kernel: add kmod-pstore-blk

This module enables support for pstore oops and panic logger writing to
block devices. This is needed for some x86 targets, e.g. the APU series
of devices that can't work with ramoops.

.gitattributes

@@ -1,2 +1,4 @@
 * -text
 *.patch whitespace=-indent-with-non-tab,-space-before-tab,-tab-in-indent,-trailing-space
+*.dts text eol=lf
+*.dts[io] text eol=lf

.github/labeler.yml

@@ -54,6 +54,10 @@
     - "target/linux/d1/**"
     - "package/boot/uboot-d1/**"
     - "package/boot/opensbi/**"
+"target/econet":
+- changed-files:
+  - any-glob-to-any-file:
+    - "target/linux/econet/**"
 "target/gemini":
 - changed-files:
   - any-glob-to-any-file:
@@ -122,6 +126,12 @@
     - "target/linux/mediatek/**"
     - "package/boot/arm-trusted-firmware-mediatek/**"
     - "package/boot/uboot-mediatek/**"
+"target/microchipsw":
+- changed-files:
+  - any-glob-to-any-file:
+    - "target/linux/microchipsw/**"
+    - "package/boot/arm-trusted-firmware-microchipsw/**"
+    - "package/boot/uboot-microchipsw/**"
 "target/mpc85xx":
 - changed-files:
   - any-glob-to-any-file:

.github/workflows/build-on-comment.yml

@@ -1,164 +0,0 @@
-name: Build on Comment
-
-on:
-  issue_comment:
-    types: [created, edited]
-
-permissions:
-  pull-requests: write
-
-concurrency:
-  group: build-on-comment-${{ github.event.issue.number || github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  check-and-build:
-    if: github.event.issue.pull_request != null
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check if user is in reviewers team
-        id: check-reviewer
-        run: |
-          USERNAME="${{ github.event.comment.user.login }}"
-
-          STATUS_CODE=$(curl -s -H "Authorization: token ${{ secrets.LOOKUP_MEMBERS }}" \
-                -o response.json -w "%{http_code}" \
-                https://api.github.com/orgs/openwrt/teams/reviewers/memberships/$USERNAME)
-
-          if grep -q '"state": "active"' response.json && [ "$STATUS_CODE" -eq 200 ]; then
-            echo "authorized=true" >> $GITHUB_OUTPUT
-          else
-            echo "authorized=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Parse build command
-        if: steps.check-reviewer.outputs.authorized == 'true'
-        id: parse-command
-        run: |
-          COMMENT="${{ github.event.comment.body }}"
-          if echo "$COMMENT" | grep -q "build [a-zA-Z0-9_-]\+/[a-zA-Z0-9_-]\+/[a-zA-Z0-9_-]\+"; then
-            BUILD_PATH=$(echo "$COMMENT" | grep -o "build [a-zA-Z0-9_-]\+/[a-zA-Z0-9_-]\+/[a-zA-Z0-9_-]\+" | sed 's/build //')
-            TARGET=$(echo "$BUILD_PATH" | cut -d'/' -f1)
-            SUBTARGET=$(echo "$BUILD_PATH" | cut -d'/' -f2)
-            PROFILE=$(echo "$BUILD_PATH" | cut -d'/' -f3)
-            echo "build_requested=true" >> $GITHUB_OUTPUT
-            echo "target=$TARGET" >> $GITHUB_OUTPUT
-            echo "subtarget=$SUBTARGET" >> $GITHUB_OUTPUT
-            echo "profile=$PROFILE" >> $GITHUB_OUTPUT
-            echo "build_path=$BUILD_PATH" >> $GITHUB_OUTPUT
-          else
-            echo "build_requested=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Find existing build comment
-        if: steps.parse-command.outputs.build_requested == 'true'
-        id: find-comment
-        uses: peter-evans/find-comment@v2
-        with:
-          issue-number: ${{ github.event.pull_request.number || github.event.issue.number }}
-          comment-author: "github-actions[bot]"
-
-      - name: Create early build comment
-        if: steps.parse-command.outputs.build_requested == 'true'
-        id: start-comment
-        uses: peter-evans/create-or-update-comment@v3
-        with:
-          issue-number: ${{ github.event.pull_request.number || github.event.issue.number }}
-          comment-id: ${{ steps.find-comment.outputs.comment-id }}
-          body: |
-            🚧 **Build in progress for** `${{ steps.parse-command.outputs.build_path }}`...
-
-            You can follow progress [here](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-            *Triggered by: @${{ github.event.comment.user.login }}*
-          edit-mode: replace
-
-      - name: Checkout repository
-        if: steps.parse-command.outputs.build_requested == 'true'
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0
-          ref: refs/pull/${{ github.event.issue.number }}/merge
-
-      - name: Setup build environment
-        if: steps.parse-command.outputs.build_requested == 'true'
-        continue-on-error: true
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential libncurses5-dev gawk git subversion libssl-dev gettext zlib1g-dev swig unzip time rsync
-
-      - name: Build target
-        if: steps.parse-command.outputs.build_requested == 'true'
-        id: build
-        run: |
-          make defconfig
-          echo "CONFIG_DEVEL=y" > .config
-          echo "CONFIG_BPF_TOOLCHAIN_HOST=y" >> .config
-          echo "CONFIG_TARGET_${{ steps.parse-command.outputs.target }}=y" >> .config
-          echo "CONFIG_TARGET_${{ steps.parse-command.outputs.target }}_${{ steps.parse-command.outputs.subtarget }}=y" >> .config
-          echo "CONFIG_TARGET_${{ steps.parse-command.outputs.target }}_${{ steps.parse-command.outputs.subtarget }}_DEVICE_${{ steps.parse-command.outputs.profile }}=y" >> .config
-
-          make defconfig
-          make -j$(nproc) BUILD_LOG=1
-
-          echo "build_success=true" >> $GITHUB_OUTPUT
-
-      - name: Upload log
-        uses: actions/upload-artifact@v4
-        if: steps.check-reviewer.outputs.authorized == 'true' && (success() || failure())
-        with:
-          name: build-log-${{ steps.parse-command.outputs.target }}-${{ steps.parse-command.outputs.subtarget }}-${{ steps.parse-command.outputs.profile }}
-          path: logs/
-
-      - name: Create artifact archive
-        if: steps.build.outputs.build_success == 'true'
-        run: |
-          cd bin/
-          tar -czf ../build-artifacts.tar.gz *
-          cd ..
-
-      - name: Upload build artifacts
-        if: steps.build.outputs.build_success == 'true'
-        uses: actions/upload-artifact@v4
-        with:
-          name: build-${{ steps.parse-command.outputs.target }}-${{ steps.parse-command.outputs.subtarget }}-${{ steps.parse-command.outputs.profile }}
-          path: build-artifacts.tar.gz
-
-      - name: Update comment with build results
-        if: steps.build.outputs.build_success == 'true'
-        uses: peter-evans/create-or-update-comment@v3
-        with:
-          comment-id: ${{ steps.start-comment.outputs.comment-id }}
-          issue-number: ${{ github.event.pull_request.number || github.event.issue.number }}
-          body: |
-            ## Build Results for `${{ steps.parse-command.outputs.build_path }}`
-
-            ✅ **Build completed successfully!**
-
-            **Target:** `${{ steps.parse-command.outputs.target }}`
-            **Subtarget:** `${{ steps.parse-command.outputs.subtarget }}`
-            **Profile:** `${{ steps.parse-command.outputs.profile }}`
-
-            📦 **Artifacts:** [Download build-${{ steps.parse-command.outputs.target }}-${{ steps.parse-command.outputs.subtarget }}-${{ steps.parse-command.outputs.profile }}](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-            *Build triggered by: @${{ github.event.comment.user.login }}*
-            *Last updated: ${{ github.event.comment.created_at }}*
-          edit-mode: replace
-
-      - name: Update comment on build failure
-        if: steps.parse-command.outputs.build_requested == 'true' && steps.build.outputs.build_success == 'false'
-        uses: peter-evans/create-or-update-comment@v3
-        with:
-          comment-id: ${{ steps.start-comment.outputs.comment-id }}
-          issue-number: ${{ github.event.pull_request.number || github.event.issue.number }}
-          body: |
-            ## Build Results for `${{ steps.parse-command.outputs.build_path }}`
-
-            ❌ **Build failed!**
-
-            Please check the [action logs](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details.
-
-            *Build triggered by: @${{ github.event.comment.user.login }}*
-          edit-mode: replace

.github/workflows/build-pr-profile.yml

@@ -0,0 +1,12 @@
+name: Build PR Profile
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  build-pr-profile:
+    uses: openwrt/actions-shared-workflows/.github/workflows/build-pr-profile.yml@main

.github/workflows/claude-code-review.yml

@@ -0,0 +1,33 @@
+name: Claude Code Review
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: read
+
+jobs:
+  code-review:
+    name: Claude Code Review
+    # Only run on PR comments containing "/claude" from users with write access
+    if: >-
+      github.event.issue.pull_request &&
+      contains(github.event.comment.body, '/claude') &&
+      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'),
+               github.event.comment.author_association)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 1
+
+      - name: PR Review
+        uses: anthropics/claude-code-action@f669191d7d1e67f08a54b0c11cf5683a9a391951 # v1.0.49
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          trigger_phrase: "/claude"

.github/workflows/formal.yml

@@ -5,8 +5,14 @@ on:
 
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   build:
     name: Test Formalities
     uses: openwrt/actions-shared-workflows/.github/workflows/formal.yml@main
+    # with:
+    #   # Post formality check summaries to the PR.
+    #   # Repo's permissions need to be updated for actions to modify PRs:
+    #   # https://docs.github.com/en/rest/issues/comments?apiVersion=2022-11-28#create-an-issue-comment
+    #   post_comment: true

config/Config-build.in

@@ -73,6 +73,16 @@ menu "Global build settings"
 		bool "Use APK instead of OPKG to build distribution"
 		default y
 
+	config SIGN_EACH_PACKAGE
+		bool "Cryptographically sign each package .apk file"
+		depends on USE_APK
+		default n if BUILDBOT
+		default y
+		help
+		  Sign also the individual package .apk file. Removes the need for
+		  --allow-untrusted when installing self-compiled packages to a
+		  firmware compiled by the same buildhost as public key matches.
+
 	comment "General build options"
 
 	config TESTING_KERNEL
@@ -108,6 +118,7 @@ menu "Global build settings"
 	config CLEAN_IPKG
 		bool
 		prompt "Remove ipkg/opkg status data files in final images"
+		depends on !USE_APK
 		help
 		  This removes all ipkg/opkg status data files from the target directory
 		  before building the root filesystem.
@@ -250,6 +261,15 @@ menu "Global build settings"
 
 	comment "Hardening build options"
 
+	config PKG_FANALYZER
+		bool
+		prompt "Enable gcc fanalyzer"
+		default n
+		help
+		  Add -fanalyzer to the CFLAGS. As a result of this option, a static analysis
+		  of the program flow is conducted, allowing interprocedural paths to be
+		  identified and warnings to be issued if problems are identified.
+
 	config PKG_CHECK_FORMAT_SECURITY
 		bool
 		prompt "Enable gcc format-security"
@@ -358,9 +378,11 @@ menu "Global build settings"
 		config PKG_FORTIFY_SOURCE_NONE
 			bool "None"
 		config PKG_FORTIFY_SOURCE_1
-			bool "Conservative"
+			bool "Conservative Level 1"
 		config PKG_FORTIFY_SOURCE_2
-			bool "Aggressive"
+			bool "Aggressive Level 2"
+		config PKG_FORTIFY_SOURCE_3
+			bool "Aggressive Level 3"
 	endchoice
 
 	choice
@@ -381,6 +403,15 @@ menu "Global build settings"
 			bool "Full"
 	endchoice
 
+	config PKG_DT_RELR
+		bool "Link with relative relocations (RELR)"
+		depends on (aarch64 || i386 || loongarch64 || x86_64)
+		default y
+		help
+		  Link all applications with -Wl,-z,pack-relative-relocs.
+		  This will reduce the size of many applications.
+		  This is only supported on a limited number of architectures.
+
 	config TARGET_ROOTFS_SECURITY_LABELS
 		bool
 		select KERNEL_SQUASHFS_XATTR

config/Config-images.in

@@ -18,6 +18,7 @@ menu "Target Images"
 			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_mpc85xx
 			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_ramips
 			default TARGET_INITRAMFS_COMPRESSION_ZSTD if TARGET_qualcommax
+			default TARGET_INITRAMFS_COMPRESSION_ZSTD if TARGET_microchipsw
 			default TARGET_INITRAMFS_COMPRESSION_XZ if USES_SEPARATE_INITRAMFS
 			default TARGET_INITRAMFS_COMPRESSION_NONE
 			depends on TARGET_ROOTFS_INITRAMFS
@@ -231,7 +232,7 @@ menu "Target Images"
 	config GRUB_IMAGES
 		bool "Build GRUB images (Linux x86 or x86_64 host only)"
 		depends on TARGET_x86
-		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS
+		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS || TARGET_ROOTFS_EROFS
 		select PACKAGE_grub2
 		select PACKAGE_grub2-bios-setup
 		default y
@@ -239,7 +240,7 @@ menu "Target Images"
 	config GRUB_EFI_IMAGES
 		bool "Build GRUB EFI images"
 		depends on TARGET_x86 || TARGET_armsr || TARGET_loongarch64
-		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS
+		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS || TARGET_ROOTFS_EROFS
 		select PACKAGE_grub2 if TARGET_x86
 		select PACKAGE_grub2-efi if TARGET_x86
 		select PACKAGE_grub2-bios-setup if TARGET_x86
@@ -335,7 +336,7 @@ menu "Target Images"
 		int "Root filesystem partition size (in MiB)"
 		depends on USES_ROOTFS_PART || TARGET_ROOTFS_EXT4FS
 		default 232 if TARGET_loongarch64
-		default 448 if TARGET_mediatek
+		default 448 if TARGET_mediatek || TARGET_microchipsw
 		default 104
 		help
 		  Select the root filesystem partition size.
@@ -355,4 +356,18 @@ menu "Target Images"
 		  across reboots. When enabled, /var/run will still be linked
 		  to /tmp/run.
 
+	config TARGET_PSTORE_BLK_ENABLE
+		bool "Enable creating a PSTORE partition"
+		depends on GRUB_IMAGES || GRUB_EFI_IMAGES
+		help
+		  Create a partition for usage with the pstore-blk kernel module.
+
+	config TARGET_PSTORE_BLK_PARTSIZE
+		int "pstore partition size (in MB)"
+		depends on TARGET_PSTORE_BLK_ENABLE
+
+	config TARGET_PSTORE_BLK_PARTNAME
+		string "pstore partition on target device"
+		depends on TARGET_PSTORE_BLK_ENABLE
+
 endmenu

config/Config-kernel.in

@@ -413,6 +413,102 @@ config KERNEL_PREEMPT_TRACER
 	  enabled. This option and the irqs-off timing option can be
 	  used together or separately.)
 
+config KERNEL_HWLAT_TRACER
+	bool "Tracer to detect hardware latencies (like SMIs)"
+	depends on KERNEL_FTRACE
+	help
+	  This tracer, when enabled will create one or more kernel threads,
+	  depending on what the cpumask file is set to, which each thread
+	  spinning in a loop looking for interruptions caused by
+	  something other than the kernel. For example, if a
+	  System Management Interrupt (SMI) takes a noticeable amount of
+	  time, this tracer will detect it. This is useful for testing
+	  if a system is reliable for Real Time tasks.
+
+	  Some files are created in the tracing directory when this
+	  is enabled:
+
+	    hwlat_detector/width   - time in usecs for how long to spin for
+	    hwlat_detector/window  - time in usecs between the start of each
+				     iteration
+
+	  A kernel thread is created that will spin with interrupts disabled
+	  for "width" microseconds in every "window" cycle. It will not spin
+	  for "window - width" microseconds, where the system can
+	  continue to operate.
+
+	  The output will appear in the trace and trace_pipe files.
+
+	  When the tracer is not running, it has no affect on the system,
+	  but when it is running, it can cause the system to be
+	  periodically non responsive. Do not run this tracer on a
+	  production system.
+
+	  To enable this tracer, echo in "hwlat" into the current_tracer
+	  file. Every time a latency is greater than tracing_thresh, it will
+	  be recorded into the ring buffer.
+
+config KERNEL_OSNOISE_TRACER
+	bool "OS Noise tracer"
+	depends on KERNEL_FTRACE
+	help
+	  In the context of high-performance computing (HPC), the Operating
+	  System Noise (osnoise) refers to the interference experienced by an
+	  application due to activities inside the operating system. In the
+	  context of Linux, NMIs, IRQs, SoftIRQs, and any other system thread
+	  can cause noise to the system. Moreover, hardware-related jobs can
+	  also cause noise, for example, via SMIs.
+
+	  The osnoise tracer leverages the hwlat_detector by running a similar
+	  loop with preemption, SoftIRQs and IRQs enabled, thus allowing all
+	  the sources of osnoise during its execution. The osnoise tracer takes
+	  note of the entry and exit point of any source of interferences,
+	  increasing a per-cpu interference counter. It saves an interference
+	  counter for each source of interference. The interference counter for
+	  NMI, IRQs, SoftIRQs, and threads is increased anytime the tool
+	  observes these interferences' entry events. When a noise happens
+	  without any interference from the operating system level, the
+	  hardware noise counter increases, pointing to a hardware-related
+	  noise. In this way, osnoise can account for any source of
+	  interference. At the end of the period, the osnoise tracer prints
+	  the sum of all noise, the max single noise, the percentage of CPU
+	  available for the thread, and the counters for the noise sources.
+
+	  In addition to the tracer, a set of tracepoints were added to
+	  facilitate the identification of the osnoise source.
+
+	  The output will appear in the trace and trace_pipe files.
+
+	  To enable this tracer, echo in "osnoise" into the current_tracer
+	  file.
+
+config KERNEL_TIMERLAT_TRACER
+	bool "Timerlat tracer"
+	depends on KERNEL_FTRACE
+	help
+	  The timerlat tracer aims to help the preemptive kernel developers
+	  to find sources of wakeup latencies of real-time threads.
+
+	  The tracer creates a per-cpu kernel thread with real-time priority.
+	  The tracer thread sets a periodic timer to wakeup itself, and goes
+	  to sleep waiting for the timer to fire. At the wakeup, the thread
+	  then computes a wakeup latency value as the difference between
+	  the current time and the absolute time that the timer was set
+	  to expire.
+
+	  The tracer prints two lines at every activation. The first is the
+	  timer latency observed at the hardirq context before the
+	  activation of the thread. The second is the timer latency observed
+	  by the thread, which is the same level that cyclictest reports. The
+	  ACTIVATION ID field serves to relate the irq execution to its
+	  respective thread execution.
+
+	  The tracer is build on top of osnoise tracer, and the osnoise:
+	  events can be used to trace the source of interference from NMI,
+	  IRQs and other threads. It also enables the capture of the
+	  stacktrace at the IRQ context, which helps to identify the code
+	  path that can cause thread delay.
+
 config KERNEL_HIST_TRIGGERS
 	bool "Histogram triggers"
 	depends on KERNEL_FTRACE
@@ -597,14 +693,12 @@ choice
 
 	config KERNEL_TRANSPARENT_HUGEPAGE_NEVER
 		bool "never"
-		depends on !LINUX_6_6
 endchoice
 
 config KERNEL_ARM64_CONTPTE
 	bool "Compile the kernel with Contiguous PTE mappings for user memory"
-	depends on KERNEL_ARM64
+	depends on aarch64
 	depends on KERNEL_TRANSPARENT_HUGEPAGE
-	depends on !LINUX_6_6
 	default y
 
 config KERNEL_HUGETLBFS
@@ -862,7 +956,6 @@ if KERNEL_CGROUPS
 	config KERNEL_CPUSETS_V1
 		bool "Legacy cgroup v1 cpusets controller"
 		depends on KERNEL_CPUSETS
-		depends on !LINUX_6_6
 		default n
 		help
 		  Legacy cgroup v1 cpusets controller which has been deprecated by
@@ -921,7 +1014,6 @@ if KERNEL_CGROUPS
 		bool "Legacy cgroup v1 memory controller"
 		default n
 		depends on KERNEL_MEMCG
-		depends on !LINUX_6_6
 		help
 		  Legacy cgroup v1 memory controller which has been deprecated by
 		  cgroup v2 implementation. The v1 is there for legacy applications
@@ -1185,6 +1277,7 @@ config KERNEL_NET_L3_MASTER_DEV
 config KERNEL_DCB
 	bool "Data Center Bridging support"
 	default y if TARGET_armsr_armv8
+	default y if TARGET_microchipsw
 	default y if TARGET_x86_64
 	help
 	  This enables support for configuring Data Center Bridging (DCB)
@@ -1496,3 +1589,72 @@ config KERNEL_WERROR
 	  and unusual warnings, or you have some architecture with problems,
 	  you may need to disable this config option in order to
 	  successfully build the kernel.
+
+choice
+	prompt "Preemption Model"
+	default KERNEL_PREEMPT_NONE
+
+config KERNEL_PREEMPT_NONE
+	bool "No Forced Preemption (Server)"
+	help
+	  This is the traditional Linux preemption model, geared towards
+	  throughput. It will still provide good latencies most of the
+	  time, but there are no guarantees and occasional longer delays
+	  are possible.
+
+	  Select this option if you are building a kernel for a server or
+	  scientific/computation system, or if you want to maximize the
+	  raw processing power of the kernel, irrespective of scheduling
+	  latencies.
+
+config KERNEL_PREEMPT_VOLUNTARY
+	bool "Voluntary Kernel Preemption (Desktop)"
+	help
+	  This option reduces the latency of the kernel by adding more
+	  "explicit preemption points" to the kernel code. These new
+	  preemption points have been selected to reduce the maximum
+	  latency of rescheduling, providing faster application reactions,
+	  at the cost of slightly lower throughput.
+
+	  This allows reaction to interactive events by allowing a
+	  low priority process to voluntarily preempt itself even if it
+	  is in kernel mode executing a system call. This allows
+	  applications to run more 'smoothly' even when the system is
+	  under load.
+
+	  Select this if you are building a kernel for a desktop system.
+
+config KERNEL_PREEMPT
+	bool "Preemptible Kernel (Low-Latency Desktop)"
+	help
+	  This option reduces the latency of the kernel by making
+	  all kernel code (that is not executing in a critical section)
+	  preemptible.  This allows reaction to interactive events by
+	  permitting a low priority process to be preempted involuntarily
+	  even if it is in kernel mode executing a system call and would
+	  otherwise not be about to reach a natural preemption point.
+	  This allows applications to run more 'smoothly' even when the
+	  system is under load, at the cost of slightly lower throughput
+	  and a slight runtime overhead to kernel code.
+
+	  Select this if you are building a kernel for a desktop or
+	  embedded system with latency requirements in the milliseconds
+	  range.
+
+config KERNEL_PREEMPT_RT
+	bool "Fully Preemptible Kernel (Real-Time)"
+	depends on (x86_64 || aarch64 || riscv64)
+	help
+	  This option turns the kernel into a real-time kernel by replacing
+	  various locking primitives (spinlocks, rwlocks, etc.) with
+	  preemptible priority-inheritance aware variants, enforcing
+	  interrupt threading and introducing mechanisms to break up long
+	  non-preemptible sections. This makes the kernel, except for very
+	  low level and critical code paths (entry code, scheduler, low
+	  level interrupt handling) fully preemptible and brings most
+	  execution contexts under scheduler control.
+
+	  Select this if you are building a kernel for systems which
+	  require real-time guarantees.
+
+endchoice

include/cmake.mk

@@ -89,8 +89,8 @@ endif
 define Build/Configure/Default
 	mkdir -p $(CMAKE_BINARY_DIR)
 	(cd $(CMAKE_BINARY_DIR); \
-		CFLAGS="$(TARGET_CFLAGS) $(EXTRA_CFLAGS)" \
-		CXXFLAGS="$(TARGET_CXXFLAGS) $(EXTRA_CXXFLAGS)" \
+		CFLAGS="$(TARGET_CFLAGS) $(EXTRA_CFLAGS) $(TARGET_CPPFLAGS) $(EXTRA_CPPFLAGS)" \
+		CXXFLAGS="$(TARGET_CXXFLAGS) $(EXTRA_CXXFLAGS) $(TARGET_CPPFLAGS) $(EXTRA_CPPFLAGS)" \
 		LDFLAGS="$(TARGET_LDFLAGS) $(EXTRA_LDFLAGS)" \
 		cmake \
 			--no-warn-unused-cli \
@@ -113,7 +113,7 @@ define Build/Configure/Default
 			-DCMAKE_NM="$(CMAKE_NM)" \
 			-DCMAKE_RANLIB="$(CMAKE_RANLIB)" \
 			-DCMAKE_FIND_ROOT_PATH="$(CMAKE_FIND_ROOT_PATH)" \
-			-DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM=BOTH \
+			-DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM=NEVER \
 			-DCMAKE_FIND_ROOT_PATH_MODE_LIBRARY=ONLY \
 			-DCMAKE_FIND_ROOT_PATH_MODE_INCLUDE=ONLY \
 			-DCMAKE_STRIP=: \

include/download.mk

@@ -34,11 +34,9 @@ $(strip \
       $(if $(filter @OPENWRT @APACHE/% @DEBIAN/% @GITHUB/% @GNOME/% @GNU/% @KERNEL/% @SF/% @SAVANNAH/% ftp://% http://% https://% file://%,$(1)),default, \
         $(if $(filter git://%,$(1)),$(call dl_method_git,$(1),$(2)), \
           $(if $(filter svn://%,$(1)),svn, \
-            $(if $(filter cvs://%,$(1)),cvs, \
-              $(if $(filter hg://%,$(1)),hg, \
-                $(if $(filter sftp://%,$(1)),bzr, \
-                  unknown \
-                ) \
+            $(if $(filter hg://%,$(1)),hg, \
+              $(if $(filter sftp://%,$(1)),bzr, \
+                unknown \
               ) \
             ) \
           ) \
@@ -49,7 +47,7 @@ $(strip \
 )
 endef
 
-# code for creating tarballs from cvs/svn/git/bzr/hg/darcs checkouts - useful for mirror support
+# code for creating tarballs from svn/git/bzr/hg/darcs checkouts - useful for mirror support
 dl_pack/bz2=bzip2 -c > $(1)
 dl_pack/gz=gzip -nc > $(1)
 dl_pack/xz=xz -zc -7e > $(1)
@@ -154,28 +152,23 @@ endef
 # $(2): "PKG_" if <name> as in Download/<name> is "default", otherwise "Download/<name>:"
 # $(3): shell command sequence to do the download
 define wrap_mirror
-$(if $(if $(MIRROR),$(filter-out x,$(MIRROR_HASH))),$(SCRIPT_DIR)/download.pl "$(DL_DIR)" "$(FILE)" "$(MIRROR_HASH)" "" || ( $(3) ),$(3)) \
+$(if $(if $(MIRROR), \
+	$(filter-out x,$(MIRROR_HASH))),$(SCRIPT_DIR)/download.pl "$(DL_DIR)" "$(FILE)" "$(MIRROR_HASH)" "" || \
+		( $(3) ) \
+		$(if $(filter-out x,$(MIRROR_HASH)), && ( \
+			file_hash="$$$$($(MKHASH) sha256 "$(DL_DIR)/$(FILE)")"; \
+			[ "$$$$file_hash" = "$(MIRROR_HASH)" ] || [ "$(MIRROR_HASH)" = "skip" ] || { \
+				echo "Hash mismatch for file $(FILE): expected $(MIRROR_HASH), got $$$$file_hash"; \
+				false; \
+			}; \
+		)),
+	$(3)) \
 $(if $(filter check,$(1)), \
 	$(call check_hash,$(FILE),$(MIRROR_HASH),$(2)MIRROR_$(call hash_var,$(MIRROR_MD5SUM))) \
 	$(call check_md5,$(MIRROR_MD5SUM),$(2)MIRROR_MD5SUM,$(2)MIRROR_HASH) \
 )
 endef
 
-define DownloadMethod/cvs
-	$(call wrap_mirror,$(1),$(2), \
-		echo "Checking out files from the cvs repository..."; \
-		mkdir -p $(TMP_DIR)/dl && \
-		cd $(TMP_DIR)/dl && \
-		rm -rf $(SUBDIR) && \
-		[ \! -d $(SUBDIR) ] && \
-		cvs -d $(URL) export $(SOURCE_VERSION) $(SUBDIR) && \
-		echo "Packing checkout..." && \
-		$(call dl_tar_pack,$(TMP_DIR)/dl/$(FILE),$(SUBDIR)) && \
-		mv $(TMP_DIR)/dl/$(FILE) $(DL_DIR)/ && \
-		rm -rf $(SUBDIR); \
-	)
-endef
-
 define DownloadMethod/svn
 	$(call wrap_mirror,$(1),$(2), \
 		echo "Checking out files from the svn repository..."; \
@@ -228,7 +221,7 @@ define DownloadMethod/rawgit
 	[ \! -d $(SUBDIR) ] && \
 	git clone $(OPTS) $(URL) $(SUBDIR) && \
 	(cd $(SUBDIR) && git checkout $(SOURCE_VERSION)) && \
-	export TAR_TIMESTAMP=`cd $(SUBDIR) && git log -1 --format='@%ct'` && \
+	export TAR_TIMESTAMP=`cd $(SUBDIR) && git log -1 --no-show-signature --format='@%ct'` && \
 	echo "Generating formal git archive (apply .gitattributes rules)" && \
 	(cd $(SUBDIR) && git config core.abbrev 8 && \
 	git archive --format=tar HEAD --output=../$(SUBDIR).tar.git) && \
@@ -295,7 +288,6 @@ define DownloadMethod/darcs
 	)
 endef
 
-Validate/cvs=SOURCE_VERSION SUBDIR
 Validate/svn=SOURCE_VERSION SUBDIR
 Validate/git=SOURCE_VERSION SUBDIR
 Validate/bzr=SOURCE_VERSION SUBDIR

include/hardening.mk

@@ -8,6 +8,8 @@ PKG_ASLR_PIE_REGULAR ?= 0
 PKG_SSP ?= 1
 PKG_FORTIFY_SOURCE ?= 1
 PKG_RELRO ?= 1
+PKG_DT_RELR ?= 1
+PKG_FANALYZER ?= 0
 
 ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY
   ifeq ($(strip $(PKG_CHECK_FORMAT_SECURITY)),1)
@@ -51,6 +53,11 @@ ifdef CONFIG_PKG_FORTIFY_SOURCE_2
     TARGET_CFLAGS += -D_FORTIFY_SOURCE=2
   endif
 endif
+ifdef CONFIG_PKG_FORTIFY_SOURCE_3
+  ifeq ($(strip $(PKG_FORTIFY_SOURCE)),1)
+    TARGET_CFLAGS += -D_FORTIFY_SOURCE=3
+  endif
+endif
 ifdef CONFIG_PKG_RELRO_PARTIAL
   ifeq ($(strip $(PKG_RELRO)),1)
     TARGET_CFLAGS += -Wl,-z,relro
@@ -64,3 +71,15 @@ ifdef CONFIG_PKG_RELRO_FULL
   endif
 endif
 
+ifdef CONFIG_PKG_DT_RELR
+  ifeq ($(strip $(PKG_DT_RELR)),1)
+    TARGET_CFLAGS += -Wl,-z,pack-relative-relocs
+    TARGET_LDFLAGS += -zpack-relative-relocs
+  endif
+endif
+
+ifdef CONFIG_PKG_FANALYZER
+  ifeq ($(strip $(PKG_FANALYZER)),1)
+    TARGET_CFLAGS +=  -fanalyzer
+  endif
+endif

include/image-commands.mk

@@ -130,6 +130,33 @@ define Build/append-gl-metadata
 	}
 endef
 
+define Build/append-teltonika-metadata
+	echo \
+		'{$(if $(IMAGE_METADATA),$(IMAGE_METADATA)$(comma)) \
+			"metadata_version": "1.1", \
+			"compat_version": "$(call json_quote,$(compat_version))", \
+			"version":"$(call json_quote,$(VERSION_DIST))-$(call json_quote,$(VERSION_NUMBER))-$(call json_quote,$(REVISION))", \
+			"device_code": [".*"], \
+			"hwver": [".*"], \
+			"batch": [".*"], \
+			"serial": [".*"], \
+			$(if $(DEVICE_COMPAT_MESSAGE),"compat_message": "$(call json_quote,$(DEVICE_COMPAT_MESSAGE))"$(comma)) \
+			$(if $(filter-out 1.0,$(compat_version)),"new_supported_devices": \
+				[$(call metadata_devices,$(SUPPORTED_TELTONIKA_DEVICES))]$(comma) \
+				"supported_devices": ["$(call json_quote,$(legacy_supported_message))"]$(comma)) \
+			$(if $(filter 1.0,$(compat_version)),"supported_devices":[$(call metadata_devices,$(SUPPORTED_TELTONIKA_DEVICES))]$(comma)) \
+			"version_wrt": { \
+			"dist": "$(call json_quote,$(VERSION_DIST))", \
+			"version": "$(call json_quote,$(VERSION_NUMBER))", \
+			"revision": "$(call json_quote,$(REVISION))", \
+			"target": "$(call json_quote,$(TARGETID))", \
+			"board": "$(call json_quote,$(if $(BOARD_NAME),$(BOARD_NAME),$(DEVICE_NAME)))" \
+		}, \
+			"hw_support": {}, \
+			"hw_mods": {$(shell i=1; for mod in $(SUPPORTED_TELTONIKA_HW_MODS); do [ $$i -gt 1 ] && echo -n ,; echo -n "\"mod$$i\": \"$$mod\""; i=$$((i+1)); done)} \
+		}' | fwtool -I - $@
+endef
+
 define Build/append-rootfs
 	dd if=$(IMAGE_ROOTFS) >> $@
 endef
@@ -403,8 +430,11 @@ define Build/initrd_compression
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_ZSTD),.zstd)
 endef
 
-define Build/fit
-	$(call locked,$(TOPDIR)/scripts/mkits.sh \
+define Build/fit-its
+	$(if $(findstring with-rootfs,$(word 3,$(1))), \
+		$(call locked,dd if=$(IMAGE_ROOTFS) of=$(IMAGE_ROOTFS).pagesync bs=4096 conv=sync, \
+		  gen-cpio$(if $(TARGET_PER_DEVICE_ROOTFS),.$(ROOTFS_ID/$(DEVICE_NAME)))))
+	$(TOPDIR)/scripts/mkits.sh \
 		-D $(DEVICE_NAME) -o $@.its -k $@ \
 		-C $(word 1,$(1)) \
 		$(if $(word 2,$(1)),\
@@ -421,12 +451,21 @@ define Build/fit
 		$(if $(DEVICE_DTS_LOADADDR),-s $(DEVICE_DTS_LOADADDR)) \
 		$(if $(DEVICE_DTS_OVERLAY),$(foreach dtso,$(DEVICE_DTS_OVERLAY), -O $(dtso):$(KERNEL_BUILD_DIR)/image-$(dtso).dtbo)) \
 		-c $(if $(DEVICE_DTS_CONFIG),$(DEVICE_DTS_CONFIG),"config-1") \
-		-A $(LINUX_KARCH) -v $(LINUX_VERSION), gen-cpio$(if $(TARGET_PER_DEVICE_ROOTFS),.$(ROOTFS_ID/$(DEVICE_NAME))))
+		-A $(LINUX_KARCH) -v $(LINUX_VERSION)
+endef
+
+define Build/fit-image
 	$(call locked,PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage $(if $(findstring external,$(word 3,$(1))),\
-		-E -B 0x1000 $(if $(findstring static,$(word 3,$(1))),-p 0x1000)) -f $@.its $@.new)
+		-E -B 0x1000 $(if $(findstring static,$(word 3,$(1))),-p 0x1000)) -f $@.its $@.new, \
+	  gen-cpio$(if $(TARGET_PER_DEVICE_ROOTFS),.$(ROOTFS_ID/$(DEVICE_NAME))))
 	@mv $@.new $@
 endef
 
+define Build/fit
+	$(call Build/fit-its,$(1))
+	$(call Build/fit-image,$(1))
+endef
+
 define Build/libdeflate-gzip
 	$(STAGING_DIR_HOST)/bin/libdeflate-gzip -f -12 -c $@ $(1) > $@.new
 	@mv $@.new $@
@@ -492,7 +531,7 @@ define Build/yaffs-filesystem
 		filesystem_size="filesystem_blocks * 64 * 1024" \
 		filesystem_size_with_reserve="(filesystem_blocks + 2) * 64 * 1024"; \
 		head -c $$filesystem_size_with_reserve /dev/zero | tr "\000" "\377" > $@.img \
-		&& yafut -d $@.img -w -i $@ -o kernel -C 1040 -B 64k -E -P -S $(1) \
+		&& yafut -d $@.img -w -i $@ -o $(if $(findstring v7,$@),bootimage,kernel) -C 1040 -B 64k -E -P -S $(1) \
 		&& truncate -s $$filesystem_size $@.img \
 		&& mv $@.img $@
 endef
@@ -530,6 +569,11 @@ define Build/gl-qsdk-factory
 		$(KDIR_TMP)/$(notdir $(BOOT_SCRIPT))
 endef
 
