (("/sys/class/usbmisc", "cdc-wdm"),
+                             ("/sys/class/tty", "ttyUSB")):
+        try:
+            entries = os.listdir(cls_dir)
+        except OSError:
+            continue
+        for entry in entries:
+            if not entry.startswith(prefix):
+                continue
+            try:
+                dev_path = os.path.realpath(
+                    os.path.join(cls_dir, entry, "device"))
+                add_modem(dev_path)
+            except OSError:
+                pass
+
+    if modems:
+        out["modem"] = modems
+
+
 def main():
    out = {
        "vendor": None,
@@ -647,6 +714,7 @@ def main():

    probe_wifi_radios(out)
    probe_ptp_capabilities(out)
+    probe_modems(out)

    if not out["factory-password-hash"]:
        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +
@@ -1,55 +0,0 @@
-#!/bin/sh
-# Check for available software updates and notify on login if one exists.
-# Called by the scheduler.
-
-NOTIFY_FILE=/run/os-update
-TAG=os-update
-
-# Source os-release for VERSION and IMAGE_ID
-if [ ! -f /etc/os-release ]; then
-    logger -t "$TAG" "ERROR: /etc/os-release not found"
-    exit 1
-fi
-. /etc/os-release
-
-# Dev/dirty builds have no comparable semver — always show the latest release
-IS_RELEASE=true
-if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
-    IS_RELEASE=false
-fi
-
-# Read configured update-url from running config, fall back to upstream
-UPDATE_URL=$(copy running-config \
-    -x '/ietf-system:system/infix-system:software/check-update/update-url' \
-    2>/dev/null \
-    | jq -r '.. | objects | ."update-url"? // empty')
-UPDATE_URL=${UPDATE_URL:-"https://github.com/kernelkit/infix"}
-
-# Derive API URL from the configured update URL.
-# Default (github.com): https://github.com/org/repo → https://api.github.com/repos/org/repo
-REPO=$(echo "$UPDATE_URL" | sed 's|https://github.com/||; s|/*$||')
-API_URL="https://api.github.com/repos/${REPO}/releases/latest"
-
-LATEST_TAG=$(curl -sSL --max-time 10 "$API_URL" 2>/dev/null \
-    | jq -r '.tag_name // empty')
-if [ -z "$LATEST_TAG" ]; then
-    logger -p daemon.info -t "$TAG" "Update check skipped: could not reach ${API_URL}"
-    exit 0
-fi
-LATEST=${LATEST_TAG#v}
-
-# Compare: is $1 strictly newer than $2?
-newer() {
-    [ "$1" = "$2" ] && return 1
-    [ "$(printf '%s\n%s' "$1" "$2" | sort -V | tail -1)" = "$1" ]
-}
-
-if [ "$IS_RELEASE" = false ] || newer "$LATEST" "$VERSION"; then
-    RELEASE_URL="${UPDATE_URL}/releases/${LATEST_TAG}"
-    MSG="Software update available: ${LATEST_TAG}, running ${VERSION} (see ${RELEASE_URL})"
-    logger -t "$TAG" "$MSG"
-    printf '%s\n' "$MSG" > "$NOTIFY_FILE"
-else
-    logger -p daemon.debug -t "$TAG" "No update available (current: $VERSION, latest: $LATEST)"
-    printf '' > "$NOTIFY_FILE"
-fi
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -149,6 +149,7 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
+BR2_PACKAGE_FEATURE_MODEM=y
 BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
 BR2_PACKAGE_FEATURE_WIFI_QUALCOMM=y
@@ -175,6 +176,7 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -186,8 +188,6 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-# BR2_PACKAGE_LANDING is not set
-BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -144,7 +144,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -162,6 +162,7 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -169,8 +170,6 @@ BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-# BR2_PACKAGE_LANDING is not set
-BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 IMAGE_ITB_AUX=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -142,7 +142,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -194,6 +194,7 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -205,8 +206,6 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-# BR2_PACKAGE_LANDING is not set
-BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -169,6 +169,7 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -180,8 +181,6 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-# BR2_PACKAGE_LANDING is not set
-BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.37"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.34"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -141,7 +141,6 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
-BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
@@ -3,75 +3,33 @@ Change Log

 All notable changes to the project are documented in this file.

-[v26.06.0][] - 2026-07-01
-------------------------
-
-> [!NOTE]
-> Noteworthy changes and additions in this release:
->
-> **🌐 Web Interface:** Infix gets its first-ever web interface!  Browse live
-> status and a full operational tree, handle common tasks from curated
-> configuration pages, and drop into a YANG tree editor for everything else.
-> A maintenance section covers firmware upgrade, backup & restore, and more.
->
-> **📶 Wi-Fi Roaming & Mesh:** Access points sharing an SSID can hand clients
-> off seamlessly with 802.11k/v/r, form a cable-free 802.11s mesh backhaul,
-> and steer dual-band clients onto the faster 5/6 GHz band.
->
-> **🗓️ System Scheduling:** Reusable time schedules based on ietf-schedule
-> (RFC 9922) let features like scheduled reboot and software update checks
-> run on a recurring, cron-style calendar.
+[v26.06.0][UNRELEASED]
+--------------

 ### Changes

- Upgrade Linux kernel to 6.18.37 (LTS)
- Upgrade Buildroot to 2025.02.15 (LTS)
- Add basic web interface: static status pages and a tree view of operational
-  status.  Curated configuration pages for some common tasks and a YANG tree
-  editor for the rest.  Also includes a maintenance section for firmware
-  upgrade, backup & restore, and more
 - Add Wi-Fi roaming for fast, seamless handoff between access points that
  share an SSID: 802.11k, 802.11v and 802.11r (over-the-air FT).  See the
-  [Wi-Fi][wifi] guide for details
+  [Wi-Fi User's Guide][wifi] for details
 - Add Wi-Fi 802.11s mesh support, letting access points form a wireless
  backhaul between each other without cabling
 - Add band steering for dual-band access points, nudging dual-band
  clients onto the faster 5/6 GHz band
 - Add `legacy-rates` option to re-enable 802.11b rates on 2.4 GHz for
  old IoT devices (disabled by default)
- Add system scheduling based on ietf-schedule (RFC 9922), using the
-  iCalendar recurrence grouping pruned to cron-expressible rules.  Schedules
-  are reusable time-specs; features (`scheduled-reboot`,
-  `software/check-update`) trigger off them via a schedule reference
- Configuring multiple BSS (more than one SSID) on a single Wi-Fi radio now
-  requires an explicitly configured MAC address per BSS
- New operational `advertised-pmd-types` leaf-list on each Ethernet interface,
-  exposing the link modes currently advertised, to compare against the
-  `supported-pmd-types` introduced in v26.05.0
- Release assets no longer ship separate `.sha256` checksum files; the
-  download page now publishes a SHA-256 checksum for each asset directly
+- Add cellular modem (WWAN) support for USB-attached MBIM/QMI modems,
+  including USB dongles, mPCIe cards, and M.2 Key-B modules.  Multiple
+  APNs per modem, SIM PIN configuration, and NMEA routing from modem
+  GPS to gpsd.  See the [Modem User's Guide][modem] for details

 ### Fixes

- Fix #941: a VETH pair can now connect two containers directly, with both
-  ends assigned to containers.
- Enabling IP masquerading in the firewall no longer enables IP forwarding on
-  all interfaces.  This has been an issue ever since the firewall support was
-  introduced in v25.10.0
- Fix file permission regression in `/cfg/startup-config.cfg`, causing the
-  default `admin` user no permission to read or write the file from shell
- Fix admin url shown for HTTP/HTTPS links in <https://network.local> browser,
-  used pre-conflict resolution hostname.local, instead of hostname-2.local
- Fix unreadable per-port temperature sensor names in `show hardware` on
-  Marvell based switches: each sensor is now named after the front-panel port
-  it serves (e.g. `e1`, `e2`) instead of a raw device-tree path.  `show
-  system` also reports a representative SoC temperature on CN913x platforms
- Fix missing `contact` and `location` settings in operational status; the
-  values were configurable but never returned on RESTCONF/NETCONF reads
- Fix spurious YANG validation warnings, for NTP and WireGuard configuration,
-  emitted on every NETCONF session and schema load
+- Firewall masquerade no longer enables the global IPv4/IPv6 forwarding
+  sysctls.  You must now enable IP forwarding explicitly on the interfaces
+  that should route traffic; enabling NAT alone is no longer enough

-[wifi]: https://www.kernelkit.org/infix/latest/wifi/
+[wifi]:  https://www.kernelkit.org/infix/latest/wifi/
+[modem]: https://www.kernelkit.org/infix/latest/modem/

 [v26.05.0][] - 2026-05-29
 -------------------------
@@ -132,7 +90,7 @@ All notable changes to the project are documented in this file.

