diff --git a/package/boot/uboot-envtools/files/mvebu b/package/boot/uboot-envtools/files/mvebu
index 63b5132608..c4ce76cf24 100644
--- a/package/boot/uboot-envtools/files/mvebu
+++ b/package/boot/uboot-envtools/files/mvebu
@@ -68,6 +68,10 @@ methode,edpu)
 	ubootenv_add_uci_config "/dev/mtd0" "0x180000" "0x10000" "0x10000"
 	fi
 	;;
+synology,ds213j)
+	idx="$(find_mtd_index u-boot-env)"
+	[ -n "$idx" ] && ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x10000" "0x10000"
+	;;
 esac
 
 config_load ubootenv
diff --git a/package/libs/udebug/Makefile b/package/libs/udebug/Makefile
new file mode 100644
index 0000000000..8f49388c1f
--- /dev/null
+++ b/package/libs/udebug/Makefile
@@ -0,0 +1,82 @@
+#
+# Copyright (C) 2023 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=udebug
+CMAKE_INSTALL:=1
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL=$(PROJECT_GIT)/project/udebug.git
+PKG_MIRROR_HASH:=3447dc6edd1b76f7ea5b9650a2aedcab69aba6048fa5ab7b1732cad592651fbc
+PKG_SOURCE_DATE:=2023-11-19
+PKG_SOURCE_VERSION:=44351435e28c6c878bf0a9054cb002704312d60e
+PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
+
+PKG_LICENSE:=GPL-2.0
+PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/libudebug
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=udebug client library
+  DEPENDS:=+libubox
+endef
+
+define Package/udebugd
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=OpenWrt debug service
+  DEPENDS:=+libudebug +libubus
+endef
+
+define Package/udebugd/conffiles
+/etc/config/udebug
+endef
+
+define Package/ucode-mod-udebug
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=ucode udebug module
+  DEPENDS:=+libucode +libudebug
+endef
+
+define Package/udebug-cli
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=OpenWrt debug service CLI
+  DEPENDS:=+udebugd +ucode-mod-udebug
+endef
+
+define Package/libudebug/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/*.so* $(1)/usr/lib
+endef
+
+define Package/ucode-mod-udebug/install
+	$(INSTALL_DIR) $(1)/usr/lib/ucode
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/ucode/*.so $(1)/usr/lib/ucode
+endef
+
+define Package/udebugd/install
+	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/init.d $(1)/etc/config
+	$(INSTALL_BIN) ./files/udebug.config $(1)/etc/config/udebug
+	$(INSTALL_BIN) ./files/udebug.init $(1)/etc/init.d/udebug
+	$(CP) $(PKG_INSTALL_DIR)/usr/sbin/udebugd $(1)/usr/sbin
+endef
+
+define Package/udebug-cli/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/udebug-cli $(1)/usr/sbin/udebug
+endef
+
+$(eval $(call BuildPackage,libudebug))
+$(eval $(call BuildPackage,udebugd))
+$(eval $(call BuildPackage,ucode-mod-udebug))
+$(eval $(call BuildPackage,udebug-cli))
diff --git a/package/libs/udebug/files/udebug.config b/package/libs/udebug/files/udebug.config
new file mode 100644
index 0000000000..c240553c8a
--- /dev/null
+++ b/package/libs/udebug/files/udebug.config
@@ -0,0 +1,4 @@
+config service hostapd
+	option enabled 0
+config service wpa_supplicant
+	option enabled 0
diff --git a/package/libs/udebug/files/udebug.init b/package/libs/udebug/files/udebug.init
new file mode 100755
index 0000000000..b57e962f6f
--- /dev/null
+++ b/package/libs/udebug/files/udebug.init
@@ -0,0 +1,55 @@
+#!/bin/sh /etc/rc.common
+# Copyright (c) 2021 OpenWrt.org
+
+START=11
+
+USE_PROCD=1
+PROG=/usr/sbin/udebugd
+
+start_service() {
+	procd_open_instance
+	procd_set_param command "$PROG"
+	procd_set_param respawn
+	procd_close_instance
+}
+
+get_vars() {
+	local cfg="$1"
+	uci show "udebug.$cfg" | while read LINE; do
+		cur="${LINE##udebug.$1.}"
+		[[ "$cur" = "$LINE" ]] && continue
+		var="${cur%%=*}"
+		[[ "$cur" = "$var" ]] && continue
+		echo "$var"
+	done
+}
+
+add_debug_service() {
+	local cfg="$1"
+
+	json_add_object "$cfg"
+	for var in $(get_vars "$cfg"); do
+		config_get val "$cfg" "$var"
+		json_add_string "$var" "$val"
+	done
+	json_close_object "$cfg"
+}
+
+reload_service() {
+	config_load udebug
+
+	json_init
+	json_add_object service
+	config_foreach add_debug_service service
+	json_close_object
+	ubus call udebug set_config "$(json_dump)"
+}
+
+service_triggers() {
+	procd_add_reload_trigger udebug
+}
+
+service_started() {
+	ubus -t 10 wait_for udebug
+	[ $? = 0 ] && reload_service
+}
diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile
index f46c6275ef..17f9dcb581 100644
--- a/package/network/services/hostapd/Makefile
+++ b/package/network/services/hostapd/Makefile
@@ -79,7 +79,7 @@ ifneq ($(CONFIG_DRIVER_11AX_SUPPORT),)
   HOSTAPD_IEEE80211AX:=y
 endif
 