+define Build/kernel-pack-npk
+	$(STAGING_DIR_HOST)/bin/npk_pack_kernel $@ $@.npk
+	mv $@.npk $@
+endef
+
 define Build/linksys-image
 	let \
 		size="$$(stat -c%s $@)" \
@@ -608,6 +652,19 @@ define Build/openmesh-image
 		"$(call param_get_default,rootfs,$(1),$@)" "rootfs"
 endef
 
+define Build/dualboot-datachk-nand-image
+	$(TOPDIR)/scripts/nand-fwupgradecfg-gen.sh \
+		"$(call param_get_default,ce_type,$(1),$(DEVICE_NAME))" \
+		"$@-fwupgrade.cfg" \
+		"$(call param_get_default,kernel,$(1),$(IMAGE_KERNEL))" \
+		"$(call param_get_default,rootfs,$(1),$@)"
+	$(TOPDIR)/scripts/combined-ext-image.sh \
+		"$(call param_get_default,ce_type,$(1),$(DEVICE_NAME))" "$@" \
+		"$@-fwupgrade.cfg" "fwupgrade.cfg" \
+		"$(call param_get_default,kernel,$(1),$(IMAGE_KERNEL))" "kernel" \
+		"$(call param_get_default,rootfs,$(1),$@)" "rootfs"
+endef
+
 define Build/pad-extra
 	dd if=/dev/zero bs=$(1) count=1 >> $@
 endef

include/image.mk

@@ -41,6 +41,9 @@ KDIR=$(KERNEL_BUILD_DIR)
 KDIR_TMP=$(KDIR)/tmp
 DTS_DIR:=$(LINUX_DIR)/arch/$(LINUX_KARCH)/boot/dts
 
+ifeq ($(EXTRA_IMAGE_NAME),)
+EXTRA_IMAGE_NAME:=$(call qstrip,$(CONFIG_EXTRA_IMAGE_NAME))
+endif
 IMG_PREFIX_EXTRA:=$(if $(EXTRA_IMAGE_NAME),$(call sanitize,$(EXTRA_IMAGE_NAME))-)
 IMG_PREFIX_VERNUM:=$(if $(CONFIG_VERSION_FILENAMES),$(call sanitize,$(VERSION_NUMBER))-)
 IMG_PREFIX_VERCODE:=$(if $(CONFIG_VERSION_CODE_FILENAMES),$(call sanitize,$(VERSION_CODE))-)
@@ -114,6 +117,7 @@ fs-types-$(CONFIG_TARGET_ROOTFS_JFFS2_NAND) += $(addprefix jffs2-nand-,$(NAND_BL
 fs-types-$(CONFIG_TARGET_ROOTFS_EXT4FS) += ext4
 fs-types-$(CONFIG_TARGET_ROOTFS_UBIFS) += ubifs
 fs-types-$(CONFIG_TARGET_ROOTFS_EROFS) += erofs
+fs-types-$(CONFIG_TARGET_ROOTFS_TARGZ) += targz
 fs-subtypes-$(CONFIG_TARGET_ROOTFS_JFFS2) += $(addsuffix -raw,$(addprefix jffs2-,$(JFFS2_BLOCKSIZE)))
 
 TARGET_FILESYSTEMS := $(fs-types-y)
@@ -326,6 +330,12 @@ define Image/mkfs/erofs
 		$@ $(call mkfs_target_dir,$(1))
 endef
 
+define Image/mkfs/targz
+	$(TAR) -cp --numeric-owner --owner=0 --group=0 --mode=a-s --sort=name \
+		$(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") \
+		-C $(call mkfs_target_dir,$(1)) . | gzip -9n > $@
+endef
+
 define Image/Manifest
 	$(if $(CONFIG_USE_APK), \
 		$(call apk,$(TARGET_DIR_ORIG)) list --quiet --manifest --no-network \
@@ -595,7 +605,6 @@ define Device/Check/Common
       _PROFILE_SET :=
     endif
   endif
-  DEVICE_PACKAGES += $$(call extra_packages,$$(DEVICE_PACKAGES))
   ifdef TARGET_PER_DEVICE_ROOTFS
     $$(eval $$(call merge_packages,_PACKAGES,$$(DEVICE_PACKAGES) $$(call DEVICE_EXTRA_PACKAGES,$(1))))
     ROOTFS_ID/$(1) := $$(if $$(_PROFILE_SET),$$(call mkfs_packages_id,$$(_PACKAGES)))

include/kernel-defaults.mk

@@ -25,7 +25,6 @@ ifeq ($(strip $(CONFIG_EXTERNAL_KERNEL_TREE)),"")
     define Kernel/Prepare/Default
 	$(LINUX_CAT) $(DL_DIR)/$(LINUX_SOURCE) | $(TAR) -C $(KERNEL_BUILD_DIR) $(TAR_OPTIONS)
 	$(Kernel/Patch)
-	$(if $(QUILT),touch $(LINUX_DIR)/.quilt_used)
     endef
   else
     define Kernel/Prepare/Default

include/kernel.mk

@@ -212,9 +212,8 @@ define KernelPackage
     TITLE:=$(TITLE)
     SECTION:=kernel
     CATEGORY:=Kernel modules
-    DESCRIPTION:=$(DESCRIPTION)
-    EXTRA_DEPENDS:=kernel (=$(LINUX_VERSION)~$(LINUX_VERMAGIC)-r$(LINUX_RELEASE))
-    VERSION:=$(LINUX_VERSION)$(if $(PKG_VERSION),.$(PKG_VERSION))-r$(if $(PKG_RELEASE),$(PKG_RELEASE),$(LINUX_RELEASE))
+    EXTRA_DEPENDS:=kernel (=$(subst -rc,_rc,$(LINUX_VERSION))~$(LINUX_VERMAGIC)-r$(LINUX_RELEASE))
+    VERSION:=$(subst -rc,_rc,$(LINUX_VERSION))$(if $(PKG_VERSION),.$(PKG_VERSION))-r$(if $(PKG_RELEASE),$(PKG_RELEASE),$(LINUX_RELEASE))
     PKGFLAGS:=$(PKGFLAGS)
     $(call KernelPackage/$(1))
     $(call KernelPackage/$(1)/$(BOARD))
@@ -306,4 +305,3 @@ kernel_patchver_ge=$(call kernel_version_cmp,-ge,$(KERNEL_PATCHVER),$(1))
 kernel_patchver_eq=$(call kernel_version_cmp,-eq,$(KERNEL_PATCHVER),$(1))
 kernel_patchver_le=$(call kernel_version_cmp,-le,$(KERNEL_PATCHVER),$(1))
 kernel_patchver_lt=$(call kernel_version_cmp,-lt,$(KERNEL_PATCHVER),$(1))
-

include/netfilter.mk

@@ -358,7 +358,6 @@ $(eval $(if $(NF_KMOD),$(call nf_add,NFT_CONNLIMIT,CONFIG_NFT_CONNLIMIT, $(P_XT)
 IPT_BUILTIN += $(NF_IPT-y) $(NF_IPT-m)
 IPT_BUILTIN += $(IPT_CORE-y) $(IPT_CORE-m)
 IPT_BUILTIN += $(NF_CONNTRACK-y)
-IPT_BUILTIN += $(NF_CONNTRACK6-y)
 IPT_BUILTIN += $(IPT_CONNTRACK-y)
 IPT_BUILTIN += $(IPT_CONNTRACK_EXTRA-y)
 IPT_BUILTIN += $(IPT_EXTRA-y)

include/openssl-module.mk

@@ -3,6 +3,7 @@
 # Copyright (C) 2022-2023 Enéas Ulir de Queiroz
 
 ENGINES_DIR=engines-3
+MODULES_DIR=ossl-modules
 
 define Package/openssl/module/Default
   SECTION:=libs
@@ -74,6 +75,6 @@ endef
 # 1 = provider name
 # 2 = [ package name, defaults to libopenssl-$(1) ]
 define Package/openssl/add-provider
-  $(call Package/openssl/add-module,provider,$(1),/usr/lib/ossl-modules,$(2))
+  $(call Package/openssl/add-module,provider,$(1),/usr/lib/$(MODULES_DIR),$(2))
 endef
 

include/package-defaults.mk

@@ -20,7 +20,7 @@ define Package/Default
   PROVIDES:=
   EXTRA_DEPENDS:=
   MAINTAINER:=$(PKG_MAINTAINER)
-  SOURCE:=$(patsubst $(TOPDIR)/%,%,$(patsubst $(TOPDIR)/package/%,feeds/base/%,$(CURDIR)))
+  SOURCE:=$(patsubst $(TOPDIR)/%,%,$(if $(__pkg_source_makefile),$(__pkg_source_makefile),$(CURDIR)))
   ifneq ($(PKG_VERSION),)
     ifneq ($(PKG_RELEASE),)
       VERSION:=$(PKG_VERSION)-r$(PKG_RELEASE)

include/package-pack.mk

@@ -18,10 +18,20 @@ define gen_package_wildcard
   $(1)$$(if $$(filter -%,$$(ABIV_$(1))),,[^a-z$(if $(CONFIG_USE_APK),,-)])*
 endef
 
+# 1: command and initial arguments
+# 2: arguments list
+# 3: tmp filename
+define maybe_use_xargs
+  $(if $(word 512,$(2)), \
+    $(file >$(3),$(2)) $(XARGS) $(1) < "$(3)"; rm "$(3)", \
+    $(1) $(2))
+endef
+
 # 1: package name
 # 2: candidate ipk files
 define remove_ipkg_files
-  $(if $(strip $(2)),$(SCRIPT_DIR)/ipkg-remove $(1) $(2))
+  $(if $(strip $(2)), \
+    $(call maybe_use_xargs,$(SCRIPT_DIR)/ipkg-remove $(1),$(2),$(TMP_DIR)/$(1).in))
 endef
 
 # 1: package name
@@ -68,6 +78,196 @@ define FixupDependencies
   $(call AddDependency,$(1),$$(DEPS))
 endef
 
+# Format dependencies and extra dependencies
+#
+# ABI-version EXTRA_DEPENDS so dependencies can be correctly looked up using the
+# existing semantics without the ABI specified. This is needed since ABI-
+# versioned libraries don't provide `${package_name}=${package_version}`, so
+# that same library but with different ABI versions can be installed side by
+# side.
+#
+# Remove duplicate dependencies when EXTRA_DEPENDS specifies a versioned one
+# that is already in DEPENDS.
+#
+# 1: list of dependencies
+# 2: list of extra dependencies
+define FormatDepends
+$(strip
+  $(eval _COMMA_SEP := __COMMA_SEP__)
+  $(eval _SPACE_SEP := __SPACE_SEP__)
+  $(eval _DEPENDS := $(1))
+  $(eval _EXTRA_DEPENDS_ABI := )
+  $(eval _DEP_ITEMS := $(subst $(_COMMA_SEP),$(space),$(subst $(space),$(_SPACE_SEP),$(subst $(comma),$(_COMMA_SEP),$(2)))))
+
+  $(foreach dep,$(_DEP_ITEMS),
+    $(eval _EXTRA_DEP := )
+    $(eval _CUR_DEP := $(subst $(_SPACE_SEP),$(space),$(strip $(dep))))
+    $(eval _PKG_NAME := $(word 1,$(_CUR_DEP)))
+    $(if $(findstring $(paren_left), $(_PKG_NAME)),
+      $(error "Unsupported extra dependency format: no space before '(': $(_CUR_DEP)"))
+    )
+    $(eval _ABI_SUFFIX := $(call GetABISuffix,$(_PKG_NAME)))
+    $(eval _PKG_NAME_ABI := $(_PKG_NAME)$(_ABI_SUFFIX))
+    $(eval _VERSION_CONSTRAINT := $(word 2,$(_CUR_DEP)))
+    $(if $(_VERSION_CONSTRAINT),
+      $(eval _EXTRA_DEP := $(_PKG_NAME_ABI) $(_VERSION_CONSTRAINT)),
+      $(error "Extra dependencies must have version constraints. $(_PKG_NAME) seems to be unversioned.")
+    )
+    $(if $(and $(_EXTRA_DEPENDS_ABI),$(_EXTRA_DEP)),
+      $(eval _EXTRA_DEPENDS_ABI := $(_EXTRA_DEPENDS_ABI)$(comma)$(_EXTRA_DEP)),
+      $(eval _EXTRA_DEPENDS_ABI := $(_EXTRA_DEP))
+    )
+    $(if $(_DEPENDS),
+      $(eval _DEPENDS := $(filter-out $(_PKG_NAME_ABI),$(_DEPENDS)))
+    )
+  )
+
+  $(eval _DEPENDS := $(call mergelist,$(_DEPENDS)))
+  $(_EXTRA_DEPENDS_ABI)$(if $(_DEPENDS),$(comma) $(_DEPENDS))
+)
+endef
+
+# Format provide and add ABI and version if it's not a virtual provide marked
+# with an @.
+#
+# Same as for the base package name, if ABI version is set, provide both
+# unversioned provide and one with ABI version and version.
+#
+# 1: provide name
+# 2: provide version
+# 3: (optional) ABI version
+define AddProvide
+$(strip
+  $(if $(filter @%,$(1)),
+    $(patsubst @%,%,$(1)),
+    $(if $(3),
+      $(1) $(1)$(call FormatABISuffix,$(1),$(3))=$(2),
+      $(1)=$(2)
+    )
+  )
+)
+endef
+
+# Remove virtual provides prefix and self. apk doesn't like it when packages
+# specify a redundant provide pointing to self.
+#
+# 1: package name
+# 2: list of provides
+define SanitizeProvides
+$(filter-out $(1),$(patsubst @%,%,$(2)))
+endef
+
+# Format provides both for apk and control
+#
+# - If ABI version is defined:
+#   - package is named `${package_name}${ABI_version}`
+#     if a `package_name` ends in a number, the `ABI_version` will be prefixed
+#     with a - sign, e.g.: libsqlite3-0
+#   - package implicitly provides
+#     `${package_name}${ABI_version}=${package_version}`
+#     this implies that only one version of a package per ABI can be installed
+#     at the same time
+#   - additionally provide `${package_name}` so multiple packages can be looked
+#     up by its base name
+#   - for each `provides`:
+#     - provide `${provide}${ABI_version}=${package_version}`
+#       this implies that only one version of a provide can be installed at the
+#       same time
+#     - if a `provide` ends in a number, the `ABI_version` will be prefixed with
+#       a - sign, e.g.: provide1-0
+#     - additionally provide `${provide}` so multiple packages can be looked up
+#       by its base name
+#
+# - else if ABI version is _not_ defined
+#   - package is named `${package_name}`
+#   - package implicitly provides `${package_name}=${package_version}`
+#     this implies that only one version of a package can be installed at the
+#     same time
+#   - for each `provides`, provide `${provide}=${package_version}` this implies
+#     that only one version of a provide can be installed at the same time
+#
+# - Both with and without an ABI, if a provide starts with an @, treat it as a
+#   virtual provide, that doesn't own the name by not appending version.
+#   Multiple packages with the same virtual provides can be installed
+#   side-by-side.
+#
+# - apk doesn't like it when packages specify a redundant provide pointing to
+#   self. Filter it out, but keep virtual self provides, in the form of
+#   @(kmod-)?${package_name}-any.
+#
+# - Packages implicitly add a virtual @${package_name}-any provide in Package,
+#   which implies that kmods, which are also packages, will have a virtual
+#   @kmod-${package_name}-any provide.
+#
+# - Aside from the two aforementioned implicit provides, packages are expected
+#   to manage their provides themselves.
+#
+# - When multiple variants inside the same package have the same provide, a
+#   default variant must be set using DEFAULT_VARIANT:=1.
+#
+# - Cross-package provides must be virtual and a default variant must be set. If
+#   different packages provide the same versioned (i.e. non-virtual) provide the
+#   package with a higher version will be preferred, which results in unintended
+#   behavior, because the order might change with package updates.
+#
+#   Example:
+#   - both uclient-fetch and wget provide wget
+#   - wget doesn't have a default variant called wget that would provide an
+#     implicit @wget-any
+#     - add wget to PROVIDES for both wget-ssl and wget-nossl variants so they
+#       can't be installed at the same time
+#     - add @wget-any to both packages so packages outside of wget can provide
+#       it
+#   - uclient-fetch has only one variant
+#     - add @wget-any to PROVIDES
+#     - mark uclient-fetch as the default variant using DEFAULT_VARIANT:=1
+#   - switch wget consumer that don't depend on a specific version like apk to
+#     depend on @wget-any
+#
+# - Alternatives don't affect the packaging.
+#
+# 1: package name
+# 2: package version
+# 3: ABI version
+# 4: list of provides
+define FormatProvides
+$(strip \
+  $(if $(call FormatABISuffix,$(1),$(3)), \
+    $(1) $(foreach provide, \
+      $(filter-out $(1),$(4)), \
+      $(call AddProvide,$(provide),$(2),$(3)) \
+    ), \
+    $(foreach provide, \
+      $(filter-out $(1),$(4)), \
+      $(call AddProvide,$(provide),$(2)) \
+    ) \
+  ) \
+)
+endef
+
+# Get apk provider priority
+#
+# - if a package is marked as a default variant, set it to 100.
+#
+# - if a package has an ABI version defined, set it to 10.
+#   The enables packages with an ABI version to be installed by their base name
+#   instead of a name and an ABI version, e.g.:
+#   libfoo3, where 3 is the ABI version can be installed by just libfoo.
+#   This affects manual installation only, as the dependency resolution takes
+#   care of ABI versions.
+#
+# - otherwise return nothing, i.e. package will have the default priority 0.
+#
+# 1: Default variant
+# 2: ABI version
+define GetProviderPriority
+$(strip
+  $(if $(1),100,
+    $(if $(2),10)
+  )
+)
+endef
+
 ifneq ($(PKG_NAME),toolchain)
   define CheckDependencies
 	@( \
@@ -181,17 +381,33 @@ endif
     $(STAGING_DIR_ROOT)/stamp/.$(1)_installed: $(PKG_BUILD_DIR)/.pkgdir/$(1).installed
 	mkdir -p $(STAGING_DIR_ROOT)/stamp
 	$(if $(ABI_VERSION),echo '$(ABI_VERSION)' | cmp -s - $(PKG_INFO_DIR)/$(1).version || { \
+		mkdir -p $(PKG_INFO_DIR); \
 		echo '$(ABI_VERSION)' > $(PKG_INFO_DIR)/$(1).version; \
-		$(foreach pkg,$(filter-out $(1),$(PROVIDES)), \
+		$(foreach pkg,$(call SanitizeProvides,$(1),$(PROVIDES)), \
 			cp $(PKG_INFO_DIR)/$(1).version $(PKG_INFO_DIR)/$(pkg).version; \
 		) \
 	} )
 	$(call locked,$(CP) $(PKG_BUILD_DIR)/.pkgdir/$(1)/. $(STAGING_DIR_ROOT)/,root-copy)
 	touch $$@
 
-    Package/$(1)/DEPENDS := $$(call mergelist,$$(foreach dep,$$(filter-out @%,$$(IDEPEND_$(1))),$$(dep)$$(call GetABISuffix,$$(dep))))
+    Package/$(1)/DEPENDS := $$(foreach dep,$$(filter-out @%,$$(IDEPEND_$(1))),$$(dep)$$(call GetABISuffix,$$(dep)))
     ifneq ($$(EXTRA_DEPENDS),)
-      Package/$(1)/DEPENDS := $$(EXTRA_DEPENDS)$$(if $$(Package/$(1)/DEPENDS),$$(comma) $$(Package/$(1)/DEPENDS))
+      ifeq ($(CONFIG_USE_APK),)
+        Package/$(1)/DEPENDS := $$(call mergelist,$$(Package/$(1)/DEPENDS))
+        Package/$(1)/DEPENDS := $$(EXTRA_DEPENDS)$$(if $$(Package/$(1)/DEPENDS),$$(comma) $$(Package/$(1)/DEPENDS))
+      else
+        Package/$(1)/DEPENDS := $$(call FormatDepends,$$(Package/$(1)/DEPENDS),$$(EXTRA_DEPENDS))
+      endif
+    else
+      Package/$(1)/DEPENDS := $$(call mergelist,$$(Package/$(1)/DEPENDS))
+    endif
+
+    ifeq ($(CONFIG_USE_APK),)
+      Package/$(1)/PROVIDES := $$(patsubst @%,%,$(PROVIDES))
+      Package/$(1)/PROVIDES := $$(filter-out $(1)$$(ABIV_$(1)),$$(Package/$(1)/PROVIDES)$$(if $$(ABIV_$(1)), $(1) $$(foreach provide,$$(Package/$(1)/PROVIDES),$$(provide)$$(ABIV_$(1)))))
+    else
+      Package/$(1)/PROVIDES := $$(call FormatProvides,$(1),$(VERSION),$(ABI_VERSION),$(PROVIDES))
+      Package/$(1)/PRIORITY := $$(call GetProviderPriority,$(DEFAULT_VARIANT),$(ABI_VERSION))
     endif
 
 $(_define) Package/$(1)/CONTROL
@@ -199,7 +415,7 @@ Package: $(1)$$(ABIV_$(1))
 Version: $(VERSION)
 $$(call addfield,Depends,$$(Package/$(1)/DEPENDS)
 )$$(call addfield,Conflicts,$$(call mergelist,$(CONFLICTS))
-)$$(call addfield,Provides,$$(call mergelist,$$(filter-out $(1)$$(ABIV_$(1)),$(PROVIDES)$$(if $$(ABIV_$(1)), $(1) $(foreach provide,$(PROVIDES),$(provide)$$(ABIV_$(1))))))
+)$$(call addfield,Provides,$$(call mergelist,$$(Package/$(1)/PROVIDES))
 )$$(call addfield,Alternatives,$$(call mergelist,$(ALTERNATIVES))
 )$$(call addfield,Source,$(SOURCE)
 )$$(call addfield,SourceName,$(PKG_NAME)
@@ -219,9 +435,10 @@ Installed-Size: 0
 $(_endef)
 
     $$(PACK_$(1)) : export CONTROL=$$(Package/$(1)/CONTROL)
-    $$(PACK_$(1)) : export DESCRIPTION=$$(Package/$(1)/description)
+    $$(PACK_$(1)) : $(call shexport,Package/$(1)/description)
     $$(PACK_$(1)) : export PATH=$$(TARGET_PATH_PKG)
     $$(PACK_$(1)) : export PKG_SOURCE_DATE_EPOCH:=$(PKG_SOURCE_DATE_EPOCH)
+    $$(PACK_$(1)) : export SOURCE_DATE_EPOCH:=$(PKG_SOURCE_DATE_EPOCH)
     $(PKG_INFO_DIR)/$(1).provides $$(PACK_$(1)): $(STAMP_BUILT) $(INCLUDE_DIR)/package-pack.mk
 	rm -rf $$(IDIR_$(1))
 ifeq ($$(CONFIG_USE_APK),)
@@ -233,7 +450,7 @@ endif
 	$(call Package/$(1)/install,$$(IDIR_$(1)))
 	$(if $(Package/$(1)/install-overlay),mkdir -p $(PACKAGE_DIR) $$(IDIR_$(1))/rootfs-overlay)
 	$(call Package/$(1)/install-overlay,$$(IDIR_$(1))/rootfs-overlay)
-	-find $$(IDIR_$(1)) -name 'CVS' -o -name '.svn' -o -name '.#*' -o -name '*~'| $(XARGS) rm -rf
+	-find $$(IDIR_$(1)) -name '.svn' -o -name '.#*' -o -name '*~'| $(XARGS) rm -rf
 	@( \
 		find $$(IDIR_$(1)) -name lib\*.so\* -or -name \*.ko | awk -F/ '{ print $$$$NF }'; \
 		for file in $$(patsubst %,$(PKG_INFO_DIR)/%.provides,$$(IDEPEND_$(1))); do \
@@ -242,7 +459,7 @@ endif
 			fi; \
 		done; $(Package/$(1)/extra_provides) \
 	) | sort -u > $(PKG_INFO_DIR)/$(1).provides
-	$(if $(PROVIDES),@for pkg in $(filter-out $(1),$(PROVIDES)); do cp $(PKG_INFO_DIR)/$(1).provides $(PKG_INFO_DIR)/$$$$pkg.provides; done)
+	$(if $(PROVIDES),@for pkg in $(call SanitizeProvides,$(1),$(PROVIDES)); do cp $(PKG_INFO_DIR)/$(1).provides $(PKG_INFO_DIR)/$$$$pkg.provides; done)
 	$(CheckDependencies)
 
 	$(RSTRIP) $$(IDIR_$(1))
@@ -269,14 +486,14 @@ endif
 		)
     endif
 
-	$(INSTALL_DIR) $$(PDIR_$(1))/tmp
+	$(INSTALL_DIR) $$(PDIR_$(1))
 
 ifeq ($(CONFIG_USE_APK),)
 	mkdir -p $$(IDIR_$(1))/CONTROL
 	(cd $$(IDIR_$(1))/CONTROL; \
 		( \
 			echo "$$$$CONTROL"; \
-			printf "Description: "; echo "$$$$DESCRIPTION" | sed -e 's,^[[:space:]]*, ,g'; \
+			printf "Description: "; echo "$$$$$(call shvar,Package/$(1)/description)" | sed -e 's,^[[:space:]]*, ,g'; \
 		) > control; \
 		chmod 644 control; \
 		( \
@@ -309,24 +526,24 @@ else
 		echo "[ -s "\$$$${IPKG_INSTROOT}/lib/functions.sh" ] || exit 0"; \
 		echo ". \$$$${IPKG_INSTROOT}/lib/functions.sh"; \
 		echo 'export root="$$$${IPKG_INSTROOT}"'; \
-		echo 'export pkgname="$(1)"'; \
+		echo 'export pkgname="$(1)$$(ABIV_$(1))"'; \
 		echo "add_group_and_user"; \
 		echo "default_postinst"; \
-		[ ! -f $$(ADIR_$(1))/postinst-pkg ] || sed -z 's/^\s*#!/#!/' "$$(ADIR_$(1))/postinst-pkg"; \
+		[ ! -f $$(ADIR_$(1))/postinst-pkg ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/postinst-pkg"; \
 	) > $$(ADIR_$(1))/post-install;
 
     ifdef Package/$(1)/preinst
 	( \
 		echo "#!/bin/sh"; \
 		echo 'export PKG_UPGRADE=1'; \
-		[ ! -f $$(ADIR_$(1))/preinst ] || sed -z 's/^\s*#!/#!/' "$$(ADIR_$(1))/preinst"; \
+		[ ! -f $$(ADIR_$(1))/preinst ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/preinst"; \
 	) > $$(ADIR_$(1))/pre-upgrade;
     endif
 
 	( \
 		echo "#!/bin/sh"; \
 		echo 'export PKG_UPGRADE=1'; \
-		[ ! -f $$(ADIR_$(1))/post-install ] || sed -z 's/^\s*#!/#!/' "$$(ADIR_$(1))/post-install"; \
+		[ ! -f $$(ADIR_$(1))/post-install ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/post-install"; \
 	) > $$(ADIR_$(1))/post-upgrade;
 
 	( \
@@ -334,34 +551,34 @@ else
 		echo "[ -s "\$$$${IPKG_INSTROOT}/lib/functions.sh" ] || exit 0"; \
 		echo ". \$$$${IPKG_INSTROOT}/lib/functions.sh"; \
 		echo 'export root="$$$${IPKG_INSTROOT}"'; \
-		echo 'export pkgname="$(1)"'; \
+		echo 'export pkgname="$(1)$$(ABIV_$(1))"'; \
 		echo "default_prerm"; \
-		[ ! -f $$(ADIR_$(1))/prerm-pkg ] || sed -z 's/^\s*#!/#!/' "$$(ADIR_$(1))/prerm-pkg"; \
+		[ ! -f $$(ADIR_$(1))/prerm-pkg ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/prerm-pkg"; \
 	) > $$(ADIR_$(1))/pre-deinstall;
 
 	[ ! -f $$(ADIR_$(1))/postrm ] || sed -zi 's/^\s*#!/#!/' "$$(ADIR_$(1))/postrm";
 
-	if [ -n "$(USERID)" ]; then echo $(USERID) > $$(IDIR_$(1))/lib/apk/packages/$(1).rusers; fi;
-	if [ -n "$(ALTERNATIVES)" ]; then echo $(ALTERNATIVES) > $$(IDIR_$(1))/lib/apk/packages/$(1).alternatives; fi;
-	(cd $$(IDIR_$(1)) && find . -type f,l -printf "/%P\n" > $$(IDIR_$(1))/lib/apk/packages/$(1).list)
+	if [ -n "$(USERID)" ]; then echo $(USERID) > $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).rusers; fi;
+	if [ -n "$(ALTERNATIVES)" ]; then echo $(ALTERNATIVES) > $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).alternatives; fi;
+	(cd $$(IDIR_$(1)) && find . -type f,l -printf "/%P\n" | sort > $(TMP_DIR)/$(1).list && mv $(TMP_DIR)/$(1).list $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).list)
 	# Move conffiles to IDIR and build conffiles_static with csums
 	if [ -f $$(ADIR_$(1))/conffiles ]; then \
-		mv -f $$(ADIR_$(1))/conffiles $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles; \
-		for file in $$$$(cat $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles); do \
+		mv -f $$(ADIR_$(1))/conffiles $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles; \
+		for file in $$$$(cat $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles); do \
 			[ -f $$(IDIR_$(1))/$$$$file ] || continue; \
 			csum=$$$$($(MKHASH) sha256 $$(IDIR_$(1))/$$$$file); \
-			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles_static; \
+			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles_static; \
 		done; \
 	fi
 
 	# Some package (base-files) manually append stuff to conffiles
 	# Append stuff from it and delete the CONTROL directory since everything else should be migrated
 	if [ -f $$(IDIR_$(1))/CONTROL/conffiles ]; then \
-		echo $$$$(IDIR_$(1))/CONTROL/conffiles >> $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles; \
+		echo $$$$(IDIR_$(1))/CONTROL/conffiles >> $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles; \
 		for file in $$$$(cat $$(IDIR_$(1))/CONTROL/conffiles); do \
 			[ -f $$(IDIR_$(1))/$$$$file ] || continue; \
 			csum=$$$$($(MKHASH) sha256 $$(IDIR_$(1))/$$$$file); \
-			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles_static; \
+			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles_static; \
 		done; \
 		rm -rf $$(IDIR_$(1))/CONTROL/conffiles; \
 	fi
@@ -383,22 +600,13 @@ else
 	  --info "origin:$(SOURCE)" \
 	  --info "url:$(URL)" \
 	  --info "maintainer:$(MAINTAINER)" \
-	  --info "provides:$$(foreach prov,\
-			$$(filter-out $(1)$$(ABIV_$(1)), \
-			$(PROVIDES)$$(if $$(ABIV_$(1)), \
-				$(1)=$(VERSION) $(foreach provide, \
-					$(PROVIDES), \
-					$(provide)$$(ABIV_$(1))=$(VERSION) \
-				) \
-			) \
-		), \
-		$$(prov) )" \
-	  $(if $(DEFAULT_VARIANT),--info "provider-priority:100",$(if $(PROVIDES),--info "provider-priority:1")) \
+	  $$(if $$(Package/$(1)/PROVIDES),--info "provides:$$(Package/$(1)/PROVIDES)") \
+	  $$(if $$(Package/$(1)/PRIORITY),--info "provider-priority:$$(Package/$(1)/PRIORITY)") \
 	  $$(APK_SCRIPTS_$(1)) \
 	  --info "depends:$$(foreach depends,$$(subst $$(comma),$$(space),$$(subst $$(space),,$$(subst $$(paren_right),,$$(subst $$(paren_left),,$$(Package/$(1)/DEPENDS))))),$$(depends))" \
 	  --files "$$(IDIR_$(1))" \
-	  --output "$$(PACK_$(1))" \
-	  --sign "$(BUILD_KEY_APK_SEC)"
+	  $(if $(CONFIG_SIGN_EACH_PACKAGE),--sign $(BUILD_KEY_APK_SEC),) \
+	  --output "$$(PACK_$(1))"
 endif
 
 	@[ -f $$(PACK_$(1)) ]

include/package.mk

@@ -134,6 +134,35 @@ endef
 
 PKG_INSTALL_STAMP:=$(PKG_INFO_DIR)/$(PKG_DIR_NAME).$(if $(BUILD_VARIANT),$(BUILD_VARIANT),default).install
 
+# Normalize package SOURCE entry to pack reproducible package
+# If we are packing a package with OpenWrt buildroot:
+# - Replace package/... with feeds/base/...
+# If we are packing a package with SDK:
+# - Replace feeds/.*_root/... with feeds/.*/... and remove
+#   the intermediate directory to reflect what the symbolic link
+#   points to.
+#   Example:
+#   Feed link: feeds/base_root/package -> feeds/base
+#   Package: feeds/base_root/package/system/uci -> feeds/base/system/uci
+ifeq ($(DUMP),)
+  __pkg_base_path:=$(patsubst $(TOPDIR)/%,%,$(CURDIR))
+  __pkg_provider_path:=$(word 1,$(subst /, ,$(__pkg_base_path)))
+  ifeq ($(__pkg_provider_path), feeds)
+    __pkg_feed_path:=$(word 2,$(subst /, ,$(__pkg_base_path)))
+    __pkg_feed_name:=$(patsubst %_root,%,$(__pkg_feed_path))
+    ifneq (__pkg_feed_path, __pkg_feed_name)
+      __pkg_feed_realpath:=$(realpath $(TOPDIR)/feeds/$(__pkg_feed_name))
+      __pkg_feed_dir:=$(patsubst $(TOPDIR)/feeds/$(__pkg_feed_path)/%,%,$(__pkg_feed_realpath))
+      __pkg_path:=$(patsubst feeds/$(__pkg_feed_path)/$(__pkg_feed_dir)/%,%,$(__pkg_base_path))
+    else
+      __pkg_path:=$(patsubst feeds/$(__pkg_feed_path)/%,%,$(__pkg_base_path))
+    endif
+    __pkg_source_makefile:=$(TOPDIR)/feeds/$(__pkg_feed_name)/$(__pkg_path)
+  else ifeq ($(__pkg_provider_path), package)
+    __pkg_source_makefile:=$(TOPDIR)/feeds/base/$(patsubst package/%,%,$(__pkg_base_path))
+  endif
+endif
+
 include $(INCLUDE_DIR)/package-defaults.mk
 include $(INCLUDE_DIR)/package-dumpinfo.mk
 include $(INCLUDE_DIR)/package-pack.mk
@@ -303,9 +332,12 @@ define BuildPackage
   $(eval $(Package/Default))
   $(eval $(Package/$(1)))
 
-ifdef DESCRIPTION
-$$(error DESCRIPTION:= is obsolete, use Package/PKG_NAME/description)
-endif
+  # Add an implicit self-provide. apk can't handle self provides, be it
+  # versioned or virtual, so opt for a suffix instead. This allows several
+  # variants to provide the same virtual package without adding extra provides
+  # to the default one, e.g. wget implicitly provides wget-any and is marked as
+  # default, so wget-ssl can explicitly provide @wget-any as well.
+  $(eval PROVIDES:=$(strip @$(1)-any $(PROVIDES)))
 
 ifndef Package/$(1)/description
 define Package/$(1)/description
@@ -359,7 +391,7 @@ prepare-package-install:
 $(PACKAGE_DIR):
 	mkdir -p $@
 
-compile:
+compile: prepare-package-install
 .install: .compile
 install: compile
 

include/prereq-build.mk

@@ -9,11 +9,11 @@ SHELL:=sh
 PKG_NAME:=Build dependency
 
 $(eval $(call TestHostCommand,true, \
-	Please install GNU 'coreutils', \
+	Please install 'coreutils', \
 	$(TRUE)))
 
 $(eval $(call TestHostCommand,false, \
-	Please install GNU 'coreutils', \
+	Please install 'coreutils', \
 	$(FALSE); [ $$$$$$$$? = 1 ] && $(TRUE)))
 
 # Required for the toolchain
@@ -126,10 +126,12 @@ $(eval $(call SetupHostCommand,diff,Please install GNU diffutils, \
 	diff --version 2>&1 | grep GNU))
 
 $(eval $(call SetupHostCommand,cp,Please install GNU fileutils, \
+	$(TOPDIR)/staging_dir/host/bin/gcp --help 2>&1 | grep 'Copy SOURCE', \
 	gcp --help 2>&1 | grep 'Copy SOURCE', \
 	cp --help 2>&1 | grep 'Copy SOURCE'))
 
 $(eval $(call SetupHostCommand,seq,Please install seq, \
+	$(TOPDIR)/staging_dir/host/bin/gseq --version, \
 	gseq --version, \
 	seq --version 2>&1 | grep seq))
 
@@ -153,10 +155,12 @@ $(eval $(call SetupHostCommand,getopt, \
 	/opt/local/bin/getopt -o t --long test -- --test | grep '^ *--test *--'))
 
 $(eval $(call SetupHostCommand,realpath,Please install a 'realpath' utility, \
+	$(TOPDIR)/staging_dir/host/bin/grealpath /, \
 	grealpath /, \
 	realpath /))
 
 $(eval $(call SetupHostCommand,stat,Cannot find a file stat utility, \
+	$(TOPDIR)/staging_dir/host/bin/gstat -c%s $(TOPDIR)/Makefile, \
 	gnustat -c%s $(TOPDIR)/Makefile, \
 	gstat -c%s $(TOPDIR)/Makefile, \
 	stat -c%s $(TOPDIR)/Makefile))
@@ -174,14 +178,16 @@ $(eval $(call SetupHostCommand,bzip2,Please install 'bzip2', \
 $(eval $(call SetupHostCommand,wget,Please install GNU 'wget', \
 	wget --version | grep GNU))
 
-$(eval $(call SetupHostCommand,install,Please install GNU 'install', \
-	install --version | grep GNU, \
+$(eval $(call SetupHostCommand,install,Please install 'install', \
+	$(TOPDIR)/staging_dir/host/bin/ginstall --version | grep GNU, \
+	install --version | grep 'GNU\|uutils', \
 	ginstall --version | grep GNU))
 
 $(eval $(call SetupHostCommand,perl,Please install Perl 5.x, \
 	perl --version | grep "perl.*v5"))
 
 $(eval $(call SetupHostCommand,python,Please install Python >= 3.7, \
+	python3.13 -V 2>&1 | grep 'Python 3', \
 	python3.12 -V 2>&1 | grep 'Python 3', \
 	python3.11 -V 2>&1 | grep 'Python 3', \
 	python3.10 -V 2>&1 | grep 'Python 3', \
@@ -191,6 +197,7 @@ $(eval $(call SetupHostCommand,python,Please install Python >= 3.7, \
 	python3 -V 2>&1 | grep -E 'Python 3\.([7-9]|[0-9][0-9])\.?'))
 
