Merge Official Source

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2026-06-29 13:33:20 +08:00
parent fd28cb248b a6ecb09985
commit 1e920a0024
556 changed files with 13323 additions and 38656 deletions
@@ -201,27 +201,6 @@ $(eval $(call nf_add,NF_NATHELPER,CONFIG_NF_CONNTRACK_FTP, $(P_XT)nf_conntrack_f
 $(eval $(call nf_add,NF_NATHELPER,CONFIG_NF_NAT_FTP, $(P_XT)nf_nat_ftp))


-# nathelper-extra
-
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_BROADCAST, $(P_XT)nf_conntrack_broadcast))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_NETBIOS_NS, $(P_XT)nf_conntrack_netbios_ns))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_SANE, $(P_XT)nf_conntrack_sane))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_AMANDA, $(P_XT)nf_conntrack_amanda))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_AMANDA, $(P_XT)nf_nat_amanda))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_H323, $(P_XT)nf_conntrack_h323))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_H323, $(P_V4)nf_nat_h323))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_PPTP, $(P_XT)nf_conntrack_pptp))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_PPTP, $(P_V4)nf_nat_pptp))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_SIP, $(P_XT)nf_conntrack_sip))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_SIP, $(P_XT)nf_nat_sip))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_SNMP, $(P_XT)nf_conntrack_snmp))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_SNMP_BASIC, $(P_V4)nf_nat_snmp_basic))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_TFTP, $(P_XT)nf_conntrack_tftp))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_TFTP, $(P_XT)nf_nat_tftp))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_IRC, $(P_XT)nf_conntrack_irc))
-$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_IRC, $(P_XT)nf_nat_irc))
-
-
 # nflog

 $(eval $(call nf_add,IPT_NFLOG,CONFIG_NETFILTER_XT_TARGET_NFLOG, $(P_XT)xt_NFLOG))
@@ -375,7 +354,6 @@ IPT_BUILTIN += $(IPT_NAT-y)
 IPT_BUILTIN += $(IPT_NAT6-y)
 IPT_BUILTIN += $(IPT_NAT_EXTRA-y)
 IPT_BUILTIN += $(NF_NATHELPER-y)
-IPT_BUILTIN += $(NF_NATHELPER_EXTRA-y)
 IPT_BUILTIN += $(IPT_TPROXY-y)
 IPT_BUILTIN += $(NFNETLINK-y)
 IPT_BUILTIN += $(NFNETLINK_LOG-y)
@@ -35,7 +35,8 @@ $(eval $(call SetupHostCommand,gcc, \
 	Please install the GNU C Compiler (gcc) 10 or later, \
 	$(CC) -dumpversion | grep -E '^(1[0-9]|[2-9][0-9])\.?', \
 	gcc -dumpversion | grep -E '^(1[0-9]|[2-9][0-9])\.?', \
-	gcc --version | grep -E 'Apple.(LLVM|clang)' ))
+	clang -dumpversion | grep -E '^(1[2-9]|[2-9][0-9])\.', \
+	clang-12 -dumpversion | grep -E '^(1[2-9]|[2-9][0-9])\.' ))

 $(eval $(call TestHostCommand,working-gcc, \
 	Please reinstall the GNU C Compiler (10 or later) - \
@@ -47,7 +48,8 @@ $(eval $(call SetupHostCommand,g++, \
 	Please install the GNU C++ Compiler (g++) 10 or later, \
 	$(CXX) -dumpversion | grep -E '^(1[0-9]|[2-9][0-9])\.?', \
 	g++ -dumpversion | grep -E '^(1[0-9]|[2-9][0-9])\.?', \
-	g++ --version | grep -E 'Apple.(LLVM|clang)' ))
+	clang++ -dumpversion | grep -E '^(1[2-9]|[2-9][0-9])\.', \
+	clang++-12 -dumpversion | grep -E '^(1[2-9]|[2-9][0-9])\.' ))

 $(eval $(call TestHostCommand,working-g++, \
 	Please reinstall the GNU C++ Compiler (10 or later) - \
@@ -185,6 +187,7 @@ $(eval $(call SetupHostCommand,perl,Please install Perl 5.x, \
 	perl --version | grep "perl.*v5"))

 $(eval $(call SetupHostCommand,python,Please install Python >= 3.8, \
+	python3.14 -V 2>&1 | grep 'Python 3', \
 	python3.13 -V 2>&1 | grep 'Python 3', \
 	python3.12 -V 2>&1 | grep 'Python 3', \
 	python3.11 -V 2>&1 | grep 'Python 3', \
@@ -194,6 +197,7 @@ $(eval $(call SetupHostCommand,python,Please install Python >= 3.8, \
 	python3 -V 2>&1 | grep -E 'Python 3\.([8-9]|[0-9][0-9])\.?'))

 $(eval $(call SetupHostCommand,python3,Please install Python >= 3.8, \
+	python3.14 -V 2>&1 | grep 'Python 3', \
 	python3.13 -V 2>&1 | grep 'Python 3', \
 	python3.12 -V 2>&1 | grep 'Python 3', \
 	python3.11 -V 2>&1 | grep 'Python 3', \
@@ -29,6 +29,7 @@ endif
 ifdef UBOOT_USE_INTREE_DTC
  $(eval $(call TestHostCommand,python3-dev, \
    Please install the python3-dev package, \
+    python3.14-config --includes 2>&1 | grep 'python3', \
    python3.13-config --includes 2>&1 | grep 'python3', \
    python3.12-config --includes 2>&1 | grep 'python3', \
    python3.11-config --includes 2>&1 | grep 'python3', \
@@ -43,7 +43,8 @@ define Package/base-files
 	+netifd +libc +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring \
 	+NAND_SUPPORT:ubi-utils +fstools +fwtool \
 	+SELINUX:procd-selinux +!SELINUX:procd +USE_SECCOMP:procd-seccomp \
-	+SELINUX:busybox-selinux +!SELINUX:busybox
+	+SELINUX:busybox-selinux +!SELINUX:busybox \
+	+ucode +ucode-mod-fs +ucode-mod-digest
  TITLE:=Base filesystem for OpenWrt
  URL:=https://openwrt.org/
  VERSION:=$(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION)))
@@ -1,8 +1,10 @@
 [ "$(uci -q get network.globals.dhcp_default_duid || echo "auto")" != "auto" ] && exit 0

+duid="$(/usr/libexec/duid-generate)"
+[ -n "$duid" ] || exit 1
+
 uci -q batch <<-EOF >/dev/null
-	# DUID-UUID - RFC6355
-	set network.globals.dhcp_default_duid="$(printf '%s%s' '0004' $(cat /proc/sys/kernel/random/uuid | sed -e 's/-//g'))"
+	set network.globals.dhcp_default_duid="$duid"
 	commit network
 EOF

@@ -7,8 +7,9 @@
 CI_KERNPART="${CI_KERNPART:-kernel}"

 # 'ubi' partition on NAND contains UBI
-# There are also CI_KERN_UBIPART and CI_ROOT_UBIPART if kernel
-# and rootfs are on separated UBIs.
+# If individual UBI volumes are on different partitions,
+# they can be set with CI_KERN_UBIPART, CI_ROOT_UBIPART and/or
+# CI_DATA_UBIPART.
 CI_UBIPART="${CI_UBIPART:-ubi}"

 # 'rootfs' UBI volume on NAND contains the rootfs
@@ -77,9 +78,10 @@ identify_if_gzip() {
 }

 nand_restore_config() {
-	local ubidev=$( nand_find_ubi "${CI_ROOT_UBIPART:-$CI_UBIPART}" )
+	local ubidev=$( nand_find_ubi "${CI_DATA_UBIPART:-$CI_UBIPART}" )
 	local ubivol="$( nand_find_volume $ubidev rootfs_data )"
 	if [ ! "$ubivol" ]; then
+		local ubidev=$( nand_find_ubi "${CI_ROOT_UBIPART:-$CI_UBIPART}" )
 		ubivol="$( nand_find_volume $ubidev "$CI_ROOTPART" )"
 		if [ ! "$ubivol" ]; then
 			echo "cannot find ubifs data volume"
@@ -188,23 +190,21 @@ nand_upgrade_prepare_ubi() {
 	local has_env="${4:-0}"
 	local kern_ubidev
 	local root_ubidev
+	local data_ubidev

 	[ -n "$rootfs_length" -o -n "$kernel_length" ] || return 1

-	if [ -n "$CI_KERN_UBIPART" -a -n "$CI_ROOT_UBIPART" ]; then
-		kern_ubidev="$( nand_attach_ubi "$CI_KERN_UBIPART" "$has_env" )"
-		[ -n "$kern_ubidev" ] || return 1
-		root_ubidev="$( nand_attach_ubi "$CI_ROOT_UBIPART" )"
-		[ -n "$root_ubidev" ] || return 1
-	else
-		kern_ubidev="$( nand_attach_ubi "$CI_UBIPART" "$has_env" )"
-		[ -n "$kern_ubidev" ] || return 1
-		root_ubidev="$kern_ubidev"
-	fi
+	# Attach UBI partitions (might be identical, but nand_attach_ubi handles that)
+	kern_ubidev="$( nand_attach_ubi "${CI_KERN_UBIPART:-$CI_UBIPART}" "$has_env" )"
+	[ -n "$kern_ubidev" ] || return 1
+	root_ubidev="$( nand_attach_ubi "${CI_ROOT_UBIPART:-$CI_UBIPART}" )"
+	[ -n "$root_ubidev" ] || return 1
+	data_ubidev="$( nand_attach_ubi "${CI_DATA_UBIPART:-$CI_UBIPART}" )"
+	[ -n "$data_ubidev" ] || return 1

 	local kern_ubivol="$( nand_find_volume $kern_ubidev "$CI_KERNPART" )"
 	local root_ubivol="$( nand_find_volume $root_ubidev "$CI_ROOTPART" )"
-	local data_ubivol="$( nand_find_volume $root_ubidev rootfs_data )"
+	local data_ubivol="$( nand_find_volume $data_ubidev rootfs_data )"
 	[ "$root_ubivol" = "$kern_ubivol" ] && root_ubivol=

 	# remove ubiblocks
@@ -215,7 +215,7 @@ nand_upgrade_prepare_ubi() {
 	# kill volumes
 	[ "$kern_ubivol" ] && ubirmvol /dev/$kern_ubidev -N "$CI_KERNPART" || :
 	[ "$root_ubivol" ] && ubirmvol /dev/$root_ubidev -N "$CI_ROOTPART" || :
-	[ "$data_ubivol" ] && ubirmvol /dev/$root_ubidev -N rootfs_data || :
+	[ "$data_ubivol" ] && ubirmvol /dev/$data_ubidev -N rootfs_data || :

 	# create provisioning vol
 	if [ "${UPGRADE_OPT_ADD_PROVISIONING:-0}" -gt 0 ]; then
@@ -255,8 +255,8 @@ nand_upgrade_prepare_ubi() {
 		if [ -n "$rootfs_data_max" ]; then
 			rootfs_data_size_param="-s $rootfs_data_max"
 		fi
-		if ! ubimkvol /dev/$root_ubidev -N rootfs_data $rootfs_data_size_param; then
-			if ! ubimkvol /dev/$root_ubidev -N rootfs_data -m; then
+		if ! ubimkvol /dev/$data_ubidev -N rootfs_data $rootfs_data_size_param; then
+			if ! ubimkvol /dev/$data_ubidev -N rootfs_data -m; then
 				echo "cannot initialize rootfs_data volume"
 				return 1
 			fi
@@ -288,8 +288,8 @@ nand_upgrade_ubifs() {

 	nand_upgrade_prepare_ubi "$ubifs_length" "ubifs" "" "" || return 1

-	local ubidev="$( nand_find_ubi "$CI_UBIPART" )"
-	local root_ubivol="$(nand_find_volume $ubidev "$CI_ROOTPART")"
+	local root_ubidev="$( nand_find_ubi "${CI_ROOT_UBIPART:-$CI_UBIPART}" )"
+	local root_ubivol="$(nand_find_volume $root_ubidev "$CI_ROOTPART")"
 	$cmd < "$ubifs_file" | ubiupdatevol /dev/$root_ubivol -s "$ubifs_length" -
 }

@@ -302,7 +302,7 @@ nand_upgrade_fit() {

 	nand_upgrade_prepare_ubi "" "" "$fit_length" "1" || return 1

-	local fit_ubidev="$(nand_find_ubi "$CI_UBIPART")"
+	local fit_ubidev="$(nand_find_ubi "${CI_KERN_UBIPART:-$CI_UBIPART}")"
 	local fit_ubivol="$(nand_find_volume $fit_ubidev "$CI_KERNPART")"
 	$cmd < "$fit_file" | ubiupdatevol /dev/$fit_ubivol -s "$fit_length" -
 }
@@ -328,6 +328,10 @@ nand_upgrade_tar() {
 	local rootfs_type
 	[ "$rootfs_length" ] && rootfs_type="$(identify_tar "$tar_file" "$cmd" "$board_dir/root")"

+	# If CI_SKIP_KERNEL_MTD is set, ignore any potential kernel MTD partition that was found.
+	# This is needed if there's an MTD partition with the same name as the kernel's UBI volume.
+	[ "${CI_SKIP_KERNEL_MTD:-}" ] && kernel_mtd=
+
 	local ubi_kernel_length
 	if [ "$kernel_length" ]; then
 		if [ "$kernel_mtd" ]; then
@@ -0,0 +1,120 @@
+#!/usr/bin/env ucode
+'use strict';
+
+import { readfile } from 'fs';
+import * as digest from 'digest';
+
+// Fixed salt prefixed to the MAC address before hashing. It only separates this
+// particular use of the MAC from any other; the value itself carries no meaning.
+const DUID_SALT = 'openwrt-dhcp-duid:';
+const DUID_TYPE_UUID = '0004';
+
+function mac_normalise(mac) {
+	if (type(mac) != 'string')
+		return null;
+
+	mac = lc(trim(mac));
+
+	if (!match(mac, /^[0-9a-f]{2}(:[0-9a-f]{2}){5}$/))
+		return null;
+
+	if (mac == '00:00:00:00:00:00')
+		return null;
+
+	return mac;
+}
+
+function sysfs_mac(dev) {
+	if (!dev)
+		return null;
+
+	return mac_normalise(readfile('/sys/class/net/' + dev + '/address'));
+}
+
+function role_mac(board, role) {
+	if (type(role) != 'object')
+		return null;
+
+	let dev;
+	if (type(role.ports) == 'array' && length(role.ports) > 0)
+		dev = role.ports[0];
+	else
+		dev = role.device;
+
+	// Prefer the live hardware address of the physical port.
+	let mac = sysfs_mac(dev);
+	if (mac)
+		return mac;
+
+	// Fall back to MAC addresses recorded in board.json.
+	mac = mac_normalise(board?.network_device?.[dev]?.macaddr);
+	if (mac)
+		return mac;
+
+	return mac_normalise(role.macaddr);
+}
+
+function board_mac(board) {
+	let net = board?.network;
+	if (type(net) != 'object')
+		return null;
+
+	for (let prefix in ['lan', 'wan']) {
+		let mac = role_mac(board, net[prefix]);
+		if (mac)
+			return mac;
+
+		for (let name in keys(net)) {
+			if (substr(name, 0, length(prefix)) != prefix)
+				continue;
+
+			mac = role_mac(board, net[name]);
+			if (mac)
+				return mac;
+		}
+	}
+
+	return null;
+}
+
+function uuid_set_bits(u, version) {
+	let b6 = (hex(substr(u, 12, 2)) & 0x0f) | (version << 4);
+	let b8 = (hex(substr(u, 16, 2)) & 0x3f) | 0x80;
+
+	return substr(u, 0, 12) + sprintf('%02x', b6) +
+	       substr(u, 14, 2) + sprintf('%02x', b8) +
+	       substr(u, 18, 14);
+}
+
+function uuid_from_mac(mac) {
+	let hash = digest.sha1(DUID_SALT + mac);
+	if (type(hash) != 'string' || length(hash) < 32)
+		return null;
+
+	return uuid_set_bits(substr(hash, 0, 32), 5);
+}
+
+function uuid_random() {
+	let uuid = readfile('/proc/sys/kernel/random/uuid');
+	if (!uuid)
+		return null;
+
+	return join('', split(trim(uuid), '-'));
+}
+
+let board;
+try {
+	board = json(readfile('/etc/board.json'));
+} catch (e) {
+	board = null;
+}
+
+let mac = board_mac(board);
+let uuid = mac ? uuid_from_mac(mac) : null;
+
+uuid ??= uuid_random();
+
+if (!uuid)
+	exit(1);
+
+print(DUID_TYPE_UUID + uuid + '\n');
@@ -0,0 +1,77 @@
+#
+# Copyright (C) 2026 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=apboot-aruba-ipq806x
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/lukasstockner/ap325-apboot-openwrt.git
+PKG_MIRROR_HASH:=ef91bc1539d50c19c35ae5d38eab1a4944692d3f651952f58800ea1f7ffd4878
+PKG_SOURCE_DATE:=2026-06-12
+PKG_SOURCE_VERSION:=d36bb7270a8a8a5c5988ff778e55de12e0c40745
+
+PKG_LICENSE:=GPL-2.0-or-later
+PKG_LICENSE_FILES:=COPYING
+PKG_MAINTAINER:=Lukas Stockner <lukas@lukasstockner.de>
+
+# Legacy U-Boot tree, not Kbuild-parallel safe.
+PKG_BUILD_PARALLEL:=0
+PKG_FLAGS:=nonshared
+
+include $(INCLUDE_DIR)/package.mk
+
+# Aruba/QCA board name in the APBoot tree (Makefile.releng target):
+#   octomore -> AP-324 / AP-325 (and Siemens Scalance W1750D)
+APBOOT_BOARD:=octomore
+
+# Stamped into the version banner; the upstream Dockerfile uses the short hash.
+APBOOT_LABELID:=$(call version_abbrev,$(PKG_SOURCE_VERSION))
+
+define Package/apboot-aruba-ipq806x
+  SECTION:=boot
+  CATEGORY:=Boot Loaders
+  DEPENDS:=@TARGET_ipq806x
+  TITLE:=Patched Aruba APBoot for AP-32x
+  URL:=https://github.com/lukasstockner/ap325-apboot-openwrt
+endef
+
+define Package/apboot-aruba-ipq806x/description
+  Patched build of the Aruba APBoot bootloader (a vendor fork of U-Boot) for
+  the Aruba AP-324 / AP-325 access points (board "octomore"). The factory
+  bootloader enforces RSA signatures on the firmware; this build removes the
+  signature check and switches the console to 115200 baud so that OpenWrt can
+  be booted. The resulting "u-boot.mbn" is meant to be flashed to the APPSBL
+  SPI-flash partition via the serial console.
+endef
+
+# APBoot is a freestanding U-Boot, so build it with OpenWrt's target
+# cross-toolchain instead of the bare-metal arm-none-eabi- default. The legacy
+# Makefile honours an externally supplied CROSS_COMPILE.
+define Build/Compile
+	+$(MAKE) -C $(PKG_BUILD_DIR) -f Makefile.releng $(APBOOT_BOARD) \
+		SHELL=/bin/bash \
+		CROSS_COMPILE=$(TARGET_CROSS) \
+		HOSTCC="$(HOSTCC)" \
+		LABELID=$(APBOOT_LABELID) \
+		ARUBA_MAKE_VERBOSE=1
+endef
+
+# The bootloader is flashed by hand and is not part of the root filesystem.
+# Stage the image so the ipq806x image build can emit it as a device artifact.
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/u-boot.mbn \
+		$(STAGING_DIR_IMAGE)/aruba_ap-32x-apboot.mbn
+endef
+
+define Package/apboot-aruba-ipq806x/install
+	:
+endef
+
+$(eval $(call BuildPackage,apboot-aruba-ipq806x))
@@ -29,10 +29,16 @@ define Package/arm-trusted-firmware-tools
  BUILDONLY:=1
 endef