-CORE_DEPENDS = +ucode +libubus +libucode +ucode-mod-fs +ucode-mod-nl80211 +ucode-mod-rtnl +ucode-mod-ubus +ucode-mod-uloop +libblobmsg-json
+CORE_DEPENDS = +ucode +libubus +libucode +ucode-mod-fs +ucode-mod-nl80211 +ucode-mod-rtnl +ucode-mod-ubus +ucode-mod-uloop +libblobmsg-json +libudebug
 OPENSSL_DEPENDS = +PACKAGE_$(1):libopenssl +PACKAGE_$(1):libopenssl-legacy
 
 DRIVER_MAKEOPTS= \
@@ -585,7 +585,7 @@ TARGET_CPPFLAGS := \
 	-D_GNU_SOURCE \
 	$(if $(CONFIG_WPA_MSG_MIN_PRIORITY),-DCONFIG_MSG_MIN_PRIORITY=$(CONFIG_WPA_MSG_MIN_PRIORITY))
 
-TARGET_LDFLAGS += -lubox -lubus -lblobmsg_json -lucode -lm -lnl-tiny
+TARGET_LDFLAGS += -lubox -lubus -lblobmsg_json -lucode -lm -lnl-tiny -ludebug
 
 ifdef CONFIG_WPA_ENABLE_WEP
     DRIVER_MAKEOPTS += CONFIG_WEP=y
diff --git a/package/network/services/hostapd/files/hostapd.uc b/package/network/services/hostapd/files/hostapd.uc
index 750fd535a4..84138f29a5 100644
--- a/package/network/services/hostapd/files/hostapd.uc
+++ b/package/network/services/hostapd/files/hostapd.uc
@@ -782,8 +782,33 @@ let main_obj = {
 	},
 };
 
+function handle_debug_config(cfg) {
+	hostapd.printf(`handle_debug_config: ${cfg}\n`);
+	if (!cfg)
+		return;
+
+	let data = cfg.service;
+	if (!data)
+		return;
+
+	data = data.hostapd;
+	if (!data)
+		return;
+
+	hostapd.udebug_set(!!+data.enabled);
+}
+
 hostapd.data.ubus = ubus;
 hostapd.data.obj = ubus.publish("hostapd", main_obj);
+hostapd.data.debug_sub = ubus.subscriber((req) => {
+	if (req.type != "config")
+		return;
+
+	handle_debug_config(req.data);
+});
+
+hostapd.data.debug_sub.subscribe("udebug");
+handle_debug_config(ubus.call("udebug", "get_config", {}));
 