 $(eval $(call SetupHostCommand,python3,Please install Python >= 3.7, \
+	python3.13 -V 2>&1 | grep 'Python 3', \
 	python3.12 -V 2>&1 | grep 'Python 3', \
 	python3.11 -V 2>&1 | grep 'Python 3', \
 	python3.10 -V 2>&1 | grep 'Python 3', \
@@ -232,7 +239,7 @@ endif
 
 $(STAGING_DIR_HOST)/bin/mkhash: $(SCRIPT_DIR)/mkhash.c
 	mkdir -p $(dir $@)
-	$(CC) -O2 -I$(TOPDIR)/tools/include -o $@ $<
+	$(STAGING_DIR_HOST)/bin/gcc -O2 -I$(TOPDIR)/tools/include -o $@ $<
 
 $(STAGING_DIR_HOST)/bin/xxd: $(SCRIPT_DIR)/xxdi.pl
 	$(LN) $< $@

include/prereq.mk

@@ -71,7 +71,7 @@ endef
 # 4: optional link library test (example -lncurses)
 define RequireCHeader
   define Require/$(1)
-    echo 'int main(int argc, char **argv) { $(3); return 0; }' | gcc -include $(1) -x c -o $(TMP_DIR)/a.out - $(4)
+    echo 'int main(int argc, char **argv) { $(3); return 0; }' | $(STAGING_DIR_HOST)/bin/gcc -include $(1) -x c -o $(TMP_DIR)/a.out - $(4)
   endef
 
   $$(eval $$(call Require,$(1),$(2)))
@@ -113,7 +113,7 @@ define SetupHostCommand
 						[ -x "$(STAGING_DIR_HOST)/bin/$(strip $(1))" ] && exit 0 \
 						;; \
 				esac; \
-				ln -sf "$$$$$$$$bin" "$(STAGING_DIR_HOST)/bin/$(strip $(1))"; \
+				ln -sf "$$$$$$$${bin#$(STAGING_DIR_HOST)/bin/}" "$(STAGING_DIR_HOST)/bin/$(strip $(1))"; \
 				exit 1; \
 			fi; \
 		fi; \

include/quilt.mk

@@ -103,6 +103,7 @@ define Kernel/Patch/Default
 	$(call PatchDir,$(LINUX_DIR),$(GENERIC_PATCH_DIR),generic/)
 	$(call PatchDir,$(LINUX_DIR),$(GENERIC_HACK_DIR),generic-hack/)
 	$(call PatchDir,$(LINUX_DIR),$(PATCH_DIR),platform/)
+	$(if $(QUILT),touch $(LINUX_DIR)/.quilt_used)
 endef
 
 define Quilt/RefreshDir

include/rootfs.mk

@@ -78,6 +78,7 @@ define prepare_rootfs
 		cd $(1); \
 		if [ -n "$(CONFIG_USE_APK)" ]; then \
 			IPKG_POSTINST_PATH=./lib/apk/db/*.post-install; \
+			$(STAGING_DIR_HOST)/bin/gzip -d ./lib/apk/db/scripts.tar; \
 			$(STAGING_DIR_HOST)/bin/tar -C ./lib/apk/db/ -xf ./lib/apk/db/scripts.tar --wildcards "*.post-install"; \
 		else \
 			IPKG_POSTINST_PATH=./usr/lib/opkg/info/*.postinst; \
@@ -91,6 +92,7 @@ define prepare_rootfs
 			fi; \
 			[ -n "$(CONFIG_USE_APK)" ] && $(STAGING_DIR_HOST)/bin/tar --delete -f ./lib/apk/db/scripts.tar $$(basename $$script); \
 		done; \
+		[ -n "$(CONFIG_USE_APK)" ] && $(STAGING_DIR_HOST)/bin/gzip -f -9n -S ".gz" ./lib/apk/db/scripts.tar; \
 		if [ -z "$(CONFIG_USE_APK)" ]; then \
 			$(if $(IB),,awk -i inplace \
 				'/^Status:/ { \
@@ -111,7 +113,7 @@ define prepare_rootfs
 		done || true \
 	)
 
-	@-find $(1) -name CVS -o -name .svn -o -name .git -o -name '.#*' | $(XARGS) rm -rf
+	@-find $(1) -name .svn -o -name .git -o -name '.#*' | $(XARGS) rm -rf
 	rm -rf \
 		$(1)/boot \
 		$(1)/tmp/* \

include/target.mk

@@ -105,13 +105,6 @@ DEFAULT_PACKAGES += $(DEFAULT_PACKAGES.$(DEVICE_TYPE))
 ##
 filter_packages = $(filter-out -% $(patsubst -%,%,$(filter -%,$(1))),$(1))
 
-##@
-# @brief Append extra package dependencies.
-#
-# @param 1: Package list.
-##
-extra_packages = $(if $(filter wpad wpad-% nas,$(1)),iwinfo)
-
 define ProfileDefault
   NAME:=
   PRIORITY:=
@@ -128,7 +121,7 @@ define Profile
 	echo "Target-Profile: $(1)"; \
 	$(if $(PRIORITY), echo "Target-Profile-Priority: $(PRIORITY)"; ) \
 	echo "Target-Profile-Name: $(NAME)"; \
-	echo "Target-Profile-Packages: $(PACKAGES) $(call extra_packages,$(DEFAULT_PACKAGES) $(PACKAGES))"; \
+	echo "Target-Profile-Packages: $(PACKAGES)"; \
 	echo "Target-Profile-Description:"; \
 	echo "$$$$$$$$$(call shvar,Profile/$(1)/Description)"; \
 	echo "@@"; \
@@ -324,6 +317,9 @@ ifeq ($(DUMP),1)
     ifneq ($(CONFIG_PWM),)
       FEATURES += pwm
     endif
+    ifneq ($(CONFIG_REGULATOR),)
+      FEATURES += regulator
+    endif
     ifneq ($(CONFIG_USB)$(CONFIG_USB_SUPPORT),)
       ifneq ($(CONFIG_USB_ARCH_HAS_HCD)$(CONFIG_USB_EHCI_HCD),)
         FEATURES += usb
@@ -366,7 +362,7 @@ endif
 
 define BuildTargets/DumpCurrent
   .PHONY: dumpinfo
-  dumpinfo : export DESCRIPTION=$$(Target/Description)
+  dumpinfo: $(call shexport,Target/Description)
   dumpinfo:
 	@echo 'Target: $(TARGETID)'; \
 	 echo 'Target-Board: $(BOARD)'; \
@@ -383,13 +379,13 @@ define BuildTargets/DumpCurrent
 	 echo 'Linux-Kernel-Arch: $(LINUX_KARCH)'; \
 	$(if $(SUBTARGET),,$(if $(DEFAULT_SUBTARGET), echo 'Default-Subtarget: $(DEFAULT_SUBTARGET)'; )) \
 	 echo 'Target-Description:'; \
-	 echo "$$$$DESCRIPTION"; \
+	 echo "$$$$$(call shvar,Target/Description);"; \
 	 echo '@@'; \
 	 $(if $(DEFAULT_PROFILE),echo 'Target-Default-Profile: $(DEFAULT_PROFILE)';) \
-	 echo 'Default-Packages: $(DEFAULT_PACKAGES) $(call extra_packages,$(DEFAULT_PACKAGES))'; \
+	 echo 'Default-Packages: $(DEFAULT_PACKAGES)'; \
 	 $(DUMPINFO)
 	$(if $(CUR_SUBTARGET),$(SUBMAKE) -r --no-print-directory -C image -s DUMP=1 SUBTARGET=$(CUR_SUBTARGET))
-	$(if $(SUBTARGET),,@$(foreach SUBTARGET,$(SUBTARGETS),$(SUBMAKE) -s DUMP=1 SUBTARGET=$(SUBTARGET); ))
+	$(if $(SUBTARGET),,@$(foreach SUBTARGET,$(SUBTARGETS),$(SUBMAKE) --no-print-directory -s DUMP=1 SUBTARGET=$(SUBTARGET); ))
 endef
 
 include $(INCLUDE_DIR)/kernel.mk

include/toplevel.mk

@@ -78,7 +78,7 @@ _ignore = $(foreach p,$(IGNORE_PACKAGES),--ignore $(p))
 prepare-tmpinfo: FORCE
 	@+$(MAKE) -r -s $(STAGING_DIR_HOST)/.prereq-build $(PREP_MK)
 	mkdir -p tmp/info feeds
-	[ -e $(TOPDIR)/feeds/base ] || ln -sf $(TOPDIR)/package $(TOPDIR)/feeds/base
+	[ -e $(TOPDIR)/feeds/base ] || ln -sf ../package $(TOPDIR)/feeds/base
 	$(_SINGLE)$(NO_TRACE_MAKE) -j1 -r -s -f include/scan.mk SCAN_TARGET="packageinfo" SCAN_DIR="package" SCAN_NAME="package" SCAN_DEPTH=5 SCAN_EXTRA=""
 	$(_SINGLE)$(NO_TRACE_MAKE) -j1 -r -s -f include/scan.mk SCAN_TARGET="targetinfo" SCAN_DIR="target/linux" SCAN_NAME="target" SCAN_DEPTH=3 SCAN_EXTRA="" SCAN_MAKEOPTS="TARGET_BUILD=1"
 	for type in package target; do \
@@ -201,7 +201,7 @@ else
   DOWNLOAD_DIRS = package/download
 endif
 
-download: .config FORCE $(if $(wildcard $(STAGING_DIR_HOST)/bin/flock),,tools/flock/compile)
+download: .config FORCE $(if $(wildcard $(STAGING_DIR_HOST)/bin/flock),,tools/flock/compile) $(if $(wildcard $(STAGING_DIR_HOST)/bin/zstd),,tools/zstd/compile)
 	@+$(foreach dir,$(DOWNLOAD_DIRS),$(SUBMAKE) $(dir);)
 
 clean dirclean: .config

include/u-boot.mk

@@ -104,7 +104,7 @@ define Build/U-Boot/Target
       endif
     endif
     $(if $(DEFAULT),DEFAULT:=$(DEFAULT))
-    URL:=http://www.denx.de/wiki/U-Boot
+    URL:=https://docs.u-boot.org/en/latest/
   endef
 
   define Package/u-boot-$(1)/install

package/Makefile

@@ -70,7 +70,8 @@ ifneq ($(CONFIG_USE_APK),)
 	(cd $(PACKAGE_DIR_ALL) && $(STAGING_DIR_HOST)/bin/apk mkndx \
 			--root $(TOPDIR) \
 			--keys-dir $(TOPDIR) \
-			--sign $(BUILD_KEY_APK_SEC) \
+			--allow-untrusted \
+			$(if $(CONFIG_SIGNED_PACKAGES),--sign $(BUILD_KEY_APK_SEC),) \
 			--output packages.adb \
 			*.apk; \
 	)
@@ -100,10 +101,11 @@ ifneq ($(CONFIG_USE_APK),)
 	    $(foreach pkg,$(shell cat $(PACKAGE_INSTALL_FILES) 2>/dev/null),$(pkg)$(call GetABISuffix,$(pkg))))
 	$(call apk,$(TARGET_DIR)) add --no-cache --initdb --no-scripts --arch $(ARCH_PACKAGES) \
 		--repositories-file /dev/null --repository file://$(PACKAGE_DIR_ALL)/packages.adb \
+		$(if $(CONFIG_SIGNED_PACKAGES),,--allow-untrusted) \
 		$$(cat $(TMP_DIR)/apk_install_list) \
-			"base-files=$(shell cat $(TMP_DIR)/base-files.version)" \
-			"libc=$(shell cat $(TMP_DIR)/libc.version)" \
-			"kernel=$(shell cat $(TMP_DIR)/kernel.version)"
+			"base-files=$(shell cat $(STAGING_DIR)/base-files.version)" \
+			"libc=$(shell cat $(STAGING_DIR)/libc.version)" \
+			"kernel=$(subst -rc,_rc,$(shell cat $(STAGING_DIR)/kernel.version))"
 
 	rm -rf $(TARGET_DIR)/run
 else
@@ -127,13 +129,15 @@ $(curdir)/index: FORCE
 	@echo Generating package index...
 ifneq ($(CONFIG_USE_APK),)
 	@for d in $(PACKAGE_SUBDIRS); do \
+		set -e; \
 		mkdir -p $$d; \
 		cd $$d || continue; \
 		ls *.apk >/dev/null 2>&1 || continue; \
 		$(STAGING_DIR_HOST)/bin/apk mkndx \
 			--root $(TOPDIR) \
 			--keys-dir $(TOPDIR) \
-			--sign $(BUILD_KEY_APK_SEC) \
+			--allow-untrusted \
+			$(if $(CONFIG_SIGNED_PACKAGES),--sign $(BUILD_KEY_APK_SEC),) \
 			--output packages.adb \
 			*.apk; \
 		$(STAGING_DIR_HOST)/bin/apk adbdump --format json packages.adb | \
@@ -169,6 +173,7 @@ ifdef CONFIG_JSON_CYCLONEDX_SBOM
 	); done
 endif
 endif
+	$(call sha256sums,$(OUTPUT_DIR)/packages/$(ARCH_PACKAGES),1)
 
 $(curdir)/flags-install:= -j1
 

package/base-files/Makefile

@@ -45,7 +45,7 @@ define Package/base-files
 	+SELINUX:procd-selinux +!SELINUX:procd +USE_SECCOMP:procd-seccomp \
 	+SELINUX:busybox-selinux +!SELINUX:busybox
   TITLE:=Base filesystem for OpenWrt
-  URL:=http://openwrt.org/
+  URL:=https://openwrt.org/
   VERSION:=$(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION)))
 endef
 
@@ -256,7 +256,7 @@ ifneq ($(CONFIG_USE_APK),)
 
 	rm -f $(1)/etc/uci-defaults/13_fix-group-user
 	rm -f $(1)/sbin/pkg_check
-	echo $(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION))) >$(TMP_DIR)/base-files.version
+	echo $(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION))) >$(STAGING_DIR)/base-files.version
 else
 	$(if $(CONFIG_CLEAN_IPKG),, \
 		mkdir -p $(1)/etc/opkg; \

package/base-files/files/bin/board_detect

@@ -1,14 +1,22 @@
 #!/bin/sh
 
-CFG=$1
+REAL_CFG=$1
 
-[ -n "$CFG" ] || CFG=/etc/board.json
+[ -n "$REAL_CFG" ] || REAL_CFG=/etc/board.json
 
-[ -d "/etc/board.d/" -a ! -s "$CFG" ] && {
+if [ -d "/etc/board.d/" ] && [ ! -s "$REAL_CFG" ]; then
+	# Use temp file to prevent incomplete file on power-cut, CFG is used by the sourced script to read/write the file
+	CFG="$(dirname "$REAL_CFG")/.$(basename "$REAL_CFG").tmp"
+	rm -f "$CFG" || exit
 	for a in $(ls /etc/board.d/*); do
-		[ -s $a ] || continue;
-		$(. $a)
+		[ -s "$a" ] || continue
+		(. "$a")
 	done
-}
+fi
 
-[ -s "$CFG" ] || return 1
+if [ -s "$CFG" ]; then
+	mv "$CFG" "$REAL_CFG" || exit
+else
+	rm -f "$CFG"
+	exit 1
+fi

package/base-files/files/bin/config_generate

@@ -44,14 +44,15 @@ generate_static_network() {
 		set network.loopback.device='lo'
 		set network.loopback.proto='static'
 		add_list network.loopback.ipaddr='127.0.0.1/8'
+		delete network.globals
+		set network.globals='globals'
+		set network.globals.dhcp_default_duid='auto'
 	EOF
-		[ -e /proc/sys/net/ipv6 ] && {
-			uci -q batch <<-EOF
-				delete network.globals
-				set network.globals='globals'
-				set network.globals.ula_prefix='auto'
-			EOF
-		}
+	[ -e /proc/sys/net/ipv6 ] && {
+		uci -q batch <<-EOF
+			set network.globals.ula_prefix='auto'
+		EOF
+	}
 
 	if json_is_a dsl object; then
 		json_select dsl

package/base-files/files/etc/group

@@ -5,7 +5,6 @@ mail:x:8:
 dialout:x:20:
 audio:x:29:
 www-data:x:33:
-ftp:x:55:
 users:x:100:
 network:x:101:
 nogroup:x:65534:

package/base-files/files/etc/init.d/boot

@@ -10,10 +10,13 @@ uci_apply_defaults() {
 	cd /etc/uci-defaults || return 0
 	files="$(ls)"
 	[ -z "$files" ] && return 0
+	applied=""
 	for file in $files; do
-		( . "./$(basename $file)" ) && rm -f "$file"
+		( . "./$(basename $file)" ) && applied="$applied $file"
 	done
 	uci commit
+	sync
+	rm -f $applied
 }
 
 boot() {

package/base-files/files/etc/passwd

@@ -1,5 +1,4 @@
 root:x:0:0:root:/root:/bin/ash
 daemon:*:1:1:daemon:/var:/bin/false
-ftp:*:55:55:ftp:/home/ftp:/bin/false
 network:*:101:101:network:/var:/bin/false
 nobody:*:65534:65534:nobody:/var:/bin/false

package/base-files/files/etc/profile

@@ -1,61 +1,39 @@
+unset FAILSAFE
 [ -e /tmp/.failsafe ] && export FAILSAFE=1
 
 [ -f /etc/banner ] && cat /etc/banner
-[ -n "$FAILSAFE" ] && cat /etc/banner.failsafe
+[ -n "$FAILSAFE" ] && [ -f /etc/banner.failsafe ] && cat /etc/banner.failsafe
 
-grep -Fsq '/ overlay ro,' /proc/mounts && {
-	echo 'Your JFFS2-partition seems full and overlayfs is mounted read-only.'
-	echo 'Please try to remove files from /overlay/upper/... and reboot!'
-}
+if grep -Fsq '/ overlay ro,' /proc/mounts ; then
+cat << EOF
+
+ === WARNING! ======================================
+ Your JFFS2-partition seems full and overlayfs is
+ mounted as READ-ONLY!
+ Please try to remove files from /overlay/upper/...
+ and reboot!
+ ---------------------------------------------------
+
+EOF
+fi
 
 export PATH="%PATH%"
-export HOME=$(grep -e "^${USER:-root}:" /etc/passwd | cut -d ":" -f 6)
-export HOME=${HOME:-/root}
+HOME=$(grep -E "^${USER:-root}:" /etc/passwd | cut -d ":" -f 6)
+HOME=${HOME:-/root}
+export HOME
 export PS1='\u@\h:\w\$ '
 export ENV=/etc/shinit
 
 case "$TERM" in
 	xterm*|rxvt*)
-		export PS1='\[\e]0;\u@\h: \w\a\]'$PS1
-		;;
+		export PS1='\[\e]0;\u@\h: \w\a\]'"$PS1"
+	;;
 esac
 
-[ -n "$FAILSAFE" ] || {
-	for FILE in /etc/profile.d/*.sh; do
-		[ -e "$FILE" ] && . "$FILE"
+if [ -z "$FAILSAFE" ] ; then
+	for FILE in /etc/profile.d/*.sh ; do
+		[ -f "${FILE%.sh}.hush" ] && continue
+		[ -f "$FILE" ] && . "$FILE"
 	done
 	unset FILE
-}
-
-if ( grep -qs '^root::' /etc/shadow && \
-     [ -z "$FAILSAFE" ] )
-then
-cat << EOF
-=== WARNING! =====================================
-There is no root password defined on this device!
-Use the "passwd" command to set up a new password
-in order to prevent unauthorized SSH logins.
---------------------------------------------------
-EOF
-fi
-
-if [ -x /usr/bin/apk ]; then
-cat << EOF
-
- OpenWrt recently switched to the "apk" package manager!
-
- OPKG Command           APK Equivalent      Description
- ------------------------------------------------------------------
- opkg install <pkg>     apk add <pkg>       Install a package
- opkg remove <pkg>      apk del <pkg>       Remove a package
- opkg upgrade           apk upgrade         Upgrade all packages
- opkg files <pkg>       apk info -L <pkg>   List package contents
- opkg list-installed    apk info            List installed packages
- opkg update            apk update          Update package lists
- opkg search <pkg>      apk search <pkg>    Search for packages
- ------------------------------------------------------------------
-
-For more https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet
-
-EOF
 fi

package/base-files/files/etc/profile.d/00-passwordless-root.sh

@@ -0,0 +1,11 @@
+if grep -Esq '^root::' /etc/shadow ; then
+cat << EOF
+
+ === WARNING! =====================================
+ There is no root password defined on this device!
+ Use the "passwd" command to set up a new password
+ in order to prevent unauthorized SSH logins.
+ --------------------------------------------------
+
+EOF
+fi

package/base-files/files/etc/shadow

@@ -1,5 +1,4 @@
 root:::0:99999:7:::
 daemon:*:0:0:99999:7:::
-ftp:*:0:0:99999:7:::
 network:*:0:0:99999:7:::
 nobody:*:0:0:99999:7:::

package/base-files/files/etc/uci-defaults/14_network-generate-duid

@@ -0,0 +1,9 @@
+[ "$(uci -q get network.globals.dhcp_default_duid || echo "auto")" != "auto" ] && exit 0
+
+uci -q batch <<-EOF >/dev/null
+	# DUID-UUID - RFC6355
+	set network.globals.dhcp_default_duid="$(printf '%s%s' '0004' $(cat /proc/sys/kernel/random/uuid | sed -e 's/-//g'))"
+	commit network
+EOF
+
+exit 0

package/base-files/files/etc/uci-defaults/15_migrate-time-zonename

@@ -0,0 +1,6 @@
+zonename="$(uci -q get system.@system[0].zonename)"
+case "$zonename" in
+        *[[:space:]]*) uci set system.@system[0].zonename="${zonename// /_}" ;;
+esac
+
+exit 0

package/base-files/files/lib/functions.sh

@@ -382,7 +382,7 @@ default_postinst() {
 			uci commit
 		fi
 
-		rm -f /tmp/luci-indexcache
+		rm -f /tmp/luci-indexcache.*
 	fi
 
 	if [ -f "$root/usr/lib/opkg/info/${pkgname}.postinst-pkg" ]; then
@@ -447,7 +447,7 @@ find_mmc_part() {
 	fi
 
 	for DEVNAME in /sys/block/$ROOTDEV/mmcblk*p*; do
-		PARTNAME="$(grep PARTNAME ${DEVNAME}/uevent | cut -f2 -d'=')"
+		PARTNAME="$(grep PARTNAME ${DEVNAME}/uevent | cut -f2 -d'=' 2>/dev/null)"
 		[ "$PARTNAME" = "$1" ] && echo "/dev/$(basename $DEVNAME)" && return 0
 	done
 }

package/base-files/files/lib/functions/network.sh

@@ -24,6 +24,17 @@ __network_ifstatus() {
 	eval "$__tmp"
 }
 
+# determine the IAID of the given logical interface
+# 1: destination variable
+# 2: interface
+network_generate_iface_iaid() {
+	local __iaid
+
+	__iaid=$(printf '%s' "$2" | md5sum | cut -c 1-8)
+
+	export "$1=$__iaid"
+}
+
 # determine first IPv4 address of given logical interface
 # 1: destination variable
 # 2: interface

package/base-files/files/lib/functions/uci-defaults.sh

@@ -771,6 +771,27 @@ ucidef_add_wlan() {
 	ucidef_wlan_idx="$((ucidef_wlan_idx + 1))"
 }
 
+ucidef_set_interface_netdev_range() {
+	local interface="$1"
+	local base_netdev="$2"
+	local start="$3"
+	local stop="$4"
+	local netdevs
+	local i
+
+	if [ "$stop" -ge "$start" ]; then
+		i="$start"
+		netdevs="$base_netdev$i"
+
+		while [ "$i" -lt "$stop" ]; do
+			i=$((i + 1))
+			netdevs="$netdevs $base_netdev$i"
+		done
+
+		ucidef_set_interface "$interface" device "$netdevs"
+	fi
+}
+
 board_config_update() {
 	json_init
 	[ -f ${CFG} ] && json_load "$(cat ${CFG})"

package/base-files/files/lib/preinit/30_failsafe_wait

@@ -21,8 +21,8 @@ fs_wait_for_key () {
 		touch $keypress_sec
 	fi
 
-	trap "echo 'true' >$keypress_true; lock -u $keypress_wait ; rm -f $keypress_wait" INT
-	trap "echo 'true' >$keypress_true; lock -u $keypress_wait ; rm -f $keypress_wait" USR1
+	trap "echo 'true' >$keypress_true; lock -u $keypress_wait ; rm -f $keypress_wait 2>/dev/null" INT
+	trap "echo 'true' >$keypress_true; lock -u $keypress_wait ; rm -f $keypress_wait 2>/dev/null" USR1
 
 	[ -n "$timeout" ] || timeout=1
 	[ $timeout -ge 1 ] || timeout=1
@@ -37,7 +37,7 @@ fs_wait_for_key () {
 			sleep 1
 		done
 		lock -u $keypress_wait
-		rm -f $keypress_wait
+		rm -f $keypress_wait 2>/dev/null
 	} &
 
 	local consoles="$(cat /sys/class/tty/console/active)"
@@ -68,7 +68,7 @@ fs_wait_for_key () {
 						;;
 					esac
 					lock -u $keypress_wait
-					rm -f $keypress_wait
+					rm -f $keypress_wait 2>/dev/null
 				}
 			done
 		} &

package/base-files/files/sbin/sysupgrade

@@ -146,7 +146,7 @@ list_conffiles() {
 		' /usr/lib/opkg/status
 	elif [ -d /lib/apk/packages ]; then
 		conffiles=""
-		for file in /lib/apk/packages/*.conffiles_static; do
+		for file in $(find /lib/apk/packages -name "*.conffiles_static" -type f); do
 			conffiles="$(echo -e "$(cat $file)\n$conffiles")"
 		done
 		echo "$conffiles"

package/base-files/image-config.in

@@ -5,6 +5,14 @@
 # See /LICENSE for more information.
 #
 
+config EXTRA_IMAGE_NAME
+	string
+	prompt "Extra image filename" if IMAGEOPT
+	default ""
+	help
+		Add this to the output image filenames, to distinguish between
+		different builds for the same hardware type.
+
 config TARGET_DEFAULT_LAN_IP_FROM_PREINIT
 	bool "Use preinit IP configuration as default LAN IP" if IMAGEOPT
 	default n

package/boot/arm-trusted-firmware-mediatek/Makefile

@@ -29,6 +29,8 @@ define Trusted-Firmware-A/Default
   HIDDEN:=y
   BOOT_DEVICE:=
   DDR3_FLYBY:=
+  DDR3_FREQ_1866:=
+  DDR4_4BG_MODE:=
   DDR_TYPE:=
   NAND_TYPE:=
   BOARD_QFN:=
@@ -37,6 +39,7 @@ define Trusted-Firmware-A/Default
   USE_UBI:=
   FIP_OFFSET:=
   FIP_SIZE:=
+  SPIM_CTRL:=
 endef
 
 define Trusted-Firmware-A/mt7622-nor-1ddr
@@ -137,6 +140,14 @@ define Trusted-Firmware-A/mt7622-sdmmc-2ddr
   DDR3_FLYBY:=1
 endef
 
+define Trusted-Firmware-A/mt7981-nor-ddr4
+  NAME:=MediaTek MT7981 (SPI-NOR, DDR4)
+  BOOT_DEVICE:=nor
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr4
+endef
+
 define Trusted-Firmware-A/mt7981-ram-ddr4
   NAME:=MediaTek MT7981 (RAM, DDR4)
   BOOT_DEVICE:=ram
@@ -156,6 +167,14 @@ define Trusted-Firmware-A/mt7981-emmc-ddr4
   DDR_TYPE:=ddr4
 endef
 
+define Trusted-Firmware-A/mt7981-sdmmc-ddr4
+  NAME:=MediaTek MT7981 (SD card, DDR4)
+  BOOT_DEVICE:=sdmmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr4
+endef
+
 define Trusted-Firmware-A/mt7981-spim-nand-ddr4
   NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR4)
   BOOT_DEVICE:=spim-nand
@@ -178,19 +197,12 @@ define Trusted-Firmware-A/mt7981-ram-ddr3
   BUILD_SUBTARGET:=filogic
   PLAT:=mt7981
   DDR_TYPE:=ddr3
+  DDR3_FREQ_1866:=1
   RAM_BOOT_UART_DL:=1
   HIDDEN:=
   DEFAULT:=TARGET_mediatek_filogic
 endef
 
-define Trusted-Firmware-A/mt7981-nor-ddr4
-  NAME:=MediaTek MT7981 (SPI-NOR, DDR4)
-  BOOT_DEVICE:=nor
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7981
-  DDR_TYPE:=ddr4
-endef
-
 define Trusted-Firmware-A/mt7981-emmc-ddr3
   NAME:=MediaTek MT7981 (eMMC, DDR3)
   BOOT_DEVICE:=emmc
@@ -199,6 +211,15 @@ define Trusted-Firmware-A/mt7981-emmc-ddr3
   DDR_TYPE:=ddr3
 endef
 
+define Trusted-Firmware-A/mt7981-emmc-ddr3-1866
+  NAME:=MediaTek MT7981 (eMMC, DDR3 1866 MT/s)
+  BOOT_DEVICE:=emmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr3
+  DDR3_FREQ_1866:=1
+endef
+
 define Trusted-Firmware-A/mt7981-sdmmc-ddr3
   NAME:=MediaTek MT7981 (SD card, DDR3)
   BOOT_DEVICE:=sdmmc
@@ -223,8 +244,26 @@ define Trusted-Firmware-A/mt7981-spim-nand-ddr3
   DDR_TYPE:=ddr3
 endef
 
-define Trusted-Firmware-A/mt7981-cudy-tr3000-v1
-  NAME:=Cudy TR3000 v1 (SPI-NAND via SPIM, DDR3)
+define Trusted-Firmware-A/mt7981-spim-nand-ddr3-1866
+  NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR3 1866 MT/s)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr3
+  DDR3_FREQ_1866:=1
+endef
+
+define Trusted-Firmware-A/mt7981-spim-nand-ubi-ddr4
+  NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR4)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr4
+  USE_UBI:=1
+endef
+
+define Trusted-Firmware-A/mt7981-cudy-ddr3
+  NAME:=Cudy (SPI-NAND via SPIM, DDR3)
   BOOT_DEVICE:=spim-nand
   BUILD_SUBTARGET:=filogic
   PLAT:=mt7981
@@ -244,15 +283,6 @@ define Trusted-Firmware-A/mt7986-ram-ddr4
   DEFAULT:=TARGET_mediatek_filogic
 endef
 
-define Trusted-Firmware-A/mt7981-spim-nand-ubi-ddr4
-  NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR4)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7981
-  DDR_TYPE:=ddr4
-  USE_UBI:=1
-endef
-
 define Trusted-Firmware-A/mt7986-nor-ddr4
   NAME:=MediaTek MT7986 (SPI-NOR, DDR4)
   BOOT_DEVICE:=nor
@@ -305,7 +335,7 @@ define Trusted-Firmware-A/mt7986-spim-nand-ubi-ddr4
 endef
 
 define Trusted-Firmware-A/mt7986-spim-nand-4k-ddr4
-  NAME:=MediaTek MT7986 (SPI-NAND via SPIM, DDR4)
+  NAME:=MediaTek MT7986 (SPI-NAND 4k+256 via SPIM, DDR4)
   BOOT_DEVICE:=spim-nand
   BUILD_SUBTARGET:=filogic
   PLAT:=mt7986
@@ -373,6 +403,88 @@ define Trusted-Firmware-A/mt7986-spim-nand-ubi-ddr3
   USE_UBI:=1
 endef
 
+define Trusted-Firmware-A/mt7986-spim-nand-4k-ddr3
+  NAME:=MediaTek MT7986 (SPI-NAND 4k+256 via SPIM, DDR3)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7986
+  DDR_TYPE:=ddr3
+  NAND_TYPE:=spim:4k+256
+endef
+
+define Trusted-Firmware-A/mt7987-emmc-comb
+  NAME:=MediaTek MT7987 (eMMC)
+  BOOT_DEVICE:=emmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+endef
+
+define Trusted-Firmware-A/mt7987-emmc-ddr4-4bg
+  NAME:=MediaTek MT7987 (eMMC, DDR4 4GB)
+  BOOT_DEVICE:=emmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+  DDR4_4BG_MODE:=1
+endef
+
+define Trusted-Firmware-A/mt7987-nor-comb
+  NAME:=MediaTek MT7987 (NOR)
+  BOOT_DEVICE:=nor
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+endef
+
+define Trusted-Firmware-A/mt7987-sdmmc-comb
+  NAME:=MediaTek MT7987 (SD card)
+  BOOT_DEVICE:=sdmmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+endef
+
+define Trusted-Firmware-A/mt7987-sdmmc-ddr4-4bg
+  NAME:=MediaTek MT7987 (SD card, DDR4 4GB)
+  BOOT_DEVICE:=sdmmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+  DDR4_4BG_MODE:=1
+endef
+
+define Trusted-Firmware-A/mt7987-spim-nand0
+  NAME:=MediaTek MT7987 (SPI-NAND via SPIM)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+  SPIM_CTRL:=0
+endef
+
+define Trusted-Firmware-A/mt7987-spim-nand0-ubi-comb
+  NAME:=MediaTek MT7987 (SPI-NAND via SPIM, UBI)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+  USE_UBI:=1
+  SPIM_CTRL:=0
+endef
+
+define Trusted-Firmware-A/mt7987-spim-nand2-ubi-comb
+  NAME:=MediaTek MT7987 (SPI-NAND via SPIM, UBI)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+  USE_UBI:=1
+  SPIM_CTRL:=2
+endef
+
+define Trusted-Firmware-A/mt7987-ram-comb
+  NAME:=MediaTek MT7987 (RAM)
+  BOOT_DEVICE:=ram
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7987
+  RAM_BOOT_UART_DL:=1
+  HIDDEN:=
+  DEFAULT:=TARGET_mediatek_filogic
+endef
+
 define Trusted-Firmware-A/mt7988-nor-ddr3
   NAME:=MediaTek MT7988 (SPI-NOR, DDR3)
   BOOT_DEVICE:=nor
@@ -542,6 +654,34 @@ define Trusted-Firmware-A/mt7988-spim-nand-ubi-ddr4
   USE_UBI:=1
 endef
 