+ifeq ($(shell uname -s),Linux)
+	HOST_MUSL_FLAG:=$(shell [ "$$(2>&1 ldd --version | head -n 1 | cut -d ' ' -f1)" = "musl" ] && echo " -D__MUSL__")
+else
+	HOST_MUSL_FLAG:=
+endif
+
 define Host/Compile
 	$(MAKE) -C \
 		$(HOST_BUILD_DIR)/tools/fiptool \
-		CPPFLAGS="$(HOST_CFLAGS)" \
+		CPPFLAGS="$(HOST_CFLAGS)$(HOST_MUSL_FLAG)" \
 		LDFLAGS="$(HOST_LDFLAGS)" \
 		OPENSSL_DIR="$(STAGING_DIR_HOST)"
 endef
@@ -0,0 +1,39 @@
+From 6f51da2bb799a8b77da0167eeea45d5d5125f39c Mon Sep 17 00:00:00 2001
+From: Shine <4c.fce2@proton.me>
+Date: Mon, 22 Jun 2026 14:45:39 +0200
+Subject: fix fiptool build on musl host
+
+Due to POSIX style ioctl(int,int,...) declaration, building fiptool under
+MUSL generates a compiler warning (BLKGETSIZE64 == 0x80081272, ie. integer
+overflow). This causes a build failure when compiling with -Werror and
+-pedantic GCC switches enabled.
+
+Selectively cast the parameter to (int) when hinted to be running on a
+MUSL based build host.
+
+Requires a __MUSL__ macro to be defined. MUSL does not provide such a
+predefined macro, so this has to be passed explicitly to GCC, e.g. with
+-D__MUSL__ during build.
+
+For OpenWrt, this is done in the arm-trusted-firmware-tools Makefile,
+see commit e42e9c8133fbd0dce7abfe1ec696383745448078
+
+Signed-off-by: Shine <4c.fce2@proton.me>
+---
+ tools/fiptool/fiptool.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/tools/fiptool/fiptool.c
+++ b/tools/fiptool/fiptool.c
+@@ -318,7 +318,11 @@ static int parse_fip(const char *filename, fip_toc_header_t *toc_header_out)
+ 
+ #ifdef BLKGETSIZE64
+ 	if ((st.st_mode & S_IFBLK) != 0)
+#ifdef __MUSL__
+		if (ioctl(fileno(fp), (int)BLKGETSIZE64, &st_size) == -1)
+#else
+ 		if (ioctl(fileno(fp), BLKGETSIZE64, &st_size) == -1)
+#endif
+ 			log_err("ioctl %s", filename);
+ #endif
+ 
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=tfa-layerscape
-PKG_VERSION:=6.12.20.2.0.0
+PKG_VERSION:=6.18.2.1.0.0
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/nxp-qoriq/atf
-PKG_SOURCE_VERSION:=lf-6.12.20-2.0.0
-PKG_MIRROR_HASH:=1e1c74900113a8d4354c06fdcedfff2cd6b0899b4a063d393de98f8ca358dfd2
+PKG_SOURCE_VERSION:=lf-6.18.2-1.0.0
+PKG_MIRROR_HASH:=4baa079cdc794bd6095c4d5cecb64d38d94273d592ad6d84da955cff3d443393
 PKG_BUILD_DEPENDS:=tfa-layerscape/host

 include $(INCLUDE_DIR)/host-build.mk
@@ -16,14 +16,32 @@ define U-Boot/Default
  LZMA_COMPRESS:=1
 endef

-define U-Boot/en7523_rfb
-  NAME:=EN7523 Reference Board
-  UBOOT_CONFIG:=en7523_evb
-  BUILD_DEVICES:=airoha_en7523-evb
-  BUILD_SUBTARGET:=en7523
+define U-Boot/an7581_gemtek_w1700k
+  NAME:=Gemtek W1700K (UBI)
+  UBOOT_CONFIG:=an7581_w1700k
+  BUILD_DEVICES:=gemtek_w1700k-ubi
+  BUILD_SUBTARGET:=an7581
+  UBOOT_IMAGE:=u-boot.bin
+endef
+
+define U-Boot/an7581_nokia_valyrian
+  NAME:=Nokia Valyrian
+  UBOOT_CONFIG:=an7581_nokia_valyrian
+  BUILD_DEVICES:=nokia_valyrian
+  BUILD_SUBTARGET:=an7581
  UBOOT_IMAGE:=u-boot.fip
-  BL2_IMAGE:=en7523-bl2.bin
-  BL31_IMAGE:=en7523-bl31.bin
+  BL2_IMAGE:=an7581-bl2.bin
+  BL31_IMAGE:=an7581-bl31.bin
+endef
+
+define U-Boot/an7581_nokia_xg-040g-md
+  NAME:=Nokia XG-040G-MD
+  UBOOT_CONFIG:=an7581_nokia_xg-040g-md
+  BUILD_DEVICES:=nokia_xg-040g-md-ubi
+  BUILD_SUBTARGET:=an7581
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_IMAGE:=an7581-bl2.bin
+  BL31_IMAGE:=an7581-bl31.bin
 endef

 define U-Boot/an7581_rfb
@@ -46,30 +64,23 @@ define U-Boot/an7583_rfb
  BL31_IMAGE:=an7583-bl31.bin
 endef

-define U-Boot/an7581_gemtek_w1700k
-  NAME:=Gemtek W1700K (UBI)
-  UBOOT_CONFIG:=an7581_w1700k
-  BUILD_DEVICES:=gemtek_w1700k-ubi
-  BUILD_SUBTARGET:=an7581
-  UBOOT_IMAGE:=u-boot.bin
-endef
-
-define U-Boot/an7581_nokia_valyrian
-  NAME:=Nokia Valyrian
-  UBOOT_CONFIG:=an7581_nokia_valyrian
-  BUILD_DEVICES:=nokia_valyrian
-  BUILD_SUBTARGET:=an7581
+define U-Boot/en7523_rfb
+  NAME:=EN7523 Reference Board
+  UBOOT_CONFIG:=en7523_evb
+  BUILD_DEVICES:=airoha_en7523-evb
+  BUILD_SUBTARGET:=en7523
  UBOOT_IMAGE:=u-boot.fip
-  BL2_IMAGE:=an7581-bl2.bin
-  BL31_IMAGE:=an7581-bl31.bin
+  BL2_IMAGE:=en7523-bl2.bin
+  BL31_IMAGE:=en7523-bl31.bin
 endef

 UBOOT_TARGETS := \
-	en7523_rfb \
+	an7581_gemtek_w1700k \
+	an7581_nokia_valyrian \
+	an7581_nokia_xg-040g-md \
 	an7581_rfb \
 	an7583_rfb \
-	an7581_gemtek_w1700k \
-	an7581_nokia_valyrian
+	en7523_rfb

 UBOOT_CUSTOMIZE_CONFIG := \
 	--disable TOOLS_KWBIMAGE \
@@ -0,0 +1,33 @@
+--- a/cmd/bootmenu.c
+++ b/cmd/bootmenu.c
+@@ -482,7 +482,11 @@ static void menu_display_statusline(stru
+ 	printf(ANSI_CURSOR_POSITION, 1, 1);
+ 	puts(ANSI_CLEAR_LINE);
+ 	printf(ANSI_CURSOR_POSITION, 2, 3);
+-	puts("*** U-Boot Boot Menu ***");
+	if (menu->mtitle)
+		puts(menu->mtitle);
+	else
+		puts("  *** U-Boot Boot Menu ***");
+
+ 	puts(ANSI_CLEAR_LINE_TO_END);
+ 	printf(ANSI_CURSOR_POSITION, 3, 1);
+ 	puts(ANSI_CLEAR_LINE);
+@@ -573,6 +577,7 @@ static enum bootmenu_ret bootmenu_show(i
+ 		return BOOTMENU_RET_FAIL;
+ 	}
+ 
+	bootmenu->mtitle = env_get("bootmenu_title");
+ 	for (iter = bootmenu->first; iter; iter = iter->next) {
+ 		if (menu_item_add(menu, iter->key, iter) != 1)
+ 			goto cleanup;
+--- a/include/menu.h
+++ b/include/menu.h
+@@ -43,6 +43,7 @@ struct bootmenu_data {
+ 	int last_active;		/* last active menu entry */
+ 	int count;			/* total count of menu entries */
+ 	struct bootmenu_entry *first;	/* first menu entry */
+	char *mtitle;			/* custom menu title */
+ };
+ 
+ /** enum bootmenu_key - keys that can be returned by the bootmenu */
@@ -0,0 +1,116 @@
+--- a/cmd/Kconfig
+++ b/cmd/Kconfig
+@@ -717,6 +717,12 @@ config CMD_ENV_EXISTS
+ 	  Check if a variable is defined in the environment for use in
+ 	  shell scripting.
+ 
+config CMD_ENV_READMEM
+	bool "env readmem"
+	default y
+	help
+	  Store memory content into environment variable.
+
+ config CMD_ENV_CALLBACK
+ 	bool "env callbacks - print callbacks and their associated variables"
+ 	help
+--- a/cmd/nvedit.c
+++ b/cmd/nvedit.c
+@@ -273,6 +273,60 @@ static int do_env_ask(struct cmd_tbl *cm
+ }
+ #endif
+ 
+#if defined(CONFIG_CMD_ENV_READMEM)
+int do_env_readmem(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[])
+{
+	char varstr[CONFIG_SYS_CBSIZE];
+	const void *buf;
+	char *local_args[4];
+	ulong addr, bytes = 6;
+	int hexdump = 0;
+
+	/*
+	 * Check the syntax:
+	 *
+	 * readmem [-b] name address [size]
+	 */
+	if (argc < 3)
+		return CMD_RET_USAGE;
+
+	local_args[0] = argv[0];
+
+	if (!strncmp(argv[1], "-b", 3))
+		hexdump = 1;
+
+	local_args[1] = argv[hexdump + 1];
+	local_args[2] = varstr;
+	local_args[3] = NULL;
+
+	addr = simple_strtoul(argv[hexdump + 2], NULL, 16);
+
+	if (!hexdump)
+		bytes = simple_strtoul(argv[hexdump + 3], NULL, 16);
+
+	if (bytes < 1)
+		return 1;
+
+	if ((hexdump * 3) * bytes >= CONFIG_SYS_CBSIZE)
+		return 1;
+
+	buf = map_sysmem(addr, bytes);
+	if (!buf)
+		return 1;
+
+	if (hexdump) {
+		sprintf(varstr, "%pM", buf);
+	} else {
+		memcpy(varstr, buf, bytes);
+		varstr[bytes] = '\0';
+	}
+	unmap_sysmem(buf);
+
+	/* Continue calling setenv code */
+	return env_do_env_set(flag, 3, local_args, H_INTERACTIVE);
+}
+#endif
+
+ #if defined(CONFIG_CMD_ENV_CALLBACK)
+ static int print_static_binding(const char *var_name, const char *callback_name,
+ 				void *priv)
+@@ -1095,6 +1149,9 @@ static struct cmd_tbl cmd_env_sub[] = {
+ 	U_BOOT_CMD_MKENT(load, 1, 0, do_env_load, "", ""),
+ #endif
+ 	U_BOOT_CMD_MKENT(print, CONFIG_SYS_MAXARGS, 1, do_env_print, "", ""),
+#if defined(CONFIG_CMD_ENV_READMEM)
+	U_BOOT_CMD_MKENT(readmem, CONFIG_SYS_MAXARGS, 3, do_env_readmem, "", ""),
+#endif
+ #if defined(CONFIG_CMD_RUN)
+ 	U_BOOT_CMD_MKENT(run, CONFIG_SYS_MAXARGS, 1, do_run, "", ""),
+ #endif
+@@ -1179,6 +1236,9 @@ U_BOOT_LONGHELP(env,
+ #if defined(CONFIG_CMD_NVEDIT_EFI)
+ 	"env print -e [-guid guid] [-n] [name ...] - print UEFI environment\n"
+ #endif
+#if defined(CONFIG_CMD_ENV_READMEM)
+	"env readmem [-b] name address size - read variable from memory\n"
+#endif
+ #if defined(CONFIG_CMD_RUN)
+ 	"env run var [...] - run commands in an environment variable\n"
+ #endif
+@@ -1287,6 +1347,17 @@ U_BOOT_CMD(
+ );
+ #endif
+ 
+#if defined(CONFIG_CMD_ENV_READMEM)
+U_BOOT_CMD_COMPLETE(
+	readmem,	CONFIG_SYS_MAXARGS,	3,	do_env_readmem,
+	"get environment variable from memory address",
+	"[-b] name address size\n"
+	"    - store memory address to env variable\n"
+	"      \"-b\": read binary ethaddr",
+	var_complete
+);
+#endif
+
+ #if defined(CONFIG_CMD_RUN)
+ U_BOOT_CMD_COMPLETE(
+ 	run,	CONFIG_SYS_MAXARGS,	1,	do_run,
@@ -0,0 +1,295 @@
+--- /dev/null
+++ b/configs/an7581_nokia_xg-040g-md_defconfig
+@@ -0,0 +1,134 @@
+CONFIG_ARM=y
+CONFIG_ARCH_AIROHA=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_BOOTDELAY=3
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_TARGET_AN7581=y
+CONFIG_TEXT_BASE=0x81e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DM_GPIO=y
+CONFIG_DEFAULT_DEVICE_TREE="airoha/an7581-nokia-xg-040g-md"
+CONFIG_SYS_LOAD_ADDR=0x81800000
+CONFIG_BUILD_TARGET="u-boot.bin"
+# CONFIG_EFI_LOADER is not set
+CONFIG_FIT=y
+CONFIG_FIT_VERBOSE=y
+CONFIG_DEFAULT_FDT_FILE="airoha/an7581-nokia-xg-040g-md.dtb"
+CONFIG_LOGLEVEL=9
+CONFIG_LOG=y
+CONFIG_SYS_PBSIZE=1049
+CONFIG_SYS_CONSOLE_IS_IN_ENV=y
+# CONFIG_DISPLAY_BOARDINFO is not set
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="AN7581> "
+CONFIG_SYS_MAXARGS=8
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_RNG=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_MTD_MARKBAD=y
+CONFIG_CMD_MTD_NAND_READ_TEST=y
+CONFIG_CMD_MTD_NAND_WRITE_TEST=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/an7581_nokia_xg-040g-md_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+# CONFIG_ENV_IS_IN_MTD is not set
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_MODULE=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTD_UBI_BEB_LIMIT=20
+# CONFIG_MTD_UBI_FASTMAP is not set
+CONFIG_UBI_BLOCK=y
+# CONFIG_UBIFS_SILENCE_MSG is not set
+# CONFIG_UBIFS_SILENCE_DEBUG_DUMP is not set
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_OF_UPSTREAM=y
+CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_SYS_RX_ETH_BUFFER=8
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_CLK=y
+CONFIG_DMA=y
+CONFIG_GPIO_HOG=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+CONFIG_SPI_FLASH=y
+CONFIG_SPI_FLASH_EON=y
+CONFIG_SPI_FLASH_GIGADEVICE=y
+CONFIG_SPI_FLASH_ISSI=y
+CONFIG_SPI_FLASH_MACRONIX=y
+CONFIG_SPI_FLASH_SPANSION=y
+CONFIG_SPI_FLASH_STMICRO=y
+CONFIG_SPI_FLASH_WINBOND=y
+CONFIG_SPI_FLASH_MTD=y
+CONFIG_AIROHA_ETH=y
+CONFIG_DM_MDIO=y
+CONFIG_CMD_MII=y
+CONFIG_CMD_MDIO=y
+CONFIG_PCS_AIROHA_AN7581=y
+CONFIG_PHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_RAM=y
+CONFIG_DM_SERIAL=y
+CONFIG_SYS_NS16550=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_AIROHA_SNFI_SPI=y
+CONFIG_SHA512=y
+CONFIG_USE_DEFAULT_ENV_FILE=y
+CONFIG_DEFAULT_ENV_FILE="defenvs/an7581_nokia_xg-040g-md_env"
+CONFIG_PCS_AIROHA_AN7581=y
+CONFIG_PHY_AIROHA_EN8811=y
+CONFIG_PHY_ANEG_TIMEOUT=10000
+CONFIG_PHY_ETHERNET_ID=y
+--- /dev/null
+++ b/defenvs/an7581_nokia_xg-040g-md_env
+@@ -0,0 +1,53 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x90000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=run check_buttons ; run boot_ubi
+bootconf=config-1
+bootdelay=0
+bootfile=immortalwrt-airoha-an7581-nokia_xg-040g-md-ubi-initramfs-recovery.itb
+bootfile_bl2=immortalwrt-airoha-an7581-nokia_xg-040g-md-ubi-preloader.bin
+bootfile_fip=immortalwrt-airoha-an7581-nokia_xg-040g-md-ubi-bl31-uboot.fip
+bootfile_upg=immortalwrt-airoha-an7581-nokia_xg-040g-md-ubi-squashfs-sysupgrade.itb
+bootled_status=green:power
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Load production system via TFTP then write to NAND=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_4=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_5=[31mLoad BL2 preloader via TFTP then write to NAND[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_6=Reboot=reset
+bootmenu_7=Reset all settings to factory defaults=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_status on ; run boot_default ; fi ; bootmenu
+boot_default=run bootcmd ; run boot_tftp_forever
+boot_production=led $bootled_status on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_status off
+boot_ubi=run boot_production ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_status on ; while true ; do run boot_tftp ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_bl2=mw.b $loadaddr 0xff 0x800 ; setexpr loadaddr_bl2 $loadaddr + 0x800 ; tftpboot $loadaddr_bl2 $bootfile_bl2 && run mtd_write_bl2
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run ubi_write_fip && run reset_factory
+preboot=led $bootled_status on
+check_buttons=if button reset ; then run boot_tftp ; fi
+ethaddr_factory=ubi read 0x90000000 ri && env readmem -b ethaddr 0x9000003e 0x6 ; setenv ethaddr_factory
+part_default=production
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+ubi_create_board_data=ubi check bosa || ubi create bosa 0x40000 || run ubi_format ; ubi check ri || ubi create ri 0x40000 || run ubi_format
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x1f000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x1f000 dynamic || run ubi_format
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_fip=run ubi_remove_rootfs ; ubi check fip && ubi remove fip ; ubi create fip 0x100000 static && ubi write $loadaddr fip $filesize
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv ; run ubi_create_board_data
+_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
+--- /dev/null
+++ b/dts/upstream/src/arm64/airoha/an7581-nokia-xg-040g-md.dts
+@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/dts-v1/;
+
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include "en7581.dtsi"
+
+/ {
+	model = "Nokia XG-040G-MD";
+	compatible = "nokia,xg-040g-md",
+		     "airoha,an7581",
+		     "airoha,en7581";
+
+	chosen {
+		bootargs = "console=ttyS0,115200 earlycon";
+		stdout-path = "serial0:115200n8";
+		linux,usable-memory-range = <0x0 0x80200000 0x0 0x1fe00000>;
+	};
+
+	memory@80000000 {
+		device_type = "memory";
+		reg = <0x0 0x80000000 0x0 0x20000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-0 {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&en7581_pinctrl 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "green:power";
+			gpios = <&en7581_pinctrl 17 GPIO_ACTIVE_LOW>;
+		};
+
+		led-1 {
+			label = "green:wan";
+			gpios = <&en7581_pinctrl 18 GPIO_ACTIVE_LOW>;
+		};
+
+		led-2 {
+			label = "red:wan";
+			gpios = <&en7581_pinctrl 19 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			label = "green:wan-online";
+			gpios = <&en7581_pinctrl 20 GPIO_ACTIVE_LOW>;
+		};
+
+		led-4 {
+			label = "green:usb-2";
+			gpios = <&en7581_pinctrl 34 GPIO_ACTIVE_LOW>;
+		};
+
+		led-5 {
+			label = "green:usb-1";
+			gpios = <&en7581_pinctrl 35 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&snfi {
+	status = "okay";
+};
+
+&spi_nand {
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "bl2";
+			reg = <0x0 0x20000>;
+		};
+
+		partition@20000 {
+			label = "ubi";
+			reg = <0x20000 0xffe0000>;
+		};
+	};
+};
+
+&i2c0 {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+};
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=uboot-layerscape
-PKG_VERSION:=6.12.20.2.0.0
+PKG_VERSION:=6.18.2.1.0.0
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/nxp-qoriq/u-boot
-PKG_SOURCE_VERSION:=lf-6.12.20-2.0.0
-PKG_MIRROR_HASH:=13594333aa3ee131d5832b4da88f73cf0744d98c28e90ad3e03594788c486e37
+PKG_SOURCE_VERSION:=lf-6.18.2-1.0.0
+PKG_MIRROR_HASH:=047df1acdbf35004bc9d896ee688da5930da3b8a6f02a7bdc109a1367be61fee

