removed patch, will put back before pr

fix: fixed cli arguments being ignored
removed wifi autostart - prep for release
2026-07-10 05:24:59 -04:00 · 2026-07-09 04:37:52 -04:00 · 2026-07-08 02:01:06 -04:00 · 2026-07-08 01:42:56 -04:00 · 2026-07-08 01:27:00 -04:00 · 2026-07-08 00:24:35 -04:00
1237 changed files with 38519 additions and 11790 deletions
--- a/.gitignore
+++ b/.gitignore
@ -35,3 +35,43 @@ git-src
 .cproject
 .ccache
 .vscode*
+
+# mooleshacat
+
+# nusciance
+*.apk
+*.img
+*.itb
+*.ubi
+*.bin.md5
+*.dts.md5
+*.tar.gz
+fw_tew-829dru_v1(1.0.3.12).zip
+*-squashfs-*.bin
+
+# proprietary
+board.bin
+board-2.bin
+caldata.bin
+firmware-5.bin
+full_nand_*.bin
+boardData_1_0_IPQ4019_DK04_2G.bin
+boardData_1_0_IPQ4019_DK04_5G.bin
+boardData_QCA9984_CUS239_5G_v1_001.bin
+extracted.bin
+kernel-uImage.bin
+TEW-829DRU_v1.0.3.12.bin
+pre-cal-ahb-a000000.wifi.bin
+pre-cal-ahb-a800000.wifi.bin
+chunk_*.bin
+part*.bin
+TEW-829DRU*.bin
+extracted.dtb
+*flashdump.bin
+
+# secret(s)
+*_PAC*
+
+# proprietary, device specific, calibration data
+package/firmware/ipq-wifi/files/board-trendnet_tew-829dru.QCA9984
+package/firmware/ipq-wifi/files/board-trendnet_tew-829dru.QCA4019
--- a/config/Config-kernel.in
+++ b/config/Config-kernel.in
@ -1181,6 +1181,7 @@ config KERNEL_NET_L3_MASTER_DEV
 config KERNEL_DCB
 	bool "Data Center Bridging support"
 	default y if TARGET_armsr_armv8
+	default y if TARGET_microchipsw
 	default y if TARGET_x86_64
 	help
 	  This enables support for configuring Data Center Bridging (DCB)
--- a/feeds.conf.default
+++ b/feeds.conf.default
@ -1,8 +1,5 @@
-src-git packages https://git.openwrt.org/feed/packages.git
-src-git luci https://git.openwrt.org/project/luci.git
-src-git routing https://git.openwrt.org/feed/routing.git
-src-git telephony https://git.openwrt.org/feed/telephony.git
-src-git video https://github.com/openwrt/video.git
-#src-git targets https://github.com/openwrt/targets.git
-#src-git oldpackages http://git.openwrt.org/packages.git
-#src-link custom /usr/src/openwrt/custom-feed
+src-git packages https://git.openwrt.org/feed/packages.git;openwrt-25.12
+src-git luci https://git.openwrt.org/project/luci.git;openwrt-25.12
+src-git routing https://git.openwrt.org/feed/routing.git;openwrt-25.12
+src-git telephony https://git.openwrt.org/feed/telephony.git;openwrt-25.12
+src-git video https://github.com/openwrt/video.git;openwrt-25.12
--- a/include/cmake.mk
+++ b/include/cmake.mk
@ -89,8 +89,8 @@ endif
 define Build/Configure/Default
 	mkdir -p $(CMAKE_BINARY_DIR)
 	(cd $(CMAKE_BINARY_DIR); \
-		CFLAGS="$(TARGET_CFLAGS) $(EXTRA_CFLAGS)" \
-		CXXFLAGS="$(TARGET_CXXFLAGS) $(EXTRA_CXXFLAGS)" \
+		CFLAGS="$(TARGET_CFLAGS) $(EXTRA_CFLAGS) $(TARGET_CPPFLAGS) $(EXTRA_CPPFLAGS)" \
+		CXXFLAGS="$(TARGET_CXXFLAGS) $(EXTRA_CXXFLAGS) $(TARGET_CPPFLAGS) $(EXTRA_CPPFLAGS)" \
 		LDFLAGS="$(TARGET_LDFLAGS) $(EXTRA_LDFLAGS)" \
 		cmake \
 			--no-warn-unused-cli \
--- a/include/image-commands.mk
+++ b/include/image-commands.mk
@ -324,7 +324,7 @@ define Build/copy-file
 endef

 # Create a header for a D-Link AI series recovery image and add it at the beginning of the image
-# Currently supported: AQUILA M30, EAGLE M32 and R32
+# Currently supported: AQUILA E30 and M30, EAGLE M32 and R32
 # Arguments:
 # 1: Start string of the header
 # 2: Firmware version
--- a/include/image.mk
+++ b/include/image.mk
@ -41,6 +41,9 @@ KDIR=$(KERNEL_BUILD_DIR)
 KDIR_TMP=$(KDIR)/tmp
 DTS_DIR:=$(LINUX_DIR)/arch/$(LINUX_KARCH)/boot/dts

+ifeq ($(EXTRA_IMAGE_NAME),)
+EXTRA_IMAGE_NAME:=$(call qstrip,$(CONFIG_EXTRA_IMAGE_NAME))
+endif
 IMG_PREFIX_EXTRA:=$(if $(EXTRA_IMAGE_NAME),$(call sanitize,$(EXTRA_IMAGE_NAME))-)
 IMG_PREFIX_VERNUM:=$(if $(CONFIG_VERSION_FILENAMES),$(call sanitize,$(VERSION_NUMBER))-)
 IMG_PREFIX_VERCODE:=$(if $(CONFIG_VERSION_CODE_FILENAMES),$(call sanitize,$(VERSION_CODE))-)
@ -114,6 +117,7 @@ fs-types-$(CONFIG_TARGET_ROOTFS_JFFS2_NAND) += $(addprefix jffs2-nand-,$(NAND_BL
 fs-types-$(CONFIG_TARGET_ROOTFS_EXT4FS) += ext4
 fs-types-$(CONFIG_TARGET_ROOTFS_UBIFS) += ubifs
 fs-types-$(CONFIG_TARGET_ROOTFS_EROFS) += erofs
+fs-types-$(CONFIG_TARGET_ROOTFS_TARGZ) += targz
 fs-subtypes-$(CONFIG_TARGET_ROOTFS_JFFS2) += $(addsuffix -raw,$(addprefix jffs2-,$(JFFS2_BLOCKSIZE)))

 TARGET_FILESYSTEMS := $(fs-types-y)
@ -326,6 +330,12 @@ define Image/mkfs/erofs
 		$@ $(call mkfs_target_dir,$(1))
 endef

+define Image/mkfs/targz
+	$(TAR) -cp --numeric-owner --owner=0 --group=0 --mode=a-s --sort=name \
+		$(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") \
+		-C $(call mkfs_target_dir,$(1)) . | gzip -9n > $@
+endef
+
 define Image/Manifest
 	$(if $(CONFIG_USE_APK), \
 		$(call apk,$(TARGET_DIR_ORIG)) list --quiet --manifest --no-network \
@ -880,9 +890,13 @@ define Device/Build
    $$(call Device/Build/compile,$$(compile),$(1))))

  $$(eval $$(foreach image,$$(IMAGES), \
-    $$(foreach fs,$$(filter $(TARGET_FILESYSTEMS),$$(FILESYSTEMS)), \
+    $$(foreach fs,$$(filter $$(filter-out targz,$(TARGET_FILESYSTEMS)),$$(FILESYSTEMS)), \
      $$(call Device/Build/image,$$(fs),$$(image),$(1)))))

+  $(if $(CONFIG_TARGET_ROOTFS_TARGZ), \
+    IMAGE/rootfs.tar.gz := append-rootfs
+    $$(eval $$(call Device/Build/image,targz,rootfs.tar.gz,$(1))))
+
  $$(eval $$(foreach artifact,$$(ARTIFACTS), \
    $$(call Device/Build/artifact,$$(artifact),$(1))))

--- a/include/kernel.mk
+++ b/include/kernel.mk
@ -306,4 +306,3 @@ kernel_patchver_ge=$(call kernel_version_cmp,-ge,$(KERNEL_PATCHVER),$(1))
 kernel_patchver_eq=$(call kernel_version_cmp,-eq,$(KERNEL_PATCHVER),$(1))
 kernel_patchver_le=$(call kernel_version_cmp,-le,$(KERNEL_PATCHVER),$(1))
 kernel_patchver_lt=$(call kernel_version_cmp,-lt,$(KERNEL_PATCHVER),$(1))
-
--- a/include/package-pack.mk
+++ b/include/package-pack.mk
@ -78,6 +78,196 @@ define FixupDependencies
  $(call AddDependency,$(1),$$(DEPS))
 endef

+# Format dependencies and extra dependencies
+#
+# ABI-version EXTRA_DEPENDS so dependencies can be correctly looked up using the
+# existing semantics without the ABI specified. This is needed since ABI-
+# versioned libraries don't provide `${package_name}=${package_version}`, so
+# that same library but with different ABI versions can be installed side by
+# side.
+#
+# Remove duplicate dependencies when EXTRA_DEPENDS specifies a versioned one
+# that is already in DEPENDS.
+#
+# 1: list of dependencies
+# 2: list of extra dependencies
+define FormatDepends
+$(strip
+  $(eval _COMMA_SEP := __COMMA_SEP__)
+  $(eval _SPACE_SEP := __SPACE_SEP__)
+  $(eval _DEPENDS := $(1))
+  $(eval _EXTRA_DEPENDS_ABI := )
+  $(eval _DEP_ITEMS := $(subst $(_COMMA_SEP),$(space),$(subst $(space),$(_SPACE_SEP),$(subst $(comma),$(_COMMA_SEP),$(2)))))
+
+  $(foreach dep,$(_DEP_ITEMS),
+    $(eval _EXTRA_DEP := )
+    $(eval _CUR_DEP := $(subst $(_SPACE_SEP),$(space),$(strip $(dep))))
+    $(eval _PKG_NAME := $(word 1,$(_CUR_DEP)))
+    $(if $(findstring $(paren_left), $(_PKG_NAME)),
+      $(error "Unsupported extra dependency format: no space before '(': $(_CUR_DEP)"))
+    )
+    $(eval _ABI_SUFFIX := $(call GetABISuffix,$(_PKG_NAME)))
+    $(eval _PKG_NAME_ABI := $(_PKG_NAME)$(_ABI_SUFFIX))
+    $(eval _VERSION_CONSTRAINT := $(word 2,$(_CUR_DEP)))
+    $(if $(_VERSION_CONSTRAINT),
+      $(eval _EXTRA_DEP := $(_PKG_NAME_ABI) $(_VERSION_CONSTRAINT)),
+      $(error "Extra dependencies must have version constraints. $(_PKG_NAME) seems to be unversioned.")
+    )
+    $(if $(and $(_EXTRA_DEPENDS_ABI),$(_EXTRA_DEP)),
+      $(eval _EXTRA_DEPENDS_ABI := $(_EXTRA_DEPENDS_ABI)$(comma)$(_EXTRA_DEP)),
+      $(eval _EXTRA_DEPENDS_ABI := $(_EXTRA_DEP))
+    )
+    $(if $(_DEPENDS),
+      $(eval _DEPENDS := $(filter-out $(_PKG_NAME_ABI),$(_DEPENDS)))
+    )
+  )
+
+  $(eval _DEPENDS := $(call mergelist,$(_DEPENDS)))
+  $(_EXTRA_DEPENDS_ABI)$(if $(_DEPENDS),$(comma) $(_DEPENDS))
+)
+endef
+
+# Format provide and add ABI and version if it's not a virtual provide marked
+# with an @.
+#
+# Same as for the base package name, if ABI version is set, provide both
+# unversioned provide and one with ABI version and version.
+#
+# 1: provide name
+# 2: provide version
+# 3: (optional) ABI version
+define AddProvide
+$(strip
+  $(if $(filter @%,$(1)),
+    $(patsubst @%,%,$(1)),
+    $(if $(3),
+      $(1) $(1)$(call FormatABISuffix,$(1),$(3))=$(2),
+      $(1)=$(2)
+    )
+  )
+)
+endef
+
+# Remove virtual provides prefix and self. apk doesn't like it when packages
+# specify a redundant provide pointing to self.
+#
+# 1: package name
+# 2: list of provides
+define SanitizeProvides
+$(filter-out $(1),$(patsubst @%,%,$(2)))
+endef
+
+# Format provides both for apk and control
+#
+# - If ABI version is defined:
+#   - package is named `${package_name}${ABI_version}`
+#     if a `package_name` ends in a number, the `ABI_version` will be prefixed
+#     with a - sign, e.g.: libsqlite3-0
+#   - package implicitly provides
+#     `${package_name}${ABI_version}=${package_version}`
+#     this implies that only one version of a package per ABI can be installed
+#     at the same time
+#   - additionally provide `${package_name}` so multiple packages can be looked
+#     up by its base name
+#   - for each `provides`:
+#     - provide `${provide}${ABI_version}=${package_version}`
+#       this implies that only one version of a provide can be installed at the
+#       same time
+#     - if a `provide` ends in a number, the `ABI_version` will be prefixed with
+#       a - sign, e.g.: provide1-0
+#     - additionally provide `${provide}` so multiple packages can be looked up
+#       by its base name
+#
+# - else if ABI version is _not_ defined
+#   - package is named `${package_name}`
+#   - package implicitly provides `${package_name}=${package_version}`
+#     this implies that only one version of a package can be installed at the
+#     same time
+#   - for each `provides`, provide `${provide}=${package_version}` this implies
+#     that only one version of a provide can be installed at the same time
+#
+# - Both with and without an ABI, if a provide starts with an @, treat it as a
+#   virtual provide, that doesn't own the name by not appending version.
+#   Multiple packages with the same virtual provides can be installed
+#   side-by-side.
+#
+# - apk doesn't like it when packages specify a redundant provide pointing to
+#   self. Filter it out, but keep virtual self provides, in the form of
+#   @(kmod-)?${package_name}-any.
+#
+# - Packages implicitly add a virtual @${package_name}-any provide in Package,
+#   which implies that kmods, which are also packages, will have a virtual
+#   @kmod-${package_name}-any provide.
+#
+# - Aside from the two aforementioned implicit provides, packages are expected
+#   to manage their provides themselves.
+#
+# - When multiple variants inside the same package have the same provide, a
+#   default variant must be set using DEFAULT_VARIANT:=1.
+#
+# - Cross-package provides must be virtual and a default variant must be set. If
+#   different packages provide the same versioned (i.e. non-virtual) provide the
+#   package with a higher version will be preferred, which results in unintended
+#   behavior, because the order might change with package updates.
+#
+#   Example:
+#   - both uclient-fetch and wget provide wget
+#   - wget doesn't have a default variant called wget that would provide an
+#     implicit @wget-any
+#     - add wget to PROVIDES for both wget-ssl and wget-nossl variants so they
+#       can't be installed at the same time
+#     - add @wget-any to both packages so packages outside of wget can provide
+#       it
+#   - uclient-fetch has only one variant
+#     - add @wget-any to PROVIDES
+#     - mark uclient-fetch as the default variant using DEFAULT_VARIANT:=1
+#   - switch wget consumer that don't depend on a specific version like apk to
+#     depend on @wget-any
+#
+# - Alternatives don't affect the packaging.
+#
+# 1: package name
+# 2: package version
+# 3: ABI version
+# 4: list of provides
+define FormatProvides
+$(strip \
+  $(if $(call FormatABISuffix,$(1),$(3)), \
+    $(1) $(foreach provide, \
+      $(filter-out $(1),$(4)), \
+      $(call AddProvide,$(provide),$(2),$(3)) \
+    ), \
+    $(foreach provide, \
+      $(filter-out $(1),$(4)), \
+      $(call AddProvide,$(provide),$(2)) \
+    ) \
+  ) \
+)
+endef
+
+# Get apk provider priority
+#
+# - if a package is marked as a default variant, set it to 100.
+#
+# - if a package has an ABI version defined, set it to 10.
+#   The enables packages with an ABI version to be installed by their base name
+#   instead of a name and an ABI version, e.g.:
+#   libfoo3, where 3 is the ABI version can be installed by just libfoo.
+#   This affects manual installation only, as the dependency resolution takes
+#   care of ABI versions.
+#
+# - otherwise return nothing, i.e. package will have the default priority 0.
+#
+# 1: Default variant
+# 2: ABI version
+define GetProviderPriority
+$(strip
+  $(if $(1),100,
+    $(if $(2),10)
+  )
+)
+endef
+
 ifneq ($(PKG_NAME),toolchain)
  define CheckDependencies
 	@( \
@ -191,17 +381,33 @@ endif
    $(STAGING_DIR_ROOT)/stamp/.$(1)_installed: $(PKG_BUILD_DIR)/.pkgdir/$(1).installed
 	mkdir -p $(STAGING_DIR_ROOT)/stamp
 	$(if $(ABI_VERSION),echo '$(ABI_VERSION)' | cmp -s - $(PKG_INFO_DIR)/$(1).version || { \
+		mkdir -p $(PKG_INFO_DIR); \
 		echo '$(ABI_VERSION)' > $(PKG_INFO_DIR)/$(1).version; \
-		$(foreach pkg,$(filter-out $(1),$(PROVIDES)), \
+		$(foreach pkg,$(call SanitizeProvides,$(1),$(PROVIDES)), \
 			cp $(PKG_INFO_DIR)/$(1).version $(PKG_INFO_DIR)/$(pkg).version; \
 		) \
 	} )
 	$(call locked,$(CP) $(PKG_BUILD_DIR)/.pkgdir/$(1)/. $(STAGING_DIR_ROOT)/,root-copy)
 	touch $$@

-    Package/$(1)/DEPENDS := $$(call mergelist,$$(foreach dep,$$(filter-out @%,$$(IDEPEND_$(1))),$$(dep)$$(call GetABISuffix,$$(dep))))
+    Package/$(1)/DEPENDS := $$(foreach dep,$$(filter-out @%,$$(IDEPEND_$(1))),$$(dep)$$(call GetABISuffix,$$(dep)))
    ifneq ($$(EXTRA_DEPENDS),)
-      Package/$(1)/DEPENDS := $$(EXTRA_DEPENDS)$$(if $$(Package/$(1)/DEPENDS),$$(comma) $$(Package/$(1)/DEPENDS))
+      ifeq ($(CONFIG_USE_APK),)
+        Package/$(1)/DEPENDS := $$(call mergelist,$$(Package/$(1)/DEPENDS))
+        Package/$(1)/DEPENDS := $$(EXTRA_DEPENDS)$$(if $$(Package/$(1)/DEPENDS),$$(comma) $$(Package/$(1)/DEPENDS))
+      else
+        Package/$(1)/DEPENDS := $$(call FormatDepends,$$(Package/$(1)/DEPENDS),$$(EXTRA_DEPENDS))
+      endif
+    else
+      Package/$(1)/DEPENDS := $$(call mergelist,$$(Package/$(1)/DEPENDS))
+    endif
+
+    ifeq ($(CONFIG_USE_APK),)
+      Package/$(1)/PROVIDES := $$(patsubst @%,%,$(PROVIDES))
+      Package/$(1)/PROVIDES := $$(filter-out $(1)$$(ABIV_$(1)),$$(Package/$(1)/PROVIDES)$$(if $$(ABIV_$(1)), $(1) $$(foreach provide,$$(Package/$(1)/PROVIDES),$$(provide)$$(ABIV_$(1)))))
+    else
+      Package/$(1)/PROVIDES := $$(call FormatProvides,$(1),$(VERSION),$(ABI_VERSION),$(PROVIDES))
+      Package/$(1)/PRIORITY := $$(call GetProviderPriority,$(DEFAULT_VARIANT),$(ABI_VERSION))
    endif

 $(_define) Package/$(1)/CONTROL
@ -209,7 +415,7 @@ Package: $(1)$$(ABIV_$(1))
 Version: $(VERSION)
 $$(call addfield,Depends,$$(Package/$(1)/DEPENDS)
 )$$(call addfield,Conflicts,$$(call mergelist,$(CONFLICTS))
-)$$(call addfield,Provides,$$(call mergelist,$$(filter-out $(1)$$(ABIV_$(1)),$(PROVIDES)$$(if $$(ABIV_$(1)), $(1) $(foreach provide,$(PROVIDES),$(provide)$$(ABIV_$(1))))))
+)$$(call addfield,Provides,$$(call mergelist,$$(Package/$(1)/PROVIDES))
 )$$(call addfield,Alternatives,$$(call mergelist,$(ALTERNATIVES))
 )$$(call addfield,Source,$(SOURCE)
 )$$(call addfield,SourceName,$(PKG_NAME)
@ -253,7 +459,7 @@ endif
 			fi; \
 		done; $(Package/$(1)/extra_provides) \
 	) | sort -u > $(PKG_INFO_DIR)/$(1).provides
-	$(if $(PROVIDES),@for pkg in $(filter-out $(1),$(PROVIDES)); do cp $(PKG_INFO_DIR)/$(1).provides $(PKG_INFO_DIR)/$$$$pkg.provides; done)
+	$(if $(PROVIDES),@for pkg in $(call SanitizeProvides,$(1),$(PROVIDES)); do cp $(PKG_INFO_DIR)/$(1).provides $(PKG_INFO_DIR)/$$$$pkg.provides; done)
 	$(CheckDependencies)

 	$(RSTRIP) $$(IDIR_$(1))
@ -320,24 +526,24 @@ else
 		echo "[ -s "\$$$${IPKG_INSTROOT}/lib/functions.sh" ] || exit 0"; \
 		echo ". \$$$${IPKG_INSTROOT}/lib/functions.sh"; \
 		echo 'export root="$$$${IPKG_INSTROOT}"'; \
-		echo 'export pkgname="$(1)"'; \
+		echo 'export pkgname="$(1)$$(ABIV_$(1))"'; \
 		echo "add_group_and_user"; \
 		echo "default_postinst"; \
-		[ ! -f $$(ADIR_$(1))/postinst-pkg ] || sed -z 's/^\s*#!/#!/' "$$(ADIR_$(1))/postinst-pkg"; \
+		[ ! -f $$(ADIR_$(1))/postinst-pkg ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/postinst-pkg"; \
 	) > $$(ADIR_$(1))/post-install;

    ifdef Package/$(1)/preinst
 	( \
 		echo "#!/bin/sh"; \
 		echo 'export PKG_UPGRADE=1'; \
-		[ ! -f $$(ADIR_$(1))/preinst ] || sed -z 's/^\s*#!/#!/' "$$(ADIR_$(1))/preinst"; \
+		[ ! -f $$(ADIR_$(1))/preinst ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/preinst"; \
 	) > $$(ADIR_$(1))/pre-upgrade;
    endif

 	( \
 		echo "#!/bin/sh"; \
 		echo 'export PKG_UPGRADE=1'; \
-		[ ! -f $$(ADIR_$(1))/post-install ] || sed -z 's/^\s*#!/#!/' "$$(ADIR_$(1))/post-install"; \
+		[ ! -f $$(ADIR_$(1))/post-install ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/post-install"; \
 	) > $$(ADIR_$(1))/post-upgrade;

 	( \
@ -345,34 +551,34 @@ else
 		echo "[ -s "\$$$${IPKG_INSTROOT}/lib/functions.sh" ] || exit 0"; \
 		echo ". \$$$${IPKG_INSTROOT}/lib/functions.sh"; \
 		echo 'export root="$$$${IPKG_INSTROOT}"'; \
-		echo 'export pkgname="$(1)"'; \
+		echo 'export pkgname="$(1)$$(ABIV_$(1))"'; \
 		echo "default_prerm"; \
-		[ ! -f $$(ADIR_$(1))/prerm-pkg ] || sed -z 's/^\s*#!/#!/' "$$(ADIR_$(1))/prerm-pkg"; \
+		[ ! -f $$(ADIR_$(1))/prerm-pkg ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/prerm-pkg"; \
 	) > $$(ADIR_$(1))/pre-deinstall;

 	[ ! -f $$(ADIR_$(1))/postrm ] || sed -zi 's/^\s*#!/#!/' "$$(ADIR_$(1))/postrm";

-	if [ -n "$(USERID)" ]; then echo $(USERID) > $$(IDIR_$(1))/lib/apk/packages/$(1).rusers; fi;
-	if [ -n "$(ALTERNATIVES)" ]; then echo $(ALTERNATIVES) > $$(IDIR_$(1))/lib/apk/packages/$(1).alternatives; fi;
-	(cd $$(IDIR_$(1)) && find . -type f,l -printf "/%P\n" | sort > $(TMP_DIR)/$(1).list && mv $(TMP_DIR)/$(1).list $$(IDIR_$(1))/lib/apk/packages/$(1).list)
+	if [ -n "$(USERID)" ]; then echo $(USERID) > $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).rusers; fi;
+	if [ -n "$(ALTERNATIVES)" ]; then echo $(ALTERNATIVES) > $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).alternatives; fi;
+	(cd $$(IDIR_$(1)) && find . -type f,l -printf "/%P\n" | sort > $(TMP_DIR)/$(1).list && mv $(TMP_DIR)/$(1).list $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).list)
 	# Move conffiles to IDIR and build conffiles_static with csums
 	if [ -f $$(ADIR_$(1))/conffiles ]; then \
-		mv -f $$(ADIR_$(1))/conffiles $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles; \
-		for file in $$$$(cat $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles); do \
+		mv -f $$(ADIR_$(1))/conffiles $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles; \
+		for file in $$$$(cat $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles); do \
 			[ -f $$(IDIR_$(1))/$$$$file ] || continue; \
 			csum=$$$$($(MKHASH) sha256 $$(IDIR_$(1))/$$$$file); \
-			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles_static; \
+			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles_static; \
 		done; \
 	fi

 	# Some package (base-files) manually append stuff to conffiles
 	# Append stuff from it and delete the CONTROL directory since everything else should be migrated
 	if [ -f $$(IDIR_$(1))/CONTROL/conffiles ]; then \
-		echo $$$$(IDIR_$(1))/CONTROL/conffiles >> $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles; \
+		echo $$$$(IDIR_$(1))/CONTROL/conffiles >> $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles; \
 		for file in $$$$(cat $$(IDIR_$(1))/CONTROL/conffiles); do \
 			[ -f $$(IDIR_$(1))/$$$$file ] || continue; \
 			csum=$$$$($(MKHASH) sha256 $$(IDIR_$(1))/$$$$file); \
-			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles_static; \
+			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles_static; \
 		done; \
 		rm -rf $$(IDIR_$(1))/CONTROL/conffiles; \
 	fi
@ -394,17 +600,8 @@ else
 	  --info "origin:$(SOURCE)" \
 	  --info "url:$(URL)" \
 	  --info "maintainer:$(MAINTAINER)" \
-	  --info "provides:$$(foreach prov,\
-			$$(filter-out $(1)$$(ABIV_$(1)), \
-			$(PROVIDES)$$(if $$(ABIV_$(1)), \
-				$(1)=$(VERSION) $(foreach provide, \
-					$(PROVIDES), \
-					$(provide)$$(ABIV_$(1))=$(VERSION) \
-				) \
-			) \
-		), \
-		$$(prov) )" \
-	  $(if $(DEFAULT_VARIANT),--info "provider-priority:100",$(if $(PROVIDES),--info "provider-priority:1")) \
+	  $$(if $$(Package/$(1)/PROVIDES),--info "provides:$$(Package/$(1)/PROVIDES)") \
+	  $$(if $$(Package/$(1)/PRIORITY),--info "provider-priority:$$(Package/$(1)/PRIORITY)") \
 	  $$(APK_SCRIPTS_$(1)) \
 	  --info "depends:$$(foreach depends,$$(subst $$(comma),$$(space),$$(subst $$(space),,$$(subst $$(paren_right),,$$(subst $$(paren_left),,$$(Package/$(1)/DEPENDS))))),$$(depends))" \
 	  --files "$$(IDIR_$(1))" \
--- a/include/package.mk
+++ b/include/package.mk
@ -332,6 +332,13 @@ define BuildPackage
  $(eval $(Package/Default))
  $(eval $(Package/$(1)))

+  # Add an implicit self-provide. apk can't handle self provides, be it
+  # versioned or virtual, so opt for a suffix instead. This allows several
+  # variants to provide the same virtual package without adding extra provides
+  # to the default one, e.g. wget implicitly provides wget-any and is marked as
+  # default, so wget-ssl can explicitly provide @wget-any as well.
+  $(eval PROVIDES:=$(strip @$(1)-any $(PROVIDES)))
+
 ifdef DESCRIPTION
 $$(error DESCRIPTION:= is obsolete, use Package/PKG_NAME/description)
 endif
--- a/include/version.mk
+++ b/include/version.mk
@ -27,13 +27,13 @@ PKG_CONFIG_DEPENDS += \
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))

 VERSION_NUMBER:=$(call qstrip,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),SNAPSHOT)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),25.12-SNAPSHOT)

 VERSION_CODE:=$(call qstrip,$(CONFIG_VERSION_CODE))
 VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),$(REVISION))

 VERSION_REPO:=$(call qstrip,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/snapshots)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/releases/25.12-SNAPSHOT)

 VERSION_DIST:=$(call qstrip,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),OpenWrt)
--- a/package/Makefile
+++ b/package/Makefile
@ -103,9 +103,9 @@ ifneq ($(CONFIG_USE_APK),)
 		--repositories-file /dev/null --repository file://$(PACKAGE_DIR_ALL)/packages.adb \
 		$(if $(CONFIG_SIGNED_PACKAGES),,--allow-untrusted) \
 		$$(cat $(TMP_DIR)/apk_install_list) \
-			"base-files=$(shell cat $(TMP_DIR)/base-files.version)" \
-			"libc=$(shell cat $(TMP_DIR)/libc.version)" \
-			"kernel=$(shell cat $(TMP_DIR)/kernel.version)"
+			"base-files=$(shell cat $(STAGING_DIR)/base-files.version)" \
+			"libc=$(shell cat $(STAGING_DIR)/libc.version)" \
+			"kernel=$(shell cat $(STAGING_DIR)/kernel.version)"

 	rm -rf $(TARGET_DIR)/run
 else
@ -129,6 +129,7 @@ $(curdir)/index: FORCE
 	@echo Generating package index...
 ifneq ($(CONFIG_USE_APK),)
 	@for d in $(PACKAGE_SUBDIRS); do \
+		set -e; \
 		mkdir -p $$d; \
 		cd $$d || continue; \
 		ls *.apk >/dev/null 2>&1 || continue; \
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@ -256,7 +256,7 @@ ifneq ($(CONFIG_USE_APK),)

 	rm -f $(1)/etc/uci-defaults/13_fix-group-user
 	rm -f $(1)/sbin/pkg_check
-	echo $(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION))) >$(TMP_DIR)/base-files.version
+	echo $(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION))) >$(STAGING_DIR)/base-files.version
 else
 	$(if $(CONFIG_CLEAN_IPKG),, \
 		mkdir -p $(1)/etc/opkg; \
--- a/package/base-files/files/etc/banner
+++ b/package/base-files/files/etc/banner
@ -4,5 +4,5 @@
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
- %D %V, %C
+ %D %V, %C Dave's Guitar
 -----------------------------------------------------
--- a/package/base-files/files/etc/uci-defaults/14_network-generate-clientid
+++ b/package/base-files/files/etc/uci-defaults/14_network-generate-clientid
@ -1,4 +1,4 @@
-[ "$(uci -q get network.globals.dhcp_default_duid)" != "auto" ] && exit 0
+[ "$(uci -q get network.globals.dhcp_default_duid || echo "auto")" != "auto" ] && exit 0

 uci -q batch <<-EOF >/dev/null
 	# DUID-UUID - RFC6355
--- a/package/base-files/files/etc/uci-defaults/15_migrate-time-zonename
+++ b/package/base-files/files/etc/uci-defaults/15_migrate-time-zonename
@ -0,0 +1,6 @@
+zonename="$(uci -q get system.@system[0].zonename)"
+case "$zonename" in
+        *[[:space:]]*) uci set system.@system[0].zonename="${zonename// /_}" ;;
+esac
+
+exit 0
--- a/package/base-files/files/lib/functions.sh
+++ b/package/base-files/files/lib/functions.sh
@ -382,7 +382,7 @@ default_postinst() {
 			uci commit
 		fi

-		rm -f /tmp/luci-indexcache
+		rm -f /tmp/luci-indexcache.*
 	fi

 	if [ -f "$root/usr/lib/opkg/info/${pkgname}.postinst-pkg" ]; then
--- a/package/base-files/files/lib/functions/network.sh
+++ b/package/base-files/files/lib/functions/network.sh
@ -24,6 +24,17 @@ __network_ifstatus() {
 	eval "$__tmp"
 }