 [ethernet]: https://www.kernelkit.org/infix/latest/ethernet/#restricting-advertised-link-modes
 [BPI-R3]:   https://docs.banana-pi.org/en/BPI-R3/BananaPi_BPI-R3
-[AcerConnectVero]: https://github.com/kernelkit/infix/tree/main/board/aarch64/acer-connect-vero-w6m
+[AcerConnectVero]: https://github.com/kernelkit/infix/tree/main/board/aarch64/acer-connect-vero-w6m/

 [v26.04.0][] - 2026-04-30
 -------------------------
@@ -2205,8 +2163,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.06.0...HEAD
-[v26.06.0]:   https://github.com/kernelkit/infix/compare/v26.05.0...v26.06.0
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.05.0...HEAD
 [v26.05.0]:   https://github.com/kernelkit/infix/compare/v26.04.0...v26.05.0
 [v26.04.0]:   https://github.com/kernelkit/infix/compare/v26.03.0...v26.04.0
 [v26.03.0]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.03.0
@@ -23,6 +23,7 @@ regression test system solely relies on NETCONF and RESTCONF.
   - [Network Configuration](networking.md)
   - [Wi-Fi](wifi.md)
   - [DHCP Server](dhcp.md)
+   - [Cellular Modem (WWAN)](modem.md)
   - [Syslog Support](syslog.md)
 - **Infix In-Depth**
   - [Boot Procedure](boot.md)
@@ -668,9 +668,11 @@ set:

 For an example of both, see the next section.

-> [!TIP]
-> Both ends of a VETH pair may be assigned to containers, connecting two
-> containers directly without involving the host namespace.
+> [!IMPORTANT]
+> **VETH Pair Limitation:** When using VETH pairs with containers, at least
+> one side of the pair must remain in the host namespace. It is currently
+> not possible to create VETH pairs where both ends are assigned to different
+> containers. One end must always be accessible from the host.

 [^3]: Something which the container bridge network type does behind the
    scenes with one end of an automatically created VETH pair.
@@ -122,21 +122,13 @@ recommend using `pipx` to install the necessary tooling:
 ```bash
 $ sudo apt install pipx
 $ pipx install mkdocs
-$ pipx inject mkdocs mkdocs-material pymdown-extensions mkdocs-callouts mike mkdocs-to-pdf mkdocs-glightbox
+$ pipx inject mkdocs mkdocs-material pymdown-extensions mkdocs-callouts mike mkdocs-to-pdf
 ```

-The `mike` and `mkdocs-to-pdf` packages are used for online versioning
-and PDF generation by GitHub Actions, but since every plugin is listed
-in `mkdocs.yml`, anyone who wants to preview the documentation has to
-install all the tooling.
-
-> [!IMPORTANT]
-> MkDocs is also required to **build a WebUI image**.  The build bundles
-> the User's Guide into the image (served on-device at `/guide/`), so
-> `make` runs `mkdocs build` from `post-build.sh` when the `webui`
-> package is selected.  If MkDocs is missing the build still succeeds,
-> but the image ships without the on-device guide.  Minimal images and
-> any build without the `webui` package skip this step entirely.
+The last two packages, `mike` and `mkdocs-to-pdf`, are used for online
+versioning and PDF generation by GitHub Actions, but since they are in
+the `mkdocs.yml` file, everyone who wants to preview the documentation
+have to install all the tooling.

 Preview with:

@@ -0,0 +1,438 @@
+# Cellular Modem (WWAN)
+
+Infix supports cellular modem connectivity via modems that expose a
+QMI or MBIM control interface over USB.  Form factor does not matter:
+USB dongles, mPCIe cards, and M.2 Key-B modules all work as long as
+the modem chipset uses USB on the connector (the typical case for
+4G/LTE modems).  See *Supported Modems* below for the exceptions.
+
+Setup involves three configuration items:
+
+- A `modem0` hardware component for the physical modem
+- A `sim0` hardware component for the SIM card slot
+- A `wwan0` network interface that references both and carries the
+  bearer (APN) configuration
+
+## Architecture
+
+Infix uses a three-layer architecture for cellular modem support:
+
+1. **Modem hardware component (modem0)**: the physical modem
+     - Configured via `ietf-hardware` with class `infix-hardware:modem`
+     - `admin-state` controls whether ModemManager and modemd are active
+     - Holds physical-layer config: allowed bands, preferred mode, location
+     - Auto-discovered into factory-default config when the modem is
+       present at first boot
+
+2. **SIM hardware component (sim0)**: the SIM card slot
+     - Configured via `ietf-hardware` with class `infix-hardware:sim`
+     - Holds PIN/PUK credentials and carrier profile
+     - Auto-discovered into factory-default config alongside the modem
+
+3. **Network interface (wwan0)**: data bearer to the cellular network
+     - Configured via `ietf-interfaces` with type `infix-if-type:modem`
+     - References a modem component and a SIM component
+     - Holds bearer config: APN, IP type, roaming, route preference,
+       authentication
+     - Always added by the user, never auto-created
+
+## Naming Conventions
+
+| **Name Pattern** | **Type**             | **Description**                                 |
+|------------------|----------------------|-------------------------------------------------|
+| `modemN`         | Modem hardware       | Hardware component for the physical modem       |
+| `simN`           | SIM hardware         | Hardware component for the SIM card slot        |
+| `wwanN`          | Modem interface      | Network interface for cellular data             |
+
+Where `N` is a number (0, 1, 2, ...).
+
+> [!TIP]
+> Using these naming conventions simplifies configuration since type and
+> class are automatically inferred.  Creating a hardware component named
+> `modem0` automatically sets its class to `infix-hardware:modem`, and
+> creating an interface named `wwan0` automatically sets its type to
+> `infix-if-type:modem`.
+>
+> **Note:** This inference only works via the CLI.  When configuring
+> over NETCONF or RESTCONF the class and type must be set explicitly.
+
+## Multi-Bearer (Multiple APNs)
+
+Multiple wwan interfaces can reference the same modem component, each
+with a different APN.  Same idea as multi-SSID on a WiFi radio: one
+hardware modem, several independent data connections.
+
+Configure `wwan0` and `wwan1` both pointing to `modem0`:
+
+```
+edit interface wwan0 wwan
+set modem modem0
+set bearer apn internet
+
+edit interface wwan1 wwan
+set modem modem0
+set bearer apn corporate.vpn.apn
+```
+
+## Current Limitations
+
+- The modem must be present at boot.  Hot-plug is not supported.
+- If the modem is absent at boot, and no `probe-timeout` is set, a
+  dummy `wwan0` placeholder is created immediately so IP configuration
+  can proceed.  A reboot is required once the hardware is inserted.
+
+## Supported Modems
+
+Modems exposing a CDC-WDM control interface over USB are supported,
+regardless of physical form factor.  Two protocols are handled by
+ModemManager:
+
+- **MBIM**: Mobile Broadband Interface Model (e.g. Sierra Wireless,
+  Quectel EM06/EM12)
+- **QMI**: Qualcomm MSM Interface (e.g. Sierra Wireless EM7xxx,
+  Quectel EM/RMxxx)
+
+Most 4G/LTE modules (USB dongles, mPCIe cards, M.2 Key-B) use USB on
+the connector even when the slot also carries PCIe lanes.  From Infix's
+view they are all USB modems.  PCIe-only modems (some 5G NR modules)
+are not supported, since the modemd / ModemManager pipeline assumes a
+USB-attached control interface.
+
+## Step-by-step Setup
+
+### 1. Hardware Detection
+
+At first boot, USB modems detected by the kernel are written to
+`/run/system.json` and added as hardware components in the
+factory-default configuration.  Verify the modem appears:
+
+<pre class="cli"><code>admin@example:/> <b>show modem</b>
+──────────────────────────────────────────────────────────────
+<span class="title">Cellular Modems</span>
+NAME    MANUFACTURER  MODEL   STATE       NETWORK  SIGNAL
+modem0  Quectel       EM06-E  registered  lte      good
+──────────────────────────────────────────────────────────────
+<span class="title">SIM Cards</span>
+NAME  SLOT  STATE     OPERATOR
+sim0  1     unlocked  Tele2
+</code></pre>
+
+The `STATE`, `SIM STATE`, and `SIGNAL` columns are color-coded so the
+healthy / attention / problem cases are visible at a glance: green for
+`registered`, `connected`, `unlocked`, `excellent`, `good`; yellow for
+transient or attention states like `enabling`, `pin-required`, `poor`;
+red for `failed`, `not-inserted`, `bad`.
+
+If `modem0` does not appear:
+
+- Verify the kernel sees the modem (`dmesg | grep -i mbim` or
+  `dmesg | grep -i qmi`).  Without a kernel driver no further setup
+  is possible.
+- On boards with a custom factory configuration, or after replacing
+  hardware on a running system, the components may need to be added
+  manually.  See Step 2.
+
+### 2. Hardware Components
+
+If `show modem` already lists `modem0` and `sim0`, the components were
+auto-discovered into the factory-default configuration and you can skip
+ahead to Step 3.
+
+Otherwise, add them manually.  The class is inferred from the component
+name (`modemN` → `infix-hardware:modem`, `simN` → `infix-hardware:sim`).
+The `admin-state` must be set explicitly.  There is no implicit default,
+and without `unlocked` confd will not start ModemManager or modemd:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit hardware component modem0</b>
+admin@example:/config/hardware/component/modem0/> <b>set state admin-state unlocked</b>
+admin@example:/config/hardware/component/modem0/> <b>end</b>
+admin@example:/config/hardware/> <b>edit component sim0</b>
+admin@example:/config/hardware/component/sim0/> <b>set state admin-state unlocked</b>
+admin@example:/config/hardware/component/sim0/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+To take the modem offline cleanly without removing the configuration,
+set `admin-state locked`.  All related services are stopped and the
+bearer is torn down before the modem goes offline:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit hardware component modem0</b>
+admin@example:/config/hardware/component/modem0/> <b>set state admin-state locked</b>
+admin@example:/config/hardware/component/modem0/> <b>leave</b>
+</code></pre>
+
+#### Slow USB Modems
+
+USB modems can be slow to enumerate at boot.  The kernel wwan interface
+may not appear until several seconds after confd starts applying
+configuration.  The `probe-timeout` leaf inside the `modem` hardware
+configuration container controls how long confd waits.  It defaults to
+30 seconds when the container is present.
+
+To enable the timeout, create the modem configuration container (this
+also lets you configure bands, preferred mode, etc.):
+
+<pre class="cli"><code>admin@example:/config/> <b>edit hardware component modem0 modem</b>
+admin@example:/config/hardware/component/modem0/modem/> <b>leave</b>
+</code></pre>
+
+With `probe-timeout` at its default of 30, confd waits up to 30 seconds
+for the wwan interface to appear before proceeding.  For most modems it
+is ready in 2-5 seconds.  If the modem has not appeared within the
+timeout, a dummy placeholder interface is created and a reboot is
+required for the real interface to take over.  Set `probe-timeout 0`
+to disable waiting entirely.
+
+> [!NOTE]
+> Some Quectel modules (e.g. EM05) re-enumerate the USB device several
+> times during a cold-boot firmware-init sequence that takes around 50
+> to 60 seconds.  Bump `probe-timeout` to 90 for those, otherwise the
+> dummy placeholder fires before the modem settles and the real
+> interface ends up with a different name (`wwan1` instead of `wwan0`).
+
+### 3. Configure the Bearer (APN)
+
+Bearer configuration lives on the `wwan0` interface.  Reference the
+modem hardware component and set the APN:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface wwan0</b>
+admin@example:/config/interface/wwan0/> <b>set wwan modem modem0</b>
+admin@example:/config/interface/wwan0/> <b>set wwan sim sim0</b>
+admin@example:/config/interface/wwan0/> <b>set wwan bearer apn internet</b>
+admin@example:/config/interface/wwan0/> <b>leave</b>
+</code></pre>
+
+The modem will connect automatically once the bearer is configured and
+the hardware is unlocked.
+
+**Key bearer parameters:**
+
+- `apn`: Access Point Name, required, provided by your operator
+  (e.g. `internet`, `data.vodafone.com`, `web.tele2.se`)