 function bss_event(type, name, data) {
 	let ubus = hostapd.data.ubus;
diff --git a/package/network/services/hostapd/files/wpa_supplicant.uc b/package/network/services/hostapd/files/wpa_supplicant.uc
index d624f27cdd..aac144b339 100644
--- a/package/network/services/hostapd/files/wpa_supplicant.uc
+++ b/package/network/services/hostapd/files/wpa_supplicant.uc
@@ -244,8 +244,32 @@ let main_obj = {
 	},
 };
 
+function handle_debug_config(cfg) {
+	if (!cfg)
+		return;
+
+	let data = cfg.service;
+	if (!data)
+		return;
+
+	data = data.wpa_supplicant;
+	if (!data)
+		return;
+
+	wpas.udebug_set(!!+data.enabled);
+}
+
 wpas.data.ubus = ubus;
 wpas.data.obj = ubus.publish("wpa_supplicant", main_obj);
+wpas.data.debug_sub = ubus.subscriber((req) => {
+	if (req.type != "config")
+		return;
+
+	handle_debug_config(req.data);
+});
+
+wpas.data.debug_sub.subscribe("udebug");
+handle_debug_config(ubus.call("udebug", "get_config", {}));
 
 function iface_event(type, name, data) {
 	let ubus = wpas.data.ubus;
diff --git a/package/network/services/hostapd/files/wpad_acl.json b/package/network/services/hostapd/files/wpad_acl.json
index d00fd945ba..7532953cab 100644
--- a/package/network/services/hostapd/files/wpad_acl.json
+++ b/package/network/services/hostapd/files/wpad_acl.json
@@ -9,8 +9,12 @@
 		},
 		"hostapd": {
 			"methods": [ "apsta_state" ]
+		},
+		"udebug": {
+			"methods": [ "get_config" ]
 		}
 	},
+	"subscribe": [ "udebug" ],
 	"publish": [ "hostapd", "hostapd.*", "wpa_supplicant", "wpa_supplicant.*" ],
 	"send": [ "bss.*", "wps_credentials" ]
 }
diff --git a/package/network/services/hostapd/patches/601-ucode_support.patch b/package/network/services/hostapd/patches/601-ucode_support.patch
index 23f535b685..cfdb51f356 100644
--- a/package/network/services/hostapd/patches/601-ucode_support.patch
+++ b/package/network/services/hostapd/patches/601-ucode_support.patch
@@ -196,7 +196,7 @@
  
  #ifdef CONFIG_BGSCAN
  	if (state == WPA_COMPLETED && wpa_s->current_ssid != wpa_s->bgscan_ssid)
-@@ -7596,6 +7597,7 @@ struct wpa_supplicant * wpa_supplicant_a
+@@ -7594,6 +7595,7 @@ struct wpa_supplicant * wpa_supplicant_a
  #endif /* CONFIG_P2P */
  
  	wpas_ubus_add_bss(wpa_s);
@@ -204,7 +204,7 @@
  
  	return wpa_s;
  }
-@@ -7623,6 +7625,7 @@ int wpa_supplicant_remove_iface(struct w
+@@ -7621,6 +7623,7 @@ int wpa_supplicant_remove_iface(struct w
  	struct wpa_supplicant *parent = wpa_s->parent;
  #endif /* CONFIG_MESH */
  
@@ -212,7 +212,7 @@
  	wpas_ubus_free_bss(wpa_s);
  
  	/* Remove interface from the global list of interfaces */
-@@ -7933,6 +7936,7 @@ struct wpa_global * wpa_supplicant_init(
+@@ -7931,6 +7934,7 @@ struct wpa_global * wpa_supplicant_init(
  
  	eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
  			       wpas_periodic, global, NULL);
@@ -220,7 +220,7 @@
  
  	return global;
  }
-@@ -7971,12 +7975,8 @@ int wpa_supplicant_run(struct wpa_global
+@@ -7969,12 +7973,8 @@ int wpa_supplicant_run(struct wpa_global
  	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
  	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
  