+# determine the IAID of the given logical interface
+# 1: destination variable
+# 2: interface
+network_generate_iface_iaid() {
+	local __iaid
+
+	__iaid=$(printf '%s' "$2" | md5sum | cut -c 1-8)
+
+	export "$1=$__iaid"
+}
+
 # determine first IPv4 address of given logical interface
 # 1: destination variable
 # 2: interface
--- a/package/base-files/files/lib/upgrade/common.sh
+++ b/package/base-files/files/lib/upgrade/common.sh
@ -167,7 +167,7 @@ part_magic_fat() {

 export_bootdevice() {
 	local cmdline uuid blockdev uevent line class
-	local MAJOR MINOR DEVNAME DEVTYPE
+	local MAJOR MINOR DEVNAME DEVTYPE DISKSEQ PARTN
 	local rootpart="$(cmdline_get_var root)"

 	case "$rootpart" in
@ -216,8 +216,7 @@ export_bootdevice() {
 		while read line; do
 			export -n "$line"
 		done < "$uevent"
-		export BOOTDEV_MAJOR=$MAJOR
-		export BOOTDEV_MINOR=$MINOR
+		export BOOTDEV_DISKSEQ=$DISKSEQ
 		return 0
 	fi

@ -225,16 +224,18 @@ export_bootdevice() {
 }

 export_partdevice() {
-	local var="$1" offset="$2"
-	local uevent line MAJOR MINOR DEVNAME DEVTYPE
+	local var="$1" partn="$2"
+	local uevent line MAJOR MINOR DEVNAME DEVTYPE DISKSEQ PARTN

 	for uevent in /sys/class/block/*/uevent; do
 		while read line; do
 			export -n "$line"
 		done < "$uevent"
-		if [ "$BOOTDEV_MAJOR" = "$MAJOR" -a $(($BOOTDEV_MINOR + $offset)) = "$MINOR" -a -b "/dev/$DEVNAME" ]; then
-			export "$var=$DEVNAME"
-			return 0
+		if [ "$BOOTDEV_DISKSEQ" = "$DISKSEQ" -a -b "/dev/$DEVNAME" ]; then
+			if [ "$PARTN" = "$partn" -a "$DEVTYPE" = "partition" ] || [ "$partn" = "0" -a "$DEVTYPE" = "disk" ]; then
+				export "$var=$DEVNAME"
+				return 0
+			fi
 		fi
 	done

--- a/package/base-files/files/sbin/sysupgrade
+++ b/package/base-files/files/sbin/sysupgrade
@ -146,7 +146,7 @@ list_conffiles() {
 		' /usr/lib/opkg/status
 	elif [ -d /lib/apk/packages ]; then
 		conffiles=""
-		for file in /lib/apk/packages/*.conffiles_static; do
+		for file in $(find /lib/apk/packages -name "*.conffiles_static" -type f); do
 			conffiles="$(echo -e "$(cat $file)\n$conffiles")"
 		done
 		echo "$conffiles"
@ -201,12 +201,17 @@ build_list_of_backup_overlay_files() {

 		# do not backup files from packages, except those listed
 		# in conffiles and keep.d
-		{
+		if [ -f /usr/lib/opkg/status ]; then
 			find /usr/lib/opkg/info -type f -name "*.list" -exec cat {} \;
 			find /usr/lib/opkg/info -type f -name "*.control" -exec sed \
 				-ne '/^Alternatives/{s/^Alternatives: //;s/, /\n/g;p}' {} \; |
 				cut -f2 -d:
-		} |  grep -v -x -F -f $conffiles |
+		elif [ -d /lib/apk/packages ]; then
+			find /lib/apk/packages -type f -name "*.list" -exec cat {} \;
+			find /lib/apk/packages -type f -name "*.alternatives" -exec cat {} \; |
+				tr ' ' '\n' |
+				cut -f2 -d:
+		fi |  grep -v -x -F -f $conffiles |
 		     grep -v -x -F -f $keepfiles | sort -u > "$packagesfiles"
 		rm -f "$keepfiles" "$conffiles"
 	fi
@ -217,10 +222,14 @@ build_list_of_backup_overlay_files() {
 	( cd /overlay/upper/; find .$SAVE_OVERLAY_PATH \( -type f -o -type l \) $find_filter | sed \
 		-e 's,^\.,,' \
 		-e '\,^/etc/board.json$,d' \
+		-e '\,^/etc/luci-uploads/\.placeholder,d' \
 		-e '\,/[^/]*-opkg$,d' \
 		-e '\,^/etc/urandom.seed$,d' \
+		-e '\,^/etc/apk/world$,d' \
 		-e "\,^$INSTALLED_PACKAGES$,d" \
 		-e '\,^/usr/lib/opkg/.*,d' \
+		-e '\,^/lib/apk/.*,d' \
+		-e '\,^/run$,d' \
 	) | grep -v -x -F -f $packagesfiles > "$file"

 	rm -f "$packagesfiles"
@ -298,6 +307,9 @@ create_backup_archive() {
 						\( -exec test -f /overlay/upper/{} \; -exec echo {} overlay \; \) -o \
 						\( -exec echo {} unknown \; \) \
 						\) | sed -e 's,.*/,,;s/\.list /\t/')" || ret=1
+				else
+					echo "Failed to detect installed packages metadata files." >&2
+					ret=1
 				fi
 			fi
 		fi
@ -395,7 +407,7 @@ json_get_var forceable "forceable"
 }

 if [ -n "$CONF_IMAGE" ]; then
-	case "$(get_magic_word $CONF_IMAGE cat)" in
+	case "$(get_magic_word "$CONF_IMAGE" cat)" in
 		# .gz files
 		1f8b) ;;
 		*)
--- a/package/base-files/image-config.in
+++ b/package/base-files/image-config.in
@ -5,6 +5,14 @@
 # See /LICENSE for more information.
 #

+config EXTRA_IMAGE_NAME
+	string
+	prompt "Extra image filename" if IMAGEOPT
+	default ""
+	help
+		Add this to the output image filenames, to distinguish between
+		different builds for the same hardware type.
+
 config TARGET_DEFAULT_LAN_IP_FROM_PREINIT
 	bool "Use preinit IP configuration as default LAN IP" if IMAGEOPT
 	default n
@ -190,7 +198,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "https://downloads.openwrt.org/snapshots"
+		default "https://downloads.openwrt.org/releases/25.12-SNAPSHOT"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:
--- a/package/boot/arm-trusted-firmware-mediatek/Makefile
+++ b/package/boot/arm-trusted-firmware-mediatek/Makefile
@ -30,6 +30,7 @@ define Trusted-Firmware-A/Default
  BOOT_DEVICE:=
  DDR3_FLYBY:=
  DDR3_FREQ_1866:=
+  DDR4_4BG_MODE:=
  DDR_TYPE:=
  NAND_TYPE:=
  BOARD_QFN:=
@ -139,6 +140,14 @@ define Trusted-Firmware-A/mt7622-sdmmc-2ddr
  DDR3_FLYBY:=1
 endef

+define Trusted-Firmware-A/mt7981-nor-ddr4
+  NAME:=MediaTek MT7981 (SPI-NOR, DDR4)
+  BOOT_DEVICE:=nor
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr4
+endef
+
 define Trusted-Firmware-A/mt7981-ram-ddr4
  NAME:=MediaTek MT7981 (RAM, DDR4)
  BOOT_DEVICE:=ram
@ -158,6 +167,14 @@ define Trusted-Firmware-A/mt7981-emmc-ddr4
  DDR_TYPE:=ddr4
 endef

+define Trusted-Firmware-A/mt7981-sdmmc-ddr4
+  NAME:=MediaTek MT7981 (SD card, DDR4)
+  BOOT_DEVICE:=sdmmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr4
+endef
+
 define Trusted-Firmware-A/mt7981-spim-nand-ddr4
  NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR4)
  BOOT_DEVICE:=spim-nand
@ -186,14 +203,6 @@ define Trusted-Firmware-A/mt7981-ram-ddr3
  DEFAULT:=TARGET_mediatek_filogic
 endef

-define Trusted-Firmware-A/mt7981-nor-ddr4
-  NAME:=MediaTek MT7981 (SPI-NOR, DDR4)
-  BOOT_DEVICE:=nor
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7981
-  DDR_TYPE:=ddr4
-endef
-
 define Trusted-Firmware-A/mt7981-emmc-ddr3
  NAME:=MediaTek MT7981 (eMMC, DDR3)
  BOOT_DEVICE:=emmc
@ -244,8 +253,17 @@ define Trusted-Firmware-A/mt7981-spim-nand-ddr3-1866mhz
  DDR3_FREQ_1866:=1
 endef

-define Trusted-Firmware-A/mt7981-cudy-tr3000-v1
-  NAME:=Cudy TR3000 v1 (SPI-NAND via SPIM, DDR3)
+define Trusted-Firmware-A/mt7981-spim-nand-ubi-ddr4
+  NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR4)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr4
+  USE_UBI:=1
+endef
+
+define Trusted-Firmware-A/mt7981-cudy-ddr3
+  NAME:=Cudy (SPI-NAND via SPIM, DDR3)
  BOOT_DEVICE:=spim-nand
  BUILD_SUBTARGET:=filogic
  PLAT:=mt7981
@ -254,6 +272,16 @@ define Trusted-Firmware-A/mt7981-cudy-tr3000-v1
  FIP_SIZE:=0x200000
 endef

+define Trusted-Firmware-A/mt7981-cudy-ddr4
+  NAME:=Cudy (SPI-NAND via SPIM, DDR4)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr4
+  FIP_OFFSET:=0x3c0000
+  FIP_SIZE:=0x200000
+endef
+
 define Trusted-Firmware-A/mt7986-ram-ddr4
  NAME:=MediaTek MT7986 (RAM, DDR4)
  BOOT_DEVICE:=ram
@ -265,15 +293,6 @@ define Trusted-Firmware-A/mt7986-ram-ddr4
  DEFAULT:=TARGET_mediatek_filogic
 endef

-define Trusted-Firmware-A/mt7981-spim-nand-ubi-ddr4
-  NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR4)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7981
-  DDR_TYPE:=ddr4
-  USE_UBI:=1
-endef
-
 define Trusted-Firmware-A/mt7986-nor-ddr4
  NAME:=MediaTek MT7986 (SPI-NOR, DDR4)
  BOOT_DEVICE:=nor
@ -326,7 +345,7 @@ define Trusted-Firmware-A/mt7986-spim-nand-ubi-ddr4
 endef

 define Trusted-Firmware-A/mt7986-spim-nand-4k-ddr4
-  NAME:=MediaTek MT7986 (SPI-NAND via SPIM, DDR4)
+  NAME:=MediaTek MT7986 (SPI-NAND 4k+256 via SPIM, DDR4)
  BOOT_DEVICE:=spim-nand
  BUILD_SUBTARGET:=filogic
  PLAT:=mt7986
@ -394,12 +413,28 @@ define Trusted-Firmware-A/mt7986-spim-nand-ubi-ddr3
  USE_UBI:=1
 endef

+define Trusted-Firmware-A/mt7986-spim-nand-4k-ddr3
+  NAME:=MediaTek MT7986 (SPI-NAND 4k+256 via SPIM, DDR3)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7986
+  DDR_TYPE:=ddr3
+  NAND_TYPE:=spim:4k+256
+endef
+
 define Trusted-Firmware-A/mt7987-emmc-comb
  NAME:=MediaTek MT7987 (eMMC)
  BOOT_DEVICE:=emmc
  BUILD_SUBTARGET:=filogic
  PLAT:=mt7987
-  DRAM_USE_COMB:=1
+endef
+
+define Trusted-Firmware-A/mt7987-emmc-ddr4-4bg
+  NAME:=MediaTek MT7987 (eMMC, DDR4 4GB)
+  BOOT_DEVICE:=emmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+  DDR4_4BG_MODE:=1
 endef

 define Trusted-Firmware-A/mt7987-nor-comb
@ -407,7 +442,6 @@ define Trusted-Firmware-A/mt7987-nor-comb
  BOOT_DEVICE:=nor
  BUILD_SUBTARGET:=filogic
  PLAT:=mt7987
-  DRAM_USE_COMB:=1
 endef

 define Trusted-Firmware-A/mt7987-sdmmc-comb
@ -415,7 +449,22 @@ define Trusted-Firmware-A/mt7987-sdmmc-comb
  BOOT_DEVICE:=sdmmc
  BUILD_SUBTARGET:=filogic
  PLAT:=mt7987
-  DRAM_USE_COMB:=1
+endef
+
+define Trusted-Firmware-A/mt7987-sdmmc-ddr4-4bg
+  NAME:=MediaTek MT7987 (SD card, DDR4 4GB)
+  BOOT_DEVICE:=sdmmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+  DDR4_4BG_MODE:=1
+endef
+
+define Trusted-Firmware-A/mt7987-spim-nand0
+  NAME:=MediaTek MT7987 (SPI-NAND via SPIM)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+  SPIM_CTRL:=0
 endef

 define Trusted-Firmware-A/mt7987-spim-nand0-ubi-comb
@ -423,7 +472,6 @@ define Trusted-Firmware-A/mt7987-spim-nand0-ubi-comb
  BOOT_DEVICE:=spim-nand
  BUILD_SUBTARGET:=filogic
  PLAT:=mt7987
-  DRAM_USE_COMB:=1
  USE_UBI:=1
  SPIM_CTRL:=0
 endef
@ -433,7 +481,6 @@ define Trusted-Firmware-A/mt7987-spim-nand2-ubi-comb
  BOOT_DEVICE:=spim-nand
  BUILD_SUBTARGET:=filogic
  PLAT:=mt7987
-  DRAM_USE_COMB:=1
  USE_UBI:=1
  SPIM_CTRL:=2
 endef
@ -443,7 +490,6 @@ define Trusted-Firmware-A/mt7987-ram-comb
  BOOT_DEVICE:=ram
  BUILD_SUBTARGET:=filogic
  PLAT:=mt7987
-  DRAM_USE_COMB:=1
  RAM_BOOT_UART_DL:=1
  HIDDEN:=
  DEFAULT:=TARGET_mediatek_filogic
@ -643,8 +689,10 @@ TFA_TARGETS:= \
 	mt7981-spim-nand-ubi-ddr4 \
 	mt7981-ram-ddr4 \
 	mt7981-emmc-ddr4 \
+	mt7981-sdmmc-ddr4 \
 	mt7981-spim-nand-ddr4 \
-	mt7981-cudy-tr3000-v1 \
+	mt7981-cudy-ddr3 \
+	mt7981-cudy-ddr4 \
 	mt7986-ram-ddr3 \
 	mt7986-emmc-ddr3 \
 	mt7986-nor-ddr3 \
@ -652,6 +700,7 @@ TFA_TARGETS:= \
 	mt7986-snand-ddr3 \
 	mt7986-spim-nand-ddr3 \
 	mt7986-spim-nand-ubi-ddr3 \
+	mt7986-spim-nand-4k-ddr3 \
 	mt7986-ram-ddr4 \
 	mt7986-emmc-ddr4 \
 	mt7986-nor-ddr4 \
@ -661,8 +710,11 @@ TFA_TARGETS:= \
 	mt7986-spim-nand-ubi-ddr4 \
 	mt7986-spim-nand-4k-ddr4 \
 	mt7987-emmc-comb \
+	mt7987-emmc-ddr4-4bg \
 	mt7987-nor-comb \
 	mt7987-sdmmc-comb \
+	mt7987-sdmmc-ddr4-4bg \
+	mt7987-spim-nand0 \
 	mt7987-spim-nand0-ubi-comb \
 	mt7987-spim-nand2-ubi-comb \
 	mt7987-ram-comb \
@ -696,6 +748,7 @@ TFA_MAKE_FLAGS += \
 	HAVE_DRAM_OBJ_FILE=yes \
 	$(if $(DDR3_FLYBY),DDR3_FLYBY=1) \
 	$(if $(DDR3_FREQ_1866),DDR3_FREQ_1866=1) \
+	$(if $(DDR4_4BG_MODE),DDR4_4BG_MODE=1) \
 	$(if $(DRAM_USE_COMB),DRAM_USE_COMB=1) \
 	$(if $(RAM_BOOT_UART_DL),RAM_BOOT_UART_DL=1) \
 	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7622,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x80000)) \
--- a/package/boot/arm-trusted-firmware-microchipsw/Makefile
+++ b/package/boot/arm-trusted-firmware-microchipsw/Makefile
@ -5,10 +5,11 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/microchip-ung/arm-trusted-firmware.git
-PKG_SOURCE_DATE:=2024-08-13
-PKG_SOURCE_VERSION:=67fcfcab71f78ac7d4af834c37b29f8c98dd5ff1
-PKG_MIRROR_HASH:=777c68273e84028de77750f3fe8a1219b02f01d43ce35948893ac642d8eb10d7
+PKG_SOURCE_DATE:=2026-01-07
+PKG_SOURCE_VERSION:=7696c9aaaae7c677f4c373a61a1289cba7f824aa
+PKG_MIRROR_HASH:=331548d7c73896bd5e4438c0ec9c71bbe58d3bf9a29350496ad94c382e922b9c

+PKG_BUILD_DEPENDS:=ruby/host
 PKG_MAINTAINER:=Robert Marko <robert.marko@sartura.hr>

 include $(INCLUDE_DIR)/kernel.mk
@ -28,7 +29,17 @@ define Trusted-Firmware-A/ev23x71a
  DEPENDS:=+u-boot-ev23x71a
 endef

-TFA_TARGETS:= ev23x71a
+define Trusted-Firmware-A/tactical-1000
+  NAME:=Novarq Tactical 1000
+  BUILD_SUBTARGET:=lan969x
+  BUILD_DEVICES:=novarq_tactical-1000
+  PLAT:=novarq_tactical_1000_v3
+  DEPENDS:=+u-boot-tactical-1000
+endef
+
+TFA_TARGETS:= \
+	ev23x71a \
+	tactical-1000

 MBEDTLS_NAME:=mbedtls
 MBEDTLS_RELEASE:=2.28.10
@ -52,17 +63,6 @@ define Build/Prepare
 	$(TAR) -C $(PKG_BUILD_DIR) -xf $(DL_DIR)/$(MBEDTLS_SOURCE)
 endef

-# We must not pass OPENSSL_DIR as locally built mbedtls is used
-define Build/Compile
-	+unset CC; \
-	$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
-		CROSS_COMPILE=$(TARGET_CROSS) \
-		$(if $(DTC),DTC="$(DTC)") \
-		PLAT=$(PLAT) \
-		BUILD_STRING="OpenWrt $(PKG_VERSION_PREFIX)$(PKG_VERSION)-$(PKG_RELEASE) ($(VARIANT))" \
-		$(TFA_MAKE_FLAGS)
-endef
-
 TFA_MAKE_FLAGS += \
 	MBEDTLS_DIR=$(PKG_BUILD_DIR)/$(MBEDTLS_NAME) \
 	BL33=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.bin \
--- a/package/boot/arm-trusted-firmware-microchipsw/patches/0001-microchip-lan969x-add-Novarq-Tactical-1000-v3.patch
+++ b/package/boot/arm-trusted-firmware-microchipsw/patches/0001-microchip-lan969x-add-Novarq-Tactical-1000-v3.patch
@ -0,0 +1,171 @@
+From 190202583edb9dcab5ca49638169d08a332f0fdf Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Sun, 2 Nov 2025 16:57:45 +0100
+Subject: [PATCH] microchip: lan969x: add Novarq Tactical 1000 v3
+
+Add support for Novarq Tactical 1000 v3 board as a separate platform since
+it uses 2GB of RAM and requires a different RAM configuration.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ .../fdts/lan969x-tactical-1000-v3-ddr.dtsi    | 90 +++++++++++++++++++
+ .../novarq_tactical_1000_v3_tb_fw_config.dts  | 30 +++++++
+ .../novarq_tactical_1000_v3/platform.mk       | 12 +++
+ scripts/fwu/fwu.js                            |  2 +-
+ 4 files changed, 133 insertions(+), 1 deletion(-)
+ create mode 100644 plat/microchip/lan969x/fdts/lan969x-tactical-1000-v3-ddr.dtsi
+ create mode 100644 plat/microchip/lan969x/novarq_tactical_1000_v3/fdts/novarq_tactical_1000_v3_tb_fw_config.dts
+ create mode 100644 plat/microchip/lan969x/novarq_tactical_1000_v3/platform.mk
+
+--- /dev/null
+++ b/plat/microchip/lan969x/fdts/lan969x-tactical-1000-v3-ddr.dtsi
+@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Copyright (C) 2022 Microchip Technology Inc. and its subsidiaries.
+ *
+ */
+
+&ddr {
+	microchip,mem-name = "lan969x_tactical_1000_2gb 2025-11-02-13:03:23 7391dfb-dirty";
+	microchip,mem-speed = <2400>;
+	microchip,mem-size = <0x80000000>;
+	microchip,mem-bus-width = <16>;
+
+	microchip,main-reg = <
+		0x00001091	/* crcparctl1 */
+		0x00000001	/* dbictl */
+		0x00000040	/* dfimisc */
+		0x0391820f	/* dfitmg0 */
+		0x00040201	/* dfitmg1 */
+		0x40400003	/* dfiupd0 */
+		0x004000ff	/* dfiupd1 */
+		0x003f7f40	/* ecccfg0 */
+		0x00020248	/* init0 */
+		0x00e80000	/* init1 */
+		0x0c340101	/* init3 */
+		0x10180200	/* init4 */
+		0x00110000	/* init5 */
+		0x00000402	/* init6 */
+		0x00000c19	/* init7 */
+		0x81040010	/* mstr */
+		0x00000000	/* pccfg */
+		0x00000000	/* pwrctl */
+		0x00210020	/* rfshctl0 */
+		0x00000000	/* rfshctl3 */
+	>;
+
+	microchip,timing-reg = <
+		0x17131413	/* dramtmg0 */
+		0x0007051b	/* dramtmg1 */
+		0x1a000010	/* dramtmg12 */
+		0x090b0512	/* dramtmg2 */
+		0x0000400c	/* dramtmg3 */
+		0x08040409	/* dramtmg4 */
+		0x07070404	/* dramtmg5 */
+		0x07060c0b	/* dramtmg8 */
+		0x0003040d	/* dramtmg9 */
+		0x07000610	/* odtcfg */
+		0x0049014b	/* rfshtmg */
+	>;
+
+	microchip,mapping-reg = <
+		0x0000001f	/* addrmap0 */
+		0x003f0909	/* addrmap1 */
+		0x00000700	/* addrmap2 */
+		0x00000000	/* addrmap3 */
+		0x00001f1f	/* addrmap4 */
+		0x07070707	/* addrmap5 */
+		0x07070707	/* addrmap6 */
+		0x00000f07	/* addrmap7 */
+		0x00003f01	/* addrmap8 */
+	>;
+
+	microchip,phy-reg = <
+		0x0000040c	/* dcr */
+		0x0064401b	/* dsgcr */
+		0x8000b0cf	/* dtcr0 */
+		0x00010a37	/* dtcr1 */
+		0x00c01884	/* dxccr */
+		0x000010ba	/* pgcr2 */
+		0x00000000	/* schcr1 */
+		0x00079900	/* zq0pr */
+		0x10077900	/* zq1pr */
+		0x00000000	/* zq2pr */
+		0x00058f00	/* zqcr */
+	>;
+
+	microchip,phy_timing-reg = <
+		0x0827100a	/* dtpr0 */
+		0x28250018	/* dtpr1 */
+		0x000702a1	/* dtpr2 */
+		0x03000101	/* dtpr3 */
+		0x02950808	/* dtpr4 */
+		0x00361009	/* dtpr5 */
+		0x4ae25710	/* ptr0 */
+		0x74f4950e	/* ptr1 */
+		0x00083def	/* ptr2 */
+		0x2a192000	/* ptr3 */
+		0x1003a000	/* ptr4 */
+	>;
+
+};
+--- /dev/null
+++ b/plat/microchip/lan969x/novarq_tactical_1000_v3/fdts/novarq_tactical_1000_v3_tb_fw_config.dts
+@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2022, Microchip Technology Inc. and its subsidiaries.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+#include "lan969x.dtsi"
+#include "lan969x-tactical-1000-v3-ddr.dtsi"
+
+&emmc_clk {
+	clock-frequency = <100000000>;
+};
+
+&sdmmc0 {
+	status = "okay";
+	bus-width = <8>;
+};
+
+&qspi0 {
+	status = "okay";
+	spi-flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <100000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+	};
+};
+--- /dev/null
+++ b/plat/microchip/lan969x/novarq_tactical_1000_v3/platform.mk
+@@ -0,0 +1,12 @@
+#
+# Copyright (c) 2021, Microchip Technology Inc. and its subsidiaries.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+
+include plat/microchip/lan969x/common/common.mk
+
+# This is used in lan969x code
+$(eval $(call add_define,LAN969X_ASIC))
+# This is used in common drivers
+$(eval $(call add_define,LAN966X_ASIC))
+--- a/scripts/fwu/fwu.js
+++ b/scripts/fwu/fwu.js
+@@ -91,7 +91,7 @@ const platforms = [
+ 	"ddr_diag":	ddr_diag_regs_lan969x,
+ 	"ddr_regs":	ddr_regs_lan969x,
+ 	"ddr_speed":	lan969x_speeds,
+-	"bl2u_compat":	["lan969x_a0", "lan969x_svb"],
+	"bl2u_compat":	["lan969x_a0", "lan969x_svb", "novarq_tactical_1000_v3"],
+     },
+ ];
+ 
--- a/package/boot/arm-trusted-firmware-microchipsw/patches/0002-cert_create-add-LibreSSL-3.9-compatibility.patch
+++ b/package/boot/arm-trusted-firmware-microchipsw/patches/0002-cert_create-add-LibreSSL-3.9-compatibility.patch
@ -0,0 +1,95 @@
+From 40166fd8d88f33c621d3cca0b936f31816f3fe2e Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Mon, 12 Jan 2026 14:40:23 +0100
+Subject: [PATCH] cert_create: add LibreSSL 3.9+ compatibility
+
+LibreSSL 3.9+ has dropped the whole support for X509V3 extensions.
+
+Generated by Gemini 3 Pro.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ tools/cert_create/src/ext.c | 26 ++++++++++++++++++++++----
+ 1 file changed, 22 insertions(+), 4 deletions(-)
+
+--- a/tools/cert_create/src/ext.c
+++ b/tools/cert_create/src/ext.c
+@@ -51,15 +51,18 @@ int ext_init(void)
+ {
+ 	cmd_opt_t cmd_opt;
+ 	ext_t *ext;
+#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x40200000L
+ 	X509V3_EXT_METHOD *m;
+-	int nid, ret;
+	int ret, nid;
+#endif
+ 	unsigned int i;
+ 
+ 	extensions = malloc((num_def_extensions * sizeof(def_extensions[0]))
+ #ifdef PDEF_EXTS
+ 			    + (num_pdef_extensions * sizeof(pdef_extensions[0]))
+ #endif
+-			    );
+		);
+
+ 	if (extensions == NULL) {
+ 		ERROR("%s:%d Failed to allocate memory.\n", __func__, __LINE__);
+ 		return 1;
+@@ -69,7 +72,7 @@ int ext_init(void)
+ 	       (num_def_extensions * sizeof(def_extensions[0])));
+ #ifdef PDEF_EXTS
+ 	memcpy(&extensions[num_def_extensions], &pdef_extensions[0],
+-		(num_pdef_extensions * sizeof(pdef_extensions[0])));
+	       (num_pdef_extensions * sizeof(pdef_extensions[0])));
+ 	num_extensions = num_def_extensions + num_pdef_extensions;
+ #else
+ 	num_extensions = num_def_extensions;
+@@ -86,11 +89,15 @@ int ext_init(void)
+ 			cmd_opt.help_msg = ext->help_msg;
+ 			cmd_opt_add(&cmd_opt);
+ 		}
+
+ 		/* Register the extension OID in OpenSSL */
+ 		if (ext->oid == NULL) {
+ 			continue;
+ 		}
+
+#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x40200000L
+ 		nid = OBJ_create(ext->oid, ext->sn, ext->ln);
+
+ 		if (ext->alias) {
+ 			X509V3_EXT_add_alias(nid, ext->alias);
+ 		} else {
+@@ -117,7 +124,16 @@ int ext_init(void)
+ 				return 1;
+ 			}
+ 		}
+#else
+		/*
+		 * LibreSSL 4.2.0+ removed X509V3_EXT_add/alias.
+		 * We still register the OID, but ignore the returned NID
+		 * as we skip method registration.
+		 */
+		OBJ_create(ext->oid, ext->sn, ext->ln);
+#endif
+ 	}
+
+ 	return 0;
+ }
+ 
+@@ -323,12 +339,14 @@ void ext_cleanup(void)
+ 	for (i = 0; i < num_extensions; i++) {
+ 		if (extensions[i].arg != NULL) {
+ 			void *ptr = (void *)extensions[i].arg;
+-
+ 			extensions[i].arg = NULL;
+ 			free(ptr);
+ 		}
+ 	}
+ 	free(extensions);
+
+#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x40200000L
+ 	X509V3_EXT_cleanup();
+#endif
+ }
+ 
--- a/package/boot/arm-trusted-firmware-microchipsw/patches/0003-cert_create-pass-pthread-in-LDFLAGS.patch
+++ b/package/boot/arm-trusted-firmware-microchipsw/patches/0003-cert_create-pass-pthread-in-LDFLAGS.patch
@ -0,0 +1,36 @@
+From 11ff8b5e67830d5a09f39e8c1f000b0ddcf8e88f Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Mon, 12 Jan 2026 15:16:07 +0100
+Subject: [PATCH] cert_create: pass pthread in LDFLAGS
+
+OpenWrt-s LibreSSL is linked against pthread, so we have to make sure to
+pass -lpthread in LDFLAGS to avoid:
+/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-crypto_init.o): in function `OPENSSL_init_crypto':
+crypto_init.c:(.text+0x67): undefined reference to `pthread_once'
+/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-err.o): in function `ERR_load_ERR_strings':
+err.c:(.text+0x812): undefined reference to `pthread_once'
+/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-conf_sap.o): in function `OpenSSL_config':
+conf_sap.c:(.text+0xc0): undefined reference to `pthread_once'
+/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-conf_sap.o): in function `OpenSSL_no_config':
+conf_sap.c:(.text+0x107): undefined reference to `pthread_once'
+/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-err_all.o): in function `ERR_load_crypto_strings':
+err_all.c:(.text+0xa3): undefined reference to `pthread_once'
+collect2: error: ld returned 1 exit status
+make[4]: *** [Makefile:93: cert_create] Error 1
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ tools/cert_create/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/cert_create/Makefile
+++ b/tools/cert_create/Makefile
+@@ -79,7 +79,7 @@ INC_DIR += -I ./include -I ${PLAT_INCLUD
+ # located under the main project directory (i.e.: ${OPENSSL_DIR}, not
+ # ${OPENSSL_DIR}/lib/).
+ LIB_DIR := -L ${OPENSSL_DIR}/lib -L ${OPENSSL_DIR}
+-LIB := -lssl -lcrypto
+LIB := -lssl -lcrypto -pthread
+ 
+ HOSTCC ?= gcc
+ 
--- a/package/boot/arm-trusted-firmware-microchipsw/patches/0004-microchip-lan969x-do-not-rely-on-Ruby-shebang.patch
+++ b/package/boot/arm-trusted-firmware-microchipsw/patches/0004-microchip-lan969x-do-not-rely-on-Ruby-shebang.patch
@ -0,0 +1,29 @@
+From f78f934710394822a36bd74043ed93a812c1c690 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Mon, 12 Jan 2026 15:36:35 +0100
+Subject: [PATCH] microchip: lan969x: do not rely on Ruby shebang
+
+Host Ruby build in the staging dir must be used, so we cannot rely on the
+shebang as that will fail.
+
+So, call the script via Ruby executable instead.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ plat/microchip/lan969x/common/common.mk | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/plat/microchip/lan969x/common/common.mk
+++ b/plat/microchip/lan969x/common/common.mk
+@@ -218,9 +218,9 @@ FWU_HTML := ${BUILD_PLAT}/fwu.html
+ FWU_JS   := ${BUILD_PLAT}/fwu_app.js
+ 
+ ${FWU_JS}: ${BUILD_PLAT}/${FWU_FIP_NAME}
+-	./plat/microchip/scripts/mkjs.rb -p ${PLAT} -o ${FWU_JS} $<
+	$(Q)ruby ./plat/microchip/scripts/mkjs.rb -p ${PLAT} -o ${FWU_JS} $<
+ 
+ ${FWU_HTML}: ${FWU_JS}
+-	./plat/microchip/scripts/html_inline.rb -i ${BUILD_PLAT} ./scripts/fwu/serial.html > ${FWU_HTML}
+	$(Q)ruby ./plat/microchip/scripts/html_inline.rb -i ${BUILD_PLAT} ./scripts/fwu/serial.html > ${FWU_HTML}
+ 
+ all: ${FWU_HTML}
--- a/package/boot/uboot-airoha/Makefile
+++ b/package/boot/uboot-airoha/Makefile
@ -13,7 +13,7 @@ include $(INCLUDE_DIR)/host-build.mk

 define U-Boot/Default
  BUILD_TARGET:=airoha
-  FIP_COMPRESS:=1
+  LZMA_COMPRESS:=1
 endef

 define U-Boot/an7581_rfb
@ -36,9 +36,18 @@ define U-Boot/an7583_rfb
  BL31_IMAGE:=an7583-bl31.bin
 endef

