OpenWrt v24.10.0-rc1: adjust config defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

.gitattributes

@@ -1,4 +1 @@
 * -text
-*.patch whitespace=-indent-with-non-tab,-space-before-tab,-tab-in-indent,-trailing-space
-*.dts text eol=lf
-*.dts[io] text eol=lf

.github/labeler.yml

@@ -7,6 +7,10 @@
 - changed-files:
   - any-glob-to-any-file:
     - "target/linux/apm821xx/**"
+"target/archs38":
+- changed-files:
+  - any-glob-to-any-file:
+    - "target/linux/archs38/**"
 "target/armsr":
 - changed-files:
   - any-glob-to-any-file:
@@ -54,10 +58,6 @@
     - "target/linux/d1/**"
     - "package/boot/uboot-d1/**"
     - "package/boot/opensbi/**"
-"target/econet":
-- changed-files:
-  - any-glob-to-any-file:
-    - "target/linux/econet/**"
 "target/gemini":
 - changed-files:
   - any-glob-to-any-file:
@@ -80,12 +80,6 @@
 - changed-files:
   - any-glob-to-any-file:
     - "target/linux/qualcommax/**"
-    - "package/kernel/qca-ssdk/**"
-    - "package/kernel/qca-nss-dp/**"
-"target/qualcommbe":
-- changed-files:
-  - any-glob-to-any-file:
-    - "target/linux/qualcommbe/**"
 "target/ixp4xx":
 - changed-files:
   - any-glob-to-any-file:
@@ -126,12 +120,6 @@
     - "target/linux/mediatek/**"
     - "package/boot/arm-trusted-firmware-mediatek/**"
     - "package/boot/uboot-mediatek/**"
-"target/microchipsw":
-- changed-files:
-  - any-glob-to-any-file:
-    - "target/linux/microchipsw/**"
-    - "package/boot/arm-trusted-firmware-microchipsw/**"
-    - "package/boot/uboot-microchipsw/**"
 "target/mpc85xx":
 - changed-files:
   - any-glob-to-any-file:

.github/workflows/build-pr-profile.yml

@@ -1,12 +0,0 @@
-name: Build PR Profile
-
-on:
-  pull_request:
-    types: [opened, edited, synchronize]
-
-permissions:
-  pull-requests: write
-
-jobs:
-  build-pr-profile:
-    uses: openwrt/actions-shared-workflows/.github/workflows/build-pr-profile.yml@main

.github/workflows/formal.yml

@@ -5,14 +5,8 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   build:
     name: Test Formalities
     uses: openwrt/actions-shared-workflows/.github/workflows/formal.yml@main
-    # with:
-    #   # Post formality check summaries to the PR.
-    #   # Repo's permissions need to be updated for actions to modify PRs:
-    #   # https://docs.github.com/en/rest/issues/comments?apiVersion=2022-11-28#create-an-issue-comment
-    #   post_comment: true

config/Config-build.in

@@ -70,8 +70,8 @@ menu "Global build settings"
 
 	config USE_APK
 		imply PACKAGE_apk-mbedtls
-		bool "Use APK instead of OPKG to build distribution"
-		default y
+		bool "Use APK instead of OPKG to build distribution (BROKEN)"
+		depends on BROKEN
 
 	comment "General build options"
 
@@ -108,7 +108,6 @@ menu "Global build settings"
 	config CLEAN_IPKG
 		bool
 		prompt "Remove ipkg/opkg status data files in final images"
-		depends on !USE_APK
 		help
 		  This removes all ipkg/opkg status data files from the target directory
 		  before building the root filesystem.
@@ -175,8 +174,8 @@ menu "Global build settings"
 		  Packages can choose to opt-out via setting PKG_BUILD_FLAGS:=no-lto
 
 	config MOLD
-		depends on (aarch64 || arm || i386 || i686 || loongarch64 || m68k || powerpc || powerpc64 || riscv64 || sh4 || x86_64)
-		depends on !HOST_OS_MACOS
+		depends on (aarch64 || arm || i386 || i686 || m68k || powerpc || powerpc64 || sh4 || x86_64)
+		depends on !GCC_USE_VERSION_11
 		def_bool $(shell, ./config/check-hostcxx.sh 10 2 12)
 
 	config USE_MOLD
@@ -251,15 +250,6 @@ menu "Global build settings"
 
 	comment "Hardening build options"
 
-	config PKG_FANALYZER
-		bool
-		prompt "Enable gcc fanalyzer"
-		default n
-		help
-		  Add -fanalyzer to the CFLAGS. As a result of this option, a static analysis
-		  of the program flow is conducted, allowing interprocedural paths to be
-		  identified and warnings to be issued if problems are identified.
-
 	config PKG_CHECK_FORMAT_SECURITY
 		bool
 		prompt "Enable gcc format-security"
@@ -368,11 +358,9 @@ menu "Global build settings"
 		config PKG_FORTIFY_SOURCE_NONE
 			bool "None"
 		config PKG_FORTIFY_SOURCE_1
-			bool "Conservative Level 1"
+			bool "Conservative"
 		config PKG_FORTIFY_SOURCE_2
-			bool "Aggressive Level 2"
-		config PKG_FORTIFY_SOURCE_3
-			bool "Aggressive Level 3"
+			bool "Aggressive"
 	endchoice
 
 	choice
@@ -393,19 +381,9 @@ menu "Global build settings"
 			bool "Full"
 	endchoice
 
-	config PKG_DT_RELR
-		bool "Link with relative relocations (RELR)"
-		depends on (aarch64 || i386 || loongarch64 || x86_64)
-		default y
-		help
-		  Link all applications with -Wl,-z,pack-relative-relocs.
-		  This will reduce the size of many applications.
-		  This is only supported on a limited number of architectures.
-
 	config TARGET_ROOTFS_SECURITY_LABELS
 		bool
 		select KERNEL_SQUASHFS_XATTR
-		select KERNEL_EROFS_FS_SECURITY
 		select KERNEL_EXT4_FS_SECURITY
 		select KERNEL_F2FS_FS_SECURITY
 		select KERNEL_UBIFS_FS_SECURITY
@@ -445,10 +423,11 @@ menu "Global build settings"
 
 	endchoice
 
-	config USE_SECCOMP
+	config SECCOMP
 		bool "Enable SECCOMP"
 		select KERNEL_SECCOMP
-		depends on (aarch64 || arm || armeb || mips || mipsel || mips64 || mips64el || i386 || loongarch64 || powerpc || x86_64)
+		select PACKAGE_procd-seccomp
+		depends on (aarch64 || arm || armeb || mips || mipsel || mips64 || mips64el || i386 || powerpc || x86_64)
 		depends on !TARGET_uml
 		default y
 		help

config/Config-devel.in

@@ -62,60 +62,6 @@ menuconfig DEVEL
 		  Compile all host host tools even if not needed. This is needed to prepare a
 		  universal precompiled host tools archive to use in another buildroot.
 
-	menuconfig OPTIMIZE_HOST_TOOLS
-		bool "Host Tools compile options" if DEVEL
-
-		if OPTIMIZE_HOST_TOOLS
-
-		config HOST_FLAGS_OPT
-			string "Host Tools optimization flags"
-			default "-O2"
-			help
-			  Compiler flags which are used to build host tools.
-
-			  E.g.: "-O2", "-O3 -fno-tree-vectorize".
-
-			  Default is "-O2".
-
-		config HOST_TOOLS_STRIP
-			bool "Strip Host Tools"
-			help
-			  Instructs compiler/linker to use flags from HOST_FLAGS_STRIP
-			  in order to reduce binary size of host tools.
-
-		config HOST_FLAGS_STRIP
-			string "Host Tools compiler/linker flags for stripping symbols"
-			depends on HOST_TOOLS_STRIP
-			default "-Wl,-s"
-			help
-			  Compiler flags which are used to strip symbols from host tools.
-
-			  Each flag should be prefixed with "-Wl," string
-			  because compiler (GCC) passes this value to linker.
-
-			  Default is "-Wl,-s" which means "strip all symbols" - specifically,
-			  debug symbols and other symbols not needed for relocation processing.
-
-		comment "Host Tools miscellaneous flags"
-
-		config HOST_EXTRA_CFLAGS
-			string "Host Tools extra CFLAGS"
-			default ""
-
-		config HOST_EXTRA_CXXFLAGS
-			string "Host Tools extra CXXFLAGS"
-			default ""
-
-		config HOST_EXTRA_CPPFLAGS
-			string "Host Tools extra CPPFLAGS"
-			default ""
-
-		config HOST_EXTRA_LDFLAGS
-			string "Host Tools extra LDFLAGS"
-			default ""
-
-		endif
-
 	config BUILD_SUFFIX
 		string "Build suffix to append to the target BUILD_DIR variable" if DEVEL
 		default ""

config/Config-images.in

@@ -18,7 +18,6 @@ menu "Target Images"
 			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_mpc85xx
 			default TARGET_INITRAMFS_COMPRESSION_LZMA if TARGET_ramips
 			default TARGET_INITRAMFS_COMPRESSION_ZSTD if TARGET_qualcommax
-			default TARGET_INITRAMFS_COMPRESSION_ZSTD if TARGET_microchipsw
 			default TARGET_INITRAMFS_COMPRESSION_XZ if USES_SEPARATE_INITRAMFS
 			default TARGET_INITRAMFS_COMPRESSION_NONE
 			depends on TARGET_ROOTFS_INITRAMFS
@@ -88,23 +87,6 @@ menu "Target Images"
 
 	comment "Root filesystem images"
 
-	menuconfig TARGET_ROOTFS_EROFS
-		bool "erofs"
-		default y if USES_EROFS
-		select KERNEL_EROFS_FS
-		help
-		  Build a EROFS root filesystem.
-
-		config TARGET_EROFS_PCLUSTER_SIZE
-			int "physical cluster size (in KiB)"
-			depends on TARGET_ROOTFS_EROFS
-			default 64 if LOW_MEMORY_FOOTPRINT
-			default 1024 if (SMALL_FLASH && !LOW_MEMORY_FOOTPRINT)
-			default 256
-			help
-			  Specify the EROFS physical cluster size (must be equal
-			  to or a multiple of the filesystem block size).
-
 	menuconfig TARGET_ROOTFS_EXT4FS
 		bool "ext4"
 		default y if USES_EXT4
@@ -178,22 +160,6 @@ menu "Target Images"
 			  Select squashfs block size, must be one of:
 			    4, 8, 16, 32, 64, 128, 256, 512, 1024
 
-		config TARGET_SQUASHFS_BLOCK_READERS
-			int "mksquashfs tool parallel block reader threads"
-			depends on TARGET_ROOTFS_SQUASHFS
-			default 4
-			help
-			  Specify the number of parallel block reader threads
-			  (for files equal or larger than the squashfs block size).
-
-		config TARGET_SQUASHFS_SMALL_READERS
-			int "mksquashfs tool parallel small file reader threads"
-			depends on TARGET_ROOTFS_SQUASHFS
-			default 4
-			help
-			  Specify the number of parallel small file reader threads
-			  (for files less than the squashfs block size).
-
 	menuconfig TARGET_ROOTFS_UBIFS
 		bool "ubifs"
 		default y if USES_UBIFS
@@ -232,7 +198,7 @@ menu "Target Images"
 	config GRUB_IMAGES
 		bool "Build GRUB images (Linux x86 or x86_64 host only)"
 		depends on TARGET_x86
-		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS || TARGET_ROOTFS_EROFS
+		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS
 		select PACKAGE_grub2
 		select PACKAGE_grub2-bios-setup
 		default y
@@ -240,7 +206,7 @@ menu "Target Images"
 	config GRUB_EFI_IMAGES
 		bool "Build GRUB EFI images"
 		depends on TARGET_x86 || TARGET_armsr || TARGET_loongarch64
-		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS || TARGET_ROOTFS_EROFS
+		depends on TARGET_ROOTFS_EXT4FS || TARGET_ROOTFS_JFFS2 || TARGET_ROOTFS_SQUASHFS
 		select PACKAGE_grub2 if TARGET_x86
 		select PACKAGE_grub2-efi if TARGET_x86
 		select PACKAGE_grub2-bios-setup if TARGET_x86
@@ -336,7 +302,7 @@ menu "Target Images"
 		int "Root filesystem partition size (in MiB)"
 		depends on USES_ROOTFS_PART || TARGET_ROOTFS_EXT4FS
 		default 232 if TARGET_loongarch64
-		default 448 if TARGET_mediatek || TARGET_microchipsw
+		default 448 if TARGET_mediatek
 		default 104
 		help
 		  Select the root filesystem partition size.

config/Config-kernel.in

@@ -53,7 +53,7 @@ config KERNEL_ARM_PMU
 config KERNEL_ARM_PMUV3
 	bool
 	default y if TARGET_armsr_armv8
-	depends on (arm_v7 || aarch64)
+	depends on (arm_v7 || aarch64) && LINUX_6_6
 
 config KERNEL_RISCV_PMU
 	bool
@@ -84,7 +84,7 @@ config KERNEL_X86_VSYSCALL_EMULATION
 config KERNEL_PERF_EVENTS
 	bool "Compile the kernel with performance events and counters"
 	select KERNEL_ARM_PMU if (arm || aarch64)
-	select KERNEL_ARM_PMUV3 if (arm_v7 || aarch64)
+	select KERNEL_ARM_PMUV3 if (arm_v7 || aarch64) && LINUX_6_6
 	select KERNEL_RISCV_PMU if riscv64
 
 config KERNEL_PROFILING
@@ -137,6 +137,13 @@ config KERNEL_UBSAN_BOUNDS
 	  {str,mem}*cpy() family of functions (that is addressed by
 	  FORTIFY_SOURCE).
 
+config KERNEL_UBSAN_NULL
+	bool "Enable checking of null pointers"
+	depends on KERNEL_UBSAN
+	help
+	  This option enables detection of memory accesses via a
+	  null pointer.
+
 config KERNEL_UBSAN_TRAP
 	bool "On Sanitizer warnings, abort the running kernel code"
 	depends on KERNEL_UBSAN
@@ -413,102 +420,6 @@ config KERNEL_PREEMPT_TRACER
 	  enabled. This option and the irqs-off timing option can be
 	  used together or separately.)
 
-config KERNEL_HWLAT_TRACER
-	bool "Tracer to detect hardware latencies (like SMIs)"
-	depends on KERNEL_FTRACE
-	help
-	  This tracer, when enabled will create one or more kernel threads,
-	  depending on what the cpumask file is set to, which each thread
-	  spinning in a loop looking for interruptions caused by
-	  something other than the kernel. For example, if a
-	  System Management Interrupt (SMI) takes a noticeable amount of
-	  time, this tracer will detect it. This is useful for testing
-	  if a system is reliable for Real Time tasks.
-
-	  Some files are created in the tracing directory when this
-	  is enabled:
-
-	    hwlat_detector/width   - time in usecs for how long to spin for
-	    hwlat_detector/window  - time in usecs between the start of each
-				     iteration
-
-	  A kernel thread is created that will spin with interrupts disabled
-	  for "width" microseconds in every "window" cycle. It will not spin
-	  for "window - width" microseconds, where the system can
-	  continue to operate.
-
-	  The output will appear in the trace and trace_pipe files.
-
-	  When the tracer is not running, it has no affect on the system,
-	  but when it is running, it can cause the system to be
-	  periodically non responsive. Do not run this tracer on a
-	  production system.
-
-	  To enable this tracer, echo in "hwlat" into the current_tracer
-	  file. Every time a latency is greater than tracing_thresh, it will
-	  be recorded into the ring buffer.
-
-config KERNEL_OSNOISE_TRACER
-	bool "OS Noise tracer"
-	depends on KERNEL_FTRACE
-	help
-	  In the context of high-performance computing (HPC), the Operating
-	  System Noise (osnoise) refers to the interference experienced by an
-	  application due to activities inside the operating system. In the
-	  context of Linux, NMIs, IRQs, SoftIRQs, and any other system thread
-	  can cause noise to the system. Moreover, hardware-related jobs can
-	  also cause noise, for example, via SMIs.
-
-	  The osnoise tracer leverages the hwlat_detector by running a similar
-	  loop with preemption, SoftIRQs and IRQs enabled, thus allowing all
-	  the sources of osnoise during its execution. The osnoise tracer takes
-	  note of the entry and exit point of any source of interferences,
-	  increasing a per-cpu interference counter. It saves an interference
-	  counter for each source of interference. The interference counter for
-	  NMI, IRQs, SoftIRQs, and threads is increased anytime the tool
-	  observes these interferences' entry events. When a noise happens
-	  without any interference from the operating system level, the
-	  hardware noise counter increases, pointing to a hardware-related
-	  noise. In this way, osnoise can account for any source of
-	  interference. At the end of the period, the osnoise tracer prints
-	  the sum of all noise, the max single noise, the percentage of CPU
-	  available for the thread, and the counters for the noise sources.
-
-	  In addition to the tracer, a set of tracepoints were added to
-	  facilitate the identification of the osnoise source.
-
-	  The output will appear in the trace and trace_pipe files.
-
-	  To enable this tracer, echo in "osnoise" into the current_tracer
-	  file.
-
-config KERNEL_TIMERLAT_TRACER
-	bool "Timerlat tracer"
-	depends on KERNEL_FTRACE
-	help
-	  The timerlat tracer aims to help the preemptive kernel developers
-	  to find sources of wakeup latencies of real-time threads.
-
-	  The tracer creates a per-cpu kernel thread with real-time priority.
-	  The tracer thread sets a periodic timer to wakeup itself, and goes
-	  to sleep waiting for the timer to fire. At the wakeup, the thread
-	  then computes a wakeup latency value as the difference between
-	  the current time and the absolute time that the timer was set
-	  to expire.
-
-	  The tracer prints two lines at every activation. The first is the
-	  timer latency observed at the hardirq context before the
-	  activation of the thread. The second is the timer latency observed
-	  by the thread, which is the same level that cyclictest reports. The
-	  ACTIVATION ID field serves to relate the irq execution to its
-	  respective thread execution.
-
-	  The tracer is build on top of osnoise tracer, and the osnoise:
-	  events can be used to trace the source of interference from NMI,
-	  IRQs and other threads. It also enables the capture of the
-	  stacktrace at the IRQ context, which helps to identify the code
-	  path that can cause thread delay.
-
 config KERNEL_HIST_TRIGGERS
 	bool "Histogram triggers"
 	depends on KERNEL_FTRACE
@@ -587,10 +498,16 @@ config KERNEL_FRAME_WARN
 # KConfig wont evaluate them unless KERNEL_EARLY_PRINTK is selected
 # which means that buildroot wont override the DEBUG_LL symbols in target
 # kernel configurations and lead to devices that dont have working console
+config KERNEL_DEBUG_LL_UART_NONE
+	bool
+	default n
+	depends on arm
+
 config KERNEL_DEBUG_LL
 	bool
 	default n
 	depends on arm
+	select KERNEL_DEBUG_LL_UART_NONE
 	help
 	  ARM low level debugging.
 
@@ -650,7 +567,7 @@ config KERNEL_BPF_EVENTS
 
 config KERNEL_PROBE_EVENTS_BTF_ARGS
 	bool "Support BTF function arguments for probe events"
-	depends on KERNEL_DEBUG_INFO_BTF && KERNEL_KPROBE_EVENTS
+	depends on KERNEL_DEBUG_INFO_BTF && KERNEL_KPROBE_EVENTS && LINUX_6_6
 
 config KERNEL_BPF_KPROBE_OVERRIDE
 	bool
@@ -690,17 +607,8 @@ choice
 
 	config KERNEL_TRANSPARENT_HUGEPAGE_MADVISE
 		bool "madvise"
-
-	config KERNEL_TRANSPARENT_HUGEPAGE_NEVER
-		bool "never"
 endchoice
 
-config KERNEL_ARM64_CONTPTE
-	bool "Compile the kernel with Contiguous PTE mappings for user memory"
-	depends on aarch64
-	depends on KERNEL_TRANSPARENT_HUGEPAGE
-	default y
-
 config KERNEL_HUGETLBFS
 	bool
 
@@ -824,10 +732,10 @@ config KERNEL_SLUB_DEBUG_ON
 	  This enables by default sanity_checks, red_zone, poison and store_user
 	  debugging options for all caches.
 
-config KERNEL_STACKDEPOT_MAX_FRAMES
-	int
-	default 64
-	depends on KERNEL_SLUB_DEBUG
+config KERNEL_SLABINFO
+	select KERNEL_SLUB_DEBUG
+	select KERNEL_SLUB_DEBUG_ON
+	bool "Enable /proc slab debug info"
 
 config KERNEL_PROC_PAGE_MONITOR
 	bool "Enable /proc page monitoring"
@@ -953,17 +861,6 @@ if KERNEL_CGROUPS
 		  Memory Nodes and assigning tasks to run only within those sets.
 		  This is primarily useful on large SMP or NUMA systems.
 
-	config KERNEL_CPUSETS_V1
-		bool "Legacy cgroup v1 cpusets controller"
-		depends on KERNEL_CPUSETS
-		default n
-		help
-		  Legacy cgroup v1 cpusets controller which has been deprecated by
-		  cgroup v2 implementation. The v1 is there for legacy applications
-		  which haven't migrated to the new cgroup v2 interface yet. If you
-		  do not have any such application then you are completely fine leaving
-		  this option disabled.
-
 	config KERNEL_PROC_PID_CPUSET
 		bool "Include legacy /proc/<pid>/cpuset file"
 		depends on KERNEL_CPUSETS
@@ -975,10 +872,22 @@ if KERNEL_CGROUPS
 		  Provides a simple Resource Controller for monitoring the
 		  total CPU consumed by the tasks in a cgroup.
 
+	config KERNEL_RESOURCE_COUNTERS
+		bool "Resource counters"
+		default y
+		help
+		  This option enables controller independent resource accounting
+		  infrastructure that works with cgroups.
+
+	config KERNEL_MM_OWNER
+		bool
+		default y if KERNEL_MEMCG
+
 	config KERNEL_MEMCG
 		bool "Memory Resource Controller for Control Groups"
 		default y
 		select KERNEL_FREEZER
+		depends on KERNEL_RESOURCE_COUNTERS
 		help
 		  Provides a memory resource controller that manages both anonymous
 		  memory and page cache. (See Documentation/cgroups/memory.txt)
@@ -998,6 +907,40 @@ if KERNEL_CGROUPS
 		  This config option also selects MM_OWNER config option, which
 		  could in turn add some fork/exit overhead.
 
+	config KERNEL_MEMCG_SWAP
+		bool "Memory Resource Controller Swap Extension"
+		default y
+		depends on KERNEL_MEMCG
+		help
+		  Add swap management feature to memory resource controller. When you
+		  enable this, you can limit mem+swap usage per cgroup. In other words,
+		  when you disable this, memory resource controller has no cares to
+		  usage of swap...a process can exhaust all of the swap. This extension
+		  is useful when you want to avoid exhaustion swap but this itself
+		  adds more overheads and consumes memory for remembering information.
+		  Especially if you use 32bit system or small memory system, please
+		  be careful about enabling this. When memory resource controller
+		  is disabled by boot option, this will be automatically disabled and
+		  there will be no overhead from this. Even when you set this config=y,
+		  if boot option "swapaccount=0" is set, swap will not be accounted.
+		  Now, memory usage of swap_cgroup is 2 bytes per entry. If swap page
+		  size is 4096bytes, 512k per 1Gbytes of swap.
+
+	config KERNEL_MEMCG_SWAP_ENABLED
+		bool "Memory Resource Controller Swap Extension enabled by default"
+		depends on KERNEL_MEMCG_SWAP
+		help
+		  Memory Resource Controller Swap Extension comes with its price in
+		  a bigger memory consumption. General purpose distribution kernels
+		  which want to enable the feature but keep it disabled by default
+		  and let the user enable it by swapaccount boot command line
+		  parameter should have this option unselected.
+
+		  Those who want to have the feature enabled by default should
+		  select this option (if, for some reason, they need to disable it,
+		  then swapaccount=0 does the trick).
+
+
 	config KERNEL_MEMCG_KMEM
 		bool "Memory Resource Controller Kernel Memory accounting (EXPERIMENTAL)"
 		default y
@@ -1009,21 +952,6 @@ if KERNEL_CGROUPS
 		  Memory Controller, which are page-based, and can be swapped. Users of
 		  the kmem extension can use it to guarantee that no group of processes
 		  will ever exhaust kernel resources alone.
-	
-	config KERNEL_MEMCG_V1
-		bool "Legacy cgroup v1 memory controller"
-		default n
-		depends on KERNEL_MEMCG
-		help
-		  Legacy cgroup v1 memory controller which has been deprecated by
-		  cgroup v2 implementation. The v1 is there for legacy applications
-		  which haven't migrated to the new cgroup v2 interface yet. If you
-		  do not have any such application then you are completely fine leaving
-		  this option disabled.
-
-		  Please note that feature set of the legacy memory controller is likely
-		  going to shrink due to deprecation process. New deployments with v1
-		  controller are highly discouraged.
 
 	config KERNEL_CGROUP_PERF
 		bool "Enable perf_event per-cpu per-container group (cgroup) monitoring"
@@ -1168,6 +1096,16 @@ if KERNEL_NAMESPACES
 
 endif
 
+config KERNEL_DEVPTS_MULTIPLE_INSTANCES
+	bool "Support multiple instances of devpts"
+	default y if !SMALL_FLASH
+	help
+	  Enable support for multiple instances of devpts filesystem.
+	  If you want to have isolated PTY namespaces (eg: in containers),
+	  say Y here. Otherwise, say N. If enabled, each mount of devpts
+	  filesystem with the '-o newinstance' option will create an
+	  independent PTY namespace.
+
 config KERNEL_POSIX_MQUEUE
 	bool "POSIX Message Queues"
 	default y if !SMALL_FLASH
@@ -1274,29 +1212,6 @@ config KERNEL_NET_L3_MASTER_DEV
 	  drivers to support L3 master devices like VRF.
   	  Increases the compressed kernel size by ~4kB (as of Linux 6.6).
 
-config KERNEL_DCB
-	bool "Data Center Bridging support"
-	default y if TARGET_armsr_armv8
-	default y if TARGET_microchipsw
-	default y if TARGET_x86_64
-	help
-	  This enables support for configuring Data Center Bridging (DCB)
-	  features on DCB capable Ethernet adapters via rtnetlink.  Say 'Y'
-	  if you have a DCB capable Ethernet adapter which supports this
-	  interface and you are connected to a DCB capable switch.
-
-	  DCB is a collection of Ethernet enhancements which allow DCB capable
-	  NICs and switches to support network traffic with differing
-	  requirements (highly reliable, no drops vs. best effort vs. low
-	  latency) to co-exist on Ethernet.
-
-	  DCB features include:
-	    Enhanced Transmission Selection (aka Priority Grouping) - provides a
-	      framework for assigning bandwidth guarantees to traffic classes.
-	    Priority-based Flow Control (PFC) - a MAC control pause frame which
-	      works at the granularity of the 802.1p priority instead of the
-	      link (802.3x).
-
 config KERNEL_XDP_SOCKETS
 	bool "XDP sockets support"
 	help
@@ -1324,13 +1239,6 @@ config KERNEL_MPTCP_IPV6
 	default KERNEL_MPTCP
 endif
 
-config KERNEL_NF_CONNTRACK_TIMEOUT
-	bool "Per-connection connection tracking timeout"
-	default y if !SMALL_FLASH
-	help
-	   Select this option to enable support for per-connection conntrack timeouts.
-	   Increases the (uncompressed) size of nf_conntrack.ko by ~8kB.
-
 #
 # NFS related symbols
 #
@@ -1371,23 +1279,6 @@ config KERNEL_BTRFS_FS
 	  Say Y here if you want to make the kernel to be able to boot off a
 	  BTRFS partition.
 
-config KERNEL_EROFS_FS
-	bool "Compile the kernel with built-in EROFS support"
-	help
-	  Say Y here if you want to make the kernel to be able to boot off a
-	  EROFS partition.
-
-config KERNEL_EROFS_FS_XATTR
-	bool "EROFS XATTR support"
-
-config KERNEL_EROFS_FS_ZIP
-	bool
-	default y if KERNEL_EROFS_FS
-
-config KERNEL_EROFS_FS_ZIP_LZMA
-	bool
-	default y if KERNEL_EROFS_FS
-
 menu "Filesystem ACL and attr support options"
 	config USE_FS_ACL_ATTR
 		bool "Use filesystem ACL and attr support by default"
@@ -1408,11 +1299,6 @@ menu "Filesystem ACL and attr support options"
 		select KERNEL_FS_POSIX_ACL
 		default y if USE_FS_ACL_ATTR
 
-	config KERNEL_EROFS_FS_POSIX_ACL
-		bool "Enable POSIX ACL for EROFS Filesystems"
-		select KERNEL_FS_POSIX_ACL
-		default y if USE_FS_ACL_ATTR
-
 	config KERNEL_EXT4_FS_POSIX_ACL
 		bool "Enable POSIX ACL for Ext4 Filesystems"
 		select KERNEL_FS_POSIX_ACL
@@ -1485,6 +1371,13 @@ config KERNEL_DEVMEM
 	  The /dev/mem device is used to access areas of physical
 	  memory.
 