+- `route-preference`: Administrative distance for the default route
+  (default: `200`).  Higher value = lower priority.  The default of 200
+  places cellular behind wired Ethernet (distance 5) and WiFi, so
+  cellular acts as a failover when the wired link is up
+- `roaming`: Allow data when roaming on a foreign network
+  (default: `false`)
+- `ip-type`: `ipv4`, `ipv6`, or `ipv4v6` dual-stack
+  (default: `ipv4v6`)
+
+### 4. Configure Authentication
+
+Most consumer APNs connect without credentials.  If your operator
+requires authentication, first store the password in the keystore, then
+reference it from the bearer.
+
+Create the keystore entry for the APN password:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit keystore symmetric-key apn-pass</b>
+admin@example:/config/keystore/…/apn-pass/> <b>set key-format passphrase-key-format</b>
+admin@example:/config/keystore/…/apn-pass/> <b>change cleartext-symmetric-key</b>
+Passphrase: ************
+Retype passphrase: ************
+admin@example:/config/keystore/…/apn-pass/> <b>leave</b>
+</code></pre>
+
+Then point the bearer's authentication at it:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface wwan0 wwan bearer</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>set authentication username myuser</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>set authentication password apn-pass</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>leave</b>
+</code></pre>
+
+Setting any leaf inside `authentication` creates the container, which
+enables authentication.  The `password` leaf is a reference to a
+symmetric key in the keystore, not the plaintext password itself.
+
+The authentication protocol defaults to `chap`.  To use PAP instead:
+
+<pre class="cli"><code>admin@example:/config/interface/wwan0/wwan/bearer/> <b>set authentication type pap</b>
+</code></pre>
+
+### 5. Configure SIM PIN
+
+If the SIM requires a PIN to unlock, configure it on the SIM hardware
+component:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit hardware component sim0</b>
+admin@example:/config/hardware/component/sim0/> <b>set sim pin 1234</b>
+admin@example:/config/hardware/component/sim0/> <b>leave</b>
+</code></pre>
+
+### 6. Verify Connectivity
+
+Once connected, the `wwan0` interface receives an IP address from the
+carrier and modemd installs the default route:
+
+<pre class="cli"><code>admin@example:/> <b>show interface wwan0</b>
+name                : wwan0
+type                : modem
+index               : 5
+mtu                 : 1500
+operational status  : up
+ip forwarding       : enabled
+physical address    : 12:34:56:78:9a:bc
+ipv4 addresses      : 10.142.87.33/30 (wwan)
+ipv6 addresses      : 2001:db8:1:2::1/64 (wwan)
+in-octets           : 84213
+out-octets          : 31456
+</code></pre>
+
+Check the full modem state including signal quality and registration:
+
+<pre class="cli"><code>admin@example:/> <b>show modem modem0</b>
+<span class="header">MODEM: modem0                                                 </span>
+──────────────────────────────────────────────────────────────
+<span class="title">Hardware Information</span>
+  Manufacturer        : Quectel
+  Model               : EM06-E
+  Firmware Version    : EM06ELAR04A07M4G
+  Serial Number       : 352753090141905
+  IMSI                : 240021234567890
+  ICCID               : 8946020000001234567
+──────────────────────────────────────────────────────────────
+<span class="title">Status</span>
+  State               : connected
+  Power State         : on
+  Signal              : Quality: 72% good  RSSI: -59 dBm  RSRP: -95 dBm  RSRQ: -11.0 dB
+──────────────────────────────────────────────────────────────
+<span class="title">Cellular</span>
+  Registration        : home
+  Service State       : attached
+  Operator            : Tele2
+  Operator ID         : 23002
+  Network Type        : lte
+──────────────────────────────────────────────────────────────
+<span class="title">SIM Card</span>
+  Name                : sim0
+  Slot                : 1
+  Lock State          : unlocked
+  Operator            : Tele2
+</code></pre>
+
+When the modem is in trouble, the same view shows why.  A
+`State: failed` line is followed by `Failed Reason` (e.g.
+`sim-missing`), and the `SIM Card` section's `Lock State` reads
+`not-inserted` or `pin-required` to match.
+
+## Cellular Failover
+
+The default `route-preference` (200) is deliberately higher than the
+distances used by wired Ethernet (udhcpc default: 5) and WiFi.  When a
+wired link is up it takes precedence automatically; cellular becomes
+the active path only if higher-priority routes are withdrawn.
+
+A default route via the bearer is always installed when the bearer
+connects.  To adjust the failover priority between two cellular modems,
+or to prefer cellular over WiFi, set `route-preference` explicitly:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit interface wwan0 wwan bearer</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>set route-preference 100</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>leave</b>
+</code></pre>
+
+Lower `route-preference` = higher priority.
+
+## Roaming
+
+Data roaming is disabled by default.  To allow the modem to connect
+when on a foreign (roaming) network:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit interface wwan0 wwan bearer</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>set roaming true</b>
+admin@example:/config/interface/wwan0/wwan/bearer/> <b>leave</b>
+</code></pre>
+
+> [!IMPORTANT]
+> Enabling roaming may incur significant charges depending on your
+> mobile subscription.  Check with your operator before enabling.
+
+## Management Commands
+
+### Restart Bearer
+
+Disconnect and reconnect all bearers without resetting the modem
+hardware.  Use this after changing APN or authentication settings:
+
+<pre class="cli"><code>admin@example:/> <b>modem restart modem0</b>
+</code></pre>
+
+### Reset Modem
+
+Factory-reset the modem firmware.  This clears all modem-internal
+settings and takes longer than a restart.  Only use it if the modem is
+in a bad state that a bearer restart cannot fix:
+
+<pre class="cli"><code>admin@example:/> <b>modem reset modem0</b>
+</code></pre>
+
+> [!NOTE]
+> Not all modules accept `--reset` from ModemManager.  Quectel EM05,
+> for example, rejects both `--reset` and `--factory-reset`.  The only
+> way to recover from a hung firmware on these is a physical power
+> cycle.  When the modem reports the rejection, modemd logs it once and
+> stops retrying.
+
+### Send SMS
+
+Send an SMS message via the signalling plane.  No active data bearer
+is required; the modem only needs to be registered on the network:
+
+<pre class="cli"><code>admin@example:/> <b>modem sms modem0 +46701234567 "Hello from Infix"</b>
+</code></pre>
+
+> [!NOTE]
+> Some SIM cards have Fixed Dialing Number (FDN) enabled, which
+> restricts outgoing SMS and calls to a pre-configured whitelist.  If
+> `modem sms` fails, check whether FDN is active with `mmcli -m 0` and
+> look for `enabled locks: fixed-dialing` in the output.
+
+## Troubleshooting
+
+**Modem not detected (`show modem` shows no modem entry)**
+
+- Verify the modem is connected and recognized by the kernel: check
+  `dmesg` for `cdc_mbim` or `qmi_wwan` driver messages
+- Confirm `/sys/class/usbmisc/` contains a `cdc-wdm*` entry
+- The modem must be present at boot; hotplug after boot is not
+  supported
+
+**`wwan0` shows as `down` or has no IP address**
+
+- Check `show modem modem0`.  The State should show `registered` or
+  `connected`, not `failed`
+- If the State is `failed`, look at the `Failed Reason` line that
+  immediately follows:
+    - `sim-missing`: the SIM Card section will also show
+      `Lock State: not-inserted`.  Power off the device, insert the
+      SIM, power back on.  A warm reboot is not enough; on most M.2
+      slots the SIM tray stays powered through reboot, so the modem
+      keeps the original not-inserted reading
+    - `unlock-required`: the SIM Card section will show
+      `Lock State: pin-required`.  Configure the PIN with
+      `set hardware component sim0 sim pin <code>`
+    - `sim-wrong` / `sim-error`: the SIM is not compatible or is
+      damaged.  Try a different SIM
+- Verify the APN is correct for your operator
+- Check system logs with `show log` for modemd or ModemManager
+  messages
+
+**`wwan0` interface is a dummy (no data flows, no carrier address)**
+
+- The modem was not enumerated by the kernel before confd applied
+  config
+- Create the modem hardware configuration container (see Step 2),
+  which enables the default 30-second probe-timeout so confd waits for
+  the wwan interface before falling back to a dummy placeholder
+
+**High latency or poor signal**
+
+- Use `show modem modem0` to check signal quality and RSRP
+- Signal below -110 dBm RSRP typically indicates poor coverage
+- Consider repositioning the antenna or the device
@@ -4,12 +4,10 @@ oem-dir := $(call qstrip,$(INFIX_OEM_PATH))
 INFIX_TOPDIR = $(if $(oem-dir),$(oem-dir),$(BR2_EXTERNAL_INFIX_PATH))