+define U-Boot/an7581_gemtek_w1700k
+  NAME:=Gemtek W1700K (UBI)
+  UBOOT_CONFIG:=an7581_w1700k
+  BUILD_DEVICES:=gemtek_w1700k-ubi
+  BUILD_SUBTARGET:=an7581
+  UBOOT_IMAGE:=u-boot.bin
+endef
+
 UBOOT_TARGETS := \
 	an7581_rfb \
-	an7583_rfb
+	an7583_rfb \
+	an7581_gemtek_w1700k

 UBOOT_CUSTOMIZE_CONFIG := \
 	--disable TOOLS_KWBIMAGE \
@ -54,15 +63,12 @@ define Build/fip-image-bl2
 endef

 define Build/fip-image
-	$(if $(FIP_COMPRESS), $(STAGING_DIR_HOST)/bin/lzma e \
-		$(PKG_BUILD_DIR)/u-boot.bin \
-		$(PKG_BUILD_DIR)/u-boot.bin.lzma)
-	$(if $(FIP_COMPRESS), $(STAGING_DIR_HOST)/bin/lzma e \
+	$(if $(LZMA_COMPRESS), $(STAGING_DIR_HOST)/bin/lzma e \
 		files/$(BL31_IMAGE) \
 		$(PKG_BUILD_DIR)/bl31.bin.lzma)
 	$(STAGING_DIR_HOST)/bin/fiptool create \
-		--soc-fw $(PKG_BUILD_DIR)/bl31.bin$(if $(FIP_COMPRESS),.lzma) \
-		--nt-fw $(PKG_BUILD_DIR)/u-boot.bin$(if $(FIP_COMPRESS),.lzma) \
+		--soc-fw $(PKG_BUILD_DIR)/bl31.bin$(if $(LZMA_COMPRESS),.lzma) \
+		--nt-fw $(PKG_BUILD_DIR)/u-boot.bin$(if $(LZMA_COMPRESS),.lzma) \
 		$(PKG_BUILD_DIR)/u-boot.fip
 endef

@ -73,6 +79,9 @@ endef

 define Build/Compile
 	$(call Build/Compile/U-Boot)
+	$(if $(LZMA_COMPRESS), $(STAGING_DIR_HOST)/bin/lzma e \
+		$(PKG_BUILD_DIR)/u-boot.bin \
+		$(PKG_BUILD_DIR)/u-boot.bin.lzma)
 ifeq ($(UBOOT_IMAGE),u-boot.fip)
 	$(call Build/fip-image-bl2)
 	$(call Build/fip-image)
@ -88,6 +97,11 @@ define Build/InstallDev
 ifeq ($(UBOOT_IMAGE),u-boot.fip)
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/bl2.fip $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-bl2.fip
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/u-boot.fip $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-bl31-u-boot.fip
+else
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/u-boot.bin$(if $(LZMA_COMPRESS),.lzma) \
+		$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.bin$(if $(LZMA_COMPRESS),.lzma)
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/u-boot.dtb \
+		$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.dtb
 endif
 endef

--- a/package/boot/uboot-airoha/patches/307-airoha-add-Ethernet-node-in-AN7581-dtsi.patch
+++ b/package/boot/uboot-airoha/patches/307-airoha-add-Ethernet-node-in-AN7581-dtsi.patch
@ -0,0 +1,52 @@
+From 6ecd1312f85bdd0a9be8cc1cdada58c83f68ad99 Mon Sep 17 00:00:00 2001
+From: Kenneth Kasilag <kenneth@kasilag.me>
+Date: Fri, 6 Mar 2026 06:26:03 +0000
+Subject: [PATCH] uboot-airoha: add ethernet node for an7581 dtsi
+
+The ethernet driver (airoha_eth) supports an7581 however it is
+not declared in the dtsi. Add the ethernet node for the built in
+airoha ethernet controller.
+
+Signed-off-by: Kenneth Kasilag <kenneth@kasilag.me>
+---
+ dts/upstream/src/arm64/airoha/en7581.dtsi | 36 +++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+diff --git a/dts/upstream/src/arm64/airoha/en7581.dtsi b/dts/upstream/src/arm64/airoha/en7581.dtsi
+index 69265e4a1fea97..3b319e7b72fb57 100644
+--- a/dts/upstream/src/arm64/airoha/en7581.dtsi
+++ b/dts/upstream/src/arm64/airoha/en7581.dtsi
+@@ -346,5 +346,33 @@
+ 
+ 			status = "disabled";
+ 		};
+
+		eth: ethernet@1fb50000 {
+			compatible = "airoha,en7581-eth";
+			reg = <0 0x1fb50000 0 0x2600>,
+			      <0 0x1fb54000 0 0x2000>,
+			      <0 0x1fb56000 0 0x2000>;
+			reg-names = "fe", "qdma0", "qdma1";
+
+			resets = <&scuclk EN7581_FE_RST>,
+				 <&scuclk EN7581_FE_PDMA_RST>,
+				 <&scuclk EN7581_FE_QDMA_RST>,
+				 <&scuclk EN7581_DUAL_HSI0_MAC_RST>,
+				 <&scuclk EN7581_DUAL_HSI1_MAC_RST>,
+				 <&scuclk EN7581_HSI_MAC_RST>,
+				 <&scuclk EN7581_XFP_MAC_RST>;
+			reset-names = "fe", "pdma", "qdma",
+				      "hsi0-mac", "hsi1-mac",
+				      "hsi-mac", "xfp-mac";
+
+			status = "disabled";
+		};
+
+		switch: switch@1fb58000 {
+			compatible = "airoha,en7581-switch";
+			reg = <0 0x1fb58000 0 0x8000>;
+
+			status = "disabled";
+		};
+ 	};
+ };
--- a/package/boot/uboot-airoha/patches/998-airoha-add-snfi-label.patch
+++ b/package/boot/uboot-airoha/patches/998-airoha-add-snfi-label.patch
@ -0,0 +1,21 @@
+From 4fb890cd92dcf8985e76a544c949ad455784ed81 Mon Sep 17 00:00:00 2001
+From: Dirk Buchwalder <buchwalder@posteo.de>
+Date: Sun, 1 Mar 2026 13:48:42 +0100
+Subject: [PATCH] uboot-airoha: add a label to the spi node
+
+Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
+---
+ dts/upstream/src/arm64/airoha/en7581.dtsi           | 2  -+
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/dts/upstream/src/arm64/airoha/en7581.dtsi
+++ b/dts/upstream/src/arm64/airoha/en7581.dtsi
+@@ -150,7 +150,7 @@
+ 			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>;
+ 		};
+ 
+-		spi@1fa10000 {
+		snfi: spi@1fa10000 {
+ 			compatible = "airoha,en7581-snand";
+ 			reg = <0x0 0x1fa10000 0x0 0x140>,
+ 			      <0x0 0x1fa11000 0x0 0x160>;
--- a/package/boot/uboot-airoha/patches/999-airoha-add-gemtek-w1700k.patch
+++ b/package/boot/uboot-airoha/patches/999-airoha-add-gemtek-w1700k.patch
@ -0,0 +1,318 @@
+From d6402eadaa56494b382e389d739b9f80d6883788 Mon Sep 17 00:00:00 2001
+From: Kenneth Kasilag <kenneth@kasilag.me>
+Date: Sat, 21 Feb 2026 21:49:46 +0000
+Subject: [PATCH] an7581: add uboot chainloader for w1700k
+
+Due to issues surrounding the implementation of the vendor BMT/BBT
+on Airoha, upstream ATF + uboot has switched to UBI flash partitions.
+
+However, some devices shipped on this platform are bootloader locked,
+and thus it is impossible to replace ATF + uboot.
+
+During testing for the Gemtek W1700K (#17869), sysupgrades from Linux
+(which is unaware of the underlying BMT/BBT) would occasionally write
+data into blocks which were remapped by the vendor uboot when it was
+read on the following reboot, causing a soft brick.
+
+An acceptable workaround [1],[2] was discussed where an intermediate
+uboot would be written by the vendor uboot (which is aware of Airoha
+BMT/BBT). This chainloader would then ignore the regions of flash
+used by the vendor uboot, and store all relevant data inside of UBI.
+
+UBI would then be used to handle bad block management. As the vendor
+ATF + uboot do not read or interact with the UBI region, we would avoid
+unwanted remaps from BMT/BBT.
+
+This commit introduces support for building such a chainloader, by
+packaging u-boot and DTS into a FIT image; to be flashed like a kernel.
+
+Configuration for the Gemtek W1700K is provided as an example of how the
+chainloader is used.
+
+[1] https://github.com/openwrt/openwrt/pull/17869#discussion_r2836066746
+[2] https://github.com/openwrt/openwrt/pull/17869#discussion_r2838395671
+
+Signed-off-by: Kenneth Kasilag <kenneth@kasilag.me>
+---
+ configs/an7581_w1700k_defconfig                     | 107 ++++++++++
+ defenvs/an7581_w1700k_env                           |  21 ++
+ dts/upstream/src/arm64/airoha/an7581-w1700k-ubi.dts |  87 +++++
+ 3 files changed, 215 insertions(+), 0 deletions(-)
+ create mode 100644 configs/an7581_w1700k_defconfig
+ create mode 100644 defenvs/an7581_w1700k_env
+ create mode 100644 dts/upstream/src/arm64/airoha/an7581-w1700k-ubi.dts
+
+--- /dev/null
+++ b/configs/an7581_w1700k_defconfig
+@@ -0,0 +1,107 @@
+CONFIG_ARM=y
+CONFIG_ARCH_AIROHA=y
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_TARGET_AN7581=y
+CONFIG_TEXT_BASE=0x81E00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_ENV_SIZE=0x4000
+CONFIG_ENV_OFFSET=0x7c000
+CONFIG_DM_GPIO=y
+CONFIG_DEFAULT_DEVICE_TREE="airoha/an7581-w1700k-ubi"
+CONFIG_SYS_LOAD_ADDR=0x81800000
+CONFIG_BUILD_TARGET="u-boot.bin"
+# CONFIG_EFI_LOADER is not set
+CONFIG_FIT=y
+CONFIG_FIT_VERBOSE=y
+CONFIG_BOOTDELAY=30
+CONFIG_DEFAULT_FDT_FILE="an7581-w1700k-ubi"
+CONFIG_SYS_PBSIZE=1049
+CONFIG_SYS_CONSOLE_IS_IN_ENV=y
+# CONFIG_DISPLAY_BOARDINFO is not set
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="U-Boot> "
+CONFIG_SYS_MAXARGS=8
+CONFIG_CMD_BOOTZ=y
+CONFIG_CMD_BOOTMENU=y
+# CONFIG_CMD_ELF is not set
+# CONFIG_CMD_XIMG is not set
+CONFIG_CMD_BIND=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_SF_TEST=y
+CONFIG_CMD_SPI=y
+# CONFIG_CMD_SETEXPR is not set
+CONFIG_CMD_PING=y
+CONFIG_CMD_EXT4=y
+CONFIG_CMD_FAT=y
+CONFIG_CMD_FS_GENERIC=y
+CONFIG_CMD_MTDPARTS=y
+CONFIG_CMD_LOG=y
+CONFIG_OF_UPSTREAM=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_MMC=y
+# CONFIG_ENV_IS_IN_MTD is not set
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_SYS_RX_ETH_BUFFER=8
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_CLK=y
+CONFIG_DMA=y
+CONFIG_LED=y
+CONFIG_LED_GPIO=y
+CONFIG_MMC_HS200_SUPPORT=y
+CONFIG_MMC_MTK=y
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH_EON=y
+CONFIG_SPI_FLASH_GIGADEVICE=y
+CONFIG_SPI_FLASH_ISSI=y
+CONFIG_SPI_FLASH_MACRONIX=y
+CONFIG_SPI_FLASH_SPANSION=y
+CONFIG_SPI_FLASH_STMICRO=y
+CONFIG_SPI_FLASH_WINBOND=y
+CONFIG_SPI_FLASH_MTD=y
+CONFIG_AIROHA_ETH=y
+CONFIG_DM_MDIO=y
+CONFIG_CMD_MII=y
+CONFIG_CMD_MDIO=y
+CONFIG_PHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_RAM=y
+CONFIG_DM_SERIAL=y
+CONFIG_SYS_NS16550=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_AIROHA_SNFI_SPI=y
+CONFIG_CMD_UBI=y
+# CONFIG_CMD_UBI_RENAME is not set
+CONFIG_CMD_UBIFS=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_UBI_VID_OFFSET=0
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_MODULE=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTD_UBI_BEB_LIMIT=20
+# CONFIG_MTD_UBI_FASTMAP is not set
+CONFIG_UBI_BLOCK=y
+# CONFIG_UBIFS_SILENCE_MSG is not set
+# CONFIG_UBIFS_SILENCE_DEBUG_DUMP is not set
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/an7581_w1700k_env"
+CONFIG_SHA512=y
+--- /dev/null
+++ b/defenvs/an7581_w1700k_env
+@@ -0,0 +1,27 @@
+loadaddr=0x81800000
+initaddr=0x89000000
+ipaddr=192.168.1.1
+serverip=192.168.1.10
+bootfile=openwrt-airoha-an7581-gemtek_w1700k-ubi-initramfs-recovery.itb
+installfile=openwrt-airoha-an7581-gemtek_w1700k-ubi-initramfs-installer.itb
+bootled_pwr=status:red
+bootled_rec=status:blue
+boot_ubi=ubi part ubi && run boot_production ; run boot_recovery
+boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
+boot_recovery=led $bootled_rec on ; run ubi_read_recovery ; bootm $initaddr#$bootconf ; led $bootled_rec off
+boot_tftp=tftpboot $initaddr $bootfile && bootm $initaddr#$bootconf
+boot_installer=tftpboot $initaddr $installfile && bootm $initaddr#$bootconf
+bootconf=config-1
+bootcmd=boot_ubi
+bootdelay=3
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=3
+bootmenu_title=      34m( ( ( mOpenWrt34m ) ) )
+bootmenu_0=Run default boot command.=run boot_production
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot recovery system from flash.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_3=Boot installer via TFTP.=run boot_installer ; run bootmenu_confirm_return
+bootmenu_4=Reboot.=reset
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr
+ubi_read_recovery=ubi check recovery && ubi read $initaddr recovery
+--- /dev/null
+++ b/dts/upstream/src/arm64/airoha/an7581-w1700k-ubi.dts
+@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/dts-v1/;
+
+/* Bootloader installs ATF here */
+/memreserve/ 0x80000000 0x200000;
+
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/gpio/gpio.h>
+#include "en7581.dtsi"
+
+/ {
+	model = "Gemtek W1700K (UBI)";
+	compatible = "gemtek,w1700k-ubi", "airoha,an7581", "airoha,en7581";
+
+	aliases {
+		serial0 = &uart1;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		linux,usable-memory-range = <0x0 0x80200000 0x0 0x7fe00000>;
+	};
+
+	memory@80000000 {
+		device_type = "memory";
+		reg = <0x0 0x80000000 0x2 0x00000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		key-restart {
+			label = "reset";
+			gpios = <&en7581_pinctrl 0 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_status_green {
+			label = "status:green";
+			gpios = <&en7581_pinctrl 17 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+		led_status_blue {
+			label = "status:blue";
+			gpios = <&en7581_pinctrl 19 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+		led_status_red {
+			label = "status:red";
+			gpios = <&en7581_pinctrl 29 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+		led_status_white {
+			label = "status:white";
+			gpios = <&en7581_pinctrl 20 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+	};
+};
+
+&snfi {
+	status = "okay";
+};
+
+&spi_nand {
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		vendor@0 {
+			label = "vendor";
+			reg = <0x00000000 0x00600000>;
+			read-only;
+		};
+
+		chainloader@600000 {
+			label = "chainloader";
+			reg = <0x00600000 0x00100000>;
+			read-only;
+		};
+
+		ubi@700000 {
+			label = "ubi";
+			reg = <0x00700000 0x1b700000>;
+		};
+
+		/* reserved for bad block table */
+		reserved_bmt@1be00000 {
+			label = "reserved_bmt";
+			reg = <0x1be00000 0x04200000>;
+			read-only;
+		};
+	};
+};
+
+&en7581_pinctrl {
+	gpio-ranges = <&en7581_pinctrl 0 13 47>;
+
+	pcie0_rst_pins: pcie0-rst-pins {
+		conf {
+			pins = "pcie_reset0";
+			drive-open-drain = <1>;
+		};
+	};
+};
+
+&pcie0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_rst_pins>;
+	status = "okay";
+};
+
+&i2c0 {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
--- a/package/boot/uboot-at91/Makefile
+++ b/package/boot/uboot-at91/Makefile
@ -104,7 +104,7 @@ endef
 define U-Boot/sama5d4_xplained_nandflash
  NAME:=SAMA5D4 Xplained board (NandFlash)
  BUILD_SUBTARGET:=sama5
-  BUILD_DEVICES:=microchip_sama5d3-xplained
+  BUILD_DEVICES:=microchip_sama5d4-xplained
 endef

 define U-Boot/sama5d27_som1_ek_mmc
--- a/package/boot/uboot-lantiq/patches/0017-tools-add-some-helper-tools-for-Lantiq-SoCs.patch
+++ b/package/boot/uboot-lantiq/patches/0017-tools-add-some-helper-tools-for-Lantiq-SoCs.patch
@ -251,7 +251,7 @@ Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
 +}
 +
 +/^#define/ {
-+	/* DC03 contains MC enable bit and must not be set here */
+	# DC03 contains MC enable bit and must not be set here
 +	if (tolower($2) != "mc_dc03_value")
 +		printf("WM32 0x%x %s\n", reg_base, tolower($3))
 +
@ -357,7 +357,7 @@ Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
 +}
 --- /dev/null
 +++ b/tools/lantiq_ram_init_uart.awk
-@@ -0,0 +1,117 @@
+@@ -0,0 +1,115 @@
 +#!/usr/bin/awk -f
 +#
 +# Copyright (C) 2011-2012 Luka Perkov <luka@openwrt.org>
@ -383,45 +383,45 @@ Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
 +
 +function mc_danube_prologue()
 +{
-+	/* Clear access error log registers */
+	# Clear access error log registers
 +	print "0xbf800010", "0x0"
 +	print "0xbf800020", "0x0"
 +
-+	/* Enable DDR and SRAM module in memory controller */
+	# Enable DDR and SRAM module in memory controller
 +	print "0xbf800060", "0x5"
 +
-+	/* Clear start bit of DDR memory controller */
+	# Clear start bit of DDR memory controller
 +	print "0xbf801030", "0x0"
 +}
 +
 +function mc_ar9_prologue()
 +{
-+	/* Clear access error log registers */
+	# Clear access error log registers
 +	print "0xbf800010", "0x0"
 +	print "0xbf800020", "0x0"
 +
-+	/* Enable FPI, DDR and SRAM module in memory controller */
+	# Enable FPI, DDR and SRAM module in memory controller
 +	print "0xbf800060", "0xD"
 +
-+	/* Clear start bit of DDR memory controller */
+	# Clear start bit of DDR memory controller
 +	print "0xbf801030", "0x0"
 +}
 +
 +function mc_ddr1_epilogue()
 +{
-+	/* Set start bit of DDR memory controller */
+	# Set start bit of DDR memory controller
 +	print "0xbf801030", "0x100"
 +}
 +
 +function mc_ddr2_prologue()
 +{
-+	/* Put memory controller in inactive mode */
+	# Put memory controller in inactive mode
 +	print "0xbf401070", "0x0"
 +}
 +
 +function mc_ddr2_epilogue(mc_ccr07_value)
 +{
-+	/* Put memory controller in active mode */
+	# Put memory controller in active mode
 +	mc_ccr07_value = or(mc_ccr07_value, 0x100)
 +	printf("0xbf401070 0x%x\n", mc_ccr07_value)
 +}
@ -452,12 +452,10 @@ Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
 +}
 +
 +/^#define/ {
-+	/* CCR07 contains MC enable bit and must not be set here */
+	# CCR07 contains MC enable bit and must not be set here
 +	if (tolower($2) == "mc_ccr07_value")
 +		mc_ccr07_value = strtonum($3)
-+	if (tolower($2) == "mc_dc03_value")
-+		/* CCR07 contains MC enable bit and must not be set here */
-+	else
+	if (tolower($2) != "mc_dc03_value")
 +		printf("0x%x %s\n", reg_base, tolower($3))
 +
 +	reg_base += 0x10
--- a/package/boot/uboot-mediatek/Makefile
+++ b/package/boot/uboot-mediatek/Makefile
@ -231,6 +231,18 @@ define U-Boot/mt7981_abt_asr3000
  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
 endef

+define U-Boot/mt7981_bazis-ax3000wm
+  NAME:=BAZIS AX3000WM
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=bazis_ax3000wm
+  UBOOT_CONFIG:=mt7981_bazis_ax3000wm
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
+endef
+
 define U-Boot/mt7981_cmcc_a10
  NAME:=CMCC A10
  BUILD_SUBTARGET:=filogic
@ -299,8 +311,8 @@ define U-Boot/mt7981_comfast_cf-wr632ax
  UBOOT_IMAGE:=u-boot.fip
  BL2_BOOTDEV:=spim-nand
  BL2_SOC:=mt7981
-  BL2_DDRTYPE:=ddr3
-  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
+  BL2_DDRTYPE:=ddr3-1866mhz
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3-1866mhz
 endef

 define U-Boot/mt7981_cudy_tr3000-v1
@ -309,9 +321,68 @@ define U-Boot/mt7981_cudy_tr3000-v1
  BUILD_DEVICES:=cudy_tr3000-v1-ubootmod
  UBOOT_CONFIG:=mt7981_cudy_tr3000-v1
  UBOOT_IMAGE:=u-boot.fip
-  BL2_BOOTDEV:=cudy-tr3000-v1
+  BL2_BOOTDEV:=cudy-ddr3
  BL2_SOC:=mt7981
-  DEPENDS:=+trusted-firmware-a-mt7981-cudy-tr3000-v1
+  DEPENDS:=+trusted-firmware-a-mt7981-cudy-ddr3
+endef
+
+define U-Boot/mt7981_cudy_wbr3000uax-v1
+  NAME:=Cudy WBR3000UAX v1
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cudy_wbr3000uax-v1-ubootmod
+  UBOOT_CONFIG:=mt7981_cudy_wbr3000uax-v1
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=cudy-ddr3
+  BL2_SOC:=mt7981
+  DEPENDS:=+trusted-firmware-a-mt7981-cudy-ddr3
+endef
+
+define U-Boot/mt7981_cudy_wr3000e-v1
+  NAME:=Cudy WR3000E v1
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cudy_wr3000e-v1-ubootmod
+  UBOOT_CONFIG:=mt7981_cudy_wr3000e-v1
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=cudy
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-cudy-ddr3
+endef
+
+define U-Boot/mt7981_cudy_wr3000s-v1
+  NAME:=Cudy WR3000S v1
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cudy_wr3000s-v1-ubootmod
+  UBOOT_CONFIG:=mt7981_cudy_wr3000s-v1
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=cudy
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-cudy-ddr3
+endef
+
+define U-Boot/mt7981_cudy_wr3000h-v1
+  NAME:=Cudy WR3000H v1
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cudy_wr3000h-v1-ubootmod
+  UBOOT_CONFIG:=mt7981_cudy_wr3000h-v1
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=cudy
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-cudy-ddr3
+endef
+
+define U-Boot/mt7981_cudy_wr3000p-v1
+  NAME:=Cudy WR3000P v1
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cudy_wr3000p-v1-ubootmod
+  UBOOT_CONFIG:=mt7981_cudy_wr3000p-v1
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=cudy
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr4
+  DEPENDS:=+trusted-firmware-a-mt7981-cudy-ddr4
 endef

 define U-Boot/mt7981_glinet_gl-mt2500
@ -422,6 +493,18 @@ define U-Boot/mt7981_netis_nx31
  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
 endef

+define U-Boot/mt7981_netis_nx32u
+  NAME:=netis NX32U
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=netis_nx32u
+  UBOOT_CONFIG:=mt7981_netis_nx32u
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
+endef
+
 define U-Boot/mt7981_nokia_ea0326gmp
  NAME:=Nokia EA0326GMP
  BUILD_SUBTARGET:=filogic
@ -821,6 +904,18 @@ define U-Boot/mt7986_zyxel_ex5601-t0
  DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-4k-ddr4
 endef

+define U-Boot/mt7986_zyxel_wx5600-t0
+  NAME:=Zyxel WX5600-T0
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=zyxel_wx5600-t0-ubootmod
+  UBOOT_CONFIG:=mt7986_zyxel_wx5600-t0
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand-4k
+  BL2_SOC:=mt7986
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-4k-ddr3
+endef
+
 define U-Boot/mt7987_bananapi_bpi-r4-lite-emmc
  NAME:=BananaPi BPi-R4 Lite
  BUILD_SUBTARGET:=filogic
@ -870,6 +965,17 @@ define U-Boot/mt7987_bananapi_bpi-r4-lite-nor
  FIP_COMPRESS:=1
 endef