@@ -233,7 +233,7 @@
  	return 0;
  }
  
-@@ -8009,6 +8009,8 @@ void wpa_supplicant_deinit(struct wpa_gl
+@@ -8007,6 +8007,8 @@ void wpa_supplicant_deinit(struct wpa_gl
  
  	wpas_notify_supplicant_deinitialized(global);
  
@@ -395,7 +395,60 @@
  {
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -1333,7 +1333,7 @@ static void wpa_driver_nl80211_event_rtm
+@@ -73,6 +73,16 @@ enum nlmsgerr_attrs {
+ 
+ #endif /* ANDROID */
+ 
++static void handle_nl_debug_hook(struct nl_msg *msg, int tx)
++{
++	const struct nlmsghdr *nlh;
++
++	if (!wpa_netlink_hook)
++		return;
++
++	nlh = nlmsg_hdr(msg);
++	wpa_netlink_hook(tx, nlh, nlh->nlmsg_len);
++}
+ 
+ static struct nl_sock * nl_create_handle(struct nl_cb *cb, const char *dbg)
+ {
+@@ -379,6 +389,11 @@ static int no_seq_check(struct nl_msg *m
+ 	return NL_OK;
+ }
+ 
++static int debug_handler(struct nl_msg *msg, void *arg)
++{
++	handle_nl_debug_hook(msg, 0);
++	return NL_OK;
++}
+ 
+ static void nl80211_nlmsg_clear(struct nl_msg *msg)
+ {
+@@ -415,6 +430,7 @@ static int send_and_recv(struct nl80211_
+ 	if (!msg)
+ 		return -ENOMEM;
+ 
++	handle_nl_debug_hook(msg, 1);
+ 	cb = nl_cb_clone(global->nl_cb);
+ 	if (!cb)
+ 		goto out;
+@@ -443,6 +459,7 @@ static int send_and_recv(struct nl80211_
+ 
+ 	err = 1;
+ 
++	nl_cb_set(cb, NL_CB_MSG_IN, NL_CB_CUSTOM, debug_handler, NULL);
+ 	nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
+ 	nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
+ 	if (ack_handler_custom) {
+@@ -919,6 +936,7 @@ nl80211_get_wiphy_data_ap(struct i802_bs
+ 			os_free(w);
+ 			return NULL;
+ 		}
++		nl_cb_set(w->nl_cb, NL_CB_MSG_IN, NL_CB_CUSTOM, debug_handler, NULL);
+ 		nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
+ 			  no_seq_check, NULL);
+ 		nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
+@@ -1333,7 +1351,7 @@ static void wpa_driver_nl80211_event_rtm
  		}
  		wpa_printf(MSG_DEBUG, "nl80211: Interface down (%s/%s)",
  			   namebuf, ifname);
@@ -404,7 +457,7 @@
  			wpa_printf(MSG_DEBUG,
  				   "nl80211: Not the main interface (%s) - do not indicate interface down",
  				   drv->first_bss->ifname);
-@@ -1369,7 +1369,7 @@ static void wpa_driver_nl80211_event_rtm
+@@ -1369,7 +1387,7 @@ static void wpa_driver_nl80211_event_rtm
  		}
  		wpa_printf(MSG_DEBUG, "nl80211: Interface up (%s/%s)",
  			   namebuf, ifname);
@@ -413,7 +466,23 @@
  			wpa_printf(MSG_DEBUG,
  				   "nl80211: Not the main interface (%s) - do not indicate interface up",
  				   drv->first_bss->ifname);
-@@ -8432,6 +8432,7 @@ static void *i802_init(struct hostapd_da
+@@ -1992,6 +2010,7 @@ static int wpa_driver_nl80211_init_nl_gl
+ 		/* Continue without vendor events */
+ 	}
+ 
++	nl_cb_set(global->nl_cb, NL_CB_MSG_IN, NL_CB_CUSTOM, debug_handler, NULL);
+ 	nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
+ 		  no_seq_check, NULL);
+ 	nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
+@@ -2160,6 +2179,7 @@ static int nl80211_init_bss(struct i802_
+ 	if (!bss->nl_cb)
+ 		return -1;
+ 
++	nl_cb_set(bss->nl_cb, NL_CB_MSG_IN, NL_CB_CUSTOM, debug_handler, NULL);
+ 	nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
+ 		  no_seq_check, NULL);
+ 	nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
+@@ -8432,6 +8452,7 @@ static void *i802_init(struct hostapd_da
  	char master_ifname[IFNAMSIZ];
  	int ifindex, br_ifindex = 0;
  	int br_added = 0;
@@ -421,7 +490,7 @@
  