 include $(INCLUDE_DIR)/u-boot.mk
 include $(INCLUDE_DIR)/package.mk
@@ -353,6 +353,18 @@ define U-Boot/mt7981_comfast_cf-wr632ax
  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3-1866
 endef

+define U-Boot/mt7981_creatlentem_clt-r30b1-ubi
+  NAME:=CreatLentem CLT-R30B1 (UBI)
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=creatlentem_clt-r30b1-ubi
+  UBOOT_CONFIG:=mt7981_creatlentem_clt-r30b1-ubi
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand-ubi
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3-1866
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ubi-ddr3-1866
+endef
+
 define U-Boot/mt7981_cudy_tr3000-v1
  NAME:=Cudy TR3000 v1
  BUILD_SUBTARGET:=filogic
@@ -1359,6 +1371,7 @@ UBOOT_TARGETS := \
 	mt7981_cmcc_rax3000me-nand-ddr3 \
 	mt7981_cmcc_rax3000me-nand-ddr4 \
 	mt7981_comfast_cf-wr632ax \
+	mt7981_creatlentem_clt-r30b1-ubi \
 	mt7981_cudy_tr3000-v1 \
 	mt7981_cudy_wbr3000uax-v1 \
 	mt7981_cudy_wr3000e-v1 \
@@ -1,7 +1,8 @@
 --- /dev/null
 +++ b/configs/mt7981_cudy_wr3000e-v1_defconfig
-@@ -0,0 +1,108 @@
+@@ -0,0 +1,112 @@
 +CONFIG_ARM=y
+CONFIG_ARM_SMCCC=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
@@ -34,6 +35,7 @@
 +CONFIG_CMD_ASKENV=y
 +CONFIG_CMD_ERASEENV=y
 +CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_RNG=y
 +CONFIG_CMD_STRINGS=y
 +CONFIG_CMD_DM=y
 +CONFIG_CMD_GPIO=y
@@ -101,6 +103,8 @@
 +CONFIG_DM_REGULATOR_FIXED=y
 +CONFIG_DM_REGULATOR_GPIO=y
 +CONFIG_RAM=y
+CONFIG_DM_RNG=y
+CONFIG_RNG_MTK_V2=y
 +CONFIG_DM_SERIAL=y
 +CONFIG_SERIAL_RX_BUFFER=y
 +CONFIG_MTK_SERIAL=y
@@ -1,7 +1,8 @@
 --- /dev/null
 +++ b/configs/mt7981_cudy_wr3000h-v1_defconfig
-@@ -0,0 +1,108 @@
+@@ -0,0 +1,112 @@
 +CONFIG_ARM=y
+CONFIG_ARM_SMCCC=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
@@ -34,6 +35,7 @@
 +CONFIG_CMD_ASKENV=y
 +CONFIG_CMD_ERASEENV=y
 +CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_RNG=y
 +CONFIG_CMD_STRINGS=y
 +CONFIG_CMD_DM=y
 +CONFIG_CMD_GPIO=y
@@ -101,6 +103,8 @@
 +CONFIG_DM_REGULATOR_FIXED=y
 +CONFIG_DM_REGULATOR_GPIO=y
 +CONFIG_RAM=y
+CONFIG_DM_RNG=y
+CONFIG_RNG_MTK_V2=y
 +CONFIG_DM_SERIAL=y
 +CONFIG_SERIAL_RX_BUFFER=y
 +CONFIG_MTK_SERIAL=y
@@ -1,7 +1,8 @@
 --- /dev/null
 +++ b/configs/mt7981_cudy_wr3000p-v1_defconfig
-@@ -0,0 +1,108 @@
+@@ -0,0 +1,112 @@
 +CONFIG_ARM=y
+CONFIG_ARM_SMCCC=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
@@ -34,6 +35,7 @@
 +CONFIG_CMD_ASKENV=y
 +CONFIG_CMD_ERASEENV=y
 +CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_RNG=y
 +CONFIG_CMD_STRINGS=y
 +CONFIG_CMD_DM=y
 +CONFIG_CMD_GPIO=y
@@ -101,6 +103,8 @@
 +CONFIG_DM_REGULATOR_FIXED=y
 +CONFIG_DM_REGULATOR_GPIO=y
 +CONFIG_RAM=y
+CONFIG_DM_RNG=y
+CONFIG_RNG_MTK_V2=y
 +CONFIG_DM_SERIAL=y
 +CONFIG_SERIAL_RX_BUFFER=y
 +CONFIG_MTK_SERIAL=y
@@ -1,7 +1,8 @@
 --- /dev/null
 +++ b/configs/mt7981_cudy_wr3000s-v1_defconfig
-@@ -0,0 +1,108 @@
+@@ -0,0 +1,112 @@
 +CONFIG_ARM=y
+CONFIG_ARM_SMCCC=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
@@ -34,6 +35,7 @@
 +CONFIG_CMD_ASKENV=y
 +CONFIG_CMD_ERASEENV=y
 +CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_RNG=y
 +CONFIG_CMD_STRINGS=y
 +CONFIG_CMD_DM=y
 +CONFIG_CMD_GPIO=y
@@ -101,6 +103,8 @@
 +CONFIG_DM_REGULATOR_FIXED=y
 +CONFIG_DM_REGULATOR_GPIO=y
 +CONFIG_RAM=y
+CONFIG_DM_RNG=y
+CONFIG_RNG_MTK_V2=y
 +CONFIG_DM_SERIAL=y
 +CONFIG_SERIAL_RX_BUFFER=y
 +CONFIG_MTK_SERIAL=y
@@ -0,0 +1,315 @@
+--- /dev/null
+++ b/configs/mt7981_creatlentem_clt-r30b1-ubi_defconfig
+@@ -0,0 +1,112 @@
+CONFIG_ARM=y
+CONFIG_ARM_SMCCC=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7981-creatlentem-clt-r30b1-ubi"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7981=y
+CONFIG_SYS_LOAD_ADDR=0x46000000
+CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
+CONFIG_DEBUG_UART_BASE=0x11002000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_DEBUG_UART=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=30
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_USE_PREBOOT=y
+CONFIG_DEFAULT_FDT_FILE="mt7981-creatlentem-clt-r30b1-ubi"
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+# CONFIG_BOARD_INIT is not set
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="MT7981> "
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_RNG=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_ENV_REDUNDANT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/creatlentem_clt-r30b1-ubi_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_GPIO_HOG=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_FIXED=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7981=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_RAM=y
+CONFIG_DM_RNG=y
+CONFIG_RNG_MTK_V2=y
+CONFIG_DM_SERIAL=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+--- /dev/null
+++ b/defenvs/creatlentem_clt-r30b1-ubi_env
+@@ -0,0 +1,54 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x46000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=immortalwrt-mediatek-filogic-creatlentem_clt-r30b1-ubi-initramfs-recovery.itb
+bootfile_bl2=immortalwrt-mediatek-filogic-creatlentem_clt-r30b1-ubi-preloader.bin
+bootfile_fip=immortalwrt-mediatek-filogic-creatlentem_clt-r30b1-ubi-bl31-uboot.fip
+bootfile_upg=immortalwrt-mediatek-filogic-creatlentem_clt-r30b1-ubi-squashfs-sysupgrade.itb
+bootled_pwr=red:status
+bootled_rec=green:status
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_pwr off ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=led $bootled_rec off ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
+boot_recovery=led $bootled_pwr off ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_pwr off ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run ubi_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+preboot=led $bootled_pwr on ; led $bootled_rec on
+reset_factory=mw $loadaddr 0xff 0x1f000 ; ubi write $loadaddr ubootenv 0x1f000 ; ubi write $loadaddr ubootenv2 0x1f000 ; ubi remove rootfs_data
+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x1f000 dynamic ; ubi check ubootenv2 || ubi create ubootenv2 0x1f000 dynamic
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_fip=run ubi_remove_rootfs ; ubi check fip && ubi remove fip ; ubi create fip 0x200000 static ; ubi write $loadaddr fip 0x200000
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
+--- /dev/null
+++ b/arch/arm/dts/mt7981-creatlentem-clt-r30b1-ubi.dts
+@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+/dts-v1/;
+#include "mt7981.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/linux-event-codes.h>
+
+/ {
+	model = "CreatLentem CLT-R30B1 (UBI)";
+	compatible = "creatlentem,clt-r30b1-ubi", "mediatek,mt7981";
+
+	chosen {
+		stdout-path = &uart0;
+		tick-timer = &timer0;
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x10000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		button-wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_status_green: led-0 {
+			label = "green:status";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_red: led-1 {
+			label = "red:status";
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+	mediatek,gmac-id = <0>;
+	phy-mode = "2500base-x";
+	mediatek,switch = "mt7531";
+	reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+
+	fixed-link {
+		speed = <2500>;
+		full-duplex;
+	};
+};
+
+&pio {
+	spi_flash_pins: spi0-pins-func-1 {
+		mux {
+			function = "flash";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+
+	line_8-hog {
+		gpio-hog;
+		gpios = <8 GPIO_ACTIVE_HIGH>;
+		output-low;
+		line-name = "LEDs power";
+	};
+};
+
+&spi0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+	must_tx;
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <2>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "ubi";
+				reg = <0x100000 0x7f00000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&uart0 {
+	mediatek,force-highspeed;
+	status = "okay";
+};
+
+&watchdog {
+	status = "disabled";
+};
@@ -1,7 +1,8 @@
 --- /dev/null
 +++ b/configs/mt7981_wavlink_wl-wnt100x3_defconfig
-@@ -0,0 +1,108 @@
+@@ -0,0 +1,112 @@
 +CONFIG_ARM=y
+CONFIG_ARM_SMCCC=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
@@ -34,6 +35,7 @@
 +CONFIG_CMD_ASKENV=y
 +CONFIG_CMD_ERASEENV=y
 +CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_RNG=y
 +CONFIG_CMD_STRINGS=y
 +CONFIG_CMD_DM=y
 +CONFIG_CMD_GPIO=y
@@ -101,6 +103,8 @@
 +CONFIG_DM_REGULATOR_FIXED=y
 +CONFIG_DM_REGULATOR_GPIO=y
 +CONFIG_RAM=y
+CONFIG_DM_RNG=y
+CONFIG_RNG_MTK_V2=y
 +CONFIG_DM_SERIAL=y
 +CONFIG_SERIAL_RX_BUFFER=y
 +CONFIG_MTK_SERIAL=y
@@ -12,9 +12,13 @@ touch /etc/config/ubootenv
 board=$(board_name)

 case "$board" in
-gemtek,w1700k-ubi)
+gemtek,w1700k-ubi|\
+nokia,xg-040g-md-ubi)
 	ubootenv_add_ubi_default
 	;;
+nokia,xg-040g-md)
+	ubootenv_add_mtd "u-boot-env" "0x1c000" "0x4000" "0x4000"
+	;;
 esac

 config_load ubootenv
@@ -35,6 +35,12 @@ arris,tr4400-v2|\
 askey,rt4230w-rev6)
 	ubootenv_add_uci_config "/dev/mtd9" "0x0" "0x40000" "0x20000"
 	;;
+aruba,ap-32x|\
+ignitenet,ss-w2-ac2600|\
+qcom,ipq8064-ap148|\
+qcom,ipq8064-db149)
+	ubootenv_add_uci_config $(ubootenv_mtdinfo)
+	;;
 edgecore,ecw5410)
 	ubootenv_add_uci_config "/dev/mtd11" "0x0" "0x10000" "0x10000"
 	;;
@@ -42,11 +48,6 @@ extreme,ap3935)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x10000"
 	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x10000" "0x10000"
 	;;
-ignitenet,ss-w2-ac2600|\
-qcom,ipq8064-ap148|\
-qcom,ipq8064-db149)
-	ubootenv_add_uci_config $(ubootenv_mtdinfo)
-	;;
 linksys,ea7500-v1|\
 linksys,ea8500)
 	ubootenv_add_uci_config "/dev/mtd10" "0x0" "0x20000" "0x20000"
@@ -28,6 +28,7 @@ asus,zenwifi-bt8-ubootmod|\
 cetron,ct3003-ubootmod|\
 cmcc,a10-ubootmod|\
 comfast,cf-wr632ax-ubootmod|\
+creatlentem,clt-r30b1-ubi|\
 cudy,tr3000-v1-ubootmod|\
 cudy,wbr3000uax-v1-ubootmod|\
 cudy,wr3000e-v1-ubootmod|\
@@ -78,6 +78,9 @@ methode,edpu)
 synology,ds213j)
 	ubootenv_add_mtd "u-boot-env" "0x0" "0x10000" "0x10000"
 	;;
+zyxel,nas326)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x80000"
+	;;
 esac

 config_load ubootenv
@@ -37,6 +37,7 @@ iodata,bsh-g24mb)
 	ubootenv_add_sys_mtd "u-boot-env2" "0x0" "0x3800" "0x10000"
 	;;
 tplink,sg2008p-v1|\
+tplink,sg2008p-v3|\
 tplink,sg2210p-v3|\
 tplink,sg2452p-v4)
 	ubootenv_add_mtd "u-boot-env" "0x0" "0x20000" "0x10000"
@@ -30,6 +30,12 @@ define U-Boot/zc702
  BUILD_DEVICES:=xlnx_zynq-zc702
 endef

+define U-Boot/antminer-s9
+  NAME:=Bitmain Antminer S9 control board
+  BUILD_DEVICES:=bitmain_zynq-antminer-s9
+  UBOOT_CONFIG:=bitmain_antminer_s9
+endef
+
 define U-Boot/zed
  NAME:=Avnet Digilent ZedBoard Dev Board
  BUILD_DEVICES:=avnet_zynq-zed
@@ -46,6 +52,7 @@ define U-Boot/zybo_z7
 endef

 UBOOT_TARGETS := \
+	antminer-s9 \
 	zc702 \
 	zed \
 	zybo \
@@ -1 +1,2 @@
 bootargs=console=ttyPS0,115200n8 root=/dev/mmcblk0p2 rootwait earlyprintk
+bootcmd=run sdboot
@@ -0,0 +1,37 @@
+--- a/include/configs/bitmain_antminer_s9.h
+++ b/include/configs/bitmain_antminer_s9.h
+@@ -20,6 +20,34 @@
+ 	"initrd_high=0xefff000\0" \
+ 	"devnum=0\0" \
+ 	"wdstop=mw f8005000 ABC000\0" \
+	"scriptaddr=0x3000000\0"        \
+	"loadbootenv_addr=0x2000000\0" \
+	"fit_image=fit.itb\0"           \
+	"load_addr=0x2000000\0"         \
+	"bootenv=uEnv.txt\0" \
+	"bootenv_dev=mmc\0" \
+	"loadbootenv=load ${bootenv_dev} 0 ${loadbootenv_addr} ${bootenv}\0" \
+	"importbootenv=echo Importing environment from ${bootenv_dev} ...; " \
+	"env import -t ${loadbootenv_addr} $filesize\0" \
+	"bootenv_existence_test=test -e ${bootenv_dev} 0 /${bootenv}\0" \
+	"setbootenv=if env run bootenv_existence_test; then " \
+		"if env run loadbootenv; then " \
+			"env run importbootenv; " \
+		"fi; " \
+	"fi; \0" \
+	"sd_loadbootenv=setenv bootenv_dev mmc && " \
+		"run setbootenv \0" \
+		"preboot=if test $modeboot = sdboot; then " \
+			"run sd_loadbootenv; " \
+			"echo Checking if uenvcmd is set ...; " \
+			"if test -n $uenvcmd; then " \
+				"echo Running uenvcmd ...; " \
+				"run uenvcmd; " \
+			"fi; " \
+		"fi; \0" \
+	"sdboot=echo Copying FIT from SD to RAM... && " \
+		"load mmc 0 ${load_addr} ${fit_image} && " \
+		"bootm ${load_addr}\0" \
+ 	BOOTENV
+ 
+ #include <configs/zynq-common.h>
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=fman-ucode
-PKG_VERSION:=6.12.20.2.0.0
+PKG_VERSION:=6.18.2.1.0.0
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/nxp-qoriq/qoriq-fm-ucode
-PKG_SOURCE_VERSION:=lf-6.12.20-2.0.0
-PKG_MIRROR_HASH:=15b5df228b23b4cbdd1af484c98069b558d32ece15a80f0dabe22af6e5ee1ba1
+PKG_SOURCE_VERSION:=lf-6.18.2-1.0.0
+PKG_MIRROR_HASH:=155b74a390c8eefc7767b68993eb41cf04ac6d578ae53eb82cff40a1c1251375