+config KERNEL_DEVKMEM
+	bool "/dev/kmem virtual device support"
+	help
+	  Say Y here if you want to support the /dev/kmem device. The
+	  /dev/kmem device is rarely used, but can be used for certain
+	  kind of kernel debugging operations.
+
 config KERNEL_SQUASHFS_FRAGMENT_CACHE_SIZE
 	int "Number of squashfs fragments cached"
 	default 2 if (SMALL_FLASH && !LOW_MEMORY_FOOTPRINT)
@@ -1535,6 +1428,10 @@ config KERNEL_SECURITY_SELINUX_BOOTPARAM
 	depends on KERNEL_SECURITY_SELINUX
 	default y
 
+config KERNEL_SECURITY_SELINUX_DISABLE
+	bool "NSA SELinux runtime disable"
+	depends on KERNEL_SECURITY_SELINUX
+
 config KERNEL_SECURITY_SELINUX_DEVELOP
 	bool "NSA SELinux Development Support"
 	depends on KERNEL_SECURITY_SELINUX
@@ -1555,11 +1452,6 @@ config KERNEL_LSM
 	default "lockdown,yama,loadpin,safesetid,integrity,selinux"
 	depends on KERNEL_SECURITY_SELINUX
 
-config KERNEL_EROFS_FS_SECURITY
-	bool "EROFS Security Labels"
-	default y if !SMALL_FLASH
-	select KERNEL_EROFS_FS_XATTR
-
 config KERNEL_EXT4_FS_SECURITY
 	bool "Ext4 Security Labels"
 	default y if !SMALL_FLASH
@@ -1589,72 +1481,3 @@ config KERNEL_WERROR
 	  and unusual warnings, or you have some architecture with problems,
 	  you may need to disable this config option in order to
 	  successfully build the kernel.
-
-choice
-	prompt "Preemption Model"
-	default KERNEL_PREEMPT_NONE
-
-config KERNEL_PREEMPT_NONE
-	bool "No Forced Preemption (Server)"
-	help
-	  This is the traditional Linux preemption model, geared towards
-	  throughput. It will still provide good latencies most of the
-	  time, but there are no guarantees and occasional longer delays
-	  are possible.
-
-	  Select this option if you are building a kernel for a server or
-	  scientific/computation system, or if you want to maximize the
-	  raw processing power of the kernel, irrespective of scheduling
-	  latencies.
-
-config KERNEL_PREEMPT_VOLUNTARY
-	bool "Voluntary Kernel Preemption (Desktop)"
-	help
-	  This option reduces the latency of the kernel by adding more
-	  "explicit preemption points" to the kernel code. These new
-	  preemption points have been selected to reduce the maximum
-	  latency of rescheduling, providing faster application reactions,
-	  at the cost of slightly lower throughput.
-
-	  This allows reaction to interactive events by allowing a
-	  low priority process to voluntarily preempt itself even if it
-	  is in kernel mode executing a system call. This allows
-	  applications to run more 'smoothly' even when the system is
-	  under load.
-
-	  Select this if you are building a kernel for a desktop system.
-
-config KERNEL_PREEMPT
-	bool "Preemptible Kernel (Low-Latency Desktop)"
-	help
-	  This option reduces the latency of the kernel by making
-	  all kernel code (that is not executing in a critical section)
-	  preemptible.  This allows reaction to interactive events by
-	  permitting a low priority process to be preempted involuntarily
-	  even if it is in kernel mode executing a system call and would
-	  otherwise not be about to reach a natural preemption point.
-	  This allows applications to run more 'smoothly' even when the
-	  system is under load, at the cost of slightly lower throughput
-	  and a slight runtime overhead to kernel code.
-
-	  Select this if you are building a kernel for a desktop or
-	  embedded system with latency requirements in the milliseconds
-	  range.
-
-config KERNEL_PREEMPT_RT
-	bool "Fully Preemptible Kernel (Real-Time)"
-	depends on (x86_64 || aarch64 || riscv64)
-	help
-	  This option turns the kernel into a real-time kernel by replacing
-	  various locking primitives (spinlocks, rwlocks, etc.) with
-	  preemptible priority-inheritance aware variants, enforcing
-	  interrupt threading and introducing mechanisms to break up long
-	  non-preemptible sections. This makes the kernel, except for very
-	  low level and critical code paths (entry code, scheduler, low
-	  level interrupt handling) fully preemptible and brings most
-	  execution contexts under scheduler control.
-
-	  Select this if you are building a kernel for systems which
-	  require real-time guarantees.
-
-endchoice

feeds.conf.default

@@ -1,8 +1,4 @@
-src-git packages https://git.openwrt.org/feed/packages.git
-src-git luci https://git.openwrt.org/project/luci.git
-src-git routing https://git.openwrt.org/feed/routing.git
-src-git telephony https://git.openwrt.org/feed/telephony.git
-src-git video https://github.com/openwrt/video.git
-#src-git targets https://github.com/openwrt/targets.git
-#src-git oldpackages http://git.openwrt.org/packages.git
-#src-link custom /usr/src/openwrt/custom-feed
+src-git packages https://git.openwrt.org/feed/packages.git^b5f11b79d2b0538d57103a8da05e7a7a87981ff3
+src-git luci https://git.openwrt.org/project/luci.git^094507c19372268d13679d2e6ad4325e08a333e2
+src-git routing https://git.openwrt.org/feed/routing.git^3f15699240c076d5ee9ed697fa5ef45355423f6f
+src-git telephony https://git.openwrt.org/feed/telephony.git^fd605af7143165a2490681ec1752f259873b9147

include/bpf.mk

@@ -1,40 +1,30 @@
-BPF_DEPENDS := @HAS_BPF_TOOLCHAIN +@NEED_BPF_TOOLCHAIN
+BPF_DEPENDS := @HAS_BPF_TOOLCHAIN
+LLVM_VER:=
 
 CLANG_MIN_VER:=12
 
 ifneq ($(CONFIG_USE_LLVM_HOST),)
-  find-llvm-tool=$(firstword $(shell PATH='$(BPF_PATH)' command -v $(1) || echo '$(firstword $(1))-not-found'))
-
   BPF_TOOLCHAIN_HOST_PATH:=$(call qstrip,$(CONFIG_BPF_TOOLCHAIN_HOST_PATH))
   ifneq ($(BPF_TOOLCHAIN_HOST_PATH),)
     BPF_PATH:=$(BPF_TOOLCHAIN_HOST_PATH)/bin:$(PATH)
   else
     BPF_PATH:=$(PATH)
   endif
-  CLANG:=$(call find-llvm-tool,clang clang-13 clang-12)
+  CLANG:=$(firstword $(shell PATH='$(BPF_PATH)' command -v clang clang-13 clang-12 clang-11))
   LLVM_VER:=$(subst clang,,$(notdir $(CLANG)))
-
-  BPF_PATH:=$(dir $(CLANG)):$(BPF_PATH)
-  LLVM_LLC:=$(call find-llvm-tool,llc$(LLVM_VER))
-  LLVM_DIS:=$(call find-llvm-tool,llvm-dis$(LLVM_VER))
-  LLVM_OPT:=$(call find-llvm-tool,opt$(LLVM_VER))
-  LLVM_STRIP:=$(call find-llvm-tool,llvm-strip$(LLVM_VER))
-else
-  LLVM_PATH:=/invalid
-
-  ifneq ($(CONFIG_USE_LLVM_PREBUILT),)
-    LLVM_PATH:=$(TOPDIR)/llvm-bpf/bin
-  endif
-  ifneq ($(CONFIG_USE_LLVM_BUILD),)
-    LLVM_PATH:=$(STAGING_DIR_HOST)/llvm-bpf/bin
-  endif
-
-  CLANG:=$(LLVM_PATH)/clang
-  LLVM_LLC:=$(LLVM_PATH)/llc
-  LLVM_DIS:=$(LLVM_PATH)/llvm-dis
-  LLVM_OPT:=$(LLVM_PATH)/opt
-  LLVM_STRIP:=$(LLVM_PATH)/llvm-strip
 endif
+ifneq ($(CONFIG_USE_LLVM_PREBUILT),)
+  CLANG:=$(TOPDIR)/llvm-bpf/bin/clang
+endif
+ifneq ($(CONFIG_USE_LLVM_BUILD),)
+  CLANG:=$(STAGING_DIR_HOST)/llvm-bpf/bin/clang
+endif
+
+LLVM_PATH:=$(dir $(CLANG))
+LLVM_LLC:=$(LLVM_PATH)/llc$(LLVM_VER)
+LLVM_DIS:=$(LLVM_PATH)/llvm-dis$(LLVM_VER)
+LLVM_OPT:=$(LLVM_PATH)/opt$(LLVM_VER)
+LLVM_STRIP:=$(LLVM_PATH)/llvm-strip$(LLVM_VER)
 
 BPF_KARCH:=mips
 BPF_ARCH:=mips$(if $(CONFIG_ARCH_64BIT),64)$(if $(CONFIG_BIG_ENDIAN),,el)

include/cmake.mk

@@ -89,15 +89,15 @@ endif
 define Build/Configure/Default
 	mkdir -p $(CMAKE_BINARY_DIR)
 	(cd $(CMAKE_BINARY_DIR); \
-		CFLAGS="$(TARGET_CFLAGS) $(EXTRA_CFLAGS) $(TARGET_CPPFLAGS) $(EXTRA_CPPFLAGS)" \
-		CXXFLAGS="$(TARGET_CXXFLAGS) $(EXTRA_CXXFLAGS) $(TARGET_CPPFLAGS) $(EXTRA_CPPFLAGS)" \
+		CFLAGS="$(TARGET_CFLAGS) $(EXTRA_CFLAGS)" \
+		CXXFLAGS="$(TARGET_CXXFLAGS) $(EXTRA_CXXFLAGS)" \
 		LDFLAGS="$(TARGET_LDFLAGS) $(EXTRA_LDFLAGS)" \
 		cmake \
 			--no-warn-unused-cli \
 			-DCMAKE_SYSTEM_NAME=Linux \
 			-DCMAKE_SYSTEM_VERSION=1 \
 			-DCMAKE_SYSTEM_PROCESSOR=$(ARCH) \
-			-DCMAKE_BUILD_TYPE=$(if $(CONFIG_DEBUG),RelWithDebInfo,Release) \
+			-DCMAKE_BUILD_TYPE=$(if $(CONFIG_DEBUG),Debug,Release) \
 			-DCMAKE_C_FLAGS_RELEASE="-DNDEBUG" \
 			-DCMAKE_CXX_FLAGS_RELEASE="-DNDEBUG" \
 			-DCMAKE_C_COMPILER_LAUNCHER="$(CMAKE_C_COMPILER_LAUNCHER)" \
@@ -113,7 +113,7 @@ define Build/Configure/Default
 			-DCMAKE_NM="$(CMAKE_NM)" \
 			-DCMAKE_RANLIB="$(CMAKE_RANLIB)" \
 			-DCMAKE_FIND_ROOT_PATH="$(CMAKE_FIND_ROOT_PATH)" \
-			-DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM=NEVER \
+			-DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM=BOTH \
 			-DCMAKE_FIND_ROOT_PATH_MODE_LIBRARY=ONLY \
 			-DCMAKE_FIND_ROOT_PATH_MODE_INCLUDE=ONLY \
 			-DCMAKE_STRIP=: \

include/default-packages.mk

@@ -1,5 +0,0 @@
-ifneq ($(CONFIG_USE_APK),)
-  DEFAULT_PACKAGES += apk-mbedtls
-else
-  DEFAULT_PACKAGES += opkg
-endif

include/download.mk

@@ -34,9 +34,11 @@ $(strip \
       $(if $(filter @OPENWRT @APACHE/% @DEBIAN/% @GITHUB/% @GNOME/% @GNU/% @KERNEL/% @SF/% @SAVANNAH/% ftp://% http://% https://% file://%,$(1)),default, \
         $(if $(filter git://%,$(1)),$(call dl_method_git,$(1),$(2)), \
           $(if $(filter svn://%,$(1)),svn, \
-            $(if $(filter hg://%,$(1)),hg, \
-              $(if $(filter sftp://%,$(1)),bzr, \
-                unknown \
+            $(if $(filter cvs://%,$(1)),cvs, \
+              $(if $(filter hg://%,$(1)),hg, \
+                $(if $(filter sftp://%,$(1)),bzr, \
+                  unknown \
+                ) \
               ) \
             ) \
           ) \
@@ -47,7 +49,7 @@ $(strip \
 )
 endef
 
-# code for creating tarballs from svn/git/bzr/hg/darcs checkouts - useful for mirror support
+# code for creating tarballs from cvs/svn/git/bzr/hg/darcs checkouts - useful for mirror support
 dl_pack/bz2=bzip2 -c > $(1)
 dl_pack/gz=gzip -nc > $(1)
 dl_pack/xz=xz -zc -7e > $(1)
@@ -152,23 +154,28 @@ endef
 # $(2): "PKG_" if <name> as in Download/<name> is "default", otherwise "Download/<name>:"
 # $(3): shell command sequence to do the download
 define wrap_mirror
-$(if $(if $(MIRROR), \
-	$(filter-out x,$(MIRROR_HASH))),$(SCRIPT_DIR)/download.pl "$(DL_DIR)" "$(FILE)" "$(MIRROR_HASH)" "" || \
-		( $(3) ) \
-		$(if $(filter-out x,$(MIRROR_HASH)), && ( \
-			file_hash="$$$$($(MKHASH) sha256 "$(DL_DIR)/$(FILE)")"; \
-			[ "$$$$file_hash" = "$(MIRROR_HASH)" ] || [ "$(MIRROR_HASH)" = "skip" ] || { \
-				echo "Hash mismatch for file $(FILE): expected $(MIRROR_HASH), got $$$$file_hash"; \
-				false; \
-			}; \
-		)),
-	$(3)) \
+$(if $(if $(MIRROR),$(filter-out x,$(MIRROR_HASH))),$(SCRIPT_DIR)/download.pl "$(DL_DIR)" "$(FILE)" "$(MIRROR_HASH)" "" || ( $(3) ),$(3)) \
 $(if $(filter check,$(1)), \
 	$(call check_hash,$(FILE),$(MIRROR_HASH),$(2)MIRROR_$(call hash_var,$(MIRROR_MD5SUM))) \
 	$(call check_md5,$(MIRROR_MD5SUM),$(2)MIRROR_MD5SUM,$(2)MIRROR_HASH) \
 )
 endef
 
+define DownloadMethod/cvs
+	$(call wrap_mirror,$(1),$(2), \
+		echo "Checking out files from the cvs repository..."; \
+		mkdir -p $(TMP_DIR)/dl && \
+		cd $(TMP_DIR)/dl && \
+		rm -rf $(SUBDIR) && \
+		[ \! -d $(SUBDIR) ] && \
+		cvs -d $(URL) export $(SOURCE_VERSION) $(SUBDIR) && \
+		echo "Packing checkout..." && \
+		$(call dl_tar_pack,$(TMP_DIR)/dl/$(FILE),$(SUBDIR)) && \
+		mv $(TMP_DIR)/dl/$(FILE) $(DL_DIR)/ && \
+		rm -rf $(SUBDIR); \
+	)
+endef
+
 define DownloadMethod/svn
 	$(call wrap_mirror,$(1),$(2), \
 		echo "Checking out files from the svn repository..."; \
@@ -221,13 +228,11 @@ define DownloadMethod/rawgit
 	[ \! -d $(SUBDIR) ] && \
 	git clone $(OPTS) $(URL) $(SUBDIR) && \
 	(cd $(SUBDIR) && git checkout $(SOURCE_VERSION)) && \
-	export TAR_TIMESTAMP=`cd $(SUBDIR) && git log -1 --no-show-signature --format='@%ct'` && \
+	export TAR_TIMESTAMP=`cd $(SUBDIR) && git log -1 --format='@%ct'` && \
 	echo "Generating formal git archive (apply .gitattributes rules)" && \
 	(cd $(SUBDIR) && git config core.abbrev 8 && \
 	git archive --format=tar HEAD --output=../$(SUBDIR).tar.git) && \
-	$(if $(filter skip,$(SUBMODULES)),true, \
-		$(TAR) --numeric-owner --owner=0 --group=0 --ignore-failed-read -C $(SUBDIR) -f $(SUBDIR).tar.git -r .git .gitmodules 2>/dev/null \
-	) && \
+	$(if $(filter skip,$(SUBMODULES)),true,$(TAR) --ignore-failed-read -C $(SUBDIR) -f $(SUBDIR).tar.git -r .git .gitmodules 2>/dev/null) && \
 	rm -rf $(SUBDIR) && mkdir $(SUBDIR) && \
 	$(TAR) -C $(SUBDIR) -xf $(SUBDIR).tar.git && \
 	(cd $(SUBDIR) && $(if $(filter skip,$(SUBMODULES)),true,git submodule update --init --recursive -- $(SUBMODULES) && \
@@ -288,6 +293,7 @@ define DownloadMethod/darcs
 	)
 endef
 
+Validate/cvs=SOURCE_VERSION SUBDIR
 Validate/svn=SOURCE_VERSION SUBDIR
 Validate/git=SOURCE_VERSION SUBDIR
 Validate/bzr=SOURCE_VERSION SUBDIR

include/feeds.mk

@@ -20,7 +20,7 @@ opkg_package_files = $(wildcard \
 
 apk_package_files = $(wildcard \
 	$(foreach dir,$(PACKAGE_SUBDIRS), \
-	  $(foreach pkg,$(1), $(dir)/$(pkg)-*.apk)))
+	  $(foreach pkg,$(1), $(dir)/$(pkg)_*.apk)))
 
 # 1: package name
 define FeedPackageDir
@@ -37,7 +37,7 @@ define FeedSourcesAppendOPKG
   echo 'src/gz %d_core %U/targets/%S/packages'; \
   $(strip $(if $(CONFIG_PER_FEED_REPO), \
 	echo 'src/gz %d_base %U/packages/%A/base'; \
-	$(if $(CONFIG_BUILDBOT), \
+	$(if $(filter %SNAPSHOT-y,$(VERSION_NUMBER)-$(CONFIG_BUILDBOT)), \
 		echo 'src/gz %d_kmods %U/targets/%S/kmods/$(LINUX_VERSION)-$(LINUX_RELEASE)-$(LINUX_VERMAGIC)';) \
 	$(foreach feed,$(FEEDS_AVAILABLE), \
 		$(if $(CONFIG_FEED_$(feed)), \
@@ -51,7 +51,7 @@ define FeedSourcesAppendAPK
   echo '%U/targets/%S/packages/packages.adb'; \
   $(strip $(if $(CONFIG_PER_FEED_REPO), \
 	echo '%U/packages/%A/base/packages.adb'; \
-	$(if $(CONFIG_BUILDBOT), \
+	$(if $(filter %SNAPSHOT-y,$(VERSION_NUMBER)-$(CONFIG_BUILDBOT)), \
 		echo '%U/targets/%S/kmods/$(LINUX_VERSION)-$(LINUX_RELEASE)-$(LINUX_VERMAGIC)/packages.adb';) \
 	$(foreach feed,$(FEEDS_AVAILABLE), \
 		$(if $(CONFIG_FEED_$(feed)), \

include/hardening.mk

@@ -8,8 +8,6 @@ PKG_ASLR_PIE_REGULAR ?= 0
 PKG_SSP ?= 1
 PKG_FORTIFY_SOURCE ?= 1
 PKG_RELRO ?= 1
-PKG_DT_RELR ?= 1
-PKG_FANALYZER ?= 0
 
 ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY
   ifeq ($(strip $(PKG_CHECK_FORMAT_SECURITY)),1)
@@ -53,11 +51,6 @@ ifdef CONFIG_PKG_FORTIFY_SOURCE_2
     TARGET_CFLAGS += -D_FORTIFY_SOURCE=2
   endif
 endif
-ifdef CONFIG_PKG_FORTIFY_SOURCE_3
-  ifeq ($(strip $(PKG_FORTIFY_SOURCE)),1)
-    TARGET_CFLAGS += -D_FORTIFY_SOURCE=3
-  endif
-endif
 ifdef CONFIG_PKG_RELRO_PARTIAL
   ifeq ($(strip $(PKG_RELRO)),1)
     TARGET_CFLAGS += -Wl,-z,relro
@@ -71,15 +64,3 @@ ifdef CONFIG_PKG_RELRO_FULL
   endif
 endif
 
-ifdef CONFIG_PKG_DT_RELR
-  ifeq ($(strip $(PKG_DT_RELR)),1)
-    TARGET_CFLAGS += -Wl,-z,pack-relative-relocs
-    TARGET_LDFLAGS += -zpack-relative-relocs
-  endif
-endif
-
-ifdef CONFIG_PKG_FANALYZER
-  ifeq ($(strip $(PKG_FANALYZER)),1)
-    TARGET_CFLAGS +=  -fanalyzer
-  endif
-endif

include/image-commands.mk

@@ -99,64 +99,6 @@ define Build/append-metadata
 	}
 endef
 
-metadata_gl_json = \
-	'{ $(if $(IMAGE_METADATA),$(IMAGE_METADATA)$(comma)) \
-		"metadata_version": "1.1", \
-		"compat_version": "$(call json_quote,$(compat_version))", \
-		$(if $(DEVICE_COMPAT_MESSAGE),"compat_message": "$(call json_quote,$(DEVICE_COMPAT_MESSAGE))"$(comma)) \
-		$(if $(filter-out 1.0,$(compat_version)),"new_supported_devices": \
-			[$(call metadata_devices,$(SUPPORTED_DEVICES))]$(comma) \
-			"supported_devices": ["$(call json_quote,$(legacy_supported_message))"]$(comma)) \
-		$(if $(filter 1.0,$(compat_version)),"supported_devices":[$(call metadata_devices,$(SUPPORTED_DEVICES))]$(comma)) \
-		"version": { \
-			"release": "$(call json_quote,$(VERSION_NUMBER))", \
-			"date": "$(shell TZ='Asia/Chongqing' date '+%Y%m%d%H%M%S')", \
-			"dist": "$(call json_quote,$(VERSION_DIST))", \
-			"version": "$(call json_quote,$(VERSION_NUMBER))", \
-			"revision": "$(call json_quote,$(REVISION))", \
-			"target": "$(call json_quote,$(TARGETID))", \
-			"board": "$(call json_quote,$(if $(BOARD_NAME),$(BOARD_NAME),$(DEVICE_NAME)))" \
-		} \
-	}'
-
-define Build/append-gl-metadata
-	$(if $(SUPPORTED_DEVICES),-echo $(call metadata_gl_json,$(SUPPORTED_DEVICES)) | fwtool -I - $@)
-	sha256sum "$@" | cut -d" " -f1 > "$@.sha256sum"
-	[ ! -s "$(BUILD_KEY)" -o ! -s "$(BUILD_KEY).ucert" -o ! -s "$@" ] || { \
-		cp "$(BUILD_KEY).ucert" "$@.ucert" ;\
-		usign -S -m "$@" -s "$(BUILD_KEY)" -x "$@.sig" ;\
-		ucert -A -c "$@.ucert" -x "$@.sig" ;\
-		fwtool -S "$@.ucert" "$@" ;\
-	}
-endef
-
-define Build/append-teltonika-metadata
-	echo \
-		'{$(if $(IMAGE_METADATA),$(IMAGE_METADATA)$(comma)) \
-			"metadata_version": "1.1", \
-			"compat_version": "$(call json_quote,$(compat_version))", \
-			"version":"$(call json_quote,$(VERSION_DIST))-$(call json_quote,$(VERSION_NUMBER))-$(call json_quote,$(REVISION))", \
-			"device_code": [".*"], \
-			"hwver": [".*"], \
-			"batch": [".*"], \
-			"serial": [".*"], \
-			$(if $(DEVICE_COMPAT_MESSAGE),"compat_message": "$(call json_quote,$(DEVICE_COMPAT_MESSAGE))"$(comma)) \
-			$(if $(filter-out 1.0,$(compat_version)),"new_supported_devices": \
-				[$(call metadata_devices,$(SUPPORTED_TELTONIKA_DEVICES))]$(comma) \
-				"supported_devices": ["$(call json_quote,$(legacy_supported_message))"]$(comma)) \
-			$(if $(filter 1.0,$(compat_version)),"supported_devices":[$(call metadata_devices,$(SUPPORTED_TELTONIKA_DEVICES))]$(comma)) \
-			"version_wrt": { \
-			"dist": "$(call json_quote,$(VERSION_DIST))", \
-			"version": "$(call json_quote,$(VERSION_NUMBER))", \
-			"revision": "$(call json_quote,$(REVISION))", \
-			"target": "$(call json_quote,$(TARGETID))", \
-			"board": "$(call json_quote,$(if $(BOARD_NAME),$(BOARD_NAME),$(DEVICE_NAME)))" \
-		}, \
-			"hw_support": {}, \
-			"hw_mods": {$(shell i=1; for mod in $(SUPPORTED_TELTONIKA_HW_MODS); do [ $$i -gt 1 ] && echo -n ,; echo -n "\"mod$$i\": \"$$mod\""; i=$$((i+1)); done)} \
-		}' | fwtool -I - $@
-endef
-
 define Build/append-rootfs
 	dd if=$(IMAGE_ROOTFS) >> $@
 endef
@@ -430,11 +372,8 @@ define Build/initrd_compression
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_ZSTD),.zstd)
 endef
 
-define Build/fit-its
-	$(if $(findstring with-rootfs,$(word 3,$(1))), \
-		$(call locked,dd if=$(IMAGE_ROOTFS) of=$(IMAGE_ROOTFS).pagesync bs=4096 conv=sync, \
-		  gen-cpio$(if $(TARGET_PER_DEVICE_ROOTFS),.$(ROOTFS_ID/$(DEVICE_NAME)))))
-	$(TOPDIR)/scripts/mkits.sh \
+define Build/fit
+	$(call locked,$(TOPDIR)/scripts/mkits.sh \
 		-D $(DEVICE_NAME) -o $@.its -k $@ \
 		-C $(word 1,$(1)) \
 		$(if $(word 2,$(1)),\
@@ -451,21 +390,12 @@ define Build/fit-its
 		$(if $(DEVICE_DTS_LOADADDR),-s $(DEVICE_DTS_LOADADDR)) \
 		$(if $(DEVICE_DTS_OVERLAY),$(foreach dtso,$(DEVICE_DTS_OVERLAY), -O $(dtso):$(KERNEL_BUILD_DIR)/image-$(dtso).dtbo)) \
 		-c $(if $(DEVICE_DTS_CONFIG),$(DEVICE_DTS_CONFIG),"config-1") \
-		-A $(LINUX_KARCH) -v $(LINUX_VERSION)
-endef
-
-define Build/fit-image
-	$(call locked,PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage $(if $(findstring external,$(word 3,$(1))),\
-		-E -B 0x1000 $(if $(findstring static,$(word 3,$(1))),-p 0x1000)) -f $@.its $@.new, \
-	  gen-cpio$(if $(TARGET_PER_DEVICE_ROOTFS),.$(ROOTFS_ID/$(DEVICE_NAME))))
+		-A $(LINUX_KARCH) -v $(LINUX_VERSION), gen-cpio$(if $(TARGET_PER_DEVICE_ROOTFS),.$(ROOTFS_ID/$(DEVICE_NAME))))
+	PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage $(if $(findstring external,$(word 3,$(1))),\
+		-E -B 0x1000 $(if $(findstring static,$(word 3,$(1))),-p 0x1000)) -f $@.its $@.new
 	@mv $@.new $@
 endef
 
-define Build/fit
-	$(call Build/fit-its,$(1))
-	$(call Build/fit-image,$(1))
-endef
-
 define Build/libdeflate-gzip
 	$(STAGING_DIR_HOST)/bin/libdeflate-gzip -f -12 -c $@ $(1) > $@.new
 	@mv $@.new $@
@@ -508,14 +438,13 @@ endef
 
 define Build/jffs2
 	rm -rf $(KDIR_TMP)/$(DEVICE_NAME)/jffs2 && \
-		mkdir -p $(KDIR_TMP)/$(DEVICE_NAME)/jffs2/$$(dirname $(word 1,$(1))) && \
-		cp $@ $(KDIR_TMP)/$(DEVICE_NAME)/jffs2/$(word 1,$(1)) && \
+		mkdir -p $(KDIR_TMP)/$(DEVICE_NAME)/jffs2/$$(dirname $(1)) && \
+		cp $@ $(KDIR_TMP)/$(DEVICE_NAME)/jffs2/$(1) && \
 		$(STAGING_DIR_HOST)/bin/mkfs.jffs2 --pad \
 			$(if $(CONFIG_BIG_ENDIAN),--big-endian,--little-endian) \
 			--squash-uids -v -e $(patsubst %k,%KiB,$(BLOCKSIZE)) \
 			-o $@.new \
 			-d $(KDIR_TMP)/$(DEVICE_NAME)/jffs2 \
-			$(wordlist 2,$(words $(1)),$(1)) \
 			2>&1 1>/dev/null | awk '/^.+$$$$/' && \
 		$(STAGING_DIR_HOST)/bin/padjffs2 $@.new -J $(patsubst %k,,$(BLOCKSIZE))
 	-rm -rf $(KDIR_TMP)/$(DEVICE_NAME)/jffs2/
@@ -531,7 +460,7 @@ define Build/yaffs-filesystem
 		filesystem_size="filesystem_blocks * 64 * 1024" \
 		filesystem_size_with_reserve="(filesystem_blocks + 2) * 64 * 1024"; \
 		head -c $$filesystem_size_with_reserve /dev/zero | tr "\000" "\377" > $@.img \
-		&& yafut -d $@.img -w -i $@ -o $(if $(findstring v7,$@),bootimage,kernel) -C 1040 -B 64k -E -P -S $(1) \
+		&& yafut -d $@.img -w -i $@ -o kernel -C 1040 -B 64k -E -P -S $(1) \
 		&& truncate -s $$filesystem_size $@.img \
 		&& mv $@.img $@
 endef
@@ -541,39 +470,6 @@ define Build/kernel-bin
 	cp $< $@
 endef
 
-define Build/gl-qsdk-factory
-	$(eval GL_NAME := $(call param_get_default,type,$(1),$(DEVICE_NAME)))
-	$(eval GL_IMGK := $(KDIR_TMP)/$(DEVICE_IMG_PREFIX)-squashfs-factory.img)
-	$(eval GL_ITS := $(KDIR_TMP)/$(GL_NAME).its)
-	$(eval GL_UBI := "ubi")
-
-	$(CP) $(BOOT_SCRIPT) $(KDIR_TMP)/
-	$(shell mv $(GL_IMGK) $(GL_IMGK).tmp)
-
-	sed -i "s/rootfs_size/`wc -c $(GL_IMGK) | \
-	cut -d " " -f 1 | xargs printf "0x%x"`/g" $(KDIR_TMP)/$(BOOT_SCRIPT);
-
-	$(TOPDIR)/scripts/mkits-qsdk-ipq-image.sh \
-		$(GL_ITS) \
-		$(BOOT_SCRIPT) \
-		$(GL_UBI) \
-		$(GL_IMGK)
-
-	PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage -f \
-		$(GL_ITS) \
-		$(GL_IMGK)
-
-	$(RM) \
-		$(GL_ITS) \
-		$(GL_IMGK).tmp \
-		$(KDIR_TMP)/$(notdir $(BOOT_SCRIPT))
-endef
-
-define Build/kernel-pack-npk
-	$(STAGING_DIR_HOST)/bin/npk_pack_kernel $@ $@.npk
-	mv $@.npk $@
-endef
-
 define Build/linksys-image
 	let \
 		size="$$(stat -c%s $@)" \
@@ -652,19 +548,6 @@ define Build/openmesh-image
 		"$(call param_get_default,rootfs,$(1),$@)" "rootfs"
 endef
 
-define Build/dualboot-datachk-nand-image
-	$(TOPDIR)/scripts/nand-fwupgradecfg-gen.sh \
-		"$(call param_get_default,ce_type,$(1),$(DEVICE_NAME))" \
-		"$@-fwupgrade.cfg" \
-		"$(call param_get_default,kernel,$(1),$(IMAGE_KERNEL))" \
-		"$(call param_get_default,rootfs,$(1),$@)"
-	$(TOPDIR)/scripts/combined-ext-image.sh \
-		"$(call param_get_default,ce_type,$(1),$(DEVICE_NAME))" "$@" \
-		"$@-fwupgrade.cfg" "fwupgrade.cfg" \
-		"$(call param_get_default,kernel,$(1),$(IMAGE_KERNEL))" "kernel" \
-		"$(call param_get_default,rootfs,$(1),$@)" "rootfs"
-endef
-
 define Build/pad-extra
 	dd if=/dev/zero bs=$(1) count=1 >> $@
 endef
@@ -736,23 +619,13 @@ define Build/senao-header
 endef
 
 define Build/sysupgrade-tar
-	$(eval dtb=$(call param_get,dtb,$(1)))
 	sh $(TOPDIR)/scripts/sysupgrade-tar.sh \
 		--board $(if $(BOARD_NAME),$(BOARD_NAME),$(DEVICE_NAME)) \
 		--kernel $(call param_get_default,kernel,$(1),$(IMAGE_KERNEL)) \
 		--rootfs $(call param_get_default,rootfs,$(1),$(IMAGE_ROOTFS)) \
-		$(if $(dtb),--dtb $(dtb)) \
 		$@
 endef
 
-define Build/tplink-image-2022
-	$(TOPDIR)/scripts/tplink-mkimage-2022.py  \
-		--create $@.new \
-		--rootfs $@ \
-		--support "$(TPLINK_SUPPORT_STRING)"
-	@mv $@.new $@
-endef
-
 define Build/tplink-safeloader
 	-$(STAGING_DIR_HOST)/bin/tplink-safeloader \
 		-B $(TPLINK_BOARD_ID) \
@@ -859,10 +732,6 @@ define Build/zip
 	rm -rf $@.tmp
 endef
 
-define Build/zyimage
-	$(STAGING_DIR_HOST)/bin/zyimage $(1) $@
-endef
-
 define Build/zyxel-ras-image
 	let \
 		newsize="$(call exp_units,$(RAS_ROOTFS_SIZE))"; \

include/image.mk

@@ -41,9 +41,6 @@ KDIR=$(KERNEL_BUILD_DIR)
 KDIR_TMP=$(KDIR)/tmp
 DTS_DIR:=$(LINUX_DIR)/arch/$(LINUX_KARCH)/boot/dts
 