 # Unless the user specifies an explicit build id, source it from git.
-# Exclude the moving 'latest*' tags so the version always resolves to a
-# real release tag, see issue #1524.  The build id is also the version
-# shown to users; INFIX_RELEASE only labels the release channel and names
-# artifacts (see INFIX_ARTIFACT below).
-export INFIX_BUILD_ID ?= $(shell git -C $(INFIX_TOPDIR) describe --dirty --always --tags --exclude 'latest*')
-export INFIX_VERSION = $(INFIX_BUILD_ID)
+# The build id also becomes the image version, unless an official
+# release is being built.
+export INFIX_BUILD_ID ?= $(shell git -C $(INFIX_TOPDIR) describe --dirty --always --tags)
+export INFIX_VERSION = $(if $(INFIX_RELEASE),$(INFIX_RELEASE),$(INFIX_BUILD_ID))
 export INFIX_ARTIFACT = $(call qstrip,$(INFIX_IMAGE_ID)$(if $(INFIX_RELEASE),-$(INFIX_RELEASE)))

 INFIX_CFLAGS:=-Wall -Werror -Wextra -Wno-unused-parameter -Wformat=2 -Wformat-overflow=2 -Winit-self -Wstrict-overflow=4 -Wno-format-truncation -Wno-format-nonliteral
@@ -44,6 +44,7 @@ nav:
          - Overview: vpn.md
          - WireGuard: vpn-wireguard.md
      - Wireless LAN (WiFi): wifi.md
+      - Cellular Modem (wwan): modem.md
  - Services:
      - Device Discovery: discovery.md
      - DHCP Server: dhcp.md
@@ -2,6 +2,7 @@ menu "Packages"

 comment "Hardware Support"
 source "$BR2_EXTERNAL_INFIX_PATH/package/feature-gps/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/feature-modem/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/feature-wifi/Config.in"

 comment "Software Packages"
@@ -30,6 +31,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/landing/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/libsrx/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/lowdown/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/mcd/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/modemd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/mdns-alias/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/netbrowse/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/onieprom/Config.in"
@@ -42,7 +44,6 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/tetris/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/libyang-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/webui/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rauc-installation-status/Config.in"
@@ -1,11 +1,9 @@
-#set DEBUG=1
-
 # Single daemon handles gen-config, datastore init, config load, and plugins
-#  log:prio:daemon.err
-service log:console env:/etc/default/confd           \
+service log:console env:/etc/default/confd        \
 	[S12345] <usr/ixinit> confd -f -v warning \
-		-F /etc/factory-config.cfg \
-		-S /cfg/startup-config.cfg \
-		-E /etc/failure-config.cfg \
-		-t $CONFD_TIMEOUT \
+		-F /etc/factory-config.cfg        \
+		-S /cfg/startup-config.cfg        \
+		-E /etc/failure-config.cfg        \
+		-t $CONFD_TIMEOUT                 \
+		$CONFD_ARGS                       \
 	-- Configuration daemon
@@ -36,10 +36,8 @@ else
 CONFD_CONF_OPTS += --disable-gps
 endif
 define CONFD_INSTALL_EXTRA
-	for fn in confd.conf crond.conf resolvconf.conf; do \
-		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
-	done
 	for fn in confd.conf resolvconf.conf; do \
+		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
 		ln -sf ../available/$$fn $(FINIT_D)/enabled/$$fn; \
 	done
 	cp $(CONFD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/etc/tmpfiles.d/confd.conf
@@ -93,10 +91,10 @@ define CONFD_INSTALL_YANG_MODULES_GPS
 	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/gps.inc
 endef
 endif
-ifeq ($(BR2_PACKAGE_WEBUI),y)
-define CONFD_INSTALL_YANG_MODULES_WEBUI
+ifeq ($(BR2_PACKAGE_FEATURE_MODEM),y)
+define CONFD_INSTALL_YANG_MODULES_MODEM
 	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/web.inc
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/modem.inc
 endef
 endif

@@ -129,7 +127,7 @@ CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WIFI
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_GPS
-CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WEBUI
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_MODEM
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_IN_ROMFS
 CONFD_TARGET_FINALIZE_HOOKS += CONFD_CLEANUP

@@ -1,2 +0,0 @@
-# Cron daemon for infix-schedule
-service [2345] crond -f -- Cron daemon
@@ -0,0 +1,25 @@
+config BR2_PACKAGE_FEATURE_MODEM
+	bool "Feature Modem"
+	select BR2_PACKAGE_MODEMD
+	select BR2_PACKAGE_MODEM_MANAGER
+	select BR2_PACKAGE_MODEM_MANAGER_ATVIADBUS
+	select BR2_PACKAGE_MODEM_MANAGER_LIBMBIM
+	select BR2_PACKAGE_MODEM_MANAGER_LIBQMI
+	select BR2_PACKAGE_MODEM_MANAGER_LIBQRTR
+	help
+	  Enables cellular modem support in Infix via ModemManager and
+	  the modemd management daemon.  Includes drivers for common
+	  USB option modems and QMI/MBIM-based devices.
+
+	  ATVIADBUS allows raw AT commands over D-Bus (used by modemd to
+	  enable GPS NMEA output via vendor-specific AT commands such as
+	  AT+QGPS=1) without needing to start ModemManager in --debug
+	  mode.
+
+config BR2_PACKAGE_FEATURE_MODEM_QUALCOMM
+	bool "Qualcomm-based modems (QMI/QRTR/MHI)"
+	depends on BR2_PACKAGE_FEATURE_MODEM
+	help
+	  Adds kernel support for Qualcomm-based cellular modems that use
+	  the MHI bus and QRTR IPC router (e.g. Sierra Wireless EM7xxx,
+	  Quectel EM/RMxxx, Telit LN9xx).
@@ -0,0 +1,26 @@
+################################################################################
+#
+# Cellular modem support
+#
+################################################################################
+
+FEATURE_MODEM_PACKAGE_VERSION = 1.0
+FEATURE_MODEM_PACKAGE_LICENSE = MIT
+
+define FEATURE_MODEM_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_SERIAL)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_SERIAL_WWAN)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_SERIAL_OPTION)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_WDM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_NET_QMI_WWAN)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_CDC_MBIM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_NET_CDC_MBIM)
+
+	$(if $(filter y,$(BR2_PACKAGE_FEATURE_MODEM_QUALCOMM)),
+		$(call KCONFIG_SET_OPT,CONFIG_QRTR,m)
+		$(call KCONFIG_SET_OPT,CONFIG_MHI_BUS,m)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_QRTR_MHI)
+	)
+endef
+
+$(eval $(generic-package))
@@ -14,8 +14,6 @@ define LANDING_INSTALL_TARGET_CMDS
        mkdir -p $(TARGET_DIR)/usr/html/
 	cp $(@D)/*.html $(TARGET_DIR)/usr/html/
 	cp $(@D)/*.png  $(TARGET_DIR)/usr/html/
-	$(INSTALL) -D -m 0644 $(LANDING_PKGDIR)/default.conf \
-		$(TARGET_DIR)/etc/nginx/available/default.conf
 endef