+define Trusted-Firmware-A/mt7988-emmc-comb-4bg
+  NAME:=MediaTek MT7988 (eMMC, DDR4 8GB)
+  BOOT_DEVICE:=emmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7988
+  DRAM_USE_COMB:=1
+  DDR4_4BG_MODE:=1
+endef
+
+define Trusted-Firmware-A/mt7988-sdmmc-comb-4bg
+  NAME:=MediaTek MT7988 (SD card, DDR4 8GB)
+  BOOT_DEVICE:=sdmmc
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7988
+  DRAM_USE_COMB:=1
+  DDR4_4BG_MODE:=1
+endef
+
+define Trusted-Firmware-A/mt7988-spim-nand-ubi-comb-4bg
+  NAME:=MediaTek MT7988 (SPI-NAND via SPIM, UBI, DDR4 8GB)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7988
+  DRAM_USE_COMB:=1
+  DDR4_4BG_MODE:=1
+  USE_UBI:=1
+endef
+
 TFA_TARGETS:= \
 	mt7622-nor-1ddr \
 	mt7622-nor-2ddr \
@@ -557,16 +697,19 @@ TFA_TARGETS:= \
 	mt7622-sdmmc-2ddr \
 	mt7981-ram-ddr3 \
 	mt7981-emmc-ddr3 \
+	mt7981-emmc-ddr3-1866 \
 	mt7981-nor-ddr3 \
 	mt7981-nor-ddr4 \
 	mt7981-sdmmc-ddr3 \
 	mt7981-snand-ddr3 \
 	mt7981-spim-nand-ddr3 \
+	mt7981-spim-nand-ddr3-1866 \
 	mt7981-spim-nand-ubi-ddr4 \
 	mt7981-ram-ddr4 \
 	mt7981-emmc-ddr4 \
+	mt7981-sdmmc-ddr4 \
 	mt7981-spim-nand-ddr4 \
-	mt7981-cudy-tr3000-v1 \
+	mt7981-cudy-ddr3 \
 	mt7986-ram-ddr3 \
 	mt7986-emmc-ddr3 \
 	mt7986-nor-ddr3 \
@@ -574,6 +717,7 @@ TFA_TARGETS:= \
 	mt7986-snand-ddr3 \
 	mt7986-spim-nand-ddr3 \
 	mt7986-spim-nand-ubi-ddr3 \
+	mt7986-spim-nand-4k-ddr3 \
 	mt7986-ram-ddr4 \
 	mt7986-emmc-ddr4 \
 	mt7986-nor-ddr4 \
@@ -582,6 +726,15 @@ TFA_TARGETS:= \
 	mt7986-spim-nand-ddr4 \
 	mt7986-spim-nand-ubi-ddr4 \
 	mt7986-spim-nand-4k-ddr4 \
+	mt7987-emmc-comb \
+	mt7987-emmc-ddr4-4bg \
+	mt7987-nor-comb \
+	mt7987-sdmmc-comb \
+	mt7987-sdmmc-ddr4-4bg \
+	mt7987-spim-nand0 \
+	mt7987-spim-nand0-ubi-comb \
+	mt7987-spim-nand2-ubi-comb \
+	mt7987-ram-comb \
 	mt7988-emmc-ddr3 \
 	mt7988-nor-ddr3 \
 	mt7988-sdmmc-ddr3 \
@@ -601,7 +754,10 @@ TFA_TARGETS:= \
 	mt7988-snand-ubi-comb \
 	mt7988-spim-nand-comb \
 	mt7988-spim-nand-ubi-comb \
-	mt7988-spim-nand-ubi-ddr4
+	mt7988-spim-nand-ubi-ddr4 \
+	mt7988-emmc-comb-4bg \
+	mt7988-sdmmc-comb-4bg \
+	mt7988-spim-nand-ubi-comb-4bg
 
 TFA_MAKE_FLAGS += \
 	BOOT_DEVICE=$(BOOT_DEVICE) \
@@ -611,6 +767,8 @@ TFA_MAKE_FLAGS += \
 	$(if $(NAND_TYPE),NAND_TYPE=$(NAND_TYPE)) \
 	HAVE_DRAM_OBJ_FILE=yes \
 	$(if $(DDR3_FLYBY),DDR3_FLYBY=1) \
+	$(if $(DDR3_FREQ_1866),DDR3_FREQ_1866=1) \
+	$(if $(DDR4_4BG_MODE),DDR4_4BG_MODE=1) \
 	$(if $(DRAM_USE_COMB),DRAM_USE_COMB=1) \
 	$(if $(RAM_BOOT_UART_DL),RAM_BOOT_UART_DL=1) \
 	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7622,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x80000)) \
@@ -618,6 +776,7 @@ TFA_MAKE_FLAGS += \
 	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7986,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x200000)) \
 	$(if $(FIP_OFFSET),OVERRIDE_FIP_BASE=$(FIP_OFFSET)) \
 	$(if $(FIP_SIZE),OVERRIDE_FIP_SIZE=$(FIP_SIZE)) \
+	$(if $(SPIM_CTRL),SPIM_CTRL=$(SPIM_CTRL)) \
 	$(if $(RAM_BOOT_UART_DL),bl2,all)
 
 define Package/trusted-firmware-a-ram/install
@@ -630,6 +789,7 @@ Package/trusted-firmware-a-mt7981-ram-ddr3/install = $(Package/trusted-firmware-
 Package/trusted-firmware-a-mt7981-ram-ddr4/install = $(Package/trusted-firmware-a-ram/install)
 Package/trusted-firmware-a-mt7986-ram-ddr3/install = $(Package/trusted-firmware-a-ram/install)
 Package/trusted-firmware-a-mt7986-ram-ddr4/install = $(Package/trusted-firmware-a-ram/install)
+Package/trusted-firmware-a-mt7987-ram-comb/install = $(Package/trusted-firmware-a-ram/install)
 Package/trusted-firmware-a-mt7988-ram-comb/install = $(Package/trusted-firmware-a-ram/install)
 Package/trusted-firmware-a-mt7988-ram-ddr4/install = $(Package/trusted-firmware-a-ram/install)
 

package/boot/arm-trusted-firmware-mediatek/patches/0004-mediatek-snfi-add-FudanMicro-manufacturer.patch

@@ -0,0 +1,41 @@
+From fd057aba83aea8458986e11c81dbb75a69468b84 Mon Sep 17 00:00:00 2001
+From: Mikhail Zhilkin <csharper2005@gmail.com>
+Date: Wed, 13 Aug 2025 22:46:54 +0300
+Subject: arm-trusted-firmware-mediatek: add FudanMicro manufacturer
+
+Add FudanMicro manufacturer.
+
+Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
+---
+
+--- a/plat/mediatek/apsoc_common/drivers/spi_nand/mtk_spi_nand.c
++++ b/plat/mediatek/apsoc_common/drivers/spi_nand/mtk_spi_nand.c
+@@ -21,6 +21,7 @@
+ #define SPI_NAND_MAX_ID_LEN		4U
+ #define DELAY_US_400MS			400000U
+ #define ETRON_ID			0xD5U
++#define FUDAN_ID			0xA1U
+ #define GIGADEVICE_ID			0xC8U
+ #define MACRONIX_ID			0xC2U
+ #define MICRON_ID			0x2CU
+@@ -146,7 +147,8 @@ static int spi_nand_quad_enable(uint8_t
+ 	if (manufacturer_id != MACRONIX_ID &&
+ 	    manufacturer_id != GIGADEVICE_ID &&
+ 	    manufacturer_id != ETRON_ID &&
+-	    manufacturer_id != FORESEE_ID) {
++	    manufacturer_id != FORESEE_ID &&
++	    manufacturer_id != FUDAN_ID) {
+ 		return 0;
+ 	}
+ 
+@@ -543,6 +545,10 @@ static int spi_nand_check_pp(struct para
+ 		INFO("PP COPY %d CRC read: 0x%x, compute: 0x%x\n",
+ 		     i, crc, crc_compute);
+ 
++		// FUDAN integrity CRC (bytes 254-255) is reversed
++		if (crc != crc_compute)
++			crc = htobe16(pp->integrity_crc);
++
+ 		if (crc != crc_compute) {
+ 			ret = -EBADMSG;
+ 			continue;

package/boot/arm-trusted-firmware-mediatek/patches/0005-mt7987-make-SPI-controller-configurable.patch

@@ -0,0 +1,128 @@
+From e2e43103c00b5f7ccedbdbdece0f622cb420b4a5 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 3 Oct 2025 12:53:10 +0100
+Subject: [PATCH] mt7987: make SPI controller configurable
+
+Allow selecting the SPI controller used for SPIM-NAND or SPI-NOR boot
+devices (either SPI0 or SPI2).
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ plat/mediatek/apsoc_common/Config.in        |  1 +
+ plat/mediatek/mt7987/Config.in              | 29 +++++++++++++++++++++
+ plat/mediatek/mt7987/bl2/bl2.mk             | 12 +++++++++
+ plat/mediatek/mt7987/bl2/bl2_dev_spi_nand.c | 10 ++++++-
+ plat/mediatek/mt7987/platform.mk            |  4 +--
+ 5 files changed, 53 insertions(+), 3 deletions(-)
+ create mode 100644 plat/mediatek/mt7987/Config.in
+
+--- a/plat/mediatek/apsoc_common/Config.in
++++ b/plat/mediatek/apsoc_common/Config.in
+@@ -783,6 +783,7 @@ config ENABLE_BL31_RUNTIME_LOG
+ 	default 1
+ 	depends on _ENABLE_BL31_RUNTIME_LOG
+ 
++source "plat/mediatek/mt7987/Config.in"
+ source "plat/mediatek/mt7988/Config.in"
+ 
+ endmenu # Platform configurations
+--- /dev/null
++++ b/plat/mediatek/mt7987/Config.in
+@@ -0,0 +1,29 @@
++# SPDX-License-Identifier: BSD-3-Clause
++#
++# Copyright (c) 2025 Daniel Golle <daniel@makrotopia.org>
++#
++# MT7987 platform-specific configurations
++#
++
++if _PLAT_MT7987
++
++choice
++	prompt "SPI controller"
++	depends on (_BOOT_DEVICE_SPIM_NAND || _BOOT_DEVICE_SPI_NOR)
++	default _SPIM_CTRL_0 if _BOOT_DEVICE_SPIM_NAND
++	default _SPIM_CTRL_2 if _BOOT_DEVICE_SPI_NOR
++
++	config _SPIM_CTRL_0
++		bool "0"
++
++	config _SPIM_CTRL_2
++		bool "2"
++
++endchoice
++
++config SPIM_CTRL
++	int
++	default 0 if _SPIM_CTRL_0
++	default 2 if _SPIM_CTRL_2
++
++endif # _PLAT_MT7987
+--- a/plat/mediatek/mt7987/bl2/bl2.mk
++++ b/plat/mediatek/mt7987/bl2/bl2.mk
+@@ -91,7 +91,11 @@ endif # END OF BOOT_DEVICE = ram
+ ifeq ($(BOOT_DEVICE),nor)
+ $(eval $(call BL2_BOOT_NOR))
+ BL2_SOURCES		+=	$(MTK_PLAT_SOC)/bl2/bl2_dev_spi_nor.c
++ifeq ($(SPIM_CTRL),0)
++DTS_NAME		:=	mt7987-spi0
++else
+ DTS_NAME		:=	mt7987-spi2
++endif
+ endif # END OF BOOTDEVICE = nor
+ 
+ ifeq ($(BOOT_DEVICE),emmc)
+@@ -112,10 +116,18 @@ ifeq ($(BOOT_DEVICE),spim-nand)
+ $(eval $(call BL2_BOOT_SPI_NAND,0,0))
+ BL2_SOURCES		+=	$(MTK_PLAT_SOC)/bl2/bl2_dev_spi_nand.c
+ NAND_TYPE		?=	spim:2k+64
++ifeq ($(SPIM_CTRL),2)
++DTS_NAME		:=	mt7987-spi2
++else
+ DTS_NAME		:=	mt7987-spi0
++endif
+ $(eval $(call BL2_BOOT_NAND_TYPE_CHECK,$(NAND_TYPE),spim:2k+64 spim:2k+128 spim:4k+256))
+ endif # END OF BOOTDEVICE = spim-nand
+ 
++ifneq ($(SPIM_CTRL),)
++BL2_CPPFLAGS		+=	-DSPIM_CTRL=$(SPIM_CTRL)
++endif
++
+ ifeq ($(BROM_HEADER_TYPE),)
+ $(error BOOT_DEVICE has invalid value. Please re-check.)
+ endif
+--- a/plat/mediatek/mt7987/bl2/bl2_dev_spi_nand.c
++++ b/plat/mediatek/mt7987/bl2/bl2_dev_spi_nand.c
+@@ -12,10 +12,18 @@
+ 
+ #define MTK_QSPI_SRC_CLK		CB_MPLL_D2
+ 
++#if SPIM_CTRL == 0
++#define SELECTED_SPIM SPIM0
++#elif SPIM_CTRL == 2
++#define SELECTED_SPIM SPIM2
++#else
++#error "Invalid SPI controller selection"
++#endif
++
+ uint32_t mtk_plat_get_qspi_src_clk(void)
+ {
+ 	/* config GPIO pinmux to spi mode */
+-	mtk_spi_gpio_init(SPIM0);
++	mtk_spi_gpio_init(SELECTED_SPIM);
+ 
+ 	/* select 208M clk */
+ 	mtk_spi_source_clock_select(MTK_QSPI_SRC_CLK);
+--- a/plat/mediatek/mt7987/platform.mk
++++ b/plat/mediatek/mt7987/platform.mk
+@@ -56,8 +56,8 @@ include make_helpers/dep.mk
+ 
+ $(call GEN_DEP_RULES,bl2,emicfg bl2_boot_ram bl2_boot_nand_nmbm bl2_dev_mmc bl2_plat_init bl2_plat_setup mt7987_gpio dtb)
+ $(call MAKE_DEP,bl2,emicfg,DDR4_4BG_MODE DRAM_DEBUG_LOG DDR3_FREQ_2133 DDR3_FREQ_1866 DDR4_FREQ_3200 DDR4_FREQ_2666)
+-$(call MAKE_DEP,bl2,bl2_plat_init,BL2_COMPRESS)
+-$(call MAKE_DEP,bl2,bl2_plat_setup,BOOT_DEVICE TRUSTED_BOARD_BOOT BL32_TZRAM_BASE BL32_TZRAM_SIZE BL32_LOAD_OFFSET)
++$(call MAKE_DEP,bl2,bl2_plat_init,BL2_COMPRESS SPIM_CTRL)
++$(call MAKE_DEP,bl2,bl2_plat_setup,BOOT_DEVICE TRUSTED_BOARD_BOOT BL32_TZRAM_BASE BL32_TZRAM_SIZE BL32_LOAD_OFFSET SPIM_CTRL)
+ $(call MAKE_DEP,bl2,bl2_dev_mmc,BOOT_DEVICE)
+ $(call MAKE_DEP,bl2,bl2_boot_ram,RAM_BOOT_DEBUGGER_HOOK RAM_BOOT_UART_DL)
+ $(call MAKE_DEP,bl2,bl2_boot_nand_nmbm,NMBM_MAX_RATIO NMBM_MAX_RESERVED_BLOCKS NMBM_DEFAULT_LOG_LEVEL)

package/boot/arm-trusted-firmware-mediatek/patches/0006-hack-mt7987-mmc-use-4-bit-bus-width-for-eMMC.patch

@@ -0,0 +1,24 @@
+From 0a09912eb336bee788443b919ea5b99b195f5a91 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 4 Oct 2025 22:13:49 +0100
+Subject: [PATCH] hack: mt7987: mmc: use 4-bit bus-width for eMMC
+
+The BananaPi R4 Lite has broken DAT5 signal of the MMC bus, which
+results in 8-bit buswidth not working well for the eMMC.
+Reduce to 4-bit buswidth fixes it (and makes all other boards with
+eMMC a tiny bit slower to boot, but it's in the milliseconds).
+---
+ plat/mediatek/mt7987/bl2/bl2_dev_mmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/plat/mediatek/mt7987/bl2/bl2_dev_mmc.c
++++ b/plat/mediatek/mt7987/bl2/bl2_dev_mmc.c
+@@ -74,7 +74,7 @@ static const struct mt7987_msdc_conf {
+ 	{
+ 		.base = MSDC0_BASE,
+ 		.top_base = MSDC0_TOP_BASE,
+-		.bus_width = MMC_BUS_WIDTH_8,
++		.bus_width = MMC_BUS_WIDTH_4,
+ 		.type = MMC_IS_EMMC,
+ 		.src_clk = 200000000,
+ 		.dev_comp = &mt7987_msdc_compat,

package/boot/arm-trusted-firmware-mediatek/patches/0007-hack-mt7987-bl2-move-FIP-offset-to-0x100000.patch

@@ -0,0 +1,27 @@
+From 6725bb3c2aa9330f37a591e1e539badf67021b47 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 4 Oct 2025 23:59:54 +0100
+Subject: [PATCH] hack: mt7987: bl2: move FIP offset to 0x100000
+
+There is no use in allocating more than 2MB to the factory partition.
+After all, even for WiFi 7 tri-band devices the calibration data is
+still in the kilobytes range.
+Move FIP offset to 0x100000 to not waste so much space on small NOR
+flash.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ plat/mediatek/mt7987/bl2/bl2_dev_spi_nor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/plat/mediatek/mt7987/bl2/bl2_dev_spi_nor.c
++++ b/plat/mediatek/mt7987/bl2/bl2_dev_spi_nor.c
+@@ -7,7 +7,7 @@
+ #include <stdint.h>
+ #include <boot_spi.h>
+ 
+-#define FIP_BASE			0x250000
++#define FIP_BASE			0x100000
+ #define FIP_SIZE			0x80000
+ 
+ #define MTK_QSPI_SRC_CLK		CB_MPLL_D2

package/boot/arm-trusted-firmware-microchipsw/Makefile

@@ -0,0 +1,78 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=arm-trusted-firmware-microchipsw
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL=https://github.com/microchip-ung/arm-trusted-firmware.git
+PKG_SOURCE_DATE:=2026-01-07
+PKG_SOURCE_VERSION:=7696c9aaaae7c677f4c373a61a1289cba7f824aa
+PKG_MIRROR_HASH:=331548d7c73896bd5e4438c0ec9c71bbe58d3bf9a29350496ad94c382e922b9c
+
+PKG_BUILD_DEPENDS:=ruby/host
+PKG_MAINTAINER:=Robert Marko <robert.marko@sartura.hr>
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/trusted-firmware-a.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Trusted-Firmware-A/Default
+  BUILD_TARGET:=microchipsw
+  TFA_IMAGE:=fip.bin fwu_fip.bin fwu.html
+endef
+
+define Trusted-Firmware-A/ev23x71a
+  NAME:=Microchip EV23X71A
+  BUILD_SUBTARGET:=lan969x
+  BUILD_DEVICES:=microchip_ev23x71a
+  PLAT:=lan969x_a0
+  DEPENDS:=+u-boot-ev23x71a
+endef
+
+define Trusted-Firmware-A/tactical-1000
+  NAME:=Novarq Tactical 1000
+  BUILD_SUBTARGET:=lan969x
+  BUILD_DEVICES:=novarq_tactical-1000
+  PLAT:=novarq_tactical_1000_v3
+  DEPENDS:=+u-boot-tactical-1000
+endef
+
+TFA_TARGETS:= \
+	ev23x71a \
+	tactical-1000
+
+MBEDTLS_NAME:=mbedtls
+MBEDTLS_RELEASE:=2.28.10
+MBEDTLS_SOURCE:=$(MBEDTLS_NAME)-$(MBEDTLS_RELEASE).tar.zst
+
+define Download/mbedtls
+  FILE:=$(MBEDTLS_SOURCE)
+  PROTO:=git
+  URL:=https://github.com/Mbed-TLS/mbedtls.git
+  SOURCE_VERSION:=2fc8413bfcb51354c8e679141b17b3f1a5942561
+  MIRROR_HASH:=40b94a76572ad1ca89738929ab81d6024f678f22691eb3bd633c076ac18a334a
+  SUBDIR:=$(MBEDTLS_NAME)
+endef
+
+define Build/Prepare
+	# Download mbedtls
+	$(eval $(call Download,mbedtls))
+
+	$(call Build/Prepare/Default,)
+
+	$(TAR) -C $(PKG_BUILD_DIR) -xf $(DL_DIR)/$(MBEDTLS_SOURCE)
+endef
+
+TFA_MAKE_FLAGS += \
+	MBEDTLS_DIR=$(PKG_BUILD_DIR)/$(MBEDTLS_NAME) \
+	BL33=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.bin \
+	KEY_ALG=ecdsa GENERATE_COT=1 TRUSTED_BOARD_BOOT=1 \
+	all fip fwu_fip
+
+define Package/trusted-firmware-a/install
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/build/$(PLAT)/release/fip.bin $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-fip.bin
+	$(CP) $(patsubst %,$(PKG_BUILD_DIR)/build/$(PLAT)/release/%,$(TFA_IMAGE)) $(1)/
+endef
+
+$(eval $(call BuildPackage/Trusted-Firmware-A))

package/boot/arm-trusted-firmware-microchipsw/patches/0001-microchip-lan969x-add-Novarq-Tactical-1000-v3.patch

@@ -0,0 +1,171 @@
+From 190202583edb9dcab5ca49638169d08a332f0fdf Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Sun, 2 Nov 2025 16:57:45 +0100
+Subject: [PATCH] microchip: lan969x: add Novarq Tactical 1000 v3
+
+Add support for Novarq Tactical 1000 v3 board as a separate platform since
+it uses 2GB of RAM and requires a different RAM configuration.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ .../fdts/lan969x-tactical-1000-v3-ddr.dtsi    | 90 +++++++++++++++++++
+ .../novarq_tactical_1000_v3_tb_fw_config.dts  | 30 +++++++
+ .../novarq_tactical_1000_v3/platform.mk       | 12 +++
+ scripts/fwu/fwu.js                            |  2 +-
+ 4 files changed, 133 insertions(+), 1 deletion(-)
+ create mode 100644 plat/microchip/lan969x/fdts/lan969x-tactical-1000-v3-ddr.dtsi
+ create mode 100644 plat/microchip/lan969x/novarq_tactical_1000_v3/fdts/novarq_tactical_1000_v3_tb_fw_config.dts
+ create mode 100644 plat/microchip/lan969x/novarq_tactical_1000_v3/platform.mk
+
+--- /dev/null
++++ b/plat/microchip/lan969x/fdts/lan969x-tactical-1000-v3-ddr.dtsi
+@@ -0,0 +1,90 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright (C) 2022 Microchip Technology Inc. and its subsidiaries.
++ *
++ */
++
++&ddr {
++	microchip,mem-name = "lan969x_tactical_1000_2gb 2025-11-02-13:03:23 7391dfb-dirty";
++	microchip,mem-speed = <2400>;
++	microchip,mem-size = <0x80000000>;
++	microchip,mem-bus-width = <16>;
++
++	microchip,main-reg = <
++		0x00001091	/* crcparctl1 */
++		0x00000001	/* dbictl */
++		0x00000040	/* dfimisc */
++		0x0391820f	/* dfitmg0 */
++		0x00040201	/* dfitmg1 */
++		0x40400003	/* dfiupd0 */
++		0x004000ff	/* dfiupd1 */
++		0x003f7f40	/* ecccfg0 */
++		0x00020248	/* init0 */
++		0x00e80000	/* init1 */
++		0x0c340101	/* init3 */
++		0x10180200	/* init4 */
++		0x00110000	/* init5 */
++		0x00000402	/* init6 */
++		0x00000c19	/* init7 */
++		0x81040010	/* mstr */
++		0x00000000	/* pccfg */
++		0x00000000	/* pwrctl */
++		0x00210020	/* rfshctl0 */
++		0x00000000	/* rfshctl3 */
++	>;
++
++	microchip,timing-reg = <
++		0x17131413	/* dramtmg0 */
++		0x0007051b	/* dramtmg1 */
++		0x1a000010	/* dramtmg12 */
++		0x090b0512	/* dramtmg2 */
++		0x0000400c	/* dramtmg3 */
++		0x08040409	/* dramtmg4 */
++		0x07070404	/* dramtmg5 */
++		0x07060c0b	/* dramtmg8 */
++		0x0003040d	/* dramtmg9 */
++		0x07000610	/* odtcfg */
++		0x0049014b	/* rfshtmg */
++	>;
++
++	microchip,mapping-reg = <
++		0x0000001f	/* addrmap0 */
++		0x003f0909	/* addrmap1 */
++		0x00000700	/* addrmap2 */
++		0x00000000	/* addrmap3 */
++		0x00001f1f	/* addrmap4 */
++		0x07070707	/* addrmap5 */
++		0x07070707	/* addrmap6 */
++		0x00000f07	/* addrmap7 */
++		0x00003f01	/* addrmap8 */
++	>;
++
++	microchip,phy-reg = <
++		0x0000040c	/* dcr */
++		0x0064401b	/* dsgcr */
++		0x8000b0cf	/* dtcr0 */
++		0x00010a37	/* dtcr1 */
++		0x00c01884	/* dxccr */
++		0x000010ba	/* pgcr2 */
++		0x00000000	/* schcr1 */
++		0x00079900	/* zq0pr */
++		0x10077900	/* zq1pr */
++		0x00000000	/* zq2pr */
++		0x00058f00	/* zqcr */
++	>;
++
++	microchip,phy_timing-reg = <
++		0x0827100a	/* dtpr0 */
++		0x28250018	/* dtpr1 */
++		0x000702a1	/* dtpr2 */
++		0x03000101	/* dtpr3 */
++		0x02950808	/* dtpr4 */
++		0x00361009	/* dtpr5 */
++		0x4ae25710	/* ptr0 */
++		0x74f4950e	/* ptr1 */
++		0x00083def	/* ptr2 */
++		0x2a192000	/* ptr3 */
++		0x1003a000	/* ptr4 */
++	>;
++
++};
+--- /dev/null
++++ b/plat/microchip/lan969x/novarq_tactical_1000_v3/fdts/novarq_tactical_1000_v3_tb_fw_config.dts
+@@ -0,0 +1,30 @@
++/*
++ * Copyright (c) 2022, Microchip Technology Inc. and its subsidiaries.
++ *
++ * SPDX-License-Identifier: BSD-3-Clause
++ */
++
++/dts-v1/;
++
++#include "lan969x.dtsi"
++#include "lan969x-tactical-1000-v3-ddr.dtsi"
++
++&emmc_clk {
++	clock-frequency = <100000000>;
++};
++
++&sdmmc0 {
++	status = "okay";
++	bus-width = <8>;
++};
++
++&qspi0 {
++	status = "okay";
++	spi-flash@0 {
++		compatible = "jedec,spi-nor";
++		reg = <0>;
++		spi-max-frequency = <100000000>;
++		spi-tx-bus-width = <4>;
++		spi-rx-bus-width = <4>;
++	};
++};
+--- /dev/null
++++ b/plat/microchip/lan969x/novarq_tactical_1000_v3/platform.mk
+@@ -0,0 +1,12 @@
++#
++# Copyright (c) 2021, Microchip Technology Inc. and its subsidiaries.
++#
++# SPDX-License-Identifier: BSD-3-Clause
++#
++
++include plat/microchip/lan969x/common/common.mk
++
++# This is used in lan969x code
++$(eval $(call add_define,LAN969X_ASIC))
++# This is used in common drivers
++$(eval $(call add_define,LAN966X_ASIC))
+--- a/scripts/fwu/fwu.js
++++ b/scripts/fwu/fwu.js
+@@ -91,7 +91,7 @@ const platforms = [
+ 	"ddr_diag":	ddr_diag_regs_lan969x,
+ 	"ddr_regs":	ddr_regs_lan969x,
+ 	"ddr_speed":	lan969x_speeds,
+-	"bl2u_compat":	["lan969x_a0", "lan969x_svb"],
++	"bl2u_compat":	["lan969x_a0", "lan969x_svb", "novarq_tactical_1000_v3"],
+     },
+ ];
+ 

package/boot/arm-trusted-firmware-microchipsw/patches/0002-cert_create-add-LibreSSL-3.9-compatibility.patch

@@ -0,0 +1,95 @@
+From 40166fd8d88f33c621d3cca0b936f31816f3fe2e Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Mon, 12 Jan 2026 14:40:23 +0100
+Subject: [PATCH] cert_create: add LibreSSL 3.9+ compatibility
+
+LibreSSL 3.9+ has dropped the whole support for X509V3 extensions.
+
+Generated by Gemini 3 Pro.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ tools/cert_create/src/ext.c | 26 ++++++++++++++++++++++----
+ 1 file changed, 22 insertions(+), 4 deletions(-)
+
+--- a/tools/cert_create/src/ext.c
++++ b/tools/cert_create/src/ext.c
+@@ -51,15 +51,18 @@ int ext_init(void)
+ {
+ 	cmd_opt_t cmd_opt;
+ 	ext_t *ext;
++#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x40200000L
+ 	X509V3_EXT_METHOD *m;
+-	int nid, ret;
++	int ret, nid;
++#endif
+ 	unsigned int i;
+ 
+ 	extensions = malloc((num_def_extensions * sizeof(def_extensions[0]))
+ #ifdef PDEF_EXTS
+ 			    + (num_pdef_extensions * sizeof(pdef_extensions[0]))
+ #endif
+-			    );
++		);
++
+ 	if (extensions == NULL) {
+ 		ERROR("%s:%d Failed to allocate memory.\n", __func__, __LINE__);
+ 		return 1;
+@@ -69,7 +72,7 @@ int ext_init(void)
+ 	       (num_def_extensions * sizeof(def_extensions[0])));
+ #ifdef PDEF_EXTS
+ 	memcpy(&extensions[num_def_extensions], &pdef_extensions[0],
+-		(num_pdef_extensions * sizeof(pdef_extensions[0])));
++	       (num_pdef_extensions * sizeof(pdef_extensions[0])));
+ 	num_extensions = num_def_extensions + num_pdef_extensions;
+ #else
+ 	num_extensions = num_def_extensions;
+@@ -86,11 +89,15 @@ int ext_init(void)
+ 			cmd_opt.help_msg = ext->help_msg;
+ 			cmd_opt_add(&cmd_opt);
+ 		}
++
+ 		/* Register the extension OID in OpenSSL */
+ 		if (ext->oid == NULL) {
+ 			continue;
+ 		}
++
++#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x40200000L
+ 		nid = OBJ_create(ext->oid, ext->sn, ext->ln);
++
+ 		if (ext->alias) {
+ 			X509V3_EXT_add_alias(nid, ext->alias);
+ 		} else {
+@@ -117,7 +124,16 @@ int ext_init(void)
+ 				return 1;
+ 			}
+ 		}
++#else
++		/*
++		 * LibreSSL 4.2.0+ removed X509V3_EXT_add/alias.
++		 * We still register the OID, but ignore the returned NID
++		 * as we skip method registration.
++		 */
++		OBJ_create(ext->oid, ext->sn, ext->ln);
++#endif
+ 	}
++
+ 	return 0;
+ }
+ 
+@@ -323,12 +339,14 @@ void ext_cleanup(void)
+ 	for (i = 0; i < num_extensions; i++) {
+ 		if (extensions[i].arg != NULL) {
+ 			void *ptr = (void *)extensions[i].arg;
+-
+ 			extensions[i].arg = NULL;
+ 			free(ptr);
+ 		}
+ 	}
+ 	free(extensions);
++
++#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x40200000L
+ 	X509V3_EXT_cleanup();
++#endif
+ }
+ 

package/boot/arm-trusted-firmware-microchipsw/patches/0003-cert_create-pass-pthread-in-LDFLAGS.patch

@@ -0,0 +1,36 @@
+From 11ff8b5e67830d5a09f39e8c1f000b0ddcf8e88f Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Mon, 12 Jan 2026 15:16:07 +0100
+Subject: [PATCH] cert_create: pass pthread in LDFLAGS
+
+OpenWrt-s LibreSSL is linked against pthread, so we have to make sure to
+pass -lpthread in LDFLAGS to avoid:
+/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-crypto_init.o): in function `OPENSSL_init_crypto':
+crypto_init.c:(.text+0x67): undefined reference to `pthread_once'
+/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-err.o): in function `ERR_load_ERR_strings':
+err.c:(.text+0x812): undefined reference to `pthread_once'
+/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-conf_sap.o): in function `OpenSSL_config':
+conf_sap.c:(.text+0xc0): undefined reference to `pthread_once'
+/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-conf_sap.o): in function `OpenSSL_no_config':
+conf_sap.c:(.text+0x107): undefined reference to `pthread_once'
+/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-err_all.o): in function `ERR_load_crypto_strings':
+err_all.c:(.text+0xa3): undefined reference to `pthread_once'
+collect2: error: ld returned 1 exit status
+make[4]: *** [Makefile:93: cert_create] Error 1
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ tools/cert_create/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/cert_create/Makefile
++++ b/tools/cert_create/Makefile
+@@ -79,7 +79,7 @@ INC_DIR += -I ./include -I ${PLAT_INCLUD
+ # located under the main project directory (i.e.: ${OPENSSL_DIR}, not
+ # ${OPENSSL_DIR}/lib/).
+ LIB_DIR := -L ${OPENSSL_DIR}/lib -L ${OPENSSL_DIR}
+-LIB := -lssl -lcrypto
++LIB := -lssl -lcrypto -pthread
+ 
+ HOSTCC ?= gcc
+ 

package/boot/arm-trusted-firmware-microchipsw/patches/0004-microchip-lan969x-do-not-rely-on-Ruby-shebang.patch

@@ -0,0 +1,29 @@
+From f78f934710394822a36bd74043ed93a812c1c690 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Mon, 12 Jan 2026 15:36:35 +0100
+Subject: [PATCH] microchip: lan969x: do not rely on Ruby shebang
+
+Host Ruby build in the staging dir must be used, so we cannot rely on the
+shebang as that will fail.
+
+So, call the script via Ruby executable instead.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ plat/microchip/lan969x/common/common.mk | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/plat/microchip/lan969x/common/common.mk
++++ b/plat/microchip/lan969x/common/common.mk
+@@ -218,9 +218,9 @@ FWU_HTML := ${BUILD_PLAT}/fwu.html
+ FWU_JS   := ${BUILD_PLAT}/fwu_app.js
+ 
+ ${FWU_JS}: ${BUILD_PLAT}/${FWU_FIP_NAME}
+-	./plat/microchip/scripts/mkjs.rb -p ${PLAT} -o ${FWU_JS} $<
++	$(Q)ruby ./plat/microchip/scripts/mkjs.rb -p ${PLAT} -o ${FWU_JS} $<
+ 
+ ${FWU_HTML}: ${FWU_JS}
+-	./plat/microchip/scripts/html_inline.rb -i ${BUILD_PLAT} ./scripts/fwu/serial.html > ${FWU_HTML}
++	$(Q)ruby ./plat/microchip/scripts/html_inline.rb -i ${BUILD_PLAT} ./scripts/fwu/serial.html > ${FWU_HTML}
+ 
+ all: ${FWU_HTML}

package/boot/arm-trusted-firmware-rockchip/Makefile

@@ -7,11 +7,10 @@
 
 include $(TOPDIR)/rules.mk
 
-PKG_VERSION:=2.12.1
+PKG_VERSION:=2.14.0
 PKG_RELEASE:=1
-PKG_LTS:=1
 
-PKG_HASH:=c0d432a851da452d927561feaf45f569c1cde57985782beadfe29e616e260440
+PKG_HASH:=b2a3bc360307c929714ffd8e7f1441c4888cd5d80531276e809c2de54db5dc16
 
 PKG_MAINTAINER:=Sarah Maedel <openwrt@tbspace.de>
 
@@ -34,6 +33,11 @@ define Trusted-Firmware-A/rk3399
   PLAT:=rk3399
 endef
 
+define Trusted-Firmware-A/rk3576
+  BUILD_SUBTARGET:=armv8
+  PLAT:=rk3576
+endef
+
 define Trusted-Firmware-A/rk3588
   BUILD_SUBTARGET:=armv8
   PLAT:=rk3588
@@ -42,11 +46,12 @@ endef
 TFA_TARGETS:= \
 	rk3328 \
 	rk3399 \
+	rk3576 \
 	rk3588
 
 ifeq ($(BUILD_VARIANT),rk3399)
-  M0_GCC_NAME:=gcc-arm
-  M0_GCC_RELEASE:=11.2-2022.02
+  M0_GCC_NAME:=arm-gnu-toolchain
+  M0_GCC_RELEASE:=12.3.rel1
   M0_GCC_VERSION:=$(HOST_ARCH)-arm-none-eabi
   M0_GCC_SOURCE:=$(M0_GCC_NAME)-$(M0_GCC_RELEASE)-$(M0_GCC_VERSION).tar.xz
 
@@ -54,9 +59,9 @@ ifeq ($(BUILD_VARIANT),rk3399)
     FILE:=$(M0_GCC_SOURCE)
     URL:=https://developer.arm.com/-/media/Files/downloads/gnu/$(M0_GCC_RELEASE)/binrel
   ifeq ($(HOST_ARCH),aarch64)
-    HASH:=ef1d82e5894e3908cb7ed49c5485b5b95deefa32872f79c2b5f6f5447cabf55f
+    HASH:=14c0487d5753f6071d24e568881f7c7e67f80dd83165dec5164b3731394af431
   else
-    HASH:=8c5acd5ae567c0100245b0556941c237369f210bceb196edfe5a2e7532c60326
+    HASH:=12a2815644318ebcceaf84beabb665d0924b6e79e21048452c5331a56332b309
   endif
   endef
 

package/boot/arm-trusted-firmware-stm32/Makefile

@@ -7,10 +7,10 @@
 
 include $(TOPDIR)/rules.mk
 
-PKG_VERSION:=2.12
-PKG_RELEASE:=2
+PKG_VERSION:=2.14
+PKG_RELEASE:=1
 
-PKG_HASH:=b4c047493cac1152203e1ba121ae57267e4899b7bf56eb365e22a933342d31c9
+PKG_HASH:=14fb6101f2ef424ec84c0296c3cbdeb7f79b22f5fbb46529bea0e362d0fab0d5
 PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
 
 include $(INCLUDE_DIR)/kernel.mk

package/boot/arm-trusted-firmware-stm32/patches/0001-fix-stm32mp1-fdts-re-enable-RTC-clock.patch