-ifeq ($(EXTRA_IMAGE_NAME),)
-EXTRA_IMAGE_NAME:=$(call qstrip,$(CONFIG_EXTRA_IMAGE_NAME))
-endif
 IMG_PREFIX_EXTRA:=$(if $(EXTRA_IMAGE_NAME),$(call sanitize,$(EXTRA_IMAGE_NAME))-)
 IMG_PREFIX_VERNUM:=$(if $(CONFIG_VERSION_FILENAMES),$(call sanitize,$(VERSION_NUMBER))-)
 IMG_PREFIX_VERCODE:=$(if $(CONFIG_VERSION_CODE_FILENAMES),$(call sanitize,$(VERSION_CODE))-)
@@ -89,8 +86,6 @@ SQUASHFS_BLOCKSIZE := $(CONFIG_TARGET_SQUASHFS_BLOCK_SIZE)k
 SQUASHFSOPT := -b $(SQUASHFS_BLOCKSIZE)
 SQUASHFSOPT += -p '/dev d 755 0 0' -p '/dev/console c 600 0 0 5 1'
 SQUASHFSOPT += $(if $(CONFIG_SELINUX),-xattrs,-no-xattrs)
-SQUASHFSOPT += -block-readers $(CONFIG_TARGET_SQUASHFS_BLOCK_READERS)
-SQUASHFSOPT += -small-readers $(CONFIG_TARGET_SQUASHFS_SMALL_READERS)
 SQUASHFSCOMP := gzip
 LZMA_XZ_OPTIONS := -Xpreset 9 -Xe -Xlc 0 -Xlp 2 -Xpb 2
 ifeq ($(CONFIG_SQUASHFS_XZ),y)
@@ -102,22 +97,11 @@ endif
 
 JFFS2_BLOCKSIZE ?= 64k 128k
 
-EROFS_PCLUSTERSIZE = $(shell echo $$(($(CONFIG_TARGET_EROFS_PCLUSTER_SIZE)*1024)))
-EROFSOPT := -Efragments,dedupe,ztailpacking -Uclear --all-root
-EROFSOPT += $(if $(SOURCE_DATE_EPOCH),-T$(SOURCE_DATE_EPOCH) --ignore-mtime)
-EROFSOPT += $(if $(CONFIG_SELINUX),,-x-1)
-EROFSCOMP := lz4hc,12
-ifeq ($(CONFIG_EROFS_FS_ZIP_LZMA),y)
-EROFSCOMP := lzma,109
-endif
-
 fs-types-$(CONFIG_TARGET_ROOTFS_SQUASHFS) += squashfs
 fs-types-$(CONFIG_TARGET_ROOTFS_JFFS2) += $(addprefix jffs2-,$(JFFS2_BLOCKSIZE))
 fs-types-$(CONFIG_TARGET_ROOTFS_JFFS2_NAND) += $(addprefix jffs2-nand-,$(NAND_BLOCKSIZE))
 fs-types-$(CONFIG_TARGET_ROOTFS_EXT4FS) += ext4
 fs-types-$(CONFIG_TARGET_ROOTFS_UBIFS) += ubifs
-fs-types-$(CONFIG_TARGET_ROOTFS_EROFS) += erofs
-fs-types-$(CONFIG_TARGET_ROOTFS_TARGZ) += targz
 fs-subtypes-$(CONFIG_TARGET_ROOTFS_JFFS2) += $(addsuffix -raw,$(addprefix jffs2-,$(JFFS2_BLOCKSIZE)))
 
 TARGET_FILESYSTEMS := $(fs-types-y)
@@ -323,23 +307,10 @@ define Image/mkfs/ext4
 		$@ $(call mkfs_target_dir,$(1))/
 endef
 
-# Don't use the mkfs.erofs builtin $SOURCE_DATE_EPOCH behavior
-define Image/mkfs/erofs
-	env -u SOURCE_DATE_EPOCH $(STAGING_DIR_HOST)/bin/mkfs.erofs -z$(EROFSCOMP) \
-		-C$(EROFS_PCLUSTERSIZE) $(EROFSOPT) \
-		$@ $(call mkfs_target_dir,$(1))
-endef
-
-define Image/mkfs/targz
-	$(TAR) -cp --numeric-owner --owner=0 --group=0 --mode=a-s --sort=name \
-		$(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") \
-		-C $(call mkfs_target_dir,$(1)) . | gzip -9n > $@
-endef
-
 define Image/Manifest
 	$(if $(CONFIG_USE_APK), \
 		$(call apk,$(TARGET_DIR_ORIG)) list --quiet --manifest --no-network \
-			--repositories-file /dev/null | sort | sed 's/ / - /'  > \
+			--repositories-file /dev/zero | sort | sed 's/ / - /'  > \
 			$(BIN_DIR)/$(IMG_PREFIX)$(if $(PROFILE_SANITIZED),-$(PROFILE_SANITIZED)).manifest, \
 		$(call opkg,$(TARGET_DIR_ORIG)) list-installed > \
 			$(BIN_DIR)/$(IMG_PREFIX)$(if $(PROFILE_SANITIZED),-$(PROFILE_SANITIZED)).manifest \
@@ -394,17 +365,19 @@ opkg_target = \
 
 apk_target = \
 	$(call apk,$(mkfs_cur_target_dir)) --no-scripts \
-		--repositories-file /dev/null --repository file://$(PACKAGE_DIR_ALL)/packages.adb
+		--repositories-file /dev/zero --repository file://$(PACKAGE_DIR_ALL)/packages.adb
 
 
 target-dir-%: FORCE
 ifneq ($(CONFIG_USE_APK),)
 	rm -rf $(mkfs_cur_target_dir)
 	$(CP) $(TARGET_DIR_ORIG) $(mkfs_cur_target_dir)
+	mv $(mkfs_cur_target_dir)/etc/apk/repositories $(mkfs_cur_target_dir).repositories
 	$(if $(mkfs_packages_remove), \
-		-$(apk_target) del $(mkfs_packages_remove))
+		$(apk_target) del $(mkfs_packages_remove))
 	$(if $(mkfs_packages_add), \
 		$(apk_target) add $(mkfs_packages_add))
+	mv $(mkfs_cur_target_dir).repositories $(mkfs_cur_target_dir)/etc/apk/repositories
 else
 	rm -rf $(mkfs_cur_target_dir) $(mkfs_cur_target_dir).opkg
 	$(CP) $(TARGET_DIR_ORIG) $(mkfs_cur_target_dir)
@@ -596,15 +569,7 @@ endef
 
 define Device/Check/Common
   _PROFILE_SET = $$(strip $$(foreach profile,$$(PROFILES) DEVICE_$(1),$$(call DEVICE_CHECK_PROFILE,$$(profile))))
-  # Check if device is disabled and if so do not mark to be installed when ImageBuilder is used
-  ifeq ($(IB),1)
-    ifeq ($$(DEFAULT),n)
-      _PROFILE_SET :=
-    endif
-    ifeq ($$(BROKEN),y)
-      _PROFILE_SET :=
-    endif
-  endif
+  DEVICE_PACKAGES += $$(call extra_packages,$$(DEVICE_PACKAGES))
   ifdef TARGET_PER_DEVICE_ROOTFS
     $$(eval $$(call merge_packages,_PACKAGES,$$(DEVICE_PACKAGES) $$(call DEVICE_EXTRA_PACKAGES,$(1))))
     ROOTFS_ID/$(1) := $$(if $$(_PROFILE_SET),$$(call mkfs_packages_id,$$(_PACKAGES)))
@@ -684,8 +649,6 @@ define Device/Build/initramfs
 	VERSION_NUMBER="$(VERSION_NUMBER)" \
 	VERSION_CODE="$(VERSION_CODE)" \
 	SUPPORTED_DEVICES="$$(SUPPORTED_DEVICES)" \
-	KERNEL_SIZE="$$(KERNEL_SIZE)" \
-	IMAGE_SIZE="$$(IMAGE_SIZE)" \
 	$(TOPDIR)/scripts/json_add_image_info.py $$@
 endef
 endif
@@ -820,8 +783,6 @@ define Device/Build/image
 	VERSION_NUMBER="$(VERSION_NUMBER)" \
 	VERSION_CODE="$(VERSION_CODE)" \
 	SUPPORTED_DEVICES="$(SUPPORTED_DEVICES)" \
-	KERNEL_SIZE="$(KERNEL_SIZE)" \
-	IMAGE_SIZE="$(IMAGE_SIZE)" \
 	$(TOPDIR)/scripts/json_add_image_info.py $$@
 
 endef
@@ -876,8 +837,6 @@ define Device/Build/artifact
 	VERSION_NUMBER="$(VERSION_NUMBER)" \
 	VERSION_CODE="$(VERSION_CODE)" \
 	SUPPORTED_DEVICES="$(SUPPORTED_DEVICES)" \
-	KERNEL_SIZE="$(KERNEL_SIZE)" \
-	IMAGE_SIZE="$(IMAGE_SIZE)" \
 	$(TOPDIR)/scripts/json_add_image_info.py $$@
 
 endef

include/kernel-6.6

@@ -0,0 +1,2 @@
+LINUX_VERSION-6.6 = .63
+LINUX_KERNEL_HASH-6.6.63 = d1054ab4803413efe2850f50f1a84349c091631ec50a1cf9e891d1b1f9061835

include/kernel-defaults.mk

@@ -25,6 +25,7 @@ ifeq ($(strip $(CONFIG_EXTERNAL_KERNEL_TREE)),"")
     define Kernel/Prepare/Default
 	$(LINUX_CAT) $(DL_DIR)/$(LINUX_SOURCE) | $(TAR) -C $(KERNEL_BUILD_DIR) $(TAR_OPTIONS)
 	$(Kernel/Patch)
+	$(if $(QUILT),touch $(LINUX_DIR)/.quilt_used)
     endef
   else
     define Kernel/Prepare/Default
@@ -174,6 +175,7 @@ define Kernel/PrepareConfigPerRootfs
 		[ ! -d "$(1)" ] || rm -rf $(1); \
 		mkdir $(1) && $(CP) -T $(LINUX_DIR) $(1); \
 		touch $(1)/.config; \
+		rm -rf $(1)/usr/initramfs_data.cpio*; \
 	}
 endef
 
@@ -188,7 +190,6 @@ define Kernel/CompileImage/Initramfs
 		$(call Kernel/Configure/Initramfs,$(if $(1),$(1),$(TARGET_DIR)),$(LINUX_DIR)$(2)); \
 		$(CP) $(GENERIC_PLATFORM_DIR)/other-files/init $(if $(1),$(1),$(TARGET_DIR))/init; \
 		$(if $(SOURCE_DATE_EPOCH),touch -hcd "@$(SOURCE_DATE_EPOCH)" $(if $(1),$(1),$(TARGET_DIR)) $(if $(1),$(1),$(TARGET_DIR))/init;) \
-		rm -rf $(LINUX_DIR)$(2)/usr/initramfs_data.cpio*; \
 		$(if $(CONFIG_TARGET_ROOTFS_INITRAMFS_SEPARATE), \
 			$(call locked,{ \
 				$(if $(call qstrip,$(CONFIG_EXTERNAL_CPIO)), \

include/kernel-version.mk

@@ -6,7 +6,7 @@ ifdef CONFIG_TESTING_KERNEL
   KERNEL_PATCHVER:=$(KERNEL_TESTING_PATCHVER)
 endif
 
-KERNEL_DETAILS_FILE=$(GENERIC_PLATFORM_DIR)/kernel-$(KERNEL_PATCHVER)
+KERNEL_DETAILS_FILE=$(INCLUDE_DIR)/kernel-$(KERNEL_PATCHVER)
 ifeq ($(wildcard $(KERNEL_DETAILS_FILE)),)
   $(error Missing kernel version/hash file for $(KERNEL_PATCHVER). Please create $(KERNEL_DETAILS_FILE))
 endif
@@ -14,7 +14,7 @@ endif
 include $(KERNEL_DETAILS_FILE)
 
 ifdef KERNEL_TESTING_PATCHVER
-  KERNEL_TESTING_DETAILS_FILE=$(GENERIC_PLATFORM_DIR)/kernel-$(KERNEL_TESTING_PATCHVER)
+  KERNEL_TESTING_DETAILS_FILE=$(INCLUDE_DIR)/kernel-$(KERNEL_TESTING_PATCHVER)
   ifeq ($(wildcard $(KERNEL_TESTING_DETAILS_FILE)),)
     $(error Missing kernel version/hash file for $(KERNEL_TESTING_PATCHVER). Please create $(KERNEL_TESTING_DETAILS_FILE))
   endif

include/kernel.mk

@@ -212,8 +212,9 @@ define KernelPackage
     TITLE:=$(TITLE)
     SECTION:=kernel
     CATEGORY:=Kernel modules
-    EXTRA_DEPENDS:=kernel (=$(subst -rc,_rc,$(LINUX_VERSION))~$(LINUX_VERMAGIC)-r$(LINUX_RELEASE))
-    VERSION:=$(subst -rc,_rc,$(LINUX_VERSION))$(if $(PKG_VERSION),.$(PKG_VERSION))-r$(if $(PKG_RELEASE),$(PKG_RELEASE),$(LINUX_RELEASE))
+    DESCRIPTION:=$(DESCRIPTION)
+    EXTRA_DEPENDS:=kernel (=$(LINUX_VERSION)~$(LINUX_VERMAGIC)-r$(LINUX_RELEASE))
+    VERSION:=$(LINUX_VERSION)$(if $(PKG_VERSION),.$(PKG_VERSION))-r$(if $(PKG_RELEASE),$(PKG_RELEASE),$(LINUX_RELEASE))
     PKGFLAGS:=$(PKGFLAGS)
     $(call KernelPackage/$(1))
     $(call KernelPackage/$(1)/$(BOARD))
@@ -305,3 +306,4 @@ kernel_patchver_ge=$(call kernel_version_cmp,-ge,$(KERNEL_PATCHVER),$(1))
 kernel_patchver_eq=$(call kernel_version_cmp,-eq,$(KERNEL_PATCHVER),$(1))
 kernel_patchver_le=$(call kernel_version_cmp,-le,$(KERNEL_PATCHVER),$(1))
 kernel_patchver_lt=$(call kernel_version_cmp,-lt,$(KERNEL_PATCHVER),$(1))
+

include/meson.mk

@@ -55,14 +55,8 @@ else
 MESON_CPU:="$(CPU_TYPE)$(if $(CPU_SUBTYPE),+$(CPU_SUBTYPE))"
 endif
 
-ifeq ($(MESON_USE_STAGING_PYTHON),)
-PYTHON_BIN:=$(STAGING_DIR_HOST)/bin/$(PYTHON)
-else
-PYTHON_BIN:=$(STAGING_DIR_HOSTPKG)/bin/$(PYTHON)
-endif
-
 define Meson
-	$(2) $(PYTHON_BIN) $(STAGING_DIR_HOST)/bin/meson.py $(1)
+	$(2) $(STAGING_DIR_HOST)/bin/$(PYTHON) $(STAGING_DIR_HOST)/bin/meson.py $(1)
 endef
 
 define Meson/CreateNativeFile
@@ -71,7 +65,7 @@ define Meson/CreateNativeFile
 		-e "s|@CXX@|$(foreach BIN,$(HOSTCXX),'$(BIN)',)|" \
 		-e "s|@PKGCONFIG@|$(PKG_CONFIG)|" \
 		-e "s|@CMAKE@|$(STAGING_DIR_HOST)/bin/cmake|" \
-		-e "s|@PYTHON@|$(PYTHON_BIN)|" \
+		-e "s|@PYTHON@|$(STAGING_DIR_HOST)/bin/python3|" \
 		-e "s|@CFLAGS@|$(foreach FLAG,$(HOST_CFLAGS) $(HOST_CPPFLAGS),'$(FLAG)',)|" \
 		-e "s|@CXXFLAGS@|$(foreach FLAG,$(HOST_CXXFLAGS) $(HOST_CPPFLAGS),'$(FLAG)',)|" \
 		-e "s|@LDFLAGS@|$(foreach FLAG,$(HOST_LDFLAGS),'$(FLAG)',)|" \
@@ -90,7 +84,7 @@ define Meson/CreateCrossFile
 		-e "s|@NM@|$(TARGET_NM)|" \
 		-e "s|@PKGCONFIG@|$(PKG_CONFIG)|" \
 		-e "s|@CMAKE@|$(STAGING_DIR_HOST)/bin/cmake|" \
-		-e "s|@PYTHON@|$(PYTHON_BIN)|" \
+		-e "s|@PYTHON@|$(STAGING_DIR_HOST)/bin/python3|" \
 		-e "s|@CFLAGS@|$(foreach FLAG,$(TARGET_CFLAGS) $(EXTRA_CFLAGS) $(TARGET_CPPFLAGS) $(EXTRA_CPPFLAGS),'$(FLAG)',)|" \
 		-e "s|@CXXFLAGS@|$(foreach FLAG,$(TARGET_CXXFLAGS) $(EXTRA_CXXFLAGS) $(TARGET_CPPFLAGS) $(EXTRA_CPPFLAGS),'$(FLAG)',)|" \
 		-e "s|@LDFLAGS@|$(foreach FLAG,$(TARGET_LDFLAGS) $(EXTRA_LDFLAGS),'$(FLAG)',)|" \
@@ -114,7 +108,7 @@ define Host/Configure/Meson
 endef
 
 define Host/Compile/Meson
-	+$(MESON_HOST_VARS) $(NINJA) -C $(MESON_HOST_BUILD_DIR) $(1)
+	+$(NINJA) -C $(MESON_HOST_BUILD_DIR) $(1)
 endef
 
 define Host/Install/Meson
@@ -141,7 +135,7 @@ define Build/Configure/Meson
 endef
 
 define Build/Compile/Meson
-	+$(MESON_VARS) $(NINJA) -C $(MESON_BUILD_DIR) $(1)
+	+$(NINJA) -C $(MESON_BUILD_DIR) $(1)
 endef
 
 define Build/Install/Meson

include/netfilter.mk

@@ -358,6 +358,7 @@ $(eval $(if $(NF_KMOD),$(call nf_add,NFT_CONNLIMIT,CONFIG_NFT_CONNLIMIT, $(P_XT)
 IPT_BUILTIN += $(NF_IPT-y) $(NF_IPT-m)
 IPT_BUILTIN += $(IPT_CORE-y) $(IPT_CORE-m)
 IPT_BUILTIN += $(NF_CONNTRACK-y)
+IPT_BUILTIN += $(NF_CONNTRACK6-y)
 IPT_BUILTIN += $(IPT_CONNTRACK-y)
 IPT_BUILTIN += $(IPT_CONNTRACK_EXTRA-y)
 IPT_BUILTIN += $(IPT_EXTRA-y)

include/openssl-module.mk

@@ -3,7 +3,6 @@
 # Copyright (C) 2022-2023 Enéas Ulir de Queiroz
 
 ENGINES_DIR=engines-3
-MODULES_DIR=ossl-modules
 
 define Package/openssl/module/Default
   SECTION:=libs
@@ -75,6 +74,6 @@ endef
 # 1 = provider name
 # 2 = [ package name, defaults to libopenssl-$(1) ]
 define Package/openssl/add-provider
-  $(call Package/openssl/add-module,provider,$(1),/usr/lib/$(MODULES_DIR),$(2))
+  $(call Package/openssl/add-module,provider,$(1),/usr/lib/ossl-modules,$(2))
 endef
 

include/optee-os.mk

@@ -85,7 +85,7 @@ endef
 
 define Build/Compile/Optee-os
 	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
-		PATH=$(LINUX_DIR)/scripts/dtc/:$(STAGING_DIR_HOST)/bin:$(PATH) \
+		PATH=$(LINUX_DIR)/scripts/dtc/:$(PATH) \
 		CROSS_COMPILE=$(TARGET_CROSS) \
 		CROSS_COMPILE_core="$(TARGET_CROSS)" \
 		CROSS_COMPILE_ta_arm64="$(TARGET_CROSS)" \

include/package-defaults.mk

@@ -20,7 +20,7 @@ define Package/Default
   PROVIDES:=
   EXTRA_DEPENDS:=
   MAINTAINER:=$(PKG_MAINTAINER)
-  SOURCE:=$(patsubst $(TOPDIR)/%,%,$(if $(__pkg_source_makefile),$(__pkg_source_makefile),$(CURDIR)))
+  SOURCE:=$(patsubst $(TOPDIR)/%,%,$(patsubst $(TOPDIR)/package/%,feeds/base/%,$(CURDIR)))
   ifneq ($(PKG_VERSION),)
     ifneq ($(PKG_RELEASE),)
       VERSION:=$(PKG_VERSION)-r$(PKG_RELEASE)

include/package-pack.mk

@@ -8,30 +8,16 @@ endif
 
 IPKG_STATE_DIR:=$(TARGET_DIR)/usr/lib/opkg
 
-define description_escape
-$(subst `,\`,$(subst $$,\$$,$(subst ",\",$(subst \,\\,$(1)))))
-endef
-
 # Generates a make statement to return a wildcard for candidate ipkg files
 # 1: package name
 define gen_package_wildcard
-  $(1)$$(if $$(filter -%,$$(ABIV_$(1))),,[^a-z$(if $(CONFIG_USE_APK),,-)])*
-endef
-
-# 1: command and initial arguments
-# 2: arguments list
-# 3: tmp filename
-define maybe_use_xargs
-  $(if $(word 512,$(2)), \
-    $(file >$(3),$(2)) $(XARGS) $(1) < "$(3)"; rm "$(3)", \
-    $(1) $(2))
+  $(1)$$(if $$(filter -%,$$(ABIV_$(1))),,[^a-z-])*
 endef
 
 # 1: package name
 # 2: candidate ipk files
 define remove_ipkg_files
-  $(if $(strip $(2)), \
-    $(call maybe_use_xargs,$(SCRIPT_DIR)/ipkg-remove $(1),$(2),$(TMP_DIR)/$(1).in))
+  $(if $(strip $(2)),$(SCRIPT_DIR)/ipkg-remove $(1) $(2))
 endef
 
 # 1: package name
@@ -78,196 +64,6 @@ define FixupDependencies
   $(call AddDependency,$(1),$$(DEPS))
 endef
 
-# Format dependencies and extra dependencies
-#
-# ABI-version EXTRA_DEPENDS so dependencies can be correctly looked up using the
-# existing semantics without the ABI specified. This is needed since ABI-
-# versioned libraries don't provide `${package_name}=${package_version}`, so
-# that same library but with different ABI versions can be installed side by
-# side.
-#
-# Remove duplicate dependencies when EXTRA_DEPENDS specifies a versioned one
-# that is already in DEPENDS.
-#
-# 1: list of dependencies
-# 2: list of extra dependencies
-define FormatDepends
-$(strip
-  $(eval _COMMA_SEP := __COMMA_SEP__)
-  $(eval _SPACE_SEP := __SPACE_SEP__)
-  $(eval _DEPENDS := $(1))
-  $(eval _EXTRA_DEPENDS_ABI := )
-  $(eval _DEP_ITEMS := $(subst $(_COMMA_SEP),$(space),$(subst $(space),$(_SPACE_SEP),$(subst $(comma),$(_COMMA_SEP),$(2)))))
-
-  $(foreach dep,$(_DEP_ITEMS),
-    $(eval _EXTRA_DEP := )
-    $(eval _CUR_DEP := $(subst $(_SPACE_SEP),$(space),$(strip $(dep))))
-    $(eval _PKG_NAME := $(word 1,$(_CUR_DEP)))
-    $(if $(findstring $(paren_left), $(_PKG_NAME)),
-      $(error "Unsupported extra dependency format: no space before '(': $(_CUR_DEP)"))
-    )
-    $(eval _ABI_SUFFIX := $(call GetABISuffix,$(_PKG_NAME)))
-    $(eval _PKG_NAME_ABI := $(_PKG_NAME)$(_ABI_SUFFIX))
-    $(eval _VERSION_CONSTRAINT := $(word 2,$(_CUR_DEP)))
-    $(if $(_VERSION_CONSTRAINT),
-      $(eval _EXTRA_DEP := $(_PKG_NAME_ABI) $(_VERSION_CONSTRAINT)),
-      $(error "Extra dependencies must have version constraints. $(_PKG_NAME) seems to be unversioned.")
-    )
-    $(if $(and $(_EXTRA_DEPENDS_ABI),$(_EXTRA_DEP)),
-      $(eval _EXTRA_DEPENDS_ABI := $(_EXTRA_DEPENDS_ABI)$(comma)$(_EXTRA_DEP)),
-      $(eval _EXTRA_DEPENDS_ABI := $(_EXTRA_DEP))
-    )
-    $(if $(_DEPENDS),
-      $(eval _DEPENDS := $(filter-out $(_PKG_NAME_ABI),$(_DEPENDS)))
-    )
-  )
-
-  $(eval _DEPENDS := $(call mergelist,$(_DEPENDS)))
-  $(_EXTRA_DEPENDS_ABI)$(if $(_DEPENDS),$(comma) $(_DEPENDS))
-)
-endef
-
-# Format provide and add ABI and version if it's not a virtual provide marked
-# with an @.
-#
-# Same as for the base package name, if ABI version is set, provide both
-# unversioned provide and one with ABI version and version.
-#
-# 1: provide name
-# 2: provide version
-# 3: (optional) ABI version
-define AddProvide
-$(strip
-  $(if $(filter @%,$(1)),
-    $(patsubst @%,%,$(1)),
-    $(if $(3),
-      $(1) $(1)$(call FormatABISuffix,$(1),$(3))=$(2),
-      $(1)=$(2)
-    )
-  )
-)
-endef
-
-# Remove virtual provides prefix and self. apk doesn't like it when packages
-# specify a redundant provide pointing to self.
-#
-# 1: package name
-# 2: list of provides
-define SanitizeProvides
-$(filter-out $(1),$(patsubst @%,%,$(2)))
-endef
-
-# Format provides both for apk and control
-#
-# - If ABI version is defined:
-#   - package is named `${package_name}${ABI_version}`
-#     if a `package_name` ends in a number, the `ABI_version` will be prefixed
-#     with a - sign, e.g.: libsqlite3-0
-#   - package implicitly provides
-#     `${package_name}${ABI_version}=${package_version}`
-#     this implies that only one version of a package per ABI can be installed
-#     at the same time
-#   - additionally provide `${package_name}` so multiple packages can be looked
-#     up by its base name
-#   - for each `provides`:
-#     - provide `${provide}${ABI_version}=${package_version}`
-#       this implies that only one version of a provide can be installed at the
-#       same time
-#     - if a `provide` ends in a number, the `ABI_version` will be prefixed with
-#       a - sign, e.g.: provide1-0
-#     - additionally provide `${provide}` so multiple packages can be looked up
-#       by its base name
-#
-# - else if ABI version is _not_ defined
-#   - package is named `${package_name}`
-#   - package implicitly provides `${package_name}=${package_version}`
-#     this implies that only one version of a package can be installed at the
-#     same time
-#   - for each `provides`, provide `${provide}=${package_version}` this implies
-#     that only one version of a provide can be installed at the same time
-#
-# - Both with and without an ABI, if a provide starts with an @, treat it as a
-#   virtual provide, that doesn't own the name by not appending version.
-#   Multiple packages with the same virtual provides can be installed
-#   side-by-side.
-#
-# - apk doesn't like it when packages specify a redundant provide pointing to
-#   self. Filter it out, but keep virtual self provides, in the form of
-#   @(kmod-)?${package_name}-any.
-#
-# - Packages implicitly add a virtual @${package_name}-any provide in Package,
-#   which implies that kmods, which are also packages, will have a virtual
-#   @kmod-${package_name}-any provide.
-#
-# - Aside from the two aforementioned implicit provides, packages are expected
-#   to manage their provides themselves.
-#
-# - When multiple variants inside the same package have the same provide, a
-#   default variant must be set using DEFAULT_VARIANT:=1.
-#
-# - Cross-package provides must be virtual and a default variant must be set. If
-#   different packages provide the same versioned (i.e. non-virtual) provide the
-#   package with a higher version will be preferred, which results in unintended
-#   behavior, because the order might change with package updates.
-#
-#   Example:
-#   - both uclient-fetch and wget provide wget
-#   - wget doesn't have a default variant called wget that would provide an
-#     implicit @wget-any
-#     - add wget to PROVIDES for both wget-ssl and wget-nossl variants so they
-#       can't be installed at the same time
-#     - add @wget-any to both packages so packages outside of wget can provide
-#       it
-#   - uclient-fetch has only one variant
-#     - add @wget-any to PROVIDES
-#     - mark uclient-fetch as the default variant using DEFAULT_VARIANT:=1
-#   - switch wget consumer that don't depend on a specific version like apk to
-#     depend on @wget-any
-#
-# - Alternatives don't affect the packaging.
-#
-# 1: package name
-# 2: package version
-# 3: ABI version
-# 4: list of provides
-define FormatProvides
-$(strip \
-  $(if $(call FormatABISuffix,$(1),$(3)), \
-    $(1) $(foreach provide, \
-      $(filter-out $(1),$(4)), \
-      $(call AddProvide,$(provide),$(2),$(3)) \
-    ), \
-    $(foreach provide, \
-      $(filter-out $(1),$(4)), \
-      $(call AddProvide,$(provide),$(2)) \
-    ) \
-  ) \
-)
-endef
-
-# Get apk provider priority
-#
-# - if a package is marked as a default variant, set it to 100.
-#
-# - if a package has an ABI version defined, set it to 10.
-#   The enables packages with an ABI version to be installed by their base name
-#   instead of a name and an ABI version, e.g.:
-#   libfoo3, where 3 is the ABI version can be installed by just libfoo.
-#   This affects manual installation only, as the dependency resolution takes
-#   care of ABI versions.
-#
-# - otherwise return nothing, i.e. package will have the default priority 0.
-#
-# 1: Default variant
-# 2: ABI version
-define GetProviderPriority
-$(strip
-  $(if $(1),100,
-    $(if $(2),10)
-  )
-)
-endef
-
 ifneq ($(PKG_NAME),toolchain)
   define CheckDependencies
 	@( \
@@ -311,23 +107,6 @@ endif
     ADIR_$(1):=$(PKG_BUILD_DIR)/apk-$(PKGARCH)/$(1)
     KEEP_$(1):=$(strip $(call Package/$(1)/conffiles))
 
-    APK_SCRIPTS_$(1):=
-
-    ifdef Package/$(1)/preinst
-      APK_SCRIPTS_$(1)+=--script "pre-install:$$(ADIR_$(1))/preinst"
-    endif
-    APK_SCRIPTS_$(1)+=--script "post-install:$$(ADIR_$(1))/post-install"
-
-    ifdef Package/$(1)/preinst
-      APK_SCRIPTS_$(1)+=--script "pre-upgrade:$$(ADIR_$(1))/pre-upgrade"
-    endif
-    APK_SCRIPTS_$(1)+=--script "post-upgrade:$$(ADIR_$(1))/post-upgrade"
-
-    APK_SCRIPTS_$(1)+=--script "pre-deinstall:$$(ADIR_$(1))/pre-deinstall"
-    ifdef Package/$(1)/postrm
-      APK_SCRIPTS_$(1)+=--script "post-deinstall:$$(ADIR_$(1))/postrm"
-    endif
-
     TARGET_VARIANT:=$$(if $(ALL_VARIANTS),$$(if $$(VARIANT),$$(filter-out *,$$(VARIANT)),$(firstword $(ALL_VARIANTS))))
     ifeq ($(BUILD_VARIANT),$$(if $$(TARGET_VARIANT),$$(TARGET_VARIANT),$(BUILD_VARIANT)))
     do_install=
@@ -381,33 +160,17 @@ endif
     $(STAGING_DIR_ROOT)/stamp/.$(1)_installed: $(PKG_BUILD_DIR)/.pkgdir/$(1).installed
 	mkdir -p $(STAGING_DIR_ROOT)/stamp
 	$(if $(ABI_VERSION),echo '$(ABI_VERSION)' | cmp -s - $(PKG_INFO_DIR)/$(1).version || { \
-		mkdir -p $(PKG_INFO_DIR); \
 		echo '$(ABI_VERSION)' > $(PKG_INFO_DIR)/$(1).version; \
-		$(foreach pkg,$(call SanitizeProvides,$(1),$(PROVIDES)), \
+		$(foreach pkg,$(filter-out $(1),$(PROVIDES)), \
 			cp $(PKG_INFO_DIR)/$(1).version $(PKG_INFO_DIR)/$(pkg).version; \
 		) \
 	} )
 	$(call locked,$(CP) $(PKG_BUILD_DIR)/.pkgdir/$(1)/. $(STAGING_DIR_ROOT)/,root-copy)
 	touch $$@
 