 PKG_FLAGS:=nonshared

@@ -6,13 +6,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=ls-ddr-phy
-PKG_VERSION:=6.12.20.2.0.0
+PKG_VERSION:=6.18.2.1.0.0
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/NXP/ddr-phy-binary.git
-PKG_SOURCE_VERSION:=lf-6.12.20-2.0.0
-PKG_MIRROR_HASH:=162616b23041e345a9a12080005ee1c24c9903d6809c60a022588a1c7f5b1577
+PKG_SOURCE_VERSION:=lf-6.18.2-1.0.0
+PKG_MIRROR_HASH:=376d9af14bfe4ee6f14ae77ace9d592606d82ad3d7af87dda47d5fa8fd3ba10e
 PKG_BUILD_DEPENDS:=tfa-layerscape/host

 PKG_LICENSE:=EULA
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=ls-dpl
-PKG_VERSION:=10.39.0
+PKG_VERSION:=10.40.0
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/nxp-qoriq/mc-utils
-PKG_SOURCE_VERSION:=mc_release_10.39.0
-PKG_MIRROR_HASH:=48e0ad66f536689bf8cfd115420422a1c746cd609816bd9b07ef8ef358a85cf4
+PKG_SOURCE_VERSION:=mc_release_10.40.0
+PKG_MIRROR_HASH:=d29481aeddbfff337b8bdcdd0a93c19dd0673f0408246e7f3f98cd2c0af15cc3

 PKG_FLAGS:=nonshared

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=ls-mc
-PKG_VERSION:=10.39.0
+PKG_VERSION:=10.40.0
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/NXP/qoriq-mc-binary.git
-PKG_SOURCE_VERSION:=mc_release_10.39.0
-PKG_MIRROR_HASH:=0676072ec3fcb7ad3ec101ea279f5e7b41b292b44426563aba9062668f9855ab
+PKG_SOURCE_VERSION:=mc_release_10.40.0
+PKG_MIRROR_HASH:=d4359637da641108f5c8b39c1db43d9dda4d2f8e64d4a4c89ce0301ebd12b3b1

 PKG_FLAGS:=nonshared

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=ls-rcw
-PKG_VERSION:=6.12.20.2.0.0
+PKG_VERSION:=6.18.2.1.0.0
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/nxp-qoriq/rcw
-PKG_SOURCE_VERSION:=lf-6.12.20-2.0.0
-PKG_MIRROR_HASH:=8436e04a01fa7a0da3512dae035b47122691fc860fa2c36da20552bceec9246a
+PKG_SOURCE_VERSION:=lf-6.18.2-1.0.0
+PKG_MIRROR_HASH:=a2f908c2b0a31a728f72ca9b9edb1a349c3f9037d65bed6a8236818a1a243873

 PKG_FLAGS:=nonshared

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=ppfe
-PKG_VERSION:=6.12.20.2.0.0
+PKG_VERSION:=6.18.2.1.0.0
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/nxp-qoriq/qoriq-engine-pfe-bin
-PKG_SOURCE_VERSION:=lf-6.12.20-2.0.0
-PKG_MIRROR_HASH:=57ff6ebc78e774a12f64ac7d4738621edabdeee3a46c6ee69343ba0a8bff73cd
+PKG_SOURCE_VERSION:=lf-6.18.2-1.0.0
+PKG_MIRROR_HASH:=71bed42bc91366967a8efe9343ccecd1cec7d7538a9605f642b24cfd6a4ba07e

 PKG_FLAGS:=nonshared

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=linux-firmware
-PKG_VERSION:=20260519
+PKG_VERSION:=20260622
 PKG_RELEASE:=1

 PKG_SOURCE_URL:=@KERNEL/linux/kernel/firmware
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=b14e7197a290a7e5569f5ef790cde289bddc47e32126f2eb262a8e677fc39727
+PKG_HASH:=2b9d8a358e76eb766588609135e53fa548b902c551daae33ee32f26f25e60dbb

 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>

@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=button-hotplug
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 PKG_LICENSE:=GPL-2.0

 include $(INCLUDE_DIR)/package.mk
@@ -52,13 +52,8 @@ module_param(pcie_switch_exist, bool, 0644);
 MODULE_PARM_DESC(pcie_switch_exist, "pcie switch existed or not");

 static const char dc_ep_driver_name[] = "vrx518";
-static const char dc_ep_driver_version[] = DRV_VERSION;
-static const char dc_ep_driver_string[] =
-			"Intel(R) SmartPHY DSL(VRX518) PCIe EP/ACA Driver";
-static const char dc_ep_copyright[] =
-				"Copyright (c) 2016 Intel Corporation.";

-static struct dc_ep_info g_dc_ep_info;
+static struct dc_ep_info g_dc_ep_info = {};
 static DEFINE_SPINLOCK(dc_ep_lock);

 static inline void reset_assert_device(struct dc_ep_dev *dev, u32 bits)
@@ -729,7 +724,7 @@ static const struct pci_device_id dc_ep_id_table[] = {
 MODULE_DEVICE_TABLE(pci, dc_ep_id_table);

 static struct pci_driver dc_ep_driver = {
-	.name = (char *)dc_ep_driver_name,
+	.name = dc_ep_driver_name,
 	.id_table = dc_ep_id_table,
 	.probe = dc_ep_probe,
 	.remove = dc_ep_remove,
@@ -738,31 +733,7 @@ static struct pci_driver dc_ep_driver = {
 	/* AER is controlled by RC */
 };

-static int __init dc_ep_init(void)
-{
-	pr_info("%s - version %s\n",
-		dc_ep_driver_string, dc_ep_driver_version);
-
-	pr_info("%s\n", dc_ep_copyright);
-	memset(&g_dc_ep_info, 0, sizeof(struct dc_ep_info));
-
-	if (pci_register_driver(&dc_ep_driver) < 0) {
-		pr_err("%s: No devices found, driver not installed.\n",
-			__func__);
-		return -ENODEV;
-	}
-	return 0;
-}
-module_init(dc_ep_init);
-
-static void __exit dc_ep_exit(void)
-{
-	pci_unregister_driver(&dc_ep_driver);
-
-	pr_info("%s: %s driver unloaded\n", __func__,
-		dc_ep_driver_name);
-}
-module_exit(dc_ep_exit);
+module_pci_driver(dc_ep_driver);

 MODULE_AUTHOR("Intel Corporation, <Chuanhua.lei@intel.com>");
 MODULE_DESCRIPTION("Intel(R) SmartPHY PCIe EP/ACA Driver");
@@ -491,14 +491,15 @@ define KernelPackage/fs-nfs-common-rpcsec
  TITLE:=NFS Secure RPC
  DEPENDS:= \
 	+kmod-fs-nfs-common \
-	+kmod-crypto-des \
-	+kmod-crypto-cbc \
-	+kmod-crypto-cts \
-	+kmod-crypto-md5 \
-	+kmod-crypto-sha1 \
+	+kmod-crypto-manager \
+	+kmod-crypto-authenc \
 	+kmod-crypto-hmac \
-	+kmod-crypto-ecb \
-	+kmod-crypto-arc4
+	+kmod-crypto-cmac \
+	+kmod-crypto-sha1 \
+	+kmod-crypto-sha256 \
+	+kmod-crypto-sha512 \
+	+kmod-crypto-cbc \
+	+kmod-crypto-cts
  KCONFIG:= \
 	CONFIG_SUNRPC_GSS \
 	CONFIG_RPCSEC_GSS_KRB5
@@ -512,7 +512,7 @@ define KernelPackage/nf-ipvs-sip
  SUBMENU:=$(NF_MENU)
  TITLE:=Virtual Server SIP protocol support
  KCONFIG:=CONFIG_IP_VS_PE_SIP
-  DEPENDS:=kmod-nf-ipvs +kmod-nf-nathelper-extra
+  DEPENDS:=kmod-nf-ipvs +kmod-nf-nathelper-sip
  FILES:=$(LINUX_DIR)/net/netfilter/ipvs/ip_vs_pe_sip.ko
 endef

@@ -621,30 +621,194 @@ $(eval $(call KernelPackage,nf-nathelper))
 define KernelPackage/nf-nathelper-extra
  SUBMENU:=$(NF_MENU)
  TITLE:=Extra Conntrack and NAT helpers
-  KCONFIG:=$(KCONFIG_NF_NATHELPER_EXTRA)
-  FILES:=$(foreach mod,$(NF_NATHELPER_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
-  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER_EXTRA-m)))
-  DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch +kmod-asn1-decoder
+  DEPENDS:= \
+	+kmod-nf-nathelper-amanda \
+	+kmod-nf-nathelper-broadcast \
+	+kmod-nf-nathelper-h323 \
+	+kmod-nf-nathelper-irc \
+	+kmod-nf-nathelper-netbios \
+	+kmod-nf-nathelper-pptp \
+	+kmod-nf-nathelper-sane \
+	+kmod-nf-nathelper-sip \
+	+kmod-nf-nathelper-snmp \
+	+kmod-nf-nathelper-tftp
 endef

 define KernelPackage/nf-nathelper-extra/description
- Extra Netfilter (IPv4) Conntrack and NAT helpers
- Includes:
+ Compatibility package providing all extra Netfilter
+ conntrack and NAT helpers.
+ This package depends on all individual helper packages:
 - amanda
+ - broadcast
 - h323
 - irc
- - mms
+ - netbios
 - pptp
- - proto_gre
+ - sane
 - sip
- - snmp_basic
+ - snmp
 - tftp
- - broadcast
+ Select individual helper packages instead if only a
+ subset is required.
 endef

 $(eval $(call KernelPackage,nf-nathelper-extra))


+define KernelPackage/nf-nathelper-amanda
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Amanda conntrack and NAT helper
+  KCONFIG:= \
+	CONFIG_NF_CONNTRACK_AMANDA \
+	CONFIG_NF_NAT_AMANDA
+  FILES:= \
+	$(LINUX_DIR)/net/$(P_XT)nf_conntrack_amanda.ko \
+	$(LINUX_DIR)/net/$(P_XT)nf_nat_amanda.ko
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_amanda nf_nat_amanda)
+  DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-amanda))
+
+
+define KernelPackage/nf-nathelper-broadcast
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Broadcast conntrack helper
+  KCONFIG:=CONFIG_NF_CONNTRACK_BROADCAST
+  FILES:= \
+	$(LINUX_DIR)/net/$(P_XT)nf_conntrack_broadcast.ko
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_broadcast)
+  DEPENDS:=+kmod-nf-conntrack
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-broadcast))
+
+
+define KernelPackage/nf-nathelper-h323
+  SUBMENU:=$(NF_MENU)
+  TITLE:=H.323 conntrack and NAT helper
+  KCONFIG:= \
+	CONFIG_NF_CONNTRACK_H323 \
+	CONFIG_NF_NAT_H323
+  FILES:= \
+	$(LINUX_DIR)/net/$(P_XT)nf_conntrack_h323.ko \
+	$(LINUX_DIR)/net/$(P_V4)nf_nat_h323.ko
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_h323 nf_nat_h323)
+  DEPENDS:=+kmod-nf-nat
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-h323))
+
+
+define KernelPackage/nf-nathelper-irc
+  SUBMENU:=$(NF_MENU)
+  TITLE:=IRC conntrack and NAT helper
+  KCONFIG:= \
+	CONFIG_NF_CONNTRACK_IRC \
+	CONFIG_NF_NAT_IRC
+  FILES:= \
+	$(LINUX_DIR)/net/$(P_XT)nf_conntrack_irc.ko \
+	$(LINUX_DIR)/net/$(P_XT)nf_nat_irc.ko
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_irc nf_nat_irc)
+  DEPENDS:=+kmod-nf-nat
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-irc))
+
+
+define KernelPackage/nf-nathelper-netbios
+  SUBMENU:=$(NF_MENU)
+  TITLE:=NetBIOS NS conntrack helper
+  KCONFIG:=CONFIG_NF_CONNTRACK_NETBIOS_NS
+  FILES:= \
+	$(LINUX_DIR)/net/$(P_XT)nf_conntrack_netbios_ns.ko
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_netbios_ns)
+  DEPENDS:=+kmod-nf-conntrack +kmod-nf-nathelper-broadcast
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-netbios))
+
+
+define KernelPackage/nf-nathelper-pptp
+  SUBMENU:=$(NF_MENU)
+  TITLE:=PPTP conntrack and NAT helper
+  KCONFIG:= \
+	CONFIG_NF_CONNTRACK_PPTP \
+	CONFIG_NF_NAT_PPTP
+  FILES:= \
+	$(LINUX_DIR)/net/$(P_XT)nf_conntrack_pptp.ko \
+	$(LINUX_DIR)/net/$(P_V4)nf_nat_pptp.ko
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_pptp nf_nat_pptp)
+  DEPENDS:=+kmod-nf-nat
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-pptp))
+
+
+define KernelPackage/nf-nathelper-sane
+  SUBMENU:=$(NF_MENU)
+  TITLE:=SANE conntrack helper
+  KCONFIG:=CONFIG_NF_CONNTRACK_SANE
+  FILES:= \
+	$(LINUX_DIR)/net/$(P_XT)nf_conntrack_sane.ko
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_sane)
+  DEPENDS:=+kmod-nf-conntrack
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-sane))
+
+
+define KernelPackage/nf-nathelper-sip
+  SUBMENU:=$(NF_MENU)
+  TITLE:=SIP conntrack and NAT helper
+  KCONFIG:= \
+	CONFIG_NF_CONNTRACK_SIP \
+	CONFIG_NF_NAT_SIP
+  FILES:= \
+	$(LINUX_DIR)/net/$(P_XT)nf_conntrack_sip.ko \
+	$(LINUX_DIR)/net/$(P_XT)nf_nat_sip.ko
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_sip nf_nat_sip)
+  DEPENDS:=+kmod-nf-nat
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-sip))
+
+
+define KernelPackage/nf-nathelper-snmp
+  SUBMENU:=$(NF_MENU)
+  TITLE:=SNMP conntrack and NAT helper
+  KCONFIG:= \
+	CONFIG_NF_CONNTRACK_SNMP \
+	CONFIG_NF_NAT_SNMP_BASIC
+  FILES:= \
+	$(LINUX_DIR)/net/$(P_XT)nf_conntrack_snmp.ko \
+	$(LINUX_DIR)/net/$(P_V4)nf_nat_snmp_basic.ko
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_snmp nf_nat_snmp_basic)
+  DEPENDS:= \
+	+kmod-asn1-decoder \
+	+kmod-nf-nat \
+	+kmod-nf-nathelper-broadcast
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-snmp))
+
+
+define KernelPackage/nf-nathelper-tftp
+  SUBMENU:=$(NF_MENU)
+  TITLE:=TFTP conntrack and NAT helper
+  KCONFIG:= \
+	CONFIG_NF_CONNTRACK_TFTP \
+	CONFIG_NF_NAT_TFTP
+  FILES:= \
+	$(LINUX_DIR)/net/$(P_XT)nf_conntrack_tftp.ko \
+	$(LINUX_DIR)/net/$(P_XT)nf_nat_tftp.ko
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_tftp nf_nat_tftp)
+  DEPENDS:=+kmod-nf-nat
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-tftp))
+
+
 define KernelPackage/ipt-nflog
  TITLE:=Module for user-space packet logging
  KCONFIG:=$(KCONFIG_IPT_NFLOG)
@@ -0,0 +1,108 @@
+From 3e14d832e30b10478d2b0945ff2651f6784385a7 Mon Sep 17 00:00:00 2001
+From: Rosen Penev <rosenp@gmail.com>
+Date: Sat, 16 May 2026 16:43:10 -0700
+Subject: [PATCH] wifi: ath9k: Clear DMA descriptors without memset
+
+Clear ath9k DMA descriptors with explicit status word stores instead of
+memset(). The descriptor rings are coherent DMA memory, which may be
+mapped uncached on 32-bit powerpc. The optimized memset() path can use
+dcbz there and trigger an alignment warning.
+
+Use WRITE_ONCE() for the descriptor status words so the compiler keeps
+the clears as ordinary stores instead of folding them back into bulk
+memset(). This covers AR9003 TX status descriptors as well as the RX
+status area cleared when setting up RX descriptors.
+
+Assisted-by: Codex:GPT-5.5
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+---
+ drivers/net/wireless/ath/ath9k/ar9002_mac.c | 15 +++++++++++++-
+ drivers/net/wireless/ath/ath9k/ar9003_mac.c | 23 +++++++++++++++++----
+ 2 files changed, 33 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+@@ -403,6 +403,19 @@ static int ar9002_hw_get_duration(struct
+ 	}
+ }
+ 
+static void ath9k_hw_clear_rxdesc_status(struct ar5416_desc *ads)
+{
+	WRITE_ONCE(ads->u.rx.status0, 0);
+	WRITE_ONCE(ads->u.rx.status1, 0);
+	WRITE_ONCE(ads->u.rx.status2, 0);
+	WRITE_ONCE(ads->u.rx.status3, 0);
+	WRITE_ONCE(ads->u.rx.status4, 0);
+	WRITE_ONCE(ads->u.rx.status5, 0);
+	WRITE_ONCE(ads->u.rx.status6, 0);
+	WRITE_ONCE(ads->u.rx.status7, 0);
+	WRITE_ONCE(ads->u.rx.status8, 0);
+}
+
+ void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
+ 			  u32 size, u32 flags)
+ {
+@@ -412,7 +425,7 @@ void ath9k_hw_setuprxdesc(struct ath_hw
+ 	if (flags & ATH9K_RXDESC_INTREQ)
+ 		ads->ds_ctl1 |= AR_RxIntrReq;
+ 
+-	memset(&ads->u.rx, 0, sizeof(ads->u.rx));
+	ath9k_hw_clear_rxdesc_status(ads);
+ }
+ EXPORT_SYMBOL(ath9k_hw_setuprxdesc);
+ 
+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -352,6 +352,19 @@ static bool ar9003_hw_get_isr(struct ath
+ 	return true;
+ }
+ 
+static void ath9k_hw_clear_txstatus(struct ar9003_txs *ads)
+{
+	WRITE_ONCE(ads->ds_info, 0);
+	WRITE_ONCE(ads->status1, 0);
+	WRITE_ONCE(ads->status2, 0);
+	WRITE_ONCE(ads->status3, 0);
+	WRITE_ONCE(ads->status4, 0);
+	WRITE_ONCE(ads->status5, 0);
+	WRITE_ONCE(ads->status6, 0);
+	WRITE_ONCE(ads->status7, 0);
+	WRITE_ONCE(ads->status8, 0);
+}
+
+ static int ar9003_hw_proc_txdesc(struct ath_hw *ah, void *ds,
+ 				 struct ath_tx_status *ts)
+ {
+@@ -370,7 +383,7 @@ static int ar9003_hw_proc_txdesc(struct
+ 	    (MS(ads->ds_info, AR_TxRxDesc) != 1)) {
+ 		ath_dbg(ath9k_hw_common(ah), XMIT,
+ 			"Tx Descriptor error %x\n", ads->ds_info);
+-		memset(ads, 0, sizeof(*ads));
+		ath9k_hw_clear_txstatus(ads);
+ 		return -EIO;
+ 	}
+ 
+@@ -427,7 +440,7 @@ static int ar9003_hw_proc_txdesc(struct
+ 	ts->ts_rssi_ext1 = MS(status, AR_TxRSSIAnt11);
+ 	ts->ts_rssi_ext2 = MS(status, AR_TxRSSIAnt12);
+ 
+-	memset(ads, 0, sizeof(*ads));
+	ath9k_hw_clear_txstatus(ads);
+ 
+ 	return 0;
+ }
+@@ -591,10 +604,12 @@ EXPORT_SYMBOL(ath9k_hw_process_rxdesc_ed
+ 
+ void ath9k_hw_reset_txstatus_ring(struct ath_hw *ah)
+ {
+	int i;
+
+ 	ah->ts_tail = 0;
+ 
+-	memset((void *) ah->ts_ring, 0,
+-		ah->ts_size * sizeof(struct ar9003_txs));
+	for (i = 0; i < ah->ts_size; i++)
+		ath9k_hw_clear_txstatus(&ah->ts_ring[i]);
+ 
+ 	ath_dbg(ath9k_hw_common(ah), XMIT,
+ 		"TS Start 0x%x End 0x%x Virt %p, Size %d\n",
@@ -0,0 +1,34 @@
+From 0da0cfb0840f7fe7df34bde4f787d3435e3db674 Mon Sep 17 00:00:00 2001
+From: Rosen Penev <rosenp@gmail.com>
+Date: Sat, 16 May 2026 20:28:16 -0700
+Subject: [PATCH] wifi: ath9k: remove TX99 power array zero init
+
+This array is fully initialized in the loop itself. No need to zero
+initialize and then overwrite.
+
+Remove static from the array. This was a holdover from when the array
+was a static global variable. It no longer confers any benefit.
+
+Also add a min() call to avoid the manual if/ternary operation.
+
+Assisted-by: Codex:GPT-5.5
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+---
+ drivers/net/wireless/ath/ath9k/ar9003_phy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1737,10 +1737,10 @@ static void ar9003_hw_tx99_stop(struct a
+ 
+ static void ar9003_hw_tx99_set_txpower(struct ath_hw *ah, u8 txpower)
+ {
+-	static u8 p_pwr_array[ar9300RateSize] = { 0 };
+	u8 p_pwr_array[ar9300RateSize];
+ 	unsigned int i;
+ 
+-	txpower = txpower <= MAX_RATE_POWER ? txpower : MAX_RATE_POWER;
+	txpower = min(txpower, MAX_RATE_POWER);
+ 	for (i = 0; i < ar9300RateSize; i++)
+ 		p_pwr_array[i] = txpower;
+ 
@@ -8,9 +8,9 @@ PKG_LICENSE_FILES:=