@@ -1,51 +0,0 @@
-From 33573ea6842198cfdb5b3fdd320db9e2045855e9 Mon Sep 17 00:00:00 2001
-From: Valentin Caron <valentin.caron@foss.st.com>
-Date: Wed, 11 Dec 2024 11:20:04 +0100
-Subject: [PATCH] fix(stm32mp1-fdts): re-enable RTC clock
-
-On STM32MP15 ST boards, RTC clock configuration by OPTEE is not ready
-yet. Re-enable it temporary to get LSE as clock source of RTC.
-
-Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
-Change-Id: Ib6071229552e456faffb4fdfc8db9808140d54a7
----
- fdts/stm32mp157c-ed1.dts  | 2 ++
- fdts/stm32mp15xx-dkx.dtsi | 2 ++
- 2 files changed, 4 insertions(+)
-
---- a/fdts/stm32mp157c-ed1.dts
-+++ b/fdts/stm32mp157c-ed1.dts
-@@ -194,6 +194,7 @@
- 		CLK_MPU_PLL1P
- 		CLK_AXI_PLL2P
- 		CLK_MCU_PLL3P
-+		CLK_RTC_LSE
- 		CLK_MCO1_DISABLED
- 		CLK_MCO2_DISABLED
- 		CLK_CKPER_HSE
-@@ -242,6 +243,7 @@
- 		DIV(DIV_APB3, 1)
- 		DIV(DIV_APB4, 1)
- 		DIV(DIV_APB5, 2)
-+		DIV(DIV_RTC, 23)
- 		DIV(DIV_MCO1, 0)
- 		DIV(DIV_MCO2, 0)
- 	>;
---- a/fdts/stm32mp15xx-dkx.dtsi
-+++ b/fdts/stm32mp15xx-dkx.dtsi
-@@ -198,6 +198,7 @@
- 		CLK_MPU_PLL1P
- 		CLK_AXI_PLL2P
- 		CLK_MCU_PLL3P
-+		CLK_RTC_LSE
- 		CLK_MCO1_DISABLED
- 		CLK_MCO2_DISABLED
- 		CLK_CKPER_HSE
-@@ -246,6 +247,7 @@
- 		DIV(DIV_APB3, 1)
- 		DIV(DIV_APB4, 1)
- 		DIV(DIV_APB5, 2)
-+		DIV(DIV_RTC, 23)
- 		DIV(DIV_MCO1, 0)
- 		DIV(DIV_MCO2, 0)
- 	>;

package/boot/arm-trusted-firmware-sunxi/Makefile

@@ -7,10 +7,10 @@
 
 include $(TOPDIR)/rules.mk
 
-PKG_VERSION:=2.10
+PKG_VERSION:=2.14
 PKG_RELEASE:=1
 
-PKG_HASH:=88215a62291b9ba87da8e50b077741103cdc08fb6c9e1ebd34dfaace746d3201
+PKG_HASH:=14fb6101f2ef424ec84c0296c3cbdeb7f79b22f5fbb46529bea0e362d0fab0d5
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=license.md
@@ -46,9 +46,6 @@ TFA_TARGETS:= \
 	sunxi-h6 \
 	sunxi-h616
 
-TFA_MAKE_FLAGS+= \
-	$(if $(CONFIG_BINUTILS_VERSION_2_37)$(CONFIG_BINUTILS_VERSION_2_38),,LDFLAGS="-no-warn-rwx-segments")
-
 define Package/trusted-firmware-a/install
 	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/build/$(PLAT)/release/bl31.bin $(STAGING_DIR_IMAGE)/bl31_$(BUILD_VARIANT).bin

package/boot/grub2/Makefile

@@ -34,7 +34,7 @@ define Package/grub2/Default
   CATEGORY:=Boot Loaders
   SECTION:=boot
   TITLE:=GRand Unified Bootloader ($(2))
-  URL:=http://www.gnu.org/software/grub/
+  URL:=https://www.gnu.org/software/grub/
   DEPENDS:=@TARGET_$(1)
   VARIANT:=$(2)
 endef
@@ -49,7 +49,7 @@ define Package/grub2-editenv
   SECTION:=utils
   SUBMENU:=Boot Loaders
   TITLE:=Grub2 Environment editor
-  URL:=http://www.gnu.org/software/grub/
+  URL:=https://www.gnu.org/software/grub/
   DEPENDS:=@TARGET_x86
   VARIANT:=none
 endef
@@ -63,7 +63,7 @@ define Package/grub2-bios-setup
   SECTION:=utils
   SUBMENU:=Boot Loaders
   TITLE:=Grub2 BIOS boot setup tool
-  URL:=http://www.gnu.org/software/grub/
+  URL:=https://www.gnu.org/software/grub/
   DEPENDS:=@TARGET_x86
   VARIANT:=none
 endef

package/boot/kexec-tools/Config.in

@@ -11,4 +11,9 @@ config KEXEC_LZMA
 	prompt "lzma support"
 	default n
 
+config KEXEC_ZSTD
+	bool
+	prompt "zstd support"
+	default n
+	
 endmenu

package/boot/kexec-tools/Makefile

@@ -8,18 +8,18 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=kexec-tools
-PKG_VERSION:=2.0.28
-PKG_RELEASE:=2
+PKG_VERSION:=2.0.32
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/kernel/kexec
-PKG_HASH:=d2f0ef872f39e2fe4b1b01feb62b0001383207239b9f8041f98a95564161d053
+PKG_HASH:=8f81422a5fd2362cf6cb001b511e535565ed0f32c2f4451fb5eb68fed6710a5d
 
 PKG_LICENSE:=GPL-2.0-only
 PKG_LICENSE_FILES:=COPYING
 PKG_CPE_ID:=cpe:/a:kernel:kexec-tools
 
-PKG_CONFIG_DEPENDS := CONFIG_KEXEC_ZLIB CONFIG_KEXEC_LZMA
+PKG_CONFIG_DEPENDS := CONFIG_KEXEC_ZLIB CONFIG_KEXEC_LZMA CONFIG_KEXEC_ZSTD
 
 PKG_BUILD_FLAGS:=gc-sections
 
@@ -47,8 +47,8 @@ define Package/kexec
   $(call Package/kexec-tools/Default)
   TITLE:=Kernel boots kernel
   DEPENDS:=\
-	@(armeb||arm||i386||x86_64||powerpc64||mipsel||mips) \
-	+KEXEC_ZLIB:zlib +KEXEC_LZMA:liblzma @KERNEL_KEXEC
+	@(armeb||arm||aarch64||i386||x86_64||powerpc64||mipsel||mips) \
+	+KEXEC_ZLIB:zlib +KEXEC_LZMA:liblzma +KEXEC_ZSTD:libzstd @KERNEL_KEXEC
 endef
 
 define Package/kexec/description
@@ -58,7 +58,7 @@ endef
 define Package/kdump
   $(call Package/kexec-tools/Default)
   TITLE:=Kernel crash analysis
-  DEPENDS:=+kexec @(i386||x86_64||arm) @KERNEL_CRASH_DUMP
+  DEPENDS:=+kexec @(i386||x86_64||arm||aarch64) @KERNEL_CRASH_DUMP
 endef
 
 define Package/kdump/description
@@ -86,6 +86,7 @@ CONFIGURE_ARGS = \
 		--sysconfdir=/etc \
 		$(if $(CONFIG_KEXEC_ZLIB),--with,--without)-zlib \
 		$(if $(CONFIG_KEXEC_LZMA),--with,--without)-lzma \
+		$(if $(CONFIG_KEXEC_ZSTD),--with,--without)-zstd \
 		TARGET_LD="$(TARGET_CROSS)ld"
 
 CONFIGURE_VARS += \

package/boot/kexec-tools/patches/010-Fix-building-on-x86_64-with-binutils-2.41.patch

@@ -1,81 +0,0 @@
-From 328de8e00e298f00d7ba6b25dc3950147e9642e6 Mon Sep 17 00:00:00 2001
-From: Michel Lind <salimma@fedoraproject.org>
-Date: Tue, 30 Jan 2024 04:14:31 -0600
-Subject: [PATCH] Fix building on x86_64 with binutils 2.41
-
-Newer versions of the GNU assembler (observed with binutils 2.41) will
-complain about the ".arch i386" in files assembled with "as --64",
-with the message "Error: 64bit mode not supported on 'i386'".
-
-Fix by moving ".arch i386" below the relevant ".code32" directive, so
-that the assembler is no longer expecting 64-bit instructions to be used
-by the time that the ".arch i386" directive is encountered.
-
-Based on similar iPXE fix:
-https://github.com/ipxe/ipxe/commit/6ca597eee
-
-Signed-off-by: Michel Lind <michel@michel-slm.name>
-Signed-off-by: Simon Horman <horms@kernel.org>
----
- purgatory/arch/i386/entry32-16-debug.S | 2 +-
- purgatory/arch/i386/entry32-16.S       | 2 +-
- purgatory/arch/i386/entry32.S          | 2 +-
- purgatory/arch/i386/setup-x86.S        | 2 +-
- 4 files changed, 4 insertions(+), 4 deletions(-)
-
---- a/purgatory/arch/i386/entry32-16-debug.S
-+++ b/purgatory/arch/i386/entry32-16-debug.S
-@@ -25,10 +25,10 @@
- 	.globl entry16_debug_pre32
- 	.globl entry16_debug_first32
- 	.globl entry16_debug_old_first32
--	.arch i386
- 	.balign 16
- entry16_debug:
- 	.code32
-+	.arch i386
- 	/* Compute where I am running at (assumes esp valid) */
- 	call	1f
- 1:	popl	%ebx
---- a/purgatory/arch/i386/entry32-16.S
-+++ b/purgatory/arch/i386/entry32-16.S
-@@ -20,10 +20,10 @@
- #undef i386	
- 	.text
- 	.globl entry16, entry16_regs
--	.arch i386
- 	.balign 16
- entry16:
- 	.code32
-+	.arch i386
- 	/* Compute where I am running at (assumes esp valid) */
- 	call	1f
- 1:	popl	%ebx
---- a/purgatory/arch/i386/entry32.S
-+++ b/purgatory/arch/i386/entry32.S
-@@ -20,10 +20,10 @@
- #undef i386
- 
- 	.text
--	.arch	i386
- 	.globl entry32, entry32_regs
- entry32:
- 	.code32
-+	.arch	i386
- 
- 	/* Setup a gdt that should that is generally usefully */
- 	lgdt	%cs:gdt
---- a/purgatory/arch/i386/setup-x86.S
-+++ b/purgatory/arch/i386/setup-x86.S
-@@ -21,10 +21,10 @@
- #undef i386
- 
- 	.text
--	.arch	i386
- 	.globl purgatory_start
- purgatory_start:
- 	.code32
-+	.arch	i386
- 
- 	/* Load a gdt so I know what the segment registers are */
- 	lgdt	%cs:gdt

package/boot/kexec-tools/patches/020-i386-improve-basename-compatibility.patch

@@ -1,37 +0,0 @@
-From 99f62f58fac57214ecc3c9aabf6bf61ac1e1201d Mon Sep 17 00:00:00 2001
-From: Tony Ambardar <itugrok@yahoo.com>
-Date: Fri, 7 Jun 2024 21:54:56 -0700
-Subject: [PATCH] i386: improve basename() compatibility
-
-Drop usage of glibc basename() in favour of a simpler implementation that
-works across GNU and musl libc, and is similar to existing code in fs2dt.c.
-
-This fixes compile errors seen building against musl.
-
-Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
----
- kexec/arch/i386/x86-linux-setup.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
---- a/kexec/arch/i386/x86-linux-setup.c
-+++ b/kexec/arch/i386/x86-linux-setup.c
-@@ -318,6 +318,7 @@ static int add_edd_entry(struct x86_linu
- 	uint8_t devnum, version;
- 	uint32_t mbr_sig;
- 	struct edd_info *edd_info;
-+	char *basename = strrchr(sysfs_name,'/') + 1;
- 
- 	if (!current_mbr || !current_edd) {
- 		fprintf(stderr, "%s: current_edd and current_edd "
-@@ -329,9 +330,9 @@ static int add_edd_entry(struct x86_linu
- 	memset(edd_info, 0, sizeof(struct edd_info));
- 
- 	/* extract the device number */
--	if (sscanf(basename(sysfs_name), "int13_dev%hhx", &devnum) != 1) {
-+	if (sscanf(basename, "int13_dev%hhx", &devnum) != 1) {
- 		fprintf(stderr, "Invalid format of int13_dev dir "
--				"entry: %s\n", basename(sysfs_name));
-+				"entry: %s\n", basename);
- 		return -1;
- 	}
- 

package/boot/optee-os-stm32/Makefile

@@ -7,10 +7,10 @@
 
 include $(TOPDIR)/rules.mk
 
-PKG_VERSION:=4.6.0
+PKG_VERSION:=4.9.0
 PKG_RELEASE:=1
 
-PKG_HASH:=0c947c6972bf50c483cb993af01041d4094b1e03711c7246cdde6ba2ffc351fe
+PKG_HASH:=9400e16c45bfa45f15585b2c933b86c449e7de05def0ecaaa62a4f38973a3a45
 PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
 
 OPTEE_USE_INTREE_DTC:=1

package/boot/rkbin/Makefile

@@ -9,9 +9,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/rockchip-linux/rkbin.git
-PKG_SOURCE_DATE:=2024-02-22
-PKG_SOURCE_VERSION:=a2a0b89b6c8c612dca5ed9ed8a68db8a07f68bc0
-PKG_MIRROR_HASH:=39f15e5f8fac02026065b6747b355b93f4e06202783ae448c43607763211597c
+PKG_SOURCE_DATE:=2025-06-13
+PKG_SOURCE_VERSION:=74213af1e952c4683d2e35952507133b61394862
+PKG_MIRROR_HASH:=4b801b1301ae297f660340617b5f398b23a3f0b43bc7f0ef42c21f0f43eb8990
 
 PKG_LICENSE_FILES:=LICENSE
 PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>
@@ -27,78 +27,91 @@ endef
 
 define Trusted-Firmware-A/rk3308
   BUILD_SUBTARGET:=armv8
-  ATF:=rk33/rk3308_bl31_v2.26.elf
-  TPL:=rk33/rk3308_ddr_589MHz_uart2_m1_v2.07.bin
+  ATF:=rk33/rk3308_bl31_v2.27.elf
+  TPL:=rk33/rk3308_ddr_589MHz_uart2_m1_v2.10.bin
 endef
 
-define Trusted-Firmware-A/rk3308-rock-pi-s
-  NAME:=Radxa ROCK Pi S
+define Trusted-Firmware-A/rk3308-tpl-rock-pi-s
+  NAME:=Radxa ROCK Pi S board
   BUILD_SUBTARGET:=armv8
-  ATF:=rk33/rk3308_bl31_v2.26.elf
-  TPL:=rk33/rk3308_ddr_589MHz_uart0_m0_v2.07.bin
+  TPL:=rk33/rk3308_ddr_589MHz_uart0_m0_v2.10.bin
+endef
+
+define Trusted-Firmware-A/rk3528
+  BUILD_SUBTARGET:=armv8
+  ATF:=rk35/rk3528_bl31_v1.20.elf
+  TPL:=rk35/rk3528_ddr_1056MHz_v1.11.bin
 endef
 
 define Trusted-Firmware-A/rk3566
   BUILD_SUBTARGET:=armv8
-  ATF:=rk35/rk3568_bl31_v1.44.elf
-  TPL:=rk35/rk3566_ddr_1056MHz_v1.21.bin
+  ATF:=rk35/rk3568_bl31_v1.45.elf
+  TPL:=rk35/rk3566_ddr_1056MHz_v1.23.bin
 endef
 
 define Trusted-Firmware-A/rk3568
   BUILD_SUBTARGET:=armv8
-  ATF:=rk35/rk3568_bl31_v1.44.elf
-  TPL:=rk35/rk3568_ddr_1560MHz_v1.21.bin
+  ATF:=rk35/rk3568_bl31_v1.45.elf
+  TPL:=rk35/rk3568_ddr_1560MHz_v1.23.bin
 endef
 
-define Trusted-Firmware-A/rk3568-e25
+define Trusted-Firmware-A/rk3568-tpl-e25
   NAME:=Radxa E25 board
   BUILD_SUBTARGET:=armv8
-  ATF:=rk35/rk3568_bl31_v1.44.elf
-  TPL:=rk35/rk3568_ddr_1560MHz_uart2_m0_115200_v1.21.bin
+  TPL:=rk35/rk3568_ddr_1560MHz_uart2_m0_115200_v1.23.bin
+endef
+
+define Trusted-Firmware-A/rk3576-tpl
+  NAME:=Rockchip RK3576 SoCs
+  BUILD_SUBTARGET:=armv8
+  TPL:=rk35/rk3576_ddr_lp4_2112MHz_lp5_2736MHz_v1.09.bin
 endef
 
 define Trusted-Firmware-A/rk3588-tpl
+  NAME:=Rockchip RK3588 SoCs
   BUILD_SUBTARGET:=armv8
-  TPL:=rk35/rk3588_ddr_lp4_2112MHz_lp5_2400MHz_v1.16.bin
+  TPL:=rk35/rk3588_ddr_lp4_2112MHz_lp5_2400MHz_v1.19.bin
 endef
 
 TFA_TARGETS:= \
 	rk3308 \
-	rk3308-rock-pi-s \
+	rk3308-tpl-rock-pi-s \
+	rk3528 \
 	rk3566 \
 	rk3568 \
-	rk3568-e25 \
+	rk3568-tpl-e25 \
+	rk3576-tpl \
 	rk3588-tpl
 
-ifeq ($(BUILD_VARIANT),rk3308-rock-pi-s)
-  TPL_FILE:=rk3308_ddr_589MHz_uart0_m0_v2.07.bin
+ifeq ($(BUILD_VARIANT),rk3308-tpl-rock-pi-s)
   define Download/rk3308-tpl-rock-pi-s
-    FILE:=$(TPL_FILE)
-    URL:=https://github.com/radxa/rkbin/raw/5696fab20dcac57c1458f72dc7604ba60e553adf/bin/rk33/
-    HASH:=8a1a42df23cccb86a2dabc14a5c0e9227d64a51b9b83e9968ef5af3b30787f7d
+    FILE:=$(notdir $(TPL))
+    URL_FILE:=$(TPL)
+    URL:=https://github.com/radxa/rkbin/raw/2b54df9d062ef91a9fffbc85472b070c9220c4cf/bin/
+    HASH:=45af030ed2cb322cc5a91c32350130fc1f1ea9508794fa4b5d309eadf70e3d04
   endef
 
   define Build/Prepare
 	$(eval $(call Download,rk3308-tpl-rock-pi-s))
 	$(call Build/Prepare/Default)
 
-	$(CP) $(DL_DIR)/$(TPL_FILE) $(PKG_BUILD_DIR)/bin/rk33/
+	$(CP) $(DL_DIR)/$(notdir $(TPL)) $(PKG_BUILD_DIR)/bin/$(TPL)
   endef
 endif
 
-ifeq ($(BUILD_VARIANT),rk3568-e25)
-  TPL_FILE:=rk3568_ddr_1560MHz_uart2_m0_115200_v1.21.bin
+ifeq ($(BUILD_VARIANT),rk3568-tpl-e25)
   define Download/rk3568-tpl-e25
-    FILE:=$(TPL_FILE)
-    URL:=https://github.com/radxa/rkbin/raw/5696fab20dcac57c1458f72dc7604ba60e553adf/bin/rk35/
-    HASH:=1815f9649dc5661a3ef184b052da39286e51453a66f6ff53cc3e345d65dfabd4
+    FILE:=$(notdir $(TPL))
+    URL_FILE:=$(TPL)
+    URL:=https://github.com/radxa/rkbin/raw/2e77c53ab0279585b09ecdaa54fe3e2bf80f9475/bin/
+    HASH:=1bb9f92a6515a70b91c0f8bd3aa4dc31432afc4317b9408f82c43ca63cb10ab6
   endef
 
   define Build/Prepare
 	$(eval $(call Download,rk3568-tpl-e25))
 	$(call Build/Prepare/Default)
 
-	$(CP) $(DL_DIR)/$(TPL_FILE) $(PKG_BUILD_DIR)/bin/rk35/
+	$(CP) $(DL_DIR)/$(notdir $(TPL)) $(PKG_BUILD_DIR)/bin/$(TPL)
   endef
 endif
 

package/boot/tfa-layerscape/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=tfa-layerscape
-PKG_VERSION:=6.6.23.2.0.0
-PKG_RELEASE:=2
+PKG_VERSION:=6.12.20.2.0.0
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/nxp-qoriq/atf
-PKG_SOURCE_VERSION:=lf-6.6.23-2.0.0
-PKG_MIRROR_HASH:=628a95ba60a593ae0575ee9ede1154445ec3a86a07b18e4947e06e13c2b67859
+PKG_SOURCE_VERSION:=lf-6.12.20-2.0.0
+PKG_MIRROR_HASH:=1e1c74900113a8d4354c06fdcedfff2cd6b0899b4a063d393de98f8ca358dfd2
 PKG_BUILD_DEPENDS:=tfa-layerscape/host
 
 include $(INCLUDE_DIR)/host-build.mk
@@ -162,7 +162,7 @@ TFA_TARGETS := \
   lx2160a-rdb-sdboot
 
 TFA_MAKE_FLAGS += \
-	$(if $(CONFIG_BINUTILS_VERSION_2_37)$(CONFIG_BINUTILS_VERSION_2_38),,LDFLAGS="-no-warn-rwx-segments") \
+	$(if $(CONFIG_BINUTILS_VERSION_2_37)$(CONFIG_BINUTILS_VERSION_2_38),,LDFLAGS="-Wl,--no-warn-rwx-segments") \
 	fip pbl \
 	BOOT_MODE=$(BOOT_MODE) \
 	RCW=$(STAGING_DIR_IMAGE)/fsl_$(BUILD_VARIANT)-rcw.bin \

package/boot/tfa-layerscape/patches/001-fiptool-hostbuild-fixes.patch

@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -128,10 +128,6 @@ CRTTOOL			?=	${CRTTOOLPATH}/cert_create$
+@@ -105,10 +105,6 @@ CRTTOOL			?=	${CRTTOOLPATH}/cert_create$
  ENCTOOLPATH		?=	tools/encrypt_fw
  ENCTOOL			?=	${ENCTOOLPATH}/encrypt_fw${BIN_EXT}
  
@@ -11,55 +11,55 @@
  # Variables for use with sptool
  SPTOOLPATH		?=	tools/sptool
  SPTOOL			?=	${SPTOOLPATH}/sptool.py
-@@ -1597,13 +1593,6 @@ endif #(CHECKPATCH)
+@@ -1622,13 +1618,6 @@ endif #(CHECKPATCH)
  clean:
- 	@echo "  CLEAN"
+ 	$(s)echo "  CLEAN"
  	$(call SHELL_REMOVE_DIR,${BUILD_PLAT})
 -ifdef UNIX_MK
--	${Q}${MAKE} --no-print-directory -C ${FIPTOOLPATH} clean
+-	$(q)${MAKE} --no-print-directory -C ${FIPTOOLPATH} clean
 -else
 -# Clear the MAKEFLAGS as we do not want
 -# to pass the gnumake flags to nmake.
--	${Q}set MAKEFLAGS= && ${MSVC_NMAKE} /nologo /f ${FIPTOOLPATH}/Makefile.msvc FIPTOOLPATH=$(subst /,\,$(FIPTOOLPATH)) FIPTOOL=$(subst /,\,$(FIPTOOL)) clean
+-	$(q)set MAKEFLAGS= && ${MSVC_NMAKE} /nologo /f ${FIPTOOLPATH}/Makefile.msvc FIPTOOLPATH=$(subst /,\,$(FIPTOOLPATH)) FIPTOOL=$(subst /,\,$(FIPTOOL)) clean
 -endif #(UNIX_MK)
- 	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${CRTTOOLPATH} clean
- 	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${ENCTOOLPATH} clean
- 	${Q}${MAKE} --no-print-directory -C ${ROMLIBPATH} clean
-@@ -1612,13 +1601,6 @@ realclean distclean:
- 	@echo "  REALCLEAN"
+ 	$(q)${MAKE} PLAT=${PLAT} --no-print-directory -C ${CRTTOOLPATH} clean
+ 	$(q)${MAKE} PLAT=${PLAT} --no-print-directory -C ${ENCTOOLPATH} clean
+ 	$(q)${MAKE} --no-print-directory -C ${ROMLIBPATH} clean
+@@ -1637,13 +1626,6 @@ realclean distclean:
+ 	$(s)echo "  REALCLEAN"
  	$(call SHELL_REMOVE_DIR,${BUILD_BASE})
  	$(call SHELL_DELETE_ALL, ${CURDIR}/cscope.*)
 -ifdef UNIX_MK
--	${Q}${MAKE} --no-print-directory -C ${FIPTOOLPATH} clean
+-	$(q)${MAKE} --no-print-directory -C ${FIPTOOLPATH} clean
 -else
 -# Clear the MAKEFLAGS as we do not want
 -# to pass the gnumake flags to nmake.
--	${Q}set MAKEFLAGS= && ${MSVC_NMAKE} /nologo /f ${FIPTOOLPATH}/Makefile.msvc FIPTOOLPATH=$(subst /,\,$(FIPTOOLPATH)) FIPTOOL=$(subst /,\,$(FIPTOOL)) realclean
+-	$(q)set MAKEFLAGS= && ${MSVC_NMAKE} /nologo /f ${FIPTOOLPATH}/Makefile.msvc FIPTOOLPATH=$(subst /,\,$(FIPTOOLPATH)) FIPTOOL=$(subst /,\,$(FIPTOOL)) realclean
 -endif #(UNIX_MK)
- 	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${CRTTOOLPATH} realclean
- 	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${ENCTOOLPATH} realclean
- 	${Q}${MAKE} --no-print-directory -C ${ROMLIBPATH} clean
-@@ -1674,7 +1656,7 @@ certificates: ${CRT_DEPS} ${CRTTOOL}
- 	@${ECHO_BLANK_LINE}
+ 	$(q)${MAKE} PLAT=${PLAT} --no-print-directory -C ${CRTTOOLPATH} realclean
+ 	$(q)${MAKE} PLAT=${PLAT} --no-print-directory -C ${ENCTOOLPATH} realclean
+ 	$(q)${MAKE} --no-print-directory -C ${ROMLIBPATH} clean
+@@ -1698,7 +1680,7 @@ certificates: ${CRT_DEPS} ${CRTTOOL}
+ 	$(s)echo
  endif #(GENERATE_COT)
  
 -${BUILD_PLAT}/${FIP_NAME}: ${FIP_DEPS} ${FIPTOOL}
 +${BUILD_PLAT}/${FIP_NAME}: ${FIP_DEPS}
  	$(eval ${CHECK_FIP_CMD})
- 	${Q}${FIPTOOL} create ${FIP_ARGS} $@
- 	${Q}${FIPTOOL} info $@
-@@ -1691,7 +1673,7 @@ fwu_certificates: ${FWU_CRT_DEPS} ${CRTT
- 	@${ECHO_BLANK_LINE}
+ 	$(q)${FIPTOOL} create ${FIP_ARGS} $@
+ 	$(q)${FIPTOOL} info $@
+@@ -1715,7 +1697,7 @@ fwu_certificates: ${FWU_CRT_DEPS} ${CRTT
+ 	$(s)echo
  endif #(GENERATE_COT)
  
 -${BUILD_PLAT}/${FWU_FIP_NAME}: ${FWU_FIP_DEPS} ${FIPTOOL}
 +${BUILD_PLAT}/${FWU_FIP_NAME}: ${FWU_FIP_DEPS}
  	$(eval ${CHECK_FWU_FIP_CMD})
- 	${Q}${FIPTOOL} create ${FWU_FIP_ARGS} $@
- 	${Q}${FIPTOOL} info $@
-@@ -1699,19 +1681,9 @@ ${BUILD_PLAT}/${FWU_FIP_NAME}: ${FWU_FIP
- 	@echo "Built $@ successfully"
- 	@${ECHO_BLANK_LINE}
+ 	$(q)${FIPTOOL} create ${FWU_FIP_ARGS} $@
+ 	$(q)${FIPTOOL} info $@
+@@ -1723,19 +1705,9 @@ ${BUILD_PLAT}/${FWU_FIP_NAME}: ${FWU_FIP
+ 	$(s)echo "Built $@ successfully"
+ 	$(s)echo
  
 -fiptool: ${FIPTOOL}
  fip: ${BUILD_PLAT}/${FIP_NAME}
@@ -67,27 +67,27 @@
  
 -${FIPTOOL}: FORCE
 -ifdef UNIX_MK
--	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" FIPTOOL=${FIPTOOL} OPENSSL_DIR=${OPENSSL_DIR} DEBUG=${DEBUG} V=${V} --no-print-directory -C ${FIPTOOLPATH} all
+-	$(q)${MAKE} PLAT=${PLAT} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" FIPTOOL=${FIPTOOL} OPENSSL_DIR=${OPENSSL_DIR} DEBUG=${DEBUG} --no-print-directory -C ${FIPTOOLPATH} all
 -else
 -# Clear the MAKEFLAGS as we do not want
 -# to pass the gnumake flags to nmake.
--	${Q}set MAKEFLAGS= && ${MSVC_NMAKE} /nologo /f ${FIPTOOLPATH}/Makefile.msvc FIPTOOLPATH=$(subst /,\,$(FIPTOOLPATH)) FIPTOOL=$(subst /,\,$(FIPTOOL))
+-	$(q)set MAKEFLAGS= && ${MSVC_NMAKE} /nologo /f ${FIPTOOLPATH}/Makefile.msvc FIPTOOLPATH=$(subst /,\,$(FIPTOOLPATH)) FIPTOOL=$(subst /,\,$(FIPTOOL))
 -endif #(UNIX_MK)
 -
  romlib.bin: libraries FORCE
- 	${Q}${MAKE} PLAT_DIR=${PLAT_DIR} BUILD_PLAT=${BUILD_PLAT} ENABLE_BTI=${ENABLE_BTI} ARM_ARCH_MINOR=${ARM_ARCH_MINOR} INCLUDES='${INCLUDES}' DEFINES='${DEFINES}' --no-print-directory -C ${ROMLIBPATH} all
+ 	$(q)${MAKE} PLAT_DIR=${PLAT_DIR} BUILD_PLAT=${BUILD_PLAT} ENABLE_BTI=${ENABLE_BTI} ARM_ARCH_MINOR=${ARM_ARCH_MINOR} INCLUDES=$(call escape-shell,$(INCLUDES)) DEFINES=$(call escape-shell,$(DEFINES)) --no-print-directory -C ${ROMLIBPATH} all
  
 --- a/tools/fiptool/Makefile
 +++ b/tools/fiptool/Makefile
-@@ -81,7 +81,7 @@ all: --openssl ${PROJECT}
+@@ -74,7 +74,7 @@ all: --openssl ${PROJECT}
  
  ${PROJECT}: ${OBJECTS} Makefile
- 	@echo "  HOSTLD  $@"
--	${Q}${HOSTCC} ${OBJECTS} -o $@ $(LDOPTS)
-+	${Q}${HOSTCC} ${OBJECTS} -o $@ $(LDOPTS) $(LDFLAGS)
- 	@${ECHO_BLANK_LINE}
- 	@echo "Built $@ successfully"
- 	@${ECHO_BLANK_LINE}
+ 	$(s)echo "  HOSTLD  $@"
+-	$(q)$(host-cc) ${OBJECTS} -o $@ $(LDOPTS)
++	$(q)$(host-cc) ${OBJECTS} -o $@ $(LDOPTS) $(LDFLAGS)
+ 	$(s)echo
+ 	$(s)echo "Built $@ successfully"
+ 	$(s)echo
 --- a/tools/fiptool/plat_fiptool/nxp/plat_fiptool.mk
 +++ b/tools/fiptool/plat_fiptool/nxp/plat_fiptool.mk
 @@ -21,11 +21,11 @@ INCLUDE_PATHS += -I${PLAT_DEF_UUID_OID_C

package/boot/tfa-layerscape/patches/003-plat-nxp-tools-fix-create_pbl-and-byte_swap-host-bui.patch

@@ -16,17 +16,17 @@ Signed-off-by: Biwen Li <biwen.li@nxp.com>
 @@ -19,8 +19,6 @@ ifeq ($(RCW),"")
  else
  	# Generate header for bl2.bin
- 	$(Q)$(CST_DIR)/create_hdr_isbc --in ${BUILD_PLAT}/bl2.bin --out ${BUILD_PLAT}/hdr_bl2 ${BL2_INPUT_FILE}
+ 	$(q)$(CST_DIR)/create_hdr_isbc --in ${BUILD_PLAT}/bl2.bin --out ${BUILD_PLAT}/hdr_bl2 ${BL2_INPUT_FILE}
 -	# Compile create_pbl tool
--	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};\
+-	$(q)${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};\
  	# Add bl2.bin to RCW
  	${CREATE_PBL} -r ${RCW} -i ${BUILD_PLAT}/bl2.bin -b ${BOOT_MODE} -c ${SOC_NUM} -d ${BL2_BASE} -e ${BL2_BASE}\
  			-o ${BUILD_PLAT}/bl2_${BOOT_MODE}.pbl ;\
 @@ -42,7 +40,6 @@ ifeq ($(RCW),"")
- 	${Q}echo "Platform ${PLAT} requires rcw file. Please set RCW to point to the right RCW file for boot mode ${BOOT_MODE}"
+ 	$(s)echo "Platform ${PLAT} requires rcw file. Please set RCW to point to the right RCW file for boot mode ${BOOT_MODE}"
  else
  	# -a option appends the image for Chassis 3 devices in case of non secure boot
--	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};
+-	$(q)${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};
  	${CREATE_PBL} -r ${RCW} -i ${BUILD_PLAT}/bl2.bin -b ${BOOT_MODE} -c ${SOC_NUM} -d ${BL2_BASE} -e ${BL2_BASE} \
  	-o ${BUILD_PLAT}/bl2_${BOOT_MODE}.pbl ;
  # Swapping of RCW is required for QSPi Chassis 2 devices
@@ -34,19 +34,19 @@ Signed-off-by: Biwen Li <biwen.li@nxp.com>
 +++ b/tools/nxp/create_pbl/pbl_ch3.mk
 @@ -26,9 +26,6 @@ else
  	# Generate header for bl2.bin
- 	$(Q)$(CST_DIR)/create_hdr_isbc --in ${BUILD_PLAT}/bl2.bin --out ${BUILD_PLAT}/hdr_bl2 ${BL2_INPUT_FILE}
+ 	$(q)$(CST_DIR)/create_hdr_isbc --in ${BUILD_PLAT}/bl2.bin --out ${BUILD_PLAT}/hdr_bl2 ${BL2_INPUT_FILE}
  