-    Package/$(1)/DEPENDS := $$(foreach dep,$$(filter-out @%,$$(IDEPEND_$(1))),$$(dep)$$(call GetABISuffix,$$(dep)))
+    Package/$(1)/DEPENDS := $$(call mergelist,$$(foreach dep,$$(filter-out @%,$$(IDEPEND_$(1))),$$(dep)$$(call GetABISuffix,$$(dep))))
     ifneq ($$(EXTRA_DEPENDS),)
-      ifeq ($(CONFIG_USE_APK),)
-        Package/$(1)/DEPENDS := $$(call mergelist,$$(Package/$(1)/DEPENDS))
-        Package/$(1)/DEPENDS := $$(EXTRA_DEPENDS)$$(if $$(Package/$(1)/DEPENDS),$$(comma) $$(Package/$(1)/DEPENDS))
-      else
-        Package/$(1)/DEPENDS := $$(call FormatDepends,$$(Package/$(1)/DEPENDS),$$(EXTRA_DEPENDS))
-      endif
-    else
-      Package/$(1)/DEPENDS := $$(call mergelist,$$(Package/$(1)/DEPENDS))
-    endif
-
-    ifeq ($(CONFIG_USE_APK),)
-      Package/$(1)/PROVIDES := $$(patsubst @%,%,$(PROVIDES))
-      Package/$(1)/PROVIDES := $$(filter-out $(1)$$(ABIV_$(1)),$$(Package/$(1)/PROVIDES)$$(if $$(ABIV_$(1)), $(1) $$(foreach provide,$$(Package/$(1)/PROVIDES),$$(provide)$$(ABIV_$(1)))))
-    else
-      Package/$(1)/PROVIDES := $$(call FormatProvides,$(1),$(VERSION),$(ABI_VERSION),$(PROVIDES))
-      Package/$(1)/PRIORITY := $$(call GetProviderPriority,$(DEFAULT_VARIANT),$(ABI_VERSION))
+      Package/$(1)/DEPENDS := $$(EXTRA_DEPENDS)$$(if $$(Package/$(1)/DEPENDS),$$(comma) $$(Package/$(1)/DEPENDS))
     endif
 
 $(_define) Package/$(1)/CONTROL
@@ -415,7 +178,7 @@ Package: $(1)$$(ABIV_$(1))
 Version: $(VERSION)
 $$(call addfield,Depends,$$(Package/$(1)/DEPENDS)
 )$$(call addfield,Conflicts,$$(call mergelist,$(CONFLICTS))
-)$$(call addfield,Provides,$$(call mergelist,$$(Package/$(1)/PROVIDES))
+)$$(call addfield,Provides,$$(call mergelist,$$(filter-out $(1)$$(ABIV_$(1)),$(PROVIDES)$$(if $$(ABIV_$(1)), $(1) $(foreach provide,$(PROVIDES),$(provide)$$(ABIV_$(1))))))
 )$$(call addfield,Alternatives,$$(call mergelist,$(ALTERNATIVES))
 )$$(call addfield,Source,$(SOURCE)
 )$$(call addfield,SourceName,$(PKG_NAME)
@@ -435,10 +198,9 @@ Installed-Size: 0
 $(_endef)
 
     $$(PACK_$(1)) : export CONTROL=$$(Package/$(1)/CONTROL)
-    $$(PACK_$(1)) : $(call shexport,Package/$(1)/description)
+    $$(PACK_$(1)) : export DESCRIPTION=$$(Package/$(1)/description)
     $$(PACK_$(1)) : export PATH=$$(TARGET_PATH_PKG)
     $$(PACK_$(1)) : export PKG_SOURCE_DATE_EPOCH:=$(PKG_SOURCE_DATE_EPOCH)
-    $$(PACK_$(1)) : export SOURCE_DATE_EPOCH:=$(PKG_SOURCE_DATE_EPOCH)
     $(PKG_INFO_DIR)/$(1).provides $$(PACK_$(1)): $(STAMP_BUILT) $(INCLUDE_DIR)/package-pack.mk
 	rm -rf $$(IDIR_$(1))
 ifeq ($$(CONFIG_USE_APK),)
@@ -450,7 +212,7 @@ endif
 	$(call Package/$(1)/install,$$(IDIR_$(1)))
 	$(if $(Package/$(1)/install-overlay),mkdir -p $(PACKAGE_DIR) $$(IDIR_$(1))/rootfs-overlay)
 	$(call Package/$(1)/install-overlay,$$(IDIR_$(1))/rootfs-overlay)
-	-find $$(IDIR_$(1)) -name '.svn' -o -name '.#*' -o -name '*~'| $(XARGS) rm -rf
+	-find $$(IDIR_$(1)) -name 'CVS' -o -name '.svn' -o -name '.#*' -o -name '*~'| $(XARGS) rm -rf
 	@( \
 		find $$(IDIR_$(1)) -name lib\*.so\* -or -name \*.ko | awk -F/ '{ print $$$$NF }'; \
 		for file in $$(patsubst %,$(PKG_INFO_DIR)/%.provides,$$(IDEPEND_$(1))); do \
@@ -459,7 +221,7 @@ endif
 			fi; \
 		done; $(Package/$(1)/extra_provides) \
 	) | sort -u > $(PKG_INFO_DIR)/$(1).provides
-	$(if $(PROVIDES),@for pkg in $(call SanitizeProvides,$(1),$(PROVIDES)); do cp $(PKG_INFO_DIR)/$(1).provides $(PKG_INFO_DIR)/$$$$pkg.provides; done)
+	$(if $(PROVIDES),@for pkg in $(filter-out $(1),$(PROVIDES)); do cp $(PKG_INFO_DIR)/$(1).provides $(PKG_INFO_DIR)/$$$$pkg.provides; done)
 	$(CheckDependencies)
 
 	$(RSTRIP) $$(IDIR_$(1))
@@ -486,14 +248,14 @@ endif
 		)
     endif
 
-	$(INSTALL_DIR) $$(PDIR_$(1))
+	$(INSTALL_DIR) $$(PDIR_$(1))/tmp
 
 ifeq ($(CONFIG_USE_APK),)
 	mkdir -p $$(IDIR_$(1))/CONTROL
 	(cd $$(IDIR_$(1))/CONTROL; \
 		( \
 			echo "$$$$CONTROL"; \
-			printf "Description: "; echo "$$$$$(call shvar,Package/$(1)/description)" | sed -e 's,^[[:space:]]*, ,g'; \
+			printf "Description: "; echo "$$$$DESCRIPTION" | sed -e 's,^[[:space:]]*, ,g'; \
 		) > control; \
 		chmod 644 control; \
 		( \
@@ -526,59 +288,43 @@ else
 		echo "[ -s "\$$$${IPKG_INSTROOT}/lib/functions.sh" ] || exit 0"; \
 		echo ". \$$$${IPKG_INSTROOT}/lib/functions.sh"; \
 		echo 'export root="$$$${IPKG_INSTROOT}"'; \
-		echo 'export pkgname="$(1)$$(ABIV_$(1))"'; \
+		echo 'export pkgname="$(1)"'; \
 		echo "add_group_and_user"; \
+		[ ! -f $$(ADIR_$(1))/postinst-pkg ] || cat "$$(ADIR_$(1))/postinst-pkg"; \
 		echo "default_postinst"; \
-		[ ! -f $$(ADIR_$(1))/postinst-pkg ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/postinst-pkg"; \
 	) > $$(ADIR_$(1))/post-install;
 
-    ifdef Package/$(1)/preinst
-	( \
-		echo "#!/bin/sh"; \
-		echo 'export PKG_UPGRADE=1'; \
-		[ ! -f $$(ADIR_$(1))/preinst ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/preinst"; \
-	) > $$(ADIR_$(1))/pre-upgrade;
-    endif
-
-	( \
-		echo "#!/bin/sh"; \
-		echo 'export PKG_UPGRADE=1'; \
-		[ ! -f $$(ADIR_$(1))/post-install ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/post-install"; \
-	) > $$(ADIR_$(1))/post-upgrade;
-
 	( \
 		echo "#!/bin/sh"; \
 		echo "[ -s "\$$$${IPKG_INSTROOT}/lib/functions.sh" ] || exit 0"; \
 		echo ". \$$$${IPKG_INSTROOT}/lib/functions.sh"; \
 		echo 'export root="$$$${IPKG_INSTROOT}"'; \
-		echo 'export pkgname="$(1)$$(ABIV_$(1))"'; \
+		echo 'export pkgname="$(1)"'; \
+		[ ! -f $$(ADIR_$(1))/prerm-pkg ] || cat "$$(ADIR_$(1))/prerm-pkg"; \
 		echo "default_prerm"; \
-		[ ! -f $$(ADIR_$(1))/prerm-pkg ] || sed '/^\s*#!/d' "$$(ADIR_$(1))/prerm-pkg"; \
 	) > $$(ADIR_$(1))/pre-deinstall;
 
-	[ ! -f $$(ADIR_$(1))/postrm ] || sed -zi 's/^\s*#!/#!/' "$$(ADIR_$(1))/postrm";
-
-	if [ -n "$(USERID)" ]; then echo $(USERID) > $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).rusers; fi;
-	if [ -n "$(ALTERNATIVES)" ]; then echo $(ALTERNATIVES) > $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).alternatives; fi;
-	(cd $$(IDIR_$(1)) && find . -type f,l -printf "/%P\n" | sort > $(TMP_DIR)/$(1).list && mv $(TMP_DIR)/$(1).list $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).list)
+	if [ -n "$(USERID)" ]; then echo $(USERID) > $$(IDIR_$(1))/lib/apk/packages/$(1).rusers; fi;
+	if [ -n "$(ALTERNATIVES)" ]; then echo $(ALTERNATIVES) > $$(IDIR_$(1))/lib/apk/packages/$(1).alternatives; fi;
+	(cd $$(IDIR_$(1)) && find . -type f,l -printf "/%P\n" > $$(IDIR_$(1))/lib/apk/packages/$(1).list)
 	# Move conffiles to IDIR and build conffiles_static with csums
 	if [ -f $$(ADIR_$(1))/conffiles ]; then \
-		mv -f $$(ADIR_$(1))/conffiles $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles; \
-		for file in $$$$(cat $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles); do \
+		mv -f $$(ADIR_$(1))/conffiles $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles; \
+		for file in $$$$(cat $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles); do \
 			[ -f $$(IDIR_$(1))/$$$$file ] || continue; \
 			csum=$$$$($(MKHASH) sha256 $$(IDIR_$(1))/$$$$file); \
-			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles_static; \
+			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles_static; \
 		done; \
 	fi
 
 	# Some package (base-files) manually append stuff to conffiles
 	# Append stuff from it and delete the CONTROL directory since everything else should be migrated
 	if [ -f $$(IDIR_$(1))/CONTROL/conffiles ]; then \
-		echo $$$$(IDIR_$(1))/CONTROL/conffiles >> $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles; \
+		echo $$$$(IDIR_$(1))/CONTROL/conffiles >> $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles; \
 		for file in $$$$(cat $$(IDIR_$(1))/CONTROL/conffiles); do \
 			[ -f $$(IDIR_$(1))/$$$$file ] || continue; \
 			csum=$$$$($(MKHASH) sha256 $$(IDIR_$(1))/$$$$file); \
-			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1)$$(ABIV_$(1)).conffiles_static; \
+			echo $$$$file $$$$csum >> $$(IDIR_$(1))/lib/apk/packages/$(1).conffiles_static; \
 		done; \
 		rm -rf $$(IDIR_$(1))/CONTROL/conffiles; \
 	fi
@@ -593,19 +339,29 @@ else
 	$(FAKEROOT) $(STAGING_DIR_HOST)/bin/apk mkpkg \
 	  --info "name:$(1)$$(ABIV_$(1))" \
 	  --info "version:$(VERSION)" \
-	  $$(if $$(ABIV_$(1)),--info "tags:openwrt:abiversion=$$(ABIV_$(1))") \
-	  --info "description:$$(call description_escape,$$(strip $$(Package/$(1)/description)))" \
-	  $(if $(findstring all,$(PKGARCH)),--info "arch:noarch",--info "arch:$(PKGARCH)") \
+	  --info "description:$$(strip $$(Package/$(1)/description))" \
+	  --info "arch:$(PKGARCH)" \
 	  --info "license:$(LICENSE)" \
 	  --info "origin:$(SOURCE)" \
 	  --info "url:$(URL)" \
 	  --info "maintainer:$(MAINTAINER)" \
-	  $$(if $$(Package/$(1)/PROVIDES),--info "provides:$$(Package/$(1)/PROVIDES)") \
-	  $$(if $$(Package/$(1)/PRIORITY),--info "provider-priority:$$(Package/$(1)/PRIORITY)") \
-	  $$(APK_SCRIPTS_$(1)) \
+	  --info "provides:$$(foreach prov,\
+			$$(filter-out $(1)$$(ABIV_$(1)), \
+			$(PROVIDES)$$(if $$(ABIV_$(1)), \
+				$(1)=$(VERSION) $(foreach provide, \
+					$(PROVIDES), \
+					$(provide)$$(ABIV_$(1))=$(VERSION) \
+				) \
+			) \
+		), \
+		$$(prov) )" \
+	  $(if $(DEFAULT_VARIANT),--info "provider-priority:100") \
+	  --script "post-install:$$(ADIR_$(1))/post-install" \
+	  --script "pre-deinstall:$$(ADIR_$(1))/pre-deinstall" \
 	  --info "depends:$$(foreach depends,$$(subst $$(comma),$$(space),$$(subst $$(space),,$$(subst $$(paren_right),,$$(subst $$(paren_left),,$$(Package/$(1)/DEPENDS))))),$$(depends))" \
 	  --files "$$(IDIR_$(1))" \
-	  --output "$$(PACK_$(1))"
+	  --output "$$(PACK_$(1))" \
+	  --sign "$(BUILD_KEY_APK_SEC)"
 endif
 
 	@[ -f $$(PACK_$(1)) ]

include/package.mk

@@ -134,35 +134,6 @@ endef
 
 PKG_INSTALL_STAMP:=$(PKG_INFO_DIR)/$(PKG_DIR_NAME).$(if $(BUILD_VARIANT),$(BUILD_VARIANT),default).install
 
-# Normalize package SOURCE entry to pack reproducible package
-# If we are packing a package with OpenWrt buildroot:
-# - Replace package/... with feeds/base/...
-# If we are packing a package with SDK:
-# - Replace feeds/.*_root/... with feeds/.*/... and remove
-#   the intermediate directory to reflect what the symbolic link
-#   points to.
-#   Example:
-#   Feed link: feeds/base_root/package -> feeds/base
-#   Package: feeds/base_root/package/system/uci -> feeds/base/system/uci
-ifeq ($(DUMP),)
-  __pkg_base_path:=$(patsubst $(TOPDIR)/%,%,$(CURDIR))
-  __pkg_provider_path:=$(word 1,$(subst /, ,$(__pkg_base_path)))
-  ifeq ($(__pkg_provider_path), feeds)
-    __pkg_feed_path:=$(word 2,$(subst /, ,$(__pkg_base_path)))
-    __pkg_feed_name:=$(patsubst %_root,%,$(__pkg_feed_path))
-    ifneq (__pkg_feed_path, __pkg_feed_name)
-      __pkg_feed_realpath:=$(realpath $(TOPDIR)/feeds/$(__pkg_feed_name))
-      __pkg_feed_dir:=$(patsubst $(TOPDIR)/feeds/$(__pkg_feed_path)/%,%,$(__pkg_feed_realpath))
-      __pkg_path:=$(patsubst feeds/$(__pkg_feed_path)/$(__pkg_feed_dir)/%,%,$(__pkg_base_path))
-    else
-      __pkg_path:=$(patsubst feeds/$(__pkg_feed_path)/%,%,$(__pkg_base_path))
-    endif
-    __pkg_source_makefile:=$(TOPDIR)/feeds/$(__pkg_feed_name)/$(__pkg_path)
-  else ifeq ($(__pkg_provider_path), package)
-    __pkg_source_makefile:=$(TOPDIR)/feeds/base/$(patsubst package/%,%,$(__pkg_base_path))
-  endif
-endif
-
 include $(INCLUDE_DIR)/package-defaults.mk
 include $(INCLUDE_DIR)/package-dumpinfo.mk
 include $(INCLUDE_DIR)/package-pack.mk
@@ -332,12 +303,9 @@ define BuildPackage
   $(eval $(Package/Default))
   $(eval $(Package/$(1)))
 
-  # Add an implicit self-provide. apk can't handle self provides, be it
-  # versioned or virtual, so opt for a suffix instead. This allows several
-  # variants to provide the same virtual package without adding extra provides
-  # to the default one, e.g. wget implicitly provides wget-any and is marked as
-  # default, so wget-ssl can explicitly provide @wget-any as well.
-  $(eval PROVIDES:=$(strip @$(1)-any $(PROVIDES)))
+ifdef DESCRIPTION
+$$(error DESCRIPTION:= is obsolete, use Package/PKG_NAME/description)
+endif
 
 ifndef Package/$(1)/description
 define Package/$(1)/description
@@ -391,7 +359,7 @@ prepare-package-install:
 $(PACKAGE_DIR):
 	mkdir -p $@
 
-compile: prepare-package-install
+compile:
 .install: .compile
 install: compile
 

include/prereq-build.mk

@@ -9,11 +9,11 @@ SHELL:=sh
 PKG_NAME:=Build dependency
 
 $(eval $(call TestHostCommand,true, \
-	Please install 'coreutils', \
+	Please install GNU 'coreutils', \
 	$(TRUE)))
 
 $(eval $(call TestHostCommand,false, \
-	Please install 'coreutils', \
+	Please install GNU 'coreutils', \
 	$(FALSE); [ $$$$$$$$? = 1 ] && $(TRUE)))
 
 # Required for the toolchain
@@ -97,7 +97,7 @@ $(eval $(call TestHostCommand,perl-thread-queue, \
 	perl -MThread::Queue -e 1))
 
 $(eval $(call TestHostCommand,perl-ipc-cmd, \
-	Please install the Perl IPC::Cmd module, \
+	Please install the Perl IPC:Cmd module, \
 	perl -MIPC::Cmd -e 1))
 
 $(eval $(call SetupHostCommand,tar,Please install GNU 'tar', \
@@ -126,12 +126,10 @@ $(eval $(call SetupHostCommand,diff,Please install GNU diffutils, \
 	diff --version 2>&1 | grep GNU))
 
 $(eval $(call SetupHostCommand,cp,Please install GNU fileutils, \
-	$(TOPDIR)/staging_dir/host/bin/gcp --help 2>&1 | grep 'Copy SOURCE', \
 	gcp --help 2>&1 | grep 'Copy SOURCE', \
 	cp --help 2>&1 | grep 'Copy SOURCE'))
 
 $(eval $(call SetupHostCommand,seq,Please install seq, \
-	$(TOPDIR)/staging_dir/host/bin/gseq --version, \
 	gseq --version, \
 	seq --version 2>&1 | grep seq))
 
@@ -155,12 +153,10 @@ $(eval $(call SetupHostCommand,getopt, \
 	/opt/local/bin/getopt -o t --long test -- --test | grep '^ *--test *--'))
 
 $(eval $(call SetupHostCommand,realpath,Please install a 'realpath' utility, \
-	$(TOPDIR)/staging_dir/host/bin/grealpath /, \
 	grealpath /, \
 	realpath /))
 
 $(eval $(call SetupHostCommand,stat,Cannot find a file stat utility, \
-	$(TOPDIR)/staging_dir/host/bin/gstat -c%s $(TOPDIR)/Makefile, \
 	gnustat -c%s $(TOPDIR)/Makefile, \
 	gstat -c%s $(TOPDIR)/Makefile, \
 	stat -c%s $(TOPDIR)/Makefile))
@@ -178,16 +174,14 @@ $(eval $(call SetupHostCommand,bzip2,Please install 'bzip2', \
 $(eval $(call SetupHostCommand,wget,Please install GNU 'wget', \
 	wget --version | grep GNU))
 
-$(eval $(call SetupHostCommand,install,Please install 'install', \
-	$(TOPDIR)/staging_dir/host/bin/ginstall --version | grep GNU, \
-	install --version | grep 'GNU\|uutils', \
+$(eval $(call SetupHostCommand,install,Please install GNU 'install', \
+	install --version | grep GNU, \
 	ginstall --version | grep GNU))
 
 $(eval $(call SetupHostCommand,perl,Please install Perl 5.x, \
 	perl --version | grep "perl.*v5"))
 
 $(eval $(call SetupHostCommand,python,Please install Python >= 3.7, \
-	python3.13 -V 2>&1 | grep 'Python 3', \
 	python3.12 -V 2>&1 | grep 'Python 3', \
 	python3.11 -V 2>&1 | grep 'Python 3', \
 	python3.10 -V 2>&1 | grep 'Python 3', \
@@ -197,7 +191,6 @@ $(eval $(call SetupHostCommand,python,Please install Python >= 3.7, \
 	python3 -V 2>&1 | grep -E 'Python 3\.([7-9]|[0-9][0-9])\.?'))
 
 $(eval $(call SetupHostCommand,python3,Please install Python >= 3.7, \
-	python3.13 -V 2>&1 | grep 'Python 3', \
 	python3.12 -V 2>&1 | grep 'Python 3', \
 	python3.11 -V 2>&1 | grep 'Python 3', \
 	python3.10 -V 2>&1 | grep 'Python 3', \
@@ -239,7 +232,7 @@ endif
 
 $(STAGING_DIR_HOST)/bin/mkhash: $(SCRIPT_DIR)/mkhash.c
 	mkdir -p $(dir $@)
-	$(STAGING_DIR_HOST)/bin/gcc -O2 -I$(TOPDIR)/tools/include -o $@ $<
+	$(CC) -O2 -I$(TOPDIR)/tools/include -o $@ $<
 
 $(STAGING_DIR_HOST)/bin/xxd: $(SCRIPT_DIR)/xxdi.pl
 	$(LN) $< $@

include/prereq.mk

@@ -71,7 +71,7 @@ endef
 # 4: optional link library test (example -lncurses)
 define RequireCHeader
   define Require/$(1)
-    echo 'int main(int argc, char **argv) { $(3); return 0; }' | $(STAGING_DIR_HOST)/bin/gcc -include $(1) -x c -o $(TMP_DIR)/a.out - $(4)
+    echo 'int main(int argc, char **argv) { $(3); return 0; }' | gcc -include $(1) -x c -o $(TMP_DIR)/a.out - $(4)
   endef
 
   $$(eval $$(call Require,$(1),$(2)))
@@ -113,7 +113,7 @@ define SetupHostCommand
 						[ -x "$(STAGING_DIR_HOST)/bin/$(strip $(1))" ] && exit 0 \
 						;; \
 				esac; \
-				ln -sf "$$$$$$$${bin#$(STAGING_DIR_HOST)/bin/}" "$(STAGING_DIR_HOST)/bin/$(strip $(1))"; \
+				ln -sf "$$$$$$$$bin" "$(STAGING_DIR_HOST)/bin/$(strip $(1))"; \
 				exit 1; \
 			fi; \
 		fi; \

include/quilt.mk

@@ -103,7 +103,6 @@ define Kernel/Patch/Default
 	$(call PatchDir,$(LINUX_DIR),$(GENERIC_PATCH_DIR),generic/)
 	$(call PatchDir,$(LINUX_DIR),$(GENERIC_HACK_DIR),generic-hack/)
 	$(call PatchDir,$(LINUX_DIR),$(PATCH_DIR),platform/)
-	$(if $(QUILT),touch $(LINUX_DIR)/.quilt_used)
 endef
 
 define Quilt/RefreshDir

include/rootfs.mk

@@ -48,6 +48,7 @@ apk = \
   $(FAKEROOT) $(STAGING_DIR_HOST)/bin/apk \
 	--root $(1) \
 	--keys-dir $(if $(APK_KEYS),$(APK_KEYS),$(TOPDIR)) \
+	--no-cache \
 	--no-logfile \
 	--preserve-env
 
@@ -78,7 +79,6 @@ define prepare_rootfs
 		cd $(1); \
 		if [ -n "$(CONFIG_USE_APK)" ]; then \
 			IPKG_POSTINST_PATH=./lib/apk/db/*.post-install; \
-			$(STAGING_DIR_HOST)/bin/gzip -d ./lib/apk/db/scripts.tar; \
 			$(STAGING_DIR_HOST)/bin/tar -C ./lib/apk/db/ -xf ./lib/apk/db/scripts.tar --wildcards "*.post-install"; \
 		else \
 			IPKG_POSTINST_PATH=./usr/lib/opkg/info/*.postinst; \
@@ -92,7 +92,6 @@ define prepare_rootfs
 			fi; \
 			[ -n "$(CONFIG_USE_APK)" ] && $(STAGING_DIR_HOST)/bin/tar --delete -f ./lib/apk/db/scripts.tar $$(basename $$script); \
 		done; \
-		[ -n "$(CONFIG_USE_APK)" ] && $(STAGING_DIR_HOST)/bin/gzip -f -9n -S ".gz" ./lib/apk/db/scripts.tar; \
 		if [ -z "$(CONFIG_USE_APK)" ]; then \
 			$(if $(IB),,awk -i inplace \
 				'/^Status:/ { \
@@ -113,7 +112,7 @@ define prepare_rootfs
 		done || true \
 	)
 
-	@-find $(1) -name .svn -o -name .git -o -name '.#*' | $(XARGS) rm -rf
+	@-find $(1) -name CVS -o -name .svn -o -name .git -o -name '.#*' | $(XARGS) rm -rf
 	rm -rf \
 		$(1)/boot \
 		$(1)/tmp/* \

include/target.mk

@@ -90,9 +90,45 @@ else
   endif
 endif
 
+ifneq ($(DUMP),)
+  # Parse generic config that might be set before a .config is generated to modify the
+  # default package configuration
+  # Keep DYNAMIC_DEF_PKG_CONF in sync with toplevel.mk to reflect the same configs
+  DYNAMIC_DEF_PKG_CONF := CONFIG_USE_APK CONFIG_SELINUX CONFIG_SMALL_FLASH CONFIG_SECCOMP
+  $(foreach config, $(DYNAMIC_DEF_PKG_CONF), \
+    $(eval $(config) := $(shell grep "$(config)=y" $(TOPDIR)/.config 2>/dev/null)) \
+  )
+  # The config options that are enabled by default and where other default
+  # packages depends on needs to be set if they are missing in the .config.
+  ifeq ($(shell grep "CONFIG_SECCOMP" $(TOPDIR)/.config 2>/dev/null),)
+    ifeq ($(filter $(BOARD), uml),)
+    ifneq ($(filter $(ARCH), aarch64 arm armeb mips mipsel mips64 mips64el i386 powerpc x86_64),)
+      CONFIG_SECCOMP := y
+    endif
+    endif
+  endif
+endif
+
+ifneq ($(CONFIG_USE_APK),)
+DEFAULT_PACKAGES+=apk-mbedtls
+else
+DEFAULT_PACKAGES+=opkg
+endif
+
+ifneq ($(CONFIG_SELINUX),)
+DEFAULT_PACKAGES+=busybox-selinux procd-selinux
+else
+DEFAULT_PACKAGES+=busybox procd
+endif
+
 # include ujail on systems with enough storage
-ifeq ($(filter small_flash,$(FEATURES)),)
-  DEFAULT_PACKAGES+=procd-ujail
+ifeq ($(CONFIG_SMALL_FLASH),)
+DEFAULT_PACKAGES+=procd-ujail
+endif
+
+# include seccomp ld-preload hooks if kernel supports it
+ifneq ($(CONFIG_SECCOMP),)
+DEFAULT_PACKAGES+=procd-seccomp
 endif
 
 # Add device specific packages (here below to allow device type set from subtarget)
@@ -105,6 +141,13 @@ DEFAULT_PACKAGES += $(DEFAULT_PACKAGES.$(DEVICE_TYPE))
 ##
 filter_packages = $(filter-out -% $(patsubst -%,%,$(filter -%,$(1))),$(1))
 
+##@
+# @brief Append extra package dependencies.
+#
+# @param 1: Package list.
+##
+extra_packages = $(if $(filter wpad wpad-% nas,$(1)),iwinfo)
+
 define ProfileDefault
   NAME:=
   PRIORITY:=
@@ -121,7 +164,7 @@ define Profile
 	echo "Target-Profile: $(1)"; \
 	$(if $(PRIORITY), echo "Target-Profile-Priority: $(PRIORITY)"; ) \
 	echo "Target-Profile-Name: $(NAME)"; \
-	echo "Target-Profile-Packages: $(PACKAGES)"; \
+	echo "Target-Profile-Packages: $(PACKAGES) $(call extra_packages,$(DEFAULT_PACKAGES) $(PACKAGES))"; \
 	echo "Target-Profile-Description:"; \
 	echo "$$$$$$$$$(call shvar,Profile/$(1)/Description)"; \
 	echo "@@"; \
@@ -148,12 +191,11 @@ ifeq ($(TARGET_BUILD),1)
   endif
 endif
 
-GENERIC_PLATFORM_DIR := $(TOPDIR)/target/linux/generic
-
 ifneq ($(TARGET_BUILD)$(if $(DUMP),,1),)
   include $(INCLUDE_DIR)/kernel-version.mk
 endif
 
+GENERIC_PLATFORM_DIR := $(TOPDIR)/target/linux/generic
 GENERIC_BACKPORT_DIR := $(GENERIC_PLATFORM_DIR)/backport$(if $(wildcard $(GENERIC_PLATFORM_DIR)/backport-$(KERNEL_PATCHVER)),-$(KERNEL_PATCHVER))
 GENERIC_PATCH_DIR := $(GENERIC_PLATFORM_DIR)/pending$(if $(wildcard $(GENERIC_PLATFORM_DIR)/pending-$(KERNEL_PATCHVER)),-$(KERNEL_PATCHVER))
 GENERIC_HACK_DIR := $(GENERIC_PLATFORM_DIR)/hack$(if $(wildcard $(GENERIC_PLATFORM_DIR)/hack-$(KERNEL_PATCHVER)),-$(KERNEL_PATCHVER))
@@ -268,8 +310,8 @@ ifeq ($(DUMP),1)
     CPU_CFLAGS_archs = -mcpu=archs
   endif
   ifeq ($(ARCH),riscv64)
-    CPU_TYPE ?= generic
-    CPU_CFLAGS_generic:=-mabi=lp64d -march=rv64gc
+    CPU_TYPE ?= riscv64
+    CPU_CFLAGS_riscv64:=-mabi=lp64d -march=rv64imafdc
   endif
   ifeq ($(ARCH),loongarch64)
     CPU_TYPE ?= generic
@@ -308,15 +350,6 @@ ifeq ($(DUMP),1)
     ifneq ($(CONFIG_PCIEPORTBUS),)
       FEATURES += pcie
     endif
-    ifneq ($(CONFIG_PINCTRL),)
-      FEATURES += pinctrl
-    endif
-    ifneq ($(CONFIG_PM),)
-      FEATURES += pm
-    endif
-    ifneq ($(CONFIG_PWM),)
-      FEATURES += pwm
-    endif
     ifneq ($(CONFIG_USB)$(CONFIG_USB_SUPPORT),)
       ifneq ($(CONFIG_USB_ARCH_HAS_HCD)$(CONFIG_USB_EHCI_HCD),)
         FEATURES += usb
@@ -359,7 +392,7 @@ endif
 
 define BuildTargets/DumpCurrent
   .PHONY: dumpinfo
-  dumpinfo: $(call shexport,Target/Description)
+  dumpinfo : export DESCRIPTION=$$(Target/Description)
   dumpinfo:
 	@echo 'Target: $(TARGETID)'; \
 	 echo 'Target-Board: $(BOARD)'; \
@@ -376,13 +409,12 @@ define BuildTargets/DumpCurrent
 	 echo 'Linux-Kernel-Arch: $(LINUX_KARCH)'; \
 	$(if $(SUBTARGET),,$(if $(DEFAULT_SUBTARGET), echo 'Default-Subtarget: $(DEFAULT_SUBTARGET)'; )) \
 	 echo 'Target-Description:'; \
-	 echo "$$$$$(call shvar,Target/Description);"; \
+	 echo "$$$$DESCRIPTION"; \
 	 echo '@@'; \
-	 $(if $(DEFAULT_PROFILE),echo 'Target-Default-Profile: $(DEFAULT_PROFILE)';) \
-	 echo 'Default-Packages: $(DEFAULT_PACKAGES)'; \
+	 echo 'Default-Packages: $(DEFAULT_PACKAGES) $(call extra_packages,$(DEFAULT_PACKAGES))'; \
 	 $(DUMPINFO)
 	$(if $(CUR_SUBTARGET),$(SUBMAKE) -r --no-print-directory -C image -s DUMP=1 SUBTARGET=$(CUR_SUBTARGET))
-	$(if $(SUBTARGET),,@$(foreach SUBTARGET,$(SUBTARGETS),$(SUBMAKE) --no-print-directory -s DUMP=1 SUBTARGET=$(SUBTARGET); ))
+	$(if $(SUBTARGET),,@$(foreach SUBTARGET,$(SUBTARGETS),$(SUBMAKE) -s DUMP=1 SUBTARGET=$(SUBTARGET); ))
 endef
 
 include $(INCLUDE_DIR)/kernel.mk

include/toplevel.mk

@@ -75,10 +75,25 @@ endif
 
 _ignore = $(foreach p,$(IGNORE_PACKAGES),--ignore $(p))
 