+define U-Boot/mt7987_routerich_be7200
+  NAME:=Routerich BE7200
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=routerich_be7200
+  UBOOT_CONFIG:=mt7987a_routerich_be7200
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand0
+  BL2_SOC:=mt7987
+  DEPENDS:=+trusted-firmware-a-mt7987-spim-nand0
+endef
+
 define U-Boot/mt7988_arcadyan_mozart
  NAME:=Arcadyan Mozart
  BUILD_SUBTARGET:=filogic
@ -1084,6 +1190,7 @@ UBOOT_TARGETS := \
 	mt7628_ravpower_rp-wd009 \
 	mt7629_rfb \
 	mt7981_abt_asr3000 \
+	mt7981_bazis-ax3000wm \
 	mt7981_cmcc_a10 \
 	mt7981_cmcc_rax3000m-emmc-ddr3 \
 	mt7981_cmcc_rax3000m-emmc-ddr4 \
@ -1091,6 +1198,11 @@ UBOOT_TARGETS := \
 	mt7981_cmcc_rax3000m-nand-ddr4 \
 	mt7981_comfast_cf-wr632ax \
 	mt7981_cudy_tr3000-v1 \
+	mt7981_cudy_wbr3000uax-v1 \
+	mt7981_cudy_wr3000e-v1 \
+	mt7981_cudy_wr3000s-v1 \
+	mt7981_cudy_wr3000h-v1 \
+	mt7981_cudy_wr3000p-v1 \
 	mt7981_gatonetworks_gdsp \
 	mt7981_glinet_gl-mt2500 \
 	mt7981_glinet_gl-x3000 \
@ -1101,6 +1213,7 @@ UBOOT_TARGETS := \
 	mt7981_konka_komi-a31 \
 	mt7981_netis_nx30v2 \
 	mt7981_netis_nx31 \
+	mt7981_netis_nx32u \
 	mt7981_nokia_ea0326gmp \
 	mt7981_openwrt_one-snand \
 	mt7981_openwrt_one-nor \
@ -1132,6 +1245,7 @@ UBOOT_TARGETS := \
 	mt7986_tplink_tl-xtr8488 \
 	mt7986_xiaomi_redmi-router-ax6000 \
 	mt7986_zyxel_ex5601-t0 \
+	mt7986_zyxel_wx5600-t0 \
 	mt7986_rfb \
 	mt7987_bananapi_bpi-r4-lite-emmc \
 	mt7987_bananapi_bpi-r4-lite-sdmmc \
@ -1140,6 +1254,7 @@ UBOOT_TARGETS := \
 	mt7987_rfb-emmc \
 	mt7987_rfb-sd \
 	mt7987_rfb-spim-nand \
+	mt7987_routerich_be7200 \
 	mt7988_arcadyan_mozart \
 	mt7988_asus_zenwifi-bt8 \
 	mt7988_bananapi_bpi-r4-emmc \
--- a/package/boot/uboot-mediatek/patches/445-add-netis-nx32u.patch
+++ b/package/boot/uboot-mediatek/patches/445-add-netis-nx32u.patch
@ -0,0 +1,341 @@
+--- /dev/null
+++ b/configs/mt7981_netis_nx32u_defconfig
+@@ -0,0 +1,108 @@
+CONFIG_ARM=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7981-netis_nx32u"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7981=y
+CONFIG_SYS_LOAD_ADDR=0x46000000
+CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
+CONFIG_DEBUG_UART_BASE=0x11002000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_DEBUG_UART=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=30
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-netis_nx32u.dtb"
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+# CONFIG_BOARD_INIT is not set
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="MT7981> "
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/netis_nx32u_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_GPIO_HOG=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_FIXED=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7981=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_RAM=y
+CONFIG_DM_SERIAL=y
+CONFIG_SERIAL_RX_BUFFER=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+--- /dev/null
+++ b/arch/arm/dts/mt7981-netis_nx32u.dts
+@@ -0,0 +1,167 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026
+ * Author: Fil Dunsky <filipp.dunsky@gmail.com>
+ */
+
+/dts-v1/;
+#include "mt7981.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/linux-event-codes.h>
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	model = "netis NX32U";
+	compatible = "netis,nx32u", "mediatek,mt7981";
+
+	chosen {
+		stdout-path = &uart0;
+		tick-timer = &timer0;
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x10000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		button-mesh {
+			label = "mesh";
+			linux,code = <BTN_0>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_internet {
+			label = "green:internet";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wps {
+			label = "green:wps";
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wifi2g {
+			label = "green:wifi2g";
+			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wifi5g {
+			label = "green:wifi5g";
+			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+		};
+
+		led_usb {
+			label = "green:usb";
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&uart0 {
+	mediatek,force-highspeed;
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+	mediatek,gmac-id = <0>;
+	phy-mode = "2500base-x";
+	mediatek,switch = "mt7531";
+	reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+
+	fixed-link {
+		speed = <2500>;
+		full-duplex;
+	};
+};
+
+&pio {
+	spi_flash_pins: spi0-pins-func-1 {
+		mux {
+			function = "flash";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+	must_tx;
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <2>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@160000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x7a80000>;
+			};
+		};
+	};
+};
+
+&watchdog {
+	status = "disabled";
+};
+--- /dev/null
+++ b/defenvs/netis_nx32u_env
+@@ -0,0 +1,57 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x46000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=run check_buttons ; if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=openwrt-mediatek-filogic-netis_nx32u-initramfs-recovery.itb
+bootfile_bl2=openwrt-mediatek-filogic-netis_nx32u-preloader.bin
+bootfile_fip=openwrt-mediatek-filogic-netis_nx32u-bl31-uboot.fip
+bootfile_upg=openwrt-mediatek-filogic-netis_nx32u-squashfs-sysupgrade.itb
+bootled_status=green:wps
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_status on ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=led $bootled_status on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led bootled_status off
+boot_recovery=led $bootled_status on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led bootled_status off
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_status on ; while true ; do run boot_tftp ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+check_buttons=if button reset ; then run boot_tftp ; fi
+ethaddr_factory=mtd read Factory 0x40080000 0x1e0000 0x20000 && env readmem -b ethaddr 0x4009ef20 0x6 ; setenv ethaddr_factory
+part_default=production
+part_recovery=recovery
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_fip=mtd erase FIP && mtd write FIP $loadaddr
+mtd_write_bl2=mtd erase BL2 && mtd write BL2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
--- a/package/boot/uboot-mediatek/patches/448-add-comfast_cf-wr632ax.patch
+++ b/package/boot/uboot-mediatek/patches/448-add-comfast_cf-wr632ax.patch
@ -1,6 +1,6 @@
 --- /dev/null
 +++ b/arch/arm/dts/mt7981-comfast-cf-wr632ax.dts
-@@ -0,0 +1,153 @@
+@@ -0,0 +1,151 @@
 +// SPDX-License-Identifier: GPL-2.0-or-later
 +
 +/dts-v1/;
@ -9,10 +9,8 @@
 +#include <dt-bindings/input/linux-event-codes.h>
 +
 +/ {
-+	#address-cells = <1>;
-+	#size-cells = <1>;
 +	model = "COMFAST CF-WR632AX";
-+	compatible = "mediatek,mt7981", "mediatek,mt7981-rfb";
+	compatible = "comfast,cf-wr632ax", "mediatek,mt7981";
 +
 +	chosen {
 +		stdout-path = &uart0;
@ -82,13 +80,13 @@
 +		conf-pu {
 +			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
 +			drive-strength = <MTK_DRIVE_4mA>;
-+			bias-pull-up = <MTK_PUPD_SET_R1R0_00>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
 +		};
 +
 +		conf-pd {
 +			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
 +			drive-strength = <MTK_DRIVE_4mA>;
-+			bias-pull-down = <MTK_PUPD_SET_R1R0_00>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
 +		};
 +	};
 +};
@ -118,7 +116,7 @@
 +			#size-cells = <1>;
 +
 +			partition@0 {
-+				label = "bl2";
+				label = "BL2";
 +				reg = <0x0 0x100000>;
 +			};
 +
@ -128,12 +126,12 @@
 +			};
 +
 +			partition@180000 {
-+				label = "factory";
+				label = "Factory";
 +				reg = <0x180000 0x200000>;
 +			};
 +
 +			partition@380000 {
-+				label = "fip";
+				label = "FIP";
 +				reg = <0x380000 0x200000>;
 +			};
 +
@ -283,7 +281,7 @@
 +bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
 +bootmenu_default=0
 +bootmenu_delay=0
-+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
 +bootmenu_0=Initialize environment.=run _firstboot
 +bootmenu_0d=Run default boot command.=run boot_default
 +bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
@ -291,8 +289,8 @@
 +bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
 +bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
 +bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
-+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
-+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
 +bootmenu_8=Reboot.=reset
 +bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
 +boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
@ -307,8 +305,8 @@
 +boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
 +boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
 +reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
-+mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
-+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+mtd_write_fip=mtd erase FIP && mtd write FIP $loadaddr
+mtd_write_bl2=mtd erase BL2 && mtd write BL2 $loadaddr
 +ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
 +ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
 +ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
@ -320,4 +318,4 @@
 +_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
 +_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
 +_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
-+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
--- a/package/boot/uboot-mediatek/patches/449-add-cudy_wbr3000uax-v1.patch
+++ b/package/boot/uboot-mediatek/patches/449-add-cudy_wbr3000uax-v1.patch
@ -0,0 +1,355 @@
+--- /dev/null
+++ b/configs/mt7981_cudy_wbr3000uax-v1_defconfig
+@@ -0,0 +1,108 @@
+CONFIG_ARM=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7981-cudy-wbr3000uax-v1"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7981=y
+CONFIG_SYS_LOAD_ADDR=0x46000000
+CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
+CONFIG_DEBUG_UART_BASE=0x11002000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_DEBUG_UART=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=30
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cudy-wbr3000uax-v1.dtb"
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+# CONFIG_BOARD_INIT is not set
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="MT7981> "
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/cudy_wbr3000uax-v1_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_GPIO_HOG=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_FIXED=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7981=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_RAM=y
+CONFIG_DM_SERIAL=y
+CONFIG_SERIAL_RX_BUFFER=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+--- /dev/null
+++ b/arch/arm/dts/mt7981-cudy-wbr3000uax-v1.dts
+@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+/dts-v1/;
+#include "mt7981.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/linux-event-codes.h>
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	model = "Cudy WBR3000UAX v1";
+	compatible = "mediatek,mt7981", "mediatek,mt7981-rfb";
+
+	chosen {
+		stdout-path = &uart0;
+		tick-timer = &timer0;
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x20000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		button-wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_status: led_power {
+			label = "blue:power";
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wan_blue {
+			label = "blue:wan";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+		
+		led_wan_red {
+			label = "red:wan";
+			gpios = <&pio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led_lan {
+			label = "blue:lan";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wps_blue {
+			label = "blue:wps";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wps_red {
+			label = "red:wps";
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wifi2g {
+			label = "blue:wifi2g";
+			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wifi5g {
+			label = "blue:wifi5g";
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+	mediatek,gmac-id = <0>;
+	phy-mode = "2500base-x";
+	mediatek,switch = "mt7531";
+	reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+
+	fixed-link {
+		speed = <2500>;
+		full-duplex;
+	};
+};
+
+&pio {
+	spi_flash_pins: spi0-pins-func-1 {
+		mux {
+			function = "flash";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+	must_tx;
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <2>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "factory";
+				reg = <0x180000 0x200000>;
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x40000>;
+			};
+
+			partition@3c0000 {
+				label = "fip";
+				reg = <0x3c0000 0x200000>;
+			};
+
+			partition@5c0000 {
+				label = "ubi";
+				reg = <0x5c0000 0x7a40000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&uart0 {
+	mediatek,force-highspeed;
+	status = "okay";
+};
+
+&watchdog {
+	status = "disabled";
+};
+--- /dev/null
+++ b/defenvs/cudy_wbr3000uax-v1_env
+@@ -0,0 +1,54 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x46000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=openwrt-mediatek-filogic-cudy_wbr3000uax-v1-ubootmod-initramfs-recovery.itb
+bootfile_bl2=openwrt-mediatek-filogic-cudy_wbr3000uax-v1-ubootmod-preloader.bin
+bootfile_fip=openwrt-mediatek-filogic-cudy_wbr3000uax-v1-ubootmod-bl31-uboot.fip
+bootfile_upg=openwrt-mediatek-filogic-cudy_wbr3000uax-v1-ubootmod-squashfs-sysupgrade.itb
+bootled_pwr=blue:power
+bootled_rec=red:wan
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
+boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
--- a/package/boot/uboot-mediatek/patches/467-add-routerich-be7200.patch
+++ b/package/boot/uboot-mediatek/patches/467-add-routerich-be7200.patch
@ -0,0 +1,373 @@
+--- /dev/null
+++ b/configs/mt7987a_routerich_be7200_defconfig
+@@ -0,0 +1,133 @@
+CONFIG_ARM=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7987a-routerich_be7200"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7987=y
+CONFIG_CPU_ARMV8=y
+CONFIG_SYS_BOOTM_LEN=0x6000000
+CONFIG_SYS_LOAD_ADDR=0x48000000
+CONFIG_PRE_CON_BUF_ADDR=0x4007ef00
+CONFIG_DEBUG_UART_BASE=0x11000000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_DEBUG_UART=y
+CONFIG_FIT=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_DEFAULT_FDT_FILE="mt7987a-routerich_be7200"
+CONFIG_SYS_CBSIZE=512
+CONFIG_SYS_PBSIZE=1049
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+# CONFIG_BOARD_INIT is not set
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="MT7987> "
+# CONFIG_BOOTM_NETBSD is not set
+# CONFIG_BOOTM_PLAN9 is not set
+# CONFIG_BOOTM_RTEMS is not set
+# CONFIG_BOOTM_VXWORKS is not set
+# CONFIG_CMD_BOOTEFI_BOOTMGR is not set
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_CPU=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_PWM=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_I2C=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_PCI=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_EXT4=y
+CONFIG_CMD_FAT=y
+CONFIG_CMD_FS_GENERIC=y
+CONFIG_CMD_FS_UUID=y
+CONFIG_CMD_SF_TEST=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+# CONFIG_CMD_XIMG is not set
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/routerich_be7200_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_NETMASK=y
+CONFIG_NETMASK="255.255.255.0"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_DM_I2C=y
+CONFIG_SYS_I2C_MTK=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_ETHERNET_ID=y
+CONFIG_PHY_FIXED=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7987=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_DM_PWM=y
+CONFIG_PWM_MTK=y
+CONFIG_SCSI=y
+CONFIG_DM_SERIAL=y
+CONFIG_SERIAL_RX_BUFFER=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_MTK=y
+CONFIG_USB_STORAGE=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+--- /dev/null
+++ b/defenvs/routerich_be7200_env
+@@ -0,0 +1,57 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x48000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=run check_buttons ; if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=openwrt-mediatek-filogic-routerich_be7200-initramfs-recovery.itb
+bootfile_bl2=openwrt-mediatek-filogic-routerich_be7200-preloader.bin
+bootfile_fip=openwrt-mediatek-filogic-routerich_be7200-bl31-uboot.fip
+bootfile_upg=openwrt-mediatek-filogic-routerich_be7200-squashfs-sysupgrade.itb
+bootled_status=blue:status
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_status on ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=led $bootled_status on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led bootled_status off
+boot_recovery=led $bootled_status on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led bootled_status off
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_status on ; while true ; do run boot_tftp ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+check_buttons=if button reset ; then run boot_tftp ; fi
+ethaddr_factory=mtd read Factory 0x40080000 0x0 0x20000 && env readmem -b ethaddr 0x40080004 0x6 ; setenv ethaddr_factory
+part_default=production
+part_recovery=recovery
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_fip=mtd erase FIP && mtd write FIP $loadaddr
+mtd_write_bl2=mtd erase BL2 && mtd write BL2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
+--- /dev/null
+++ b/arch/arm/dts/mt7987a-routerich_be7200.dts
+@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2025
+ * Author: Mikhail Zhilkin <csharper2005@gmail.com>
+ */
+
+/dts-v1/;
+#include "mt7987a.dtsi"
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Routerich BE7200";
+	compatible = "routerich,be7200",
+		     "mediatek,mt7987";
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-0 {
+			label = "mesh";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			debounce-interval = <10>;
+		};
+
+		button-1 {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+			debounce-interval = <10>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "blue:status";
+			gpios = <&pio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led-1 {
+			label = "blue:wlan5g";
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led-2 {
+			label = "blue:mesh";
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			label = "red:wan";
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led-4 {
+			label = "blue:wan";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-5 {
+			label = "blue:lan3";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		led-6 {
+			label = "blue:lan2";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led-7 {
+			label = "blue:lan1";
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+--- a/arch/arm/dts/Makefile
+++ b/arch/arm/dts/Makefile
+@@ -1138,6 +1138,7 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += \
+ 	mt7986b-emmc-rfb.dtb \
+ 	mt7987a-emmc-rfb.dtb \
+ 	mt7987a-rfb.dtb \
+	mt7987a-routerich_be7200.dtb \
+ 	mt7987a-sd-rfb.dtb \
+ 	mt7988-rfb.dtb \
+ 	mt7988-sd-rfb.dtb \
+--- /dev/null
+++ b/arch/arm/dts/mt7987a-routerich_be7200-u-boot.dtsi
+@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2025
+ * Author: Mikhail Zhilkin <csharper2005@gmail.com>
+ */
+
+#include "mt7987a-u-boot.dtsi"
+#include "mt7987-netsys-u-boot.dtsi"
+
+/ {
+	model = "Routerich BE7200";
+	compatible = "routerich,be7200",
+		     "mediatek,mt7987";
+};
+
+&eth0 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio0_pins>;
+	phy-mode = "2500base-x";
+	mediatek,switch = "auto";
+	reset-gpios = <&pio 42 GPIO_ACTIVE_HIGH>;
+
+	fixed-link {
+		speed = <2500>;
+		full-duplex;
+		pause;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	#address-cells = <1>;
+	#size-cells = <0>;
+	status = "okay";
+	must_tx;
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <2>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+		spi-rx-bus-width = <4>;
+		spi-tx-bus-width = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "u-boot-env (unused)";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x400000>;
+			};
+
+			partition@580000 {
+				label = "FIP";
+				reg = <0x580000 0x200000>;
+			};
+
+			partition@780000 {
+				label = "ubi";
+				reg = <0x780000 0x1f880000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
--- a/package/boot/uboot-mediatek/patches/468-add-cudy_wr3000e-v1.patch
+++ b/package/boot/uboot-mediatek/patches/468-add-cudy_wr3000e-v1.patch
@ -0,0 +1,319 @@
+--- /dev/null
+++ b/configs/mt7981_cudy_wr3000e-v1_defconfig
+@@ -0,0 +1,108 @@
+CONFIG_ARM=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7981-cudy-wr3000e-v1"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7981=y
+CONFIG_SYS_LOAD_ADDR=0x46000000
+CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
+CONFIG_DEBUG_UART_BASE=0x11002000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_DEBUG_UART=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=30
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cudy-wr3000e-v1.dtb"
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+# CONFIG_BOARD_INIT is not set
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="MT7981> "
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/cudy_wr3000e-v1_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_GPIO_HOG=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_FIXED=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7981=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_RAM=y
+CONFIG_DM_SERIAL=y
+CONFIG_SERIAL_RX_BUFFER=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+--- /dev/null
+++ b/arch/arm/dts/mt7981-cudy-wr3000e-v1.dts
+@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+/dts-v1/;
+#include "mt7981.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/linux-event-codes.h>
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	model = "Cudy WR3000E v1";
+	compatible = "mediatek,mt7981", "mediatek,mt7981-rfb";
+
+	chosen {
+		stdout-path = &uart0;
+		tick-timer = &timer0;
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x10000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_power_white {
+			label = "white:power";
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wan_white {
+			label = "white:wan";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+	mediatek,gmac-id = <0>;
+	phy-mode = "2500base-x";
+	mediatek,switch = "mt7531";
+	reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+
+	fixed-link {
+		speed = <2500>;
+		full-duplex;
+	};
+};
+
+&pio {
+	spi_flash_pins: spi0-pins-func-1 {
+		mux {
+			function = "flash";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+	must_tx;
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <2>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "factory";
+				reg = <0x180000 0x200000>;
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x40000>;
+			};
+
+			partition@3c0000 {
+				label = "fip";
+				reg = <0x3c0000 0x200000>;
+			};
+
+			partition@5c0000 {
+				label = "ubi";
+				reg = <0x5c0000 0x7a40000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&uart0 {
+	mediatek,force-highspeed;
+	status = "okay";
+};
+
+&watchdog {
+	status = "disabled";
+};
+--- /dev/null
+++ b/defenvs/cudy_wr3000e-v1_env
+@@ -0,0 +1,54 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x46000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=openwrt-mediatek-filogic-cudy_wr3000e-v1-ubootmod-initramfs-recovery.itb
+bootfile_bl2=openwrt-mediatek-filogic-cudy_wr3000e-v1-ubootmod-preloader.bin
+bootfile_fip=openwrt-mediatek-filogic-cudy_wr3000e-v1-ubootmod-bl31-uboot.fip
+bootfile_upg=openwrt-mediatek-filogic-cudy_wr3000e-v1-ubootmod-squashfs-sysupgrade.itb
+bootled_pwr=white:power
+bootled_rec=white:wan
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
+boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
--- a/package/boot/uboot-mediatek/patches/468-add-cudy_wr3000h-v1.patch
+++ b/package/boot/uboot-mediatek/patches/468-add-cudy_wr3000h-v1.patch
@ -0,0 +1,319 @@
+--- /dev/null
+++ b/configs/mt7981_cudy_wr3000h-v1_defconfig
+@@ -0,0 +1,108 @@
+CONFIG_ARM=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7981-cudy-wr3000h-v1"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7981=y
+CONFIG_SYS_LOAD_ADDR=0x46000000
+CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
+CONFIG_DEBUG_UART_BASE=0x11002000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_DEBUG_UART=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=30
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cudy-wr3000h-v1.dtb"
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+# CONFIG_BOARD_INIT is not set
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="MT7981> "
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/cudy_wr3000h-v1_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_GPIO_HOG=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_FIXED=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7981=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_RAM=y
+CONFIG_DM_SERIAL=y
+CONFIG_SERIAL_RX_BUFFER=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+--- /dev/null
+++ b/arch/arm/dts/mt7981-cudy-wr3000h-v1.dts
+@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+/dts-v1/;
+#include "mt7981.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/linux-event-codes.h>
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	model = "Cudy WR3000H v1";
+	compatible = "mediatek,mt7981", "mediatek,mt7981-rfb";
+
+	chosen {
+		stdout-path = &uart0;
+		tick-timer = &timer0;
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x10000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_status_white {
+			label = "white:status";
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wan_white {
+			label = "white:wan";
+			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+	mediatek,gmac-id = <0>;
+	phy-mode = "2500base-x";
+	mediatek,switch = "mt7531";
+	reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+
+	fixed-link {
+		speed = <2500>;
+		full-duplex;
+	};
+};
+
+&pio {
+	spi_flash_pins: spi0-pins-func-1 {
+		mux {
+			function = "flash";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+	must_tx;
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <2>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "factory";
+				reg = <0x180000 0x200000>;
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x40000>;
+			};
+
+			partition@3c0000 {
+				label = "fip";
+				reg = <0x3c0000 0x200000>;
+			};
+
+			partition@5c0000 {
+				label = "ubi";
+				reg = <0x5c0000 0x7a40000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&uart0 {
+	mediatek,force-highspeed;
+	status = "okay";
+};
+
+&watchdog {
+	status = "disabled";
+};
+--- /dev/null
+++ b/defenvs/cudy_wr3000h-v1_env
+@@ -0,0 +1,54 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x46000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=openwrt-mediatek-filogic-cudy_wr3000h-v1-ubootmod-initramfs-recovery.itb
+bootfile_bl2=openwrt-mediatek-filogic-cudy_wr3000h-v1-ubootmod-preloader.bin
+bootfile_fip=openwrt-mediatek-filogic-cudy_wr3000h-v1-ubootmod-bl31-uboot.fip
+bootfile_upg=openwrt-mediatek-filogic-cudy_wr3000h-v1-ubootmod-squashfs-sysupgrade.itb
+bootled_pwr=white:status
+bootled_rec=white:wan
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
+boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
--- a/package/boot/uboot-mediatek/patches/468-add-cudy_wr3000p-v1.patch
+++ b/package/boot/uboot-mediatek/patches/468-add-cudy_wr3000p-v1.patch
@ -0,0 +1,319 @@
+--- /dev/null
+++ b/configs/mt7981_cudy_wr3000p-v1_defconfig
+@@ -0,0 +1,108 @@
+CONFIG_ARM=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7981-cudy-wr3000p-v1"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7981=y
+CONFIG_SYS_LOAD_ADDR=0x46000000
+CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
+CONFIG_DEBUG_UART_BASE=0x11002000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_DEBUG_UART=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=30
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cudy-wr3000p-v1.dtb"
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+# CONFIG_BOARD_INIT is not set
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="MT7981> "
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/cudy_wr3000p-v1_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_GPIO_HOG=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_FIXED=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7981=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_RAM=y
+CONFIG_DM_SERIAL=y
+CONFIG_SERIAL_RX_BUFFER=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+--- /dev/null
+++ b/arch/arm/dts/mt7981-cudy-wr3000p-v1.dts
+@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+/dts-v1/;
+#include "mt7981.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/linux-event-codes.h>
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	model = "Cudy WR3000P v1";
+	compatible = "mediatek,mt7981", "mediatek,mt7981-rfb";
+
+	chosen {
+		stdout-path = &uart0;
+		tick-timer = &timer0;
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x20000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_status_white {
+			label = "white:status";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wan_white {
+			label = "white:wan";
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+	mediatek,gmac-id = <0>;
+	phy-mode = "2500base-x";
+	mediatek,switch = "mt7531";
+	reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+
+	fixed-link {
+		speed = <2500>;
+		full-duplex;
+	};
+};
+
+&pio {
+	spi_flash_pins: spi0-pins-func-1 {
+		mux {
+			function = "flash";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+	must_tx;
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <2>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "factory";
+				reg = <0x180000 0x200000>;
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x40000>;
+			};
+
+			partition@3c0000 {
+				label = "fip";
+				reg = <0x3c0000 0x200000>;
+			};
+
+			partition@5c0000 {
+				label = "ubi";
+				reg = <0x5c0000 0x7a40000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&uart0 {
+	mediatek,force-highspeed;
+	status = "okay";
+};
+
+&watchdog {
+	status = "disabled";
+};
+--- /dev/null
+++ b/defenvs/cudy_wr3000p-v1_env
+@@ -0,0 +1,54 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x46000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=openwrt-mediatek-filogic-cudy_wr3000p-v1-ubootmod-initramfs-recovery.itb
+bootfile_bl2=openwrt-mediatek-filogic-cudy_wr3000p-v1-ubootmod-preloader.bin
+bootfile_fip=openwrt-mediatek-filogic-cudy_wr3000p-v1-ubootmod-bl31-uboot.fip
+bootfile_upg=openwrt-mediatek-filogic-cudy_wr3000p-v1-ubootmod-squashfs-sysupgrade.itb
+bootled_pwr=white:status
+bootled_rec=white:wan
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
+boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
--- a/package/boot/uboot-mediatek/patches/468-add-cudy_wr3000s-v1.patch
+++ b/package/boot/uboot-mediatek/patches/468-add-cudy_wr3000s-v1.patch
@ -0,0 +1,319 @@
+--- /dev/null
+++ b/configs/mt7981_cudy_wr3000s-v1_defconfig
+@@ -0,0 +1,108 @@
+CONFIG_ARM=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7981-cudy-wr3000s-v1"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7981=y
+CONFIG_SYS_LOAD_ADDR=0x46000000
+CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
+CONFIG_DEBUG_UART_BASE=0x11002000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_DEBUG_UART=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=30
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cudy-wr3000s-v1.dtb"
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+# CONFIG_BOARD_INIT is not set
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="MT7981> "
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/cudy_wr3000s-v1_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_GPIO_HOG=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_FIXED=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7981=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_RAM=y
+CONFIG_DM_SERIAL=y
+CONFIG_SERIAL_RX_BUFFER=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+--- /dev/null
+++ b/arch/arm/dts/mt7981-cudy-wr3000s-v1.dts
+@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+/dts-v1/;
+#include "mt7981.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/linux-event-codes.h>
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	model = "Cudy WR3000S v1";
+	compatible = "mediatek,mt7981", "mediatek,mt7981-rfb";
+
+	chosen {
+		stdout-path = &uart0;
+		tick-timer = &timer0;
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x10000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_status_white {
+			label = "white:status";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wan_white {
+			label = "white:wan";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+	mediatek,gmac-id = <0>;
+	phy-mode = "2500base-x";
+	mediatek,switch = "mt7531";
+	reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+
+	fixed-link {
+		speed = <2500>;
+		full-duplex;
+	};
+};
+
+&pio {
+	spi_flash_pins: spi0-pins-func-1 {
+		mux {
+			function = "flash";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+	must_tx;
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <2>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "factory";
+				reg = <0x180000 0x200000>;
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x40000>;
+			};
+
+			partition@3c0000 {
+				label = "fip";
+				reg = <0x3c0000 0x200000>;
+			};
+
+			partition@5c0000 {
+				label = "ubi";
+				reg = <0x5c0000 0x7a40000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&uart0 {
+	mediatek,force-highspeed;
+	status = "okay";
+};
+
+&watchdog {
+	status = "disabled";
+};
+--- /dev/null
+++ b/defenvs/cudy_wr3000s-v1_env
+@@ -0,0 +1,54 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x46000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=openwrt-mediatek-filogic-cudy_wr3000s-v1-ubootmod-initramfs-recovery.itb
+bootfile_bl2=openwrt-mediatek-filogic-cudy_wr3000s-v1-ubootmod-preloader.bin
+bootfile_fip=openwrt-mediatek-filogic-cudy_wr3000s-v1-ubootmod-bl31-uboot.fip
+bootfile_upg=openwrt-mediatek-filogic-cudy_wr3000s-v1-ubootmod-squashfs-sysupgrade.itb
+bootled_pwr=white:status
+bootled_rec=white:wan
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
+boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
--- a/package/boot/uboot-mediatek/patches/471-add-zyzel-wx5600-t0.patch
+++ b/package/boot/uboot-mediatek/patches/471-add-zyzel-wx5600-t0.patch
@ -0,0 +1,402 @@
+--- /dev/null
+++ b/configs/mt7986_zyxel_wx5600-t0_defconfig
+@@ -0,0 +1,146 @@
+CONFIG_ARM=y
+CONFIG_CMD_MII=y
+CONFIG_CMD_MDIO=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7986b-zyxel_wx5600-t0"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7986=y
+CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
+CONFIG_DEBUG_UART_BASE=0x11002000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_SYS_LOAD_ADDR=0x46000000
+CONFIG_PCI=y
+CONFIG_DEBUG_UART=y
+CONFIG_AHCI=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=30
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+# CONFIG_BOARD_INIT is not set
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="WX5600> "
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_USE_PREBOOT=y
+# CONFIG_CMD_BOOTEFI_BOOTMGR is not set
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_PWM=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_PCI=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_EXT4=y
+CONFIG_CMD_FAT=y
+CONFIG_CMD_FS_GENERIC=y
+CONFIG_CMD_FS_UUID=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/zyxel_wx5600-t0_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_SCSI_AHCI=y
+CONFIG_AHCI_PCI=y
+CONFIG_MTK_AHCI=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_GPIO_HOG=y
+# CONFIG_I2C is not set
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_FIXED=y
+CONFIG_PHY_ADDR_ENABLE=y
+CONFIG_PHY_ADDR=5
+CONFIG_PHY_ETHERNET_ID=y
+CONFIG_DM_MDIO=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7986=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_DM_PWM=y
+CONFIG_PWM_MTK=y
+CONFIG_RAM=y
+CONFIG_SCSI=y
+CONFIG_DM_SERIAL=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_MTK=y
+CONFIG_USB_STORAGE=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+CONFIG_LMB_MAX_REGIONS=64
+CONFIG_PHY_ETHERNET_ID=y
+CONFIG_PCIE_MEDIATEK=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_DM_MDIO=y
+CONFIG_CMD_MDIO=y
+CONFIG_CMD_MII=y
+CONFIG_PHY_ADDR=5
+CONFIG_LED_SW_BLINK=y
+CONFIG_LED_ACTIVITY=y
+CONFIG_LED_BOOT=y
+--- /dev/null
+++ b/arch/arm/dts/mt7986b-zyxel_wx5600-t0.dts
+@@ -0,0 +1,192 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Author: Valerio 'ftp21' Mancini <ftp21@ftp21.eu>
+ */
+
+/dts-v1/;
+#include <dt-bindings/input/linux-event-codes.h>
+#include "mt7986.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	model = "Zyxel wx5600-T0 ubootmod";
+	compatible = "zyxel,wx-5600", "mediatek,mt7986";
+   
+   options {
+       u-boot {
+          compatible = "u-boot,config";
+          boot-led = "green:pwr";
+          activity-led = "red:pwr";
+       };
+   };
+
+	chosen {
+		stdout-path = &uart0;
+		tick-timer = &timer0;
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x20000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		factory {
+			label = "reset";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		green_pwr {
+			label = "green:pwr";
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+       red_pwr {
+			label = "red:pwr";
+			gpios = <&pio 15 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+       green_signal {
+			label = "green:signal";
+			gpios = <&pio 26 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+       red_signal {
+			label = "red:signal";
+			gpios = <&pio 32 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+       green_wlan {
+			label = "green:wlan";
+			gpios = <&pio 14 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+		red_wps {
+			label = "red:wps";
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+	};
+};
+
+&uart0 {
+	mediatek,force-highspeed;
+	status = "okay";
+};
+
+&eth {
+        status = "okay";
+        mediatek,gmac-id = <0>;
+        mediatek,sgmiisys = <&sgmiisys0>;
+        phy-mode = "sgmii";
+        phy-handle = <&phy5>;
+
+        phy5: eth-phy@5 {
+                compatible = "ethernet-phy-id67c9.de0a";
+                reg = <5>;
+                maxlinear,use-broken-interrupts;
+                reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+                reset-assert-us = <600>;
+                reset-deassert-us = <20000>;
+        };
+};
+
+&pio {
+	spi_flash_pins: spi0-pins-func-1 {
+		mux {
+			function = "flash";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_00>;
+		};
+
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_00>;
+		};
+	};
+};
+
+&spi0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <1>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+			};
+
+			partition@180000 {
+				label = "factory";
+				reg = <0x180000 0x0200000>;
+			};
+
+			partition@380000 {
+				label = "fip";
+				reg = <0x380000 0x01C0000>;
+			};
+
+			partition@540000 {
+				label = "zloader";
+				reg = <0x540000 0x0040000>;
+				read-only;
+			};
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x1da80000>;
+			};
+		};
+	};
+};
+
+&watchdog {
+	status = "disabled";
+};
+--- /dev/null
+++ b/defenvs/zyxel_wx5600-t0_env
+@@ -0,0 +1,55 @@
+ethaddr_factory=mtd read Factory 0x40080000 0x0 0x20000 && env readmem -b ethaddr 0x4008002A 0x6 ; setenv ethaddr_factory
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x46000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootargs=console=ttyS0,115200n8 console_msg_format=syslog
+bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=openwrt-mediatek-filogic-zyxel_wx5600-t0-ubootmod-initramfs-recovery.itb
+bootfile_bl2=openwrt-mediatek-filogic-zyxel_wx5600-t0-ubootmod-preloader.bin
+bootfile_fip=openwrt-mediatek-filogic-zyxel_wx5600-t0-ubootmod-bl31-uboot.fip
+bootfile_upg=openwrt-mediatek-filogic-zyxel_wx5600-t0-ubootmod-squashfs-sysupgrade.itb
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=run ubi_read_production && bootm $loadaddr#$bootconf
+boot_recovery=run ubi_read_recovery && bootm $loadaddr#$bootconf
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=while true ; do run boot_tftp_recovery ; sleep 1 ; done
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+part_fit=fit
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr $part_fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
--- a/package/boot/uboot-mediatek/patches/502-add-bazis-ax3000wm.patch
+++ b/package/boot/uboot-mediatek/patches/502-add-bazis-ax3000wm.patch
@ -0,0 +1,329 @@
+--- /dev/null
+++ b/configs/mt7981_bazis_ax3000wm_defconfig
+@@ -0,0 +1,107 @@
+CONFIG_ARM=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7981-bazis-ax3000wm"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7981=y
+CONFIG_SYS_LOAD_ADDR=0x46000000
+CONFIG_PRE_CON_BUF_ADDR=0x4007ef00
+CONFIG_DEBUG_UART_BASE=0x11002000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_DEBUG_UART=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=30
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-bazis-ax3000wm.dtb"
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+# CONFIG_BOARD_INIT is not set
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="MT7981> "
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/bazis_ax3000wm_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_GPIO_HOG=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_FIXED=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7981=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_RAM=y
+CONFIG_DM_SERIAL=y
+CONFIG_SERIAL_RX_BUFFER=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+--- /dev/null
+++ b/arch/arm/dts/mt7981-bazis-ax3000wm.dts
+@@ -0,0 +1,159 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026
+ * Author: Fil Dunsky <filipp.dunsky@gmail.com>
+ */
+
+/dts-v1/;
+#include "mt7981.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/linux-event-codes.h>
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	model = "Bazis AX3000WM";
+	compatible = "bazis,ax3000wm", "mediatek,mt7981";
+
+	chosen {
+		stdout-path = &uart0;
+		tick-timer = &timer0;
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x10000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		mesh {
+			label = "mesh";
+			linux,code = <KEY_RFKILL>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status: led_power {
+			label = "blue:power";
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+		};
+		
+		led_warning: led_fault {
+			label = "red:fault";
+			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_green: led-2 {
+			label = "green:status";
+			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&uart0 {
+	mediatek,force-highspeed;
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+	mediatek,gmac-id = <1>;
+	phy-mode = "gmii";
+	phy-handle = <&phy0>;
+
+	mdio {
+		phy0: ethernet-phy@0 {
+			compatible = "ethernet-phy-id03a2.9461";
+			reg = <0x0>;
+			phy-mode = "gmii";
+		};
+	};
+};
+
+&pio {
+	spi_flash_pins: spi0-pins-func-1 {
+		mux {
+			function = "flash";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+	must_tx;
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <2>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x7a40000>;
+			};
+		};
+	};
+};
+
+&watchdog {
+	status = "disabled";
+};
+--- /dev/null
+++ b/defenvs/bazis_ax3000wm_env
+@@ -0,0 +1,54 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x46000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=openwrt-mediatek-filogic-bazis_ax3000wm-initramfs-recovery.itb
+bootfile_bl2=openwrt-mediatek-filogic-bazis_ax3000wm-preloader.bin
+bootfile_fip=openwrt-mediatek-filogic-bazis_ax3000wm-bl31-uboot.fip
+bootfile_upg=openwrt-mediatek-filogic-bazis_ax3000wm-squashfs-sysupgrade.itb
+bootled_pwr=blue:power
+bootled_rec=red:fault
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
+boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
--- a/package/boot/uboot-microchipsw/Makefile
+++ b/package/boot/uboot-microchipsw/Makefile
@ -27,7 +27,16 @@ define U-Boot/ev23x71a
  UBOOT_CONFIG:=mchp_lan969x
 endef

-UBOOT_TARGETS:= ev23x71a
+define U-Boot/tactical-1000
+  NAME:=Novarq Tactical 1000
+  BUILD_DEVICES:=novarq_tactical-1000
+  BUILD_SUBTARGET:=lan969x
+  UBOOT_CONFIG:=mchp_lan969x
+endef
+
+UBOOT_TARGETS:= \
+	ev23x71a \
+	tactical-1000

 define Build/InstallDev
 	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
--- a/package/boot/uboot-microchipsw/src/board/microchip/lan969x/lan969x.env
+++ b/package/boot/uboot-microchipsw/src/board/microchip/lan969x/lan969x.env
@ -8,3 +8,5 @@ bootargs=console=ttyAT0,115200 root=PARTLABEL=rootfs rootwait
 mmc_read_kernel=mmc read $loadaddr $part_addr 0x100 && imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc read $loadaddr $part_addr $image_size
 boot_system=part start mmc 0 kernel part_addr && part size mmc 0 kernel part_size && run mmc_read_kernel && bootm
 bootcmd=run boot_system
+filesize_to_blk=setexpr cnt $filesize + 0x1ff && setexpr cnt $cnt / 0x200
+mmc_write_fip=part start mmc 0 fip part_addr && part size mmc 0 fip part_size && run filesize_to_blk && test 0x$cnt -le 0x$part_size && mmc erase fip && mmc write $loadaddr $part_addr $cnt
--- a/package/boot/uboot-mvebu/Makefile
+++ b/package/boot/uboot-mvebu/Makefile
@ -75,12 +75,20 @@ define U-Boot/rb5009
  UBOOT_IMAGE:=u-boot.elf
 endef