 -	# Compile create_pbl tool
--	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};\
+-	$(q)${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};\
 -
  	# Add Block Copy command for bl2.bin to RCW
  	${CREATE_PBL} -r ${RCW} -i ${BUILD_PLAT}/bl2.bin -b ${BOOT_MODE} -c ${SOC_NUM} -d ${BL2_BASE} -e ${BL2_BASE}\
  			-o ${BUILD_PLAT}/bl2_${BOOT_MODE}.pbl -f ${BL2_SRC_OFFSET};\
 @@ -56,8 +53,6 @@ else  #SECURE_BOOT
  ifeq ($(RCW),"")
- 	${Q}echo "Platform ${PLAT} requires rcw file. Please set RCW to point to the right RCW file for boot mode ${BOOT_MODE}"
+ 	$(s)echo "Platform ${PLAT} requires rcw file. Please set RCW to point to the right RCW file for boot mode ${BOOT_MODE}"
  else
--	${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};
+-	$(q)${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" --no-print-directory -C ${CREATE_PBL_TOOL_PATH};
 -
  	# Add Block Copy command and populate boot loc ptrfor bl2.bin to RCW
  	${CREATE_PBL} -r ${RCW} -i ${BUILD_PLAT}/bl2.bin -b ${BOOT_MODE} -c ${SOC_NUM} -d ${BL2_BASE} -e ${BL2_BASE} \

package/boot/uboot-airoha/Makefile

@@ -0,0 +1,130 @@
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_VERSION:=2026.01
+PKG_HASH:=b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54
+PKG_BUILD_DEPENDS:=arm-trusted-firmware-tools/host
+
+UBOOT_USE_INTREE_DTC:=1
+
+include $(INCLUDE_DIR)/u-boot.mk
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/host-build.mk
+
+define U-Boot/Default
+  BUILD_TARGET:=airoha
+  LZMA_COMPRESS:=1
+endef
+
+define U-Boot/en7523_rfb
+  NAME:=EN7523 Reference Board
+  UBOOT_CONFIG:=en7523_evb
+  BUILD_DEVICES:=airoha_en7523-evb
+  BUILD_SUBTARGET:=en7523
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_IMAGE:=en7523-bl2.bin
+  BL31_IMAGE:=en7523-bl31.bin
+endef
+
+define U-Boot/an7581_rfb
+  NAME:=AN7581 Reference Board
+  UBOOT_CONFIG:=an7581_evb
+  BUILD_DEVICES:=airoha_an7581-evb
+  BUILD_SUBTARGET:=an7581
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_IMAGE:=an7581-bl2.bin
+  BL31_IMAGE:=an7581-bl31.bin
+endef
+
+define U-Boot/an7583_rfb
+  NAME:=AN7583 Reference Board
+  UBOOT_CONFIG:=an7583_evb
+  BUILD_DEVICES:=airoha_an7583-evb
+  BUILD_SUBTARGET:=an7583
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_IMAGE:=an7583-bl2.bin
+  BL31_IMAGE:=an7583-bl31.bin
+endef
+
+define U-Boot/an7581_gemtek_w1700k
+  NAME:=Gemtek W1700K (UBI)
+  UBOOT_CONFIG:=an7581_w1700k
+  BUILD_DEVICES:=gemtek_w1700k-ubi
+  BUILD_SUBTARGET:=an7581
+  UBOOT_IMAGE:=u-boot.bin
+endef
+
+define U-Boot/an7581_nokia_valyrian
+  NAME:=Nokia Valyrian
+  UBOOT_CONFIG:=an7581_nokia_valyrian
+  BUILD_DEVICES:=nokia_valyrian
+  BUILD_SUBTARGET:=an7581
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_IMAGE:=an7581-bl2.bin
+  BL31_IMAGE:=an7581-bl31.bin
+endef
+
+UBOOT_TARGETS := \
+	en7523_rfb \
+	an7581_rfb \
+	an7583_rfb \
+	an7581_gemtek_w1700k \
+	an7581_nokia_valyrian
+
+UBOOT_CUSTOMIZE_CONFIG := \
+	--disable TOOLS_KWBIMAGE \
+	--disable TOOLS_LIBCRYPTO \
+	--disable TOOLS_MKEFICAPSULE \
+	--enable SERIAL_RX_BUFFER \
+	--set-val SERIAL_RX_BUFFER_SIZE 256
+
+define Build/fip-image-bl2
+	$(STAGING_DIR_HOST)/bin/fiptool create \
+		--tb-fw files/$(BL2_IMAGE) \
+		$(PKG_BUILD_DIR)/bl2.fip
+endef
+
+define Build/fip-image
+	$(if $(LZMA_COMPRESS), $(STAGING_DIR_HOST)/bin/lzma e \
+		files/$(BL31_IMAGE) \
+		$(PKG_BUILD_DIR)/bl31.bin.lzma)
+	$(STAGING_DIR_HOST)/bin/fiptool create \
+		--soc-fw $(PKG_BUILD_DIR)/bl31.bin$(if $(LZMA_COMPRESS),.lzma) \
+		--nt-fw $(PKG_BUILD_DIR)/u-boot.bin$(if $(LZMA_COMPRESS),.lzma) \
+		$(PKG_BUILD_DIR)/u-boot.fip
+endef
+
+define Build/Configure
+	$(call Build/Configure/U-Boot)
+	sed -i 's/CONFIG_TOOLS_LIBCRYPTO=y/# CONFIG_TOOLS_LIBCRYPTO is not set/' $(PKG_BUILD_DIR)/.config
+endef
+
+define Build/Compile
+	$(call Build/Compile/U-Boot)
+	$(if $(LZMA_COMPRESS), $(STAGING_DIR_HOST)/bin/lzma e \
+		$(PKG_BUILD_DIR)/u-boot.bin \
+		$(PKG_BUILD_DIR)/u-boot.bin.lzma)
+ifeq ($(UBOOT_IMAGE),u-boot.fip)
+	$(call Build/fip-image-bl2)
+	$(call Build/fip-image)
+endif
+endef
+
+# don't stage files to bindir, let target/linux/airoha/image/*.mk do that
+define Package/u-boot/install
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+ifeq ($(UBOOT_IMAGE),u-boot.fip)
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/bl2.fip $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-bl2.fip
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/u-boot.fip $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-bl31-u-boot.fip
+else
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/u-boot.bin$(if $(LZMA_COMPRESS),.lzma) \
+		$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.bin$(if $(LZMA_COMPRESS),.lzma)
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/u-boot.dtb \
+		$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.dtb
+endif
+endef
+
+$(eval $(call BuildPackage/U-Boot))

package/boot/uboot-airoha/patches/300-airoha-add-support-for-Airoha-AN7583-SoC.patch

@@ -0,0 +1,765 @@
+From 4791e708e2976c3e8bf4e69c92ccd6f1103e8f1f Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 29 Apr 2025 13:06:59 +0200
+Subject: [PATCH 01/24] airoha: add support for Airoha AN7583 SoC
+
+Add support for Airoha AN7583 SoC. This adds the Kconfig and Makefile
+entry for the SoC, DTSI and initial config for it. Also add the code for
+CPU and RAM initialization. Everything is mostly based on AN7581 that
+share lots of common piece.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/dts/an7583-evb.dts          |  67 +++++
+ arch/arm/dts/an7583.dtsi             | 387 +++++++++++++++++++++++++++
+ arch/arm/mach-airoha/Kconfig         |  14 +
+ arch/arm/mach-airoha/Makefile        |   1 +
+ arch/arm/mach-airoha/an7583/Makefile |   3 +
+ arch/arm/mach-airoha/an7583/init.c   |  47 ++++
+ board/airoha/an7583/MAINTAINERS      |   5 +
+ board/airoha/an7583/Makefile         |   3 +
+ board/airoha/an7583/an7583_rfb.c     |  16 ++
+ configs/an7583_evb_defconfig         |  80 ++++++
+ include/configs/an7583.h             |  19 ++
+ 11 files changed, 642 insertions(+)
+ create mode 100644 arch/arm/dts/an7583-evb.dts
+ create mode 100644 arch/arm/dts/an7583.dtsi
+ create mode 100644 arch/arm/mach-airoha/an7583/Makefile
+ create mode 100644 arch/arm/mach-airoha/an7583/init.c
+ create mode 100644 board/airoha/an7583/MAINTAINERS
+ create mode 100644 board/airoha/an7583/Makefile
+ create mode 100644 board/airoha/an7583/an7583_rfb.c
+ create mode 100644 configs/an7583_evb_defconfig
+ create mode 100644 include/configs/an7583.h
+
+diff --git a/arch/arm/dts/an7583-evb.dts b/arch/arm/dts/an7583-evb.dts
+new file mode 100644
+index 00000000000..d02cd194e8a
+--- /dev/null
++++ b/arch/arm/dts/an7583-evb.dts
+@@ -0,0 +1,67 @@
++// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++/dts-v1/;
++
++/* Bootloader installs ATF here */
++/memreserve/ 0x80000000 0x200000;
++
++#include <dt-bindings/leds/common.h>
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/input.h>
++#include "an7583.dtsi"
++
++/ {
++	model = "Airoha AN7583 Evaluation Board";
++	compatible = "airoha,an7583-evb", "airoha,an7583", "airoha,en7583";
++
++	aliases {
++		serial0 = &uart1;
++	};
++
++	chosen {
++		bootargs = "console=ttyS0,115200 earlycon";
++		stdout-path = "serial0:115200n8";
++		linux,usable-memory-range = <0x0 0x80200000 0x0 0x1fe00000>;
++	};
++
++	/* When running as a first-stage bootloader this isn't filled in automatically */
++	memory@80000000 {
++		device_type = "memory";
++		reg = <0x0 0x80000000 0x0 0x20000000>;
++	};
++};
++
++&an7583_pinctrl {
++	pcie0_rst_pins: pcie0-rst-pins {
++		conf {
++			pins = "pcie_reset0";
++			drive-open-drain = <1>;
++		};
++	};
++
++	pcie1_rst_pins: pcie1-rst-pins {
++		conf {
++			pins = "pcie_reset1";
++			drive-open-drain = <1>;
++		};
++	};
++};
++
++&pcie0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pcie0_rst_pins>;
++	status = "okay";
++};
++
++&pcie1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pcie1_rst_pins>;
++	status = "okay";
++};
++
++&i2c0 {
++	status = "okay";
++};
++
++&snfi {
++	status = "okay";
++};
+diff --git a/arch/arm/dts/an7583.dtsi b/arch/arm/dts/an7583.dtsi
+new file mode 100644
+index 00000000000..e1fda15ba37
+--- /dev/null
++++ b/arch/arm/dts/an7583.dtsi
+@@ -0,0 +1,387 @@
++// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/interrupt-controller/arm-gic.h>
++#include <dt-bindings/clock/en7523-clk.h>
++#include <dt-bindings/reset/airoha,an7583-reset.h>
++#include <dt-bindings/leds/common.h>
++#include <dt-bindings/thermal/thermal.h>
++
++/ {
++	interrupt-parent = <&gic>;
++	#address-cells = <2>;
++	#size-cells = <2>;
++
++	reserved-memory {
++		#address-cells = <2>;
++		#size-cells = <2>;
++		ranges;
++
++		atf-reserved-memory@80000000 {
++			no-map;
++			reg = <0x0 0x80000000 0x0 0x40000>;
++		};
++
++		npu-binary@84000000 {
++			no-map;
++			reg = <0x0 0x84000000 0x0 0xa00000>;
++		};
++
++		npu-flag@84b0000 {
++			no-map;
++			reg = <0x0 0x84b00000 0x0 0x100000>;
++		};
++
++		npu-pkt@85000000 {
++			no-map;
++			reg = <0x0 0x85000000 0x0 0x1a00000>;
++		};
++
++		npu-phyaddr@86b00000 {
++			no-map;
++			reg = <0x0 0x86b00000 0x0 0x100000>;
++		};
++
++		npu-rxdesc@86d00000 {
++			no-map;
++			reg = <0x0 0x86d00000 0x0 0x100000>;
++		};
++	};
++
++	psci {
++		compatible = "arm,psci-1.0";
++		method = "smc";
++	};
++
++	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		cpu-map {
++			cluster0 {
++				core0 {
++					cpu = <&cpu0>;
++				};
++
++				core1 {
++					cpu = <&cpu1>;
++				};
++			};
++		};
++
++		cpu0: cpu@0 {
++			device_type = "cpu";
++			compatible = "arm,cortex-a53";
++			reg = <0x0>;
++			enable-method = "psci";
++			next-level-cache = <&l2>;
++			#cooling-cells = <2>;
++		};
++
++		cpu1: cpu@1 {
++			device_type = "cpu";
++			compatible = "arm,cortex-a53";
++			reg = <0x1>;
++			enable-method = "psci";
++			next-level-cache = <&l2>;
++			#cooling-cells = <2>;
++		};
++
++		l2: l2-cache {
++			compatible = "cache";
++			cache-size = <0x80000>;
++			cache-line-size = <64>;
++			cache-level = <2>;
++			cache-unified;
++		};
++	};
++
++	timer {
++		compatible = "arm,armv8-timer";
++		interrupt-parent = <&gic>;
++		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
++			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
++			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
++			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
++	};
++
++	soc {
++		compatible = "simple-bus";
++		#address-cells = <2>;
++		#size-cells = <2>;
++		ranges;
++
++		gic: interrupt-controller@9000000 {
++			compatible = "arm,gic-v3";
++			interrupt-controller;
++			#interrupt-cells = <3>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++			reg = <0x0 0x09000000 0x0 0x20000>,
++			      <0x0 0x09080000 0x0 0x80000>,
++			      <0x0 0x09400000 0x0 0x2000>,
++			      <0x0 0x09500000 0x0 0x2000>,
++			      <0x0 0x09600000 0x0 0x20000>;
++			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>;
++		};
++
++		chip_scu: syscon@1fa20000 {
++			compatible = "airoha,en7581-chip-scu", "syscon";
++			reg = <0x0 0x1fa20000 0x0 0x388>;
++		};
++
++		syscon@1fbe3400 {
++			compatible = "airoha,en7581-pbus-csr", "syscon";
++			reg = <0x0 0x1fbe3400 0x0 0xff>;
++		};
++
++		system-controller@1fb00000 {
++			compatible = "syscon", "simple-mfd";
++			reg = <0x0 0x1fb00000 0x0 0x970>;
++
++			scuclk: scuclk {
++				compatible = "airoha,an7583-scu";
++				#clock-cells = <1>;
++				#reset-cells = <1>;
++			};
++
++			mdio_0: mdio-0 {
++				compatible = "airoha,an7583-mdio";
++				resets = <&scuclk AN7583_MDIO0>;
++
++				airoha,bus-id = <0>;
++			};
++
++			mdio_1: mdio-1 {
++				compatible = "airoha,an7583-mdio";
++				resets = <&scuclk AN7583_MDIO1>;
++
++				airoha,bus-id = <1>;
++			};
++		};
++
++		system-controller@1fbf0200 {
++			compatible = "syscon", "simple-mfd";
++			reg = <0x0 0x1fbf0200 0x0 0xc0>;
++
++			an7583_pinctrl: pinctrl {
++				compatible = "airoha,en7583-pinctrl";
++
++				interrupt-parent = <&gic>;
++				interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
++
++				gpio-controller;
++				#gpio-cells = <2>;
++
++				interrupt-controller;
++				#interrupt-cells = <2>;
++			};
++		};
++
++		i2cclock: i2cclock@0 {
++			#clock-cells = <0>;
++			compatible = "fixed-clock";
++
++			/* 20 MHz */
++			clock-frequency = <20000000>;
++		};
++
++		i2c0: i2c0@1fbf8000 {
++			compatible = "mediatek,mt7621-i2c";
++			reg = <0x0 0x1fbf8000 0x0 0x100>;
++
++			clocks = <&i2cclock>;
++
++			/* 100 kHz */
++			clock-frequency = <100000>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "disable";
++		};
++
++		i2c1: i2c1@1fbf8100 {
++			compatible = "mediatek,mt7621-i2c";
++			reg = <0x0 0x1fbf8100 0x0 0x100>;
++
++			clocks = <&i2cclock>;
++
++			/* 100 kHz */
++			clock-frequency = <100000>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "disable";
++		};
++
++		snfi: spi@1fa10000 {
++			compatible = "airoha,en7581-snand";
++			reg = <0x0 0x1fa10000 0x0 0x140>,
++			      <0x0 0x1fa11000 0x0 0x600>;
++
++			clocks = <&scuclk EN7523_CLK_SPI>;
++			clock-names = "spi";
++
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "disabled";
++
++			spi_nand: nand@0 {
++				compatible = "spi-nand";
++				reg = <0>;
++				spi-max-frequency = <50000000>;
++				spi-tx-bus-width = <1>;
++				spi-rx-bus-width = <2>;
++			};
++		};
++
++		uart1: serial@1fbf0000 {
++			compatible = "ns16550";
++			reg = <0x0 0x1fbf0000 0x0 0x30>;
++			reg-io-width = <4>;
++			reg-shift = <2>;
++			interrupts = <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>;
++			clock-frequency = <1843200>;
++			bootph-all;
++		};
++
++		uart2: serial@1fbf0300 {
++			compatible = "airoha,en7523-uart";
++			reg = <0x0 0x1fbf0300 0x0 0x30>;
++			reg-io-width = <4>;
++			reg-shift = <2>;
++			interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
++			clock-frequency = <7372800>;
++
++			status = "disabled";
++		};
++
++		hsuart3: serial@1fbe1000 {
++			compatible = "airoha,en7523-uart";
++			reg = <0x0 0x1fbe1000 0x0 0x40>;
++			reg-io-width = <4>;
++			reg-shift = <2>;
++			interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>;
++			clock-frequency = <7372800>;
++
++			status = "disabled";
++		};
++
++		uart4: serial@1fbf0600 {
++			compatible = "airoha,en7523-uart";
++			reg = <0x0 0x1fbf0600 0x0 0x30>;
++			reg-io-width = <4>;
++			reg-shift = <2>;
++			interrupts = <GIC_SPI 61 IRQ_TYPE_LEVEL_HIGH>;
++			clock-frequency = <7372800>;
++
++			status = "disabled";
++		};
++
++		uart5: serial@1fbf0700 {
++			compatible = "airoha,en7523-uart";
++			reg = <0x0 0x1fbf0700 0x0 0x30>;
++			reg-io-width = <4>;
++			reg-shift = <2>;
++			interrupts = <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>;
++			clock-frequency = <7372800>;
++
++			status = "disabled";
++		};
++
++		pciephy: phy@1fa5a000 {
++			compatible = "airoha,en7581-pcie-phy";
++			reg = <0x0 0x1fa5a000 0x0 0xfff>,
++			      <0x0 0x1fa5b000 0x0 0xfff>,
++			      <0x0 0x1fa5c000 0x0 0xfff>,
++			      <0x0 0x1fc10044 0x0 0x4>,
++			      <0x0 0x1fc30044 0x0 0x4>,
++			      <0x0 0x1fc15030 0x0 0x104>;
++			reg-names = "csr-2l", "pma0", "pma1",
++				    "p0-xr-dtime", "p1-xr-dtime",
++				    "rx-aeq";
++			#phy-cells = <0>;
++		};
++
++		pcie0: pcie@1fc00000 {
++			compatible = "airoha,an7583-pcie";
++			device_type = "pci";
++			linux,pci-domain = <0>;
++			#address-cells = <3>;
++			#size-cells = <2>;
++
++			reg = <0x0 0x1fc20000 0x0 0x1670>;
++			reg-names = "pcie-mac";
++
++			clocks = <&scuclk EN7523_CLK_PCIE>;
++			clock-names = "sys-ck";
++
++			phys = <&pciephy>;
++			phy-names = "pcie-phy";
++
++			ranges = <0x02000000 0 0x20000000 0x0 0x20000000 0 0x4000000>;
++
++			resets = <&scuclk AN7583_PCIE0_RST>,
++				 <&scuclk AN7583_PCIE1_RST>;
++			reset-names = "phy-lane0", "phy-lane1";
++
++			interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>;
++			bus-range = <0x00 0xff>;
++			#interrupt-cells = <1>;
++			interrupt-map-mask = <0 0 0 7>;
++			interrupt-map = <0 0 0 1 &pcie_intc0 0>,
++					<0 0 0 2 &pcie_intc0 1>,
++					<0 0 0 3 &pcie_intc0 2>,
++					<0 0 0 4 &pcie_intc0 3>;
++
++			status = "disabled";
++
++			pcie_intc0: interrupt-controller {
++				interrupt-controller;
++				#address-cells = <0>;
++				#interrupt-cells = <1>;
++			};
++		};
++
++		pcie1: pcie@1fc20000 {
++			compatible = "airoha,an7583-pcie";
++			device_type = "pci";
++			linux,pci-domain = <1>;
++			#address-cells = <3>;
++			#size-cells = <2>;
++
++			reg = <0x0 0x1fa92000 0x0 0x1670>;
++			reg-names = "pcie-mac";
++
++			clocks = <&scuclk EN7523_CLK_PCIE>;
++			clock-names = "sys-ck";
++
++			phys = <&pciephy>;
++			phy-names = "pcie-phy";
++
++			ranges = <0x02000000 0 0x24000000 0x0 0x24000000 0 0x4000000>;
++
++			resets = <&scuclk AN7583_PCIE0_RST>,
++				 <&scuclk AN7583_PCIE1_RST>;
++			reset-names = "phy-lane0", "phy-lane1";
++
++			interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
++			bus-range = <0x00 0xff>;
++			#interrupt-cells = <1>;
++			interrupt-map-mask = <0 0 0 7>;
++			interrupt-map = <0 0 0 1 &pcie_intc1 0>,
++					<0 0 0 2 &pcie_intc1 1>,
++					<0 0 0 3 &pcie_intc1 2>,
++					<0 0 0 4 &pcie_intc1 3>;
++
++			status = "disabled";
++
++			pcie_intc1: interrupt-controller {
++				interrupt-controller;
++				#address-cells = <0>;
++				#interrupt-cells = <1>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/mach-airoha/Kconfig b/arch/arm/mach-airoha/Kconfig
+index b9cd0a413e1..2d74e3ce902 100644
+--- a/arch/arm/mach-airoha/Kconfig
++++ b/arch/arm/mach-airoha/Kconfig
+@@ -28,19 +28,33 @@ config TARGET_AN7581
+ 	  Peripherals include Gigabit Ethernet, switch, USB3.0 and OTG, PCIe,
+ 	  I2S, PCM, S/PDIF, UART, SPI, I2C, IR TX/RX, and PWM.
+ 
++config TARGET_AN7583
++	bool "Airoha AN7583 SoC"
++	select ARM64
++	help
++	  The Airoha AN7583 is a ARM-based SoC with a quad-core Cortex-A7
++	  including NEON and GPU, Mali-450 graphics, several DDR3 options,
++	  crypto engine, built-in Wi-Fi / Bluetooth combo chip, JPEG decoder,
++	  video interfaces supporting HDMI and MIPI, and video codec support.
++	  Peripherals include Gigabit Ethernet, switch, USB3.0 and OTG, PCIe,
++	  I2S, PCM, S/PDIF, UART, SPI, I2C, IR TX/RX, and PWM.
++
+ endchoice
+ 
+ config SYS_SOC
+ 	default "en7523" if TARGET_EN7523
+ 	default "an7581" if TARGET_AN7581
++	default "an7583" if TARGET_AN7583
+ 
+ config SYS_BOARD
+ 	default "en7523" if TARGET_EN7523
+ 	default "an7581" if TARGET_AN7581
++	default "an7583" if TARGET_AN7583
+ 
+ config SYS_CONFIG_NAME
+ 	default "en7523" if TARGET_EN7523
+ 	default "an7581" if TARGET_AN7581
++	default "an7583" if TARGET_AN7583
+ 
+ endif
+ 
+diff --git a/arch/arm/mach-airoha/Makefile b/arch/arm/mach-airoha/Makefile
+index 91395b8a850..51d82ea3e21 100644
+--- a/arch/arm/mach-airoha/Makefile
++++ b/arch/arm/mach-airoha/Makefile
+@@ -4,3 +4,4 @@ obj-y	+= cpu.o
+ 
+ obj-$(CONFIG_TARGET_EN7523) += en7523/
+ obj-$(CONFIG_TARGET_AN7581) += an7581/
++obj-$(CONFIG_TARGET_AN7583) += an7583/
+diff --git a/arch/arm/mach-airoha/an7583/Makefile b/arch/arm/mach-airoha/an7583/Makefile
+new file mode 100644
+index 00000000000..886ab7e4eb9
+--- /dev/null
++++ b/arch/arm/mach-airoha/an7583/Makefile
+@@ -0,0 +1,3 @@
++# SPDX-License-Identifier:	GPL-2.0
++
++obj-y += init.o
+diff --git a/arch/arm/mach-airoha/an7583/init.c b/arch/arm/mach-airoha/an7583/init.c
+new file mode 100644
+index 00000000000..77c29290331
+--- /dev/null
++++ b/arch/arm/mach-airoha/an7583/init.c
+@@ -0,0 +1,47 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <fdtdec.h>
++#include <init.h>
++#include <asm/armv8/mmu.h>
++#include <asm/system.h>
++
++int print_cpuinfo(void)
++{
++	printf("CPU:   Airoha AN7583\n");
++	return 0;
++}
++
++int dram_init(void)
++{
++	return fdtdec_setup_mem_size_base();
++}
++
++int dram_init_banksize(void)
++{
++	return fdtdec_setup_memory_banksize();
++}
++
++void reset_cpu(ulong addr)
++{
++	psci_system_reset();
++}
++
++static struct mm_region an7583_mem_map[] = {
++	{
++		/* DDR */
++		.virt = 0x80000000UL,
++		.phys = 0x80000000UL,
++		.size = 0x80000000UL,
++		.attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) | PTE_BLOCK_OUTER_SHARE,
++	}, {
++		.virt = 0x00000000UL,
++		.phys = 0x00000000UL,
++		.size = 0x20000000UL,
++		.attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
++			 PTE_BLOCK_NON_SHARE |
++			 PTE_BLOCK_PXN | PTE_BLOCK_UXN
++	}, {
++		0,
++	}
++};
++struct mm_region *mem_map = an7583_mem_map;
+diff --git a/board/airoha/an7583/MAINTAINERS b/board/airoha/an7583/MAINTAINERS
+new file mode 100644
+index 00000000000..71ee542a8bc
+--- /dev/null
++++ b/board/airoha/an7583/MAINTAINERS
+@@ -0,0 +1,5 @@
++AN7581
++M:	Christian Marangi <ansuelsmth@gmail.com>
++S:	Maintained
++N:      airoha
++N:      an7583
+diff --git a/board/airoha/an7583/Makefile b/board/airoha/an7583/Makefile
+new file mode 100644
+index 00000000000..d582684d1f7
+--- /dev/null
++++ b/board/airoha/an7583/Makefile
+@@ -0,0 +1,3 @@
++# SPDX-License-Identifier:	GPL-2.0
++
++obj-y	+= an7583_rfb.o
+diff --git a/board/airoha/an7583/an7583_rfb.c b/board/airoha/an7583/an7583_rfb.c
+new file mode 100644
+index 00000000000..aa73679d929
+--- /dev/null
++++ b/board/airoha/an7583/an7583_rfb.c
+@@ -0,0 +1,16 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Author: Christian Marangi <ansuelsmth@gmail.com>
++ */
++
++#include <asm/global_data.h>
++
++DECLARE_GLOBAL_DATA_PTR;
++
++int board_init(void)
++{
++	/* address of boot parameters */
++	gd->bd->bi_boot_params = CFG_SYS_SDRAM_BASE + 0x100;
++
++	return 0;
++}
+diff --git a/configs/an7583_evb_defconfig b/configs/an7583_evb_defconfig
+new file mode 100644
+index 00000000000..d1893fff398
+--- /dev/null
++++ b/configs/an7583_evb_defconfig
+@@ -0,0 +1,80 @@
++CONFIG_ARM=y
++CONFIG_ARCH_AIROHA=y
++CONFIG_TARGET_AN7583=y
++CONFIG_TEXT_BASE=0x81E00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_ENV_SIZE=0x4000
++CONFIG_ENV_OFFSET=0x7c000
++CONFIG_DM_GPIO=y
++CONFIG_DEFAULT_DEVICE_TREE="an7583-evb"
++CONFIG_SYS_LOAD_ADDR=0x81800000
++CONFIG_BUILD_TARGET="u-boot.bin"
++# CONFIG_EFI_LOADER is not set
++CONFIG_FIT=y
++CONFIG_FIT_VERBOSE=y
++CONFIG_BOOTDELAY=3
++CONFIG_DEFAULT_FDT_FILE="an7583-evb"
++CONFIG_SYS_PBSIZE=1049
++CONFIG_SYS_CONSOLE_IS_IN_ENV=y
++# CONFIG_DISPLAY_BOARDINFO is not set
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="U-Boot> "
++CONFIG_SYS_MAXARGS=8
++CONFIG_CMD_BOOTZ=y
++CONFIG_CMD_BOOTMENU=y
++# CONFIG_CMD_ELF is not set
++# CONFIG_CMD_XIMG is not set
++CONFIG_CMD_BIND=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_MMC=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_SF_TEST=y
++CONFIG_CMD_SPI=y
++# CONFIG_CMD_SETEXPR is not set
++CONFIG_CMD_PING=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_MTDPARTS=y
++CONFIG_CMD_LOG=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_MMC=y
++CONFIG_ENV_RELOC_GD_ENV_ADDR=y
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_SYS_RX_ETH_BUFFER=8
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_DMA=y
++CONFIG_LED=y
++CONFIG_LED_GPIO=y
++CONFIG_MMC_HS200_SUPPORT=y
++CONFIG_MMC_MTK=y
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_DM_SPI_FLASH=y
++CONFIG_SPI_FLASH_EON=y
++CONFIG_SPI_FLASH_GIGADEVICE=y
++CONFIG_SPI_FLASH_ISSI=y
++CONFIG_SPI_FLASH_MACRONIX=y
++CONFIG_SPI_FLASH_SPANSION=y
++CONFIG_SPI_FLASH_STMICRO=y
++CONFIG_SPI_FLASH_WINBOND=y
++CONFIG_SPI_FLASH_MTD=y
++CONFIG_AIROHA_ETH=y
++CONFIG_PHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_SYS_NS16550=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_AIROHA_SNFI_SPI=y
++CONFIG_SHA512=y
+diff --git a/include/configs/an7583.h b/include/configs/an7583.h
+new file mode 100644
+index 00000000000..c865afea1a2
+--- /dev/null
++++ b/include/configs/an7583.h
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Configuration for Airoha AN7583
++ */
++
++#ifndef __AN7583_H
++#define __AN7583_H
++
++#include <linux/sizes.h>
++
++#define CFG_SYS_UBOOT_BASE		CONFIG_TEXT_BASE
++
++#define CFG_SYS_INIT_RAM_ADDR           CONFIG_TEXT_BASE
++#define CFG_SYS_INIT_RAM_SIZE           SZ_2M
++
++/* DRAM */
++#define CFG_SYS_SDRAM_BASE		0x80000000
++
++#endif
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/301-arm-an7583-sync-init-code-with-an7581.patch

@@ -0,0 +1,83 @@
+From 2ed022130bb42e3c419a4943115144259fa3b4b6 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Fri, 17 Oct 2025 02:53:28 +0300
+Subject: [PATCH 02/24] arm/an7583: sync init code with an7581
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ arch/arm/mach-airoha/an7583/init.c | 31 ++++++++++++++++++++++++------
+ 1 file changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/mach-airoha/an7583/init.c b/arch/arm/mach-airoha/an7583/init.c
+index 77c29290331..4cf7f8caf85 100644
+--- a/arch/arm/mach-airoha/an7583/init.c
++++ b/arch/arm/mach-airoha/an7583/init.c
+@@ -2,9 +2,14 @@
+ 
+ #include <fdtdec.h>
+ #include <init.h>
++#include <linux/sizes.h>
++#include <sysreset.h>
+ #include <asm/armv8/mmu.h>
++#include <asm/global_data.h>
+ #include <asm/system.h>
+ 
++DECLARE_GLOBAL_DATA_PTR;
++
+ int print_cpuinfo(void)
+ {
+ 	printf("CPU:   Airoha AN7583\n");
+@@ -18,30 +23,44 @@ int dram_init(void)
+ 
+ int dram_init_banksize(void)
+ {
+-	return fdtdec_setup_memory_banksize();
++	gd->bd->bi_dram[0].start = gd->ram_base;
++	gd->bd->bi_dram[0].size = get_effective_memsize();
++
++	if (gd->ram_size > SZ_2G) {
++		gd->bd->bi_dram[1].start = gd->ram_base + SZ_2G;
++		gd->bd->bi_dram[1].size = gd->ram_size - SZ_2G;
++	}
++
++	return 0;
+ }
+ 
+-void reset_cpu(ulong addr)
++void reset_cpu(void)
+ {
+ 	psci_system_reset();
+ }
+ 
+ static struct mm_region an7583_mem_map[] = {
+ 	{
+-		/* DDR */
++		/* DDR, 32-bit area */
+ 		.virt = 0x80000000UL,
+ 		.phys = 0x80000000UL,
+-		.size = 0x80000000UL,
++		.size = SZ_2G,
++		.attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) | PTE_BLOCK_OUTER_SHARE,
++	}, {
++		/* DDR, 64-bit area */
++		.virt = 0x100000000UL,
++		.phys = 0x100000000UL,
++		.size = SZ_4G + SZ_2G,
+ 		.attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) | PTE_BLOCK_OUTER_SHARE,
+ 	}, {
+ 		.virt = 0x00000000UL,
+ 		.phys = 0x00000000UL,
+-		.size = 0x20000000UL,
++		.size = 0x40000000UL,
+ 		.attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
+ 			 PTE_BLOCK_NON_SHARE |
+ 			 PTE_BLOCK_PXN | PTE_BLOCK_UXN
+ 	}, {
+-		0,
++		/* List terminator */
+ 	}
+ };
+ struct mm_region *mem_map = an7583_mem_map;
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/303-arm-airoha-introduce-AN7583-helpers-to-get-SCU-and-C.patch

@@ -0,0 +1,83 @@
+From 59e3fa0d74fd36ba61a2b4e63eb6faf31b4e2396 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Fri, 31 Oct 2025 00:42:08 +0300
+Subject: [PATCH 03/24] arm: airoha: introduce AN7583 helpers to get SCU and
+ CHIP_SCU regmaps
+
+We need access SCU and CHIP_SCU regmaps in several places (clk-airoha,
+reset-airoha, airoha_eth). Unfortunately these regmaps can't be easily
+retrieved with a common code, because of different Airoha SoCs uses
+a different dts structure.
+
+To make life easy we can write a commonly named SoC specific helpers
+for these tasks. This patch implements helpers for Airoha AN7583 SoC.
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ arch/arm/include/asm/arch-an7583         |  1 +
+ arch/arm/mach-airoha/an7583/Makefile     |  1 +
+ arch/arm/mach-airoha/an7583/scu-regmap.c | 34 ++++++++++++++++++++++++
+ 3 files changed, 36 insertions(+)
+ create mode 120000 arch/arm/include/asm/arch-an7583
+ create mode 100644 arch/arm/mach-airoha/an7583/scu-regmap.c
+
+diff --git a/arch/arm/include/asm/arch-an7583 b/arch/arm/include/asm/arch-an7583
+new file mode 120000
+index 00000000000..d2317ed3bc3
+--- /dev/null
++++ b/arch/arm/include/asm/arch-an7583
+@@ -0,0 +1 @@
++arch-airoha
+\ No newline at end of file
+diff --git a/arch/arm/mach-airoha/an7583/Makefile b/arch/arm/mach-airoha/an7583/Makefile
+index 886ab7e4eb9..51f978aa101 100644
+--- a/arch/arm/mach-airoha/an7583/Makefile
++++ b/arch/arm/mach-airoha/an7583/Makefile
+@@ -1,3 +1,4 @@
+ # SPDX-License-Identifier:	GPL-2.0
+ 
+ obj-y += init.o
++obj-y += scu-regmap.o
+diff --git a/arch/arm/mach-airoha/an7583/scu-regmap.c b/arch/arm/mach-airoha/an7583/scu-regmap.c
+new file mode 100644
+index 00000000000..96f3564eec0
+--- /dev/null
++++ b/arch/arm/mach-airoha/an7583/scu-regmap.c
+@@ -0,0 +1,34 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Author: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
++ */
++
++#include <syscon.h>
++#include <linux/err.h>
++#include <asm/arch/scu-regmap.h>
++
++struct regmap *airoha_get_scu_regmap(void)
++{
++	ofnode node;
++
++	node = ofnode_by_compatible(ofnode_null(), "airoha,an7583-scu");
++	if (!ofnode_valid(node))
++		return ERR_PTR(-EINVAL);
++
++	node = ofnode_get_parent(node);
++	if (!ofnode_valid(node))
++		return ERR_PTR(-EINVAL);
++
++	return syscon_node_to_regmap(node);
++}
++
++struct regmap *airoha_get_chip_scu_regmap(void)
++{
++	ofnode node;
++
++	node = ofnode_by_compatible(ofnode_null(), "airoha,en7581-chip-scu");
++	if (!ofnode_valid(node))
++		return ERR_PTR(-EINVAL);
++
++	return syscon_node_to_regmap(node);
++}
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/304-dt-bindings-clock-airoha-Document-support-for-AN7583.patch

@@ -0,0 +1,32 @@
+From 0faf0f239a145129063a1a2c798fc97c362cc98d Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 30 Sep 2025 22:15:15 +0200
+Subject: [PATCH 04/24] dt-bindings: clock: airoha: Document support for AN7583
+ clock
+
+Document support for Airoha AN7583 clock. This is based on the EN7523
+clock schema with the new requirement of the "airoha,chip-scu"
+(previously optional for EN7581).
+
+Add additional binding for additional clock and reset lines.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ dts/upstream/include/dt-bindings/clock/en7523-clk.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/dts/upstream/include/dt-bindings/clock/en7523-clk.h b/dts/upstream/include/dt-bindings/clock/en7523-clk.h
+index edfa64045f5..0fbbcb7b1b2 100644
+--- a/dts/upstream/include/dt-bindings/clock/en7523-clk.h
++++ b/dts/upstream/include/dt-bindings/clock/en7523-clk.h
+@@ -14,4 +14,7 @@
+ 
+ #define EN7581_CLK_EMMC		8
+ 
++#define AN7583_CLK_MDIO0	9
++#define AN7583_CLK_MDIO1	10
++
+ #endif /* _DT_BINDINGS_CLOCK_AIROHA_EN7523_H_ */
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/305-clk-airoha-add-support-for-Airoha-AN7583-SoC-clock.patch