-prepare-tmpinfo: FORCE
+# Config that will invalidate the .targetinfo as they will affect
+# DEFAULT_PACKAGES.
+# Keep DYNAMIC_DEF_PKG_CONF in sync with target.mk to reflect the same configs
+DYNAMIC_DEF_PKG_CONF := CONFIG_USE_APK CONFIG_SELINUX CONFIG_SMALL_FLASH CONFIG_SECCOMP
+check-dynamic-def-pkg: FORCE
+	@+DEF_PKG_CONFS=""; \
+	if [ -f $(TOPDIR)/.config ]; then \
+		for config in $(DYNAMIC_DEF_PKG_CONF); do \
+			DEF_PKG_CONFS="$$DEF_PKG_CONFS "$$(grep "$$config"=y $(TOPDIR)/.config); \
+		done; \
+	fi; \
+	[ ! -f tmp/.packagedynamicdefault ] || OLD_DEF_PKG_CONFS=$$(cat tmp/.packagedynamicdefault); \
+	[ "$$DEF_PKG_CONFS" = "$$OLD_DEF_PKG_CONFS" ] || rm -rf tmp/info/.targetinfo*; \
+	mkdir -p tmp && echo "$$DEF_PKG_CONFS" > tmp/.packagedynamicdefault;
+
+prepare-tmpinfo: check-dynamic-def-pkg FORCE
 	@+$(MAKE) -r -s $(STAGING_DIR_HOST)/.prereq-build $(PREP_MK)
 	mkdir -p tmp/info feeds
-	[ -e $(TOPDIR)/feeds/base ] || ln -sf ../package $(TOPDIR)/feeds/base
+	[ -e $(TOPDIR)/feeds/base ] || ln -sf $(TOPDIR)/package $(TOPDIR)/feeds/base
 	$(_SINGLE)$(NO_TRACE_MAKE) -j1 -r -s -f include/scan.mk SCAN_TARGET="packageinfo" SCAN_DIR="package" SCAN_NAME="package" SCAN_DEPTH=5 SCAN_EXTRA=""
 	$(_SINGLE)$(NO_TRACE_MAKE) -j1 -r -s -f include/scan.mk SCAN_TARGET="targetinfo" SCAN_DIR="target/linux" SCAN_NAME="target" SCAN_DEPTH=3 SCAN_EXTRA="" SCAN_MAKEOPTS="TARGET_BUILD=1"
 	for type in package target; do \
@@ -201,7 +216,7 @@ else
   DOWNLOAD_DIRS = package/download
 endif
 
-download: .config FORCE $(if $(wildcard $(STAGING_DIR_HOST)/bin/flock),,tools/flock/compile) $(if $(wildcard $(STAGING_DIR_HOST)/bin/zstd),,tools/zstd/compile)
+download: .config FORCE $(if $(wildcard $(STAGING_DIR_HOST)/bin/flock),,tools/flock/compile)
 	@+$(foreach dir,$(DOWNLOAD_DIRS),$(SUBMAKE) $(dir);)
 
 clean dirclean: .config

include/trusted-firmware-a.mk

@@ -1,21 +1,13 @@
 PKG_NAME ?= trusted-firmware-a
 PKG_CPE_ID ?= cpe:/a:arm:trusted_firmware-a
 
-PKG_LTS ?=
-
-ifneq ($(PKG_LTS),)
-PKG_VERSION_PREFIX:=lts-v
-PKG_BUILD_DIR = $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION_PREFIX)$(PKG_VERSION)
-else
-PKG_VERSION_PREFIX:=v
-PKG_BUILD_DIR = $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
-endif
-
 ifndef PKG_SOURCE_PROTO
-PKG_SOURCE = trusted-firmware-a-$(PKG_VERSION_PREFIX)$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://codeload.github.com/TrustedFirmware-A/trusted-firmware-a/tar.gz/$(PKG_VERSION_PREFIX)$(PKG_VERSION)?
+PKG_SOURCE = trusted-firmware-a-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/snapshot
 endif
 
+PKG_BUILD_DIR = $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
+
 PKG_TARGETS := bin
 PKG_FLAGS:=nonshared
 
@@ -85,13 +77,13 @@ endef
 DTC=$(wildcard $(LINUX_DIR)/scripts/dtc/dtc)
 
 define Build/Compile/Trusted-Firmware-A
-	+unset CC; \
-	$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
+	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
 		CROSS_COMPILE=$(TARGET_CROSS) \
 		OPENSSL_DIR=$(STAGING_DIR_HOST) \
 		$(if $(DTC),DTC="$(DTC)") \
 		PLAT=$(PLAT) \
-		BUILD_STRING="OpenWrt $(PKG_VERSION_PREFIX)$(PKG_VERSION)-$(PKG_RELEASE) ($(VARIANT))" \
+		BUILD_STRING="OpenWrt v$(PKG_VERSION)-$(PKG_RELEASE) ($(VARIANT))" \
+		$(if $(CONFIG_BINUTILS_VERSION_2_37)$(CONFIG_BINUTILS_VERSION_2_38),,LDFLAGS="-no-warn-rwx-segments") \
 		$(TFA_MAKE_FLAGS)
 endef
 

include/u-boot.mk

@@ -29,8 +29,6 @@ endif
 ifdef UBOOT_USE_INTREE_DTC
   $(eval $(call TestHostCommand,python3-dev, \
     Please install the python3-dev package, \
-    python3.13-config --includes 2>&1 | grep 'python3', \
-    python3.12-config --includes 2>&1 | grep 'python3', \
     python3.11-config --includes 2>&1 | grep 'python3', \
     python3.10-config --includes 2>&1 | grep 'python3', \
     python3.9-config --includes 2>&1 | grep 'python3', \
@@ -80,7 +78,6 @@ UBOOT_MAKE_FLAGS = \
 	PKG_CONFIG_PATH="$(STAGING_DIR_HOST)/lib/pkgconfig" \
 	PKG_CONFIG_LIBDIR="$(STAGING_DIR_HOST)/lib/pkgconfig" \
 	PKG_CONFIG_EXTRAARGS="--static" \
-	$(if $(KBUILD_CFLAGS),KCFLAGS="$(KBUILD_CFLAGS)") \
 	$(if $(findstring c,$(OPENWRT_VERBOSE)),V=1,V='')
 
 define Build/U-Boot/Target
@@ -104,7 +101,7 @@ define Build/U-Boot/Target
       endif
     endif
     $(if $(DEFAULT),DEFAULT:=$(DEFAULT))
-    URL:=https://docs.u-boot.org/en/latest/
+    URL:=http://www.denx.de/wiki/U-Boot
   endef
 
   define Package/u-boot-$(1)/install
@@ -113,11 +110,7 @@ define Build/U-Boot/Target
 endef
 
 define Build/Configure/U-Boot
-	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
-		CROSS_COMPILE=$(TARGET_CROSS) \
-		$(UBOOT_CONFIGURE_VARS) \
-		$(firstword $(UBOOT_CONFIG))_config \
-		$(wordlist 2,$(words $(UBOOT_CONFIG)),$(UBOOT_CONFIG:%=%.config))
+	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) CROSS_COMPILE=$(TARGET_CROSS) $(UBOOT_CONFIGURE_VARS) $(UBOOT_CONFIG)_config
 	$(if $(strip $(UBOOT_CUSTOMIZE_CONFIG)),
 		$(PKG_BUILD_DIR)/scripts/config --file $(PKG_BUILD_DIR)/.config $(UBOOT_CUSTOMIZE_CONFIG)
 		+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) CROSS_COMPILE=$(TARGET_CROSS) $(UBOOT_CONFIGURE_VARS) oldconfig)

include/version.mk

@@ -6,9 +6,6 @@
 # Substituted by SDK, do not remove
 # REVISION:=x
 # SOURCE_DATE_EPOCH:=x
-# BASE_FILES_VERSION:=x
-# KERNEL_VERSION:=x
-# LIBC_VERSION:=x
 
 PKG_CONFIG_DEPENDS += \
 	CONFIG_VERSION_HOME_URL \
@@ -21,19 +18,18 @@ PKG_CONFIG_DEPENDS += \
 	CONFIG_VERSION_MANUFACTURER_URL \
 	CONFIG_VERSION_PRODUCT \
 	CONFIG_VERSION_SUPPORT_URL \
-	CONFIG_VERSION_FIRMWARE_URL \
 	CONFIG_VERSION_HWREV \
 
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))
 
 VERSION_NUMBER:=$(call qstrip,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),SNAPSHOT)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),24.10.0-rc1)
 
 VERSION_CODE:=$(call qstrip,$(CONFIG_VERSION_CODE))
-VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),$(REVISION))
+VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r28158-d276b4c91a)
 
 VERSION_REPO:=$(call qstrip,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/snapshots)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/releases/24.10.0-rc1)
 
 VERSION_DIST:=$(call qstrip,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),OpenWrt)
@@ -54,9 +50,6 @@ VERSION_HOME_URL:=$(if $(VERSION_HOME_URL),$(VERSION_HOME_URL),https://openwrt.o
 VERSION_SUPPORT_URL:=$(call qstrip,$(CONFIG_VERSION_SUPPORT_URL))
 VERSION_SUPPORT_URL:=$(if $(VERSION_SUPPORT_URL),$(VERSION_SUPPORT_URL),https://forum.openwrt.org/)
 
-VERSION_FIRMWARE_URL:=$(call qstrip,$(CONFIG_VERSION_FIRMWARE_URL))
-VERSION_FIRMWARE_URL:=$(if $(VERSION_FIRMWARE_URL),$(VERSION_FIRMWARE_URL),https://downloads.openwrt.org/)
-
 VERSION_PRODUCT:=$(call qstrip,$(CONFIG_VERSION_PRODUCT))
 VERSION_PRODUCT:=$(if $(VERSION_PRODUCT),$(VERSION_PRODUCT),Generic)
 
@@ -110,7 +103,7 @@ VERSION_SED_SCRIPT:=$(SED) 's,%U,$(call sed_escape,$(VERSION_REPO)),g' \
 	-e 's,%b,$(call sed_escape,$(VERSION_BUG_URL)),g' \
 	-e 's,%u,$(call sed_escape,$(VERSION_HOME_URL)),g' \
 	-e 's,%s,$(call sed_escape,$(VERSION_SUPPORT_URL)),g' \
-	-e 's,%f,$(call sed_escape,$(VERSION_FIRMWARE_URL)),g' \
 	-e 's,%P,$(call sed_escape,$(VERSION_PRODUCT)),g' \
 	-e 's,%h,$(call sed_escape,$(VERSION_HWREV)),g' \
 	-e 's,%B,$(call sed_escape,$(SOURCE_DATE_EPOCH)),g'
+

package/Makefile

@@ -70,8 +70,7 @@ ifneq ($(CONFIG_USE_APK),)
 	(cd $(PACKAGE_DIR_ALL) && $(STAGING_DIR_HOST)/bin/apk mkndx \
 			--root $(TOPDIR) \
 			--keys-dir $(TOPDIR) \
-			--allow-untrusted \
-			$(if $(CONFIG_SIGNED_PACKAGES),--sign $(BUILD_KEY_APK_SEC),) \
+			--sign $(BUILD_KEY_APK_SEC) \
 			--output packages.adb \
 			*.apk; \
 	)
@@ -99,15 +98,9 @@ $(curdir)/install: $(TMP_DIR)/.build $(curdir)/merge $(curdir)/merge-index
 ifneq ($(CONFIG_USE_APK),)
 	$(file >$(TMP_DIR)/apk_install_list,\
 	    $(foreach pkg,$(shell cat $(PACKAGE_INSTALL_FILES) 2>/dev/null),$(pkg)$(call GetABISuffix,$(pkg))))
-	$(call apk,$(TARGET_DIR)) add --no-cache --initdb --no-scripts --arch $(ARCH_PACKAGES) \
-		--repositories-file /dev/null --repository file://$(PACKAGE_DIR_ALL)/packages.adb \
-		$(if $(CONFIG_SIGNED_PACKAGES),,--allow-untrusted) \
-		$$(cat $(TMP_DIR)/apk_install_list) \
-			"base-files=$(shell cat $(STAGING_DIR)/base-files.version)" \
-			"libc=$(shell cat $(STAGING_DIR)/libc.version)" \
-			"kernel=$(subst -rc,_rc,$(shell cat $(STAGING_DIR)/kernel.version))"
-
-	rm -rf $(TARGET_DIR)/run
+	$(call apk,$(TARGET_DIR)) add --initdb --no-scripts --arch $(ARCH_PACKAGES) \
+		--repositories-file /dev/zero --repository file://$(PACKAGE_DIR_ALL)/packages.adb \
+		$$(cat $(TMP_DIR)/apk_install_list)
 else
 	$(file >$(TMP_DIR)/opkg_install_list,\
 	  $(call opkg_package_files,\
@@ -129,19 +122,15 @@ $(curdir)/index: FORCE
 	@echo Generating package index...
 ifneq ($(CONFIG_USE_APK),)
 	@for d in $(PACKAGE_SUBDIRS); do \
-		set -e; \
 		mkdir -p $$d; \
 		cd $$d || continue; \
 		ls *.apk >/dev/null 2>&1 || continue; \
 		$(STAGING_DIR_HOST)/bin/apk mkndx \
 			--root $(TOPDIR) \
 			--keys-dir $(TOPDIR) \
-			--allow-untrusted \
-			$(if $(CONFIG_SIGNED_PACKAGES),--sign $(BUILD_KEY_APK_SEC),) \
+			--sign $(BUILD_KEY_APK_SEC) \
 			--output packages.adb \
-			*.apk; \
-		$(STAGING_DIR_HOST)/bin/apk adbdump --format json packages.adb | \
-			$(SCRIPT_DIR)/make-index-json.py -f apk -a "$(ARCH_PACKAGES)" - > index.json; \
+			$$(ls *.apk | grep -v 'kernel\|libc'); \
 	done
 else
 	@for d in $(PACKAGE_SUBDIRS); do ( \
@@ -153,7 +142,10 @@ else
 			$(call ERROR_MESSAGE,WARNING: Applying padding in $$d/Packages to workaround usign SHA-512 bug!); \
 			{ echo ""; echo ""; } >> Packages;; \
 		esac; \
-		$(SCRIPT_DIR)/make-index-json.py -f opkg -a "$(ARCH_PACKAGES)" Packages > index.json; \
+		echo -n '{"architecture": "$(ARCH_PACKAGES)", "packages":{' > index.json; \
+		sed -n -e 's/^Package: \(.*\)$$/"\1":/p' -e 's/^Version: \(.*\)$$/"\1",/p' Packages | tr '\n' ' ' >> index.json; \
+		echo '}}' >> index.json; \
+		sed -i 's/, }}/}}/' index.json; \
 		gzip -9nc Packages > Packages.gz; \
 	); done
 ifdef CONFIG_SIGNED_PACKAGES
@@ -173,7 +165,6 @@ ifdef CONFIG_JSON_CYCLONEDX_SBOM
 	); done
 endif
 endif
-	$(call sha256sums,$(OUTPUT_DIR)/packages/$(ARCH_PACKAGES),1)
 
 $(curdir)/flags-install:= -j1
 

package/base-files/Makefile

@@ -39,13 +39,9 @@ endif
 define Package/base-files
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:= \
-	+netifd +libc +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring \
-	+NAND_SUPPORT:ubi-utils +fstools +fwtool \
-	+SELINUX:procd-selinux +!SELINUX:procd +USE_SECCOMP:procd-seccomp \
-	+SELINUX:busybox-selinux +!SELINUX:busybox
+  DEPENDS:=+netifd +libc +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool
   TITLE:=Base filesystem for OpenWrt
-  URL:=https://openwrt.org/
+  URL:=http://openwrt.org/
   VERSION:=$(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION)))
 endef
 
@@ -250,13 +246,12 @@ endif
 		rm -f $(1)/etc/banner.failsafe,)
 
 ifneq ($(CONFIG_USE_APK),)
-	mkdir -p $(1)/etc/apk/repositories.d
-	$(call FeedSourcesAppendAPK,$(1)/etc/apk/repositories.d/distfeeds.list)
-	$(VERSION_SED_SCRIPT) $(1)/etc/apk/repositories.d/distfeeds.list
+	mkdir -p $(1)/etc/apk/
+	$(call FeedSourcesAppendAPK,$(1)/etc/apk/repositories)
+	$(VERSION_SED_SCRIPT) $(1)/etc/apk/repositories
 
 	rm -f $(1)/etc/uci-defaults/13_fix-group-user
 	rm -f $(1)/sbin/pkg_check
-	echo $(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION))) >$(STAGING_DIR)/base-files.version
 else
 	$(if $(CONFIG_CLEAN_IPKG),, \
 		mkdir -p $(1)/etc/opkg; \

package/base-files/files/bin/board_detect

@@ -1,22 +1,14 @@
 #!/bin/sh
 
-REAL_CFG=$1
+CFG=$1
 
-[ -n "$REAL_CFG" ] || REAL_CFG=/etc/board.json
+[ -n "$CFG" ] || CFG=/etc/board.json
 
-if [ -d "/etc/board.d/" ] && [ ! -s "$REAL_CFG" ]; then
-	# Use temp file to prevent incomplete file on power-cut, CFG is used by the sourced script to read/write the file
-	CFG="$(dirname "$REAL_CFG")/.$(basename "$REAL_CFG").tmp"
-	rm -f "$CFG" || exit
+[ -d "/etc/board.d/" -a ! -s "$CFG" ] && {
 	for a in $(ls /etc/board.d/*); do
-		[ -s "$a" ] || continue
-		(. "$a")
+		[ -s $a ] || continue;
+		$(. $a)
 	done
-fi
+}
 
-if [ -s "$CFG" ]; then
-	mv "$CFG" "$REAL_CFG" || exit
-else
-	rm -f "$CFG"
-	exit 1
-fi
+[ -s "$CFG" ] || return 1

package/base-files/files/bin/config_generate

@@ -3,7 +3,6 @@
 CFG=/etc/board.json
 
 . /usr/share/libubox/jshn.sh
-. /lib/functions/ipv4.sh
 
 [ -s $CFG ] || /bin/board_detect || exit 1
 [ -s /etc/config/network -a -s /etc/config/system ] && exit 0
@@ -43,16 +42,16 @@ generate_static_network() {
 		set network.loopback='interface'
 		set network.loopback.device='lo'
 		set network.loopback.proto='static'
-		add_list network.loopback.ipaddr='127.0.0.1/8'
-		delete network.globals
-		set network.globals='globals'
-		set network.globals.dhcp_default_duid='auto'
+		set network.loopback.ipaddr='127.0.0.1'
+		set network.loopback.netmask='255.0.0.0'
 	EOF
-	[ -e /proc/sys/net/ipv6 ] && {
-		uci -q batch <<-EOF
-			set network.globals.ula_prefix='auto'
-		EOF
-	}
+		[ -e /proc/sys/net/ipv6 ] && {
+			uci -q batch <<-EOF
+				delete network.globals
+				set network.globals='globals'
+				set network.globals.ula_prefix='auto'
+			EOF
+		}
 
 	if json_is_a dsl object; then
 		json_select dsl
@@ -161,19 +160,18 @@ generate_network() {
 
 	case "$protocol" in
 		static)
-			local ipad netm prefix
+			local ipad
 			case "$1" in
 				lan) ipad=${ipaddr:-"192.168.1.1"} ;;
 				*) ipad=${ipaddr:-"192.168.$((addr_offset++)).1"} ;;
 			esac
 
 			netm=${netmask:-"255.255.255.0"}
-			str2ip netm "$netm"
-			netmask2prefix prefix "$netm"
 
 			uci -q batch <<-EOF
 				set network.$1.proto='static'
-				add_list network.$1.ipaddr='$ipad/$prefix'
+				set network.$1.ipaddr='$ipad'
+				set network.$1.netmask='$netm'
 			EOF
 			[ -e /proc/sys/net/ipv6 ] && uci set network.$1.ip6assign='60'
 		;;
@@ -314,8 +312,7 @@ generate_static_system() {
 		delete system.@system[0]
 		add system system
 		set system.@system[-1].hostname='OpenWrt'
-		set system.@system[-1].timezone='GMT0'
-		set system.@system[-1].zonename='UTC'
+		set system.@system[-1].timezone='UTC'
 		set system.@system[-1].ttylogin='0'
 		set system.@system[-1].log_size='128'
 		set system.@system[-1].urandom_seed='0'

package/base-files/files/bin/ipcalc.sh

@@ -133,7 +133,8 @@ _ip2str START "$start"
 _ip2str END "$end"
 
 if [ "$start" -le "$ipaddr" ] && [ "$ipaddr" -le "$end" ]; then
-    echo "warning: address $IP inside range $START..$END" >&2
+    echo "error: address $IP inside range $START..$END" >&2
+    exit 1
 fi
 
 echo "START=$START"

package/base-files/files/etc/group

@@ -5,6 +5,7 @@ mail:x:8:
 dialout:x:20:
 audio:x:29:
 www-data:x:33:
+ftp:x:55:
 users:x:100:
 network:x:101:
 nogroup:x:65534:

package/base-files/files/etc/init.d/boot

@@ -10,13 +10,10 @@ uci_apply_defaults() {
 	cd /etc/uci-defaults || return 0
 	files="$(ls)"
 	[ -z "$files" ] && return 0
-	applied=""
 	for file in $files; do
-		( . "./$(basename $file)" ) && applied="$applied $file"
+		( . "./$(basename $file)" ) && rm -f "$file"
 	done
 	uci commit
-	sync
-	rm -f $applied
 }
 
 boot() {

package/base-files/files/etc/init.d/done

@@ -5,7 +5,6 @@ START=95
 boot() {
 	mount_root done
 	rm -f /sysupgrade.tgz && sync
-	rm -f /tmp/sysupgrade.tar && sync
 
 	# process user commands
 	[ -f /etc/rc.local ] && {

package/base-files/files/etc/init.d/led

@@ -3,10 +3,6 @@
 
 START=96
 
-extra_command "turnon" "Put the LEDs into their default state"
-extra_command "turnoff" "Turn all LEDs off"
-extra_command "blink" "Blink all LEDs"
-
 led_color_set() {
 	local cfg="$1"
 	local sysfs="$2"
@@ -51,7 +47,6 @@ load_led() {
 	local delayon
 	local delayoff
 	local interval
-	local brightness
 
 	config_get sysfs $1 sysfs
 	config_get name $1 name "$sysfs"
@@ -68,7 +63,6 @@ load_led() {
 	config_get message $1 message ""
 	config_get gpio $1 gpio "0"
 	config_get_bool inverted $1 inverted "0"
-	config_get brightness $1 brightness
 
 	[ "$2" ] && [ "$sysfs" != "$2" ] && return
 
@@ -106,10 +100,8 @@ load_led() {
 		[ "$default" = 0 ] &&
 			echo 0 >/sys/class/leds/${sysfs}/brightness
 
-		[ "$default" = 1 ] && {
-			[ -z "$brightness" ] && brightness="$(cat /sys/class/leds/${sysfs}/max_brightness)"
-			echo "$brightness" > /sys/class/leds/${sysfs}/brightness
-		}
+		[ $default = 1 ] &&
+			cat /sys/class/leds/${sysfs}/max_brightness > /sys/class/leds/${sysfs}/brightness
 
 		led_color_set "$1" "$sysfs"
 
@@ -176,31 +168,7 @@ load_led() {
 	}
 }
 
-turnoff() {
-	for led in `ls /sys/class/leds/`; do
-		echo 0 > /sys/class/leds/$led/brightness
-	done
-}
-
-turnon() {
-	turnoff
-	. /etc/diag.sh
-	set_state done
-	start
-}
-
-blink() {
-	for led in `ls /sys/class/leds/`; do
-		echo 0 > /sys/class/leds/$led/brightness
-		echo timer > /sys/class/leds/$led/trigger
-	done
-}
-
 start() {
-	[ "$(uci -q get system.@system[-1].leds_off)" = '1' ] && {
-		turnoff
-		exit 0
-	}
 	[ -e /sys/class/leds/ ] && {
 		[ -s /var/run/led.state ] && {
 			local led trigger brightness color

package/base-files/files/etc/init.d/system

@@ -9,8 +9,8 @@ validate_system_section() {
 		'hostname:string:OpenWrt' \
 		'conloglevel:uinteger' \
 		'buffersize:uinteger' \
-		'timezone:string:GMT0' \
-		'zonename:string:UTC'
+		'timezone:string:UTC' \
+		'zonename:string'
 }
 
 system_config() {

package/base-files/files/etc/passwd

@@ -1,4 +1,5 @@
 root:x:0:0:root:/root:/bin/ash
 daemon:*:1:1:daemon:/var:/bin/false
+ftp:*:55:55:ftp:/home/ftp:/bin/false
 network:*:101:101:network:/var:/bin/false
 nobody:*:65534:65534:nobody:/var:/bin/false

package/base-files/files/etc/profile

@@ -1,39 +1,40 @@
-unset FAILSAFE
 [ -e /tmp/.failsafe ] && export FAILSAFE=1
 
 [ -f /etc/banner ] && cat /etc/banner
-[ -n "$FAILSAFE" ] && [ -f /etc/banner.failsafe ] && cat /etc/banner.failsafe
+[ -n "$FAILSAFE" ] && cat /etc/banner.failsafe
 
-if grep -Fsq '/ overlay ro,' /proc/mounts ; then
-cat << EOF
-
- === WARNING! ======================================
- Your JFFS2-partition seems full and overlayfs is
- mounted as READ-ONLY!
- Please try to remove files from /overlay/upper/...
- and reboot!
- ---------------------------------------------------
-
-EOF
-fi
+grep -Fsq '/ overlay ro,' /proc/mounts && {
+	echo 'Your JFFS2-partition seems full and overlayfs is mounted read-only.'
+	echo 'Please try to remove files from /overlay/upper/... and reboot!'
+}
 
 export PATH="%PATH%"
-HOME=$(grep -E "^${USER:-root}:" /etc/passwd | cut -d ":" -f 6)
-HOME=${HOME:-/root}
-export HOME
+export HOME=$(grep -e "^${USER:-root}:" /etc/passwd | cut -d ":" -f 6)
+export HOME=${HOME:-/root}
 export PS1='\u@\h:\w\$ '
 export ENV=/etc/shinit
 
 case "$TERM" in
 	xterm*|rxvt*)
-		export PS1='\[\e]0;\u@\h: \w\a\]'"$PS1"
-	;;
+		export PS1='\[\e]0;\u@\h: \w\a\]'$PS1
+		;;
 esac
 
-if [ -z "$FAILSAFE" ] ; then
-	for FILE in /etc/profile.d/*.sh ; do
-		[ -f "${FILE%.sh}.hush" ] && continue
-		[ -f "$FILE" ] && . "$FILE"
+[ -n "$FAILSAFE" ] || {
+	for FILE in /etc/profile.d/*.sh; do
+		[ -e "$FILE" ] && . "$FILE"
 	done
 	unset FILE
+}
+
+if ( grep -qs '^root::' /etc/shadow && \
+     [ -z "$FAILSAFE" ] )
+then
+cat << EOF
+=== WARNING! =====================================
+There is no root password defined on this device!
+Use the "passwd" command to set up a new password
+in order to prevent unauthorized SSH logins.
+--------------------------------------------------
+EOF
 fi

package/base-files/files/etc/profile.d/00-passwordless-root.sh

@@ -1,11 +0,0 @@
-if grep -Esq '^root::' /etc/shadow ; then
-cat << EOF
-
- === WARNING! =====================================
- There is no root password defined on this device!
- Use the "passwd" command to set up a new password
- in order to prevent unauthorized SSH logins.
- --------------------------------------------------
-
-EOF
-fi

package/base-files/files/etc/profile.d/apk-cheatsheet.sh

@@ -1,21 +0,0 @@
-if [ -x /usr/bin/apk ] ; then
-cat << EOF
-
- OpenWrt recently switched to the "apk" package manager!
-
- OPKG Command           APK Equivalent      Description
- ------------------------------------------------------------------
- opkg install <pkg>     apk add <pkg>       Install a package
- opkg remove <pkg>      apk del <pkg>       Remove a package
- opkg upgrade           apk upgrade         Upgrade all packages
- opkg files <pkg>       apk info -L <pkg>   List package contents
- opkg list-installed    apk info            List installed packages
- opkg update            apk update          Update package lists
- opkg search <pkg>      apk search <pkg>    Search for packages
- ------------------------------------------------------------------
-
-For more information visit:
-https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet
-
-EOF
-fi

package/base-files/files/etc/rc.button/reset

@@ -23,7 +23,7 @@ released)
 	elif [ "$SEEN" -ge 5 -a -n "$OVERLAY" ]
 	then
 		echo "FACTORY RESET" > /dev/console
-		factoryreset -y && reboot &
+		jffs2reset -y && reboot &
 	fi
 ;;
 esac

package/base-files/files/etc/rc.common

@@ -100,6 +100,10 @@ service_triggers() {
 	return 0
 }
 
+service_data() {
+	return 0
+}
+
 service_running() {
 	local instance="${1:-*}"
 

package/base-files/files/etc/shadow

@@ -1,4 +1,5 @@
 root:::0:99999:7:::
 daemon:*:0:0:99999:7:::
+ftp:*:0:0:99999:7:::
 network:*:0:0:99999:7:::
 nobody:*:0:0:99999:7:::

package/base-files/files/etc/uci-defaults/14_network-generate-duid

@@ -1,9 +0,0 @@
-[ "$(uci -q get network.globals.dhcp_default_duid || echo "auto")" != "auto" ] && exit 0
-
-uci -q batch <<-EOF >/dev/null
-	# DUID-UUID - RFC6355
-	set network.globals.dhcp_default_duid="$(printf '%s%s' '0004' $(cat /proc/sys/kernel/random/uuid | sed -e 's/-//g'))"
-	commit network
-EOF
-
-exit 0

package/base-files/files/etc/uci-defaults/15_migrate-time-zonename

@@ -1,6 +0,0 @@
-zonename="$(uci -q get system.@system[0].zonename)"
-case "$zonename" in
-        *[[:space:]]*) uci set system.@system[0].zonename="${zonename// /_}" ;;
-esac
-
-exit 0

package/base-files/files/lib/functions.sh

@@ -216,10 +216,6 @@ default_prerm() {
 	local filelist="${root}/usr/lib/opkg/info/${pkgname}.list"
 	[ -f "$root/lib/apk/packages/${pkgname}.list" ] && filelist="$root/lib/apk/packages/${pkgname}.list"
 