 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2026-03-21
-PKG_SOURCE_VERSION:=018f60316d4dd6b4e741874eda40e2dfaa29df3b
-PKG_MIRROR_HASH:=54a8125453a6fe04c89cf5335bdf0ea16c409361e1e5a79fb339d67cee26df0e
+PKG_SOURCE_DATE:=2026-06-23
+PKG_SOURCE_VERSION:=2dd6e4c8892f59b7943ee163afd6ced881bfb31b
+PKG_MIRROR_HASH:=9cd490cc08ccbcdd1476edfefd689d01ba5ef43a4a0cc7e23f13ac3a1e1522c5

 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_USE_NINJA:=0
@@ -1,33 +0,0 @@
-From a95e567eb0e06d460dee234f9c845fbfb215ab11 Mon Sep 17 00:00:00 2001
-From: Mieczyslaw Nalewaj <namiltd@yahoo.com>
-Date: Thu, 29 Jan 2026 16:36:25 +0100
-Subject: [PATCH] wifi: mt76: use hrtimer_setup() in mt76x02u beacon init
-
-Replace the two-step hrtimer initialization pattern with a single
-consolidated call to hrtimer_setup().
-The legacy approach of calling hrtimer_init() followed by manual
-assignment to timer.function is deprecated. The new hrtimer_setup()
-helper atomically initializes the timer and assigns the callback
-function in one operation, eliminating the race-prone intermediate
-state where the timer is initialized but lacks a handler.
-
-Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
---
- mt76x02_usb_core.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mt76x02_usb_core.c b/mt76x02_usb_core.c
-index c94c2f661..3a28a8cc1 100644
--- a/mt76x02_usb_core.c
-+++ b/mt76x02_usb_core.c
-@@ -264,8 +264,8 @@ void mt76x02u_init_beacon_config(struct mt76x02_dev *dev)
- 	};
- 	dev->beacon_ops = &beacon_ops;
- 
-	hrtimer_init(&dev->pre_tbtt_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-	dev->pre_tbtt_timer.function = mt76x02u_pre_tbtt_interrupt;
-+	hrtimer_setup(&dev->pre_tbtt_timer, mt76x02u_pre_tbtt_interrupt, CLOCK_MONOTONIC,
-+		      HRTIMER_MODE_REL);
- 	INIT_WORK(&dev->pre_tbtt_work, mt76x02u_pre_tbtt_work);
- 
- 	mt76x02_init_beacon_config(dev);
@@ -1,26 +0,0 @@
-From: Mieczyslaw Nalewaj <namiltd@yahoo.com>
-Date: Thu, 2 Apr 2026 19:01:10 +0200
-Subject: Subject: [PATCH] mt76: pass LED define via ccflags-y
-
-Replace the deprecated EXTRA_CFLAGS with ccflags-y so that
-the -DCONFIG_MT76_LEDS define is applied correctly by the kernel
-build system. EXTRA_CFLAGS is no longer honored by recent
-kbuilds[1]; ccflags-y is the supported variable and works
-on kernels 6.12 and 6.18.
-
-1. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.18.20&id=f77bf01425b11947eeb3b5b54685212c302741b8
-
-Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
---
- Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
--- a/Makefile
-+++ b/Makefile
-@@ -1,5 +1,5 @@
- # SPDX-License-Identifier: BSD-3-Clause-Clear
-EXTRA_CFLAGS += -Werror -DCONFIG_MT76_LEDS
-+ccflags-y += -Werror -DCONFIG_MT76_LEDS
- obj-m := mt76.o
- obj-$(CONFIG_MT76_USB) += mt76-usb.o
- obj-$(CONFIG_MT76_SDIO) += mt76-sdio.o
@@ -22,7 +22,7 @@ Link: https://github.com/openwrt/mt76/pull/954

 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -93,6 +93,36 @@ mt7996_eeprom_parse_stream(const u8 *eep
+@@ -95,6 +95,36 @@ mt7996_eeprom_parse_stream(const u8 *eep
 	}
 }
 
@@ -59,7 +59,7 @@ Link: https://github.com/openwrt/mt76/pull/954
 static bool mt7996_eeprom_variant_valid(struct mt7996_dev *dev, const u8 *def)
 {
 #define FEM_INT	0
-@@ -148,6 +178,8 @@ mt7996_eeprom_check_or_use_default(struc
+@@ -150,6 +180,8 @@ mt7996_eeprom_check_or_use_default(struc
 		goto out;
 	}
 
@@ -0,0 +1,58 @@
+From 4cfefb927313c389f76adff88f863abefbb040ec Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sat, 27 Jun 2026 00:48:52 +0200
+Subject: [PATCH] Fix mismatched include guards
+
+GCC 15 enables -Wheader-guard and the kernel module build treats it as
+an error, so the mismatched include guards in these headers break the
+build:
+
+  include/rtl8812a_sreset.h:20: error: header guard
+  '_RTL88812A_SRESET_H_' followed by '#define' of a different macro
+  [-Werror=header-guard]
+
+Make each '#ifndef' match its '#define'. rtl8192e_sreset.h was a
+copy/paste of the rtl8812a guard, so give it its own
+'_RTL8192E_SRESET_H_' name instead of duplicating '_RTL8812A_SRESET_H_'.
+
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ include/custom_gpio.h     | 2 +-
+ include/rtl8192e_sreset.h | 4 ++--
+ include/rtl8812a_sreset.h | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/include/custom_gpio.h
+++ b/include/custom_gpio.h
+@@ -1,5 +1,5 @@
+ #ifndef __CUSTOM_GPIO_H__
+-#define __CUSTOM_GPIO_H___
+#define __CUSTOM_GPIO_H__
+ 
+ #include <drv_conf.h>
+ #include <osdep_service.h>
+--- a/include/rtl8192e_sreset.h
+++ b/include/rtl8192e_sreset.h
+@@ -17,8 +17,8 @@
+  *
+  *
+  ******************************************************************************/
+-#ifndef _RTL88812A_SRESET_H_
+-#define _RTL8812A_SRESET_H_
+#ifndef _RTL8192E_SRESET_H_
+#define _RTL8192E_SRESET_H_
+ 
+ #include <rtw_sreset.h>
+ 
+--- a/include/rtl8812a_sreset.h
+++ b/include/rtl8812a_sreset.h
+@@ -17,7 +17,7 @@
+  *
+  *
+  ******************************************************************************/
+-#ifndef _RTL88812A_SRESET_H_
+#ifndef _RTL8812A_SRESET_H_
+ #define _RTL8812A_SRESET_H_
+ 
+ #include <rtw_sreset.h>
@@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=elfutils
-PKG_VERSION:=0.192
-PKG_RELEASE:=2
+PKG_VERSION:=0.195
+PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://sourceware.org/$(PKG_NAME)/ftp/$(PKG_VERSION) \
                https://mirrors.kernel.org/sourceware/$(PKG_NAME)/$(PKG_VERSION)
-PKG_HASH:=616099beae24aba11f9b63d86ca6cc8d566d968b802391334c91df54eab416b4
+PKG_HASH:=37629fdf7f1f3dc2818e138fca2b8094177d6c2d0f701d3bb650a561218dc026

 PKG_MAINTAINER:=Luiz Angelo Daros de Luca <luizluca@gmail.com>
 PKG_LICENSE:=GPL-2.0-or-later LGPL-3.0-or-later
@@ -11,7 +11,7 @@
 Requires.private: zlib @LIBZSTD@
 --- a/configure.ac
 +++ b/configure.ac
-@@ -728,6 +728,9 @@ dnl AM_GNU_GETTEXT_REQUIRE_VERSION suppo
+@@ -788,6 +788,9 @@ dnl AM_GNU_GETTEXT_REQUIRE_VERSION suppo
 AM_GNU_GETTEXT_VERSION([0.19.6])
 AM_GNU_GETTEXT_REQUIRE_VERSION([0.19.6])
 
@@ -1,11 +1,11 @@
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -27,7 +27,7 @@ AM_MAKEFLAGS = --no-print-directory
+@@ -29,7 +29,7 @@ AM_MAKEFLAGS = --no-print-directory
 pkginclude_HEADERS = version.h
 
- SUBDIRS = config lib libelf libcpu backends libebl libdwelf libdwfl libdw \
-	  libasm debuginfod src po doc tests
-+	  libasm
+ SUBDIRS = config lib libelf libcpu backends libebl libdwelf libdwfl \
+-	  libdwfl_stacktrace libdw libasm debuginfod src po doc tests
+	  libdwfl_stacktrace libdw libasm
 
 EXTRA_DIST = elfutils.spec GPG-KEY NOTES CONTRIBUTING SECURITY \
 	     COPYING COPYING-GPLV2 COPYING-LGPLV3 CONDUCT
@@ -33,7 +33,7 @@ Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
 # include <sys/user.h>
 # include <sys/ptrace.h>
 # include <asm/ptrace.h>
-@@ -94,7 +94,7 @@ aarch64_set_initial_registers_tid (pid_t
+@@ -115,7 +115,7 @@ aarch64_set_initial_registers_tid (pid_t
 