@@ -0,0 +1,213 @@
+From c2bc25eaebdaf865c52418ff89ece3eb6aded616 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 29 Apr 2025 13:19:11 +0200
+Subject: [PATCH 05/24] clk: airoha: add support for Airoha AN7583 SoC clock
+
+Add support for Airoha AN7583 SoC clock that implement more base values
+for clocks compared to AN7581.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/clk/airoha/clk-airoha.c | 158 ++++++++++++++++++++++++++++++++
+ 1 file changed, 158 insertions(+)
+
+diff --git a/drivers/clk/airoha/clk-airoha.c b/drivers/clk/airoha/clk-airoha.c
+index 49dbca82135..68dca6ab202 100644
+--- a/drivers/clk/airoha/clk-airoha.c
++++ b/drivers/clk/airoha/clk-airoha.c
+@@ -36,6 +36,7 @@
+ 
+ #define EN7523_MAX_CLKS			8
+ #define EN7581_MAX_CLKS			9
++#define EN7583_MAX_CLKS			11
+ 
+ struct airoha_clk_desc {
+ 	int id;
+@@ -78,6 +79,14 @@ static const u32 bus7581_base[] = { 600000000, 540000000 };
+ static const u32 npu7581_base[] = { 800000000, 750000000, 720000000, 600000000 };
+ static const u32 crypto_base[] = { 540000000, 480000000 };
+ static const u32 emmc7581_base[] = { 200000000, 150000000 };
++/* AN7583 */
++static const u32 gsw7583_base[] = { 540672000, 270336000, 400000000, 200000000 };
++static const u32 emi7583_base[] = { 540672000, 480000000, 400000000, 300000000 };
++static const u32 bus7583_base[] = { 600000000, 540672000, 480000000, 400000000 };
++static const u32 spi7583_base[] = { 400000000, 12500000 };
++static const u32 npu7583_base[] = { 666000000, 800000000, 720000000, 600000000 };
++static const u32 crypto7583_base[] = { 540672000, 400000000 };
++static const u32 emmc7583_base[] = { 150000000, 200000000 };
+ 
+ static const struct airoha_clk_desc en7523_base_clks[EN7523_MAX_CLKS] = {
+ 	[EN7523_CLK_GSW] = {
+@@ -293,6 +302,147 @@ static const struct airoha_clk_desc en7581_base_clks[EN7581_MAX_CLKS] = {
+ 	}
+ };
+ 
++static const struct airoha_clk_desc an7583_base_clks[EN7583_MAX_CLKS] = {
++	[EN7523_CLK_GSW] = {
++		.id = EN7523_CLK_GSW,
++		.name = "gsw",
++
++		.base_reg = REG_GSW_CLK_DIV_SEL,
++		.base_bits = 2,
++		.base_shift = 8,
++		.base_values = gsw7583_base,
++		.n_base_values = ARRAY_SIZE(gsw7583_base),
++
++		.div_bits = 3,
++		.div_shift = 0,
++		.div_step = 1,
++		.div_offset = 1,
++	},
++	[EN7523_CLK_EMI] = {
++		.id = EN7523_CLK_EMI,
++		.name = "emi",
++
++		.base_reg = REG_EMI_CLK_DIV_SEL,
++		.base_bits = 2,
++		.base_shift = 8,
++		.base_values = emi7583_base,
++		.n_base_values = ARRAY_SIZE(emi7583_base),
++
++		.div_bits = 3,
++		.div_shift = 0,
++		.div_step = 1,
++		.div_offset = 1,
++	},
++	[EN7523_CLK_BUS] = {
++		.id = EN7523_CLK_BUS,
++		.name = "bus",
++
++		.base_reg = REG_BUS_CLK_DIV_SEL,
++		.base_bits = 2,
++		.base_shift = 8,
++		.base_values = bus7583_base,
++		.n_base_values = ARRAY_SIZE(bus7583_base),
++
++		.div_bits = 3,
++		.div_shift = 0,
++		.div_step = 1,
++		.div_offset = 1,
++	},
++	[EN7523_CLK_SLIC] = {
++		.id = EN7523_CLK_SLIC,
++		.name = "slic",
++
++		.base_reg = REG_SPI_CLK_FREQ_SEL,
++		.base_bits = 1,
++		.base_shift = 1,
++		.base_values = slic_base,
++		.n_base_values = ARRAY_SIZE(slic_base),
++
++		.div_reg = REG_SPI_CLK_DIV_SEL,
++		.div_bits = 5,
++		.div_shift = 24,
++		.div_val0 = 20,
++		.div_step = 2,
++	},
++	[EN7523_CLK_SPI] = {
++		.id = EN7523_CLK_SPI,
++		.name = "spi",
++
++		.base_reg = REG_SPI_CLK_FREQ_SEL,
++		.base_bits = 1,
++		.base_shift = 0,
++		.base_values = spi7583_base,
++		.n_base_values = ARRAY_SIZE(spi7583_base),
++
++		.div_reg = REG_SPI_CLK_DIV_SEL,
++		.div_bits = 5,
++		.div_shift = 8,
++		.div_val0 = 40,
++		.div_step = 2,
++	},
++	[EN7523_CLK_NPU] = {
++		.id = EN7523_CLK_NPU,
++		.name = "npu",
++
++		.base_reg = REG_NPU_CLK_DIV_SEL,
++		.base_bits = 2,
++		.base_shift = 9,
++		.base_values = npu7583_base,
++		.n_base_values = ARRAY_SIZE(npu7583_base),
++
++		.div_bits = 3,
++		.div_shift = 0,
++		.div_step = 1,
++		.div_offset = 1,
++	},
++	[EN7523_CLK_CRYPTO] = {
++		.id = EN7523_CLK_CRYPTO,
++		.name = "crypto",
++
++		.base_reg = REG_CRYPTO_CLKSRC2,
++		.base_bits = 1,
++		.base_shift = 0,
++		.base_values = crypto7583_base,
++		.n_base_values = ARRAY_SIZE(crypto7583_base),
++	},
++	[EN7581_CLK_EMMC] = {
++		.id = EN7581_CLK_EMMC,
++		.name = "emmc",
++
++		.base_reg = REG_CRYPTO_CLKSRC2,
++		.base_bits = 1,
++		.base_shift = 13,
++		.base_values = emmc7583_base,
++		.n_base_values = ARRAY_SIZE(emmc7583_base),
++	},
++	[AN7583_CLK_MDIO0] = {
++		.id = AN7583_CLK_MDIO0,
++		.name = "mdio0",
++
++		.base_reg = REG_CRYPTO_CLKSRC2,
++
++		.base_value = 25000000,
++
++		.div_bits = 4,
++		.div_shift = 15,
++		.div_step = 1,
++		.div_offset = 1,
++	},
++	[AN7583_CLK_MDIO1] = {
++		.id = AN7583_CLK_MDIO1,
++		.name = "mdio1",
++
++		.base_reg = REG_CRYPTO_CLKSRC2,
++
++		.base_value = 25000000,
++
++		.div_bits = 4,
++		.div_shift = 19,
++		.div_step = 1,
++		.div_offset = 1,
++	}
++};
++
+ static u32 airoha_clk_get_base_rate(const struct airoha_clk_desc *desc, u32 val)
+ {
+ 	if (!desc->base_bits)
+@@ -542,6 +692,11 @@ static const struct airoha_clk_soc_data en7581_data = {
+ 	.descs = en7581_base_clks,
+ };
+ 
++static const struct airoha_clk_soc_data an7583_data = {
++	.num_clocks = ARRAY_SIZE(an7583_base_clks),
++	.descs = an7583_base_clks,
++};
++
+ static const struct udevice_id airoha_clk_ids[] = {
+ 	{ .compatible = "airoha,en7523-scu",
+ 	  .data = (ulong)&en7523_data,
+@@ -549,6 +704,9 @@ static const struct udevice_id airoha_clk_ids[] = {
+ 	{ .compatible = "airoha,en7581-scu",
+ 	  .data = (ulong)&en7581_data,
+ 	},
++	{ .compatible = "airoha,an7583-scu",
++	  .data = (ulong)&an7583_data,
++	},
+ 	{ }
+ };
+ 
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/306-reset-airoha-Add-support-for-Airoha-AN7583-reset.patch

@@ -0,0 +1,173 @@
+From 6b54d65d6b247d06d94c28c6df92ed5b45d7468a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 29 Apr 2025 13:33:35 +0200
+Subject: [PATCH 06/24] reset: airoha: Add support for Airoha AN7583 reset
+
+Adapt the Airoha reset driver to support Airoha AN7583 node structure.
+In AN7583 the register is exposed by the parent syscon hence a different
+logic needs to be applied. Also the reset line differ from AN7581 hence
+a dedicated table is needed.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/reset/reset-airoha.c                  | 60 ++++++++++++++++++
+ .../dt-bindings/reset/airoha,an7583-reset.h   | 62 +++++++++++++++++++
+ 2 files changed, 122 insertions(+)
+ create mode 100644 include/dt-bindings/reset/airoha,an7583-reset.h
+
+diff --git a/drivers/reset/reset-airoha.c b/drivers/reset/reset-airoha.c
+index ef8c47a067b..071f29b6f22 100644
+--- a/drivers/reset/reset-airoha.c
++++ b/drivers/reset/reset-airoha.c
+@@ -15,6 +15,7 @@
+ 
+ #include <dt-bindings/reset/airoha,en7523-reset.h>
+ #include <dt-bindings/reset/airoha,en7581-reset.h>
++#include <dt-bindings/reset/airoha,an7583-reset.h>
+ 
+ #define RST_NR_PER_BANK			32
+ 
+@@ -138,6 +139,60 @@ static const u16 en7581_rst_map[] = {
+ 	[EN7581_XPON_MAC_RST]		= RST_NR_PER_BANK + 31,
+ };
+ 
++static const u16 an7583_rst_map[] = {
++	/* RST_CTRL2 */
++	[AN7583_XPON_PHY_RST]		= 0,
++	[AN7583_GPON_OLT_RST]		= 1,
++	[AN7583_CPU_TIMER2_RST]		= 2,
++	[AN7583_HSUART_RST]		= 3,
++	[AN7583_UART4_RST]		= 4,
++	[AN7583_UART5_RST]		= 5,
++	[AN7583_I2C2_RST]		= 6,
++	[AN7583_XSI_MAC_RST]		= 7,
++	[AN7583_XSI_PHY_RST]		= 8,
++	[AN7583_NPU_RST]		= 9,
++	[AN7583_TRNG_MSTART_RST]	= 12,
++	[AN7583_DUAL_HSI0_RST]		= 13,
++	[AN7583_DUAL_HSI1_RST]		= 14,
++	[AN7583_DUAL_HSI0_MAC_RST]	= 16,
++	[AN7583_DUAL_HSI1_MAC_RST]	= 17,
++	[AN7583_XPON_XFI_RST]		= 18,
++	[AN7583_WDMA_RST]		= 19,
++	[AN7583_WOE0_RST]		= 20,
++	[AN7583_HSDMA_RST]		= 22,
++	[AN7583_TDMA_RST]		= 24,
++	[AN7583_EMMC_RST]		= 25,
++	[AN7583_SOE_RST]		= 26,
++	[AN7583_XFP_MAC_RST]		= 28,
++	[AN7583_MDIO0]			= 30,
++	[AN7583_MDIO1]			= 31,
++	/* RST_CTRL1 */
++	[AN7583_PCM1_ZSI_ISI_RST]	= RST_NR_PER_BANK + 0,
++	[AN7583_FE_PDMA_RST]		= RST_NR_PER_BANK + 1,
++	[AN7583_FE_QDMA_RST]		= RST_NR_PER_BANK + 2,
++	[AN7583_PCM_SPIWP_RST]		= RST_NR_PER_BANK + 4,
++	[AN7583_CRYPTO_RST]		= RST_NR_PER_BANK + 6,
++	[AN7583_TIMER_RST]		= RST_NR_PER_BANK + 8,
++	[AN7583_PCM1_RST]		= RST_NR_PER_BANK + 11,
++	[AN7583_UART_RST]		= RST_NR_PER_BANK + 12,
++	[AN7583_GPIO_RST]		= RST_NR_PER_BANK + 13,
++	[AN7583_GDMA_RST]		= RST_NR_PER_BANK + 14,
++	[AN7583_I2C_MASTER_RST]		= RST_NR_PER_BANK + 16,
++	[AN7583_PCM2_ZSI_ISI_RST]	= RST_NR_PER_BANK + 17,
++	[AN7583_SFC_RST]		= RST_NR_PER_BANK + 18,
++	[AN7583_UART2_RST]		= RST_NR_PER_BANK + 19,
++	[AN7583_GDMP_RST]		= RST_NR_PER_BANK + 20,
++	[AN7583_FE_RST]			= RST_NR_PER_BANK + 21,
++	[AN7583_USB_HOST_P0_RST]	= RST_NR_PER_BANK + 22,
++	[AN7583_GSW_RST]		= RST_NR_PER_BANK + 23,
++	[AN7583_SFC2_PCM_RST]		= RST_NR_PER_BANK + 25,
++	[AN7583_PCIE0_RST]		= RST_NR_PER_BANK + 26,
++	[AN7583_PCIE1_RST]		= RST_NR_PER_BANK + 27,
++	[AN7583_CPU_TIMER_RST]		= RST_NR_PER_BANK + 28,
++	[AN7583_PCIE_HB_RST]		= RST_NR_PER_BANK + 29,
++	[AN7583_XPON_MAC_RST]		= RST_NR_PER_BANK + 31,
++};
++
+ static int airoha_reset_update(struct airoha_reset_priv *priv,
+ 			       unsigned long id, bool assert)
+ {
+@@ -227,6 +282,11 @@ static int airoha_reset_probe(struct udevice *dev)
+ 		return reset_init(dev, en7581_rst_map,
+ 				  ARRAY_SIZE(en7581_rst_map));
+ 
++	if (ofnode_device_is_compatible(dev_ofnode(dev),
++					"airoha,an7583-scu"))
++		return reset_init(dev, an7583_rst_map,
++				 ARRAY_SIZE(an7583_rst_map));
++
+ 	return -ENODEV;
+ }
+ 
+diff --git a/include/dt-bindings/reset/airoha,an7583-reset.h b/include/dt-bindings/reset/airoha,an7583-reset.h
+new file mode 100644
+index 00000000000..be80d0e0bf5
+--- /dev/null
++++ b/include/dt-bindings/reset/airoha,an7583-reset.h
+@@ -0,0 +1,62 @@
++/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
++/*
++ * Copyright (c) 2024 AIROHA Inc
++ * Author: Christian Marangi <ansuelsmth@gmail.com>
++ */
++
++#ifndef __DT_BINDINGS_RESET_CONTROLLER_AIROHA_AN7583_H_
++#define __DT_BINDINGS_RESET_CONTROLLER_AIROHA_AN7583_H_
++
++/* RST_CTRL2 */
++#define AN7583_XPON_PHY_RST		 0
++#define AN7583_GPON_OLT_RST		 1
++#define AN7583_CPU_TIMER2_RST		 2
++#define AN7583_HSUART_RST		 3
++#define AN7583_UART4_RST		 4
++#define AN7583_UART5_RST		 5
++#define AN7583_I2C2_RST			 6
++#define AN7583_XSI_MAC_RST		 7
++#define AN7583_XSI_PHY_RST		 8
++#define AN7583_NPU_RST			 9
++#define AN7583_TRNG_MSTART_RST		10
++#define AN7583_DUAL_HSI0_RST		11
++#define AN7583_DUAL_HSI1_RST		12
++#define AN7583_DUAL_HSI0_MAC_RST	13
++#define AN7583_DUAL_HSI1_MAC_RST	14
++#define AN7583_XPON_XFI_RST     	15
++#define AN7583_WDMA_RST			16
++#define AN7583_WOE0_RST			17
++#define AN7583_HSDMA_RST		18
++#define AN7583_TDMA_RST			19
++#define AN7583_EMMC_RST			20
++#define AN7583_SOE_RST			21
++#define AN7583_XFP_MAC_RST		22
++#define AN7583_MDIO0                    23
++#define AN7583_MDIO1                    24
++/* RST_CTRL1 */
++#define AN7583_PCM1_ZSI_ISI_RST		25
++#define AN7583_FE_PDMA_RST		26
++#define AN7583_FE_QDMA_RST		27
++#define AN7583_PCM_SPIWP_RST		28
++#define AN7583_CRYPTO_RST		29
++#define AN7583_TIMER_RST		30
++#define AN7583_PCM1_RST			31
++#define AN7583_UART_RST			32
++#define AN7583_GPIO_RST			33
++#define AN7583_GDMA_RST			34
++#define AN7583_I2C_MASTER_RST		35
++#define AN7583_PCM2_ZSI_ISI_RST		36
++#define AN7583_SFC_RST			37
++#define AN7583_UART2_RST		38
++#define AN7583_GDMP_RST			39
++#define AN7583_FE_RST			40
++#define AN7583_USB_HOST_P0_RST		41
++#define AN7583_GSW_RST			42
++#define AN7583_SFC2_PCM_RST		43
++#define AN7583_PCIE0_RST		44
++#define AN7583_PCIE1_RST		45
++#define AN7583_CPU_TIMER_RST		46
++#define AN7583_PCIE_HB_RST		47
++#define AN7583_XPON_MAC_RST		48
++
++#endif /* __DT_BINDINGS_RESET_CONTROLLER_AIROHA_AN7583_H_ */
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/307-net-airoha-add-support-for-Airoha-AN7583.patch

@@ -0,0 +1,177 @@
+From fca7240fd0ea0b30d8b6eda68eec67d84d48f15d Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 19 May 2025 14:29:53 +0200
+Subject: [PATCH 07/24] net: airoha: add support for Airoha AN7583
+
+Add support for Ethernet controller present in Airoha AN7583. This
+follow the same implementation of Airoha AN7581 with the only difference
+of having a different reset number and a different logic to reach the
+SCU node.
+
+Generalize the driver for these 2 part to account for these minor
+difference.
+
+The switch init part also required some care as the Switch Internal PHY
+enable BMCR_PDOWN by default and tweak to GEPHY_CONN_CFG is also needed.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/net/airoha_eth.c | 91 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 91 insertions(+)
+
+diff --git a/drivers/net/airoha_eth.c b/drivers/net/airoha_eth.c
+index 3234d875887..75af93f182d 100644
+--- a/drivers/net/airoha_eth.c
++++ b/drivers/net/airoha_eth.c
+@@ -20,6 +20,7 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/io.h>
+ #include <linux/iopoll.h>
++#include <linux/mii.h>
+ #include <linux/time.h>
+ #include <asm/arch/scu-regmap.h>
+ 
+@@ -28,6 +29,11 @@
+ #define AIROHA_MAX_NUM_RSTS		3
+ #define AIROHA_MAX_NUM_XSI_RSTS		4
+ 
++#define AIROHA_MAX_NUM_SWITCH_PORT	4
++#define AIROHA_MAX_PBUS_TRY		10
++#define AIROHA_PBUS_SLEEP		100
++#define AIROHA_PBUS_C22_MASK		0x800000
++
+ #define AIROHA_MAX_PACKET_SIZE		2048
+ #define AIROHA_NUM_TX_RING		1
+ #define AIROHA_NUM_RX_RING		1
+@@ -78,6 +84,19 @@
+ #define   SWITCH_PHY_PRE_EN		BIT(15)
+ #define   SWITCH_PHY_END_ADDR		GENMASK(12, 8)
+ #define   SWITCH_PHY_ST_ADDR		GENMASK(4, 0)
++#define SWITCH_GEPHY_CONN_CFG		0x7c14
++#define   SWITCH_DPHY_CKIN_SEL		BIT(31)
++#define   SWITCH_PHY_CORE_REG_CLK_SEL	BIT(30)
++#define   SWITCH_ETHER_AFE_PWD		GENMASK(28, 24)
++#define SWITCH_PBUS_PHY_IAC		0x7c20
++#define   SWITCH_PBUS_PHY_START		BIT(31)
++#define   SWITCH_PBUS_PHY_CMD		BIT(30)
++#define   SWITCH_PBUS_PHY_CMD_READ	FIELD_PREP(SWITCH_PBUS_PHY_CMD, 0x0)
++#define   SWITCH_PBUS_PHY_CMD_WRITE	FIELD_PREP(SWITCH_PBUS_PHY_CMD, 0x1)
++#define   SWITCH_PBUS_PHY_PORTADDR	GENMASK(28, 24)
++#define   SWITCH_PBUS_PHY_REGADDR	GENMASK(23, 0)
++#define SWITCH_PBUS_PHY_IAWD		0x7c24
++#define SWITCH_PBUS_PHY_IARD		0x7c28
+ 
+ /* FE */
+ #define PSE_BASE			0x0100
+@@ -332,6 +351,12 @@ static const char * const en7581_xsi_rsts_names[] = {
+ 	"xfp-mac",
+ };
+ 
++static const char * const an7583_xsi_rsts_names[] = {
++	"hsi0-mac",
++	"hsi1-mac",
++	"xfp-mac",
++};
++
+ static u32 airoha_rr(void __iomem *base, u32 offset)
+ {
+ 	return readl(base + offset);
+@@ -372,8 +397,12 @@ static u32 airoha_rmw(void __iomem *base, u32 offset, u32 mask, u32 val)
+ #define airoha_qdma_clear(qdma, offset, val)			\
+ 	airoha_rmw((qdma)->regs, (offset), (val), 0)
+ 
++#define airoha_switch_rr(eth, offset)				\
++	airoha_rr((eth)->switch_regs, (offset))
+ #define airoha_switch_wr(eth, offset, val)			\
+ 	airoha_wr((eth)->switch_regs, (offset), (val))
++#define airoha_switch_rmw(eth, offset, mask, val)		\
++	airoha_rmw((eth)->switch_regs, (offset), (mask), (val))
+ 
+ static inline dma_addr_t dma_map_unaligned(void *vaddr, size_t len,
+ 					   enum dma_data_direction dir)
+@@ -735,6 +764,59 @@ static int airoha_switch_init(struct udevice *dev, struct airoha_eth *eth)
+ 			 FIELD_PREP(SWITCH_PHY_END_ADDR, 0xc) |
+ 			 FIELD_PREP(SWITCH_PHY_ST_ADDR, 0x8));
+ 
++	/* AN7583 require tweak to GEPHY_CONN_CFG and clear PHY BMCR_PDOWN */
++	if (!strcmp(data->switch_compatible, "airoha,an7583-switch")) {
++		int i;
++
++		airoha_switch_rmw(eth, SWITCH_GEPHY_CONN_CFG,
++				  SWITCH_DPHY_CKIN_SEL |
++				  SWITCH_PHY_CORE_REG_CLK_SEL |
++				  SWITCH_ETHER_AFE_PWD,
++				  SWITCH_DPHY_CKIN_SEL |
++				  SWITCH_PHY_CORE_REG_CLK_SEL |
++				  FIELD_PREP(SWITCH_ETHER_AFE_PWD, 0));
++
++		/* Disable BMCR_PDOWN for every PHY */
++		for (i = 0; i < AIROHA_MAX_NUM_SWITCH_PORT; i++) {
++			int try;
++			u32 val;
++
++			airoha_switch_wr(eth, SWITCH_PBUS_PHY_IAC,
++					 SWITCH_PBUS_PHY_START |
++					 SWITCH_PBUS_PHY_CMD_READ |
++					 FIELD_PREP(SWITCH_PBUS_PHY_PORTADDR, i) |
++					 FIELD_PREP(SWITCH_PBUS_PHY_REGADDR,
++						    AIROHA_PBUS_C22_MASK | MII_BMCR));
++
++			for (try = 0; try < AIROHA_MAX_PBUS_TRY; try++) {
++				val = airoha_switch_rr(eth, SWITCH_PBUS_PHY_IAC);
++				if (!(val & SWITCH_PBUS_PHY_START))
++					break;
++
++				udelay(AIROHA_PBUS_SLEEP);
++			}
++
++			val = airoha_switch_rr(eth, SWITCH_PBUS_PHY_IARD);
++			val &= ~BMCR_PDOWN;
++
++			airoha_switch_wr(eth, SWITCH_PBUS_PHY_IAWD, val);
++			airoha_switch_wr(eth, SWITCH_PBUS_PHY_IAC,
++					 SWITCH_PBUS_PHY_START |
++					 SWITCH_PBUS_PHY_CMD_WRITE |
++					 FIELD_PREP(SWITCH_PBUS_PHY_PORTADDR, i) |
++					 FIELD_PREP(SWITCH_PBUS_PHY_REGADDR,
++						    AIROHA_PBUS_C22_MASK | MII_BMCR));
++
++			for (try = 0; try < AIROHA_MAX_PBUS_TRY; try++) {
++				val = airoha_switch_rr(eth, SWITCH_PBUS_PHY_IAC);
++				if (!(val & SWITCH_PBUS_PHY_START))
++					break;
++
++				udelay(AIROHA_PBUS_SLEEP);
++			}
++		}
++	}
++
+ 	return 0;
+ }
+ 
+@@ -994,6 +1076,12 @@ static const struct airoha_eth_soc_data en7581_data = {
+ 	.switch_compatible = "airoha,en7581-switch",
+ };
+ 
++static const struct airoha_eth_soc_data an7583_data = {
++	.xsi_rsts_names = an7583_xsi_rsts_names,
++	.num_xsi_rsts = ARRAY_SIZE(an7583_xsi_rsts_names),
++	.switch_compatible = "airoha,an7583-switch",
++};
++
+ static const struct udevice_id airoha_eth_ids[] = {
+ 	{ .compatible = "airoha,en7523-eth",
+ 	  .data = (ulong)&en7523_data,
+@@ -1001,6 +1089,9 @@ static const struct udevice_id airoha_eth_ids[] = {
+ 	{ .compatible = "airoha,en7581-eth",
+ 	  .data = (ulong)&en7581_data,
+ 	},
++	{ .compatible = "airoha,an7583-eth",
++	  .data = (ulong)&an7583_data,
++	},
+ 	{ }
+ };
+ 
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/308-airoha-add-Ethernet-node-in-AN7583-dtsi.patch

@@ -0,0 +1,50 @@
+From e3acb9cf6e3e08e72e3549788a4cb35eb88ce206 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 19 May 2025 14:31:59 +0200
+Subject: [PATCH 08/24] airoha: add Ethernet node in AN7583 dtsi
+
+Add Ethernet node in AN7583 dtsi to add support for the integrated
+Ethernet Controller.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/dts/an7583.dtsi | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/arch/arm/dts/an7583.dtsi b/arch/arm/dts/an7583.dtsi
+index e1fda15ba37..daf9886af64 100644
+--- a/arch/arm/dts/an7583.dtsi
++++ b/arch/arm/dts/an7583.dtsi
+@@ -130,6 +130,29 @@
+ 			reg = <0x0 0x1fa20000 0x0 0x388>;
+ 		};
+ 
++		eth: ethernet@1fb50000 {
++			compatible = "airoha,an7583-eth";
++			reg = <0 0x1fb50000 0 0x2600>,
++				<0 0x1fb54000 0 0x2000>,
++				<0 0x1fb56000 0 0x2000>;
++			reg-names = "fe", "qdma0", "qdma1";
++
++			resets = <&scuclk AN7583_FE_RST>,
++				 <&scuclk AN7583_FE_PDMA_RST>,
++				 <&scuclk AN7583_FE_QDMA_RST>,
++				 <&scuclk AN7583_DUAL_HSI0_MAC_RST>,
++				 <&scuclk AN7583_DUAL_HSI1_MAC_RST>,
++				 <&scuclk AN7583_XFP_MAC_RST>;
++			reset-names = "fe", "pdma", "qdma",
++				      "hsi0-mac", "hsi1-mac",
++				      "xfp-mac";
++		};
++
++		switch: switch@1fb58000 {
++			compatible = "airoha,an7583-switch";
++			reg = <0 0x1fb58000 0 0x8000>;
++		};
++
+ 		syscon@1fbe3400 {
+ 			compatible = "airoha,en7581-pbus-csr", "syscon";
+ 			reg = <0x0 0x1fbe3400 0x0 0xff>;
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/309-airoha-add-MMC-node-for-Airoha-AN7583.patch

@@ -0,0 +1,70 @@
+From a982b2b81c8c73213915ff7ff655461fe2fe0cef Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 19 May 2025 14:52:26 +0200
+Subject: [PATCH 09/24] airoha: add MMC node for Airoha AN7583
+
+Add MMC node for Airoha AN7583. These follow the same node of Airoha
+AN7581.
+
+Similar to Airoha AN7581, add the fixed regulator and fixed clock for
+MMC.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/dts/an7583.dtsi | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/arch/arm/dts/an7583.dtsi b/arch/arm/dts/an7583.dtsi
+index daf9886af64..95c9d9a9507 100644
+--- a/arch/arm/dts/an7583.dtsi
++++ b/arch/arm/dts/an7583.dtsi
+@@ -105,6 +105,21 @@
+ 			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+ 	};
+ 
++	clk25m: oscillator {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-frequency = <25000000>;
++		clock-output-names = "clkxtal";
++	};
++
++	vmmc_3v3: regulator-vmmc-3v3 {
++		compatible = "regulator-fixed";
++		regulator-name = "vmmc";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-always-on;
++	};
++
+ 	soc {
+ 		compatible = "simple-bus";
+ 		#address-cells = <2>;
+@@ -259,6 +274,24 @@
+ 			};
+ 		};
+ 
++		mmc0: mmc@1fa0e000 {
++			compatible = "mediatek,mt7622-mmc";
++			reg = <0x0 0x1fa0e000 0x0 0x1000>,
++				<0x0 0x1fa0c000 0x0 0x60>;
++			interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&scuclk EN7581_CLK_EMMC>, <&clk25m>;
++			clock-names = "source", "hclk";
++			bus-width = <4>;
++			max-frequency = <52000000>;
++			vmmc-supply = <&vmmc_3v3>;
++			disable-wp;
++			cap-mmc-highspeed;
++			non-removable;
++
++			assigned-clocks = <&scuclk EN7581_CLK_EMMC>;
++			assigned-clock-rates = <200000000>;
++		};
++
+ 		uart1: serial@1fbf0000 {
+ 			compatible = "ns16550";
+ 			reg = <0x0 0x1fbf0000 0x0 0x30>;
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/400-add-nokia-valyrian.patch

@@ -0,0 +1,242 @@
+--- /dev/null
++++ b/arch/arm/dts/an7581-nokia-valyrian-u-boot.dtsi
+@@ -0,0 +1,104 @@
++// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++
++/ {
++	/* When running as a first-stage bootloader this isn't filled in automatically */
++	memory@80000000 {
++		device_type = "memory";
++		reg = <0x0 0x80000000 0x0 0x40000000>;
++	};
++};
++
++#include "an7581-u-boot.dtsi"
++
++&mmc0 {
++	status = "okay";
++
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	card@0 {
++		compatible = "mmc-card";
++		reg = <0>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			bl@800 {
++				label = "bl2";
++				reg = <0x00000800 0x0001f800>;
++			};
++
++			bootloader@20000 {
++				label = "bootloader";
++				reg = <0x00020000 0x000e0000>;
++			};
++
++			bootloader-inactive@100000 {
++				label = "bootloader-inactive";
++				reg = <0x00100000 0x000e0000>;
++			};
++
++			u-boot-env@1e0000 {
++				label = "u-boot-env";
++				reg = <0x001e0000 0x00020000>;
++
++				u-boot,mmc-env-partition;
++			};
++
++			factory@200000 {
++				label = "factory";
++				reg = <0x00200000 0x00800000>;
++			};
++
++			mfgdata@a00000 {
++				label = "mfgdata";
++				reg = <0x00a00000 0x00100000>;
++			};
++
++			kernel-active@b00000 {
++				label = "kernel-active";
++				reg = <0x00b00000 0x00800000>;
++			};
++
++			kernel-inactive@1300000 {
++				label = "kernel-inactive";
++				reg = <0x01300000 0x00800000>;
++			};
++
++			rootfs-active@1b00000 {
++				label = "rootfs-active";
++				reg = <0x01b00000 0x06400000>;
++			};
++
++			rootfs-inactive@7f00000 {
++				label = "rootfs-inactive";
++				reg = <0x07f00000 0x06400000>;
++			};
++
++			rootfs-data@e300000 {
++				label = "rootfs_data";
++				reg = <0x0e300000 0x02000000>;
++			};
++
++			securestore@10300000 {
++				label = "securestore";
++				reg = <0x10300000 0x1000000>;
++			};
++
++			lcm-data@11300000 {
++				label = "lcm_data";
++				reg = <0x11300000 0x40000000>;
++			};
++		};
++	};
++};
++
++&eth {
++	status = "okay";
++};
++
++&gdm1 {
++	status = "okay";
++};
+--- /dev/null
++++ b/configs/an7581_nokia_valyrian_defconfig
+@@ -0,0 +1,85 @@
++CONFIG_ARM=y
++CONFIG_ARCH_AIROHA=y
++CONFIG_AUTOBOOT_USE_MENUKEY=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_TARGET_AN7581=y
++CONFIG_TEXT_BASE=0x81e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_ENV_SIZE=0x20000
++CONFIG_ENV_OFFSET=0x1e0000
++CONFIG_DM_GPIO=y
++CONFIG_DEFAULT_DEVICE_TREE="airoha/an7581-nokia-valyrian"
++CONFIG_SYS_LOAD_ADDR=0x81800000
++CONFIG_BUILD_TARGET="u-boot.bin"
++# CONFIG_EFI_LOADER is not set
++CONFIG_FIT=y
++CONFIG_FIT_VERBOSE=y
++CONFIG_BOOTDELAY=3
++CONFIG_DEFAULT_FDT_FILE="airoha/an7581-nokia-valyrian.dtb"
++CONFIG_SYS_PBSIZE=1049
++CONFIG_SYS_CONSOLE_IS_IN_ENV=y
++# CONFIG_DISPLAY_BOARDINFO is not set
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="AN7581> "
++CONFIG_SYS_MAXARGS=8
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_BOOTZ=y
++CONFIG_CMD_BOOTMENU=y
++# CONFIG_CMD_ELF is not set
++# CONFIG_CMD_XIMG is not set
++CONFIG_CMD_BIND=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_MMC=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_SF_TEST=y
++CONFIG_CMD_SPI=y
++# CONFIG_CMD_SETEXPR is not set
++CONFIG_CMD_PING=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_MTDPARTS=y
++CONFIG_CMD_LOG=y
++CONFIG_OF_UPSTREAM=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_MMC=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_SYS_RX_ETH_BUFFER=8
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_CLK=y
++CONFIG_DMA=y
++CONFIG_LED=y
++CONFIG_LED_GPIO=y
++CONFIG_MMC_HS200_SUPPORT=y
++CONFIG_MMC_MTK=y
++CONFIG_AIROHA_ETH=y
++CONFIG_DM_MDIO=y
++CONFIG_CMD_MII=y
++CONFIG_CMD_MDIO=y
++CONFIG_PCS_AIROHA_AN7581=y
++CONFIG_PHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_SYS_NS16550=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_AIROHA_SNFI_SPI=y
++CONFIG_SHA512=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="defenvs/an7581_nokia_valyrian_env"
++CONFIG_FIP_LOADER=y
++CONFIG_PCS_AIROHA_AN7581=y
++CONFIG_PHY_AIROHA_EN8811=y
++CONFIG_PHY_ANEG_TIMEOUT=10000
++CONFIG_PHY_ETHERNET_ID=y
++CONFIG_PHY_AS21XXX=y
+--- /dev/null
++++ b/defenvs/an7581_nokia_valyrian_env
+@@ -0,0 +1,25 @@
++loadaddr=0x90000000
++ipaddr=192.168.1.1
++serverip=192.168.1.10
++emmc_bootfile_bl2=openwrt-airoha-an7581-nokia_valyrian-preloader.bin
++emmc_bootfile_fip=openwrt-airoha-an7581-nokia_valyrian-bl31-uboot.fip
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )  [EMMC]
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Load BL31+U-Boot FIP via TFTP then write to eMMC.=run emmc_boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_2=Load BL2 preloader via TFTP then write to eMMC.=run emmc_boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_3=Reboot.=reset
++bootmenu_4=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_default=bootm
++reset_factory=eraseenv && reset
++emmc_boot_tftp_write_fip=tftpboot $loadaddr $emmc_bootfile_fip && run emmc_write_fip
++emmc_boot_tftp_write_bl2=tftpboot $loadaddr $emmc_bootfile_bl2 && run emmc_write_bl2
++emmc_write_bl2=mmc erase 0x4 0xfc && mmc write $fileaddr 0x4 0xfc
++emmc_write_fip=mmc erase 0x100 0x700 && mmc write $fileaddr 0x100 0x700
++_init_env=setenv _init_env ; saveenv
++_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; bootmenu
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
+--- /dev/null
++++ b/dts/upstream/src/arm64/airoha/an7581-nokia-valyrian.dts
+@@ -0,0 +1,16 @@
++// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++/dts-v1/;
++
++#include <dt-bindings/leds/common.h>
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/input.h>
++#include "en7581.dtsi"
++
++/ {
++	model = "Nokia Valyrian";
++	compatible = "nokia,valyrian", "airoha,an7581", "airoha,en7581";
++
++	chosen {
++		stdout-path = &uart1;
++	};
++};

package/boot/uboot-airoha/patches/500-net-airoha-bind-MDIO-controller-on-Ethernet-load.patch