+define U-Boot/atlas
+  NAME:=RIPE Atlas Probe v5
+  BUILD_DEVICES:=ripe_atlas-v5
+  BUILD_SUBTARGET:=cortexa53
+  UBOOT_CONFIG:=turris_mox
+endef
+
 UBOOT_TARGETS:= \
 	mox \
 	clearfog \
 	helios4 \
 	omnia \
 	espressobin \
+	atlas \
 	uDPU \
 	eDPU \
 	rb5009
--- a/package/boot/uboot-qoriq/Makefile
+++ b/package/boot/uboot-qoriq/Makefile
@ -0,0 +1,80 @@
+#
+# Copyright (C) 2016 Jiang Yutang <jiangyutang1978@gmail.com>
+# Copyright (C) 2025 Pawel Dembicki <paweldembicki@gmail.com>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION:=2025.01
+PKG_HASH:=cdef7d507c93f1bbd9f015ea9bc21fa074268481405501945abc6f854d5b686f
+PKG_RELEASE:=1
+
+include $(INCLUDE_DIR)/u-boot.mk
+include $(INCLUDE_DIR)/package.mk
+
+TOOLCHAIN_NAME:=openwrt-toolchain-24.10.4-mpc85xx-p2020_gcc-13.3.0_musl.Linux-x86_64
+TOOLCHAIN_FILE:=$(TOOLCHAIN_NAME).tar.zst
+TOOLCHAIN_PATH:=$(PKG_BUILD_DIR)/$(TOOLCHAIN_NAME)/toolchain-powerpc_8548_gcc-13.3.0_musl/bin
+TOOLCHAIN_CROSS_COMPILE:=powerpc-openwrt-linux-musl-
+
+define Download/uboot-qoriq-toolchain
+  FILE:=$(TOOLCHAIN_FILE)
+  URL:=https://downloads.openwrt.org/releases/24.10.4/targets/mpc85xx/p2020/
+  URL_FILE:=$(TOOLCHAIN_FILE)
+  HASH:=c16566bb3625b6c45e4184b9d37953d4c3c1dcdec1141a45df834da626d4c08d
+endef
+
+define U-Boot/Default
+  BUILD_TARGET:=qoriq
+  BUILD_SUBTARGET:=generic
+  BUILD_DEVICES:=$(1)
+  ENV_SIZE:=0x2000
+endef
+
+define U-Boot/fsl_T4240RDB-nor
+  NAME:=NXP T4240RDB NOR Boot
+  BUILD_DEVICES:=fsl_T4240RDB
+  UBOOT_CONFIG:=T4240RDB
+  UBOOT_IMAGE:=u-boot-dtb.bin
+endef
+
+define U-Boot/fsl_T4240RDB-sdboot
+  NAME:=NXP T4240RDB SD Card Boot
+  BUILD_DEVICES:=fsl_T4240RDB
+  UBOOT_CONFIG:=T4240RDB_SDCARD
+  UBOOT_IMAGE:=u-boot-with-spl-pbl.bin
+endef
+
+UBOOT_TARGETS := \
+  fsl_T4240RDB-nor \
+  fsl_T4240RDB-sdboot
+
+define Build/Prepare
+		$(Build/Prepare/Default)
+	$(TAR) -I $(STAGING_DIR_HOST)/bin/zstd -xf $(DL_DIR)/$(TOOLCHAIN_FILE) -C $(PKG_BUILD_DIR)/
+endef
+
+define Build/Compile/U-Boot
+	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
+		CROSS_COMPILE=$(TOOLCHAIN_PATH)/$(TOOLCHAIN_CROSS_COMPILE) \
+		$(if $(DTC),DTC="$(DTC)") \
+		$(UBOOT_MAKE_FLAGS)
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(UBOOT_IMAGE) \
+		$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-uboot.bin
+	$(PKG_BUILD_DIR)/tools/mkenvimage -b -s $(ENV_SIZE) \
+		-o $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-uboot-env.bin \
+		files/$(BUILD_VARIANT)-uEnv.txt
+endef
+
+define Package/u-boot/install/default
+endef
+
+$(eval $(call Download,uboot-qoriq-toolchain))
+$(eval $(call BuildPackage/U-Boot))
--- a/package/boot/uboot-qoriq/files/fsl_T4240RDB-nor-uEnv.txt
+++ b/package/boot/uboot-qoriq/files/fsl_T4240RDB-nor-uEnv.txt
@ -0,0 +1,8 @@
+bootm_size=0x180000000
+loadaddr=0x2000000
+fwaddr=0xe8000000
+hwconfig=fsl_ddr:ctlr_intlv=3way_4KB,bank_intlv=auto;usb1:dr_mode=host,phy_type=utmi
+nor_boot=bootm $fwaddr
+bootargs=console=ttyS0,115200
+bootcmd=echo starting OpenWrt ...;run nor_boot
+bootdelay=3
--- a/package/boot/uboot-qoriq/files/fsl_T4240RDB-sdboot-uEnv.txt
+++ b/package/boot/uboot-qoriq/files/fsl_T4240RDB-sdboot-uEnv.txt
@ -0,0 +1,7 @@
+bootm_size=0x180000000
+loadaddr=0x2000000
+hwconfig=fsl_ddr:ctlr_intlv=3way_4KB,bank_intlv=auto;usb1:dr_mode=host,phy_type=utmi
+sd_boot=ext4load mmc 0:1 $loadaddr fitImage;bootm $loadaddr
+bootargs=root=/dev/mmcblk0p2 rw rootwait rootfstype=squashfs,f2fs noinitrd console=ttyS0,115200 mtdparts=fe8000000.nor:126m(firmware-nor),1m(cortina-ucode),128k(fman),128k(u-boot-env),768k(u-boot)
+bootcmd=echo starting OpeWwrt ...;run sd_boot
+bootdelay=3
--- a/package/boot/uboot-qoriq/patches/100-mpc85xx-adjust-T4240RDB-config-for-OpenWrt.patch
+++ b/package/boot/uboot-qoriq/patches/100-mpc85xx-adjust-T4240RDB-config-for-OpenWrt.patch
@ -0,0 +1,68 @@
+From ec36a44809e22a60fc153a4078d35c83a2bf9676 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Thu, 6 Oct 2022 15:18:38 +0200
+Subject: [PATCH] mpc85xx: adjust T4240RDB config for OpenWrt
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+---
+ configs/T4240RDB_SDCARD_defconfig | 6 ++++--
+ include/configs/T4240RDB.h        | 6 +++++-
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+--- a/configs/T4240RDB_SDCARD_defconfig
+++ b/configs/T4240RDB_SDCARD_defconfig
+@@ -4,7 +4,7 @@ CONFIG_SPL_LIBCOMMON_SUPPORT=y
+ CONFIG_SPL_LIBGENERIC_SUPPORT=y
+ CONFIG_SF_DEFAULT_SPEED=10000000
+ CONFIG_ENV_SIZE=0x2000
+-CONFIG_ENV_OFFSET=0x100000
+CONFIG_ENV_OFFSET=0x101000
+ CONFIG_DEFAULT_DEVICE_TREE="t4240rdb"
+ CONFIG_SYS_MONITOR_LEN=786432
+ CONFIG_SPL_MMC=y
+@@ -35,7 +35,7 @@ CONFIG_FIT_VERBOSE=y
+ CONFIG_RAMBOOT_PBL=y
+ CONFIG_SYS_FSL_PBL_PBI="$(SRCTREE)/board/freescale/t4rdb/t4_pbi.cfg"
+ CONFIG_SYS_FSL_PBL_RCW="$(SRCTREE)/board/freescale/t4rdb/t4_sd_rcw.cfg"
+-CONFIG_BOOTDELAY=10
+CONFIG_BOOTDELAY=1
+ CONFIG_OF_BOARD_SETUP=y
+ CONFIG_OF_STDOUT_VIA_ALIAS=y
+ CONFIG_USE_BOOTCOMMAND=y
+@@ -71,6 +71,7 @@ CONFIG_CMD_DHCP=y
+ CONFIG_CMD_MII=y
+ CONFIG_CMD_PING=y
+ CONFIG_CMD_EXT2=y
+CONFIG_CMD_EXT4=y
+ CONFIG_CMD_FAT=y
+ CONFIG_OF_CONTROL=y
+ CONFIG_ENV_OVERWRITE=y
+@@ -108,7 +109,8 @@ CONFIG_SPI_FLASH_SST=y
+ CONFIG_PHYLIB=y
+ CONFIG_PHYLIB_10G=y
+ CONFIG_PHY_CORTINA=y
+-CONFIG_CORTINA_FW_ADDR=0x77f000
+CONFIG_SYS_CORTINA_FW_IN_MMC=y
+CONFIG_CORTINA_FW_ADDR=0x200000
+ CONFIG_PHY_TERANETICS=y
+ CONFIG_PHY_VITESSE=y
+ CONFIG_DM_MDIO=y
+--- a/configs/T4240RDB_defconfig
+++ b/configs/T4240RDB_defconfig
+@@ -26,7 +26,7 @@ CONFIG_SYS_FSL_NUM_CC_PLLS=5
+ CONFIG_MP=y
+ CONFIG_FIT=y
+ CONFIG_FIT_VERBOSE=y
+-CONFIG_BOOTDELAY=10
+CONFIG_BOOTDELAY=1
+ CONFIG_OF_BOARD_SETUP=y
+ CONFIG_OF_STDOUT_VIA_ALIAS=y
+ CONFIG_USE_BOOTCOMMAND=y
+@@ -76,6 +76,7 @@ CONFIG_SYS_FLASH_USE_BUFFER_WRITE=y
+ CONFIG_SYS_FLASH_EMPTY_INFO=y
+ CONFIG_SYS_FLASH_CFI=y
+ CONFIG_SYS_FLASH_QUIET_TEST=y
+CONFIG_SYS_MALLOC_F_LEN=0x1000
+ CONFIG_SYS_MAX_FLASH_SECT=1024
+ CONFIG_SYS_MAX_FLASH_BANKS=2
+ CONFIG_DM_SPI_FLASH=y
--- a/package/boot/uboot-qoriq/patches/900-Revert-fsl-mxc-Drop-legacy-I2c.patch
+++ b/package/boot/uboot-qoriq/patches/900-Revert-fsl-mxc-Drop-legacy-I2c.patch
@ -0,0 +1,44 @@
+From 7041fc96942acca920699b354e956bc4966c9b00 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Wed, 19 Nov 2025 11:58:10 +0100
+Subject: [PATCH] Revert "fsl: mxc: Drop legacy I2c"
+
+This reverts commit 98dfa70f84f036c7423f1eddf00af8ea555fed8f.
+
+It broke SDCARD boot in T4240RDB.
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+---
+ drivers/ddr/fsl/main.c | 3 ++-
+ drivers/i2c/mxc_i2c.c  | 1 -
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/ddr/fsl/main.c
+++ b/drivers/ddr/fsl/main.c
+@@ -111,7 +111,7 @@ static int ddr_i2c_read(DEV_TYPE *dev, u
+ #if CONFIG_IS_ENABLED(DM_I2C)
+ 	ret = dm_i2c_read(dev, 0, buf, len);
+ #else
+-	ret = 0;
+	ret = i2c_read(dev->chip, addr, alen, buf, len);
+ #endif
+ 
+ 	return ret;
+@@ -162,6 +162,7 @@ static void __get_spd(generic_spd_eeprom
+ 	};
+ 	dev = &ldev;
+ 
+	i2c_set_bus_num(CONFIG_SYS_SPD_BUS_NUM);
+ #endif
+ 
+ #ifdef CONFIG_SYS_FSL_DDR4
+--- a/drivers/i2c/mxc_i2c.c
+++ b/drivers/i2c/mxc_i2c.c
+@@ -619,7 +619,6 @@ int enable_i2c_clk(unsigned char enable,
+ 	__attribute__((weak, alias("__enable_i2c_clk")));
+ 
+ #if !CONFIG_IS_ENABLED(DM_I2C)
+-
+ /*
+  * Read data from I2C device
+  *
--- a/package/boot/uboot-rockchip/Makefile
+++ b/package/boot/uboot-rockchip/Makefile
@ -174,6 +174,13 @@ define U-Boot/rk3528/Default
  TPL:=rk3528_ddr_1056MHz_v1.11.bin
 endef

+define U-Boot/hinlink-h28k-rk3528
+  $(U-Boot/rk3528/Default)
+  NAME:=HINLINK H28K
+  BUILD_DEVICES:= \
+    hinlink_h28k
+endef
+
 define U-Boot/radxa-e20c-rk3528
  $(U-Boot/rk3528/Default)
  NAME:=E20C
@ -420,6 +427,7 @@ UBOOT_TARGETS := \
  rock64-rk3328 \
  rock-pi-e-rk3328 \
  rock-pi-e-v3-rk3328 \
+  hinlink-h28k-rk3528 \
  radxa-e20c-rk3528 \
  rock-2-rk3528 \
  nanopi-r3s-rk3566 \
--- a/package/boot/uboot-rockchip/patches/107-board-rockchip-add-HINLINK-H28K.patch
+++ b/package/boot/uboot-rockchip/patches/107-board-rockchip-add-HINLINK-H28K.patch
@ -0,0 +1,378 @@
+From df056584b1825957ad118b6c1084aae00b1fa0b7 Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Wed, 3 Dec 2025 20:03:22 +0800
+Subject: [PATCH] board: rockchip: add HINLINK H28K
+
+The HINLINK H28K is a single board computer based on the
+RK3528 SoC. Add support for the HINLINK H28K board.
+
+Features tested on HINLINK H28K:
+- SD-card boot
+- eMMC boot
+- Ethernet
+
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+---
+
+--- /dev/null
+++ b/arch/arm/dts/rk3528-hinlink-h28k-u-boot.dtsi
+@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+
+#include "rk3528-u-boot.dtsi"
+
+&vdd_arm {
+	regulator-init-microvolt = <953000>;
+};
+
+&vdd_logic {
+	regulator-init-microvolt = <900000>;
+};
+--- /dev/null
+++ b/configs/hinlink-h28k-rk3528_defconfig
+@@ -0,0 +1,64 @@
+CONFIG_ARM=y
+CONFIG_SKIP_LOWLEVEL_INIT=y
+CONFIG_COUNTER_FREQUENCY=24000000
+CONFIG_ARCH_ROCKCHIP=y
+CONFIG_DEFAULT_DEVICE_TREE="rockchip/rk3528-hinlink-h28k"
+CONFIG_ROCKCHIP_RK3528=y
+CONFIG_SYS_LOAD_ADDR=0xc00800
+CONFIG_DEBUG_UART_BASE=0xFF9F0000
+CONFIG_DEBUG_UART_CLOCK=24000000
+CONFIG_DEBUG_UART=y
+CONFIG_DEFAULT_FDT_FILE="rockchip/rk3528-hinlink-h28k.dtb"
+# CONFIG_DISPLAY_CPUINFO is not set
+CONFIG_BOARD_RNG_SEED=y
+CONFIG_SPL_MAX_SIZE=0x40000
+# CONFIG_SPL_RAW_IMAGE_SUPPORT is not set
+CONFIG_CMD_MEMINFO=y
+CONFIG_CMD_MEMINFO_MAP=y
+CONFIG_CMD_ADC=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MISC=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_ROCKUSB=y
+CONFIG_CMD_USB_MASS_STORAGE=y
+# CONFIG_CMD_SETEXPR is not set
+CONFIG_CMD_RNG=y
+CONFIG_CMD_REGULATOR=y
+# CONFIG_SPL_DOS_PARTITION is not set
+CONFIG_OF_SPL_REMOVE_PROPS="clock-names interrupt-parent assigned-clocks assigned-clock-rates assigned-clock-parents"
+CONFIG_BUTTON=y
+CONFIG_BUTTON_ADC=y
+# CONFIG_USB_FUNCTION_FASTBOOT is not set
+CONFIG_ROCKCHIP_GPIO=y
+CONFIG_LED=y
+CONFIG_LED_GPIO=y
+CONFIG_SUPPORT_EMMC_RPMB=y
+CONFIG_MMC_DW=y
+CONFIG_MMC_DW_ROCKCHIP=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_SDMA=y
+CONFIG_MMC_SDHCI_ROCKCHIP=y
+CONFIG_PHY_REALTEK=y
+CONFIG_DM_MDIO=y
+CONFIG_DWC_ETH_QOS=y
+CONFIG_DWC_ETH_QOS_ROCKCHIP=y
+CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_PHY_ROCKCHIP_NANENG_COMBOPHY=y
+CONFIG_REGULATOR_PWM=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_PWM_ROCKCHIP=y
+CONFIG_BAUDRATE=1500000
+CONFIG_DEBUG_UART_SHIFT=2
+CONFIG_SYS_NS16550_MEM32=y
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_GENERIC=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC3_GENERIC=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_GADGET_DOWNLOAD=y
+CONFIG_USB_FUNCTION_ROCKUSB=y
+CONFIG_ERRNO_STR=y
+--- /dev/null
+++ b/dts/upstream/src/arm64/rockchip/rk3528-hinlink-h28k.dts
+@@ -0,0 +1,278 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+
+/dts-v1/;
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/pwm/pwm.h>
+#include "rk3528.dtsi"
+
+/ {
+	model = "HINLINK H28K";
+	compatible = "hinlink,h28k", "rockchip,rk3528";
+
+	aliases {
+		ethernet0 = &gmac1;
+		mmc0 = &sdhci;
+		mmc1 = &sdmmc;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:1500000n8";
+	};
+
+	keys {
+		compatible = "adc-keys";
+		io-channels = <&saradc 0>;
+		io-channel-names = "buttons";
+		keyup-threshold-microvolt = <1800000>;
+		poll-interval = <100>;
+
+		button-boot {
+			label = "BOOT";
+			linux,code = <KEY_SETUP>;
+			press-threshold-microvolt = <0>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&lan_led>, <&wan_led>, <&work_led>;
+
+		led-0 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_LAN;
+			gpios = <&gpio4 RK_PC1 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "netdev";
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&gpio4 RK_PC0 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "netdev";
+		};
+
+		led-2 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio4 RK_PB7 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "default-on";
+		};
+	};
+
+	vdd_0v9: regulator-0v9-vdd {
+		compatible = "regulator-fixed";
+		regulator-name = "vdd_0v9";
+		regulator-always-on;
+		regulator-boot-on;
+		regulator-min-microvolt = <900000>;
+		regulator-max-microvolt = <900000>;
+		vin-supply = <&vcc5v0_sys>;
+	};
+
+	vcc_ddr: regulator-1v1-vcc-ddr {
+		compatible = "regulator-fixed";
+		regulator-name = "vcc_ddr";
+		regulator-always-on;
+		regulator-boot-on;
+		regulator-min-microvolt = <1100000>;
+		regulator-max-microvolt = <1100000>;
+		vin-supply = <&vcc5v0_sys>;
+	};
+
+	vcc_1v8: regulator-1v8-vcc {
+		compatible = "regulator-fixed";
+		regulator-name = "vcc_1v8";
+		regulator-always-on;
+		regulator-boot-on;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		vin-supply = <&vcc_3v3>;
+	};
+
+	vcc_3v3: regulator-3v3-vcc {
+		compatible = "regulator-fixed";
+		regulator-name = "vcc_3v3";
+		regulator-always-on;
+		regulator-boot-on;
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		vin-supply = <&vcc5v0_sys>;
+	};
+
+	vcc3v3_sd: regulator-3v3-vcc-sd {
+		compatible = "regulator-fixed";
+		gpios = <&gpio4 RK_PA1 GPIO_ACTIVE_LOW>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&sdmmc_pwren_l>;
+		regulator-name = "vcc3v3_sd";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		vin-supply = <&vcc_3v3>;
+	};
+
+	vcc5v0_sys: regulator-5v0-vcc-sys {
+		compatible = "regulator-fixed";
+		regulator-name = "vcc5v0_sys";
+		regulator-always-on;
+		regulator-boot-on;
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+	};
+
+	vccio_sd: regulator-vccio-sd {
+		compatible = "regulator-gpio";
+		gpios = <&gpio4 RK_PB6 GPIO_ACTIVE_HIGH>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&sdmmc_vol_ctrl_h>;
+		regulator-name = "vccio_sd";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <3300000>;
+		states = <1800000 0x0>, <3300000 0x1>;
+		vin-supply = <&vcc5v0_sys>;
+	};
+
+	vdd_arm: regulator-vdd-arm {
+		compatible = "pwm-regulator";
+		pwms = <&pwm1 0 5000 PWM_POLARITY_INVERTED>;
+		pwm-supply = <&vcc5v0_sys>;
+		regulator-name = "vdd_arm";
+		regulator-always-on;
+		regulator-boot-on;
+		regulator-min-microvolt = <746000>;
+		regulator-max-microvolt = <1201000>;
+		regulator-settling-time-up-us = <250>;
+	};
+
+	vdd_logic: regulator-vdd-logic {
+		compatible = "pwm-regulator";
+		pwms = <&pwm2 0 5000 PWM_POLARITY_INVERTED>;
+		pwm-supply = <&vcc5v0_sys>;
+		regulator-name = "vdd_logic";
+		regulator-always-on;
+		regulator-boot-on;
+		regulator-min-microvolt = <705000>;
+		regulator-max-microvolt = <1006000>;
+		regulator-settling-time-up-us = <250>;
+	};
+};
+
+&cpu0 {
+	cpu-supply = <&vdd_arm>;
+};
+
+&cpu1 {
+	cpu-supply = <&vdd_arm>;
+};
+
+&cpu2 {
+	cpu-supply = <&vdd_arm>;
+};
+
+&cpu3 {
+	cpu-supply = <&vdd_arm>;
+};
+
+&gmac1 {
+	clock_in_out = "output";
+	phy-handle = <&rgmii_phy>;
+	phy-mode = "rgmii-id";
+	phy-supply = <&vcc_3v3>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&rgmii_miim>,
+		    <&rgmii_tx_bus2>,
+		    <&rgmii_rx_bus2>,
+		    <&rgmii_rgmii_clk>,
+		    <&rgmii_rgmii_bus>;
+	status = "okay";
+};
+
+&mdio1 {
+	rgmii_phy: ethernet-phy@1 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x1>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&gmac1_rstn_l>;
+		reset-assert-us = <20000>;
+		reset-deassert-us = <100000>;
+		reset-gpios = <&gpio4 RK_PC2 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&pinctrl {
+	gmac {
+		gmac1_rstn_l: gmac1-rstn-l {
+			rockchip,pins = <4 RK_PC2 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+	};
+
+	leds {
+		lan_led: lan-led {
+			rockchip,pins = <4 RK_PC1 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+
+		wan_led: wan-led {
+			rockchip,pins = <4 RK_PC0 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+
+		work_led: work-led {
+			rockchip,pins = <4 RK_PB7 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+	};
+
+	sdmmc {
+		sdmmc_pwren_l: sdmmc-pwren-l {
+			rockchip,pins = <4 RK_PA1 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+
+		sdmmc_vol_ctrl_h: sdmmc-vol-ctrl-h {
+			rockchip,pins = <4 RK_PB6 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+	};
+};
+
+&pwm1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pwm1m0_pins>;
+	status = "okay";
+};
+
+&pwm2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pwm2m0_pins>;
+	status = "okay";
+};
+
+&saradc {
+	vref-supply = <&vcc_1v8>;
+	status = "okay";
+};
+
+&sdhci {
+	bus-width = <8>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	non-removable;
+	vmmc-supply = <&vcc_3v3>;
+	vqmmc-supply = <&vcc_1v8>;
+	status = "okay";
+};
+
+&sdmmc {
+	bus-width = <4>;
+	cap-sd-highspeed;
+	disable-wp;
+	sd-uhs-sdr104;
+	vmmc-supply = <&vcc3v3_sd>;
+	vqmmc-supply = <&vccio_sd>;
+	status = "okay";
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0m0_xfer>;
+	status = "okay";
+};
--- a/package/boot/uboot-sunxi/Makefile
+++ b/package/boot/uboot-sunxi/Makefile
@ -137,14 +137,14 @@ endef
 define U-Boot/OLIMEX_A13_SOM
  BUILD_SUBTARGET:=cortexa8
  NAME:=Olimex A13 SOM
-  BUILD_DEVICES:=olimex_a13-olimex-som
+  BUILD_DEVICES:=olimex_a13-olinuxino
 endef

 define U-Boot/licheepi_nano
  BUILD_SUBTARGET:=arm926ejs
  NAME:=LicheePi Nano
  UENV:=f1c
-  BUILD_DEVICES:=licheepi-nano
+  BUILD_DEVICES:=licheepi_licheepi-nano
 endef

 define U-Boot/Linksprite_pcDuino
@ -268,7 +268,7 @@ define U-Boot/popstick
  BUILD_SUBTARGET:=arm926ejs
  NAME:=PopStick
  UENV:=f1c
-  BUILD_DEVICES:=popstick-v1.1
+  BUILD_DEVICES:=sourceparts_popstick-v1.1
 endef

 define U-Boot/libretech_all_h3_cc_h5
@ -319,13 +319,13 @@ endef
 define U-Boot/bananapi_m2_plus_h3
  BUILD_SUBTARGET:=cortexa7
  NAME:=Bananapi M2 Plus H3
-  BUILD_DEVICES:=sinovoip_bananapi-m2-plus
+  BUILD_DEVICES:=sinovoip_bpi-m2-plus
 endef

 define U-Boot/Sinovoip_BPI_M3
  BUILD_SUBTARGET:=cortexa7
  NAME:=Bananapi M3
-  BUILD_DEVICES:=sinovoip_bananapi-m3
+  BUILD_DEVICES:=sinovoip_bpi-m3
 endef

 define U-Boot/sopine_baseboard
@ -385,19 +385,19 @@ endef
 define U-Boot/Bananapi_M2_Ultra
  BUILD_SUBTARGET:=cortexa7
  NAME:=Bananapi M2 Ultra
-  BUILD_DEVICES:=sinovoip_bananapi-m2-ultra
+  BUILD_DEVICES:=sinovoip_bpi-m2-ultra
 endef

 define U-Boot/bananapi_m2_berry
  BUILD_SUBTARGET:=cortexa7
  NAME:=Bananapi M2 Berry
-  BUILD_DEVICES:=sinovoip_bananapi-m2-berry
+  BUILD_DEVICES:=sinovoip_bpi-m2-berry
 endef

 define U-Boot/bananapi_p2_zero
  BUILD_SUBTARGET:=cortexa7
  NAME:=Bananapi P2 Zero
-  BUILD_DEVICES:=sinovoip_bananapi-p2-zero
+  BUILD_DEVICES:=sinovoip_bpi-p2-zero
 endef


--- a/package/boot/uboot-tools/Makefile
+++ b/package/boot/uboot-tools/Makefile
@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk

 PKG_DISTNAME:=u-boot
 PKG_VERSION:=2025.10
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PKG_SOURCE:=$(PKG_DISTNAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
--- a/package/boot/uboot-tools/uboot-envtools/files/apm821xx
+++ b/package/boot/uboot-tools/uboot-envtools/files/apm821xx
@ -9,11 +9,12 @@ board=$(board_name)

 case "$board" in
 meraki,mr24)
-	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x4000" "0x4000" "4"
-	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x4000" "0x4000" "4"
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x4000" "0x4000" "1"
+	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x4000" "0x4000" "1"
 	;;
 meraki,mx60)
-	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000" "4"
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000" "1"
+	ubootenv_add_uci_config "/dev/mtd1" "0x80000" "0x20000" "0x20000" "1"
 	;;
 netgear,wndap620|\
 netgear,wndap660)
--- a/package/boot/uboot-tools/uboot-envtools/files/ath79
+++ b/package/boot/uboot-tools/uboot-envtools/files/ath79
@ -46,6 +46,7 @@ librerouter,librerouter-v1|\
 moxa,awk-1137c|\
 netgear,ex7300|\
 netgear,ex7300-v2|\
+netgear,wndap360|\
 netgear,wndr4300-v2|\
 netgear,wndr4500-v3|\
 netgear,wnr1000-v2|\
@ -118,6 +119,10 @@ dell,apl27-0b1)
 domywifi,dw33d)
 	ubootenv_add_uci_config "/dev/mtd4" "0x0" "0x10000" "0x10000"
 	;;
+extreme-networks,ws-ap3805i)
+	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x1000" "0x4000" "1"
+	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x1000" "0x4000" "1"
+	;;
 glinet,gl-ar150)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x8000" "0x10000"
 	;;
--- a/package/boot/uboot-tools/uboot-envtools/files/mediatek_filogic
+++ b/package/boot/uboot-tools/uboot-envtools/files/mediatek_filogic
@ -28,6 +28,11 @@ asus,zenwifi-bt8-ubootmod|\
 cmcc,a10-ubootmod|\
 comfast,cf-wr632ax-ubootmod|\
 cudy,tr3000-v1-ubootmod|\
+cudy,wbr3000uax-v1-ubootmod|\
+cudy,wr3000e-v1-ubootmod|\
+cudy,wr3000s-v1-ubootmod|\
+cudy,wr3000h-v1-ubootmod|\
+cudy,wr3000p-v1-ubootmod|\
 h3c,magic-nx30-pro|\
 imou,hx21|\
 jcg,q30-pro|\
@ -37,10 +42,12 @@ netcore,n60|\
 netcore,n60-pro|\
 netis,nx30v2|\
 netis,nx31|\
+netis,nx32u|\
 nokia,ea0326gmp|\
 openwrt,one|\
 qihoo,360t7|\
 routerich,ax3000-ubootmod|\
+routerich,be7200|\
 snr,snr-cpe-ax2|\
 tplink,tl-xdr4288|\
 tplink,tl-xdr6086|\
@ -49,13 +56,15 @@ tplink,tl-xtr8488|\
 xiaomi,mi-router-ax3000t-ubootmod|\
 xiaomi,mi-router-wr30u-ubootmod|\
 xiaomi,redmi-router-ax6000-ubootmod|\
-zyxel,ex5601-t0-ubootmod)
+zyxel,ex5601-t0-ubootmod|\
+zyxel,wx5600-t0-ubootmod)
 	ubootenv_add_ubi_default
 	;;
 acer,predator-w6|\
 acer,predator-w6d|\
 acer,vero-w6m|\
 glinet,gl-mt2500|\
+glinet,gl-mt2500-airoha|\
 glinet,gl-mt6000|\
 glinet,gl-x3000|\
 glinet,gl-xe3000|\
@ -111,6 +120,7 @@ comfast,cf-e393ax|\
 iptime,ax3000m)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x80000"
 	;;
+dlink,aquila-pro-ai-e30-a1|\
 dlink,aquila-pro-ai-m30-a1|\
 dlink,aquila-pro-ai-m60-a1)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x40000" "0x40000"
@ -134,6 +144,7 @@ teltonika,rutc50)
 	ubootenv_add_mtd "u-boot-env" "0x0" "0x10000" "0x10000"
 	;;
 tplink,archer-ax80-v1|\
+tplink,archer-ax80-v1-eu|\
 tplink,be450)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000" "8"
 	;;
--- a/package/boot/uboot-tools/uboot-envtools/files/mpc85xx
+++ b/package/boot/uboot-tools/uboot-envtools/files/mpc85xx
@ -20,9 +20,13 @@ ocedo,panda)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
 	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x20000" "0x20000"
 	;;
-watchguard,firebox-t10)
+watchguard,firebox-t10|\
+watchguard,firebox-t15)
 	ubootenv_add_uci_config "$(find_mtd_part 'u-boot-env')" "0x0" "0x2000" "0x10000"
 	;;
+watchguard,xtm330)
+	ubootenv_add_uci_config "/dev/mtd4" "0x0" "0x10000" "0x10000"
+	;;
 aerohive,hiveap-330)
 	ubootenv_add_uci_config "$(find_mtd_part 'u-boot-env')" "0x0" "0x20000" "0x10000"
 	;;
--- a/package/boot/uboot-tools/uboot-envtools/files/qoriq
+++ b/package/boot/uboot-tools/uboot-envtools/files/qoriq
@ -5,9 +5,35 @@ touch /etc/config/ubootenv
 . /lib/uboot-envtools.sh
 . /lib/functions.sh

+platform_get_rootfs_device() {
+    local majmin sys path
+
+    majmin="$(awk '$5=="/rom"{print $3; exit}' /proc/self/mountinfo 2>/dev/null)"
+    [ -n "$majmin" ] || exit 1
+
+    sys="/sys/dev/block/$majmin"
+    [ -e "$sys" ] || exit 1
+
+    path="$(readlink -f "$sys" 2>/dev/null)" || exit 1
+    basename "$path"
+}
+
 board=$(board_name)

 case "$board" in
+fsl,T4240RDB)
+	local t4240_rootfs="$(platform_get_rootfs_device)"
+	case "$t4240_rootfs" in
+		mmcblk*)
+			ubootenv_add_uci_config "/dev/mmcblk0" "0x101000" "0x2000" "0x1000"
+		;;
+		mtdblock*)
+			ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x2000" "0x20000"
+		;;
+		*)
+			exit 1
+	esac
+	;;
 watchguard,firebox-m300)
 	ubootenv_add_uci_config "/dev/mtd9" "0x0" "0x2000" "0x10000"
 	;;
--- a/package/boot/uboot-tools/uboot-envtools/files/qualcommax_ipq50xx
+++ b/package/boot/uboot-tools/uboot-envtools/files/qualcommax_ipq50xx
@ -10,7 +10,8 @@ board=$(board_name)
 case "$board" in
 cmcc,pz-l8|\
 elecom,wrc-x3000gs2|\
-iodata,wn-dax3000gr)
+iodata,wn-dax3000gr|\
+zyxel,scr50axe)
 	ubootenv_add_mtd "0:appsblenv" "0x0" "0x40000" "0x20000"
 	;;
 glinet,gl-b3000)
@ -19,6 +20,7 @@ glinet,gl-b3000)
 linksys,mr5500|\
 linksys,mx2000|\
 linksys,mx5500|\
+linksys,mx6200|\
 linksys,spnmx56)
 	ubootenv_add_mtd "u_env" "0x0" "0x40000" "0x20000"
 	;;
--- a/package/boot/uboot-tools/uboot-envtools/files/ramips
+++ b/package/boot/uboot-tools/uboot-envtools/files/ramips
@ -48,6 +48,7 @@ asus,rt-ax53u|\
 asus,rt-ax54|\
 asus,4g-ax56|\
 belkin,rt1800|\
+edup,ep-rt2983|\
 elecom,wrc-x1800gs|\
 h3c,tx1800-plus|\
 h3c,tx1801-plus|\
--- a/package/devel/binutils/Makefile
+++ b/package/devel/binutils/Makefile
@ -93,6 +93,9 @@ CONFIGURE_ARGS += \
 	--without-msgpack \
 	--disable-gprofng