   Dwarf_Word dwarf_fregs[32];
   for (int r = 0; r < 32; r++)
@@ -1,31 +0,0 @@
-From f5d6e088f84dd05278c4698a21cbf1ff4569978d Mon Sep 17 00:00:00 2001
-From: Mark Wielaard <mark@klomp.org>
-Date: Tue, 22 Oct 2024 15:03:42 +0200
-Subject: [PATCH] libelf: Add libeu objects to libelf.a static archive
-
-libelf might use some symbols from libeu.a, specifically the eu-search
-wrappers. But we don't ship libeu.a separately. So include the libeu
-objects in the libelf.a archive to facilitate static linking.
-
-	* libelf/Makefile.am (libeu_objects): New variable.
-	(libelf_a_LIBADD): New, add libeu_objects.
-
-https://sourceware.org/bugzilla/show_bug.cgi?id=32293
-
-Signed-off-by: Mark Wielaard <mark@klomp.org>
---
- libelf/Makefile.am | 3 +++
- 1 file changed, 3 insertions(+)
-
--- a/libelf/Makefile.am
-+++ b/libelf/Makefile.am
-@@ -122,6 +122,9 @@ libelf.so: $(srcdir)/libelf.map $(libelf
- 	@$(textrel_check)
- 	$(AM_V_at)ln -fs $@ $@.$(VERSION)
- 
-+libeu_objects = $(shell $(AR) t ../lib/libeu.a)
-+libelf_a_LIBADD = $(addprefix ../lib/,$(libeu_objects))
-+
- install: install-am libelf.so
- 	$(mkinstalldirs) $(DESTDIR)$(libdir)
- 	$(INSTALL_PROGRAM) libelf.so $(DESTDIR)$(libdir)/libelf-$(PACKAGE_VERSION).so
@@ -1,24 +0,0 @@
-From f3c664d069d81a4872a1ec8241ee709f37c53e9c Mon Sep 17 00:00:00 2001
-From: Aaron Merey <amerey@redhat.com>
-Date: Tue, 29 Oct 2024 14:16:57 -0400
-Subject: [PATCH] configure.ac: Fix ENABLE_IMA_VERIFICATION conditional
-
-Fix test statement for ENABLE_IMA_VERIFICATION always evalutating to
-false due to a missing 'x'.
-
-Signed-off-by: Aaron Merey <amerey@redhat.com>
---
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
--- a/configure.ac
-+++ b/configure.ac
-@@ -895,7 +895,7 @@ AS_IF([test "x$enable_debuginfod" != "xn
- AM_CONDITIONAL([DEBUGINFOD],[test "x$enable_debuginfod" = "xyes"])
- AS_IF([test "x$enable_debuginfod_ima_verification" = "xyes"],AC_DEFINE([ENABLE_IMA_VERIFICATION],[1],[Build IMA verification]))
- AS_IF([test "x$have_libarchive" = "xyes"],AC_DEFINE([HAVE_LIBARCHIVE],[1],[Define to 1 if libarchive is available]))
-AM_CONDITIONAL([ENABLE_IMA_VERIFICATION],[test "$enable_debuginfod_ima_verification" = "xyes"])
-+AM_CONDITIONAL([ENABLE_IMA_VERIFICATION],[test "x$enable_debuginfod_ima_verification" = "xyes"])
- AM_CONDITIONAL([OLD_LIBMICROHTTPD],[test "x$old_libmicrohttpd" = "xyes"])
- 
- dnl for /etc/profile.d/elfutils.{csh,sh}
@@ -1,193 +0,0 @@
-From 8707194a9f2f0b13e53041b03ebfdbdbd2942e43 Mon Sep 17 00:00:00 2001
-From: Mark Wielaard <mark@klomp.org>
-Date: Tue, 5 Nov 2024 23:31:14 +0100
-Subject: [PATCH 1/1] libelf: Only fetch shdr once in elf_compress[_gnu]
-
-Some compilers assume the second call to elf[32|64]_getshdr can fail
-and produce error: potential null pointer dereference. Just store the
-result of the first call and reuse (when not NULL).
-
-       * libelf/elf_compress.c (elf_compress): Store getshdr result in
-       a shdr union var.
-       * libelf/elf_compress_gnu.c (): Likewise
-
-https://sourceware.org/bugzilla/show_bug.cgi?id=32311
-
-Signed-off-by: Mark Wielaard <mark@klomp.org>
---
- libelf/elf_compress.c     | 55 +++++++++++++++++++++------------------
- libelf/elf_compress_gnu.c | 45 ++++++++++++++------------------
- 2 files changed, 48 insertions(+), 52 deletions(-)
-
--- a/libelf/elf_compress.c
-+++ b/libelf/elf_compress.c
-@@ -584,25 +584,30 @@ elf_compress (Elf_Scn *scn, int type, un
-   Elf64_Xword sh_flags;
-   Elf64_Word sh_type;
-   Elf64_Xword sh_addralign;
-+  union shdr
-+  {
-+    Elf32_Shdr *s32;
-+    Elf64_Shdr *s64;
-+  } shdr;
-   if (elfclass == ELFCLASS32)
-     {
-      Elf32_Shdr *shdr = elf32_getshdr (scn);
-      if (shdr == NULL)
-+      shdr.s32 = elf32_getshdr (scn);
-+      if (shdr.s32 == NULL)
- 	return -1;
- 
-      sh_flags = shdr->sh_flags;
-      sh_type = shdr->sh_type;
-      sh_addralign = shdr->sh_addralign;
-+      sh_flags = shdr.s32->sh_flags;
-+      sh_type = shdr.s32->sh_type;
-+      sh_addralign = shdr.s32->sh_addralign;
-     }
-   else
-     {
-      Elf64_Shdr *shdr = elf64_getshdr (scn);
-      if (shdr == NULL)
-+      shdr.s64 = elf64_getshdr (scn);
-+      if (shdr.s64 == NULL)
- 	return -1;
- 
-      sh_flags = shdr->sh_flags;
-      sh_type = shdr->sh_type;
-      sh_addralign = shdr->sh_addralign;
-+      sh_flags = shdr.s64->sh_flags;
-+      sh_type = shdr.s64->sh_type;
-+      sh_addralign = shdr.s64->sh_addralign;
-     }
- 
-   if ((sh_flags & SHF_ALLOC) != 0)
-@@ -679,17 +684,17 @@ elf_compress (Elf_Scn *scn, int type, un
- 	 correctly and ignored when SHF_COMPRESSED is set.  */
-       if (elfclass == ELFCLASS32)
- 	{
-	  Elf32_Shdr *shdr = elf32_getshdr (scn);
-	  shdr->sh_size = new_size;
-	  shdr->sh_addralign = __libelf_type_align (ELFCLASS32, ELF_T_CHDR);
-	  shdr->sh_flags |= SHF_COMPRESSED;
-+	  shdr.s32->sh_size = new_size;
-+	  shdr.s32->sh_addralign = __libelf_type_align (ELFCLASS32,
-+							ELF_T_CHDR);
-+	  shdr.s32->sh_flags |= SHF_COMPRESSED;
- 	}
-       else
- 	{
-	  Elf64_Shdr *shdr = elf64_getshdr (scn);
-	  shdr->sh_size = new_size;
-	  shdr->sh_addralign = __libelf_type_align (ELFCLASS64, ELF_T_CHDR);
-	  shdr->sh_flags |= SHF_COMPRESSED;
-+	  shdr.s64->sh_size = new_size;
-+	  shdr.s64->sh_addralign = __libelf_type_align (ELFCLASS64,
-+							ELF_T_CHDR);
-+	  shdr.s64->sh_flags |= SHF_COMPRESSED;
- 	}
- 
-       __libelf_reset_rawdata (scn, out_buf, new_size, 1, ELF_T_CHDR);
-@@ -731,17 +736,15 @@ elf_compress (Elf_Scn *scn, int type, un
- 	 correctly and ignored when SHF_COMPRESSED is set.  */
-       if (elfclass == ELFCLASS32)
- 	{
-	  Elf32_Shdr *shdr = elf32_getshdr (scn);
-	  shdr->sh_size = scn->zdata_size;
-	  shdr->sh_addralign = scn->zdata_align;
-	  shdr->sh_flags &= ~SHF_COMPRESSED;
-+	  shdr.s32->sh_size = scn->zdata_size;
-+	  shdr.s32->sh_addralign = scn->zdata_align;
-+	  shdr.s32->sh_flags &= ~SHF_COMPRESSED;
- 	}
-       else
- 	{
-	  Elf64_Shdr *shdr = elf64_getshdr (scn);
-	  shdr->sh_size = scn->zdata_size;
-	  shdr->sh_addralign = scn->zdata_align;
-	  shdr->sh_flags &= ~SHF_COMPRESSED;
-+	  shdr.s64->sh_size = scn->zdata_size;
-+	  shdr.s64->sh_addralign = scn->zdata_align;
-+	  shdr.s64->sh_flags &= ~SHF_COMPRESSED;
- 	}
- 
-       __libelf_reset_rawdata (scn, scn->zdata_base,
--- a/libelf/elf_compress_gnu.c
-+++ b/libelf/elf_compress_gnu.c
-@@ -59,25 +59,30 @@ elf_compress_gnu (Elf_Scn *scn, int infl
-   Elf64_Xword sh_flags;
-   Elf64_Word sh_type;
-   Elf64_Xword sh_addralign;
-+  union shdr
-+  {
-+    Elf32_Shdr *s32;
-+    Elf64_Shdr *s64;
-+  } shdr;
-   if (elfclass == ELFCLASS32)
-     {
-      Elf32_Shdr *shdr = elf32_getshdr (scn);
-      if (shdr == NULL)
-+      shdr.s32 = elf32_getshdr (scn);
-+      if (shdr.s32 == NULL)
- 	return -1;
- 
-      sh_flags = shdr->sh_flags;
-      sh_type = shdr->sh_type;
-      sh_addralign = shdr->sh_addralign;
-+      sh_flags = shdr.s32->sh_flags;
-+      sh_type = shdr.s32->sh_type;
-+      sh_addralign = shdr.s32->sh_addralign;
-     }
-   else
-     {
-      Elf64_Shdr *shdr = elf64_getshdr (scn);
-      if (shdr == NULL)
-+      shdr.s64 = elf64_getshdr (scn);
-+      if (shdr.s64 == NULL)
- 	return -1;
- 
-      sh_flags = shdr->sh_flags;
-      sh_type = shdr->sh_type;
-      sh_addralign = shdr->sh_addralign;
-+      sh_flags = shdr.s64->sh_flags;
-+      sh_type = shdr.s64->sh_type;
-+      sh_addralign = shdr.s64->sh_addralign;
-     }
- 
-   /* Allocated sections, or sections that are already are compressed
-@@ -122,15 +127,9 @@ elf_compress_gnu (Elf_Scn *scn, int infl
- 	 sh_flags won't have a SHF_COMPRESSED hint in the GNU format.
- 	 Just adjust the sh_size.  */
-       if (elfclass == ELFCLASS32)
-	{
-	  Elf32_Shdr *shdr = elf32_getshdr (scn);
-	  shdr->sh_size = new_size;
-	}
-+	  shdr.s32->sh_size = new_size;
-       else
-	{
-	  Elf64_Shdr *shdr = elf64_getshdr (scn);
-	  shdr->sh_size = new_size;
-	}
-+	  shdr.s64->sh_size = new_size;
- 
-       __libelf_reset_rawdata (scn, out_buf, new_size, 1, ELF_T_BYTE);
- 
-@@ -187,15 +186,9 @@ elf_compress_gnu (Elf_Scn *scn, int infl
- 	 sh_flags won't have a SHF_COMPRESSED hint in the GNU format.
- 	 Just adjust the sh_size.  */
-       if (elfclass == ELFCLASS32)
-	{
-	  Elf32_Shdr *shdr = elf32_getshdr (scn);
-	  shdr->sh_size = size;
-	}
-+	shdr.s32->sh_size = size;
-       else
-	{
-	  Elf64_Shdr *shdr = elf64_getshdr (scn);
-	  shdr->sh_size = size;
-	}
-+	shdr.s64->sh_size = size;
- 
-       __libelf_reset_rawdata (scn, buf_out, size, sh_addralign,
- 			      __libelf_data_type (&ehdr, sh_type,
@@ -72,7 +72,7 @@
 	struct parse_opt *opt = state->hook;
 --- a/libdwfl/Makefile.am
 +++ b/libdwfl/Makefile.am
-@@ -50,7 +50,7 @@ libdwfl_a_SOURCES = dwfl_begin.c dwfl_en
+@@ -51,7 +51,7 @@ libdwfl_a_SOURCES = dwfl_begin.c dwfl_en
 		    argp-std.c find-debuginfo.c \
 		    dwfl_build_id_find_elf.c \
 		    dwfl_build_id_find_debuginfo.c \
@@ -1,55 +0,0 @@
-strip.c: Pointer `arhdr` created at strip.c:2741 and then dereferenced without NULL-check.
-The same situation for the `arhdr` pointer at the objdump.c:313 and
-the `h` pointer at the readelf.c:13545.
-
-Triggers found by static analyzer Svace.
-
-Signed-off-by: Maks Mishin <maks.mishinFZ@gmail.com>
---
- src/objdump.c | 5 +++++
- src/readelf.c | 5 +++++
- src/strip.c   | 5 +++++
- 3 files changed, 15 insertions(+)
-
--- a/src/objdump.c
-+++ b/src/objdump.c
-@@ -311,6 +311,11 @@ handle_ar (int fd, Elf *elf, const char
-     {
-       /* The the header for this element.  */
-       Elf_Arhdr *arhdr = elf_getarhdr (subelf);
-+      if (arhdr == NULL)
-+	{
-+	  printf ("cannot get arhdr: %s\n", elf_errmsg (-1));
-+	  exit (1);
-+	}
- 
-       /* Skip over the index entries.  */
-       if (strcmp (arhdr->ar_name, "/") != 0
--- a/src/readelf.c
-+++ b/src/readelf.c
-@@ -13543,6 +13543,11 @@ dump_archive_index (Elf *elf, const char
- 			  as_off, fname, elf_errmsg (-1));
- 
- 	  const Elf_Arhdr *h = elf_getarhdr (subelf);
-+	  if (h == NULL)
-+	{
-+	  printf ("cannot get arhdr: %s\n", elf_errmsg (-1));
-+	  exit (1);
-+	}
- 
- 	  printf (_("Archive member '%s' contains:\n"), h->ar_name);
- 
--- a/src/strip.c
-+++ b/src/strip.c
-@@ -2739,6 +2739,11 @@ handle_ar (int fd, Elf *elf, const char
-     {
-       /* The the header for this element.  */
-       Elf_Arhdr *arhdr = elf_getarhdr (subelf);
-+	  if (arhdr == NULL)
-+	{
-+	  printf ("cannot get arhdr: %s\n", elf_errmsg (-1));
-+	  exit (1);
-+	}
- 
-       if (elf_kind (subelf) == ELF_K_ELF)
- 	result |= handle_elf (fd, subelf, new_prefix, arhdr->ar_name, 0, NULL);
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=openssl
-PKG_VERSION:=3.5.6
+PKG_VERSION:=3.5.7
 PKG_RELEASE:=1
 PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto

@@ -21,7 +21,7 @@ PKG_SOURCE_URL:= \
 	https://www.openssl.org/source/old/$(PKG_BASE)/ \
 	https://github.com/openssl/openssl/releases/download/$(PKG_NAME)-$(PKG_VERSION)/

-PKG_HASH:=deae7c80cba99c4b4f940ecadb3c3338b13cb77418409238e57d7f31f2a3b736
+PKG_HASH:=a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8

 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE.txt
@@ -10,7 +10,7 @@ Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

 --- a/Configure
 +++ b/Configure
-@@ -1811,7 +1811,9 @@ $config{CFLAGS} = [ map { $_ eq '--ossl-
+@@ -1816,7 +1816,9 @@ $config{CFLAGS} = [ map { $_ eq '--ossl-
 
 unless ($disabled{afalgeng}) {
     $config{afalgeng}="";
@@ -16,7 +16,7 @@ Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

 --- a/ssl/ssl_ciph.c
 +++ b/ssl/ssl_ciph.c
-@@ -1471,11 +1471,29 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+@@ -1475,11 +1475,29 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
     ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head,
         &tail);
 
@@ -46,7 +46,7 @@ Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
 
     /*
      * ...and generally, our preferred cipher is AES.
-@@ -1530,7 +1548,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+@@ -1534,7 +1552,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
      * Within each group, ciphers remain sorted by strength and previous
      * preference, i.e.,
      * 1) ECDHE > DHE
@@ -55,7 +55,7 @@ Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
      * 3) AES > rest
      * 4) TLS 1.2 > legacy
      *
-@@ -2232,7 +2250,13 @@ const char *OSSL_default_cipher_list(voi
+@@ -2236,7 +2254,13 @@ const char *OSSL_default_cipher_list(voi
  */
 const char *OSSL_default_ciphersuites(void)
 {
@@ -5,9 +5,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/netifd.git
-PKG_SOURCE_DATE:=2026-04-23
-PKG_SOURCE_VERSION:=e45b890fa532bb89380b78008c2cc70bfad2c4c7
-PKG_MIRROR_HASH:=bf318b9905ca2a63a8bb834d356bef3eec031acc843ba0137495708090894f75
+PKG_SOURCE_DATE:=2026-06-16
+PKG_SOURCE_VERSION:=d155e4cefbd964b7c022618c1d74b549de25e8a8
+PKG_MIRROR_HASH:=a9b9cf01e800ac072a353a6c7f7c7854b5b9139b336645b50cc21c5b8ef38390
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>

 PKG_LICENSE:=GPL-2.0
@@ -10,6 +10,7 @@ init_proto "$@"

 proto_dhcp_init_config() {
 	renew_handler=1
+	restart_handler=1

 	proto_config_add_string 'ipaddr:ipaddr'
 	proto_config_add_string 'hostname:hostname'
@@ -27,6 +28,9 @@ proto_dhcp_init_config() {
 	proto_config_add_string mtu6rd
 	proto_config_add_string customroutes
 	proto_config_add_boolean classlessroute
+	proto_config_add_int timeout
+	proto_config_add_int retry
+	proto_config_add_int tryagain
 }

 proto_dhcp_add_sendopts() {
@@ -54,8 +58,8 @@ proto_dhcp_setup() {
 	local config="$1"
 	local iface="$2"

-	local ipaddr hostname clientid vendorid broadcast norelease reqopts defaultreqopts iface6rd sendopts delegate zone6rd zone mtu6rd customroutes classlessroute
-	json_get_vars ipaddr hostname clientid vendorid broadcast norelease reqopts defaultreqopts iface6rd delegate zone6rd zone mtu6rd customroutes classlessroute
+	local ipaddr hostname clientid vendorid broadcast norelease reqopts defaultreqopts iface6rd sendopts delegate zone6rd zone mtu6rd customroutes classlessroute timeout retry tryagain
+	json_get_vars ipaddr hostname clientid vendorid broadcast norelease reqopts defaultreqopts iface6rd delegate zone6rd zone mtu6rd customroutes classlessroute timeout retry tryagain

 	local opt dhcpopts
 	for opt in $reqopts; do
@@ -101,7 +105,9 @@ proto_dhcp_setup() {
 	proto_run_command "$config" udhcpc \
 		-p /var/run/udhcpc-$iface.pid \
 		-s /lib/netifd/dhcp.script \
-		-f -t 0 -i "$iface" \
+		-f -t "${retry:-0}" -i "$iface" \
+		${timeout:+-T "$timeout"} \
+		${tryagain:+-A "$tryagain"} \
 		${ipaddr:+-r ${ipaddr/\/*/}} \
 		${hostname:+-x "hostname:$hostname"} \
 		${emptyvendorid:+-V ""} \
@@ -115,6 +121,15 @@ proto_dhcp_renew() {
 	[ -n "$sigusr1" ] && proto_kill_command "$interface" $sigusr1
 }

+proto_dhcp_restart() {
+	local interface="$1"
+	# SIGHUP asks a patched udhcpc to release the current lease and
+	# immediately re-enter INIT_SELECTING so a fresh DHCPDISCOVER goes
+	# out. Requires the matching busybox udhcpc patch.
+	local sighup="$(kill -l SIGHUP)"
+	[ -n "$sighup" ] && proto_kill_command "$interface" $sighup
+}
+
 proto_dhcp_teardown() {
 	local interface="$1"
 	proto_kill_command "$interface"
@@ -95,23 +95,32 @@ function print_scan(cells) {
 		
 		if (cell.vht) {
 			printf('\t  VHT Operation:\n');
-			printf('\t\tCenter Frequency 1: %d\n', cell.vht.center_chan_1);
-			printf('\t\tCenter Frequency 2: %s\n', cell.vht.center_chan_2);
-			printf('\t\tChannel Width: %s\n', cell.vht.chan_width);
+			if (cell.vht.center_chan_1)
+				printf('\t\tCenter Frequency 1: %d\n', cell.vht.center_chan_1);
+			if (cell.vht.center_chan_2)
+				printf('\t\tCenter Frequency 2: %d\n', cell.vht.center_chan_2);
+			if (cell.vht.chan_width)
+				printf('\t\tChannel Width: %s\n', cell.vht.chan_width);
 		}

 		if (cell.he) {
 			printf('\t  HE Operation:\n');
-			printf('\t\tCenter Frequency 1: %d\n', cell.he.center_chan_1);
-			printf('\t\tCenter Frequency 2: %s\n', cell.he.center_chan_2);
-			printf('\t\tChannel Width: %s\n', cell.he.chan_width);
+			if (cell.he.center_chan_1)
+				printf('\t\tCenter Frequency 1: %d\n', cell.he.center_chan_1);
+			if (cell.he.center_chan_2)
+				printf('\t\tCenter Frequency 2: %d\n', cell.he.center_chan_2);
+			if (cell.he.chan_width)
+				printf('\t\tChannel Width: %s\n', cell.he.chan_width);
 		}

 		if (cell.eht) {
 			printf('\t  EHT Operation:\n');
-			printf('\t\tCenter Frequency 1: %d\n', cell.eht.center_chan_1);
-			printf('\t\tCenter Frequency 2: %s\n', cell.eht.center_chan_2);
-			printf('\t\tChannel Width: %s\n', cell.eht.chan_width);
+			if (cell.eht.center_chan_1)
+				printf('\t\tCenter Frequency 1: %d\n', cell.eht.center_chan_1);
+			if (cell.eht.center_chan_2)
+				printf('\t\tCenter Frequency 2: %d\n', cell.eht.center_chan_2);
+			if (cell.eht.chan_width)
+				printf('\t\tChannel Width: %s\n', cell.eht.chan_width);
 		}

 		printf('\n'); 
@@ -370,6 +370,7 @@ export function assoclist(dev) {
 				flags: assoc_flags(station.sta_info.tx_bitrate ?? {}),
 			},
 			expected_throughput: format_expected_throughput(station.sta_info.expected_throughput ?? 0),
+			connected_time: station.sta_info.connected_time ?? 0,
 		};
 		ret[sta.mac] = sta;
 	}
@@ -533,22 +534,27 @@ function scan_extension(ext, cell) {

 	switch(ord(ext, 0)) {
 	case 36:
-		let offset = 7;
+		cell.he = {};

-		if (!(ord(ext, 3) & 0x2))
-			break;
+		if (cell.band == '6') {
+			let offset = 7;

-		if (ord(ext, 2) & 0x40)
-			offset += 3;
+			if (ord(ext, 2) & 0x40)
+				offset += 3;

-		if (ord(ext, 2) & 0x80)
-			offset += 1;
+			if (ord(ext, 2) & 0x80)
+				offset += 1;

-		cell.he = {
-			chan_width: eht_chan_width[ord(ext, offset + 1) & 0x3],
-			center_chan_1: ord(ext, offset + 2),
-			center_chan_2: ord(ext, offset + 3),
-		};
+			cell.he.chan_width = eht_chan_width[ord(ext, offset + 1) & 0x3];
+			cell.he.center_chan_1 = ord(ext, offset + 2);
+			cell.he.center_chan_2 = ord(ext, offset + 3);
+		} else if (cell.vht) {
+			cell.he.chan_width = cell.vht.chan_width;
+			cell.he.center_chan_1 = cell.vht.center_chan_1;
+			cell.he.center_chan_2 = cell.vht.center_chan_2;
+		} else if (cell.ht) {
+			cell.he.chan_width = cell.ht.chan_width;
+		}
 		break;

 	case 106:
@@ -155,11 +155,16 @@ function setup_sta(data, config) {
 		if (config.ca_cert_usesystem && fs.stat('/etc/ssl/certs/ca-certificates.crt'))
 			config.ca_cert = '/etc/ssl/certs/ca-certificates.crt';