@@ -0,0 +1,89 @@
+From 1357636b826cadf15e410b64f1c98bde930dfb4e Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 23 Oct 2025 19:07:45 +0200
+Subject: [PATCH 10/24] net: airoha: bind MDIO controller on Ethernet load
+
+Bind MDIO controller on Ethernet Controller load. The Airoha AN7581 SoC
+have an integrated Switch based on MT7531 (or more saying MT7988).
+
+Attach it to the mdio node in the switch node to support scanning for
+MDIO devices on the BUS with DM API.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/net/Kconfig      |  1 +
+ drivers/net/airoha_eth.c | 32 ++++++++++++++++++++++++++++++++
+ 2 files changed, 33 insertions(+)
+
+diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
+index 544e302d600..f382a7752d5 100644
+--- a/drivers/net/Kconfig
++++ b/drivers/net/Kconfig
+@@ -126,6 +126,7 @@ config AIROHA_ETH
+ 	depends on ARCH_AIROHA
+ 	select PHYLIB
+ 	select DM_RESET
++	select MDIO_MT7531
+ 	help
+ 	  This Driver support Airoha Ethernet QDMA Driver
+ 	  Say Y to enable support for the Airoha Ethernet QDMA.
+diff --git a/drivers/net/airoha_eth.c b/drivers/net/airoha_eth.c
+index 75af93f182d..661b6ac19f0 100644
+--- a/drivers/net/airoha_eth.c
++++ b/drivers/net/airoha_eth.c
+@@ -10,6 +10,7 @@
+ 
+ #include <dm.h>
+ #include <dm/devres.h>
++#include <dm/lists.h>
+ #include <mapmem.h>
+ #include <net.h>
+ #include <regmap.h>
+@@ -1064,6 +1065,36 @@ static int arht_eth_write_hwaddr(struct udevice *dev)
+ 	return 0;
+ }
+ 
++static int airoha_eth_bind(struct udevice *dev)
++{
++	ofnode switch_node, mdio_node;
++	struct udevice *mdio_dev;
++	int ret = 0;
++
++	if (!CONFIG_IS_ENABLED(MDIO_MT7531))
++		return 0;
++
++	switch_node = ofnode_by_compatible(ofnode_null(),
++					   "airoha,en7581-switch");
++	if (!ofnode_valid(switch_node)) {
++		debug("Warning: missing switch node\n");
++		return 0;
++	}
++
++	mdio_node = ofnode_find_subnode(switch_node, "mdio");
++	if (!ofnode_valid(mdio_node)) {
++		debug("Warning: missing mdio node\n");
++		return 0;
++	}
++
++	ret = device_bind_driver_to_node(dev, "mt7531-mdio", "mdio",
++					 mdio_node, &mdio_dev);
++	if (ret)
++		debug("Warning: failed to bind mdio controller\n");
++
++	return 0;
++}
++
+ static const struct airoha_eth_soc_data en7523_data = {
+ 	.xsi_rsts_names = en7523_xsi_rsts_names,
+ 	.num_xsi_rsts = ARRAY_SIZE(en7523_xsi_rsts_names),
+@@ -1109,6 +1140,7 @@ U_BOOT_DRIVER(airoha_eth) = {
+ 	.id = UCLASS_ETH,
+ 	.of_match = airoha_eth_ids,
+ 	.probe = airoha_eth_probe,
++	.bind = airoha_eth_bind,
+ 	.ops = &airoha_eth_ops,
+ 	.priv_auto = sizeof(struct airoha_eth),
+ 	.plat_auto = sizeof(struct eth_pdata),
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/501-net-airoha_eth-fix-mdio-binding-to-switch-device.patch

@@ -0,0 +1,55 @@
+From 967084a19cf6aef3a5f2a43d758e93ae1fadebbf Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Sat, 31 Jan 2026 01:06:23 +0300
+Subject: [PATCH 11/24] net: airoha_eth: fix mdio binding to switch device
+
+Commit d2145a89bcf6 ("net: airoha: bind MDIO controller on Ethernet load")
+refers to non-present CONFIG_MDIO_MT7531 and non-present "mt7531-mdio"
+driver. It should use CONFIG_MDIO_MT7531_MMIO and "mt7531-mdio-mmio"
+instead.
+
+Fixes: d2145a89bcf6 ("net: airoha: bind MDIO controller on Ethernet load")
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ drivers/net/Kconfig      | 2 +-
+ drivers/net/airoha_eth.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
+index f382a7752d5..51663580bdc 100644
+--- a/drivers/net/Kconfig
++++ b/drivers/net/Kconfig
+@@ -126,7 +126,7 @@ config AIROHA_ETH
+ 	depends on ARCH_AIROHA
+ 	select PHYLIB
+ 	select DM_RESET
+-	select MDIO_MT7531
++	select MDIO_MT7531_MMIO
+ 	help
+ 	  This Driver support Airoha Ethernet QDMA Driver
+ 	  Say Y to enable support for the Airoha Ethernet QDMA.
+diff --git a/drivers/net/airoha_eth.c b/drivers/net/airoha_eth.c
+index 661b6ac19f0..7be4f3c074f 100644
+--- a/drivers/net/airoha_eth.c
++++ b/drivers/net/airoha_eth.c
+@@ -1071,7 +1071,7 @@ static int airoha_eth_bind(struct udevice *dev)
+ 	struct udevice *mdio_dev;
+ 	int ret = 0;
+ 
+-	if (!CONFIG_IS_ENABLED(MDIO_MT7531))
++	if (!CONFIG_IS_ENABLED(MDIO_MT7531_MMIO))
+ 		return 0;
+ 
+ 	switch_node = ofnode_by_compatible(ofnode_null(),
+@@ -1087,7 +1087,7 @@ static int airoha_eth_bind(struct udevice *dev)
+ 		return 0;
+ 	}
+ 
+-	ret = device_bind_driver_to_node(dev, "mt7531-mdio", "mdio",
++	ret = device_bind_driver_to_node(dev, "mt7531-mdio-mmio", "mdio",
+ 					 mdio_node, &mdio_dev);
+ 	if (ret)
+ 		debug("Warning: failed to bind mdio controller\n");
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/502-net-airoha_eth-use-proper-switch-node-for-en7523-cas.patch

@@ -0,0 +1,39 @@
+From 54e56dd99f1c00eae7be5ca8c37149b8671f25d8 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Sat, 31 Jan 2026 01:06:24 +0300
+Subject: [PATCH 12/24] net: airoha_eth: use proper switch node for en7523 case
+
+Commit d2145a89bcf6 ("net: airoha: bind MDIO controller on Ethernet load")
+uses "airoha,en7581-switch" dts node for finding MDIO childs. This is wrong
+for EN7523 SoC. The correct node name should be used instead.
+
+Fixes: d2145a89bcf6 ("net: airoha: bind MDIO controller on Ethernet load")
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ drivers/net/airoha_eth.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/airoha_eth.c b/drivers/net/airoha_eth.c
+index 7be4f3c074f..f8d7235146d 100644
+--- a/drivers/net/airoha_eth.c
++++ b/drivers/net/airoha_eth.c
+@@ -1067,6 +1067,7 @@ static int arht_eth_write_hwaddr(struct udevice *dev)
+ 
+ static int airoha_eth_bind(struct udevice *dev)
+ {
++	struct airoha_eth_soc_data *data = (void *)dev_get_driver_data(dev);
+ 	ofnode switch_node, mdio_node;
+ 	struct udevice *mdio_dev;
+ 	int ret = 0;
+@@ -1075,7 +1076,7 @@ static int airoha_eth_bind(struct udevice *dev)
+ 		return 0;
+ 
+ 	switch_node = ofnode_by_compatible(ofnode_null(),
+-					   "airoha,en7581-switch");
++					   data->switch_compatible);
+ 	if (!ofnode_valid(switch_node)) {
+ 		debug("Warning: missing switch node\n");
+ 		return 0;
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/503-net-mdio-mt7531-mmio-fix-switch-regs-initialization.patch

@@ -0,0 +1,35 @@
+From 9317668aa6e37152d799d7cbaf8b3ce7926b526a Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Sat, 31 Jan 2026 01:06:25 +0300
+Subject: [PATCH 13/24] net: mdio-mt7531-mmio: fix switch regs initialization
+
+mdio is a child node of the switch, so to get switch base address
+we need to lookup for a parent node
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ drivers/net/mdio-mt7531-mmio.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/mdio-mt7531-mmio.c b/drivers/net/mdio-mt7531-mmio.c
+index 3e325ca58da..5a0725010f2 100644
+--- a/drivers/net/mdio-mt7531-mmio.c
++++ b/drivers/net/mdio-mt7531-mmio.c
+@@ -151,8 +151,13 @@ static const struct mdio_ops mt7531_mdio_ops = {
+ static int mt7531_mdio_probe(struct udevice *dev)
+ {
+ 	struct mt7531_mdio_priv *priv = dev_get_priv(dev);
++	ofnode switch_node;
+ 
+-	priv->switch_regs = dev_read_addr(dev);
++	switch_node = ofnode_get_parent(dev_ofnode(dev));
++	if (!ofnode_valid(switch_node))
++		return -EINVAL;
++
++	priv->switch_regs = ofnode_get_addr(switch_node);
+ 	if (priv->switch_regs == FDT_ADDR_T_NONE)
+ 		return -EINVAL;
+ 
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/504-net-mdio-mt7531-mmio-use-common-header-priv-struct.patch

@@ -0,0 +1,114 @@
+From 1a853053a3e44cae45f16b1b30da70da2629c590 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 9 Feb 2026 12:20:33 +0100
+Subject: [PATCH 14/24] net: mdio-mt7531-mmio: use common header priv struct
+
+Instead of having duplicate priv struct for mdio-mt7531-mmio driver in
+both driver and header, use the one exposed by the header directly.
+
+This make sure we have consistent priv struct if the driver will be
+updated in the future.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/net/mdio-mt7531-mmio.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/mdio-mt7531-mmio.c b/drivers/net/mdio-mt7531-mmio.c
+index 5a0725010f2..930454a9b0e 100644
+--- a/drivers/net/mdio-mt7531-mmio.c
++++ b/drivers/net/mdio-mt7531-mmio.c
+@@ -6,6 +6,8 @@
+ #include <linux/iopoll.h>
+ #include <miiphy.h>
+ 
++#include "mdio-mt7531-mmio.h"
++
+ #define MT7531_PHY_IAC			0x701c
+ #define   MT7531_PHY_ACS_ST		BIT(31)
+ #define   MT7531_MDIO_REG_ADDR_CL22	GENMASK(29, 25)
+@@ -25,11 +27,7 @@
+ #define MT7531_MDIO_TIMEOUT		100000
+ #define MT7531_MDIO_SLEEP		20
+ 
+-struct mt7531_mdio_priv {
+-	phys_addr_t switch_regs;
+-};
+-
+-static int mt7531_mdio_wait_busy(struct mt7531_mdio_priv *priv)
++static int mt7531_mdio_wait_busy(struct mt7531_mdio_mmio_priv *priv)
+ {
+ 	unsigned int busy;
+ 
+@@ -38,7 +36,7 @@ static int mt7531_mdio_wait_busy(struct mt7531_mdio_priv *priv)
+ 					MT7531_MDIO_SLEEP, MT7531_MDIO_TIMEOUT);
+ }
+ 
+-static int mt7531_mdio_read(struct mt7531_mdio_priv *priv, int addr, int devad, int reg)
++static int mt7531_mdio_read(struct mt7531_mdio_mmio_priv *priv, int addr, int devad, int reg)
+ {
+ 	u32 val;
+ 
+@@ -75,7 +73,7 @@ static int mt7531_mdio_read(struct mt7531_mdio_priv *priv, int addr, int devad,
+ 	return val & MT7531_MDIO_RW_DATA;
+ }
+ 
+-static int mt7531_mdio_write(struct mt7531_mdio_priv *priv, int addr, int devad,
++static int mt7531_mdio_write(struct mt7531_mdio_mmio_priv *priv, int addr, int devad,
+ 			     int reg, u16 value)
+ {
+ 	u32 val;
+@@ -115,7 +113,7 @@ static int mt7531_mdio_write(struct mt7531_mdio_priv *priv, int addr, int devad,
+ 
+ int mt7531_mdio_mmio_read(struct mii_dev *bus, int addr, int devad, int reg)
+ {
+-	struct mt7531_mdio_priv *priv = bus->priv;
++	struct mt7531_mdio_mmio_priv *priv = bus->priv;
+ 
+ 	return mt7531_mdio_read(priv, addr, devad, reg);
+ }
+@@ -123,14 +121,14 @@ int mt7531_mdio_mmio_read(struct mii_dev *bus, int addr, int devad, int reg)
+ int mt7531_mdio_mmio_write(struct mii_dev *bus, int addr, int devad,
+ 			   int reg, u16 value)
+ {
+-	struct mt7531_mdio_priv *priv = bus->priv;
++	struct mt7531_mdio_mmio_priv *priv = bus->priv;
+ 
+ 	return mt7531_mdio_write(priv, addr, devad, reg, value);
+ }
+ 
+ static int dm_mt7531_mdio_read(struct udevice *dev, int addr, int devad, int reg)
+ {
+-	struct mt7531_mdio_priv *priv = dev_get_priv(dev);
++	struct mt7531_mdio_mmio_priv *priv = dev_get_priv(dev);
+ 
+ 	return mt7531_mdio_read(priv, addr, devad, reg);
+ }
+@@ -138,7 +136,7 @@ static int dm_mt7531_mdio_read(struct udevice *dev, int addr, int devad, int reg
+ static int dm_mt7531_mdio_write(struct udevice *dev, int addr, int devad,
+ 				int reg, u16 value)
+ {
+-	struct mt7531_mdio_priv *priv = dev_get_priv(dev);
++	struct mt7531_mdio_mmio_priv *priv = dev_get_priv(dev);
+ 
+ 	return mt7531_mdio_write(priv, addr, devad, reg, value);
+ }
+@@ -150,7 +148,7 @@ static const struct mdio_ops mt7531_mdio_ops = {
+ 
+ static int mt7531_mdio_probe(struct udevice *dev)
+ {
+-	struct mt7531_mdio_priv *priv = dev_get_priv(dev);
++	struct mt7531_mdio_mmio_priv *priv = dev_get_priv(dev);
+ 	ofnode switch_node;
+ 
+ 	switch_node = ofnode_get_parent(dev_ofnode(dev));
+@@ -169,5 +167,5 @@ U_BOOT_DRIVER(mt7531_mdio) = {
+ 	.id             = UCLASS_MDIO,
+ 	.probe          = mt7531_mdio_probe,
+ 	.ops            = &mt7531_mdio_ops,
+-	.priv_auto	  = sizeof(struct mt7531_mdio_priv),
++	.priv_auto	  = sizeof(struct mt7531_mdio_mmio_priv),
+ };
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/505-configs-an7581-add-mii-mdio-support.patch

@@ -0,0 +1,29 @@
+From 25125e98275aa43023c1d311433e0dca1c12e069 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Sat, 31 Jan 2026 01:06:26 +0300
+Subject: [PATCH 15/24] configs: an7581: add mii/mdio support
+
+This enables mdio/mii command support.
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ configs/an7581_evb_defconfig | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/configs/an7581_evb_defconfig b/configs/an7581_evb_defconfig
+index 73af30cd693..8e2c694dbbb 100644
+--- a/configs/an7581_evb_defconfig
++++ b/configs/an7581_evb_defconfig
+@@ -66,6 +66,9 @@ CONFIG_SPI_FLASH_STMICRO=y
+ CONFIG_SPI_FLASH_WINBOND=y
+ CONFIG_SPI_FLASH_MTD=y
+ CONFIG_AIROHA_ETH=y
++CONFIG_DM_MDIO=y
++CONFIG_CMD_MII=y
++CONFIG_CMD_MDIO=y
+ CONFIG_PHY=y
+ CONFIG_PINCTRL=y
+ CONFIG_PINCONF=y
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/506-arm-dts-an7581-add-mdio-child-node-to-switch-node.patch

@@ -0,0 +1,31 @@
+From 3236c124261ca9da41632762c36b86aface13b05 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Sat, 31 Jan 2026 01:06:27 +0300
+Subject: [PATCH 16/24] arm: dts: an7581: add mdio child node to switch node
+
+add mdio node to be able see switch port states
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ arch/arm/dts/an7581-u-boot.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm/dts/an7581-u-boot.dtsi b/arch/arm/dts/an7581-u-boot.dtsi
+index a9297ca6503..c5e24c76457 100644
+--- a/arch/arm/dts/an7581-u-boot.dtsi
++++ b/arch/arm/dts/an7581-u-boot.dtsi
+@@ -57,6 +57,11 @@
+ 		switch: switch@1fb58000 {
+ 			compatible = "airoha,en7581-switch";
+ 			reg = <0 0x1fb58000 0 0x8000>;
++
++			mdio: mdio {
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
+ 		};
+ 
+ 		snfi: spi@1fa10000 {
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/507-configs-en7523-add-mii-mdio-support.patch

@@ -0,0 +1,29 @@
+From 6efbdacd79d253507e62ae93358953fff6fb3173 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Sat, 31 Jan 2026 01:06:28 +0300
+Subject: [PATCH 17/24] configs: en7523: add mii/mdio support
+
+This enables mdio/mii command support.
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ configs/en7523_evb_defconfig | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/configs/en7523_evb_defconfig b/configs/en7523_evb_defconfig
+index 113ddb46a7f..ebd99d133c9 100644
+--- a/configs/en7523_evb_defconfig
++++ b/configs/en7523_evb_defconfig
+@@ -51,6 +51,9 @@ CONFIG_MTD=y
+ CONFIG_DM_MTD=y
+ CONFIG_MTD_SPI_NAND=y
+ CONFIG_AIROHA_ETH=y
++CONFIG_DM_MDIO=y
++CONFIG_CMD_MII=y
++CONFIG_CMD_MDIO=y
+ CONFIG_PHY=y
+ CONFIG_PINCTRL=y
+ CONFIG_PINCONF=y
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/508-arm-dts-en7523-add-mdio-child-node-to-switch-node.patch

@@ -0,0 +1,31 @@
+From 3ad8d165ce15559d5cab0df0cad9559e81c995f4 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Sat, 31 Jan 2026 01:06:29 +0300
+Subject: [PATCH 18/24] arm: dts: en7523: add mdio child node to switch node
+
+add mdio node to be able see switch port states
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ arch/arm/dts/en7523-u-boot.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm/dts/en7523-u-boot.dtsi b/arch/arm/dts/en7523-u-boot.dtsi
+index f031f81515a..9eadaccc500 100644
+--- a/arch/arm/dts/en7523-u-boot.dtsi
++++ b/arch/arm/dts/en7523-u-boot.dtsi
+@@ -42,6 +42,11 @@
+ 	switch: switch@1fb58000 {
+ 		compatible = "airoha,en7523-switch";
+ 		reg = <0x1fb58000 0x8000>;
++
++		mdio: mdio {
++			#address-cells = <1>;
++			#size-cells = <0>;
++		};
+ 	};
+ 
+ 	snfi: spi@1fa10000 {
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/509-configs-an7583-add-mii-mdio-support.patch

@@ -0,0 +1,29 @@
+From c8d2c4c3beb5fd27a041744f0f9a6b6d5c4e1ebe Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Wed, 11 Feb 2026 03:26:13 +0300
+Subject: [PATCH 19/24] configs: an7583: add mii/mdio support
+
+This enables mdio/mii command support.
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu
+---
+ configs/an7583_evb_defconfig | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/configs/an7583_evb_defconfig b/configs/an7583_evb_defconfig
+index d1893fff398..41d98bab5de 100644
+--- a/configs/an7583_evb_defconfig
++++ b/configs/an7583_evb_defconfig
+@@ -65,6 +65,9 @@ CONFIG_SPI_FLASH_STMICRO=y
+ CONFIG_SPI_FLASH_WINBOND=y
+ CONFIG_SPI_FLASH_MTD=y
+ CONFIG_AIROHA_ETH=y
++CONFIG_DM_MDIO=y
++CONFIG_CMD_MII=y
++CONFIG_CMD_MDIO=y
+ CONFIG_PHY=y
+ CONFIG_PINCTRL=y
+ CONFIG_PINCONF=y
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/510-arm-dts-an7583-add-mdio-child-node-to-switch-node.patch

@@ -0,0 +1,31 @@
+From 7f9bbd9ed8d2e3b7dae0fbc7d2bd2b0c08a115d0 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Wed, 11 Feb 2026 03:29:23 +0300
+Subject: [PATCH 20/24] arm: dts: an7583: add mdio child node to switch node
+
+add mdio node to be able see switch port states
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ arch/arm/dts/an7583.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm/dts/an7583.dtsi b/arch/arm/dts/an7583.dtsi
+index 95c9d9a9507..d84ccf27f2c 100644
+--- a/arch/arm/dts/an7583.dtsi
++++ b/arch/arm/dts/an7583.dtsi
+@@ -166,6 +166,11 @@
+ 		switch: switch@1fb58000 {
+ 			compatible = "airoha,an7583-switch";
+ 			reg = <0 0x1fb58000 0 0x8000>;
++
++			mdio: mdio {
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
+ 		};
+ 
+ 		syscon@1fbe3400 {
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/900-airoha-enable-UBI-support-and-define-default-partiti.patch

@@ -0,0 +1,207 @@
+From 06a44c562647bedd0705cac8bec862877371ff1f Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 28 May 2025 03:10:53 +0200
+Subject: [PATCH 21/24] airoha: enable UBI support and define default partition
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/dts/an7583-evb.dts         | 22 ++++++++++++++++++++++
+ arch/arm/dts/en7523-evb-u-boot.dtsi | 22 ++++++++++++++++++++++
+ arch/arm/dts/en7581-evb-u-boot.dtsi | 22 ++++++++++++++++++++++
+ configs/an7581_evb_defconfig        | 17 +++++++++++++++++
+ configs/an7583_evb_defconfig        | 17 +++++++++++++++++
+ configs/en7523_evb_defconfig        | 20 ++++++++++++++++++--
+ 6 files changed, 118 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/dts/an7583-evb.dts b/arch/arm/dts/an7583-evb.dts
+index d02cd194e8a..b3045e6e7d0 100644
+--- a/arch/arm/dts/an7583-evb.dts
++++ b/arch/arm/dts/an7583-evb.dts
+@@ -46,6 +46,28 @@
+ 	};
+ };
+ 
++&snfi {
++	status = "okay";
++};
++
++&spi_nand {
++	partitions {
++		compatible = "fixed-partitions";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		bl2@0 {
++			label = "bl2";
++			reg = <0x0 0x20000>;
++		};
++
++		ubi@20000 {
++			label = "ubi";
++			reg = <0x20000 0x0>;
++		};
++	};
++};
++
+ &pcie0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&pcie0_rst_pins>;
+diff --git a/arch/arm/dts/en7523-evb-u-boot.dtsi b/arch/arm/dts/en7523-evb-u-boot.dtsi
+index c109d6794fb..b74bfe2d707 100644
+--- a/arch/arm/dts/en7523-evb-u-boot.dtsi
++++ b/arch/arm/dts/en7523-evb-u-boot.dtsi
+@@ -9,3 +9,25 @@
+ };
+ 
+ #include "en7523-u-boot.dtsi"
++
++&snfi {
++	status = "okay";
++};
++
++&spi_nand {
++	partitions {
++		compatible = "fixed-partitions";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		bl2@0 {
++			label = "bl2";
++			reg = <0x0 0x20000>;
++		};
++
++		ubi@20000 {
++			label = "ubi";
++			reg = <0x20000 0x0>;
++		};
++	};
++};
+diff --git a/arch/arm/dts/en7581-evb-u-boot.dtsi b/arch/arm/dts/en7581-evb-u-boot.dtsi
+index ebd3b8b4958..b9a9382e254 100644
+--- a/arch/arm/dts/en7581-evb-u-boot.dtsi
++++ b/arch/arm/dts/en7581-evb-u-boot.dtsi
+@@ -9,3 +9,25 @@
+ };
+ 
+ #include "an7581-u-boot.dtsi"
++
++&snfi {
++	status = "okay";
++};
++
++&spi_nand {
++	partitions {
++		compatible = "fixed-partitions";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		bl2@0 {
++			label = "bl2";
++			reg = <0x0 0x20000>;
++		};
++
++		ubi@20000 {
++			label = "ubi";
++			reg = <0x20000 0x0>;
++		};
++	};
++};
+diff --git a/configs/an7581_evb_defconfig b/configs/an7581_evb_defconfig
+index 8e2c694dbbb..05e37d04681 100644
+--- a/configs/an7581_evb_defconfig
++++ b/configs/an7581_evb_defconfig
+@@ -81,4 +81,21 @@ CONFIG_SYS_NS16550=y
+ CONFIG_SPI=y
+ CONFIG_DM_SPI=y
+ CONFIG_AIROHA_SNFI_SPI=y
++CONFIG_CMD_UBI=y
++# CONFIG_CMD_UBI_RENAME is not set
++CONFIG_CMD_UBIFS=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_ENV_REDUNDANT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_ENV_UBI_VID_OFFSET=0
++CONFIG_MTD_UBI=y
++CONFIG_MTD_UBI_MODULE=y
++CONFIG_MTD_UBI_WL_THRESHOLD=4096
++CONFIG_MTD_UBI_BEB_LIMIT=20
++# CONFIG_MTD_UBI_FASTMAP is not set
++CONFIG_UBI_BLOCK=y
++# CONFIG_UBIFS_SILENCE_MSG is not set
++# CONFIG_UBIFS_SILENCE_DEBUG_DUMP is not set
+ CONFIG_SHA512=y
+diff --git a/configs/an7583_evb_defconfig b/configs/an7583_evb_defconfig
+index 41d98bab5de..663d1ec52ae 100644
+--- a/configs/an7583_evb_defconfig
++++ b/configs/an7583_evb_defconfig
+@@ -80,4 +80,21 @@ CONFIG_SYS_NS16550=y
+ CONFIG_SPI=y
+ CONFIG_DM_SPI=y
+ CONFIG_AIROHA_SNFI_SPI=y
++CONFIG_CMD_UBI=y
++# CONFIG_CMD_UBI_RENAME is not set
++CONFIG_CMD_UBIFS=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_ENV_REDUNDANT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_ENV_UBI_VID_OFFSET=0
++CONFIG_MTD_UBI=y
++CONFIG_MTD_UBI_MODULE=y
++CONFIG_MTD_UBI_WL_THRESHOLD=4096
++CONFIG_MTD_UBI_BEB_LIMIT=20
++# CONFIG_MTD_UBI_FASTMAP is not set
++CONFIG_UBI_BLOCK=y
++# CONFIG_UBIFS_SILENCE_MSG is not set
++# CONFIG_UBIFS_SILENCE_DEBUG_DUMP is not set
+ CONFIG_SHA512=y
+diff --git a/configs/en7523_evb_defconfig b/configs/en7523_evb_defconfig
+index ebd99d133c9..4d01e3f54fe 100644
+--- a/configs/en7523_evb_defconfig
++++ b/configs/en7523_evb_defconfig
+@@ -5,7 +5,6 @@ CONFIG_TEXT_BASE=0x81E00000
+ CONFIG_SYS_MALLOC_F_LEN=0x4000
+ CONFIG_NR_DRAM_BANKS=1
+ CONFIG_ENV_SIZE=0x4000
+-CONFIG_ENV_OFFSET=0x7c000
+ CONFIG_DM_GPIO=y
+ CONFIG_DEFAULT_DEVICE_TREE="airoha/en7523-evb"
+ CONFIG_SYS_LOAD_ADDR=0x81800000
+@@ -36,8 +35,8 @@ CONFIG_CMD_MTDPARTS=y
+ CONFIG_CMD_LOG=y
+ CONFIG_OF_UPSTREAM=y
+ CONFIG_ENV_OVERWRITE=y
++# CONFIG_ENV_IS_IN_MTD is not set
+ CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+-CONFIG_ENV_MTD_DEV="spi-nand0"
+ CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+ CONFIG_NET_RANDOM_ETHADDR=y
+ CONFIG_SYS_RX_ETH_BUFFER=8
+@@ -63,4 +62,21 @@ CONFIG_SYS_NS16550=y
+ CONFIG_SPI=y
+ CONFIG_DM_SPI=y
+ CONFIG_AIROHA_SNFI_SPI=y
++CONFIG_CMD_UBI=y
++# CONFIG_CMD_UBI_RENAME is not set
++CONFIG_CMD_UBIFS=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_ENV_REDUNDANT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_ENV_UBI_VID_OFFSET=0
++CONFIG_MTD_UBI=y
++CONFIG_MTD_UBI_MODULE=y
++CONFIG_MTD_UBI_WL_THRESHOLD=4096
++CONFIG_MTD_UBI_BEB_LIMIT=20
++# CONFIG_MTD_UBI_FASTMAP is not set
++CONFIG_UBI_BLOCK=y
++# CONFIG_UBIFS_SILENCE_MSG is not set
++# CONFIG_UBIFS_SILENCE_DEBUG_DUMP is not set
+ CONFIG_SHA512=y
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/901-airoha-add-default-configuration.patch

@@ -0,0 +1,84 @@
+From 2bd435e8b2da2047ea0c5bb9b9af96bc6af2f8cd Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 28 May 2025 03:18:32 +0200
+Subject: [PATCH 22/24] airoha: add default configuration
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ configs/an7581_evb_defconfig | 2 ++
+ configs/an7583_evb_defconfig | 2 ++
+ configs/en7523_evb_defconfig | 2 ++
+ defenvs/an7581_rfb_env       | 4 ++++
+ defenvs/an7583_rfb_env       | 4 ++++
+ defenvs/en7523_rfb_env       | 4 ++++
+ 6 files changed, 18 insertions(+)
+ create mode 100644 defenvs/an7581_rfb_env
+ create mode 100644 defenvs/an7583_rfb_env
+ create mode 100644 defenvs/en7523_rfb_env
+
+diff --git a/configs/an7581_evb_defconfig b/configs/an7581_evb_defconfig
+index 05e37d04681..7633cb7ac96 100644
+--- a/configs/an7581_evb_defconfig
++++ b/configs/an7581_evb_defconfig
+@@ -98,4 +98,6 @@ CONFIG_MTD_UBI_BEB_LIMIT=20
+ CONFIG_UBI_BLOCK=y
+ # CONFIG_UBIFS_SILENCE_MSG is not set
+ # CONFIG_UBIFS_SILENCE_DEBUG_DUMP is not set
++CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
++CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/an7581_rfb_env"
+ CONFIG_SHA512=y
+diff --git a/configs/an7583_evb_defconfig b/configs/an7583_evb_defconfig
+index 663d1ec52ae..c69cf353ffa 100644
+--- a/configs/an7583_evb_defconfig
++++ b/configs/an7583_evb_defconfig
+@@ -97,4 +97,6 @@ CONFIG_MTD_UBI_BEB_LIMIT=20
+ CONFIG_UBI_BLOCK=y
+ # CONFIG_UBIFS_SILENCE_MSG is not set
+ # CONFIG_UBIFS_SILENCE_DEBUG_DUMP is not set
++CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
++CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/an7583_rfb_env"
+ CONFIG_SHA512=y
+diff --git a/configs/en7523_evb_defconfig b/configs/en7523_evb_defconfig
+index 4d01e3f54fe..8febb6cabdd 100644
+--- a/configs/en7523_evb_defconfig
++++ b/configs/en7523_evb_defconfig
+@@ -79,4 +79,6 @@ CONFIG_MTD_UBI_BEB_LIMIT=20
+ CONFIG_UBI_BLOCK=y
+ # CONFIG_UBIFS_SILENCE_MSG is not set
+ # CONFIG_UBIFS_SILENCE_DEBUG_DUMP is not set
++CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
++CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/en7523_rfb_env"
+ CONFIG_SHA512=y
+diff --git a/defenvs/an7581_rfb_env b/defenvs/an7581_rfb_env
+new file mode 100644
+index 00000000000..716ddc321e2
+--- /dev/null
++++ b/defenvs/an7581_rfb_env
+@@ -0,0 +1,4 @@
++loadaddr=0x81800000
++ipaddr=192.168.1.1
++serverip=192.168.1.10
++bootargs=ubi.mtd=ubi root=/dev/ubiblock0_5 rootwait
+diff --git a/defenvs/an7583_rfb_env b/defenvs/an7583_rfb_env
+new file mode 100644
+index 00000000000..716ddc321e2
+--- /dev/null
++++ b/defenvs/an7583_rfb_env
+@@ -0,0 +1,4 @@
++loadaddr=0x81800000
++ipaddr=192.168.1.1
++serverip=192.168.1.10
++bootargs=ubi.mtd=ubi root=/dev/ubiblock0_5 rootwait
+diff --git a/defenvs/en7523_rfb_env b/defenvs/en7523_rfb_env
+new file mode 100644
+index 00000000000..716ddc321e2
+--- /dev/null
++++ b/defenvs/en7523_rfb_env
+@@ -0,0 +1,4 @@
++loadaddr=0x81800000
++ipaddr=192.168.1.1
++serverip=192.168.1.10
++bootargs=ubi.mtd=ubi root=/dev/ubiblock0_5 rootwait
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/902-arm-airoha-disable-environment-inside-mtd-partition.patch

@@ -0,0 +1,46 @@
+From c89b8f1baa9bf4e32b9f146f5fece6f2151e2dd0 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Mon, 13 Oct 2025 20:48:00 +0300
+Subject: [PATCH 23/24] arm: airoha: disable environment inside mtd partition
+
+When booting on en7581_evb board equipped with spinand flash, a u-boot
+panic occurs. The panic is caused by the absence any available mtd
+partition.
+
+Disable CONFIG_ENV_IS_IN_MTD to avoid an issue. The environment will
+be stored in the EMMC or in UBI, so actually CONFIG_ENV_IS_IN_MTD is
+not needed.
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ configs/an7581_evb_defconfig | 1 +
+ configs/an7583_evb_defconfig | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/configs/an7581_evb_defconfig b/configs/an7581_evb_defconfig
+index 7633cb7ac96..afdb0cd8586 100644
+--- a/configs/an7581_evb_defconfig
++++ b/configs/an7581_evb_defconfig
+@@ -41,6 +41,7 @@ CONFIG_CMD_LOG=y
+ CONFIG_OF_UPSTREAM=y
+ CONFIG_ENV_OVERWRITE=y
+ CONFIG_ENV_IS_IN_MMC=y
++# CONFIG_ENV_IS_IN_MTD is not set
+ CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+ CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+ CONFIG_NET_RANDOM_ETHADDR=y
+diff --git a/configs/an7583_evb_defconfig b/configs/an7583_evb_defconfig
+index c69cf353ffa..c3d47c411ba 100644
+--- a/configs/an7583_evb_defconfig
++++ b/configs/an7583_evb_defconfig
+@@ -40,6 +40,7 @@ CONFIG_CMD_MTDPARTS=y
+ CONFIG_CMD_LOG=y
+ CONFIG_ENV_OVERWRITE=y
+ CONFIG_ENV_IS_IN_MMC=y
++# CONFIG_ENV_IS_IN_MTD is not set
+ CONFIG_ENV_RELOC_GD_ENV_ADDR=y
+ CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+ CONFIG_NET_RANDOM_ETHADDR=y
+-- 
+2.51.0
+

package/boot/uboot-airoha/patches/903-arm-airoha-enable-position-independent-code.patch

@@ -0,0 +1,51 @@
+From 78a01bfa242139ae6b7ac487c0e857457d8ff416 Mon Sep 17 00:00:00 2001
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Date: Mon, 13 Oct 2025 20:56:31 +0300
+Subject: [PATCH 24/24] arm: airoha: enable position independent code
+
+This slightly increase the code, but makes debugging a bit easy
+
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+---
+ configs/an7581_evb_defconfig | 1 +
+ configs/an7583_evb_defconfig | 1 +
+ configs/en7523_evb_defconfig | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/configs/an7581_evb_defconfig b/configs/an7581_evb_defconfig
+index afdb0cd8586..be076ec7723 100644
+--- a/configs/an7581_evb_defconfig
++++ b/configs/an7581_evb_defconfig
+@@ -1,5 +1,6 @@
+ CONFIG_ARM=y
+ CONFIG_ARCH_AIROHA=y
++CONFIG_POSITION_INDEPENDENT=y
+ CONFIG_TARGET_AN7581=y
+ CONFIG_TEXT_BASE=0x81E00000
+ CONFIG_SYS_MALLOC_F_LEN=0x4000
+diff --git a/configs/an7583_evb_defconfig b/configs/an7583_evb_defconfig
+index c3d47c411ba..7ef2d6feeba 100644
+--- a/configs/an7583_evb_defconfig
++++ b/configs/an7583_evb_defconfig
+@@ -1,5 +1,6 @@
+ CONFIG_ARM=y
+ CONFIG_ARCH_AIROHA=y
++CONFIG_POSITION_INDEPENDENT=y
+ CONFIG_TARGET_AN7583=y
+ CONFIG_TEXT_BASE=0x81E00000
+ CONFIG_SYS_MALLOC_F_LEN=0x4000
+diff --git a/configs/en7523_evb_defconfig b/configs/en7523_evb_defconfig
+index 8febb6cabdd..53011e47f55 100644
+--- a/configs/en7523_evb_defconfig
++++ b/configs/en7523_evb_defconfig
+@@ -1,6 +1,7 @@
+ CONFIG_ARM=y
+ CONFIG_SYS_ARCH_TIMER=y
+ CONFIG_ARCH_AIROHA=y
++CONFIG_POSITION_INDEPENDENT=y
+ CONFIG_TEXT_BASE=0x81E00000
+ CONFIG_SYS_MALLOC_F_LEN=0x4000
+ CONFIG_NR_DRAM_BANKS=1
+-- 
+2.51.0
+