+MAKE_VARS+= \
+	CPPFLAGS="$(TARGET_CPPFLAGS)"
+
 define Build/Install
 	$(call Build/Install/Default)
 	$(MAKE) -C $(PKG_BUILD_DIR)/libiberty \
--- a/package/devel/gdb/Makefile
+++ b/package/devel/gdb/Makefile
@ -76,10 +76,12 @@ TARGET_LDFLAGS+= \
 	-static-libstdc++ \
 	-Wl,--gc-sections

+MAKE_VARS+= \
+	CPPFLAGS="$(TARGET_CPPFLAGS)"
+
 define Build/Install
 	$(MAKE) -C $(PKG_BUILD_DIR) \
 		DESTDIR="$(PKG_INSTALL_DIR)" \
-		CPPFLAGS="$(TARGET_CPPFLAGS)" \
 		install-gdb install-gdbserver
 endef

--- a/package/firmware/intel-microcode/Makefile
+++ b/package/firmware/intel-microcode/Makefile
@ -39,7 +39,7 @@ endef

 define Build/Compile
 	IUCODE_TOOL=$(STAGING_DIR)/../host/bin/iucode_tool $(MAKE) -C $(PKG_BUILD_DIR)
-	mkdir $(PKG_BUILD_DIR)/intel-ucode-ipkg
+	mkdir -p $(PKG_BUILD_DIR)/intel-ucode-ipkg
 	$(STAGING_DIR)/../host/bin/iucode_tool -q \
 		--write-firmware=$(PKG_BUILD_DIR)/intel-ucode-ipkg $(PKG_BUILD_DIR)/$(MICROCODE).bin
 endef
--- a/package/firmware/ipq-wifi/Makefile
+++ b/package/firmware/ipq-wifi/Makefile
@ -6,13 +6,19 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/firmware/qca-wireless.git
-PKG_SOURCE_DATE:=2025-11-15
-PKG_SOURCE_VERSION:=7c6b7545f69a3ef3ddaaff68fc97e9e172117e2e
-PKG_MIRROR_HASH:=ac77840bafd111b3cc3d6cfc7a3b770fdaabb929209c38cd2109be2efd575dae
+PKG_SOURCE_DATE:=2026-01-28
+PKG_SOURCE_VERSION:=88514e5aab3e1c0dabad81c7ace815c2fa45565a
+PKG_MIRROR_HASH:=d51f25001a8cf166bc6d42372861b4290c69dae1f8aaeb9b1e5d85f4b06f8545
 PKG_FLAGS:=nonshared

 include $(INCLUDE_DIR)/package.mk

+define Build/Prepare
+	$(call Build/Prepare/Default)
+	$(if $(wildcard $(CURDIR)/files/*), \
+		$(CP) $(CURDIR)/files/* $(PKG_BUILD_DIR)/)
+endef
+
 define Build/Compile
 endef

@ -55,6 +61,7 @@ ALLWIFIBOARDS:= \
 	linksys_mx4200 \
 	linksys_mx5300 \
 	linksys_mx5500 \
+	linksys_mx6200 \
 	linksys_mx8500 \
 	linksys_spnmx56 \
 	linksys_whw03 \
@ -63,6 +70,7 @@ ALLWIFIBOARDS:= \
 	netgear_lbr20 \
 	netgear_rax120v2 \
 	netgear_rbk20 \
+	netgear_rbk40 \
 	netgear_sxk80 \
 	netgear_wax214 \
 	netgear_wax218 \
@ -79,13 +87,15 @@ ALLWIFIBOARDS:= \
 	tplink_deco-x80-5g \
 	tplink_eap610-outdoor \
 	tplink_eap620hd-v1 \
-	tplink_eap623od-hd-v1 \
+	tplink_eap623-outdoor-hd-v1 \
 	tplink_eap625-outdoor-hd-v1 \
 	tplink_eap660hd-v1 \
 	tplink_archer-c59-v1 \
 	tplink_archer-c6-v2 \
 	tplink_archer-c60-v1 \
 	tplink_archer-c60-v2 \
+	tplink_tl-wa1201-v2 \
+        trendnet_tew-829dru \
 	wallys_dr40x9 \
 	xiaomi_aiot-ac2350 \
 	xiaomi_ax3600 \
@ -103,7 +113,8 @@ ALLWIFIBOARDS:= \
 	zte_mf287 \
 	zte_mf287plus \
 	zyxel_nbg7815 \
-	zyxel_nwa210ax
+	zyxel_nwa210ax \
+	zyxel_scr50axe

 ALLWIFIPACKAGES:=$(foreach BOARD,$(ALLWIFIBOARDS),ipq-wifi-$(BOARD))

@ -234,6 +245,7 @@ $(eval $(call generate-ipq-wifi-package,linksys_mx2000,Linksys MX2000))
 $(eval $(call generate-ipq-wifi-package,linksys_mx4200,Linksys MX4200))
 $(eval $(call generate-ipq-wifi-package,linksys_mx5300,Linksys MX5300))
 $(eval $(call generate-ipq-wifi-package,linksys_mx5500,Linksys MX5500))
+$(eval $(call generate-ipq-wifi-package,linksys_mx6200,Linksys MX6200))
 $(eval $(call generate-ipq-wifi-package,linksys_mx8500,Linksys MX8500))
 $(eval $(call generate-ipq-wifi-package,linksys_spnmx56,Linksys SPNMX56))
 $(eval $(call generate-ipq-wifi-package,linksys_whw03,Linksys WHW03))
@ -242,6 +254,7 @@ $(eval $(call generate-ipq-wifi-package,meraki_z3,Meraki Z3))
 $(eval $(call generate-ipq-wifi-package,netgear_lbr20,Netgear LBR20))
 $(eval $(call generate-ipq-wifi-package,netgear_rax120v2,Netgear RAX120v2))
 $(eval $(call generate-ipq-wifi-package,netgear_rbk20,Netgear RBK20))
+$(eval $(call generate-ipq-wifi-package,netgear_rbk40,Netgear RBK40))
 $(eval $(call generate-ipq-wifi-package,netgear_sxk80,Netgear SXK80))
 $(eval $(call generate-ipq-wifi-package,netgear_wax214,Netgear WAX214))
 $(eval $(call generate-ipq-wifi-package,netgear_wax218,Netgear WAX218))
@ -258,13 +271,15 @@ $(eval $(call generate-ipq-wifi-package,spectrum_sax1v1k,Spectrum SAX1V1K))
 $(eval $(call generate-ipq-wifi-package,tplink_deco-x80-5g,TP-Link Deco X80-5G))
 $(eval $(call generate-ipq-wifi-package,tplink_eap610-outdoor,TPLink EAP610-Outdoor))
 $(eval $(call generate-ipq-wifi-package,tplink_eap620hd-v1,TP-Link EAP620 HD v1))
-$(eval $(call generate-ipq-wifi-package,tplink_eap623od-hd-v1,TP-Link EAP623-Outdoor HD v1))
+$(eval $(call generate-ipq-wifi-package,tplink_eap623-outdoor-hd-v1,TP-Link EAP623-Outdoor HD v1))
 $(eval $(call generate-ipq-wifi-package,tplink_eap625-outdoor-hd-v1,TP-Link EAP625-Outdoor HD v1))
 $(eval $(call generate-ipq-wifi-package,tplink_eap660hd-v1,TP-Link EAP660 HD v1))
 $(eval $(call generate-ipq-wifi-package,tplink_archer-c59-v1,TP-Link Archer C59 V1))
 $(eval $(call generate-ipq-wifi-package,tplink_archer-c6-v2,TP-Link Archer C6 V2))
 $(eval $(call generate-ipq-wifi-package,tplink_archer-c60-v1,TP-Link Archer C60 V1))
 $(eval $(call generate-ipq-wifi-package,tplink_archer-c60-v2,TP-Link Archer C60 V2))
+$(eval $(call generate-ipq-wifi-package,tplink_tl-wa1201-v2,TP-Link TL-WA1201 V2))
+$(eval $(call generate-ipq-wifi-package,trendnet_tew-829dru,TRENDnet TEW-829DRU))
 $(eval $(call generate-ipq-wifi-package,wallys_dr40x9,Wallys DR40X9))
 $(eval $(call generate-ipq-wifi-package,xiaomi_aiot-ac2350,Xiaomi AIoT AC2350))
 $(eval $(call generate-ipq-wifi-package,xiaomi_ax3600,Xiaomi AX3600))
@ -283,5 +298,6 @@ $(eval $(call generate-ipq-wifi-package,zte_mf287,ZTE MF287))
 $(eval $(call generate-ipq-wifi-package,zte_mf287plus,ZTE MF287Plus))
 $(eval $(call generate-ipq-wifi-package,zyxel_nbg7815,Zyxel NBG7815))
 $(eval $(call generate-ipq-wifi-package,zyxel_nwa210ax,Zyxel NWA210AX))
+$(eval $(call generate-ipq-wifi-package,zyxel_scr50axe,Zyxel SCR50AXE))

 $(foreach PACKAGE,$(ALLWIFIPACKAGES),$(eval $(call BuildPackage,$(PACKAGE))))
--- a/package/firmware/layerscape/fman-ucode/Makefile
+++ b/package/firmware/layerscape/fman-ucode/Makefile
@ -24,8 +24,8 @@ define Package/layerscape-fman
  SECTION:=firmware
  CATEGORY:=Firmware
  TITLE:=NXP FMan ucode
-  DEPENDS:=@TARGET_layerscape
-  DEFAULT:=y if TARGET_layerscape_armv8_64b
+  DEPENDS:=@TARGET_layerscape||TARGET_qoriq
+  DEFAULT:=y if TARGET_layerscape_armv8_64b||TARGET_qoriq
  HIDDEN:=1
 endef

@ -38,6 +38,8 @@ define Build/InstallDev
 		$(STAGING_DIR_IMAGE)/fsl_ls1043a-rdb-fman.bin
 	$(CP) $(PKG_BUILD_DIR)/fsl_fman_ucode_ls1046_r1.0_106_4_18.bin \
 		$(STAGING_DIR_IMAGE)/fsl_ls1046a-rdb-fman.bin
+	$(CP) $(PKG_BUILD_DIR)/fsl_fman_ucode_t4240_r2.0_106_4_18.bin \
+		$(STAGING_DIR_IMAGE)/fsl_t4240-rdb-fman.bin
 endef

 $(eval $(call BuildPackage,layerscape-fman))
--- a/package/firmware/layerscape/ls-rcw/Makefile
+++ b/package/firmware/layerscape/ls-rcw/Makefile
@ -24,8 +24,8 @@ define Package/layerscape-rcw
  SECTION:=firmware
  CATEGORY:=Firmware
  TITLE:=NXP Layerscape RCW binaries
-  DEPENDS:=@TARGET_layerscape
-  DEFAULT:=y if TARGET_layerscape_armv7
+  DEPENDS:=@TARGET_layerscape||TARGET_qoriq
+  DEFAULT:=y if TARGET_layerscape_armv7||TARGET_qoriq
  HIDDEN:=1
 endef

@ -46,7 +46,8 @@ BOARDS := \
  ls2088a-rdb \
  lx2160a-rdb \
  lx2160a-rdb-sdboot \
-  ls1021a-twr
+  ls1021a-twr \
+  T4240RDB \

 RCW_ls1012a-rdb         :=ls1012ardb/R_SPNH_3508/rcw_1000_default.bin
 RCW_ls1012a-frdm        :=ls1012afrdm/N_SSNP_3305/rcw_800.bin
@ -65,6 +66,7 @@ RCW_ls2088a-rdb         :=ls2088ardb/FFFFFFFF_PP_HH_0x2a_0x41/rcw_1800.bin
 RCW_lx2160a-rdb         :=lx2160ardb_rev2/XGGFF_PP_HHHH_RR_19_5_2/rcw_2000_700_2900_19_5_2.bin
 RCW_lx2160a-rdb-sdboot  :=lx2160ardb_rev2/XGGFF_PP_HHHH_RR_19_5_2/rcw_2000_700_2900_19_5_2.bin
 RCW_ls1021a-twr         :=ls1021atwr/SSR_PNS_30/rcw_1200.bin
+RCW_T4240RDB            :=t4240rdb/SSFFPPH_27_55_1_9/rcw_27_55_1_9_1666MHz.bin

 define Build/InstallDev
 	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
--- a/package/firmware/layerscape/ls-rcw/patches/0003-fix_rcw_for_t4240rdb.patch
+++ b/package/firmware/layerscape/ls-rcw/patches/0003-fix_rcw_for_t4240rdb.patch
@ -0,0 +1,42 @@
+--- /dev/null
+++ b/t4240rdb/a008098.rcw
+@@ -0,0 +1,31 @@
+/*
+ * Work-around for erratum A-008098
+ *
+ * Description:
+ * The PCI Express controller may fail to discard a bad packet when there
+ * are excessive, correctable errors resulting in corrupted memory.
+ *
+ * Impact:
+ * While running in an environment with many correctable errors the PCI
+ * Express controller can corrupt memory.
+ *
+ * T4240RDB have only 0x100 bytes for PBI in eeprom. Unused pcie must be deleted.
+ */
+
+.pbi
+write 0x240000, 0x87000048
+write 0x240004, 0x80802040
+write 0x240000, 0x8700004c
+write 0x240004, 0x02c02000
+write 0x240000, 0x87000050
+write 0x240004, 0x00002000
+
+write 0x260000, 0x87000048
+write 0x260004, 0x80802040
+write 0x260000, 0x8700004c
+write 0x260004, 0x02c02000
+write 0x260000, 0x87000050
+write 0x260004, 0x00002000
+
+flush
+.end
+--- a/t4240rdb/SSFFPPH_27_55_1_9/rcw_27_55_1_9_1666MHz.rcw
+++ b/t4240rdb/SSFFPPH_27_55_1_9/rcw_27_55_1_9_1666MHz.rcw
+@@ -60,4 +60,4 @@ write 0x124010, 0x00000101
+ write 0x124130, 0x0000000c
+ .end
+ 
+-#include <../t4240qds/a008098.rcw>
+#include <a008098.rcw>
--- a/package/firmware/linux-firmware/Makefile
+++ b/package/firmware/linux-firmware/Makefile
@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=linux-firmware
-PKG_VERSION:=20251125
+PKG_VERSION:=20260221
 PKG_RELEASE:=1

 PKG_SOURCE_URL:=@KERNEL/linux/kernel/firmware
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=eb807a01c52882ac97ef5b678d4a246b209e6165ac1287d62a5f93a09ee93cd2
+PKG_HASH:=bd19acc4c1a02548e09d3df67f987fe6e378df735bab138c1d9e917962056d94

 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>

--- a/package/firmware/linux-firmware/airoha.mk
+++ b/package/firmware/linux-firmware/airoha.mk
@ -16,6 +16,7 @@ endef

 $(eval $(call BuildPackage,airoha-en8811h-firmware))

+
 Package/airoha-en7581-npu-firmware = $(call Package/firmware-default,Airoha EN7581 NPU firmware,,LICENSE.airoha)
 define Package/airoha-en7581-npu-firmware/install
 	$(INSTALL_DIR) $(1)/lib/firmware/airoha
@ -26,3 +27,27 @@ define Package/airoha-en7581-npu-firmware/install
 endef

 $(eval $(call BuildPackage,airoha-en7581-npu-firmware))
+
+
+Package/airoha-en7581-mt7996-npu-firmware = $(call Package/firmware-default,Airoha EN7581+MT7996 NPU firmware,,LICENSE.airoha)
+define Package/airoha-en7581-mt7996-npu-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/airoha
+	$(CP) \
+		$(PKG_BUILD_DIR)/airoha/en7581_MT7996_npu_data.bin \
+		$(PKG_BUILD_DIR)/airoha/en7581_MT7996_npu_rv32.bin \
+		$(1)/lib/firmware/airoha
+endef
+
+$(eval $(call BuildPackage,airoha-en7581-mt7996-npu-firmware))
+
+
+Package/airoha-an7583-npu-firmware = $(call Package/firmware-default,Airoha AN7583 NPU firmware,,LICENSE.airoha)
+define Package/airoha-an7583-npu-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/airoha
+	$(CP) \
+		$(PKG_BUILD_DIR)/airoha/an7583_npu_data.bin \
+		$(PKG_BUILD_DIR)/airoha/an7583_npu_rv32.bin \
+		$(1)/lib/firmware/airoha
+endef
+
+$(eval $(call BuildPackage,airoha-an7583-npu-firmware))
--- a/package/firmware/linux-firmware/intel.mk
+++ b/package/firmware/linux-firmware/intel.mk
@ -219,7 +219,7 @@ $(eval $(call BuildPackage,iwlwifi-firmware-ax411))
 Package/iwlwifi-firmware-be200 = $(call Package/firmware-default,Intel BE200 firmware)
 define Package/iwlwifi-firmware-be200/install
 	$(INSTALL_DIR) $(1)/lib/firmware
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/intel/iwlwifi/iwlwifi-gl-c0-fm-c0-98.ucode $(1)/lib/firmware
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/intel/iwlwifi/iwlwifi-gl-c0-fm-c0-101.ucode $(1)/lib/firmware
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/intel/iwlwifi/iwlwifi-gl-c0-fm-c0.pnvm $(1)/lib/firmware
 endef
 $(eval $(call BuildPackage,iwlwifi-firmware-be200))
--- a/package/firmware/wireless-regdb/Makefile
+++ b/package/firmware/wireless-regdb/Makefile
@ -1,14 +1,14 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=wireless-regdb
-PKG_VERSION:=2025.10.07
+PKG_VERSION:=2026.03.18
 PKG_RELEASE:=1
 PKG_LICENSE:=ISC
 PKG_LICENSE_FILES:=LICENSE

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/wireless-regdb/
-PKG_HASH:=d4c872a44154604c869f5851f7d21d818d492835d370af7f58de8847973801c3
+PKG_HASH:=5fc0000475d8c5368ccc5222827c16aef98b1eb6a69c9b5a3e7b7e98528945ac

 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>

--- a/package/kernel/ath10k-ct/Makefile
+++ b/package/kernel/ath10k-ct/Makefile
@ -34,7 +34,7 @@ define KernelPackage/ath10k-ct
 	$(PKG_BUILD_DIR)/ath10k$(CT_KVER)/ath10k_pci.ko \
 	$(PKG_BUILD_DIR)/ath10k$(CT_KVER)/ath10k_core.ko
  AUTOLOAD:=$(call AutoProbe,ath10k_pci)
-  PROVIDES:=kmod-ath10k
+  PROVIDES:=@kmod-ath10k-any
  VARIANT:=regular
 endef