+		const eap_method_map = { fast: 'FAST', peap: 'PEAP', ttls: 'TTLS', tls: 'TLS' };
+		if (eap_method_map[config.eap_type])
+			config.eap = eap_method_map[config.eap_type];
+
 		switch(config.eap_type) {
 		case 'fast':
 		case 'peap':
 		case 'ttls':
 			set_default(config, 'auth', 'MSCHAPV2');
+			config.phase2 = `"auth=${config.auth}"`;
 			if (config.auth == 'EAP-TLS') {
 				if (config.ca_cert2_usesystem && fs.stat('/etc/ssl/certs/ca-certificates.crt'))
 					config.ca_cert2 = '/etc/ssl/certs/ca-certificates.crt';
@@ -205,7 +210,7 @@ function setup_sta(data, config) {
 		'disable_ht', 'disable_ht40', 'disable_vht', 'vht', 'max_oper_chwidth',
 		'ht40', 'beacon_int', 'ieee80211w', 'rates', 'mesh_basic_rates', 'mcast_rate',
 		'altsubject_match', 'domain_match', 'domain_suffix_match',
-		'bssid_blacklist', 'bssid_whitelist', 'erp',
+		'bssid_blacklist', 'bssid_whitelist', 'erp', 'eap', 'phase2',
 		'dpp_connector', 'dpp_csign', 'dpp_netaccesskey',
 	]);
 }
@@ -353,7 +353,7 @@ function wdev_update_disabled_vifs(wdev)

 		let name = vif.name;
 		if (enabled == false)
-			disabled[wdev] = true;
+			disabled[name] = true;
 		else if (ifindex != cache[name])
 			changed = true;

@@ -12,9 +12,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/odhcp6c.git
-PKG_SOURCE_DATE:=2026-06-04
-PKG_SOURCE_VERSION:=daf4ec3054e753c99fdcc3ac5464926548b38351
-PKG_MIRROR_HASH:=a6239fde325f4815d186bde99e30f95877e58b03fa4fab25013a769127ce3369
+PKG_SOURCE_DATE:=2026-06-27
+PKG_SOURCE_VERSION:=10a52220aec9d45803518d8cc4d63e552484ed61
+PKG_MIRROR_HASH:=2194569b6899febaa70070e19b9849737952e2f96edf02d3bd504c6e76160ce4

 PKG_MAINTAINER:=Álvaro Fernández Rojas <noltari@gmail.com>
 PKG_LICENSE:=GPL-2.0
@@ -1,6 +1,7 @@
 #!/bin/sh

 . /lib/functions.sh
+. /lib/functions/network.sh
 . ../netifd-proto.sh
 . /lib/config/uci.sh
 init_proto "$@"
@@ -9,7 +10,7 @@ proto_dhcpv6_init_config() {
 	renew_handler=1

 	proto_config_add_string 'reqaddress:or("try","force","none")'
-	proto_config_add_string 'reqprefix:or("auto","no",range(0, 64))'
+	proto_config_add_string reqprefix
 	proto_config_add_string clientid
 	proto_config_add_string 'reqopts:list(uinteger)'
 	proto_config_add_string 'defaultreqopts:bool'
@@ -85,7 +86,25 @@ proto_dhcpv6_setup() {
 	[ -n "$reqaddress" ] && append opts "-N$reqaddress"

 	[ -z "$reqprefix" -o "$reqprefix" = "auto" ] && reqprefix=0
-	[ "$reqprefix" != "no" ] && append opts "-P$reqprefix"
+	[ "$reqprefix" != "no" ] && {
+		# append interface IAID if none specified
+		local iaid=$(echo -n $reqprefix | sed -nr 's/^.*:([0-9A-Fa-f]{1,8})$/\1/p')
+		[ -z "$iaid" ] && {
+			network_generate_iface_iaid iaid "$iface"
+			reqprefix="$reqprefix:$iaid"
+		}
+		# validate prefix/length hint
+		local hint=${reqprefix%:$iaid}
+		[ "${hint#/}" -le "128" ] 2>/dev/null && {
+			reqprefix=${reqprefix#/}
+		} || {
+			validate_data cidr6 "$hint" 2>/dev/null || {
+				reqprefix="0:$iaid"
+				logger -p warn -t dhcpv6 "$iface: ignoring invalid prefix hint"
+			}
+		}
+		append opts "-P$reqprefix"
+	}

 	[ -n "$clientid" ] && {
 		clientid="$(hexdump_2hex "$clientid")"
@@ -0,0 +1,37 @@
+From 0f6e30c03a093bba52f16570635b9f778925f2d7 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sat, 27 Jun 2026 00:34:23 +0200
+Subject: [PATCH] Fix thc_open_ipv6() prototype for GCC 15 / C23
+
+GCC 15 defaults to C23, where an empty parameter list "()" means
+"(void)" instead of an unspecified argument list. thc-ipv6.h declared
+
+    extern int thc_open_ipv6();
+
+so the prototype became "int(void)" and clashed with the actual
+definition "int thc_open_ipv6(char *interface)" and all of its callers:
+
+    thc-ipv6-lib.c:127: error: too many arguments to function
+    'thc_open_ipv6'; expected 0, have 1
+    thc-ipv6-lib.c:2555: error: conflicting types for 'thc_open_ipv6';
+    have 'int(char *)'
+
+Give the prototype its real signature.
+
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ thc-ipv6.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/thc-ipv6.h
+++ b/thc-ipv6.h
+@@ -208,7 +208,7 @@ extern int thc_generate_pkt(char *interf
+                             int *pkt_len);
+ extern int thc_send_pkt(char *interface, unsigned char *pkt, int *pkt_len);
+ extern unsigned char *thc_destroy_packet(unsigned char *pkt);
+-extern int            thc_open_ipv6();
+extern int            thc_open_ipv6(char *interface);
+ extern int            thc_is_dst_local(char *interface, unsigned char *dst);
+ extern int  checksum_pseudo_header(unsigned char *src, unsigned char *dst,
+                                    unsigned char type, unsigned char *data,
@@ -0,0 +1,55 @@
+From 1e48ae83dddaca892d78025fdd1d3fe6652c8522 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sat, 27 Jun 2026 02:24:41 +0200
+Subject: [PATCH] Fix signal handler prototypes for GCC 15 / C23
+
+GCC 15 defaults to C23, where an empty parameter list "()" means
+"(void)" instead of an unspecified argument list. The alarming() SIGALRM
+handlers in detect_sniffer6.c and thcping6.c were declared with "()", so
+their type became "void (*)(void)" and no longer matched the
+"void (*)(int)" expected by signal():
+
+    detect_sniffer6.c:140:19: error: passing argument 2 of 'signal' from
+    incompatible pointer type [-Wincompatible-pointer-types]
+
+Give them the proper signal handler signature. Also pass an argument to
+the direct alarming() call in detect_sniffer6.c.
+
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ detect_sniffer6.c | 4 ++--
+ thcping6.c        | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/detect_sniffer6.c
+++ b/detect_sniffer6.c
+@@ -27,7 +27,7 @@ void help(char *prg) {
+   exit(-1);
+ }
+ 
+-void alarming() {
+void alarming(int sig) {
+   if (found == 0)
+     printf("No packets received, no vulnerable system seems to be sniffing.\n");
+   else
+@@ -63,7 +63,7 @@ void check_packets(u_char *pingdata, con
+       printf(" Sniffing host detected: %s\n", thc_ipv62notation(ptr + 8));
+       memcpy(doubles[found], thc_ipv62notation(ptr + 8), 16);
+       found++;
+-      if (oneonly) alarming();
+      if (oneonly) alarming(0);
+     }
+   }
+ }
+--- a/thcping6.c
+++ b/thcping6.c
+@@ -89,7 +89,7 @@ void help(char *prg, int help) {
+   exit(-1);
+ }
+ 
+-void alarming() {
+void alarming(int sig) {
+   if (done == 0) printf("No packet received, terminating.\n");
+   exit(resp_type);
+ }
@@ -428,11 +428,14 @@ handle_send_a(struct ead_packet *pkt, int len, int *nstate)
 {
 	struct ead_msg *msg = &pkt->msg;
 	struct ead_msg_number *number = EAD_DATA(msg, number);
-	len = ntohl(msg->len) - sizeof(struct ead_msg_number);
+	uint32_t msg_len = ntohl(msg->len);

-	if (len > MAXPARAMLEN + 1)
+	if (msg_len < sizeof(struct ead_msg_number) ||
+	    msg_len - sizeof(struct ead_msg_number) > MAXPARAMLEN + 1)
 		return false;

+	len = msg_len - sizeof(struct ead_msg_number);
+
 	A.len = len;
 	A.data = abuf;
 	memcpy(A.data, number->data, len);
@@ -79,19 +79,8 @@
 #endif
 #endif

-#if STDC_HEADERS
 #include <stdlib.h>
 #include <string.h>
-#else /* not STDC_HEADERS */
-#ifndef HAVE_STRCHR
-#define strchr index
-#define strrchr rindex
-#endif
-char *strchr(), *strrchr(), *strtok();
-#ifndef HAVE_MEMCPY
-#define memcpy(d, s, n) bcopy((s), (d), (n))
-#endif
-#endif /* not STDC_HEADERS */

 #include <sys/types.h>

@@ -86,7 +86,7 @@ tick()
 }

 static void
-interrupt()
+interrupt(int sig)
 {
 	if (count) {
 #ifdef OLD_TRUERAND
@@ -81,15 +81,15 @@ probe/assoc/auth requests via object subscribe.
 
 --- a/src/ap/dfs.c
 +++ b/src/ap/dfs.c
-@@ -1295,6 +1295,8 @@ int hostapd_dfs_pre_cac_expired(struct h
+@@ -1543,6 +1543,8 @@ int hostapd_dfs_radar_detected(struct ho
 		"freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d",
 		freq, ht_enabled, chan_offset, chan_width, cf1, cf2);
 
 +	hostapd_ubus_notify_radar_detected(iface, freq, chan_width, cf1, cf2);
 +
+ 	iface->radar_detected = true;
+ 
 	/* Proceed only if DFS is not offloaded to the driver */
- 	if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
- 		return 0;
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
@@ -333,6 +333,10 @@ int hostapd_notif_assoc(struct hostapd_d
@@ -123,6 +123,23 @@ get_config_restart_hash() {
 	export -n "$var=$_hash"
 }

+resolve_bridge_member_ports() {
+	local _lower _bridge _port _ports=""
+
+	_lower=$(ls "/sys/class/net/$1/" 2>/dev/null | grep "^lower_" | head -1)
+	[ -n "$_lower" ] || return 1
+
+	_bridge="${_lower#lower_}"
+	[ -d "/sys/class/net/$_bridge/bridge" ] || return 1
+
+	for _port in $(ls "/sys/class/net/$_bridge/" 2>/dev/null | grep "^lower_"); do
+		append _ports "${_port#lower_}" ","
+	done
+
+	[ -n "$_ports" ] || return 1
+	echo "$_ports"
+}
+
 get_interface_csv() {
 	local _ifaces
 	config_get _ifaces "$2" "$3"
@@ -134,7 +151,15 @@ get_interface_csv() {

 		local _l2device=""
 		if network_get_physdev _l2device "$_iface" || [ -e "/sys/class/net/$_iface" ]; then
-			append _ifnames "${_l2device:-$_iface}" ","
+			local _resolved="${_l2device:-$_iface}"
+			local _ports
+			# LLDP uses reserved multicast (01:80:c2:00:00:0e) that bridges
+			# trap rather than forward; trapped frames arrive on the member
+			# ports, not on bridge VLAN sub-interfaces, so resolve down to
+			# the individual bridge member ports
+			_ports=$(resolve_bridge_member_ports "$_resolved")
+			[ -n "$_ports" ] && _resolved="$_ports"
+			append _ifnames "$_resolved" ","
 		else
 			# Glob case (interface is e.g. '!eth1' or 'eth*' or '*')
 			append _ifnames "$_iface" ","
@@ -12,9 +12,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/odhcpd.git
-PKG_MIRROR_HASH:=f982e7fc12f928359835ccb4b8e650ce935aa67e099bcacded6987d18452ae8d
-PKG_SOURCE_DATE:=2026-06-14
-PKG_SOURCE_VERSION:=c6792bac3905d4bf726d914e9994f6d4b98c5b57
+PKG_MIRROR_HASH:=0080feb1757c95b7a844f82728abc6d9c89b792c8170efcb73b04e728c547665
+PKG_SOURCE_DATE:=2026-06-28
+PKG_SOURCE_VERSION:=68f382690bfaec56d5b1f31c3c31c48bcb642e3a

 PKG_MAINTAINER:=Álvaro Fernández Rojas <noltari@gmail.com>
 PKG_LICENSE:=GPL-2.0
@@ -9,9 +9,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git
-PKG_SOURCE_DATE:=2026-05-21
-PKG_SOURCE_VERSION:=1b624f8f814ed568608d756512892416e0431d77
-PKG_MIRROR_HASH:=7fb56c4aa2e67a8d6d90e0cbb91f8108a363d0242bb62a8880c41ad4c10ff5ff
+PKG_SOURCE_DATE:=2026-06-16
+PKG_SOURCE_VERSION:=7b1bec45826bd78c8afc993435bdc0f1df2fe399
+PKG_MIRROR_HASH:=ee52821b04cc78f46875e9870b6ed41670606d6b90fb31b31312666c4ed809dd
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=ISC

@@ -12,9 +12,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_URL=$(PROJECT_GIT)/project/mdnsd.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2026-05-22
-PKG_SOURCE_VERSION:=bd7599d021571e785bd32a75469e7148eb1772e3
-PKG_MIRROR_HASH:=0e1942f8aacb730fa7a32642dbf812ed24f4929fe532039d48ace3cba46c040c
+PKG_SOURCE_DATE:=2026-06-27
+PKG_SOURCE_VERSION:=dbee55098c2e7a0a76feec414a11d76838572918
+PKG_MIRROR_HASH:=726e7874f7399fd286d81479ff00cb1cdd231cf3a25b8f89e4a9a1c45bb670bc

 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=LGPL-2.1
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=restool
-PKG_VERSION:=6.6.23.2.0.0
+PKG_VERSION:=6.18.2.1.0.0
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/nxp-qoriq/restool
-PKG_SOURCE_VERSION:=lf-6.6.23-2.0.0
-PKG_MIRROR_HASH:=e669c9faf5a00e36d763dbbd6dd866d878b0101df086582c38908d281fa3b465
+PKG_SOURCE_VERSION:=lf-6.18.2-1.0.0
+PKG_MIRROR_HASH:=d3e35b9e8e0db98aa52c0f48fba4b2c9c6e124a0d32e8bf36c208f9dfe3a8dc2

 PKG_FLAGS:=nonshared

@@ -27,7 +27,7 @@ define Package/restool
  DEPENDS:=@TARGET_layerscape_armv8_64b
 endef

-MAKE_FLAGS += \
+MAKE_FLAGS += MANPAGE="" \
 	DESTDIR="$(PKG_BUILD_DIR)"/output/ \
 	install

@@ -1,18 +0,0 @@
--- a/Makefile
-+++ b/Makefile
-@@ -55,14 +55,13 @@ restool: $(OBJ)
- %.1: %.md
- 	pandoc --standalone --to man $^ -o $@
- 
-install: restool scripts/ls-main scripts/ls-append-dpl scripts/ls-debug scripts/restool_completion.sh $(MANPAGE)
-+install: restool scripts/ls-main scripts/ls-append-dpl scripts/ls-debug scripts/restool_completion.sh
- 	install -D -m 755 restool $(DESTDIR)$(bindir)/restool
- 	install -D -m 755 scripts/ls-main $(DESTDIR)$(bindir)/ls-main
- 	install -D -m 755 scripts/ls-append-dpl $(DESTDIR)$(bindir)/ls-append-dpl
- 	install -D -m 755 scripts/ls-debug $(DESTDIR)$(bindir)/ls-debug
- 	$(foreach symlink, $(RESTOOL_SCRIPT_SYMLINKS), sh -c "cd $(DESTDIR)$(bindir) && ln -sf ls-main $(symlink)" ;)
- 	install -D -m 755 scripts/restool_completion.sh $(DESTDIR)$(bindir_completion)/restool
-	install -m 0644 -D $(MANPAGE) $(call get_manpage_destination,$(MANPAGE))
- 
- clean:
- 	rm -f $(OBJ) $(MANPAGE) \
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=nftables
 PKG_VERSION:=1.1.6
-PKG_RELEASE:=2
+PKG_RELEASE:=4

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
@@ -0,0 +1,29 @@
+From 2e3c68f26d5bd60c8ea7467fa9018c282a7d8c47 Mon Sep 17 00:00:00 2001
+From: Jan Palus <jpalus@fastmail.com>
+Date: Sat, 6 Dec 2025 00:43:58 +0100
+Subject: build: fix ./configure with non-bash shell
+
+ CONFIG_SHELL=/bin/dash ./configure
+
+breaks with:
+
+ ./config.status: 2044: Syntax error: Bad for loop variable
+
+Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
+Signed-off-by: Jan Palus <jpalus@fastmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/configure.ac
+++ b/configure.ac
+@@ -157,7 +157,7 @@ AC_CONFIG_COMMANDS([nftversion.h], [
+ 	echo "	${STABLE_RELEASE}"
+ 	echo "};"
+ 	echo "static char nftbuildstamp[[]] = {"
+-	for ((i = 56; i >= 0; i-= 8)); do
+	for i in `seq 56 -8 0`; do
+ 		echo "	((uint64_t)MAKE_STAMP >> $i) & 0xff,"
+ 	done
+ 	echo "};"
@@ -1,7 +1,7 @@
 From 2a0ec8a7246e5c5eb85270e3d4de43e20a00c577 Mon Sep 17 00:00:00 2001
 From: Jeremy Sowden <jeremy@azazel.net>
 Date: Wed, 28 Jan 2026 18:31:05 +0000
-Subject: [PATCH] build: simplify the instantation of nftversion.h
+Subject: build: simplify the instantation of nftversion.h

 Add an nftversion.h.in autoconf input file which configure uses to instantiate
 nftversion.h in the usual way.
@@ -14,11 +14,9 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
 2 files changed, 22 insertions(+), 16 deletions(-)
 create mode 100644 nftversion.h.in

-diff --git a/configure.ac b/configure.ac
-index 6825474..2c61072 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -147,22 +147,8 @@ AM_CONDITIONAL([BUILD_SERVICE], [test "x$unitdir" != x])
+@@ -147,22 +147,8 @@ AM_CONDITIONAL([BUILD_SERVICE], [test "x
 AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release],
             [Stable release number])],
             [], [with_stable_release=0])
@@ -32,7 +30,7 @@ index 6825474..2c61072 100644
 -	echo "	${STABLE_RELEASE}"
 -	echo "};"
 -	echo "static char nftbuildstamp[[]] = {"
-	for ((i = 56; i >= 0; i-= 8)); do
+-	for i in `seq 56 -8 0`; do
 -		echo "	((uint64_t)MAKE_STAMP >> $i) & 0xff,"
 -	done
 -	echo "};"
@@ -43,7 +41,7 @@ index 6825474..2c61072 100644
 # Current date should be fetched exactly once per build,
 # so have 'make' call date and pass the value to every 'gcc' call
 AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
-@@ -175,6 +161,7 @@ AM_CONDITIONAL([BUILD_DISTCHECK], [test "x$enable_distcheck" = "xyes"])
+@@ -175,6 +161,7 @@ AM_CONDITIONAL([BUILD_DISTCHECK], [test
 AC_CONFIG_FILES([					\
 		Makefile				\
 		libnftables.pc				\
@@ -51,9 +49,6 @@ index 6825474..2c61072 100644
 		])
 AC_OUTPUT
 