-	if [ -e "$root/lib/apk/packages/${pkgname}.alternatives" ]; then
-		update_alternatives remove "${pkgname}"
-	fi
-
 	if [ -f "$root/usr/lib/opkg/info/${pkgname}.prerm-pkg" ]; then
 		( . "$root/usr/lib/opkg/info/${pkgname}.prerm-pkg" )
 		ret=$?
@@ -356,7 +352,8 @@ default_postinst() {
 		add_group_and_user "${pkgname}"
 	fi
 
-	if [ -e "${root}/lib/apk/packages/${pkgname}.alternatives" ]; then
+	if [ -e "${root}/lib/apk/packages/${pkgname}.list" ]; then
+		filelist="${root}/lib/apk/packages/${pkgname}.list"
 		update_alternatives install "${pkgname}"
 	fi
 
@@ -382,7 +379,7 @@ default_postinst() {
 			uci commit
 		fi
 
-		rm -f /tmp/luci-indexcache.*
+		rm -f /tmp/luci-indexcache
 	fi
 
 	if [ -f "$root/usr/lib/opkg/info/${pkgname}.postinst-pkg" ]; then
@@ -447,7 +444,7 @@ find_mmc_part() {
 	fi
 
 	for DEVNAME in /sys/block/$ROOTDEV/mmcblk*p*; do
-		PARTNAME="$(grep PARTNAME ${DEVNAME}/uevent | cut -f2 -d'=' 2>/dev/null)"
+		PARTNAME="$(grep PARTNAME ${DEVNAME}/uevent | cut -f2 -d'=')"
 		[ "$PARTNAME" = "$1" ] && echo "/dev/$(basename $DEVNAME)" && return 0
 	done
 }

package/base-files/files/lib/functions/caldata.sh

@@ -125,8 +125,8 @@ caldata_valid() {
 caldata_patch_data() {
 	local data=$1
 	local data_count=$((${#1} / 2))
-	[ -n "$2" ] && local data_offset=$(($2))
-	[ -n "$3" ] && local chksum_offset=$(($3))
+	local data_offset=$(($2))
+	local chksum_offset=$(($3))
 	local target=$4
 	local fw_data
 	local fw_chksum

package/base-files/files/lib/functions/network.sh

@@ -24,17 +24,6 @@ __network_ifstatus() {
 	eval "$__tmp"
 }
 
-# determine the IAID of the given logical interface
-# 1: destination variable
-# 2: interface
-network_generate_iface_iaid() {
-	local __iaid
-
-	__iaid=$(printf '%s' "$2" | md5sum | cut -c 1-8)
-
-	export "$1=$__iaid"
-}
-
 # determine first IPv4 address of given logical interface
 # 1: destination variable
 # 2: interface

package/base-files/files/lib/functions/system.sh

@@ -66,7 +66,7 @@ get_mac_ascii() {
 	local key="$2"
 	local mac_dirty
 
-	mac_dirty=$(strings "$part" | tr -d ' \t' | sed -n 's/^'"$key"'=//p' | head -n 1)
+	mac_dirty=$(strings "$part" | sed -n 's/^'"$key"'=//p')
 
 	# "canonicalize" mac
 	[ -n "$mac_dirty" ] && macaddr_canonicalize "$mac_dirty"
@@ -315,10 +315,3 @@ macaddr_canonicalize() {
 dt_is_enabled() {
 	grep -q okay "/proc/device-tree/$1/status"
 }
-
-get_linux_version() {
-	local ver=$(uname -r)
-	local minor=${ver%\.*}
-
-	printf "%d%02d%03d" ${ver%%\.*} ${minor#*\.} ${ver##*\.} 2>/dev/null
-}

package/base-files/files/lib/functions/uci-defaults.sh

@@ -771,27 +771,6 @@ ucidef_add_wlan() {
 	ucidef_wlan_idx="$((ucidef_wlan_idx + 1))"
 }
 
-ucidef_set_interface_netdev_range() {
-	local interface="$1"
-	local base_netdev="$2"
-	local start="$3"
-	local stop="$4"
-	local netdevs
-	local i
-
-	if [ "$stop" -ge "$start" ]; then
-		i="$start"
-		netdevs="$base_netdev$i"
-
-		while [ "$i" -lt "$stop" ]; do
-			i=$((i + 1))
-			netdevs="$netdevs $base_netdev$i"
-		done
-
-		ucidef_set_interface "$interface" device "$netdevs"
-	fi
-}
-
 board_config_update() {
 	json_init
 	[ -f ${CFG} ] && json_load "$(cat ${CFG})"

package/base-files/files/lib/upgrade/emmc.sh

@@ -8,20 +8,13 @@ emmc_upgrade_tar() {
 	[ "$CI_KERNPART" -a -z "$EMMC_KERN_DEV" ] && export EMMC_KERN_DEV="$(find_mmc_part $CI_KERNPART $CI_ROOTDEV)"
 	[ "$CI_ROOTPART" -a -z "$EMMC_ROOT_DEV" ] && export EMMC_ROOT_DEV="$(find_mmc_part $CI_ROOTPART $CI_ROOTDEV)"
 	[ "$CI_DATAPART" -a -z "$EMMC_DATA_DEV" ] && export EMMC_DATA_DEV="$(find_mmc_part $CI_DATAPART $CI_ROOTDEV)"
-	[ "$CI_DTBPART" -a -z "$EMMC_DTB_DEV" ]   && export EMMC_DTB_DEV="$(find_mmc_part $CI_DTBPART $CI_ROOTDEV)"
 	local has_kernel
 	local has_rootfs
-	local has_dtb
-	local gz
-	local board_dir
-	[ "$(identify_magic_long $(get_magic_long "$tar_file" cat))" = "gzip" ] && \
-		gz="z"
-	board_dir=$(tar t${gz}f "$tar_file" | grep -m 1 '^sysupgrade-.*/$')
+	local board_dir=$(tar tf "$tar_file" | grep -m 1 '^sysupgrade-.*/$')
 	board_dir=${board_dir%/}
 
-	tar t${gz}f "$tar_file" ${board_dir}/kernel 1>/dev/null 2>/dev/null && has_kernel=1
-	tar t${gz}f "$tar_file" ${board_dir}/root 1>/dev/null 2>/dev/null && has_rootfs=1
-	tar t${gz}f "$tar_file" ${board_dir}/dtb 1>/dev/null 2>/dev/null && has_dtb=1
+	tar tf "$tar_file" ${board_dir}/kernel 1>/dev/null 2>/dev/null && has_kernel=1
+	tar tf "$tar_file" ${board_dir}/root 1>/dev/null 2>/dev/null && has_rootfs=1
 
 	[ "$has_rootfs" = 1 -a "$EMMC_ROOT_DEV" ] && {
 		# Invalidate kernel image while rootfs is being written
@@ -30,16 +23,14 @@ emmc_upgrade_tar() {
 			sync
 		}
 
-		export EMMC_ROOTFS_BLOCKS=$(($(tar x${gz}f "$tar_file" ${board_dir}/root -O | dd of="$EMMC_ROOT_DEV" bs=512 2>&1 | grep "records out" | cut -d' ' -f1)))
+		export EMMC_ROOTFS_BLOCKS=$(($(tar xf "$tar_file" ${board_dir}/root -O | dd of="$EMMC_ROOT_DEV" bs=512 2>&1 | grep "records out" | cut -d' ' -f1)))
 		# Account for 64KiB ROOTDEV_OVERLAY_ALIGN in libfstools
 		EMMC_ROOTFS_BLOCKS=$(((EMMC_ROOTFS_BLOCKS + 127) & ~127))
 		sync
 	}
-	[ "$has_dtb" = 1 -a "$EMMC_DTB_DEV" ] &&
-		export EMMC_DTB_BLOCKS=$(($(tar x${gz}f "$tar_file" ${board_dir}/dtb -O | dd of="$EMMC_DTB_DEV" bs=512 2>&1 | grep "records out" | cut -d' ' -f1)))
 
 	[ "$has_kernel" = 1 -a "$EMMC_KERN_DEV" ] &&
-		export EMMC_KERNEL_BLOCKS=$(($(tar x${gz}f "$tar_file" ${board_dir}/kernel -O | dd of="$EMMC_KERN_DEV" bs=512 2>&1 | grep "records out" | cut -d' ' -f1)))
+		export EMMC_KERNEL_BLOCKS=$(($(tar xf "$tar_file" ${board_dir}/kernel -O | dd of="$EMMC_KERN_DEV" bs=512 2>&1 | grep "records out" | cut -d' ' -f1)))
 
 	if [ -z "$UPGRADE_BACKUP" ]; then
 		if [ "$EMMC_DATA_DEV" ]; then

package/base-files/files/lib/upgrade/fwtool.sh

@@ -42,9 +42,7 @@ fwtool_check_image() {
 		v "Invalid image metadata"
 		return 1
 	}
-	# Step 1. check if oem_name file exist and is not empty
-	# If the above is true store the contents (b3000) in $oem value for later
-	[ -s /tmp/sysinfo/oem_name ] && oem="$(cat /tmp/sysinfo/oem_name)"
+
 	device="$(cat /tmp/sysinfo/board_name)"
 	devicecompat="$(uci -q get system.@system[0].compat_version)"
 	[ -n "$devicecompat" ] || devicecompat="1.0"
@@ -63,16 +61,7 @@ fwtool_check_image() {
 	json_get_keys dev_keys
 	for k in $dev_keys; do
 		json_get_var dev "$k"
-		# Step 2.
-		# lets start with the original case [ "$dev" = "$device" ]
-		# if the evaluated firmware is vanila openwrt, this evals as true -ie
-		# [ ("$dev" == "glinet.gl-b3000") == ("$device" == "glinet,gl-b3000") ]
-		# however if the firmware is oem then $dev = b3000 and the above check fails resulting 
-		# in the erroneous warnings.
-		# so we add the secondary check [ "$dev" = "$oem" ];
-		# If in Step 1 the oem_file was found and valid, the $oem == "b3000" so
-		# [ ("$dev" == "b3000) == ("$oem" == "b3000") ] so firmware is valid oem
-		if [ "$dev" = "$device" ] || [ "$dev" = "$oem" ]; then
+		if [ "$dev" = "$device" ]; then
 			# major compat version -> no sysupgrade
 			if [ "${devicecompat%.*}" != "${imagecompat%.*}" ]; then
 				v "The device is supported, but this image is incompatible for sysupgrade based on the image version ($devicecompat->$imagecompat)."
@@ -81,16 +70,7 @@ fwtool_check_image() {
 			fi
 
 			# minor compat version -> sysupgrade with -n required
-			# Step 3.
-			# here we must check if $dev == $oem to use this native compatability check
-			# so we add the check for [ "$dev" = "$oem" ]
-			if (([ "${devicecompat#.*}" != "${imagecompat#.*}" ] || [ "$dev" = "$oem" ])) && [ "$SAVE_CONFIG" = "1" ]; then
-				# Step 4.
-				# here we have to gaurd against the default case, oem may exsist and default will pass 
-				# the original check [ "${devicecompat#.*}" != "${imagecompat#.*}" ] so we must
-				# explicitly check $dev == $oem, if it is we update(reuse) the $devicecompat and imagecompat
-				# variable to reflect the case - ( Openwrt -> OEM )
-				[ "$dev" = "$oem" ] && devicecompat="Openwrt " && imagecompat=" OEM"
+			if [ "${devicecompat#.*}" != "${imagecompat#.*}" ] && [ "$SAVE_CONFIG" = "1" ]; then
 				[ "$IGNORE_MINOR_COMPAT" = 1 ] && return 0
 				v "The device is supported, but the config is incompatible to the new image ($devicecompat->$imagecompat). Please upgrade without keeping config (sysupgrade -n)."
 				[ -n "$compatmessage" ] && v "$compatmessage"

package/base-files/files/lib/upgrade/nand.sh

@@ -217,16 +217,6 @@ nand_upgrade_prepare_ubi() {
 	[ "$root_ubivol" ] && ubirmvol /dev/$root_ubidev -N "$CI_ROOTPART" || :
 	[ "$data_ubivol" ] && ubirmvol /dev/$root_ubidev -N rootfs_data || :
 
-	# create provisioning vol
-	if [ "${UPGRADE_OPT_ADD_PROVISIONING:-0}" -gt 0 ]; then
-		[ -n "$(nand_find_volume $root_ubidev provisioning)" ] || {
-			if ! ubimkvol /dev/$root_ubidev -N provisioning -s 131072; then
-				echo "cannot create provisioning volume"
-				return 1
-			fi
-		}
-	fi
-
 	# create kernel vol
 	if [ -n "$kernel_length" ]; then
 		if ! ubimkvol /dev/$kern_ubidev -N "$CI_KERNPART" -s $kernel_length; then

package/base-files/files/sbin/firstboot

@@ -1,3 +1,3 @@
 #!/bin/sh
 
-/sbin/factoryreset $@
+/sbin/jffs2reset $@

package/base-files/files/sbin/sysupgrade

@@ -11,7 +11,6 @@ INSTALLED_PACKAGES=${ETCBACKUP_DIR}/installed_packages.txt
 COMMAND=/lib/upgrade/do_stage2
 
 # File-local globals
-ADD_PROVISIONING=0
 SAVE_OVERLAY=0
 SAVE_OVERLAY_PATH=
 SAVE_PARTITIONS=1
@@ -21,7 +20,6 @@ CONF_IMAGE=
 CONF_BACKUP_LIST=0
 CONF_BACKUP=
 CONF_RESTORE=
-USE_CURR_PART=0
 NEED_IMAGE=
 HELP=0
 TEST=0
@@ -46,14 +44,12 @@ while [ -n "$1" ]; do
 		-c) SAVE_OVERLAY=1 SAVE_OVERLAY_PATH=/etc;;
 		-o) SAVE_OVERLAY=1 SAVE_OVERLAY_PATH=/;;
 		-p) SAVE_PARTITIONS=0;;
-		-P) ADD_PROVISIONING=1;;
 		-k) SAVE_INSTALLED_PKGS=1;;
 		-u) SKIP_UNCHANGED=1;;
 		-b|--create-backup) CONF_BACKUP="$2" NEED_IMAGE=1; shift;;
 		-r|--restore-backup) CONF_RESTORE="$2" NEED_IMAGE=1; shift;;
 		-l|--list-backup) CONF_BACKUP_LIST=1;;
 		-f) CONF_IMAGE="$2"; shift;;
-		-s) USE_CURR_PART=1;;
 		-F|--force) export FORCE=1;;
 		-T|--test) TEST=1;;
 		-h|--help) HELP=1; break;;
@@ -70,7 +66,7 @@ done
 print_help() {
 	cat <<EOF
 Usage: $0 [<upgrade-option>...] <image file or URL>
-       $0 [-q] [-i] [-c] [-u] [-o] [-k] [-P] <backup-command> <file>
+       $0 [-q] [-i] [-c] [-u] [-o] [-k] <backup-command> <file>
 
 upgrade-option:
 	-f <config>  restore configuration from .tar.gz (file or url)
@@ -83,9 +79,6 @@ upgrade-option:
 	-p           do not attempt to restore the partition table after flash.
 	-k           include in backup a list of current installed packages at
 	             $INSTALLED_PACKAGES
-	-s           stay on current partition (for dual firmware devices)
-	-P           create provisioning partition to keep sensitive data across
-	             factory resets.
 	-T | --test
 	             Verify image and config .tar.gz but do not actually flash.
 	-F | --force
@@ -273,12 +266,12 @@ create_backup_archive() {
 
 		if [ $ret -eq 0 ]; then
 			for service in /etc/init.d/*; do
-				if ! $service enabled >/dev/null 2>&1; then
+				if ! $service enabled; then
 				disabled="$disabled$service disable\n"
 				fi
 			done
 			disabled="$disabled\nexit 0"
-			tar_print_member "/etc/uci-defaults/10_disable_services" "$(echo -e $disabled)" "$(date -r /etc/rc.d "+%s")" || ret=1
+			tar_print_member "/etc/uci-defaults/10_disable_services" "$(echo -e $disabled)" || ret=1
 		fi
 
 		# Part of archive with installed packages info
@@ -286,19 +279,11 @@ create_backup_archive() {
 			if [ "$SAVE_INSTALLED_PKGS" -eq 1 ]; then
 				# Format: pkg-name<TAB>{rom,overlay,unknown}
 				# rom is used for pkgs in /rom, even if updated later
-				if [ -d "/usr/lib/opkg/info" ]; then
-					tar_print_member "$INSTALLED_PACKAGES" "$(find /usr/lib/opkg/info -name "*.control" \( \
-						\( -exec test -f /rom/{} \; -exec echo {} rom \; \) -o \
-						\( -exec test -f /overlay/upper/{} \; -exec echo {} overlay \; \) -o \
-						\( -exec echo {} unknown \; \) \
-						\) | sed -e 's,.*/,,;s/\.control /\t/')" || ret=1
-				elif [ -d "/lib/apk/packages" ]; then
-					tar_print_member "$INSTALLED_PACKAGES" "$(find /lib/apk/packages -name "*.list" \( \
-						\( -exec test -f /rom/{} \; -exec echo {} rom \; \) -o \
-						\( -exec test -f /overlay/upper/{} \; -exec echo {} overlay \; \) -o \
-						\( -exec echo {} unknown \; \) \
-						\) | sed -e 's,.*/,,;s/\.list /\t/')" || ret=1
-				fi
+				tar_print_member "$INSTALLED_PACKAGES" "$(find /usr/lib/opkg/info -name "*.control" \( \
+					\( -exec test -f /rom/{} \; -exec echo {} rom \; \) -o \
+					\( -exec test -f /overlay/upper/{} \; -exec echo {} overlay \; \) -o \
+					\( -exec echo {} unknown \; \) \
+					\) | sed -e 's,.*/,,;s/\.control /\t/')" || ret=1
 			fi
 		fi
 
@@ -384,9 +369,8 @@ json_load "$(/usr/libexec/validate_firmware_image "$IMAGE")" || {
 	exit 1
 }
 json_get_var valid "valid"
-json_get_var forceable "forceable"
 [ "$valid" -eq 0 ] && {
-	if [ $FORCE -eq 1 ] && [ "$forceable" -eq 1 ]; then
+	if [ $FORCE -eq 1 ]; then
 		echo "Image check failed but --force given - will update anyway!" >&2
 	else
 		echo "Image check failed." >&2
@@ -432,8 +416,6 @@ else
 	json_add_string command "$COMMAND"
 	json_add_object options
 	json_add_int save_partitions "$SAVE_PARTITIONS"
-	json_add_int add_provisioning "$ADD_PROVISIONING"
-	[ $USE_CURR_PART -eq 1 ] && json_add_boolean use_curr_part 1
 	json_close_object
 
 	ubus call system sysupgrade "$(json_dump)"

package/base-files/files/usr/lib/os-release

@@ -7,7 +7,6 @@ VERSION_ID="%v"
 HOME_URL="%u"
 BUG_URL="%b"
 SUPPORT_URL="%s"
-FIRMWARE_URL="%f"
 BUILD_ID="%R"
 OPENWRT_BOARD="%S"
 OPENWRT_ARCH="%A"

package/base-files/files/usr/libexec/validate_firmware_image

@@ -56,17 +56,7 @@ json_init
 		# Call platform_check_image() here so it can add its test
 		# results and still mark image properly.
 		json_set_namespace $old_ns
-		platform_check_image "$1" >&2
-		case "$?" in
-		0)
-			;;
-		74)
-			notify_firmware_broken
-			;;
-		*)
-			notify_firmware_invalid
-			;;
-		esac
+		platform_check_image "$1" >&2 || notify_firmware_invalid
 		json_set_namespace validate_firmware_image old_ns
 	json_close_object
 	json_add_boolean valid "$VALID"

package/base-files/image-config.in

@@ -5,14 +5,6 @@
 # See /LICENSE for more information.
 #
 
-config EXTRA_IMAGE_NAME
-	string
-	prompt "Extra image filename" if IMAGEOPT
-	default ""
-	help
-		Add this to the output image filenames, to distinguish between
-		different builds for the same hardware type.
-
 config TARGET_DEFAULT_LAN_IP_FROM_PREINIT
 	bool "Use preinit IP configuration as default LAN IP" if IMAGEOPT
 	default n
@@ -198,7 +190,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "https://downloads.openwrt.org/snapshots"
+		default "https://downloads.openwrt.org/releases/24.10.0-rc1"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:
@@ -249,12 +241,6 @@ if VERSIONOPT
 		help
 			This an URL to provide users seeking support
 
-	config VERSION_FIRMWARE_URL
-		string
-		prompt "Firmware URL"
-		help
-			This is an URL to provide users for downloading firmware
-
 	config VERSION_PRODUCT
 		string
 		prompt "Product name"
@@ -280,7 +266,7 @@ if VERSIONOPT
 	config VERSION_CODE_FILENAMES
 		bool
 		prompt "Revision code in filenames"
-		default y
+		default n
 		help
 			Enable this to include the revision identifier or the configured
 			version code into the firmware image, SDK- and Image Builder archive

package/boot/arm-trusted-firmware-bcm63xx/Makefile

@@ -33,7 +33,6 @@ TFA_TARGETS:= \
 	bcm4908
 
 TFA_MAKE_FLAGS += \
-	$(if $(CONFIG_BINUTILS_VERSION_2_37)$(CONFIG_BINUTILS_VERSION_2_38),,LDFLAGS="-no-warn-rwx-segments") \
 	BRCM_CHIP=$(BRCM_CHIP)
 
 define Package/trusted-firmware-a/install

package/boot/arm-trusted-firmware-mediatek/Makefile

@@ -9,13 +9,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=arm-trusted-firmware-mediatek
-PKG_RELEASE:=1
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/mtk-openwrt/arm-trusted-firmware.git
-PKG_SOURCE_DATE:=2025-07-11
-PKG_SOURCE_VERSION:=78a0dfd927bb00ce973a1f8eb4079df0f755887a
-PKG_MIRROR_HASH:=72a5f3f00f9e368226bb779dc098aac6195a312b48cc22172987d494ccd135d1
+PKG_SOURCE_DATE:=2024-01-17
+PKG_SOURCE_VERSION:=bacca82a8cac369470df052a9d801a0ceb9b74ca
+PKG_MIRROR_HASH:=1138649f64ac3982330925c38c795ca6860289adbd95755991f80afa30ebdea7
 
 PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
 
@@ -29,17 +29,12 @@ define Trusted-Firmware-A/Default
   HIDDEN:=y
   BOOT_DEVICE:=
   DDR3_FLYBY:=
-  DDR3_FREQ_1866:=
-  DDR4_4BG_MODE:=
   DDR_TYPE:=
   NAND_TYPE:=
   BOARD_QFN:=
   DRAM_USE_COMB:=
   RAM_BOOT_UART_DL:=
   USE_UBI:=
-  FIP_OFFSET:=
-  FIP_SIZE:=
-  SPIM_CTRL:=
 endef
 
 define Trusted-Firmware-A/mt7622-nor-1ddr
@@ -140,14 +135,6 @@ define Trusted-Firmware-A/mt7622-sdmmc-2ddr
   DDR3_FLYBY:=1
 endef
 
-define Trusted-Firmware-A/mt7981-nor-ddr4
-  NAME:=MediaTek MT7981 (SPI-NOR, DDR4)
-  BOOT_DEVICE:=nor
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7981
-  DDR_TYPE:=ddr4
-endef
-
 define Trusted-Firmware-A/mt7981-ram-ddr4
   NAME:=MediaTek MT7981 (RAM, DDR4)
   BOOT_DEVICE:=ram
@@ -167,14 +154,6 @@ define Trusted-Firmware-A/mt7981-emmc-ddr4
   DDR_TYPE:=ddr4
 endef
 
-define Trusted-Firmware-A/mt7981-sdmmc-ddr4
-  NAME:=MediaTek MT7981 (SD card, DDR4)
-  BOOT_DEVICE:=sdmmc
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7981
-  DDR_TYPE:=ddr4
-endef
-
 define Trusted-Firmware-A/mt7981-spim-nand-ddr4
   NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR4)
   BOOT_DEVICE:=spim-nand
@@ -197,12 +176,19 @@ define Trusted-Firmware-A/mt7981-ram-ddr3
   BUILD_SUBTARGET:=filogic
   PLAT:=mt7981
   DDR_TYPE:=ddr3
-  DDR3_FREQ_1866:=1
   RAM_BOOT_UART_DL:=1
   HIDDEN:=
   DEFAULT:=TARGET_mediatek_filogic
 endef
 
+define Trusted-Firmware-A/mt7981-nor-ddr4
+  NAME:=MediaTek MT7981 (SPI-NOR, DDR4)
+  BOOT_DEVICE:=nor
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr4
+endef
+
 define Trusted-Firmware-A/mt7981-emmc-ddr3
   NAME:=MediaTek MT7981 (eMMC, DDR3)
   BOOT_DEVICE:=emmc
@@ -211,15 +197,6 @@ define Trusted-Firmware-A/mt7981-emmc-ddr3
   DDR_TYPE:=ddr3
 endef
 
-define Trusted-Firmware-A/mt7981-emmc-ddr3-1866
-  NAME:=MediaTek MT7981 (eMMC, DDR3 1866 MT/s)
-  BOOT_DEVICE:=emmc
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7981
-  DDR_TYPE:=ddr3
-  DDR3_FREQ_1866:=1
-endef
-
 define Trusted-Firmware-A/mt7981-sdmmc-ddr3
   NAME:=MediaTek MT7981 (SD card, DDR3)
   BOOT_DEVICE:=sdmmc
@@ -244,34 +221,6 @@ define Trusted-Firmware-A/mt7981-spim-nand-ddr3
   DDR_TYPE:=ddr3
 endef
 
-define Trusted-Firmware-A/mt7981-spim-nand-ddr3-1866
-  NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR3 1866 MT/s)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7981
-  DDR_TYPE:=ddr3
-  DDR3_FREQ_1866:=1
-endef
-
-define Trusted-Firmware-A/mt7981-spim-nand-ubi-ddr4
-  NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR4)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7981
-  DDR_TYPE:=ddr4
-  USE_UBI:=1
-endef
-
-define Trusted-Firmware-A/mt7981-cudy-ddr3
-  NAME:=Cudy (SPI-NAND via SPIM, DDR3)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7981
-  DDR_TYPE:=ddr3
-  FIP_OFFSET:=0x3c0000
-  FIP_SIZE:=0x200000
-endef
-
 define Trusted-Firmware-A/mt7986-ram-ddr4
   NAME:=MediaTek MT7986 (RAM, DDR4)
   BOOT_DEVICE:=ram
@@ -283,6 +232,15 @@ define Trusted-Firmware-A/mt7986-ram-ddr4
   DEFAULT:=TARGET_mediatek_filogic
 endef
 
+define Trusted-Firmware-A/mt7981-spim-nand-ubi-ddr4
+  NAME:=MediaTek MT7981 (SPI-NAND via SPIM, DDR4)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr4
+  USE_UBI:=1
+endef
+
 define Trusted-Firmware-A/mt7986-nor-ddr4
   NAME:=MediaTek MT7986 (SPI-NOR, DDR4)
   BOOT_DEVICE:=nor
@@ -394,88 +352,6 @@ define Trusted-Firmware-A/mt7986-spim-nand-ddr3
   DDR_TYPE:=ddr3
 endef
 
-define Trusted-Firmware-A/mt7986-spim-nand-ubi-ddr3
-  NAME:=MediaTek MT7986 (SPI-NAND via SPIM using UBI, DDR3)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7986
-  DDR_TYPE:=ddr3
-  USE_UBI:=1
-endef
-
-define Trusted-Firmware-A/mt7987-emmc-comb
-  NAME:=MediaTek MT7987 (eMMC)
-  BOOT_DEVICE:=emmc
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7987
-endef
-
-define Trusted-Firmware-A/mt7987-emmc-ddr4-4bg
-  NAME:=MediaTek MT7987 (eMMC, DDR4 4GB)
-  BOOT_DEVICE:=emmc
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7987
-  DDR4_4BG_MODE:=1
-endef
-
-define Trusted-Firmware-A/mt7987-nor-comb
-  NAME:=MediaTek MT7987 (NOR)
-  BOOT_DEVICE:=nor
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7987
-endef
-
-define Trusted-Firmware-A/mt7987-sdmmc-comb
-  NAME:=MediaTek MT7987 (SD card)
-  BOOT_DEVICE:=sdmmc
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7987
-endef
-
-define Trusted-Firmware-A/mt7987-sdmmc-ddr4-4bg
-  NAME:=MediaTek MT7987 (SD card, DDR4 4GB)
-  BOOT_DEVICE:=sdmmc
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7987
-  DDR4_4BG_MODE:=1
-endef
-
-define Trusted-Firmware-A/mt7987-spim-nand0
-  NAME:=MediaTek MT7987 (SPI-NAND via SPIM)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7987
-  SPIM_CTRL:=0
-endef
-
-define Trusted-Firmware-A/mt7987-spim-nand0-ubi-comb
-  NAME:=MediaTek MT7987 (SPI-NAND via SPIM, UBI)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7987
-  USE_UBI:=1
-  SPIM_CTRL:=0
-endef
-
-define Trusted-Firmware-A/mt7987-spim-nand2-ubi-comb
-  NAME:=MediaTek MT7987 (SPI-NAND via SPIM, UBI)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7987
-  USE_UBI:=1
-  SPIM_CTRL:=2
-endef
-
-define Trusted-Firmware-A/mt7987-ram-comb
-  NAME:=MediaTek MT7987 (RAM)
-  BOOT_DEVICE:=ram
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7987
-  RAM_BOOT_UART_DL:=1
-  HIDDEN:=
-  DEFAULT:=TARGET_mediatek_filogic
-endef
-
 define Trusted-Firmware-A/mt7988-nor-ddr3
   NAME:=MediaTek MT7988 (SPI-NOR, DDR3)
   BOOT_DEVICE:=nor
@@ -567,17 +443,6 @@ define Trusted-Firmware-A/mt7988-ram-comb
   DEFAULT:=TARGET_mediatek_filogic
 endef
 
-define Trusted-Firmware-A/mt7988-ram-ddr4
-  NAME:=MediaTek MT7988 (RAM/ddr4)
-  BOOT_DEVICE:=ram
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7988
-  RAM_BOOT_UART_DL:=1
-  HIDDEN:=
-  DEFAULT:=TARGET_mediatek_filogic
-  DDR_TYPE:=ddr4
-endef
-
 define Trusted-Firmware-A/mt7988-nor-comb
   NAME:=MediaTek MT7988 (SPI-NOR)
   BOOT_DEVICE:=nor
@@ -636,43 +501,6 @@ define Trusted-Firmware-A/mt7988-spim-nand-ubi-comb
   USE_UBI:=1
 endef
 