 $(eval $(generic-package))
@@ -0,0 +1,6 @@
+config BR2_PACKAGE_MODEMD
+	bool "modemd"
+	select BR2_PACKAGE_MODEM_MANAGER
+	select BR2_PACKAGE_PYTHON3
+	help
+	  Daemon which manages modems.
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  25b33026a661c4c550374cfcba6890a4363bf19db0c1c31a6e65b5edd113ecf0  LICENSE
@@ -0,0 +1,56 @@
+################################################################################
+#
+# modemd
+#
+################################################################################
+
+MODEMD_VERSION = 1.0
+MODEMD_SITE_METHOD = local
+MODEMD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/modemd
+MODEMD_LICENSE = BSD-3-Clause
+MODEMD_LICENSE_FILES = LICENSE
+MODEMD_REDISTRIBUTE = NO
+MODEMD_DEPENDENCIES = modem-manager jansson python3 \
+	host-python3 host-python-pypa-build host-python-installer \
+	host-python-poetry-core
+
+define MODEMD_BUILD_CMDS
+    $(TARGET_CC) $(TARGET_CFLAGS) $(TARGET_LDFLAGS) \
+        $(MODEMD_DIR)/modem-command.c -o $(MODEMD_DIR)/modem-command -ljansson
+endef
+
+define MODEMD_BUILD_PYTHON
+	cd $(MODEMD_SITE) && \
+		$(PKG_PYTHON_PEP517_ENV) $(HOST_DIR)/bin/python3 $(PKG_PYTHON_PEP517_BUILD_CMD) -o $(@D)/dist
+	mkdir -p $(TARGET_DIR)/usr/libexec/modemd
+	rm -f $(TARGET_DIR)/usr/libexec/modemd/modemd \
+		$(TARGET_DIR)/usr/libexec/modemd/modem-* \
+		$(TARGET_DIR)/usr/libexec/modemd/sim-setup
+	cd $(@D) && \
+		$(HOST_DIR)/bin/python3 $(TOPDIR)/support/scripts/pyinstaller.py \
+			dist/*.whl \
+			--interpreter=/usr/bin/python3 \
+			--script-kind=posix \
+			--purelib=$(TARGET_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages \
+			--headers=$(TARGET_DIR)/usr/include/python$(PYTHON3_VERSION_MAJOR) \
+			--scripts=$(TARGET_DIR)/usr/libexec/modemd \
+			--data=$(TARGET_DIR)
+endef
+MODEMD_POST_INSTALL_TARGET_HOOKS += MODEMD_BUILD_PYTHON
+
+define MODEMD_INSTALL_TARGET_CMDS
+	mkdir -p $(TARGET_DIR)/usr/libexec/modemd
+	mkdir -p $(TARGET_DIR)/lib/udev/rules.d
+	mkdir -p $(FINIT_D)/available/
+	mkdir -p $(TARGET_DIR)/sbin
+	$(INSTALL) -D -m 0644 $(MODEMD_DIR)/finit.conf $(FINIT_D)/available/modemd.conf
+	install -m 644 $(MODEMD_DIR)/modemd.rules $(TARGET_DIR)/lib/udev/rules.d/90-modemd.rules
+	install -m 644 $(MODEMD_DIR)/qmi-wwan-ids.rules $(TARGET_DIR)/lib/udev/rules.d/91-qmi-wwan-ids.rules
+	install -m 644 $(MODEMD_DIR)/77-mm-dell-port-types.rules $(TARGET_DIR)/etc/udev/rules.d/77-mm-dell-port-types.rules
+	install -m 644 $(MODEMD_DIR)/77-mm-modem-gps.rules $(TARGET_DIR)/etc/udev/rules.d/77-mm-modem-gps.rules
+	install -D -m 644 $(MODEMD_DIR)/modemd.modules-load $(TARGET_DIR)/etc/modules-load.d/modemd.conf
+	install -m 755 $(MODEMD_DIR)/modem-command $(TARGET_DIR)/sbin/modem-command
+	ln -sf /usr/libexec/modemd/modemd $(TARGET_DIR)/sbin/modemd
+endef
+
+$(eval $(generic-package))
@@ -0,0 +1 @@
+service [2345789] ModemManager -- ModemManager daemon
@@ -1,30 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<title>Loading…</title>
-<meta charset="utf-8">
-<meta http-equiv="refresh" content="3">
-<style>
-  html { color-scheme: light dark; font-family: Tahoma, Verdana, Arial, sans-serif; }
-  body { max-width: 32em; margin: 4em auto; text-align: center; }
-  h1 { font-weight: 500; margin-bottom: 0.5em; }
-  p { color: #888; margin: 0.5em 0; }
-  .spinner {
-    display: inline-block;
-    width: 1.5em;
-    height: 1.5em;
-    margin-top: 1em;
-    border: 3px solid currentColor;
-    border-top-color: transparent;
-    border-radius: 50%;
-    animation: rot 1s linear infinite;
-  }
-  @keyframes rot { to { transform: rotate(360deg); } }
-</style>
-</head>
-<body>
-<h1>Loading…</h1>
-<p>The device is finishing its startup. This page refreshes automatically.</p>
-<p><span class="spinner" aria-hidden="true"></span></p>
-</body>
-</html>
@@ -1,9 +0,0 @@
-config BR2_PACKAGE_WEBUI
-	bool "webui"
-	depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
-	depends on BR2_PACKAGE_ROUSETTE
-	depends on !BR2_PACKAGE_LANDING
-	help
-	  Web management interface for Infix, a Go+HTMX application
-	  that provides browser-based configuration and monitoring
-	  via RESTCONF.
@@ -1,44 +0,0 @@
-# Throttle POST /login so a brute-force attempt can't pin the box on
-# the bcrypt-shaped credential check inside rousette/PAM. GET is left
-# unmetered: page loads after a 401-driven HX-Redirect shouldn't eat
-# into the budget.
-#
-# Zone is 32k (~500 IPs) — the minimum nginx accepts via shared-memory
-# allocation. With the cache full an attacker rotating source addresses
-# still tops out at ~2500 attempts/min total, all serialised through
-# bcrypt one at a time.
-#
-# 429 instead of the default 503 keeps the rate-limit response out of
-# the /50x.html error_page rewrite below (which auto-refreshes — would
-# loop a throttled client straight back to /login).
-map $request_method $webui_login_key {
-    POST    $binary_remote_addr;
-    default "";
-}
-limit_req_zone   $webui_login_key zone=webui_login:32k rate=5r/m;
-limit_req_status 429;
-
-server {
-    listen       80;
-    listen       [::]:80;
-    server_name  _;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen       443 ssl;
-    listen       [::]:443 ssl;
-    server_name  _;
-    include      ssl.conf;
-
-    # 404 also points at /50x.html: the page is a "Loading…" screen
-    # with a meta-refresh, so the early-boot window where the Go
-    # backend isn't up yet (and any other transient 404 / 5xx) self-
-    # recovers as soon as upstream comes back.
-    error_page   404 500 502 503 504  /50x.html;
-    location = /50x.html {
-	root   html;
-    }
-
-    include /etc/nginx/app/*.conf;
-}
@@ -1,11 +0,0 @@
-# Shared proxy-pass shape for the webui upstream. Nested locations that
-# declare their own proxy_* directives don't inherit from the outer block,
-# so each location includes this file rather than relying on inheritance.
-
-proxy_pass         http://127.0.0.1:10000;
-proxy_http_version 1.1;
-proxy_set_header   Host $host;
-proxy_set_header   X-Real-IP $remote_addr;
-proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header   X-Forwarded-Proto $scheme;
-proxy_redirect     off;
@@ -1,72 +0,0 @@
-# Must be at server scope, not on an inner location: client_max_body_size
-# does not inherit into a nested location that declares its own proxy_pass,
-# and the http-level 1m default would silently apply and reject bundle
-# uploads with 413.
-client_max_body_size 256m;
-
-location / {
-    include /etc/nginx/webui-proxy.conf;
-}
-
-# burst=3 nodelay: three POSTs land back-to-back; the next needs a
-# fresh token (~12 s at 5r/m) or 429s.
-location = /login {
-    limit_req zone=webui_login burst=3 nodelay;
-    include /etc/nginx/webui-proxy.conf;
-}
-
-# Keep proxy_request_buffering on (the default). Streaming the body races
-# the Go handler's response close, producing RST instead of FIN at
-# Content-Length and a client-visible 502. nginx spools the body to
-# /var/cache/nginx/client-body during the upload instead.
-location = /software/upload {
-    proxy_read_timeout 600s;
-    include /etc/nginx/webui-proxy.conf;
-}
-
-# SSE progress stream: RAUC's Progress D-Bus property doesn't change while
-# it's writing a slot, so the upstream goes minutes without a frame. The
-# default 60 s proxy_read_timeout closes the stream and the browser sees
-# a transient error. Raise to cover a slow image write end-to-end.
-location = /software/progress {
-    proxy_read_timeout 1800s;
-    proxy_buffering off;
-    include /etc/nginx/webui-proxy.conf;
-}
-
-# SSE live-tail stream for Maintenance > Logs.  Same buffering / timeout
-# concerns as the software progress stream: nginx must not buffer the
-# event frames, and the connection has to stay open through quiet logs.
-# The Go side sends a 15 s heartbeat, so 600 s of read timeout is plenty
-# of safety margin.
-location ~ ^/maintenance/logs/[^/]+/tail$ {
-    proxy_read_timeout 600s;
-    proxy_buffering off;
-    include /etc/nginx/webui-proxy.conf;
-}
-
-# Support bundle collection runs `support collect`, which emits nothing
-# until it finishes (~50 s) and then sends the whole archive at once.
-# The upstream is silent for that window, so the default 60 s
-# proxy_read_timeout would 504 just as the bundle is ready.  Buffering
-# stays on — it's a plain file download, not a stream.
-location = /maintenance/support-bundle {
-    proxy_read_timeout 300s;
-    include /etc/nginx/webui-proxy.conf;
-}
-
-# On-device User's Guide: the mkdocs site bundled into the rootfs at
-# /var/www/guide by post-build.sh.  Served as static files (no upstream
-# call), public like the published guide.  Present only when the build
-# host had mkdocs; the WebUI hides its User Guide entry when it's absent.
-location /guide/ {
-    alias /var/www/guide/;
-    index index.html;
-}
-
-# Liveness probe — nginx-only, no upstream call. Used by the watchdog
-# div in base.html and the reboot-overlay poller.
-location = /device-status {
-    access_log off;
-    return 204;
-}
@@ -1,29 +0,0 @@
-################################################################################
-#
-# webui
-#
-################################################################################
-
-WEBUI_VERSION = 1.0
-WEBUI_SITE_METHOD = local
-WEBUI_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/webui
-WEBUI_GOMOD = infix/webui
-WEBUI_LICENSE = MIT
-WEBUI_LICENSE_FILES = LICENSE
-WEBUI_REDISTRIBUTE = NO
-
-define WEBUI_INSTALL_EXTRA
-	$(INSTALL) -D -m 0644 $(WEBUI_PKGDIR)/webui.svc \
-		$(FINIT_D)/available/webui.conf
-	$(INSTALL) -D -m 0644 $(WEBUI_PKGDIR)/webui.conf \
-		$(TARGET_DIR)/etc/nginx/app/webui.conf
-	$(INSTALL) -D -m 0644 $(WEBUI_PKGDIR)/webui-proxy.conf \
-		$(TARGET_DIR)/etc/nginx/webui-proxy.conf
-	$(INSTALL) -D -m 0644 $(WEBUI_PKGDIR)/default.conf \
-		$(TARGET_DIR)/etc/nginx/available/default.conf
-	$(INSTALL) -D -m 0644 $(WEBUI_PKGDIR)/50x.html \
-		$(TARGET_DIR)/usr/html/50x.html
-endef
-WEBUI_POST_INSTALL_TARGET_HOOKS += WEBUI_INSTALL_EXTRA
-
-$(eval $(golang-package))
@@ -1,3 +0,0 @@
-service <!> name:webui log:prio:daemon.info,tag:webui \
-	[2345] env:-/etc/default/webui webui -listen 127.0.0.1:10000 \
-	-- Web management interface
@@ -0,0 +1,21 @@
+diff --git a/src/qmi-firmware-update/qfu-helpers-udev.c b/src/qmi-firmware-update/qfu-helpers-udev.c
+index bda9106..40d648f 100644
+--- a/src/qmi-firmware-update/qfu-helpers-udev.c
+++ b/src/qmi-firmware-update/qfu-helpers-udev.c
+@@ -364,8 +364,14 @@ device_matches (GUdevDevice          *device,
+     if (!device_sysfs_path)
+         goto out;
+ 
+-    if (g_strcmp0 (device_sysfs_path, sysfs_path) != 0)
+-        goto out;
+    /*
+     * don't compare sysfs path for download mode as it
+     * changes from USB4 to USB3 and thus may use a different host controller
+     */
+    if (mode != QFU_HELPERS_DEVICE_MODE_DOWNLOAD) {
+        if (g_strcmp0 (device_sysfs_path, sysfs_path) != 0)
+            goto out;
+    }
+ 
+     if (device_mode != mode)
+         return NULL;
@@ -1,4 +1,4 @@
-From f614327b6eca20319f5eee20ac954ea8d92276e4 Mon Sep 17 00:00:00 2001
+From 2b86219131c6bed9658c75334e0b2748d4b68c04 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 01/50] net: phy: marvell10g: Support firmware loading on
@@ -1,4 +1,4 @@
-From 7d453cb838611f44d7566b6174ae95a5d2265fa1 Mon Sep 17 00:00:00 2001
+From 9eb5c192c3c76f9141b344d3bbbc954a0e4be50e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 02/50] net: phy: marvell10g: Fix power-up when strapped to
@@ -1,4 +1,4 @@
-From 4b08a36e3107c4018ddf3a19760cc87d02281bd7 Mon Sep 17 00:00:00 2001
+From c08724121dc4d08ac783333a2ac38178649c918c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 03/50] net: phy: marvell10g: Add LED support for 88X3310
@@ -1,4 +1,4 @@
-From e5e81eb1172db22be7c83efc8071108d0d42565e Mon Sep 17 00:00:00 2001
+From cd914eb2ac2b86240294108f4d4ab18b0bfbb44b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 04/50] net: phy: marvell10g: Support LEDs tied to a single
@@ -1,4 +1,4 @@
-From 1f735096f1b8920ee6f21bf60a4c2d3f6376adeb Mon Sep 17 00:00:00 2001
+From 25d84725be05967330bbeaac957fade38e338e40 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 05/50] net: phy: Do not resume PHY when attaching
@@ -19,10 +19,10 @@ administratively down.
 1 file changed, 1 deletion(-)