--- a/package/kernel/dtc/patches/0001-scripts-dtc-Update-to-version-with-overlays.patch
+++ b/package/kernel/dtc/patches/0001-scripts-dtc-Update-to-version-with-overlays.patch
@ -1,642 +0,0 @@
-From 5f84cb93eef9f8a8ff7f49d593893f252744d0fe Mon Sep 17 00:00:00 2001
-From: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
-Date: Wed, 26 Aug 2015 18:28:08 +0300
-Subject: [PATCH] scripts/dtc: Update to version with overlays
-
-Update to mainline dtc with overlay support
-
-Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
---
- checks.c     |  20 +++++-
- dtc-lexer.l  |   5 ++
- dtc-parser.y |  54 ++++++++++++++--
- dtc.c        |  83 ++++++++++++++++++++++--
- dtc.h        |  13 +++-
- livetree.c   | 202 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- treesource.c |   3 +
- util.c       |   2 +-
- 8 files changed, 367 insertions(+), 15 deletions(-)
-
-diff --git a/checks.c b/checks.c
-index 3bf0fa4..af25c2b 100644
--- a/checks.c
-+++ b/checks.c
-@@ -465,8 +465,12 @@ static void fixup_phandle_references(struct check *c, struct node *dt,
- 
- 		refnode = get_node_by_ref(dt, m->ref);
- 		if (! refnode) {
-			FAIL(c, "Reference to non-existent node or label \"%s\"\n",
-			     m->ref);
-+			if (!source_is_plugin)
-+				FAIL(c, "Reference to non-existent node or "
-+						"label \"%s\"\n", m->ref);
-+			else /* mark the entry as unresolved */
-+				*((cell_t *)(prop->val.val + m->offset)) =
-+					cpu_to_fdt32(0xffffffff);
- 			continue;
- 		}
- 
-@@ -559,7 +563,7 @@ static void check_reg_format(struct check *c, struct node *dt,
- 	size_cells = node_size_cells(node->parent);
- 	entrylen = (addr_cells + size_cells) * sizeof(cell_t);
- 
-	if ((prop->val.len % entrylen) != 0)
-+	if (!entrylen || (prop->val.len % entrylen) != 0)
- 		FAIL(c, "\"reg\" property in %s has invalid length (%d bytes) "
- 		     "(#address-cells == %d, #size-cells == %d)",
- 		     node->fullpath, prop->val.len, addr_cells, size_cells);
-@@ -651,6 +655,15 @@ static void check_obsolete_chosen_interrupt_controller(struct check *c,
- }
- TREE_WARNING(obsolete_chosen_interrupt_controller, NULL);
- 
-+static void check_deprecated_plugin_syntax(struct check *c,
-+					   struct node *dt)
-+{
-+	if (deprecated_plugin_syntax_warning)
-+		FAIL(c, "Use '/dts-v1/ /plugin/'; syntax. /dts-v1/; /plugin/; "
-+				"is going to be removed in next versions");
-+}
-+TREE_WARNING(deprecated_plugin_syntax, NULL);
-+
- static struct check *check_table[] = {
- 	&duplicate_node_names, &duplicate_property_names,
- 	&node_name_chars, &node_name_format, &property_name_chars,
-@@ -668,6 +681,7 @@ static struct check *check_table[] = {
- 
- 	&avoid_default_addr_size,
- 	&obsolete_chosen_interrupt_controller,
-+	&deprecated_plugin_syntax,
- 
- 	&always_fail,
- };
-diff --git a/dtc-lexer.l b/dtc-lexer.l
-index 0ee1caf..dd44ba2 100644
--- a/dtc-lexer.l
-+++ b/dtc-lexer.l
-@@ -113,6 +113,11 @@ static void lexical_error(const char *fmt, ...);
- 			return DT_V1;
- 		}
- 
-+<*>"/plugin/"	{
-+			DPRINT("Keyword: /plugin/\n");
-+			return DT_PLUGIN;
-+		}
-+
- <*>"/memreserve/"	{
- 			DPRINT("Keyword: /memreserve/\n");
- 			BEGIN_DEFAULT();
-diff --git a/dtc-parser.y b/dtc-parser.y
-index ea57e0a..7d9652d 100644
--- a/dtc-parser.y
-+++ b/dtc-parser.y
-@@ -19,6 +19,7 @@
-  */
- %{
- #include <stdio.h>
-+#include <inttypes.h>
- 
- #include "dtc.h"
- #include "srcpos.h"
-@@ -52,9 +53,11 @@ extern bool treesource_error;
- 	struct node *nodelist;
- 	struct reserve_info *re;
- 	uint64_t integer;
-+	bool is_plugin;
- }
- 
- %token DT_V1
-+%token DT_PLUGIN
- %token DT_MEMRESERVE
- %token DT_LSHIFT DT_RSHIFT DT_LE DT_GE DT_EQ DT_NE DT_AND DT_OR
- %token DT_BITS
-@@ -71,6 +74,7 @@ extern bool treesource_error;
- 
- %type <data> propdata
- %type <data> propdataprefix
-+%type <is_plugin> plugindecl
- %type <re> memreserve
- %type <re> memreserves
- %type <array> arrayprefix
-@@ -101,10 +105,39 @@ extern bool treesource_error;
- %%
- 
- sourcefile:
-	  DT_V1 ';' memreserves devicetree
-+	    basesource
-+	  | pluginsource
-+	  ;
-+
-+basesource:
-+	  DT_V1 ';' plugindecl memreserves devicetree
-+		{
-+			source_is_plugin = $3;
-+			if (source_is_plugin)
-+				deprecated_plugin_syntax_warning = true;
-+			the_boot_info = build_boot_info($4, $5,
-+							guess_boot_cpuid($5));
-+		}
-+	;
-+
-+plugindecl:
-+	/* empty */
-+		{
-+			$$ = false;
-+		}
-+	| DT_PLUGIN ';'
-+		{
-+			$$ = true;
-+		}
-+	;
-+
-+pluginsource:
-+	DT_V1 DT_PLUGIN ';' memreserves devicetree
- 		{
-			the_boot_info = build_boot_info($3, $4,
-							guess_boot_cpuid($4));
-+			source_is_plugin = true;
-+			deprecated_plugin_syntax_warning = false;
-+			the_boot_info = build_boot_info($4, $5,
-+							guess_boot_cpuid($5));
- 		}
- 	;
- 
-@@ -144,10 +177,14 @@ devicetree:
- 		{
- 			struct node *target = get_node_by_ref($1, $2);
- 
-			if (target)
-+			if (target) {
- 				merge_nodes(target, $3);
-			else
-				ERROR(&@2, "Label or path %s not found", $2);
-+			} else {
-+				if (symbol_fixup_support)
-+					add_orphan_node($1, $3, $2);
-+				else
-+					ERROR(&@2, "Label or path %s not found", $2);
-+			}
- 			$$ = $1;
- 		}
- 	| devicetree DT_DEL_NODE DT_REF ';'
-@@ -162,6 +199,11 @@ devicetree:
- 
- 			$$ = $1;
- 		}
-+	| /* empty */
-+		{
-+			/* build empty node */
-+			$$ = name_node(build_node(NULL, NULL), "");
-+		}
- 	;
- 
- nodedef:
-diff --git a/dtc.c b/dtc.c
-index 8c4add6..ee37be9 100644
--- a/dtc.c
-+++ b/dtc.c
-@@ -18,6 +18,8 @@
-  *                                                                   USA
-  */
- 
-+#include <sys/stat.h>
-+
- #include "dtc.h"
- #include "srcpos.h"
- 
-@@ -29,6 +31,8 @@ int reservenum;		/* Number of memory reservation slots */
- int minsize;		/* Minimum blob size */
- int padsize;		/* Additional padding to blob */
- int phandle_format = PHANDLE_BOTH;	/* Use linux,phandle or phandle properties */
-+int symbol_fixup_support;
-+int auto_label_aliases;
- 
- static void fill_fullpaths(struct node *tree, const char *prefix)
- {
-@@ -51,7 +55,7 @@ static void fill_fullpaths(struct node *tree, const char *prefix)
- #define FDT_VERSION(version)	_FDT_VERSION(version)
- #define _FDT_VERSION(version)	#version
- static const char usage_synopsis[] = "dtc [options] <input file>";
-static const char usage_short_opts[] = "qI:O:o:V:d:R:S:p:fb:i:H:sW:E:hv";
-+static const char usage_short_opts[] = "qI:O:o:V:d:R:S:p:fb:i:H:sW:E:@Ahv";
- static struct option const usage_long_opts[] = {
- 	{"quiet",            no_argument, NULL, 'q'},
- 	{"in-format",         a_argument, NULL, 'I'},
-@@ -69,6 +73,8 @@ static struct option const usage_long_opts[] = {
- 	{"phandle",           a_argument, NULL, 'H'},
- 	{"warning",           a_argument, NULL, 'W'},
- 	{"error",             a_argument, NULL, 'E'},
-+	{"symbols",	     no_argument, NULL, '@'},
-+	{"auto-alias",       no_argument, NULL, 'A'},
- 	{"help",             no_argument, NULL, 'h'},
- 	{"version",          no_argument, NULL, 'v'},
- 	{NULL,               no_argument, NULL, 0x0},
-@@ -99,16 +105,63 @@ static const char * const usage_opts_help[] = {
- 	 "\t\tboth   - Both \"linux,phandle\" and \"phandle\" properties",
- 	"\n\tEnable/disable warnings (prefix with \"no-\")",
- 	"\n\tEnable/disable errors (prefix with \"no-\")",
-+	"\n\tEnable symbols/fixup support",
-+	"\n\tEnable auto-alias of labels",
- 	"\n\tPrint this help and exit",
- 	"\n\tPrint version and exit",
- 	NULL,
- };
- 
-+static const char *guess_type_by_name(const char *fname, const char *fallback)
-+{
-+	const char *s;
-+
-+	s = strrchr(fname, '.');
-+	if (s == NULL)
-+		return fallback;
-+	if (!strcasecmp(s, ".dts"))
-+		return "dts";
-+	if (!strcasecmp(s, ".dtb"))
-+		return "dtb";
-+	return fallback;
-+}
-+
-+static const char *guess_input_format(const char *fname, const char *fallback)
-+{
-+	struct stat statbuf;
-+	uint32_t magic;
-+	FILE *f;
-+
-+	if (stat(fname, &statbuf) != 0)
-+		return fallback;
-+
-+	if (S_ISDIR(statbuf.st_mode))
-+		return "fs";
-+
-+	if (!S_ISREG(statbuf.st_mode))
-+		return fallback;
-+
-+	f = fopen(fname, "r");
-+	if (f == NULL)
-+		return fallback;
-+	if (fread(&magic, 4, 1, f) != 1) {
-+		fclose(f);
-+		return fallback;
-+	}
-+	fclose(f);
-+
-+	magic = fdt32_to_cpu(magic);
-+	if (magic == FDT_MAGIC)
-+		return "dtb";
-+
-+	return guess_type_by_name(fname, fallback);
-+}
-+
- int main(int argc, char *argv[])
- {
- 	struct boot_info *bi;
-	const char *inform = "dts";
-	const char *outform = "dts";
-+	const char *inform = NULL;
-+	const char *outform = NULL;
- 	const char *outname = "-";
- 	const char *depname = NULL;
- 	bool force = false, sort = false;
-@@ -186,7 +239,12 @@ int main(int argc, char *argv[])
- 		case 'E':
- 			parse_checks_option(false, true, optarg);
- 			break;
-
-+		case '@':
-+			symbol_fixup_support = 1;
-+			break;
-+		case 'A':
-+			auto_label_aliases = 1;
-+			break;
- 		case 'h':
- 			usage(NULL);
- 		default:
-@@ -213,6 +271,17 @@ int main(int argc, char *argv[])
- 		fprintf(depfile, "%s:", outname);
- 	}
- 
-+	if (inform == NULL)
-+		inform = guess_input_format(arg, "dts");
-+	if (outform == NULL) {
-+		outform = guess_type_by_name(outname, NULL);
-+		if (outform == NULL) {
-+			if (streq(inform, "dts"))
-+				outform = "dtb";
-+			else
-+				outform = "dts";
-+		}
-+	}
- 	if (streq(inform, "dts"))
- 		bi = dt_from_source(arg);
- 	else if (streq(inform, "fs"))
-@@ -236,6 +305,12 @@ int main(int argc, char *argv[])
- 	if (sort)
- 		sort_tree(bi);
- 
-+	if (symbol_fixup_support || auto_label_aliases)
-+		generate_label_node(bi->dt, bi->dt);
-+
-+	if (symbol_fixup_support)
-+		generate_fixups_node(bi->dt, bi->dt);
-+
- 	if (streq(outname, "-")) {
- 		outf = stdout;
- 	} else {
-diff --git a/dtc.h b/dtc.h
-index 56212c8..d025111 100644
--- a/dtc.h
-+++ b/dtc.h
-@@ -20,7 +20,7 @@
-  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
-  *                                                                   USA
-  */
-
-+#define _GNU_SOURCE
- #include <stdio.h>
- #include <string.h>
- #include <stdlib.h>
-@@ -54,6 +54,14 @@ extern int reservenum;		/* Number of memory reservation slots */
- extern int minsize;		/* Minimum blob size */
- extern int padsize;		/* Additional padding to blob */
- extern int phandle_format;	/* Use linux,phandle or phandle properties */
-+extern int symbol_fixup_support;/* enable symbols & fixup support */
-+extern int auto_label_aliases;	/* auto generate labels -> aliases */
-+
-+/*
-+ * Tree source globals
-+ */
-+extern bool source_is_plugin;
-+extern bool deprecated_plugin_syntax_warning;
- 
- #define PHANDLE_LEGACY	0x1
- #define PHANDLE_EPAPR	0x2
-@@ -194,6 +202,7 @@ struct node *build_node_delete(void);
- struct node *name_node(struct node *node, char *name);
- struct node *chain_node(struct node *first, struct node *list);
- struct node *merge_nodes(struct node *old_node, struct node *new_node);
-+void add_orphan_node(struct node *old_node, struct node *new_node, char *ref);
- 
- void add_property(struct node *node, struct property *prop);
- void delete_property_by_name(struct node *node, char *name);
-@@ -244,6 +253,8 @@ struct boot_info {
- struct boot_info *build_boot_info(struct reserve_info *reservelist,
- 				  struct node *tree, uint32_t boot_cpuid_phys);
- void sort_tree(struct boot_info *bi);
-+void generate_label_node(struct node *node, struct node *dt);
-+void generate_fixups_node(struct node *node, struct node *dt);
- 
- /* Checks */
- 
-diff --git a/livetree.c b/livetree.c
-index e229b84..1ef9fc4 100644
--- a/livetree.c
-+++ b/livetree.c
-@@ -216,6 +216,34 @@ struct node *merge_nodes(struct node *old_node, struct node *new_node)
- 	return old_node;
- }
- 
-+void add_orphan_node(struct node *dt, struct node *new_node, char *ref)
-+{
-+	static unsigned int next_orphan_fragment = 0;
-+	struct node *ovl = xmalloc(sizeof(*ovl));
-+	struct property *p;
-+	struct data d = empty_data;
-+	char *name;
-+	int ret;
-+
-+	memset(ovl, 0, sizeof(*ovl));
-+
-+	d = data_add_marker(d, REF_PHANDLE, ref);
-+	d = data_append_integer(d, 0xffffffff, 32);
-+
-+	p = build_property("target", d);
-+	add_property(ovl, p);
-+
-+	ret = asprintf(&name, "fragment@%u",
-+			next_orphan_fragment++);
-+	if (ret == -1)
-+		die("asprintf() failed\n");
-+	name_node(ovl, name);
-+	name_node(new_node, "__overlay__");
-+
-+	add_child(dt, ovl);
-+	add_child(ovl, new_node);
-+}
-+
- struct node *chain_node(struct node *first, struct node *list)
- {
- 	assert(first->next_sibling == NULL);
-@@ -709,3 +737,177 @@ void sort_tree(struct boot_info *bi)
- 	sort_reserve_entries(bi);
- 	sort_node(bi->dt);
- }
-+
-+void generate_label_node(struct node *node, struct node *dt)
-+{
-+	struct node *c, *an;
-+	struct property *p;
-+	struct label *l;
-+	int has_label;
-+	char *gen_node_name;
-+
-+	if (auto_label_aliases)
-+		gen_node_name = "aliases";
-+	else
-+		gen_node_name = "__symbols__";
-+
-+	/* Make sure the label isn't already there */
-+	has_label = 0;
-+	for_each_label(node->labels, l) {
-+		has_label = 1;
-+		break;
-+	}
-+
-+	if (has_label) {
-+
-+		/* an is the aliases/__symbols__ node */
-+		an = get_subnode(dt, gen_node_name);
-+		/* if no node exists, create it */
-+		if (!an) {
-+			an = build_node(NULL, NULL);
-+			name_node(an, gen_node_name);
-+			add_child(dt, an);
-+		}
-+
-+		/* now add the label in the node */
-+		for_each_label(node->labels, l) {
-+			/* check whether the label already exists */
-+			p = get_property(an, l->label);
-+			if (p) {
-+				fprintf(stderr, "WARNING: label %s already"
-+					" exists in /%s", l->label,
-+					gen_node_name);
-+				continue;
-+			}
-+
-+			/* insert it */
-+			p = build_property(l->label,
-+				data_copy_escape_string(node->fullpath,
-+						strlen(node->fullpath)));
-+			add_property(an, p);
-+		}
-+
-+		/* force allocation of a phandle for this node */
-+		if (symbol_fixup_support)
-+			(void)get_node_phandle(dt, node);
-+	}
-+
-+	for_each_child(node, c)
-+		generate_label_node(c, dt);
-+}
-+
-+static void add_fixup_entry(struct node *dt, struct node *node,
-+		struct property *prop, struct marker *m)
-+{
-+	struct node *fn;	/* local fixup node */
-+	struct property *p;
-+	char *fixups_name = "__fixups__";
-+	struct data d;
-+	char *entry;
-+	int ret;
-+
-+	/* fn is the node we're putting entries in */
-+	fn = get_subnode(dt, fixups_name);
-+	/* if no node exists, create it */
-+	if (!fn) {
-+		fn = build_node(NULL, NULL);
-+		name_node(fn, fixups_name);
-+		add_child(dt, fn);
-+	}
-+
-+	ret = asprintf(&entry, "%s:%s:%u",
-+			node->fullpath, prop->name, m->offset);
-+	if (ret == -1)
-+		die("asprintf() failed\n");
-+
-+	p = get_property(fn, m->ref);
-+	d = data_append_data(p ? p->val : empty_data, entry, strlen(entry) + 1);
-+	if (!p)
-+		add_property(fn, build_property(m->ref, d));
-+	else
-+		p->val = d;
-+}
-+
-+static void add_local_fixup_entry(struct node *dt, struct node *node,
-+		struct property *prop, struct marker *m,
-+		struct node *refnode)
-+{
-+	struct node *lfn, *wn, *nwn;	/* local fixup node, walk node, new */
-+	struct property *p;
-+	struct data d;
-+	char *local_fixups_name = "__local_fixups__";
-+	char *s, *e, *comp;
-+	int len;
-+
-+	/* fn is the node we're putting entries in */
-+	lfn = get_subnode(dt, local_fixups_name);
-+	/* if no node exists, create it */
-+	if (!lfn) {
-+		lfn = build_node(NULL, NULL);
-+		name_node(lfn, local_fixups_name);
-+		add_child(dt, lfn);
-+	}
-+
-+	/* walk the path components creating nodes if they don't exist */
-+	comp = NULL;
-+	/* start skipping the first / */
-+	s = node->fullpath + 1;
-+	wn = lfn;
-+	while (*s) {
-+		/* retrieve path component */
-+		e = strchr(s, '/');
-+		if (e == NULL)
-+			e = s + strlen(s);
-+		len = e - s;
-+		comp = xrealloc(comp, len + 1);
-+		memcpy(comp, s, len);
-+		comp[len] = '\0';
-+
-+		/* if no node exists, create it */
-+		nwn = get_subnode(wn, comp);
-+		if (!nwn) {
-+			nwn = build_node(NULL, NULL);
-+			name_node(nwn, strdup(comp));
-+			add_child(wn, nwn);
-+		}
-+		wn = nwn;
-+
-+		/* last path component */
-+		if (!*e)
-+			break;
-+
-+		/* next path component */
-+		s = e + 1;
-+	}
-+	free(comp);
-+
-+	p = get_property(wn, prop->name);
-+	d = data_append_cell(p ? p->val : empty_data, (cell_t)m->offset);
-+	if (!p)
-+		add_property(wn, build_property(prop->name, d));
-+	else
-+		p->val = d;
-+}
-+
-+void generate_fixups_node(struct node *node, struct node *dt)
-+{
-+	struct node *c;
-+	struct property *prop;
-+	struct marker *m;
-+	struct node *refnode;
-+
-+	for_each_property(node, prop) {
-+		m = prop->val.markers;
-+		for_each_marker_of_type(m, REF_PHANDLE) {
-+			refnode = get_node_by_ref(dt, m->ref);
-+			if (!refnode)
-+				add_fixup_entry(dt, node, prop, m);
-+			else
-+				add_local_fixup_entry(dt, node, prop, m,
-+						refnode);
-+		}
-+	}
-+
-+	for_each_child(node, c)
-+		generate_fixups_node(c, dt);
-+}
-diff --git a/treesource.c b/treesource.c
-index a55d1d1..e1d6657 100644
--- a/treesource.c
-+++ b/treesource.c
-@@ -28,6 +28,9 @@ extern YYLTYPE yylloc;
- struct boot_info *the_boot_info;
- bool treesource_error;
- 
-+bool source_is_plugin;
-+bool deprecated_plugin_syntax_warning;
-+
- struct boot_info *dt_from_source(const char *fname)
- {
- 	the_boot_info = NULL;
-diff --git a/util.c b/util.c
-index 9d65226..cbb945b 100644
--- a/util.c
-+++ b/util.c
-@@ -349,7 +349,6 @@ int utilfdt_decode_type(const char *fmt, int *type, int *size)
- void utilfdt_print_data(const char *data, int len)
- {
- 	int i;
-	const char *p = data;
- 	const char *s;
- 
- 	/* no data, don't print */
-@@ -376,6 +375,7 @@ void utilfdt_print_data(const char *data, int len)
- 			       i < (len - 1) ? " " : "");
- 		printf(">");
- 	} else {
-+		const unsigned char *p = (const unsigned char *)data;
- 		printf(" = [");
- 		for (i = 0; i < len; i++)
- 			printf("%02x%s", *p++, i < len - 1 ? " " : "");
-- 
-2.7.0
-
--- a/package/kernel/ipqess-dual-gmac.patch
+++ b/package/kernel/ipqess-dual-gmac.patch
@ -0,0 +1,124 @@
+--- a/drivers/net/ethernet/qualcomm/ipqess/ipqess.h
+++ b/drivers/net/ethernet/qualcomm/ipqess/ipqess.h
+@@ -162,6 +162,9 @@ struct ipqess_rx_ring_refill {
+ struct ipqess {
+        struct net_device *netdev;
+       /* second netdev for the QCA8337 CPU port (port 5 of the internal switch) */
+       struct net_device *netdev2;
+       u32 gmac1_port;         /* switch port number routed to netdev2, 0 = disabled */
+        void __iomem *hw_addr;
+ 
+        struct clk *ess_clk;
+--- a/drivers/net/ethernet/qualcomm/ipqess/ipqess.c
+++ b/drivers/net/ethernet/qualcomm/ipqess/ipqess.c
+@@ -393,8 +393,22 @@ static int ipqess_rx_poll(struct ipqess_rx_ring *rx_ring, int budget)
+                        skb_put(skb, length);
+                }
+ 
+-               skb->dev = rx_ring->ess->netdev;
+-               skb->protocol = eth_type_trans(skb, rx_ring->ess->netdev);
+               /* Demux to netdev2 if the RRD source port matches gmac1_port.
+                * rrd0 bits [14:12] carry the originating switch port id.
+                * IPQESS_RRD_PORT_ID_MASK = 0x7000
+                */
+               if (rx_ring->ess->gmac1_port &&
+                   rx_ring->ess->netdev2 &&
+                   netif_running(rx_ring->ess->netdev2)) {
+                       u16 src_port = (le16_to_cpu(rd->rrd0) & IPQESS_RRD_PORT_ID_MASK) >> 12;
+
+                       if (src_port == rx_ring->ess->gmac1_port) {
+                               skb->dev = rx_ring->ess->netdev2;
+                               skb->protocol = eth_type_trans(skb, rx_ring->ess->netdev2);
+                               goto rx_demux_done;
+                       }
+               }
+               skb->dev = rx_ring->ess->netdev;
+               skb->protocol = eth_type_trans(skb, rx_ring->ess->netdev);
+rx_demux_done:
+                skb_record_rx_queue(skb, rx_ring->ring_id);
+ 
+@@ -1185,6 +1199,7 @@ static int ipqess_axi_probe(struct platform_device *pdev)
+        struct device_node *np = pdev->dev.of_node;
+        struct net_device *netdev;
+       struct net_device *netdev2 = NULL;
+        phy_interface_t phy_mode;
+        struct ipqess *ess;
+        int i, err = 0;
+@@ -1199,6 +1214,7 @@ static int ipqess_axi_probe(struct platform_device *pdev)
+        ess = netdev_priv(netdev);
+        ess->netdev = netdev;
+        ess->pdev = pdev;
+       ess->gmac1_port = 0;
+        spin_lock_init(&ess->stats_lock);
+        SET_NETDEV_DEV(netdev, &pdev->dev);
+        platform_set_drvdata(pdev, netdev);
+@@ -1275,6 +1291,51 @@ static int ipqess_axi_probe(struct platform_device *pdev)
+        err = register_netdev(netdev);
+        if (err)
+                goto err_notifier_unregister;
+
+       /* Optional second GMAC for TEW-829DRU / dual-switch boards.
+        * DTS: qcom,gmac1-port = <5>; in the ethernet node selects
+        * which switch CPU port is demuxed to the second netdev.
+        */
+       {
+               u32 port;
+               if (!of_property_read_u32(np, "qcom,gmac1-port", &port) && port) {
+                       netdev2 = alloc_etherdev(0);
+                       if (!netdev2) {
+                               dev_warn(&pdev->dev,
+                                        "gmac1: failed to alloc netdev2, single-GMAC mode\n");
+                               goto skip_gmac1;
+                       }
+
+                       SET_NETDEV_DEV(netdev2, &pdev->dev);
+                       netdev2->netdev_ops = &ipqess_axi_netdev_ops;
+                       netdev2->features   = netdev->features;
+                       netdev2->hw_features = 0;
+                       netdev2->vlan_features = netdev->vlan_features;
+                       netdev2->watchdog_timeo = 5 * HZ;
+                       netdev2->max_mtu = 9000;
+                       netdev2->gso_max_segs = IPQESS_TX_RING_SIZE / 2;
+                       /* Give it a MAC derived from netdev's by flipping one bit */
+                       eth_hw_addr_inherit(netdev2, netdev);
+                       netdev2->dev_addr [5] ^= 0x01;
+
+                       /* Point priv back to the same ess so all ring/hw
+                        * operations reuse the existing infrastructure.
+                        * netdev_priv(netdev2) would return garbage because
+                        * we used alloc_etherdev(0) – store ess in
+                        * netdev->ml_priv instead.
+                        */
+                       netdev2->ml_priv = ess;
+
+                       err = register_netdev(netdev2);
+                       if (err) {
+                               free_netdev(netdev2);
+                               dev_warn(&pdev->dev,
+                                        "gmac1: register_netdev failed (%d), single-GMAC mode\n",
+                                        err);
+                               goto skip_gmac1;
+                       }
+
+                       ess->gmac1_port = port;
+                       ess->netdev2    = netdev2;
+                       dev_info(&pdev->dev, "gmac1: netdev2=%s demuxing switch port %u\n",
+                                netdev2->name, port);
+               }
+       }
+skip_gmac1:
+ 
+        dev_set_threaded(netdev, true);
+ 
+@@ -1305,6 +1366,11 @@ static void ipqess_axi_remove(struct platform_device *pdev)
+        const struct net_device *netdev = platform_get_drvdata(pdev);
+        struct ipqess *ess = netdev_priv(netdev);
+ 
+       if (ess->netdev2) {
+               unregister_netdev(ess->netdev2);
+               free_netdev(ess->netdev2);
+               ess->netdev2 = NULL;
+       }
+
+        unregister_netdev(ess->netdev);
+        ipqess_hw_stop(ess);
--- a/package/kernel/lantiq/vrx518_tc/patches/208-dcdp-ptm_tc-fix-rx_len_adj.patch
+++ b/package/kernel/lantiq/vrx518_tc/patches/208-dcdp-ptm_tc-fix-rx_len_adj.patch
@ -0,0 +1,14 @@
+Fixes leaking the ethernet FCS into the frame payload on the RX
+path.
+
+--- a/dcdp/ptm_tc.c
+++ b/dcdp/ptm_tc.c
+@@ -923,7 +923,7 @@ static void ptm_fw_init(struct ptm_ep_pr
+ 	rx_gitf_cfg.rx_inserted_bytes_1h = 0;
+ 	rx_gitf_cfg.rx_inserted_bytes_2l = 0;
+ 	rx_gitf_cfg.rx_inserted_bytes_2h = 0;
+-	rx_gitf_cfg.rx_len_adj		= -2;
+	rx_gitf_cfg.rx_len_adj		= is_bonding ? -2 : -6;
+ 	for (i = 0; i < 4; i++) {
+ 		dst_addr = __RX_GIF0_CFG_STATS_CFG +
+ 			(i * DW_SZ(rx_gitf_cfg));
--- a/package/kernel/linux/Makefile
+++ b/package/kernel/linux/Makefile
@ -65,7 +65,7 @@ define Package/kernel/install
 	strings $(LINUX_DIR)/modules.builtin.modinfo | \
 		grep -E -v "\.(file$(if CONFIG_MODULE_STRIPPED,|parmtype))=" | \
 		tr '\n' '\0' > $(1)/$(MODULES_SUBDIR)/modules.builtin.modinfo
-	echo $(LINUX_VERSION)~$(LINUX_VERMAGIC)-r$(LINUX_RELEASE) > $(TMP_DIR)/kernel.version
+	echo $(LINUX_VERSION)~$(LINUX_VERMAGIC)-r$(LINUX_RELEASE) > $(STAGING_DIR)/kernel.version
 endef

 define Package/kernel/extra_provides
--- a/package/kernel/linux/modules/crypto.mk
+++ b/package/kernel/linux/modules/crypto.mk
@ -624,11 +624,7 @@ define KernelPackage/crypto-lib-curve25519
  FILES:= \
 	$(LINUX_DIR)/lib/crypto/libcurve25519.ko \
 	$(LINUX_DIR)/lib/crypto/libcurve25519-generic.ko
-  $(call AddDepends/crypto,+PACKAGE_kmod-crypto-kpp:kmod-crypto-kpp)
-endef
-
-define KernelPackage/crypto-lib-curve25519/config
-  imply PACKAGE_kmod-crypto-kpp
+  $(call AddDepends/crypto,+kmod-crypto-kpp)
 endef

 ifndef CONFIG_TARGET_uml
@ -661,11 +657,7 @@ define KernelPackage/crypto-lib-poly1305
  KCONFIG:=CONFIG_CRYPTO_LIB_POLY1305
  HIDDEN:=1
  FILES:=$(LINUX_DIR)/lib/crypto/libpoly1305.ko
-  $(call AddDepends/crypto,+PACKAGE_kmod-crypto-hash:kmod-crypto-hash)
-endef
-
-define KernelPackage/crypto-lib-poly1305/config
-  imply PACKAGE_kmod-crypto-hash
+  $(call AddDepends/crypto,+kmod-crypto-hash)
 endef

 ifndef CONFIG_TARGET_uml
--- a/package/kernel/linux/modules/hwmon.mk
+++ b/package/kernel/linux/modules/hwmon.mk
@ -493,6 +493,25 @@ endef
 $(eval $(call KernelPackage,pmbus-core))


+define KernelPackage/pmbus-sensors
+  TITLE:=Generic PMBus devices monitoring support
+  KCONFIG:=CONFIG_SENSORS_PMBUS
+  FILES:=$(LINUX_DIR)/drivers/hwmon/pmbus/pmbus.ko
+  AUTOLOAD:=$(call AutoProbe,pmbus)
+  $(call AddDepends/hwmon,+kmod-pmbus-core)
+endef
+
+define KernelPackage/pmbus-sensors/description
+ Kernel modules for generic PMBus devices,
+including but not limited to ADP4000, BMR310, BMR453,
+BMR454, BMR456, BMR457, BMR458, BMR480, BMR490, BMR491, BMR492,
+MAX20796, MDT040, NCP4200, NCP4208, PDT003, PDT006, PDT012,
+TPS40400, TPS544B20, TPS544B25, TPS544C20, TPS544C25, and UDT020.
+endef
+
+$(eval $(call KernelPackage,pmbus-sensors))
+
+
 define KernelPackage/pmbus-zl6100
  TITLE:=Intersil / Zilker Labs ZL6100 hardware monitoring
  KCONFIG:=CONFIG_SENSORS_ZL6100
--- a/package/kernel/linux/modules/netdevices.mk
+++ b/package/kernel/linux/modules/netdevices.mk
@ -621,6 +621,23 @@ endef

 $(eval $(call KernelPackage,phy-aquantia))

+
+define KernelPackage/phy-motorcomm
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Motorcomm Ethernet PHYs
+  DEPENDS:=+kmod-libphy
+  KCONFIG:=CONFIG_MOTORCOMM_PHY
+  FILES:=$(LINUX_DIR)/drivers/net/phy/motorcomm.ko
+  AUTOLOAD:=$(call AutoLoad,18,motorcomm,1)
+endef
+
+define KernelPackage/phy-motorcomm/description
+  Supports the Motorcomm 8511/8521/8531/8531S/8821 Ethernet PHYs
+endef
+
+$(eval $(call KernelPackage,phy-motorcomm))
+
+
 define KernelPackage/dsa
  SUBMENU:=$(NETWORK_DEVICES_MENU)
  TITLE:=Distributed Switch Architecture support
@ -1207,6 +1224,7 @@ define KernelPackage/r8169
    CONFIG_R8169_LEDS=y
  FILES:=$(LINUX_DIR)/drivers/net/ethernet/realtek/r8169.ko
  AUTOLOAD:=$(call AutoProbe,r8169,1)
+  DEFAULT_VARIANT:=1
 endef

 define KernelPackage/r8169/description
@ -2326,3 +2344,21 @@ define KernelPackage/enc28j60/description
 endef

 $(eval $(call KernelPackage,enc28j60))
+
+define KernelPackage/sparx5-switch
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Sparx5 switch driver
+  DEPENDS:=@TARGET_microchipsw +kmod-phylink +kmod-ptp
+  KCONFIG:= \
+  CONFIG_SPARX5_SWITCH \
+  CONFIG_LAN969X_SWITCH=y \
+  CONFIG_SPARX5_DCB=y
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/microchip/sparx5/sparx5-switch.ko
+  AUTOLOAD:=$(call AutoProbe,sparx5-switch,1)
+endef
+
+define KernelPackage/sparx5-switch/description
+  This driver supports the Sparx5 network switch device.
+endef
+
+$(eval $(call KernelPackage,sparx5-switch))
--- a/package/kernel/linux/modules/netsupport.mk
+++ b/package/kernel/linux/modules/netsupport.mk
@ -1654,3 +1654,68 @@ define KernelPackage/packet-diag
 endef

 $(eval $(call KernelPackage,packet-diag))
+
+define KernelPackage/team
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Ethernet team driver
+  KCONFIG:=CONFIG_NET_TEAM
+  FILES:=$(LINUX_DIR)/drivers/net/team/team.ko
+  AUTOLOAD:=$(call AutoProbe,team)
+endef
+
+$(eval $(call KernelPackage,team))
+
+define KernelPackage/team-mode-broadcast
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Broadcast mode support
+  DEPENDS:=kmod-team
+  KCONFIG:=CONFIG_NET_TEAM_MODE_BROADCAST
+  FILES:=$(LINUX_DIR)/drivers/net/team/team_mode_broadcast.ko
+  AUTOLOAD:=$(call AutoProbe,team_mode_broadcast)
+endef
+
+$(eval $(call KernelPackage,team-mode-broadcast))
+
+define KernelPackage/team-mode-roundrobin
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Round-robin mode support
+  DEPENDS:=kmod-team
+  KCONFIG:=CONFIG_NET_TEAM_MODE_ROUNDROBIN
+  FILES:=$(LINUX_DIR)/drivers/net/team/team_mode_roundrobin.ko
+  AUTOLOAD:=$(call AutoProbe,team_mode_roundrobin)
+endef
+
+$(eval $(call KernelPackage,team-mode-roundrobin))
+
+define KernelPackage/team-mode-random
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Random mode support
+  DEPENDS:=kmod-team
+  KCONFIG:=CONFIG_NET_TEAM_MODE_RANDOM
+  FILES:=$(LINUX_DIR)/drivers/net/team/team_mode_random.ko
+  AUTOLOAD:=$(call AutoProbe,team_mode_random)
+endef
+
+$(eval $(call KernelPackage,team-mode-random))
+
+define KernelPackage/team-mode-activebackup
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Active-backup mode support
+  DEPENDS:=kmod-team
+  KCONFIG:=CONFIG_NET_TEAM_MODE_ACTIVEBACKUP
+  FILES:=$(LINUX_DIR)/drivers/net/team/team_mode_activebackup.ko
+  AUTOLOAD:=$(call AutoProbe,team_mode_activebackup)
+endef
+
+$(eval $(call KernelPackage,team-mode-activebackup))
+
+define KernelPackage/team-mode-loadbalance
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Load-balance mode support
+  DEPENDS:=kmod-team
+  KCONFIG:=CONFIG_NET_TEAM_MODE_LOADBALANCE
+  FILES:=$(LINUX_DIR)/drivers/net/team/team_mode_loadbalance.ko
+  AUTOLOAD:=$(call AutoProbe,team_mode_loadbalance)
+endef
+
+$(eval $(call KernelPackage,team-mode-loadbalance))
--- a/package/kernel/linux/modules/other.mk
+++ b/package/kernel/linux/modules/other.mk
@ -990,7 +990,7 @@ $(eval $(call KernelPackage,tpm))
 define KernelPackage/tpm-tis
  SUBMENU:=$(OTHER_MENU)
  TITLE:=TPM TIS 1.2 Interface / TPM 2.0 FIFO Interface
-	DEPENDS:= @(TARGET_x86||TARGET_armsr) +kmod-tpm
+	DEPENDS:= @(TARGET_x86||TARGET_armsr||TARGET_imx) +kmod-tpm
  KCONFIG:= CONFIG_TCG_TIS
  FILES:= \
 	$(LINUX_DIR)/drivers/char/tpm/tpm_tis.ko \
@ -1007,6 +1007,27 @@ endef

 $(eval $(call KernelPackage,tpm-tis))

+define KernelPackage/tpm-tis-spi
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=TPM TIS 1.3 Interface SPI Interface
+	DEPENDS:= +kmod-tpm-tis +kmod-spi-dev
+  KCONFIG:= CONFIG_TCG_TIS_SPI \
+	CONFIG_TCG_TIS_SPI_CR50=n
+  FILES:= \
+	$(LINUX_DIR)/drivers/char/tpm/tpm_tis_spi.ko
+  AUTOLOAD:=$(call AutoLoad,20,tpm_tis_spi,1)
+endef
+
+define KernelPackage/tpm-tis-spi/description
+	If you have a TPM security chip which is connected to a regular,
+	non-tcg SPI master that is compliant with the
+	TCG TIS 1.3 TPM specification (TPM1.2) or the TCG PTP FIFO
+	specification (TPM2.0) say Yes and it will be accessible from
+	within Linux.
+endef
+
+$(eval $(call KernelPackage,tpm-tis-spi))
+
 define KernelPackage/tpm-i2c-atmel
  SUBMENU:=$(OTHER_MENU)
  TITLE:=TPM I2C Atmel Support
--- a/package/kernel/linux/modules/usb.mk
+++ b/package/kernel/linux/modules/usb.mk
@ -154,6 +154,24 @@ endef

 $(eval $(call KernelPackage,usb-gadget-hid))

+define KernelPackage/usb-gadget-fs
+  TITLE:=USB FunctionFS Gadget Support
+  KCONFIG:=CONFIG_USB_FUNCTIONFS \
+    CONFIG_USB_FUNCTIONFS_ETH=n \
+    CONFIG_USB_FUNCTIONFS_RNDIS=n
+  FILES:= \
+	  $(LINUX_DIR)/drivers/usb/gadget/legacy/g_ffs.ko \
+	  $(LINUX_DIR)/drivers/usb/gadget/function/usb_f_fs.ko
+  AUTOLOAD:=$(call AutoLoad,52,usb_f_fs)
+  $(call AddDepends/usbgadget,+kmod-usb-lib-composite +kmod-dma-buf)
+endef
+
+define KernelPackage/usb-gadget-fs/description
+  Kernel support for USB FunctionFS Gadget.
+endef
+
+$(eval $(call KernelPackage,usb-gadget-fs))
+
 define KernelPackage/usb-gadget-ehci-debug
  TITLE:=USB EHCI debug port Gadget support
  KCONFIG:=\
@ -1842,6 +1860,7 @@ define KernelPackage/usb3
  TITLE:=Support for USB3 controllers
  DEPENDS:= \
 	+kmod-usb-xhci-hcd \
+	+TARGET_airoha_an7581:kmod-usb-xhci-mtk \
 	+TARGET_bcm53xx:kmod-usb-bcma \
 	+TARGET_bcm53xx:kmod-phy-bcm-ns-usb3 \
 	+TARGET_ramips_mt7621:kmod-usb-xhci-mtk \
--- a/package/kernel/linux/modules/virt.mk
+++ b/package/kernel/linux/modules/virt.mk
@ -139,3 +139,59 @@ define KernelPackage/vhost-net
 endef

 $(eval $(call KernelPackage,vhost-net))
+
+
+define KernelPackage/vsock
+  SUBMENU:=Virtualization
+  TITLE:=Virtual Socket Protocol
+  KCONFIG:= \
+	CONFIG_VSOCKETS \
+	CONFIG_VSOCKETS_LOOPBACK=n \
+	CONFIG_HYPERV_VSOCKETS=n
+  FILES:=$(LINUX_DIR)/net/vmw_vsock/vsock.ko
+  AUTOLOAD:=$(call AutoProbe,vsock)
+endef
+
+define KernelPackage/vsock/description
+  Kernel support support for the Virtual Socket Protocol.
+  Often used when running in a VM to communicate with the hypervisor.
+  Additionally needs a hypervisor-specific transport driver.
+endef
+
+$(eval $(call KernelPackage,vsock))
+
+
+define KernelPackage/vsock-virtio-common
+  SUBMENU:=Virtualization
+  TITLE:=Module used by other drivers to access Virtio Virtual Sockets
+  DEPENDS:=+kmod-vsock
+  KCONFIG:=CONFIG_VIRTIO_VSOCKETS_COMMON
+  FILES:=$(LINUX_DIR)/net/vmw_vsock/vmw_vsock_virtio_transport_common.ko
+  AUTOLOAD:=$(call AutoProbe,vmw_vsock_virtio_transport_common)
+  HIDDEN:=1
+endef
+
+$(eval $(call KernelPackage,vsock-virtio-common))
+
+
+define KernelPackage/vsock-virtio
+  SUBMENU:=Virtualization
+  TITLE:=Virtio transport driver for Virtual Sockets
+  DEPENDS:= @VIRTIO_SUPPORT +kmod-vsock +kmod-vsock-virtio-common
+  KCONFIG:=CONFIG_VIRTIO_VSOCKETS
+  FILES:=$(LINUX_DIR)/net/vmw_vsock/vmw_vsock_virtio_transport.ko
+  AUTOLOAD:=$(call AutoProbe,vmw_vsock_virtio_transport)
+endef
+
+define KernelPackage/vsock-virtio/description
+  Kernel support for Virtual Sockets over virtio.
+  Enable this transport if you plan to run OpenWRT in a virtual machine and the
+  hypervisor supports Virtual Sockets over virtio (Incus for example).
+
+  Usually needed by "guest agents" to function, as it provides a communication
+  channel between the guest os and the hypervisor.
+
+  The module will be called vmw_vsock_virtio_transport.
+endef
+
+$(eval $(call KernelPackage,vsock-virtio))
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@ -10,13 +10,13 @@ include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=mac80211

-PKG_VERSION:=6.18
+PKG_VERSION:=6.18.26
 PKG_RELEASE:=1
 PKG_LICENSE:=GPL-2.0-only
 PKG_LICENSE_FILES:=COPYING

 PKG_SOURCE_URL:=https://github.com/openwrt/backports/releases/download/backports-v$(PKG_VERSION)
-PKG_HASH:=3bd5d84b1e56cf8addff0d1e4bcf06753c51feee88c4d7925fb7b67784529436
+PKG_HASH:=2ad578c6cae22f192fefd44e1449725228d4109ee781998b41dcbae872554968

 PKG_SOURCE:=backports-$(PKG_VERSION).tar.zst
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(if $(BUILD_VARIANT),$(PKG_NAME)-$(BUILD_VARIANT)/)backports-$(PKG_VERSION)
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@ -13,6 +13,7 @@ PKG_CONFIG_DEPENDS += \
 	CONFIG_ATH10K_LEDS \
 	CONFIG_ATH10K_THERMAL \
 	CONFIG_ATH11K_THERMAL \
+	CONFIG_ATH12K_THERMAL \
 	CONFIG_ATH_USER_REGD

 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
@ -59,6 +60,7 @@ config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
 config-$(CONFIG_ATH10K_LEDS) += ATH10K_LEDS
 config-$(CONFIG_ATH10K_THERMAL) += ATH10K_THERMAL
 config-$(CONFIG_ATH11K_THERMAL) += ATH11K_THERMAL
+config-$(CONFIG_ATH12K_THERMAL) += ATH12K_THERMAL

 config-$(call config_package,ath9k-htc) += ATH9K_HTC
 config-$(call config_package,ath10k,regular) += ATH10K ATH10K_PCI
@ -265,7 +267,7 @@ This module adds support for wireless adapters based on
 Atheros USB AR9271 and AR7010 family of chipsets.
 endef