-define Trusted-Firmware-A/mt7988-spim-nand-ubi-ddr4
-  NAME:=MediaTek MT7988 (SPI-NAND via SPIM, DDR4)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7988
-  DDR_TYPE:=ddr4
-  USE_UBI:=1
-endef
-
-define Trusted-Firmware-A/mt7988-emmc-comb-4bg
-  NAME:=MediaTek MT7988 (eMMC, DDR4 8GB)
-  BOOT_DEVICE:=emmc
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7988
-  DRAM_USE_COMB:=1
-  DDR4_4BG_MODE:=1
-endef
-
-define Trusted-Firmware-A/mt7988-sdmmc-comb-4bg
-  NAME:=MediaTek MT7988 (SD card, DDR4 8GB)
-  BOOT_DEVICE:=sdmmc
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7988
-  DRAM_USE_COMB:=1
-  DDR4_4BG_MODE:=1
-endef
-
-define Trusted-Firmware-A/mt7988-spim-nand-ubi-comb-4bg
-  NAME:=MediaTek MT7988 (SPI-NAND via SPIM, UBI, DDR4 8GB)
-  BOOT_DEVICE:=spim-nand
-  BUILD_SUBTARGET:=filogic
-  PLAT:=mt7988
-  DRAM_USE_COMB:=1
-  DDR4_4BG_MODE:=1
-  USE_UBI:=1
-endef
-
 TFA_TARGETS:= \
 	mt7622-nor-1ddr \
 	mt7622-nor-2ddr \
@@ -688,26 +516,21 @@ TFA_TARGETS:= \
 	mt7622-sdmmc-2ddr \
 	mt7981-ram-ddr3 \
 	mt7981-emmc-ddr3 \
-	mt7981-emmc-ddr3-1866 \
 	mt7981-nor-ddr3 \
 	mt7981-nor-ddr4 \
 	mt7981-sdmmc-ddr3 \
 	mt7981-snand-ddr3 \
 	mt7981-spim-nand-ddr3 \
-	mt7981-spim-nand-ddr3-1866 \
 	mt7981-spim-nand-ubi-ddr4 \
 	mt7981-ram-ddr4 \
 	mt7981-emmc-ddr4 \
-	mt7981-sdmmc-ddr4 \
 	mt7981-spim-nand-ddr4 \
-	mt7981-cudy-ddr3 \
 	mt7986-ram-ddr3 \
 	mt7986-emmc-ddr3 \
 	mt7986-nor-ddr3 \
 	mt7986-sdmmc-ddr3 \
 	mt7986-snand-ddr3 \
 	mt7986-spim-nand-ddr3 \
-	mt7986-spim-nand-ubi-ddr3 \
 	mt7986-ram-ddr4 \
 	mt7986-emmc-ddr4 \
 	mt7986-nor-ddr4 \
@@ -716,15 +539,6 @@ TFA_TARGETS:= \
 	mt7986-spim-nand-ddr4 \
 	mt7986-spim-nand-ubi-ddr4 \
 	mt7986-spim-nand-4k-ddr4 \
-	mt7987-emmc-comb \
-	mt7987-emmc-ddr4-4bg \
-	mt7987-nor-comb \
-	mt7987-sdmmc-comb \
-	mt7987-sdmmc-ddr4-4bg \
-	mt7987-spim-nand0 \
-	mt7987-spim-nand0-ubi-comb \
-	mt7987-spim-nand2-ubi-comb \
-	mt7987-ram-comb \
 	mt7988-emmc-ddr3 \
 	mt7988-nor-ddr3 \
 	mt7988-sdmmc-ddr3 \
@@ -736,18 +550,13 @@ TFA_TARGETS:= \
 	mt7988-snand-ddr4 \
 	mt7988-spim-nand-ddr4 \
 	mt7988-ram-comb \
-	mt7988-ram-ddr4 \
 	mt7988-emmc-comb \
 	mt7988-nor-comb \
 	mt7988-sdmmc-comb \
 	mt7988-snand-comb \
 	mt7988-snand-ubi-comb \
 	mt7988-spim-nand-comb \
-	mt7988-spim-nand-ubi-comb \
-	mt7988-spim-nand-ubi-ddr4 \
-	mt7988-emmc-comb-4bg \
-	mt7988-sdmmc-comb-4bg \
-	mt7988-spim-nand-ubi-comb-4bg
+	mt7988-spim-nand-ubi-comb
 
 TFA_MAKE_FLAGS += \
 	BOOT_DEVICE=$(BOOT_DEVICE) \
@@ -757,16 +566,10 @@ TFA_MAKE_FLAGS += \
 	$(if $(NAND_TYPE),NAND_TYPE=$(NAND_TYPE)) \
 	HAVE_DRAM_OBJ_FILE=yes \
 	$(if $(DDR3_FLYBY),DDR3_FLYBY=1) \
-	$(if $(DDR3_FREQ_1866),DDR3_FREQ_1866=1) \
-	$(if $(DDR4_4BG_MODE),DDR4_4BG_MODE=1) \
 	$(if $(DRAM_USE_COMB),DRAM_USE_COMB=1) \
 	$(if $(RAM_BOOT_UART_DL),RAM_BOOT_UART_DL=1) \
 	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7622,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x80000)) \
 	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7981,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x100000)) \
-	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7986,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x200000)) \
-	$(if $(FIP_OFFSET),OVERRIDE_FIP_BASE=$(FIP_OFFSET)) \
-	$(if $(FIP_SIZE),OVERRIDE_FIP_SIZE=$(FIP_SIZE)) \
-	$(if $(SPIM_CTRL),SPIM_CTRL=$(SPIM_CTRL)) \
 	$(if $(RAM_BOOT_UART_DL),bl2,all)
 
 define Package/trusted-firmware-a-ram/install
@@ -779,9 +582,7 @@ Package/trusted-firmware-a-mt7981-ram-ddr3/install = $(Package/trusted-firmware-
 Package/trusted-firmware-a-mt7981-ram-ddr4/install = $(Package/trusted-firmware-a-ram/install)
 Package/trusted-firmware-a-mt7986-ram-ddr3/install = $(Package/trusted-firmware-a-ram/install)
 Package/trusted-firmware-a-mt7986-ram-ddr4/install = $(Package/trusted-firmware-a-ram/install)
-Package/trusted-firmware-a-mt7987-ram-comb/install = $(Package/trusted-firmware-a-ram/install)
 Package/trusted-firmware-a-mt7988-ram-comb/install = $(Package/trusted-firmware-a-ram/install)
-Package/trusted-firmware-a-mt7988-ram-ddr4/install = $(Package/trusted-firmware-a-ram/install)
 
 define Package/trusted-firmware-a/install
 	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)

package/boot/arm-trusted-firmware-mediatek/patches/0004-mediatek-snfi-add-FudanMicro-manufacturer.patch

@@ -1,41 +0,0 @@
-From fd057aba83aea8458986e11c81dbb75a69468b84 Mon Sep 17 00:00:00 2001
-From: Mikhail Zhilkin <csharper2005@gmail.com>
-Date: Wed, 13 Aug 2025 22:46:54 +0300
-Subject: arm-trusted-firmware-mediatek: add FudanMicro manufacturer
-
-Add FudanMicro manufacturer.
-
-Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
----
-
---- a/plat/mediatek/apsoc_common/drivers/spi_nand/mtk_spi_nand.c
-+++ b/plat/mediatek/apsoc_common/drivers/spi_nand/mtk_spi_nand.c
-@@ -21,6 +21,7 @@
- #define SPI_NAND_MAX_ID_LEN		4U
- #define DELAY_US_400MS			400000U
- #define ETRON_ID			0xD5U
-+#define FUDAN_ID			0xA1U
- #define GIGADEVICE_ID			0xC8U
- #define MACRONIX_ID			0xC2U
- #define MICRON_ID			0x2CU
-@@ -146,7 +147,8 @@ static int spi_nand_quad_enable(uint8_t
- 	if (manufacturer_id != MACRONIX_ID &&
- 	    manufacturer_id != GIGADEVICE_ID &&
- 	    manufacturer_id != ETRON_ID &&
--	    manufacturer_id != FORESEE_ID) {
-+	    manufacturer_id != FORESEE_ID &&
-+	    manufacturer_id != FUDAN_ID) {
- 		return 0;
- 	}
- 
-@@ -543,6 +545,10 @@ static int spi_nand_check_pp(struct para
- 		INFO("PP COPY %d CRC read: 0x%x, compute: 0x%x\n",
- 		     i, crc, crc_compute);
- 
-+		// FUDAN integrity CRC (bytes 254-255) is reversed
-+		if (crc != crc_compute)
-+			crc = htobe16(pp->integrity_crc);
-+
- 		if (crc != crc_compute) {
- 			ret = -EBADMSG;
- 			continue;

package/boot/arm-trusted-firmware-mediatek/patches/0004-mediatek-snfi-fix-return-code-when-reading.patch

@@ -0,0 +1,27 @@
+From 94802b344195d3574701ca6ab5122f6b7615a6eb Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 11 Aug 2024 23:12:33 +0100
+Subject: [PATCH] mediatek: snfi: fix return code when reading
+
+Return 0 on succesful read, which may contain correctable bitflips.
+
+Fixes: #10
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ plat/mediatek/apsoc_common/bl2/bl2_dev_snfi_init.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/plat/mediatek/apsoc_common/bl2/bl2_dev_snfi_init.c
++++ b/plat/mediatek/apsoc_common/bl2/bl2_dev_snfi_init.c
+@@ -29,8 +29,10 @@ static int snfi_mtd_read_page(struct nan
+ 	int ret;
+ 
+ 	ret = mtk_snand_read_page(snf, addr, (void *)buffer, NULL, false);
+-	if (ret == -EBADMSG)
++	if (ret > 0) {
++		NOTICE("corrected %d bitflips while reading page %u\n", ret, page);
+ 		ret = 0;
++	}
+ 
+ 	return ret;
+ }

package/boot/arm-trusted-firmware-mediatek/patches/0005-mt7987-make-SPI-controller-configurable.patch

@@ -1,128 +0,0 @@
-From e2e43103c00b5f7ccedbdbdece0f622cb420b4a5 Mon Sep 17 00:00:00 2001
-From: Daniel Golle <daniel@makrotopia.org>
-Date: Fri, 3 Oct 2025 12:53:10 +0100
-Subject: [PATCH] mt7987: make SPI controller configurable
-
-Allow selecting the SPI controller used for SPIM-NAND or SPI-NOR boot
-devices (either SPI0 or SPI2).
-
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
----
- plat/mediatek/apsoc_common/Config.in        |  1 +
- plat/mediatek/mt7987/Config.in              | 29 +++++++++++++++++++++
- plat/mediatek/mt7987/bl2/bl2.mk             | 12 +++++++++
- plat/mediatek/mt7987/bl2/bl2_dev_spi_nand.c | 10 ++++++-
- plat/mediatek/mt7987/platform.mk            |  4 +--
- 5 files changed, 53 insertions(+), 3 deletions(-)
- create mode 100644 plat/mediatek/mt7987/Config.in
-
---- a/plat/mediatek/apsoc_common/Config.in
-+++ b/plat/mediatek/apsoc_common/Config.in
-@@ -783,6 +783,7 @@ config ENABLE_BL31_RUNTIME_LOG
- 	default 1
- 	depends on _ENABLE_BL31_RUNTIME_LOG
- 
-+source "plat/mediatek/mt7987/Config.in"
- source "plat/mediatek/mt7988/Config.in"
- 
- endmenu # Platform configurations
---- /dev/null
-+++ b/plat/mediatek/mt7987/Config.in
-@@ -0,0 +1,29 @@
-+# SPDX-License-Identifier: BSD-3-Clause
-+#
-+# Copyright (c) 2025 Daniel Golle <daniel@makrotopia.org>
-+#
-+# MT7987 platform-specific configurations
-+#
-+
-+if _PLAT_MT7987
-+
-+choice
-+	prompt "SPI controller"
-+	depends on (_BOOT_DEVICE_SPIM_NAND || _BOOT_DEVICE_SPI_NOR)
-+	default _SPIM_CTRL_0 if _BOOT_DEVICE_SPIM_NAND
-+	default _SPIM_CTRL_2 if _BOOT_DEVICE_SPI_NOR
-+
-+	config _SPIM_CTRL_0
-+		bool "0"
-+
-+	config _SPIM_CTRL_2
-+		bool "2"
-+
-+endchoice
-+
-+config SPIM_CTRL
-+	int
-+	default 0 if _SPIM_CTRL_0
-+	default 2 if _SPIM_CTRL_2
-+
-+endif # _PLAT_MT7987
---- a/plat/mediatek/mt7987/bl2/bl2.mk
-+++ b/plat/mediatek/mt7987/bl2/bl2.mk
-@@ -91,7 +91,11 @@ endif # END OF BOOT_DEVICE = ram
- ifeq ($(BOOT_DEVICE),nor)
- $(eval $(call BL2_BOOT_NOR))
- BL2_SOURCES		+=	$(MTK_PLAT_SOC)/bl2/bl2_dev_spi_nor.c
-+ifeq ($(SPIM_CTRL),0)
-+DTS_NAME		:=	mt7987-spi0
-+else
- DTS_NAME		:=	mt7987-spi2
-+endif
- endif # END OF BOOTDEVICE = nor
- 
- ifeq ($(BOOT_DEVICE),emmc)
-@@ -112,10 +116,18 @@ ifeq ($(BOOT_DEVICE),spim-nand)
- $(eval $(call BL2_BOOT_SPI_NAND,0,0))
- BL2_SOURCES		+=	$(MTK_PLAT_SOC)/bl2/bl2_dev_spi_nand.c
- NAND_TYPE		?=	spim:2k+64
-+ifeq ($(SPIM_CTRL),2)
-+DTS_NAME		:=	mt7987-spi2
-+else
- DTS_NAME		:=	mt7987-spi0
-+endif
- $(eval $(call BL2_BOOT_NAND_TYPE_CHECK,$(NAND_TYPE),spim:2k+64 spim:2k+128 spim:4k+256))
- endif # END OF BOOTDEVICE = spim-nand
- 
-+ifneq ($(SPIM_CTRL),)
-+BL2_CPPFLAGS		+=	-DSPIM_CTRL=$(SPIM_CTRL)
-+endif
-+
- ifeq ($(BROM_HEADER_TYPE),)
- $(error BOOT_DEVICE has invalid value. Please re-check.)
- endif
---- a/plat/mediatek/mt7987/bl2/bl2_dev_spi_nand.c
-+++ b/plat/mediatek/mt7987/bl2/bl2_dev_spi_nand.c
-@@ -12,10 +12,18 @@
- 
- #define MTK_QSPI_SRC_CLK		CB_MPLL_D2
- 
-+#if SPIM_CTRL == 0
-+#define SELECTED_SPIM SPIM0
-+#elif SPIM_CTRL == 2
-+#define SELECTED_SPIM SPIM2
-+#else
-+#error "Invalid SPI controller selection"
-+#endif
-+
- uint32_t mtk_plat_get_qspi_src_clk(void)
- {
- 	/* config GPIO pinmux to spi mode */
--	mtk_spi_gpio_init(SPIM0);
-+	mtk_spi_gpio_init(SELECTED_SPIM);
- 
- 	/* select 208M clk */
- 	mtk_spi_source_clock_select(MTK_QSPI_SRC_CLK);
---- a/plat/mediatek/mt7987/platform.mk
-+++ b/plat/mediatek/mt7987/platform.mk
-@@ -56,8 +56,8 @@ include make_helpers/dep.mk
- 
- $(call GEN_DEP_RULES,bl2,emicfg bl2_boot_ram bl2_boot_nand_nmbm bl2_dev_mmc bl2_plat_init bl2_plat_setup mt7987_gpio dtb)
- $(call MAKE_DEP,bl2,emicfg,DDR4_4BG_MODE DRAM_DEBUG_LOG DDR3_FREQ_2133 DDR3_FREQ_1866 DDR4_FREQ_3200 DDR4_FREQ_2666)
--$(call MAKE_DEP,bl2,bl2_plat_init,BL2_COMPRESS)
--$(call MAKE_DEP,bl2,bl2_plat_setup,BOOT_DEVICE TRUSTED_BOARD_BOOT BL32_TZRAM_BASE BL32_TZRAM_SIZE BL32_LOAD_OFFSET)
-+$(call MAKE_DEP,bl2,bl2_plat_init,BL2_COMPRESS SPIM_CTRL)
-+$(call MAKE_DEP,bl2,bl2_plat_setup,BOOT_DEVICE TRUSTED_BOARD_BOOT BL32_TZRAM_BASE BL32_TZRAM_SIZE BL32_LOAD_OFFSET SPIM_CTRL)
- $(call MAKE_DEP,bl2,bl2_dev_mmc,BOOT_DEVICE)
- $(call MAKE_DEP,bl2,bl2_boot_ram,RAM_BOOT_DEBUGGER_HOOK RAM_BOOT_UART_DL)
- $(call MAKE_DEP,bl2,bl2_boot_nand_nmbm,NMBM_MAX_RATIO NMBM_MAX_RESERVED_BLOCKS NMBM_DEFAULT_LOG_LEVEL)

package/boot/arm-trusted-firmware-mediatek/patches/0006-hack-mt7987-mmc-use-4-bit-bus-width-for-eMMC.patch

@@ -1,24 +0,0 @@
-From 0a09912eb336bee788443b919ea5b99b195f5a91 Mon Sep 17 00:00:00 2001
-From: Daniel Golle <daniel@makrotopia.org>
-Date: Sat, 4 Oct 2025 22:13:49 +0100
-Subject: [PATCH] hack: mt7987: mmc: use 4-bit bus-width for eMMC
-
-The BananaPi R4 Lite has broken DAT5 signal of the MMC bus, which
-results in 8-bit buswidth not working well for the eMMC.
-Reduce to 4-bit buswidth fixes it (and makes all other boards with
-eMMC a tiny bit slower to boot, but it's in the milliseconds).
----
- plat/mediatek/mt7987/bl2/bl2_dev_mmc.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/plat/mediatek/mt7987/bl2/bl2_dev_mmc.c
-+++ b/plat/mediatek/mt7987/bl2/bl2_dev_mmc.c
-@@ -74,7 +74,7 @@ static const struct mt7987_msdc_conf {
- 	{
- 		.base = MSDC0_BASE,
- 		.top_base = MSDC0_TOP_BASE,
--		.bus_width = MMC_BUS_WIDTH_8,
-+		.bus_width = MMC_BUS_WIDTH_4,
- 		.type = MMC_IS_EMMC,
- 		.src_clk = 200000000,
- 		.dev_comp = &mt7987_msdc_compat,

package/boot/arm-trusted-firmware-mediatek/patches/0007-hack-mt7987-bl2-move-FIP-offset-to-0x100000.patch

@@ -1,27 +0,0 @@
-From 6725bb3c2aa9330f37a591e1e539badf67021b47 Mon Sep 17 00:00:00 2001
-From: Daniel Golle <daniel@makrotopia.org>
-Date: Sat, 4 Oct 2025 23:59:54 +0100
-Subject: [PATCH] hack: mt7987: bl2: move FIP offset to 0x100000
-
-There is no use in allocating more than 2MB to the factory partition.
-After all, even for WiFi 7 tri-band devices the calibration data is
-still in the kilobytes range.
-Move FIP offset to 0x100000 to not waste so much space on small NOR
-flash.
-
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
----
- plat/mediatek/mt7987/bl2/bl2_dev_spi_nor.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/plat/mediatek/mt7987/bl2/bl2_dev_spi_nor.c
-+++ b/plat/mediatek/mt7987/bl2/bl2_dev_spi_nor.c
-@@ -7,7 +7,7 @@
- #include <stdint.h>
- #include <boot_spi.h>
- 
--#define FIP_BASE			0x250000
-+#define FIP_BASE			0x100000
- #define FIP_SIZE			0x80000
- 
- #define MTK_QSPI_SRC_CLK		CB_MPLL_D2

package/boot/arm-trusted-firmware-microchipsw/Makefile

@@ -1,78 +0,0 @@
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=arm-trusted-firmware-microchipsw
-PKG_RELEASE:=1
-
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL=https://github.com/microchip-ung/arm-trusted-firmware.git
-PKG_SOURCE_DATE:=2026-01-07
-PKG_SOURCE_VERSION:=7696c9aaaae7c677f4c373a61a1289cba7f824aa
-PKG_MIRROR_HASH:=331548d7c73896bd5e4438c0ec9c71bbe58d3bf9a29350496ad94c382e922b9c
-
-PKG_BUILD_DEPENDS:=ruby/host
-PKG_MAINTAINER:=Robert Marko <robert.marko@sartura.hr>
-
-include $(INCLUDE_DIR)/kernel.mk
-include $(INCLUDE_DIR)/trusted-firmware-a.mk
-include $(INCLUDE_DIR)/package.mk
-
-define Trusted-Firmware-A/Default
-  BUILD_TARGET:=microchipsw
-  TFA_IMAGE:=fip.bin fwu_fip.bin fwu.html
-endef
-
-define Trusted-Firmware-A/ev23x71a
-  NAME:=Microchip EV23X71A
-  BUILD_SUBTARGET:=lan969x
-  BUILD_DEVICES:=microchip_ev23x71a
-  PLAT:=lan969x_a0
-  DEPENDS:=+u-boot-ev23x71a
-endef
-
-define Trusted-Firmware-A/tactical-1000
-  NAME:=Novarq Tactical 1000
-  BUILD_SUBTARGET:=lan969x
-  BUILD_DEVICES:=novarq_tactical-1000
-  PLAT:=novarq_tactical_1000_v3
-  DEPENDS:=+u-boot-tactical-1000
-endef
-
-TFA_TARGETS:= \
-	ev23x71a \
-	tactical-1000
-
-MBEDTLS_NAME:=mbedtls
-MBEDTLS_RELEASE:=2.28.10
-MBEDTLS_SOURCE:=$(MBEDTLS_NAME)-$(MBEDTLS_RELEASE).tar.zst
-
-define Download/mbedtls
-  FILE:=$(MBEDTLS_SOURCE)
-  PROTO:=git
-  URL:=https://github.com/Mbed-TLS/mbedtls.git
-  SOURCE_VERSION:=2fc8413bfcb51354c8e679141b17b3f1a5942561
-  MIRROR_HASH:=40b94a76572ad1ca89738929ab81d6024f678f22691eb3bd633c076ac18a334a
-  SUBDIR:=$(MBEDTLS_NAME)
-endef
-
-define Build/Prepare
-	# Download mbedtls
-	$(eval $(call Download,mbedtls))
-
-	$(call Build/Prepare/Default,)
-
-	$(TAR) -C $(PKG_BUILD_DIR) -xf $(DL_DIR)/$(MBEDTLS_SOURCE)
-endef
-
-TFA_MAKE_FLAGS += \
-	MBEDTLS_DIR=$(PKG_BUILD_DIR)/$(MBEDTLS_NAME) \
-	BL33=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.bin \
-	KEY_ALG=ecdsa GENERATE_COT=1 TRUSTED_BOARD_BOOT=1 \
-	all fip fwu_fip
-
-define Package/trusted-firmware-a/install
-	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/build/$(PLAT)/release/fip.bin $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-fip.bin
-	$(CP) $(patsubst %,$(PKG_BUILD_DIR)/build/$(PLAT)/release/%,$(TFA_IMAGE)) $(1)/
-endef
-
-$(eval $(call BuildPackage/Trusted-Firmware-A))

package/boot/arm-trusted-firmware-microchipsw/patches/0001-microchip-lan969x-add-Novarq-Tactical-1000-v3.patch

@@ -1,171 +0,0 @@
-From 190202583edb9dcab5ca49638169d08a332f0fdf Mon Sep 17 00:00:00 2001
-From: Robert Marko <robert.marko@sartura.hr>
-Date: Sun, 2 Nov 2025 16:57:45 +0100
-Subject: [PATCH] microchip: lan969x: add Novarq Tactical 1000 v3
-
-Add support for Novarq Tactical 1000 v3 board as a separate platform since
-it uses 2GB of RAM and requires a different RAM configuration.
-
-Signed-off-by: Robert Marko <robert.marko@sartura.hr>
----
- .../fdts/lan969x-tactical-1000-v3-ddr.dtsi    | 90 +++++++++++++++++++
- .../novarq_tactical_1000_v3_tb_fw_config.dts  | 30 +++++++
- .../novarq_tactical_1000_v3/platform.mk       | 12 +++
- scripts/fwu/fwu.js                            |  2 +-
- 4 files changed, 133 insertions(+), 1 deletion(-)
- create mode 100644 plat/microchip/lan969x/fdts/lan969x-tactical-1000-v3-ddr.dtsi
- create mode 100644 plat/microchip/lan969x/novarq_tactical_1000_v3/fdts/novarq_tactical_1000_v3_tb_fw_config.dts
- create mode 100644 plat/microchip/lan969x/novarq_tactical_1000_v3/platform.mk
-
---- /dev/null
-+++ b/plat/microchip/lan969x/fdts/lan969x-tactical-1000-v3-ddr.dtsi
-@@ -0,0 +1,90 @@
-+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
-+/*
-+ * Copyright (C) 2022 Microchip Technology Inc. and its subsidiaries.
-+ *
-+ */
-+
-+&ddr {
-+	microchip,mem-name = "lan969x_tactical_1000_2gb 2025-11-02-13:03:23 7391dfb-dirty";
-+	microchip,mem-speed = <2400>;
-+	microchip,mem-size = <0x80000000>;
-+	microchip,mem-bus-width = <16>;
-+
-+	microchip,main-reg = <
-+		0x00001091	/* crcparctl1 */
-+		0x00000001	/* dbictl */
-+		0x00000040	/* dfimisc */
-+		0x0391820f	/* dfitmg0 */
-+		0x00040201	/* dfitmg1 */
-+		0x40400003	/* dfiupd0 */
-+		0x004000ff	/* dfiupd1 */
-+		0x003f7f40	/* ecccfg0 */
-+		0x00020248	/* init0 */
-+		0x00e80000	/* init1 */
-+		0x0c340101	/* init3 */
-+		0x10180200	/* init4 */
-+		0x00110000	/* init5 */
-+		0x00000402	/* init6 */
-+		0x00000c19	/* init7 */
-+		0x81040010	/* mstr */
-+		0x00000000	/* pccfg */
-+		0x00000000	/* pwrctl */
-+		0x00210020	/* rfshctl0 */
-+		0x00000000	/* rfshctl3 */
-+	>;
-+
-+	microchip,timing-reg = <
-+		0x17131413	/* dramtmg0 */
-+		0x0007051b	/* dramtmg1 */
-+		0x1a000010	/* dramtmg12 */
-+		0x090b0512	/* dramtmg2 */
-+		0x0000400c	/* dramtmg3 */
-+		0x08040409	/* dramtmg4 */
-+		0x07070404	/* dramtmg5 */
-+		0x07060c0b	/* dramtmg8 */
-+		0x0003040d	/* dramtmg9 */
-+		0x07000610	/* odtcfg */
-+		0x0049014b	/* rfshtmg */
-+	>;
-+
-+	microchip,mapping-reg = <
-+		0x0000001f	/* addrmap0 */
-+		0x003f0909	/* addrmap1 */
-+		0x00000700	/* addrmap2 */
-+		0x00000000	/* addrmap3 */
-+		0x00001f1f	/* addrmap4 */
-+		0x07070707	/* addrmap5 */
-+		0x07070707	/* addrmap6 */
-+		0x00000f07	/* addrmap7 */
-+		0x00003f01	/* addrmap8 */
-+	>;
-+
-+	microchip,phy-reg = <
-+		0x0000040c	/* dcr */
-+		0x0064401b	/* dsgcr */
-+		0x8000b0cf	/* dtcr0 */
-+		0x00010a37	/* dtcr1 */
-+		0x00c01884	/* dxccr */
-+		0x000010ba	/* pgcr2 */
-+		0x00000000	/* schcr1 */
-+		0x00079900	/* zq0pr */
-+		0x10077900	/* zq1pr */
-+		0x00000000	/* zq2pr */
-+		0x00058f00	/* zqcr */
-+	>;
-+
-+	microchip,phy_timing-reg = <
-+		0x0827100a	/* dtpr0 */
-+		0x28250018	/* dtpr1 */
-+		0x000702a1	/* dtpr2 */
-+		0x03000101	/* dtpr3 */
-+		0x02950808	/* dtpr4 */
-+		0x00361009	/* dtpr5 */
-+		0x4ae25710	/* ptr0 */
-+		0x74f4950e	/* ptr1 */
-+		0x00083def	/* ptr2 */
-+		0x2a192000	/* ptr3 */
-+		0x1003a000	/* ptr4 */
-+	>;
-+
-+};
---- /dev/null
-+++ b/plat/microchip/lan969x/novarq_tactical_1000_v3/fdts/novarq_tactical_1000_v3_tb_fw_config.dts
-@@ -0,0 +1,30 @@
-+/*
-+ * Copyright (c) 2022, Microchip Technology Inc. and its subsidiaries.
-+ *
-+ * SPDX-License-Identifier: BSD-3-Clause
-+ */
-+
-+/dts-v1/;
-+
-+#include "lan969x.dtsi"
-+#include "lan969x-tactical-1000-v3-ddr.dtsi"
-+
-+&emmc_clk {
-+	clock-frequency = <100000000>;
-+};
-+
-+&sdmmc0 {
-+	status = "okay";
-+	bus-width = <8>;
-+};
-+
-+&qspi0 {
-+	status = "okay";
-+	spi-flash@0 {
-+		compatible = "jedec,spi-nor";
-+		reg = <0>;
-+		spi-max-frequency = <100000000>;
-+		spi-tx-bus-width = <4>;
-+		spi-rx-bus-width = <4>;
-+	};
-+};
---- /dev/null
-+++ b/plat/microchip/lan969x/novarq_tactical_1000_v3/platform.mk
-@@ -0,0 +1,12 @@
-+#
-+# Copyright (c) 2021, Microchip Technology Inc. and its subsidiaries.
-+#
-+# SPDX-License-Identifier: BSD-3-Clause
-+#
-+
-+include plat/microchip/lan969x/common/common.mk
-+
-+# This is used in lan969x code
-+$(eval $(call add_define,LAN969X_ASIC))
-+# This is used in common drivers
-+$(eval $(call add_define,LAN966X_ASIC))
---- a/scripts/fwu/fwu.js
-+++ b/scripts/fwu/fwu.js
-@@ -91,7 +91,7 @@ const platforms = [
- 	"ddr_diag":	ddr_diag_regs_lan969x,
- 	"ddr_regs":	ddr_regs_lan969x,
- 	"ddr_speed":	lan969x_speeds,
--	"bl2u_compat":	["lan969x_a0", "lan969x_svb"],
-+	"bl2u_compat":	["lan969x_a0", "lan969x_svb", "novarq_tactical_1000_v3"],
-     },
- ];
- 

package/boot/arm-trusted-firmware-microchipsw/patches/0002-cert_create-add-LibreSSL-3.9-compatibility.patch

@@ -1,95 +0,0 @@
-From 40166fd8d88f33c621d3cca0b936f31816f3fe2e Mon Sep 17 00:00:00 2001
-From: Robert Marko <robert.marko@sartura.hr>
-Date: Mon, 12 Jan 2026 14:40:23 +0100
-Subject: [PATCH] cert_create: add LibreSSL 3.9+ compatibility
-
-LibreSSL 3.9+ has dropped the whole support for X509V3 extensions.
-
-Generated by Gemini 3 Pro.
-
-Signed-off-by: Robert Marko <robert.marko@sartura.hr>
----
- tools/cert_create/src/ext.c | 26 ++++++++++++++++++++++----
- 1 file changed, 22 insertions(+), 4 deletions(-)
-
---- a/tools/cert_create/src/ext.c
-+++ b/tools/cert_create/src/ext.c
-@@ -51,15 +51,18 @@ int ext_init(void)
- {
- 	cmd_opt_t cmd_opt;
- 	ext_t *ext;
-+#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x40200000L
- 	X509V3_EXT_METHOD *m;
--	int nid, ret;
-+	int ret, nid;
-+#endif
- 	unsigned int i;
- 
- 	extensions = malloc((num_def_extensions * sizeof(def_extensions[0]))
- #ifdef PDEF_EXTS
- 			    + (num_pdef_extensions * sizeof(pdef_extensions[0]))
- #endif
--			    );
-+		);
-+
- 	if (extensions == NULL) {
- 		ERROR("%s:%d Failed to allocate memory.\n", __func__, __LINE__);
- 		return 1;
-@@ -69,7 +72,7 @@ int ext_init(void)
- 	       (num_def_extensions * sizeof(def_extensions[0])));
- #ifdef PDEF_EXTS
- 	memcpy(&extensions[num_def_extensions], &pdef_extensions[0],
--		(num_pdef_extensions * sizeof(pdef_extensions[0])));
-+	       (num_pdef_extensions * sizeof(pdef_extensions[0])));
- 	num_extensions = num_def_extensions + num_pdef_extensions;
- #else
- 	num_extensions = num_def_extensions;
-@@ -86,11 +89,15 @@ int ext_init(void)
- 			cmd_opt.help_msg = ext->help_msg;
- 			cmd_opt_add(&cmd_opt);
- 		}
-+
- 		/* Register the extension OID in OpenSSL */
- 		if (ext->oid == NULL) {
- 			continue;
- 		}
-+
-+#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x40200000L
- 		nid = OBJ_create(ext->oid, ext->sn, ext->ln);
-+
- 		if (ext->alias) {
- 			X509V3_EXT_add_alias(nid, ext->alias);
- 		} else {
-@@ -117,7 +124,16 @@ int ext_init(void)
- 				return 1;
- 			}
- 		}
-+#else
-+		/*
-+		 * LibreSSL 4.2.0+ removed X509V3_EXT_add/alias.
-+		 * We still register the OID, but ignore the returned NID
-+		 * as we skip method registration.
-+		 */
-+		OBJ_create(ext->oid, ext->sn, ext->ln);
-+#endif
- 	}
-+
- 	return 0;
- }
- 
-@@ -323,12 +339,14 @@ void ext_cleanup(void)
- 	for (i = 0; i < num_extensions; i++) {
- 		if (extensions[i].arg != NULL) {
- 			void *ptr = (void *)extensions[i].arg;
--
- 			extensions[i].arg = NULL;
- 			free(ptr);
- 		}
- 	}
- 	free(extensions);
-+
-+#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x40200000L
- 	X509V3_EXT_cleanup();
-+#endif
- }
- 

package/boot/arm-trusted-firmware-microchipsw/patches/0003-cert_create-pass-pthread-in-LDFLAGS.patch