 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 26b08e3dbd1d..7597308534a0 100644
+index 78cf05a17f8f..ddf47a586a5a 100644
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1753,7 +1753,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
+@@ -1750,7 +1750,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
 	if (err)
 		goto error;
 
@@ -1,4 +1,4 @@
-From e38d2d2f07f55819d2191d4282dc2d4688075d7d Mon Sep 17 00:00:00 2001
+From cb1dbb66184b3a07f8da93d8a52a56e77d97b98f Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 06/50] net: bridge: avoid classifying unknown multicast as
@@ -1,4 +1,4 @@
-From a9b80b26c96e5492ab32a72ee36e3321a2b90ee9 Mon Sep 17 00:00:00 2001
+From 66e1ca5038625bc0feb132edf07953b2e6c350da Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 07/50] net: bridge: Ignore router ports when forwarding L2
@@ -1,4 +1,4 @@
-From 01e41d87efa1b63d292f0acfe4d1fb0e39baab20 Mon Sep 17 00:00:00 2001
+From 31bfb62384ef4b09238f93db137547d0d6d63663 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 08/50] net: bridge: drop delay for applying strict multicast
@@ -1,4 +1,4 @@
-From 944c77d075c8e0655bd3a28e96892261465a5cf4 Mon Sep 17 00:00:00 2001
+From c16b809eb7ef941870dcfb6ecceab83570fcd223 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 09/50] net: bridge: Differentiate MDB additions from
@@ -1,4 +1,4 @@
-From 3f58061ab8f869a6432a1256ee7422bb157b624e Mon Sep 17 00:00:00 2001
+From 4ba33d783110e4559b5abfcfd8c095f0e71befc5 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 10/50] nvmem: layouts: onie-tlv: Let device probe even when
@@ -17,10 +17,10 @@ simply refrain from registering any cells in those cases.
 1 file changed, 3 insertions(+), 3 deletions(-)

 diff --git a/drivers/nvmem/layouts/onie-tlv.c b/drivers/nvmem/layouts/onie-tlv.c
-index 8b0f3c1b8a0e..de85690aaa30 100644
+index 0967a32319a2..48547d5bb502 100644
 --- a/drivers/nvmem/layouts/onie-tlv.c
 +++ b/drivers/nvmem/layouts/onie-tlv.c
-@@ -198,7 +198,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
+@@ -197,7 +197,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
 
 	if (!onie_tlv_hdr_is_valid(dev, &hdr)) {
 		dev_err(dev, "Invalid ONIE TLV header\n");
@@ -29,7 +29,7 @@ index 8b0f3c1b8a0e..de85690aaa30 100644
 	}
 
 	hdr_len = sizeof(hdr.id) + sizeof(hdr.version) + sizeof(hdr.data_len);
-@@ -206,7 +206,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
+@@ -205,7 +205,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
 	table_len = hdr_len + data_len;
 	if (table_len > ONIE_TLV_MAX_LEN) {
 		dev_err(dev, "Invalid ONIE TLV data length\n");
@@ -38,7 +38,7 @@ index 8b0f3c1b8a0e..de85690aaa30 100644
 	}
 
 	table = devm_kmalloc(dev, table_len, GFP_KERNEL);
-@@ -218,7 +218,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
+@@ -217,7 +217,7 @@ static int onie_tlv_parse_table(struct nvmem_layout *layout)
 		return ret;
 
 	if (!onie_tlv_crc_is_valid(dev, table_len, table))
@@ -1,4 +1,4 @@
-From f492d4efac3a65bca4d53e383336c36113e28a8b Mon Sep 17 00:00:00 2001
+From f19c6a56de0743c906cbef917bc201d0c5a74c99 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 11/50] net: usb: r8152: add r8153b support for link/activity
@@ -18,7 +18,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 1 file changed, 8 insertions(+)