-define KernelPackage/ath10k
+define KernelPackage/ath10k/Default
  $(call KernelPackage/mac80211/Default)
  TITLE:=Atheros 802.11ac wireless cards support
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath10k
@ -276,7 +278,12 @@ define KernelPackage/ath10k
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
  AUTOLOAD:=$(call AutoProbe,ath10k_core ath10k_pci)
  MODPARAMS.ath10k_core:=frame_mode=2
+endef
+
+define KernelPackage/ath10k
+  $(call KernelPackage/ath10k/Default)
  VARIANT:=regular
+  DEFAULT_VARIANT:=1
 endef

 define KernelPackage/ath10k/description
@ -299,9 +306,10 @@ define KernelPackage/ath10k/config
 endef

 define KernelPackage/ath10k-smallbuffers
-  $(call KernelPackage/ath10k)
+  $(call KernelPackage/ath10k/Default)
  TITLE+= (small buffers for low-RAM devices)
  VARIANT:=smallbuffers
+  PROVIDES:=@kmod-ath10k-any
 endef

 define KernelPackage/ath11k
@ -362,7 +370,8 @@ define KernelPackage/ath12k
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath12k
  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT \
  +kmod-crypto-michael-mic +kmod-qrtr-mhi \
-  +kmod-qcom-qmi-helpers +@DRIVER_11BE_SUPPORT
+  +kmod-qcom-qmi-helpers +@DRIVER_11BE_SUPPORT \
+  +ATH12K_THERMAL:kmod-hwmon-core +ATH12K_THERMAL:kmod-thermal
  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath12k/ath12k.ko
  AUTOLOAD:=$(call AutoProbe,ath12k)
 endef
@ -372,6 +381,14 @@ This module adds support for Qualcomm Technologies 802.11be family of
 chipsets with PCI bus.
 endef

+define KernelPackage/ath12k/config
+
+       config ATH12K_THERMAL
+               bool "Enable ath12k thermal sensor support"
+               depends on PACKAGE_kmod-ath12k
+
+endef
+
 define KernelPackage/carl9170
  $(call KernelPackage/mac80211/Default)
  TITLE:=Driver for Atheros AR9170 USB sticks
--- a/package/kernel/mac80211/broadcom.mk
+++ b/package/kernel/mac80211/broadcom.mk
@ -438,6 +438,7 @@ define KernelPackage/brcmfmac/config
 		default y if TARGET_rockchip
 		default y if TARGET_sunxi
 		default y if TARGET_stm32
+		default y if TARGET_x86
 		default n
 		help
 		  Enable support for cards attached to an SDIO bus.
--- a/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>

 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3586,6 +3586,16 @@ int ath10k_core_register(struct ath10k *
+@@ -3583,6 +3583,16 @@ int ath10k_core_register(struct ath10k *
 
 	queue_work(ar->workqueue, &ar->register_work);
 
--- a/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
+++ b/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
@ -28,7 +28,7 @@ Forwarded: no

 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -1052,6 +1052,40 @@ static inline int ath10k_vdev_delete_syn
+@@ -1051,6 +1051,40 @@ static inline int ath10k_vdev_delete_syn
 	return 0;
 }
 
@ -69,7 +69,7 @@ Forwarded: no
 static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
 {
 	struct cfg80211_chan_def *chandef = NULL;
-@@ -1084,7 +1118,8 @@ static int ath10k_monitor_vdev_start(str
+@@ -1083,7 +1117,8 @@ static int ath10k_monitor_vdev_start(str
 	arg.channel.min_power = 0;
 	arg.channel.max_power = channel->max_power * 2;
 	arg.channel.max_reg_power = channel->max_reg_power * 2;
@ -79,7 +79,7 @@ Forwarded: no
 
 	reinit_completion(&ar->vdev_setup_done);
 	reinit_completion(&ar->vdev_delete_done);
-@@ -1530,7 +1565,8 @@ static int ath10k_vdev_start_restart(str
+@@ -1529,7 +1564,8 @@ static int ath10k_vdev_start_restart(str
 	arg.channel.min_power = 0;
 	arg.channel.max_power = chandef->chan->max_power * 2;
 	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
@ -89,7 +89,7 @@ Forwarded: no
 
 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
 		arg.ssid = arvif->u.ap.ssid;
-@@ -3461,7 +3497,8 @@ static int ath10k_update_channel_list(st
+@@ -3460,7 +3496,8 @@ static int ath10k_update_channel_list(st
 			ch->min_power = 0;
 			ch->max_power = channel->max_power * 2;
 			ch->max_reg_power = channel->max_reg_power * 2;
--- a/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
+++ b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
@ -18,7 +18,7 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>

 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -11,6 +11,7 @@
+@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/firmware.h>
 #include <linux/of.h>
@ -26,7 +26,7 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 #include <linux/property.h>
 #include <linux/dmi.h>
 #include <linux/ctype.h>
-@@ -3458,6 +3459,8 @@ static int ath10k_core_probe_fw(struct a
+@@ -3455,6 +3456,8 @@ static int ath10k_core_probe_fw(struct a
 
 	device_get_mac_address(ar->dev, ar->mac_addr);
 
--- a/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch
+++ b/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch
@ -49,7 +49,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>

 --- a/drivers/net/wireless/ath/ath11k/mhi.c
 +++ b/drivers/net/wireless/ath/ath11k/mhi.c
-@@ -239,6 +239,34 @@ static void ath11k_mhi_op_runtime_put(st
+@@ -235,6 +235,34 @@ static void ath11k_mhi_op_runtime_put(st
 {
 }
 
@ -84,7 +84,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 static char *ath11k_mhi_op_callback_to_str(enum mhi_callback reason)
 {
 	switch (reason) {
-@@ -260,6 +288,8 @@ static char *ath11k_mhi_op_callback_to_s
+@@ -256,6 +284,8 @@ static char *ath11k_mhi_op_callback_to_s
 		return "MHI_CB_FATAL_ERROR";
 	case MHI_CB_BW_REQ:
 		return "MHI_CB_BW_REQ";
@ -93,7 +93,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 	default:
 		return "UNKNOWN";
 	}
-@@ -290,6 +320,9 @@ static void ath11k_mhi_op_status_cb(stru
+@@ -286,6 +316,9 @@ static void ath11k_mhi_op_status_cb(stru
 			queue_work(ab->workqueue_aux, &ab->reset_work);
 
 		break;
@ -103,7 +103,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 	default:
 		break;
 	}
-@@ -297,22 +330,6 @@ static void ath11k_mhi_op_status_cb(stru
+@@ -293,22 +326,6 @@ static void ath11k_mhi_op_status_cb(stru
 	ab_pci->mhi_pre_cb = cb;
 }
 
@ -140,7 +140,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 int ath11k_mhi_register(struct ath11k_pci *ar_pci);
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -376,13 +376,20 @@ static void ath11k_pci_sw_reset(struct a
+@@ -394,13 +394,20 @@ static void ath11k_pci_sw_reset(struct a
 static void ath11k_pci_init_qmi_ce_config(struct ath11k_base *ab)
 {
 	struct ath11k_qmi_ce_cfg *cfg = &ab->qmi.ce_cfg;
--- a/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
+++ b/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
@ -31,7 +31,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 	{
 		.hw_rev = ATH11K_HW_IPQ8074,
 		.name = "ipq8074 hw2.0",
-@@ -2521,7 +2521,8 @@ static void ath11k_core_reset(struct wor
+@@ -2576,7 +2576,8 @@ static void ath11k_core_reset(struct wor
 static int ath11k_init_hw_params(struct ath11k_base *ab)
 {
 	const struct ath11k_hw_params *hw_params = NULL;
@ -41,7 +41,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 
 	for (i = 0; i < ARRAY_SIZE(ath11k_hw_params); i++) {
 		hw_params = &ath11k_hw_params[i];
-@@ -2537,7 +2538,31 @@ static int ath11k_init_hw_params(struct
+@@ -2592,7 +2593,31 @@ static int ath11k_init_hw_params(struct
 
 	ab->hw_params = *hw_params;
 
--- a/package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch
+++ b/package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch
@ -291,9 +291,9 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 	int pdev_idx;
 	struct ath11k *ar;
 	enum wmi_vdev_type vdev_type;
-@@ -929,24 +772,14 @@ int ath11k_reg_handle_chan_list(struct a
- 		    (char *)reg_info->alpha2, 2))
- 		goto retfail;
+@@ -932,24 +775,14 @@ int ath11k_reg_handle_chan_list(struct a
+ 		return 0;
+ 	}
 
 -	/* Intersect new rules with default regd if a new country setting was
 -	 * requested, i.e a default regd was already set during initialization
--- a/package/kernel/mac80211/patches/ath11k/924-wifi-ath11k-add-multipd-support-for-QCN6122.patch
+++ b/package/kernel/mac80211/patches/ath11k/924-wifi-ath11k-add-multipd-support-for-QCN6122.patch
@ -99,7 +99,7 @@ Signed-off-by: George Moussalem <george.moussalem@outlook.com>
 	struct ath11k_targ_cap target_caps;
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -391,6 +391,8 @@ static void ath11k_pci_init_qmi_ce_confi
+@@ -409,6 +409,8 @@ static void ath11k_pci_init_qmi_ce_confi
 	} else
 		ab->qmi.service_ins_id = ab->hw_params.qmi_service_ins_id;
 
--- a/package/kernel/mac80211/patches/ath11k/932-wifi-ath11k-poll-reo-status-ipq5018.patch
+++ b/package/kernel/mac80211/patches/ath11k/932-wifi-ath11k-poll-reo-status-ipq5018.patch
@ -1,164 +0,0 @@
-From d890c6d602307c9297df12c7d0287f9ffd26208b Mon Sep 17 00:00:00 2001
-From: Sriram R <srirrama@codeaurora.org>
-Date: Wed, 12 May 2021 19:21:09 +0530
-Subject: [PATCH] ath11k: poll reo status ring for IPQ5018
-
-Currently reo status interrupts are not received
-due to wrong mapping of the reo status interrupt
-line in IPQ5018.
-
-Hence, until the mapping is resolved in HW, use
-polling to reap the reo status ring. Rather than
-a period timer to reap the ring, the timer is
-triggered only on sending a reo command with
-status request.
-
-Without proper reaping of the ring, backpressure
-and ring full issues are seen in multi client test
-setups which leads to flooding the console with
-error messages reporting failure to send reo cmds.
-
-Can be reverted once HW solution is available.
-
-Signed-off-by: Sriram R <srirrama@codeaurora.org>
---
--- a/drivers/net/wireless/ath/ath11k/core.c
-+++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -729,6 +729,7 @@ static struct ath11k_hw_params ath11k_hw
- 		.support_fw_mac_sequence = false,
- 		.support_dual_stations = false,
- 		.pdev_suspend = false,
-+		.reo_status_poll = true,
- 	},
- 	{
- 		.name = "qca2066 hw2.1",
--- a/drivers/net/wireless/ath/ath11k/dp.c
-+++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -350,12 +350,66 @@ void ath11k_dp_stop_shadow_timers(struct
- 	ath11k_dp_shadow_stop_timer(ab, &ab->dp.reo_cmd_timer);
- }
- 
-+static void ath11k_dp_handle_reo_status_timer(struct timer_list *timer)
-+{
-+	struct ath11k_dp *dp = from_timer(dp, timer, reo_status_timer);
-+	struct ath11k_base *ab = dp->ab;
-+
-+	spin_lock_bh(&dp->reo_cmd_lock);
-+	dp->reo_status_timer_running = false;
-+	spin_unlock_bh(&dp->reo_cmd_lock);
-+
-+	ath11k_dp_process_reo_status(ab);
-+}
-+
-+void ath11k_dp_start_reo_status_timer(struct ath11k_base *ab)
-+{
-+	struct ath11k_dp *dp = &ab->dp;
-+
-+	if (!ab->hw_params.reo_status_poll)
-+		return;
-+
-+	spin_lock_bh(&dp->reo_cmd_lock);
-+	if (dp->reo_status_timer_running) {
-+		spin_unlock_bh(&dp->reo_cmd_lock);
-+		return;
-+	}
-+	dp->reo_status_timer_running = true;
-+	spin_unlock_bh(&dp->reo_cmd_lock);
-+
-+	mod_timer(&dp->reo_status_timer, jiffies +
-+		  msecs_to_jiffies(ATH11K_REO_STATUS_POLL_TIMEOUT_MS));
-+}
-+
-+static void ath11k_dp_stop_reo_status_timer(struct ath11k_base *ab)
-+{
-+	struct ath11k_dp *dp = &ab->dp;
-+
-+	if (!ab->hw_params.reo_status_poll)
-+		return;
-+
-+	del_timer_sync(&dp->reo_status_timer);
-+	dp->reo_status_timer_running = false;
-+}
-+
-+static void ath11k_dp_init_reo_status_timer(struct ath11k_base *ab)
-+{
-+	struct ath11k_dp *dp = &ab->dp;
-+
-+	if (!ab->hw_params.reo_status_poll)
-+		return;
-+
-+	timer_setup(&dp->reo_status_timer,
-+		    ath11k_dp_handle_reo_status_timer, 0);
-+}
-+
- static void ath11k_dp_srng_common_cleanup(struct ath11k_base *ab)
- {
- 	struct ath11k_dp *dp = &ab->dp;
- 	int i;
- 
- 	ath11k_dp_stop_shadow_timers(ab);
-+	ath11k_dp_stop_reo_status_timer(ab);
- 	ath11k_dp_srng_cleanup(ab, &dp->wbm_desc_rel_ring);
- 	ath11k_dp_srng_cleanup(ab, &dp->tcl_cmd_ring);
- 	ath11k_dp_srng_cleanup(ab, &dp->tcl_status_ring);
-@@ -377,6 +431,8 @@ static int ath11k_dp_srng_common_setup(s
- 	int i, ret;
- 	u8 tcl_num, wbm_num;
- 
-+	ath11k_dp_init_reo_status_timer(ab);
-+
- 	ret = ath11k_dp_srng_setup(ab, &dp->wbm_desc_rel_ring,
- 				   HAL_SW2WBM_RELEASE, 0, 0,
- 				   DP_WBM_RELEASE_RING_SIZE);
--- a/drivers/net/wireless/ath/ath11k/dp.h
-+++ b/drivers/net/wireless/ath/ath11k/dp.h
-@@ -46,6 +46,8 @@ struct dp_rx_tid {
- #define DP_MON_PURGE_TIMEOUT_MS     100
- #define DP_MON_SERVICE_BUDGET       128
- 
-+#define ATH11K_REO_STATUS_POLL_TIMEOUT_MS 10
-+
- struct dp_reo_cache_flush_elem {
- 	struct list_head list;
- 	struct dp_rx_tid data;
-@@ -287,6 +289,10 @@ struct ath11k_dp {
- 	spinlock_t reo_cmd_lock;
- 	struct ath11k_hp_update_timer reo_cmd_timer;
- 	struct ath11k_hp_update_timer tx_ring_timer[DP_TCL_NUM_RING_MAX];
-+
-+	/* reo status timer and flags */
-+	struct timer_list reo_status_timer;
-+	bool reo_status_timer_running;
- };
- 
- /* HTT definitions */
-@@ -1690,5 +1696,6 @@ void ath11k_dp_shadow_init_timer(struct
- 				 struct ath11k_hp_update_timer *update_timer,
- 				 u32 interval, u32 ring_id);
- void ath11k_dp_stop_shadow_timers(struct ath11k_base *ab);
-+void ath11k_dp_start_reo_status_timer(struct ath11k_base *ab);
- 
- #endif
--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -788,6 +788,10 @@ int ath11k_dp_tx_send_reo_cmd(struct ath
- 	if (cmd_num == 0)
- 		return -EINVAL;
- 
-+	/* Trigger reo status polling if required */
-+	if (cmd->flag & HAL_REO_CMD_FLG_NEED_STATUS)
-+		ath11k_dp_start_reo_status_timer(ab);
-+
- 	if (!cb)
- 		return 0;
- 
--- a/drivers/net/wireless/ath/ath11k/hw.h
-+++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -233,6 +233,7 @@ struct ath11k_hw_params {
- 	bool support_fw_mac_sequence;
- 	bool support_dual_stations;
- 	bool pdev_suspend;
-+	bool reo_status_poll;
- };
- 
- struct ath11k_hw_ops {
--- a/package/kernel/mac80211/patches/ath11k/948-wifi-ath11k-Fix-the-WMM-param-type.patch
+++ b/package/kernel/mac80211/patches/ath11k/948-wifi-ath11k-Fix-the-WMM-param-type.patch
@ -0,0 +1,24 @@
+From c420c1f66235b5ab4fc8d94da72bd5ae6397117f Mon Sep 17 00:00:00 2001
+From: Gautham Kumar Senthilkumaran <gauthamk@qti.qualcomm.com>
+Date: Mon, 19 Jan 2026 11:55:51 +0100
+Subject: [PATCH] wifi: ath11k: Fix the WMM param type
+
+Since FW does not support the 11ax EDCA parameter in WMI TLV command.
+FW was crashing as host was sending this parameter, now changed the
+WMM parameter type as default zero before sending to FW.
+
+Fixes: b78c02f7c710 ("wifi: ath11k: add support for MU EDCA")
+Signed-off-by: Gautham Kumar Senthilkumaran <gauthamk@qti.qualcomm.com>
+Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -2688,7 +2688,7 @@ int ath11k_wmi_send_wmm_update_cmd_tlv(s
+ 			  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
+ 
+ 	cmd->vdev_id = vdev_id;
+-	cmd->wmm_param_type = wmm_param_type;
+	cmd->wmm_param_type = WMI_WMM_PARAM_TYPE_LEGACY;
+ 
+ 	for (ac = 0; ac < WME_NUM_AC; ac++) {
+ 		switch (ac) {
--- a/package/kernel/mac80211/patches/ath12k/001-v7.1-wifi-ath12k-add-basic-hwmon-temperature-reporting.patch
+++ b/package/kernel/mac80211/patches/ath12k/001-v7.1-wifi-ath12k-add-basic-hwmon-temperature-reporting.patch
@ -0,0 +1,380 @@
+From 151322bccdbdb132f5a73cc8ad5d3ab89b90ed52 Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Date: Mon, 23 Feb 2026 18:56:22 +0530
+Subject: wifi: ath12k: add basic hwmon temperature reporting
+
+Add initial thermal support by wiring up a per-radio (pdev) hwmon temperature
+sensor backed by the existing WMI pdev temperature command and event.
+When userspace reads the sysfs file temp1_input, the driver sends
+WMI_PDEV_GET_TEMPERATURE_CMDID (tag WMI_TAG_PDEV_GET_TEMPERATURE_CMD) and waits
+for the corresponding WMI_PDEV_TEMPERATURE_EVENTID
+(tag WMI_TAG_PDEV_TEMPERATURE_EVENT) to get the temperature and pdev_id.
+
+Export the reported value in millidegrees Celsius as required by hwmon.
+The temperature reported is per-radio (pdev). In a multi-radio wiphy under a
+single phy, a separate hwmon device is created for each radio.
+
+Sample command and output:
+$ cat /sys/devices/pci0000:00/.../ieee80211/phyX/hwmonY/temp1_input
+$ 50000
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
+
+Co-developed-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
+Signed-off-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
+Signed-off-by: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260223132622.43464-1-maharaja.kennadyrajan@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+---
+ drivers/net/wireless/ath/ath12k/Makefile  |   1 +
+ drivers/net/wireless/ath/ath12k/core.c    |  13 ++++
+ drivers/net/wireless/ath/ath12k/core.h    |   3 +
+ drivers/net/wireless/ath/ath12k/mac.c     |   4 +
+ drivers/net/wireless/ath/ath12k/thermal.c | 124 ++++++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath12k/thermal.h |  40 ++++++++++
+ drivers/net/wireless/ath/ath12k/wmi.c     |  57 +++++++-------
+ 7 files changed, 211 insertions(+), 31 deletions(-)
+ create mode 100644 drivers/net/wireless/ath/ath12k/thermal.c
+ create mode 100644 drivers/net/wireless/ath/ath12k/thermal.h
+
+--- a/drivers/net/wireless/ath/ath12k/core.c
+++ b/drivers/net/wireless/ath/ath12k/core.c
+@@ -857,11 +857,22 @@ static int ath12k_core_pdev_create(struc
+ 		return ret;
+ 	}
+ 
+	ret = ath12k_thermal_register(ab);
+	if (ret) {
+		ath12k_err(ab, "could not register thermal device: %d\n", ret);
+		goto err_dp_pdev_free;
+	}
+
+ 	return 0;
+
+err_dp_pdev_free:
+	ath12k_dp_pdev_free(ab);
+	return ret;
+ }
+ 
+ static void ath12k_core_pdev_destroy(struct ath12k_base *ab)
+ {
+	ath12k_thermal_unregister(ab);
+ 	ath12k_dp_pdev_free(ab);
+ }
+ 
+@@ -1350,6 +1361,7 @@ static int ath12k_core_reconfigure_on_cr
+ 	int ret, total_vdev;
+ 
+ 	mutex_lock(&ab->core_lock);
+	ath12k_thermal_unregister(ab);
+ 	ath12k_dp_pdev_free(ab);
+ 	ath12k_ce_cleanup_pipes(ab);
+ 	ath12k_wmi_detach(ab);
+@@ -1491,6 +1503,7 @@ static void ath12k_core_pre_reconfigure_
+ 			complete(&ar->vdev_delete_done);
+ 			complete(&ar->bss_survey_done);
+ 			complete_all(&ar->regd_update_completed);
+			complete_all(&ar->thermal.wmi_sync);
+ 
+ 			wake_up(&ar->dp.tx_empty_waitq);
+ 			idr_for_each(&ar->txmgmt_idr,
+--- a/drivers/net/wireless/ath/ath12k/core.h
+++ b/drivers/net/wireless/ath/ath12k/core.h
+@@ -34,6 +34,7 @@
+ #include "wow.h"
+ #include "debugfs_htt_stats.h"
+ #include "coredump.h"
+#include "thermal.h"
+ 
+ #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
+ 
+@@ -846,6 +847,8 @@ struct ath12k {
+ 
+ 	s8 max_allowed_tx_power;
+ 	struct ath12k_pdev_rssi_offsets rssi_info;
+
+	struct ath12k_thermal thermal;
+ };
+ 
+ struct ath12k_hw {
+--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
+@@ -14063,6 +14063,10 @@ static void ath12k_mac_setup(struct ath1
+ 	init_completion(&ar->mlo_setup_done);
+ 	init_completion(&ar->completed_11d_scan);
+ 	init_completion(&ar->regd_update_completed);
+	init_completion(&ar->thermal.wmi_sync);
+
+	ar->thermal.temperature = 0;
+	ar->thermal.hwmon_dev = NULL;
+ 
+ 	INIT_DELAYED_WORK(&ar->scan.timeout, ath12k_scan_timeout_work);
+ 	wiphy_work_init(&ar->scan.vdev_clean_wk, ath12k_scan_vdev_clean_work);
+--- a/drivers/net/wireless/ath/ath12k/Makefile
+++ b/drivers/net/wireless/ath/ath12k/Makefile
+@@ -30,6 +30,7 @@ ath12k-$(CPTCFG_ATH12K_TRACING) += trace
+ ath12k-$(CONFIG_PM) += wow.o
+ ath12k-$(CPTCFG_ATH12K_COREDUMP) += coredump.o
+ ath12k-$(CPTCFG_NL80211_TESTMODE) += testmode.o
+ath12k-$(CONFIG_THERMAL) += thermal.o
+ 
+ # for tracing framework to find trace.h
+ CFLAGS_trace.o := -I$(src)
+--- /dev/null
+++ b/drivers/net/wireless/ath/ath12k/thermal.c
+@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: BSD-3-Clause-Clear
+/*
+ * Copyright (c) 2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+#include <linux/device.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/sysfs.h>
+#include <linux/thermal.h>
+#include "core.h"
+#include "debug.h"
+
+static ssize_t ath12k_thermal_temp_show(struct device *dev,
+					struct device_attribute *attr,
+					char *buf)
+{
+	struct ath12k *ar = dev_get_drvdata(dev);
+	unsigned long time_left;
+	int ret, temperature;
+
+	guard(wiphy)(ath12k_ar_to_hw(ar)->wiphy);
+
+	if (ar->ah->state != ATH12K_HW_STATE_ON)
+		return -ENETDOWN;
+
+	reinit_completion(&ar->thermal.wmi_sync);
+	ret = ath12k_wmi_send_pdev_temperature_cmd(ar);
+	if (ret) {
+		ath12k_warn(ar->ab, "failed to read temperature %d\n", ret);
+		return ret;
+	}
+
+	if (test_bit(ATH12K_FLAG_CRASH_FLUSH, &ar->ab->dev_flags))
+		return -ESHUTDOWN;
+
+	time_left = wait_for_completion_timeout(&ar->thermal.wmi_sync,
+						ATH12K_THERMAL_SYNC_TIMEOUT_HZ);
+	if (!time_left) {
+		ath12k_warn(ar->ab, "failed to synchronize thermal read\n");
+		return -ETIMEDOUT;
+	}
+
+	spin_lock_bh(&ar->data_lock);
+	temperature = ar->thermal.temperature;
+	spin_unlock_bh(&ar->data_lock);
+
+	/* display in millidegree celsius */
+	return sysfs_emit(buf, "%d\n", temperature * 1000);
+}
+
+void ath12k_thermal_event_temperature(struct ath12k *ar, int temperature)
+{
+	spin_lock_bh(&ar->data_lock);
+	ar->thermal.temperature = temperature;
+	spin_unlock_bh(&ar->data_lock);
+	complete_all(&ar->thermal.wmi_sync);
+}
+
+static SENSOR_DEVICE_ATTR_RO(temp1_input, ath12k_thermal_temp, 0);
+
+static struct attribute *ath12k_hwmon_attrs[] = {
+	&sensor_dev_attr_temp1_input.dev_attr.attr,
+	NULL,
+};
+ATTRIBUTE_GROUPS(ath12k_hwmon);
+
+int ath12k_thermal_register(struct ath12k_base *ab)
+{
+	struct ath12k *ar;
+	int i, j, ret;
+
+	if (!IS_REACHABLE(CONFIG_HWMON))
+		return 0;
+
+	for (i = 0; i < ab->num_radios; i++) {
+		ar = ab->pdevs[i].ar;
+		if (!ar)
+			continue;
+
+		ar->thermal.hwmon_dev =
+			hwmon_device_register_with_groups(&ar->ah->hw->wiphy->dev,
+							  "ath12k_hwmon", ar,
+							  ath12k_hwmon_groups);
+		if (IS_ERR(ar->thermal.hwmon_dev)) {
+			ret = PTR_ERR(ar->thermal.hwmon_dev);
+			ar->thermal.hwmon_dev = NULL;
+			ath12k_err(ar->ab, "failed to register hwmon device: %d\n",
+				   ret);
+			for (j = i - 1; j >= 0; j--) {
+				ar = ab->pdevs[j].ar;
+				if (!ar)
+					continue;
+
+				hwmon_device_unregister(ar->thermal.hwmon_dev);
+				ar->thermal.hwmon_dev = NULL;
+			}
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+void ath12k_thermal_unregister(struct ath12k_base *ab)
+{
+	struct ath12k *ar;
+	int i;
+
+	if (!IS_REACHABLE(CONFIG_HWMON))
+		return;
+
+	for (i = 0; i < ab->num_radios; i++) {
+		ar = ab->pdevs[i].ar;
+		if (!ar)
+			continue;
+
+		if (ar->thermal.hwmon_dev) {
+			hwmon_device_unregister(ar->thermal.hwmon_dev);
+			ar->thermal.hwmon_dev = NULL;
+		}
+	}
+}
+--- /dev/null
+++ b/drivers/net/wireless/ath/ath12k/thermal.h
+@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: BSD-3-Clause-Clear */
+/*
+ * Copyright (c) 2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+#ifndef _ATH12K_THERMAL_
+#define _ATH12K_THERMAL_
+
+#define ATH12K_THERMAL_SYNC_TIMEOUT_HZ (5 * HZ)
+
+struct ath12k_thermal {
+	struct completion wmi_sync;
+
+	/* temperature value in Celsius degree protected by data_lock. */
+	int temperature;
+	struct device *hwmon_dev;
+};
+
+#if IS_REACHABLE(CONFIG_THERMAL)
+int ath12k_thermal_register(struct ath12k_base *ab);
+void ath12k_thermal_unregister(struct ath12k_base *ab);
+void ath12k_thermal_event_temperature(struct ath12k *ar, int temperature);
+#else
+static inline int ath12k_thermal_register(struct ath12k_base *ab)
+{
+	return 0;
+}
+
+static inline void ath12k_thermal_unregister(struct ath12k_base *ab)
+{
+}
+
+static inline void ath12k_thermal_event_temperature(struct ath12k *ar,
+						    int temperature)
+{
+}
+
+#endif
+#endif /* _ATH12K_THERMAL_ */
+--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
+@@ -6673,31 +6673,6 @@ static int ath12k_pull_peer_assoc_conf_e
+ 	return 0;
+ }
+ 
+-static int
+-ath12k_pull_pdev_temp_ev(struct ath12k_base *ab, struct sk_buff *skb,
+-			 const struct wmi_pdev_temperature_event *ev)
+-{
+-	const void **tb;
+-	int ret;
+-
+-	tb = ath12k_wmi_tlv_parse_alloc(ab, skb, GFP_ATOMIC);
+-	if (IS_ERR(tb)) {
+-		ret = PTR_ERR(tb);
+-		ath12k_warn(ab, "failed to parse tlv: %d\n", ret);
+-		return ret;
+-	}
+-
+-	ev = tb[WMI_TAG_PDEV_TEMPERATURE_EVENT];
+-	if (!ev) {
+-		ath12k_warn(ab, "failed to fetch pdev temp ev");
+-		kfree(tb);
+-		return -EPROTO;
+-	}
+-
+-	kfree(tb);
+-	return 0;
+-}
+-
+ static void ath12k_wmi_op_ep_tx_credits(struct ath12k_base *ab)
+ {
+ 	/* try to send pending beacons first. they take priority */
+@@ -8712,25 +8687,45 @@ static void
+ ath12k_wmi_pdev_temperature_event(struct ath12k_base *ab,
+ 				  struct sk_buff *skb)
+ {
+	const struct wmi_pdev_temperature_event *ev;
+ 	struct ath12k *ar;
+-	struct wmi_pdev_temperature_event ev = {};
+	const void **tb;
+	int temp;
+	u32 pdev_id;
+ 
+-	if (ath12k_pull_pdev_temp_ev(ab, skb, &ev) != 0) {
+-		ath12k_warn(ab, "failed to extract pdev temperature event");
+	tb = ath12k_wmi_tlv_parse_alloc(ab, skb, GFP_ATOMIC);
+	if (IS_ERR(tb)) {
+		ath12k_warn(ab, "failed to parse tlv: %ld\n", PTR_ERR(tb));
+ 		return;
+ 	}
+ 
+	ev = tb[WMI_TAG_PDEV_TEMPERATURE_EVENT];
+	if (!ev) {
+		ath12k_warn(ab, "failed to fetch pdev temp ev\n");
+		kfree(tb);
+		return;
+	}
+
+	temp = a_sle32_to_cpu(ev->temp);
+	pdev_id = le32_to_cpu(ev->pdev_id);
+
+	kfree(tb);
+
+ 	ath12k_dbg(ab, ATH12K_DBG_WMI,
+-		   "pdev temperature ev temp %d pdev_id %d\n", ev.temp, ev.pdev_id);
+		   "pdev temperature ev temp %d pdev_id %u\n",
+		   temp, pdev_id);
+ 
+ 	rcu_read_lock();
+ 
+-	ar = ath12k_mac_get_ar_by_pdev_id(ab, le32_to_cpu(ev.pdev_id));
+	ar = ath12k_mac_get_ar_by_pdev_id(ab, pdev_id);
+ 	if (!ar) {
+-		ath12k_warn(ab, "invalid pdev id in pdev temperature ev %d", ev.pdev_id);
+		ath12k_warn(ab, "invalid pdev id %u in pdev temperature ev\n",
+			    pdev_id);
+ 		goto exit;
+ 	}
+ 
+	ath12k_thermal_event_temperature(ar, temp);
+
+ exit:
+ 	rcu_read_unlock();
+ }
--- a/package/kernel/mac80211/patches/ath12k/100-ath12k-prevent-ltssm-startup-crash.patch
+++ b/package/kernel/mac80211/patches/ath12k/100-ath12k-prevent-ltssm-startup-crash.patch
@ -5,7 +5,7 @@ But have issues on BPI-Rx boards.

 --- a/drivers/net/wireless/ath/ath12k/pci.c
 +++ b/drivers/net/wireless/ath/ath12k/pci.c
-@@ -279,6 +279,9 @@ static void ath12k_pci_enable_ltssm(stru
+@@ -297,6 +297,9 @@ static void ath12k_pci_enable_ltssm(stru
 	u32 val;
 	int i;
 
--- a/package/kernel/mac80211/patches/ath12k/102-wifi-ath12k-limit-WMI_SCAN_CHAN_LIST_CMDID-arg.patch
+++ b/package/kernel/mac80211/patches/ath12k/102-wifi-ath12k-limit-WMI_SCAN_CHAN_LIST_CMDID-arg.patch
@ -130,7 +130,7 @@ Best regards,

 --- a/drivers/net/wireless/ath/ath12k/wmi.c
 +++ b/drivers/net/wireless/ath/ath12k/wmi.c
-@@ -2891,6 +2891,9 @@ int ath12k_wmi_send_scan_chan_list_cmd(s
+@@ -2900,6 +2900,9 @@ int ath12k_wmi_send_scan_chan_list_cmd(s
 		max_chan_limit = (wmi->wmi_ab->max_msg_len[ar->pdev_idx] - len) /
 			sizeof(*chan_info);
 
--- a/Show More
+++ b/Show More