@@ -1,36 +0,0 @@
-From 11ff8b5e67830d5a09f39e8c1f000b0ddcf8e88f Mon Sep 17 00:00:00 2001
-From: Robert Marko <robert.marko@sartura.hr>
-Date: Mon, 12 Jan 2026 15:16:07 +0100
-Subject: [PATCH] cert_create: pass pthread in LDFLAGS
-
-OpenWrt-s LibreSSL is linked against pthread, so we have to make sure to
-pass -lpthread in LDFLAGS to avoid:
-/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-crypto_init.o): in function `OPENSSL_init_crypto':
-crypto_init.c:(.text+0x67): undefined reference to `pthread_once'
-/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-err.o): in function `ERR_load_ERR_strings':
-err.c:(.text+0x812): undefined reference to `pthread_once'
-/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-conf_sap.o): in function `OpenSSL_config':
-conf_sap.c:(.text+0xc0): undefined reference to `pthread_once'
-/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-conf_sap.o): in function `OpenSSL_no_config':
-conf_sap.c:(.text+0x107): undefined reference to `pthread_once'
-/usr/bin/ld: /openwrt/staging_dir/host/lib/libcrypto.a(libcrypto_la-err_all.o): in function `ERR_load_crypto_strings':
-err_all.c:(.text+0xa3): undefined reference to `pthread_once'
-collect2: error: ld returned 1 exit status
-make[4]: *** [Makefile:93: cert_create] Error 1
-
-Signed-off-by: Robert Marko <robert.marko@sartura.hr>
----
- tools/cert_create/Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/tools/cert_create/Makefile
-+++ b/tools/cert_create/Makefile
-@@ -79,7 +79,7 @@ INC_DIR += -I ./include -I ${PLAT_INCLUD
- # located under the main project directory (i.e.: ${OPENSSL_DIR}, not
- # ${OPENSSL_DIR}/lib/).
- LIB_DIR := -L ${OPENSSL_DIR}/lib -L ${OPENSSL_DIR}
--LIB := -lssl -lcrypto
-+LIB := -lssl -lcrypto -pthread
- 
- HOSTCC ?= gcc
- 

package/boot/arm-trusted-firmware-microchipsw/patches/0004-microchip-lan969x-do-not-rely-on-Ruby-shebang.patch

@@ -1,29 +0,0 @@
-From f78f934710394822a36bd74043ed93a812c1c690 Mon Sep 17 00:00:00 2001
-From: Robert Marko <robert.marko@sartura.hr>
-Date: Mon, 12 Jan 2026 15:36:35 +0100
-Subject: [PATCH] microchip: lan969x: do not rely on Ruby shebang
-
-Host Ruby build in the staging dir must be used, so we cannot rely on the
-shebang as that will fail.
-
-So, call the script via Ruby executable instead.
-
-Signed-off-by: Robert Marko <robert.marko@sartura.hr>
----
- plat/microchip/lan969x/common/common.mk | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/plat/microchip/lan969x/common/common.mk
-+++ b/plat/microchip/lan969x/common/common.mk
-@@ -218,9 +218,9 @@ FWU_HTML := ${BUILD_PLAT}/fwu.html
- FWU_JS   := ${BUILD_PLAT}/fwu_app.js
- 
- ${FWU_JS}: ${BUILD_PLAT}/${FWU_FIP_NAME}
--	./plat/microchip/scripts/mkjs.rb -p ${PLAT} -o ${FWU_JS} $<
-+	$(Q)ruby ./plat/microchip/scripts/mkjs.rb -p ${PLAT} -o ${FWU_JS} $<
- 
- ${FWU_HTML}: ${FWU_JS}
--	./plat/microchip/scripts/html_inline.rb -i ${BUILD_PLAT} ./scripts/fwu/serial.html > ${FWU_HTML}
-+	$(Q)ruby ./plat/microchip/scripts/html_inline.rb -i ${BUILD_PLAT} ./scripts/fwu/serial.html > ${FWU_HTML}
- 
- all: ${FWU_HTML}

package/boot/arm-trusted-firmware-mvebu/Makefile

@@ -119,7 +119,6 @@ TFA_TARGETS:= \
 	edpu
 
 TFA_MAKE_FLAGS += \
-		$(if $(CONFIG_BINUTILS_VERSION_2_37)$(CONFIG_BINUTILS_VERSION_2_38),,LDFLAGS="-no-warn-rwx-segments") \
 		CROSS_CM3=$(BUILD_DIR)/$(CM3_GCC_NAME)-$(CM3_GCC_RELEASE)-$(CM3_GCC_VERSION)/bin/arm-none-eabi- \
 		BL33=$(STAGING_DIR_IMAGE)/$(UBOOT)-u-boot.bin \
 		MV_DDR_PATH=$(BUILD_DIR)/$(MV_DDR_NAME) \

package/boot/arm-trusted-firmware-rockchip/Makefile

@@ -7,10 +7,10 @@
 
 include $(TOPDIR)/rules.mk
 
-PKG_VERSION:=2.14.0
+PKG_VERSION:=2.10
 PKG_RELEASE:=1
 
-PKG_HASH:=b2a3bc360307c929714ffd8e7f1441c4888cd5d80531276e809c2de54db5dc16
+PKG_HASH:=88215a62291b9ba87da8e50b077741103cdc08fb6c9e1ebd34dfaace746d3201
 
 PKG_MAINTAINER:=Sarah Maedel <openwrt@tbspace.de>
 
@@ -33,25 +33,13 @@ define Trusted-Firmware-A/rk3399
   PLAT:=rk3399
 endef
 
-define Trusted-Firmware-A/rk3576
-  BUILD_SUBTARGET:=armv8
-  PLAT:=rk3576
-endef
-
-define Trusted-Firmware-A/rk3588
-  BUILD_SUBTARGET:=armv8
-  PLAT:=rk3588
-endef
-
 TFA_TARGETS:= \
 	rk3328 \
-	rk3399 \
-	rk3576 \
-	rk3588
+	rk3399
 
 ifeq ($(BUILD_VARIANT),rk3399)
-  M0_GCC_NAME:=arm-gnu-toolchain
-  M0_GCC_RELEASE:=12.3.rel1
+  M0_GCC_NAME:=gcc-arm
+  M0_GCC_RELEASE:=11.2-2022.02
   M0_GCC_VERSION:=$(HOST_ARCH)-arm-none-eabi
   M0_GCC_SOURCE:=$(M0_GCC_NAME)-$(M0_GCC_RELEASE)-$(M0_GCC_VERSION).tar.xz
 
@@ -59,9 +47,9 @@ ifeq ($(BUILD_VARIANT),rk3399)
     FILE:=$(M0_GCC_SOURCE)
     URL:=https://developer.arm.com/-/media/Files/downloads/gnu/$(M0_GCC_RELEASE)/binrel
   ifeq ($(HOST_ARCH),aarch64)
-    HASH:=14c0487d5753f6071d24e568881f7c7e67f80dd83165dec5164b3731394af431
+    HASH:=ef1d82e5894e3908cb7ed49c5485b5b95deefa32872f79c2b5f6f5447cabf55f
   else
-    HASH:=12a2815644318ebcceaf84beabb665d0924b6e79e21048452c5331a56332b309
+    HASH:=8c5acd5ae567c0100245b0556941c237369f210bceb196edfe5a2e7532c60326
   endif
   endef
 

package/boot/arm-trusted-firmware-stm32/Makefile

@@ -7,10 +7,10 @@
 
 include $(TOPDIR)/rules.mk
 
-PKG_VERSION:=2.13
+PKG_VERSION:=2.10
 PKG_RELEASE:=1
 
-PKG_HASH:=afb5c408392fcec840bd30de9b02a236b0108142024f9853b542b596b0d894e3
+PKG_HASH:=88215a62291b9ba87da8e50b077741103cdc08fb6c9e1ebd34dfaace746d3201
 PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
 
 include $(INCLUDE_DIR)/kernel.mk
@@ -38,20 +38,7 @@ define Trusted-Firmware-A/stm32mp135f-dk
   DTB_FILE_NAME=stm32mp135f-dk.dtb
 endef
 
-define Trusted-Firmware-A/stm32mp157c-dk2
-  $(call Trusted-Firmware-A/stm32mp1)
-  NAME:=STM32MP157C-DK2
-  DTB_FILE_NAME=stm32mp157c-dk2.dtb
-endef
-
-define Trusted-Firmware-A/stm32mp157c-dk2-scmi
-  $(call Trusted-Firmware-A/stm32mp157c-dk2)
-  NAME:=STM32MP157C-DK2 (SCMI)
-endef
-
-TFA_TARGETS := stm32mp135f-dk \
-	       stm32mp157c-dk2 \
-	       stm32mp157c-dk2-scmi
+TFA_TARGETS := stm32mp135f-dk
 
 TFA_MAKE_FLAGS += \
 		ARCH=aarch32 AARCH32_SP=optee \
@@ -67,7 +54,7 @@ TFA_MAKE_FLAGS += \
 
 define Package/trusted-firmware-a/install
 	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
-	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/tf-a-$(subst -scmi,,$(BUILD_VARIANT)).stm32 \
+	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/tf-a-$(BUILD_VARIANT).stm32 \
 		$(STAGING_DIR_IMAGE)/tf-a-$(BUILD_VARIANT).stm32
 	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/fip.bin \
 		$(STAGING_DIR_IMAGE)/fip-$(BUILD_VARIANT).bin

package/boot/arm-trusted-firmware-sunxi/Makefile

@@ -7,10 +7,10 @@
 
 include $(TOPDIR)/rules.mk
 
-PKG_VERSION:=2.14
+PKG_VERSION:=2.10
 PKG_RELEASE:=1
 
-PKG_HASH:=14fb6101f2ef424ec84c0296c3cbdeb7f79b22f5fbb46529bea0e362d0fab0d5
+PKG_HASH:=88215a62291b9ba87da8e50b077741103cdc08fb6c9e1ebd34dfaace746d3201
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=license.md

package/boot/arm-trusted-firmware-tools/Makefile

@@ -8,9 +8,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=arm-trusted-firmware-tools
-PKG_VERSION:=2.12
+PKG_VERSION:=2.9
 PKG_RELEASE:=1
-PKG_HASH:=b4c047493cac1152203e1ba121ae57267e4899b7bf56eb365e22a933342d31c9
+PKG_HASH:=76a66a1de0c01aeb83dfc7b72b51173fe62c6e51d6fca17cc562393117bed08b
 
 PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
 PKG_HOST_ONLY:=1
@@ -33,8 +33,7 @@ define Host/Compile
 	$(MAKE) -C \
 		$(HOST_BUILD_DIR)/tools/fiptool \
 		CPPFLAGS="$(HOST_CFLAGS)" \
-		LDFLAGS="$(HOST_LDFLAGS)" \
-		OPENSSL_DIR="$(STAGING_DIR_HOST)"
+		LDFLAGS="$(HOST_LDFLAGS)"
 endef
 
 define Host/Install

package/boot/arm-trusted-firmware-tools/patches/001-respect-LDFLAGS.patch

@@ -1,11 +1,11 @@
 --- a/tools/fiptool/Makefile
 +++ b/tools/fiptool/Makefile
-@@ -74,7 +74,7 @@ all: --openssl ${PROJECT}
+@@ -38,7 +38,7 @@
  
  ${PROJECT}: ${OBJECTS} Makefile
- 	$(s)echo "  HOSTLD  $@"
--	$(q)$(host-cc) ${OBJECTS} -o $@ $(LDOPTS)
-+	$(q)$(host-cc) ${OBJECTS} -o $@ $(LDOPTS) $(LDFLAGS)
- 	$(s)echo
- 	$(s)echo "Built $@ successfully"
- 	$(s)echo
+ 	@echo "  HOSTLD  $@"
+-	${Q}${HOSTCC} ${OBJECTS} -o $@ ${LDLIBS}
++	${Q}${HOSTCC} ${OBJECTS} -o $@ ${LDLIBS} $(LDFLAGS)
+ 	@${ECHO_BLANK_LINE}
+ 	@echo "Built $@ successfully"
+ 	@${ECHO_BLANK_LINE}

package/boot/arm-trusted-firmware-tools/patches/002-darwin_compile.patch

@@ -1,6 +1,15 @@
 --- a/tools/fiptool/fiptool.c
 +++ b/tools/fiptool/fiptool.c
-@@ -19,6 +19,9 @@
+@@ -3,7 +3,7 @@
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+-
++#define _DARWIN_C_SOURCE
+ #ifndef _MSC_VER
+ #include <sys/mount.h>
+ #endif
+@@ -18,6 +18,9 @@
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
@@ -10,13 +19,3 @@
  
  #include "fiptool.h"
  #include "tbbr_config.h"
---- a/tools/fiptool/fiptool_platform.h
-+++ b/tools/fiptool/fiptool_platform.h
-@@ -12,6 +12,7 @@
- #ifndef FIPTOOL_PLATFORM_H
- #define FIPTOOL_PLATFORM_H
- 
-+#define _DARWIN_C_SOURCE
- #ifndef _MSC_VER
- 
- /* Not Visual Studio, so include Posix Headers. */

package/boot/at91bootstrap/Makefile

@@ -9,9 +9,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=at91bootstrap
-PKG_VERSION:=v4.0.10
-PKG_SOURCE_VERSION:=c123c68d1f5b13a55a8e164b03be866491ce3049
-PKG_MIRROR_HASH:=0c2d6a8a81a179c29227ad2f880b403f86095d3671f176ff1d2a21ba4e09c858
+PKG_VERSION:=v4.0.3
+PKG_MIRROR_HASH:=9c1d42337294b549e6c229ae4c9996efd21e00ae5f968bd780d352e054e24cb7
+PKG_SOURCE_VERSION:=1d9e673698d9db4a4f2301559f481274de2e75ae
 BINARIES_DIR:=build/binaries
 PKG_CPE_ID:=cpe:/a:linux4sam:at91bootstrap
 
@@ -201,9 +201,4 @@ define Build/Compile
 		CROSS_COMPILE=$(TARGET_CROSS)
 endef
 
-define Build/InstallDev
-	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(BINARIES_DIR)/at91bootstrap.bin $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-at91bootstrap.bin
-endef
-
 $(eval $(call BuildPackage/AT91Bootstrap))

package/boot/grub2/Makefile

@@ -34,7 +34,7 @@ define Package/grub2/Default
   CATEGORY:=Boot Loaders
   SECTION:=boot
   TITLE:=GRand Unified Bootloader ($(2))
-  URL:=https://www.gnu.org/software/grub/
+  URL:=http://www.gnu.org/software/grub/
   DEPENDS:=@TARGET_$(1)
   VARIANT:=$(2)
 endef
@@ -49,7 +49,7 @@ define Package/grub2-editenv
   SECTION:=utils
   SUBMENU:=Boot Loaders
   TITLE:=Grub2 Environment editor
-  URL:=https://www.gnu.org/software/grub/
+  URL:=http://www.gnu.org/software/grub/
   DEPENDS:=@TARGET_x86
   VARIANT:=none
 endef
@@ -63,7 +63,7 @@ define Package/grub2-bios-setup
   SECTION:=utils
   SUBMENU:=Boot Loaders
   TITLE:=Grub2 BIOS boot setup tool
-  URL:=https://www.gnu.org/software/grub/
+  URL:=http://www.gnu.org/software/grub/
   DEPENDS:=@TARGET_x86
   VARIANT:=none
 endef

package/boot/imx-bootlets/Makefile

@@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=imx-bootlets
-PKG_VERSION:=10.12.01
+PKG_VERSION:=10.05.02
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://trabant.uid0.hu/openwrt/
-PKG_HASH:=f7c98cbc41e15184cad61c56115e840e34ac3ebb4a162fadeea905e5038fd65b
+PKG_HASH:=09ecd81a64db5166a235932146faf08d0689bfc7ac04ac9fcc3a5bd809fba74a
 
 PKG_FLAGS:=nonshared
 
@@ -37,7 +37,7 @@ define Package/imx-bootlets/install
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/boot_prep/boot_prep $(STAGING_DIR)/boot_prep
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/linux_prep/output-target/linux_prep $(STAGING_DIR)/linux_prep
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/power_prep/power_prep $(STAGING_DIR)/power_prep
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/linux_ivt.bd $(STAGING_DIR)/linux_ivt.bd
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/linux_prebuilt.db $(STAGING_DIR)/linux_prebuilt.db
 endef
 
 $(eval $(call BuildPackage,imx-bootlets))

package/boot/imx-bootlets/patches/001-skip_sb_generation.patch

@@ -1,22 +1,18 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -37,13 +37,13 @@ ifeq "$(DFT_IMAGE)" "$(wildcard $(DFT_IM
- 	elftosb -z -c ./uboot.bd -o i$(ARCH)_uboot.sb
- 	elftosb -z -f imx28 -c ./uboot_ivt.bd -o i$(ARCH)_ivt_uboot.sb
+@@ -32,10 +32,11 @@ ifeq "$(DFT_IMAGE)" "$(wildcard $(DFT_IM
+ 	sed -i 's,[^ *]image.*;,\timage="$(DFT_UBOOT)";,' uboot.db
+ 	elftosb2 -z -c ./uboot.db -o i$(ARCH)_uboot.sb
  else
 -	@echo "by using the pre-built kernel"
--	elftosb -z -c ./linux.bd -o i$(ARCH)_linux.sb
--	elftosb -z -f imx28 -c  ./linux_ivt.bd -o i$(ARCH)_ivt_linux.sb
-+	@echo "... not generating any image for now."
-+	#elftosb -z -c ./linux.bd -o i$(ARCH)_linux.sb
-+	#elftosb -z -f imx28 -c  ./linux_ivt.bd -o i$(ARCH)_ivt_linux.sb
- 
+-	elftosb2 -z -c ./linux_prebuilt.db -o i$(ARCH)_linux.sb
 -	@echo "generating U-Boot boot stream image"
--	elftosb -z -c ./uboot.bd -o i$(ARCH)_uboot.sb
--	elftosb -z -f imx28 -c ./uboot_ivt.bd -o i$(ARCH)_ivt_uboot.sb
+-	elftosb2 -z -c ./uboot_prebuilt.db -o i$(ARCH)_uboot.sb
++	@echo "... not generating any image for now."
++	#@echo "by using the pre-built kernel"
++	#elftosb2 -z -c ./linux_prebuilt.db -o i$(ARCH)_linux.sb
 +	#@echo "generating U-Boot boot stream image"
-+	#elftosb -z -c ./uboot.bd -o i$(ARCH)_uboot.sb
-+	#elftosb -z -f imx28 -c ./uboot_ivt.bd -o i$(ARCH)_ivt_uboot.sb
++	#elftosb2 -z -c ./uboot_prebuilt.db -o i$(ARCH)_uboot.sb
  endif
  	#@echo "generating kernel bootstream file sd_mmc_bootstream.raw"
  	#Please use cfimager to burn xxx_linux.sb. The below way will no

package/boot/imx-bootlets/patches/002-set_elftosb_config.patch

@@ -1,5 +1,5 @@
---- a/linux_ivt.bd
-+++ b/linux_ivt.bd
+--- a/linux_prebuilt.db
++++ b/linux_prebuilt.db
 @@ -4,10 +4,10 @@ options {
  	flags = 0x01;
  }
@@ -7,11 +7,11 @@
 -	power_prep="./power_prep/power_prep";
 -	sdram_prep="./boot_prep/boot_prep";
 -	linux_prep="./linux_prep/output-target/linux_prep";
--	zImage="./zImage";
+-	zImage = "./zImage";
 +	power_prep="./power_prep";
 +	sdram_prep="./boot_prep";
 +	linux_prep="./linux_prep";
-+	zImage="./zImage_dtb";
++	zImage = "./zImage_dtb";
  }
  
  section (0) {

package/boot/imx-bootlets/patches/003-add-olinuxino.patch

@@ -121,7 +121,7 @@
  
  all: build_prep gen_bootstream
  
-@@ -101,6 +104,8 @@ distclean: clean
+@@ -94,6 +97,8 @@ distclean: clean
  clean:
  	-rm -rf *.sb
  	rm -f sd_mmc_bootstream.raw
@@ -130,3 +130,14 @@
  	$(MAKE) -C linux_prep clean ARCH=$(ARCH)
  	$(MAKE) -C boot_prep clean ARCH=$(ARCH)
  	$(MAKE) -C power_prep clean ARCH=$(ARCH)
+--- a/uboot.db
++++ b/uboot.db
+@@ -3,7 +3,7 @@
+ sources {
+ 	power_prep="./power_prep/power_prep";
+ 	sdram_prep="./boot_prep/boot_prep";
+-	image="/home/b18647/repos/ltib_latest/rootfs/boot/u-boot";
++	image="../boot/u-boot";
+ }
+ 
+ section (0) {

package/boot/imx-bootlets/patches/004-fix-ARM-8933_1.patch

@@ -1,11 +0,0 @@
---- a/linux_prep/core/cmdlines.S
-+++ b/linux_prep/core/cmdlines.S
-@@ -14,7 +14,7 @@
- #define CMDLINES_FILE "output-target/command_lines_stripped.txt"
- #endif
- 
--	.section .cmdlines, #alloc
-+	.section .cmdlines, "a"
- 	.globl	cmdlines_start
- cmdlines_start:
- 	.incbin	CMDLINES_FILE

package/boot/kexec-tools/Config.in

@@ -11,9 +11,4 @@ config KEXEC_LZMA
 	prompt "lzma support"
 	default n
 
-config KEXEC_ZSTD
-	bool
-	prompt "zstd support"
-	default n
-	
 endmenu

package/boot/kexec-tools/Makefile

@@ -8,18 +8,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=kexec-tools
-PKG_VERSION:=2.0.32
-PKG_RELEASE:=3
+PKG_VERSION:=2.0.28
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/kernel/kexec
-PKG_HASH:=8f81422a5fd2362cf6cb001b511e535565ed0f32c2f4451fb5eb68fed6710a5d
+PKG_HASH:=d2f0ef872f39e2fe4b1b01feb62b0001383207239b9f8041f98a95564161d053
 
-PKG_LICENSE:=GPL-2.0-only
-PKG_LICENSE_FILES:=COPYING
-PKG_CPE_ID:=cpe:/a:kernel:kexec-tools
-
-PKG_CONFIG_DEPENDS := CONFIG_KEXEC_ZLIB CONFIG_KEXEC_LZMA CONFIG_KEXEC_ZSTD
+PKG_CONFIG_DEPENDS := CONFIG_KEXEC_ZLIB CONFIG_KEXEC_LZMA
 
 PKG_BUILD_FLAGS:=gc-sections
 
@@ -28,7 +24,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/kexec-tools/Default
   SECTION:=utils
   CATEGORY:=Utilities
-  URL:=https://github.com/horms/kexec-tools
+  URL:=http://kernel.org/pub/linux/kernel/people/horms/kexec-tools/
 endef
 
 define Package/kexec-tools
@@ -47,8 +43,8 @@ define Package/kexec
   $(call Package/kexec-tools/Default)
   TITLE:=Kernel boots kernel
   DEPENDS:=\
-	@(armeb||arm||aarch64||i386||x86_64||powerpc64||mipsel||mips) \
-	+KEXEC_ZLIB:zlib +KEXEC_LZMA:liblzma +KEXEC_ZSTD:libzstd @KERNEL_KEXEC
+	@(armeb||arm||i386||x86_64||powerpc64||mipsel||mips) \
+	+KEXEC_ZLIB:zlib +KEXEC_LZMA:liblzma @KERNEL_KEXEC
 endef
 
 define Package/kexec/description
@@ -58,7 +54,7 @@ endef
 define Package/kdump
   $(call Package/kexec-tools/Default)
   TITLE:=Kernel crash analysis
-  DEPENDS:=+kexec @(i386||x86_64||arm||aarch64) @KERNEL_CRASH_DUMP
+  DEPENDS:=+kexec @(i386||x86_64||arm) @KERNEL_CRASH_DUMP
 endef
 
 define Package/kdump/description
@@ -86,7 +82,6 @@ CONFIGURE_ARGS = \
 		--sysconfdir=/etc \
 		$(if $(CONFIG_KEXEC_ZLIB),--with,--without)-zlib \
 		$(if $(CONFIG_KEXEC_LZMA),--with,--without)-lzma \
-		$(if $(CONFIG_KEXEC_ZSTD),--with,--without)-zstd \
 		TARGET_LD="$(TARGET_CROSS)ld"
 
 CONFIGURE_VARS += \

package/boot/kexec-tools/patches/010-Fix-building-on-x86_64-with-binutils-2.41.patch

@@ -0,0 +1,81 @@
+From 328de8e00e298f00d7ba6b25dc3950147e9642e6 Mon Sep 17 00:00:00 2001
+From: Michel Lind <salimma@fedoraproject.org>
+Date: Tue, 30 Jan 2024 04:14:31 -0600
+Subject: [PATCH] Fix building on x86_64 with binutils 2.41
+
+Newer versions of the GNU assembler (observed with binutils 2.41) will
+complain about the ".arch i386" in files assembled with "as --64",
+with the message "Error: 64bit mode not supported on 'i386'".
+
+Fix by moving ".arch i386" below the relevant ".code32" directive, so
+that the assembler is no longer expecting 64-bit instructions to be used
+by the time that the ".arch i386" directive is encountered.
+
+Based on similar iPXE fix:
+https://github.com/ipxe/ipxe/commit/6ca597eee
+
+Signed-off-by: Michel Lind <michel@michel-slm.name>
+Signed-off-by: Simon Horman <horms@kernel.org>
+---
+ purgatory/arch/i386/entry32-16-debug.S | 2 +-
+ purgatory/arch/i386/entry32-16.S       | 2 +-
+ purgatory/arch/i386/entry32.S          | 2 +-
+ purgatory/arch/i386/setup-x86.S        | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/purgatory/arch/i386/entry32-16-debug.S
++++ b/purgatory/arch/i386/entry32-16-debug.S
+@@ -25,10 +25,10 @@
+ 	.globl entry16_debug_pre32
+ 	.globl entry16_debug_first32
+ 	.globl entry16_debug_old_first32
+-	.arch i386
+ 	.balign 16
+ entry16_debug:
+ 	.code32
++	.arch i386
+ 	/* Compute where I am running at (assumes esp valid) */
+ 	call	1f
+ 1:	popl	%ebx
+--- a/purgatory/arch/i386/entry32-16.S
++++ b/purgatory/arch/i386/entry32-16.S
+@@ -20,10 +20,10 @@
+ #undef i386	
+ 	.text
+ 	.globl entry16, entry16_regs
+-	.arch i386
+ 	.balign 16
+ entry16:
+ 	.code32
++	.arch i386
+ 	/* Compute where I am running at (assumes esp valid) */
+ 	call	1f
+ 1:	popl	%ebx
+--- a/purgatory/arch/i386/entry32.S
++++ b/purgatory/arch/i386/entry32.S
+@@ -20,10 +20,10 @@
+ #undef i386
+ 
+ 	.text
+-	.arch	i386
+ 	.globl entry32, entry32_regs
+ entry32:
+ 	.code32
++	.arch	i386
+ 
+ 	/* Setup a gdt that should that is generally usefully */
+ 	lgdt	%cs:gdt
+--- a/purgatory/arch/i386/setup-x86.S
++++ b/purgatory/arch/i386/setup-x86.S
+@@ -21,10 +21,10 @@
+ #undef i386
+ 
+ 	.text
+-	.arch	i386
+ 	.globl purgatory_start
+ purgatory_start:
+ 	.code32
++	.arch	i386
+ 
+ 	/* Load a gdt so I know what the segment registers are */
+ 	lgdt	%cs:gdt

package/boot/kexec-tools/patches/020-i386-improve-basename-compatibility.patch

@@ -0,0 +1,37 @@
+From 99f62f58fac57214ecc3c9aabf6bf61ac1e1201d Mon Sep 17 00:00:00 2001
+From: Tony Ambardar <itugrok@yahoo.com>
+Date: Fri, 7 Jun 2024 21:54:56 -0700
+Subject: [PATCH] i386: improve basename() compatibility
+
+Drop usage of glibc basename() in favour of a simpler implementation that
+works across GNU and musl libc, and is similar to existing code in fs2dt.c.
+
+This fixes compile errors seen building against musl.
+
+Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
+---
+ kexec/arch/i386/x86-linux-setup.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/kexec/arch/i386/x86-linux-setup.c
++++ b/kexec/arch/i386/x86-linux-setup.c
+@@ -318,6 +318,7 @@ static int add_edd_entry(struct x86_linu
+ 	uint8_t devnum, version;
+ 	uint32_t mbr_sig;
+ 	struct edd_info *edd_info;
++	char *basename = strrchr(sysfs_name,'/') + 1;
+ 
+ 	if (!current_mbr || !current_edd) {
+ 		fprintf(stderr, "%s: current_edd and current_edd "
+@@ -329,9 +330,9 @@ static int add_edd_entry(struct x86_linu
+ 	memset(edd_info, 0, sizeof(struct edd_info));
+ 
+ 	/* extract the device number */
+-	if (sscanf(basename(sysfs_name), "int13_dev%hhx", &devnum) != 1) {
++	if (sscanf(basename, "int13_dev%hhx", &devnum) != 1) {
+ 		fprintf(stderr, "Invalid format of int13_dev dir "
+-				"entry: %s\n", basename(sysfs_name));
++				"entry: %s\n", basename);
+ 		return -1;
+ 	}
+ 

package/boot/opensbi/Makefile

@@ -6,13 +6,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=opensbi
-PKG_RELEASE:=1.6
+PKG_RELEASE:=1.4
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/riscv/opensbi
-PKG_SOURCE_DATE:=2024-12-24
-PKG_SOURCE_VERSION:=bd613dd92113f683052acfb23d9dc8ba60029e0a
-PKG_MIRROR_HASH:=19593a340e4346ed953f17664a15744f9efdc68340a89ec6831c5e0e4dc5656d
+PKG_SOURCE_DATE:=2023-12-24
+PKG_SOURCE_VERSION:=a2b255b88918715173942f2c5e1f97ac9e90c877
+PKG_MIRROR_HASH:=a81d7b3622feba80b2a45fe0d38600be73cfbee64a0426be82a71545c10c54d3
 
 PKG_BUILD_DIR=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)