 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index 8cf4e81f8f88..1bb93efb96c6 100644
+index d61074178279..701cc975cf11 100644
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
@@ -41,6 +41,11 @@
@@ -1,4 +1,4 @@
-From a2448b84e5483b5b91b46ac31b27609352fd9ed6 Mon Sep 17 00:00:00 2001
+From daed6dc750e19a316a1a3db62df42ca31f830bd9 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 10 Aug 2025 18:52:54 +0200
 Subject: [PATCH 12/50] arm64: dts: mediatek: mt7986a: rename BPi R3 ports to
@@ -1,4 +1,4 @@
-From c4ac90dcc5aefbb704c70ebbfe041dee683b882b Mon Sep 17 00:00:00 2001
+From 42a6936aeb6ed136f7ce7524551307d6eecb3d95 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 20 Aug 2025 21:38:24 +0200
 Subject: [PATCH 13/50] drm/panel-simple: Add a timing for the Raspberry Pi 7"
@@ -1,4 +1,4 @@
-From 8da101ec2429ba0bf1410346260f9a7ddfb0bdbe Mon Sep 17 00:00:00 2001
+From c83feafa1899f66855f13b8a5c63a3f04b037686 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 21 Aug 2025 11:20:23 +0200
 Subject: [PATCH 14/50] input:touchscreen:edt-ft5x06: Add polled mode
@@ -1,4 +1,4 @@
-From 93646f890903157bb78ef369ddf9d99a9161de0d Mon Sep 17 00:00:00 2001
+From cb3652859a4c5f0ffad4b4cae5d112370829f9ad Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 15/50] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
@@ -1,4 +1,4 @@
-From 29cfa1b5ffba41728dc5e0991d1ee27b903d569c Mon Sep 17 00:00:00 2001
+From abe555c35cf1f2c35f0b9b05917abb5f5470564e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 16/50] net: dsa: mv88e6xxx: Improve indirect register access
@@ -1,4 +1,4 @@
-From a7fa9a45329781519702d46ba05815433fff4acc Mon Sep 17 00:00:00 2001
+From 1e0374357606ce86a7fad14d3eedbf650cab2f31 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 17/50] net: dsa: mv88e6xxx: Honor ports being managed via
@@ -1,4 +1,4 @@
-From cda7100b0a29e6a9bd29a67ff9db3bcccb72065c Mon Sep 17 00:00:00 2001
+From f3a986c8529106e426b0fb5ecafdb0a852a0f344 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 18/50] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
@@ -1,4 +1,4 @@
-From ccf9f9262e8570cfd522b841465f3edf76b3447a Mon Sep 17 00:00:00 2001
+From 8eaf45f3a3c527db200164eb44a234a33bea0024 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 19/50] net: dsa: tag_dsa: Use tag priority as initial
@@ -1,4 +1,4 @@
-From 3200169701ef4d9afdea35355b3fe41d6f363134 Mon Sep 17 00:00:00 2001
+From 01af01f03f4bbaeead33d32f5f8b340a02aca16c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 20/50] net: dsa: Support MDB memberships whose L2 addresses
@@ -1,4 +1,4 @@
-From dea9ff6c0bdf7c3e4abc2fb507d2ab4b94dabb63 Mon Sep 17 00:00:00 2001
+From ee554d75ddc33549f25c132f394ce346dc661cf9 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 21/50] net: dsa: Support EtherType based priority overrides
@@ -1,4 +1,4 @@
-From 1dc01d7420e3d511babfbdeda742d93527d72abb Mon Sep 17 00:00:00 2001
+From f98cab13a16a82fe236ce37c2c82a18e4a23b09e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 22/50] net: dsa: mv88e6xxx: Support EtherType based priority
@@ -1,4 +1,4 @@
-From caed0d150badbb040e403975645bf09ba3f44e76 Mon Sep 17 00:00:00 2001
+From 638afa80161cc8f42ba8836c05a707fe648eca80 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 23/50] net: dsa: mv88e6xxx: Add mqprio qdisc support
@@ -1,4 +1,4 @@
-From 1bd5b0e8a5574209b386d6d8bc1cf3bcf2e4fd5e Mon Sep 17 00:00:00 2001
+From 25b86dcdf614b83ffdb105d401fffcc81c4a9a8c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 24/50] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
@@ -1,4 +1,4 @@
-From 7894882d70e8223939a6d9a0e15cc6bbc08ae33c Mon Sep 17 00:00:00 2001
+From 3e66363612ee2fe156f645df9b2755a12ff3bbb9 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 25/50] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
@@ -1,4 +1,4 @@
-From 09cb11eaf5cc754274620ff6eaedf768c9605e44 Mon Sep 17 00:00:00 2001
+From 0eb8674921110e40d540fec2f66862bb7a377d9a Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 16 Jan 2025 12:35:12 +0100
 Subject: [PATCH 26/50] net: dsa: mv88e6xxx: collapse disabled state into
@@ -1,4 +1,4 @@
-From 7127fd4194cde754cbc9ea869c9e65e335701d95 Mon Sep 17 00:00:00 2001
+From 107a289d4867d42b9ac8d780707e2492a6eec415 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 12 Feb 2025 22:03:14 +0100
 Subject: [PATCH 27/50] net: dsa: mv88e6xxx: Only activate LAG offloading when
@@ -1,4 +1,4 @@
-From c2f3d9277e12e7622651b521af8b43b1fe036cf0 Mon Sep 17 00:00:00 2001
+From 12f57474f41cbf2ff076fcbcb218b6fdf6ae95a1 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 14 Jan 2026 18:22:41 +0100
 Subject: [PATCH 28/50] net: dsa: mv88e6xxx: Add LED support for 6393X
@@ -1,4 +1,4 @@
-From ac98be8b6fd1b6afa264c68685d5dc82d73da1f8 Mon Sep 17 00:00:00 2001
+From 81798fe8ca0fdd8f45b110abc47caa5c42f7b383 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 15 Jan 2026 22:47:37 +0100
 Subject: [PATCH 29/50] wifi: brcmfmac: support deletion and recreation of
@@ -1,4 +1,4 @@
-From 9f1110fe13c878c49d28859f27bd90bc1b77f7bc Mon Sep 17 00:00:00 2001
+From 78f0ed92b27420a7c4ac639b39ac84c8106744d4 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Mon, 19 Jan 2026 13:06:53 +0100
 Subject: [PATCH 30/50] wifi: brcmfmac: check connection state before querying
@@ -1,4 +1,4 @@
-From 188203d0d4eeeb607b29efa344280189c2566f30 Mon Sep 17 00:00:00 2001
+From 8517f96105f0bad1fb74640fc5dc9a5d6bc161f3 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Tue, 20 Jan 2026 20:12:10 +0100
 Subject: [PATCH 31/50] wifi: brcmfmac: suppress log spam for
@@ -1,4 +1,4 @@
-From c02051fdfbcedf99bac490bcb0358774774e2bcf Mon Sep 17 00:00:00 2001
+From 185b4ae0e255c1d4b46c4be50170a927b741c4fe Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Tue, 20 Jan 2026 20:18:45 +0100
 Subject: [PATCH 32/50] wifi: brcmfmac: reduce log noise during AP to station
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`service [2345789] ModemManager -- ModemManager daemon`