-diff --git a/nftversion.h.in b/nftversion.h.in
-new file mode 100644
-index 0000000..6f89771
 --- /dev/null
 +++ b/nftversion.h.in
@@ -0,0 +1,19 @@
@@ -19,8 +19,6 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
 nftversion.h.in | 18 ++++++++++--------
 3 files changed, 11 insertions(+), 13 deletions(-)

-diff --git a/Makefile.am b/Makefile.am
-index b134330..ceb2225 100644
 --- a/Makefile.am
 +++ b/Makefile.am
@@ -159,8 +159,6 @@ AM_CFLAGS = \
@@ -32,11 +30,9 @@ index b134330..ceb2225 100644
 	$(NULL)
 
 AM_YFLAGS = -d -Wno-yacc
-diff --git a/configure.ac b/configure.ac
-index 2c61072..9859072 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -149,9 +149,7 @@ AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release],
+@@ -149,9 +149,7 @@ AC_ARG_WITH([stable-release], [AS_HELP_S
             [], [with_stable_release=0])
 AC_SUBST([STABLE_RELEASE],[$with_stable_release])
 AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')])
@@ -47,8 +43,6 @@ index 2c61072..9859072 100644
 
 AC_ARG_ENABLE([distcheck],
 	      AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
-diff --git a/nftversion.h.in b/nftversion.h.in
-index 6f89771..325b9dc 100644
 --- a/nftversion.h.in
 +++ b/nftversion.h.in
@@ -1,19 +1,21 @@
@@ -18,11 +18,9 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
 configure.ac | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-diff --git a/configure.ac b/configure.ac
-index 9859072..0226086 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -149,7 +149,7 @@ AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release],
+@@ -149,7 +149,7 @@ AC_ARG_WITH([stable-release], [AS_HELP_S
             [], [with_stable_release=0])
 AC_SUBST([STABLE_RELEASE],[$with_stable_release])
 AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')])
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=mtd
-PKG_RELEASE:=27
+PKG_RELEASE:=28

 PKG_BUILD_DIR := $(KERNEL_BUILD_DIR)/$(PKG_NAME)
 STAMP_PREPARED := $(STAMP_PREPARED)_$(call confvar,CONFIG_MTD_REDBOOT_PARTS)
@@ -12,9 +12,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git
-PKG_MIRROR_HASH:=f57f124eb1f6a0a7100cc9327bc4842d3667f611d789fc4b3e8ea4a18f73955f
-PKG_SOURCE_DATE:=2026-05-22
-PKG_SOURCE_VERSION:=74bfbee8adb8162ee3f1427905af06836f332a37
+PKG_MIRROR_HASH:=bd9e510b303b58f1edb1bfc4629e523f9a96c80a5b66cf5c972f9245bfec5596
+PKG_SOURCE_DATE:=2026-06-17
+PKG_SOURCE_VERSION:=60fdbf00e924fff0a510c4ec31c520d35e69bfe1
 CMAKE_INSTALL:=1

 PKG_LICENSE:=GPL-2.0
@@ -5,9 +5,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ubus.git
-PKG_SOURCE_DATE:=2026-05-23
-PKG_SOURCE_VERSION:=795b32bb96b611493f423666236e9c1e49e0736c
-PKG_MIRROR_HASH:=7fdc7c111b21277603448f20b15ebbf3adeab6e3f51fb99f216587f3b5998fbd
+PKG_SOURCE_DATE:=2026-06-28
+PKG_SOURCE_VERSION:=24864e7840b3a02a9ef76284a373f6b2f00b8a9b
+PKG_MIRROR_HASH:=33072c12e6d9a1fd59e3774f029575df61393b5a465486726609ff59314b8a84
 PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
 CMAKE_INSTALL:=1

@@ -867,7 +867,7 @@ config BUSYBOX_DEFAULT_FEATURE_TEST_64
 	default y
 config BUSYBOX_DEFAULT_TIMEOUT
 	bool
-	default n
+	default y
 config BUSYBOX_DEFAULT_TOUCH
 	bool
 	default y
@@ -0,0 +1,48 @@
+From: John Crispin <john@phrozen.org>
+Date: Wed, 15 Apr 2026 16:15:38 +0200
+Subject: [PATCH] udhcpc: treat SIGHUP as release + rediscover
+
+Add a SIGHUP handler to udhcpc that releases the current lease (if any)
+and immediately transitions the state machine to INIT_SELECTING so the
+next main-loop iteration sends a fresh DHCPDISCOVER. This lets a single
+signal express 'release this lease and get a new one' without exiting
+the client, so upstream watchdogs (e.g. a DNS-health monitor) can
+request a clean re-lease without tearing down the interface.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+--- a/networking/udhcp/dhcpc.c
+++ b/networking/udhcp/dhcpc.c
+@@ -1606,6 +1606,22 @@ int udhcpc_main(int argc UNUSED_PARAM, c
+ 			/* ^^^ switches to LISTEN_NONE */
+ 			timeout = INT_MAX;
+ 			continue;
+		case SIGHUP:
+			bb_info_msg("received SIGHUP, restarting DHCP session");
+			/* release the current lease if we have one */
+			if (client_data.state != INIT_SELECTING
+			 && client_data.state != RELEASED)
+				perform_release(server_id, requested_ip);
+			/* drop any cached offer, kick the state machine into
+			 * INIT_SELECTING so the next iteration sends a fresh
+			 * DHCPDISCOVER */
+			change_listen_mode(LISTEN_NONE);
+			server_id = 0;
+			requested_ip = 0;
+			packet_num = 0;
+			client_data.state = INIT_SELECTING;
+			timeout = 0;
+			continue;
+ 		case SIGTERM:
+ 			bb_info_msg("received %s", "SIGTERM");
+ 			goto ret0;
+--- a/networking/udhcp/signalpipe.c
+++ b/networking/udhcp/signalpipe.c
+@@ -58,6 +58,7 @@ void FAST_FUNC udhcp_sp_setup(void)
+ 	bb_signals(0
+ 		+ (1 << SIGUSR1)
+ 		+ (1 << SIGUSR2)
+		+ (1 << SIGHUP)
+ 		+ (1 << SIGTERM)
+ 		, signal_handler);
+ }
@@ -5,11 +5,11 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=dtc
-PKG_VERSION:=1.7.2
+PKG_VERSION:=1.8.1
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_HASH:=f200e5ebd7afd20d4b3804a3085af0870fcf3c194f8d7f0f6985cf8bbb4ac0f4
+PKG_HASH:=454e5cce748ce957c91e7f45e66da2cff5100ddb52155d7a909c43cbeaf1bcb0
 PKG_SOURCE_URL:=@KERNEL/software/utils/dtc

 PKG_MAINTAINER:=Yousong Zhou <yszhou4tech@gmail.com>
@@ -93,7 +93,7 @@ MESON_ARGS += \
 	-Dyaml=disabled \
 	-Dvalgrind=disabled \
 	-Dpython=disabled \
-	-Dstatic-build=$(if $(CONFIG_DTC_STATIC_BUILD),true,false)
+	$(if $(CONFIG_DTC_STATIC_BUILD),--prefer-static)

 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/lib
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=fritz-tools
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 CMAKE_INSTALL:=1

 include $(INCLUDE_DIR)/package.mk
@@ -245,7 +245,7 @@ static int find_entry(uint32_t id, struct tffs_entry *entry)
 				uint32_t new_num_segs = next_seg == 0 ? seg + 1 : next_seg + 1;
 				if (new_num_segs > num_segments) {
 					segments = realloc(segments, new_num_segs * sizeof(struct tffs_entry_segment));
-					memset(segments + (num_segments * sizeof(struct tffs_entry_segment)), 0x0,
+					memset(segments + num_segments, 0x0,
 							(new_num_segs - num_segments) * sizeof(struct tffs_entry_segment));
 					num_segments = new_num_segs;
 				}
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=util-linux
-PKG_VERSION:=2.42.1
+PKG_VERSION:=2.42.2
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/$(PKG_NAME)/v2.42
-PKG_HASH:=82e9158eb12a9b0b569d84e1687fed9dd18fe89ccd8ef5ac3427218a7c0d7f7f
+PKG_HASH:=03a05d3adf9602ef128f2da05b84b3205ce60c351e5737c0370f74000679ce8a
 PKG_CPE_ID:=cpe:/a:kernel:util-linux

 PKG_INSTALL:=1
@@ -0,0 +1,225 @@
+#!/usr/bin/python3
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright (C) 2025 Lukas Stockner <lukas@lukasstockner.de>
+#
+# ./aruba-header.py <input file> <output file> <build string> <version string> <oem string> <image type> <machine type>
+#
+# Generates a header for use with the APBoot bootloader on (some?) Aruba APs.
+
+import argparse
+
+LEN_BUILD = 256
+LEN_VERSION = 24
+LEN_OEM = 32
+
+HEADER_MAGIC = b'ARUBA\0\0\0'
+
+
+class ValidFlag:
+    YES = 1
+
+
+class FormatVersion:
+    CURRENT = 2
+
+
+class ImageType:
+    ELF = 0
+    FPGA_BINARY = 1
+    CPBOOT_BINARY = 2
+    APBOOT_BINARY = 3
+    TPMINFO = 4
+    APBOOT_STAGE1_BINARY = 5
+    APBOOT_STAGE2_BINARY = 6
+    APBOOT_COMBINED_BINARY = 7
+    OS_ANCILLARY_IMAGE = 8
+    XLOADER_BINARY = 9
+    GRUB_BIN = 10
+    LSM_PACKAGE = 11
+
+
+class CompressionType:
+    NONE = 0
+    BZIP2 = 1
+    GZIP = 2
+
+
+MACHINE_TYPES = {
+    'MSWITCH': 0,
+    'CABERNET': 1,
+    'SYRAH': 2,
+    'MERLOT': 3,
+    'MUSCAT': 4,
+    'NEBBIOLO': 5,
+    'MALBEC': 6,
+    'PALOMINO': 7,
+    'GRENACHE': 8,
+    'MOSCATO': 9,
+    'TALISKER': 10,
+    'JURA_R': 11,
+    'SCAPA': 12,
+    'JURA_O': 13,
+    'CORVINA': 14,
+    'ARRAN': 15,
+    'BLUEBLOOD': 16,
+    'MSR2K': 17,
+    'PORFIDIO': 18,
+    'CAZULO': 19,
+    'SCAPA_H': 20,
+    'CARDHU': 21,
+    'BOWMORE': 22,
+    'TAMDHU': 23,
+    'ARDBEG': 24,
+    'ARDMORE': 25,
+    'DALMORE': 26,
+    'K2': 27,
+    'GRAPPA': 28,
+    'SHUMWAY': 29,
+    'SPRINGBANK': 30,
+    'OUZO': 31,
+    'AMARULA': 32,
+    'GROZDOVA': 33,
+    'PALINKA': 34,
+    'HAZELBURN': 35,
+    'TOMATIN': 36,
+    'HAZELBURN_H': 37,
+    'TOMATIN_16': 38,
+    'SPRINGBANK_16': 39,
+    'OCTOMORE': 40,
+    'BALVENIE': 41,
+    'OUZO_PLUS': 42,
+    'X4': 43,
+    'EINAR': 44,
+    'GLENFARCLAS': 45,
+    'GLENFIDDICH': 46,
+    'EIGER': 47,
+    'GLENMORANGIE': 48,
+    'MILAGRO': 49,
+    'OPUSONE': 50,
+    'ABERLOUR': 51,
+    'MILLSTONE': 52,
+    'DEWARS': 53,
+    'BUNKER': 54,
+    'MASTERSON': 55,
+    'SIERRA': 56,
+    'KILCHOMAN': 57,
+    'SPEYBURN': 58,
+    'LAGAVULIN': 59,
+    'LAPHROAIG': 60,
+    'TOBA': 61,
+    'ARRANTA': 62,
+}
+
+
+class NextHeader:
+    NONE = 0x00000000
+    SIGN = 0x01111111
+
+
+class Flags:
+    C_TEST_BUILD = 0x00000001
+    SWATCH = 0x00000002
+    # Preserves the image with "clear all"
+    DONT_CLEAR_ON_PURGE = 0x00000004
+    SECURE_BOOTLOADER = 0x00000008
+    FACTORY_IMAGE = 0x00000010
+    FIPS_CERTIFIED = 0x00000020
+
+
+def make_header(data: bytes, build: str, version: str, oem: str, imageType: int, machine: int) -> bytes:
+    buildBytes = build.encode(encoding='ascii')
+    assert len(buildBytes) < LEN_BUILD
+    buildBytes += b'\0' * (LEN_BUILD - len(buildBytes))
+
+    versionBytes = version.encode(encoding='ascii')
+    assert len(versionBytes) < LEN_VERSION
+    versionBytes += b'\0' * (LEN_VERSION - len(versionBytes))
+
+    oemBytes = oem.encode(encoding='ascii')
+    assert len(oemBytes) < LEN_OEM
+    oemBytes += b'\0' * (LEN_OEM - len(oemBytes))
+
+    header = b''
+    # Payload size, image plus optional signature (which we don't use)
+    header += len(data).to_bytes(4, 'big')
+    # Use what appears to be the current version
+    header += FormatVersion.CURRENT.to_bytes(4, 'big')
+    # Checksum is computed later
+    header += b'\0\0\0\0'
+    # Vendor magic number
+    header += HEADER_MAGIC
+    # Long build information string
+    header += buildBytes
+    # Short version information string
+    header += versionBytes
+    # Image is valid
+    header += ValidFlag.YES.to_bytes(1, 'big')
+    # Image type
+    header += imageType.to_bytes(1, 'big')
+    # APBoot doesn't appear to actually support compression
+    header += CompressionType.NONE.to_bytes(1, 'big')
+    # Machine type
+    header += machine.to_bytes(1, 'big')
+    # Image size
+    header += len(data).to_bytes(4, 'big')
+    # Next header (we don't support signing)
+    header += NextHeader.NONE.to_bytes(4, 'big')
+    # MD5 checksum plus fudge factor (to ensure non-zero hash), appears unused
+    header += b'\0' * 16
+    header += b'\0' * 4
+    # No flags are set
+    header += int(0).to_bytes(4, 'big')
+    # No next header is used
+    header += b'\0' * 12
+    # Padding
+    header += b'\0' * 36
+    # OEM string
+    header += oemBytes
+    # Padding
+    header += b'\0' * 96
+
+    assert len(header) == 512
+    assert len(data) % 4 == 0
+
+    # Compute checksum such that the big-endian sum of all 32-bit integers becomes zero.
+    curSum = sum(int.from_bytes(header[i : i + 4], 'big') for i in range(0, 512, 4))
+    curSum += sum(int.from_bytes(data[i : i + 4], 'big') for i in range(0, len(data), 4))
+
+    # Set checksum
+    checksum = 0x100000000 - (curSum % 0x100000000)
+    header = header[:8] + checksum.to_bytes(4, 'big') + header[12:]
+
+    return header
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description='Generate Aruba header.')
+    parser.add_argument('source')
+    parser.add_argument('dest')
+    parser.add_argument('build')
+    parser.add_argument('version')
+    parser.add_argument('oem')
+    parser.add_argument('type', choices=['os', 'boot'])
+    parser.add_argument('machine', choices=MACHINE_TYPES.keys(), type=str.upper)
+    args = parser.parse_args()
+
+    # Parse image type.
+    # The OS image must be type "ELF" even though it's not an ELF file...
+    imageType = {'os': ImageType.ELF, 'boot': ImageType.APBOOT_BINARY}[args.type]
+    # Parse machine type.
+    machineType = MACHINE_TYPES[args.machine]
+
+    source = open(args.source, 'rb')
+    image = source.read()
+    # Pad image.
+    if len(image) % 4 != 0:
+        image += b'\0' * (4 - len(image) % 4)
+
+    # Generate header.
+    header = make_header(image, args.build, args.version, args.oem, imageType, machineType)
+
+    # Write output.
+    dest = open(args.dest, 'wb')
+    dest.write(header)
+    dest.write(image)
@@ -20,6 +20,10 @@ an7581_setup_interfaces()
 	nokia,valyrian)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 10g" "wan"
 		;;
+	nokia,xg-040g-md |\
+	nokia,xg-040g-md-ubi)
+		ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
+		;;
 	*)
 		echo "Unsupported hardware. Network interfaces not initialized"
 		;;
@@ -5,7 +5,7 @@

 START=99

-. /lib/functions.sh
+. "$IPKG_INSTROOT/lib/functions.sh"

 find_nct7802()
 {
@@ -1,11 +1,39 @@
-REQUIRE_IMAGE_METADATA=1
 RAMFS_COPY_BIN='fitblk fit_check_sign'

+REQUIRE_IMAGE_METADATA=1
+
+nokia_initial_setup()
+{
+	[ "$(rootfs_type)" = "tmpfs" ] || return 0
+
+	fw_setenv bootcmd "flash read 0xc0000 0x800000 0x85000000; bootm 0x85000000"
+}
+
+platform_check_image() {
+	local board=$(board_name)
+
+	[ "$#" -gt 1 ] && return 1
+
+	case "$board" in
+	nokia,xg-040g-md)
+		nand_do_platform_check "$board" "$1"
+		return $?
+		;;
+	nokia,xg-040g-md-ubi)
+		fit_check_image "$1"
+		return $?
+		;;
+	esac
+
+	return 0
+}
+
 platform_do_upgrade() {
 	local board=$(board_name)

 	case "$board" in
-		gemtek,w1700k-ubi)
+		gemtek,w1700k-ubi|\
+		nokia,xg-040g-md-ubi)
 			fit_do_upgrade "$1"
 			;;
 		*)
@@ -14,6 +42,14 @@ platform_do_upgrade() {
 	esac
 }

-platform_check_image() {
-	return 0
+platform_pre_upgrade() {
+	local board=$(board_name)
+
+	case "$board" in
+	nokia,xg-040g-md)
+		nokia_initial_setup
+		;;
+	*)
+		;;
+	esac
 }
@@ -212,6 +212,7 @@ CONFIG_MTD_UBI_BEB_LIMIT=20
 CONFIG_MTD_UBI_BLOCK=y
 CONFIG_MTD_UBI_NVMEM=y
 CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTD_VIRT_CONCAT=y
 CONFIG_MTK_NET_PHYLIB=y
 CONFIG_MUTEX_SPIN_ON_OWNER=y
 CONFIG_NEED_DMA_MAP_STATE=y
--- a/Show More
+++ b/Show More