  	bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
  					  params->global_priv, 1,
-@@ -8491,21 +8492,17 @@ static void *i802_init(struct hostapd_da
+@@ -8491,21 +8512,17 @@ static void *i802_init(struct hostapd_da
  	    (params->num_bridge == 0 || !params->bridge[0]))
  		add_ifidx(drv, br_ifindex, drv->ifindex);
  
@@ -453,7 +522,7 @@
  	}
  
  	if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_CONTROL_PORT_RX) {
-@@ -8875,6 +8872,50 @@ static int wpa_driver_nl80211_if_remove(
+@@ -8875,6 +8892,50 @@ static int wpa_driver_nl80211_if_remove(
  	return 0;
  }
  
@@ -504,7 +573,7 @@
  
  static int cookie_handler(struct nl_msg *msg, void *arg)
  {
-@@ -10513,6 +10554,37 @@ static int driver_nl80211_if_remove(void
+@@ -10513,6 +10574,37 @@ static int driver_nl80211_if_remove(void
  }
  
  
@@ -542,7 +611,7 @@
  static int driver_nl80211_send_mlme(void *priv, const u8 *data,
  				    size_t data_len, int noack,
  				    unsigned int freq,
-@@ -13697,6 +13769,8 @@ const struct wpa_driver_ops wpa_driver_n
+@@ -13697,6 +13789,8 @@ const struct wpa_driver_ops wpa_driver_n
  	.set_acl = wpa_driver_nl80211_set_acl,
  	.if_add = wpa_driver_nl80211_if_add,
  	.if_remove = driver_nl80211_if_remove,
@@ -551,3 +620,52 @@
  	.send_mlme = driver_nl80211_send_mlme,
  	.get_hw_feature_data = nl80211_get_hw_feature_data,
  	.sta_add = wpa_driver_nl80211_sta_add,
+--- a/src/utils/wpa_debug.c
++++ b/src/utils/wpa_debug.c
+@@ -26,6 +26,10 @@ static FILE *wpa_debug_tracing_file = NU
+ #define WPAS_TRACE_PFX "wpas <%d>: "
+ #endif /* CONFIG_DEBUG_LINUX_TRACING */
+ 
++void (*wpa_printf_hook)(int level, const char *fmt, va_list ap);
++void (*wpa_hexdump_hook)(int level, const char *title, const void *buf,
++			 size_t len);
++void (*wpa_netlink_hook)(int tx, const void *data, size_t len);
+ 
+ int wpa_debug_level = MSG_INFO;
+ int wpa_debug_show_keys = 0;
+@@ -210,6 +214,12 @@ void _wpa_printf(int level, const char *
+ {
+ 	va_list ap;
+ 
++	if (wpa_printf_hook) {
++		va_start(ap, fmt);
++		wpa_printf_hook(level, fmt, ap);
++		va_end(ap);
++	}
++
+ 	if (level >= wpa_debug_level) {
+ #ifdef CONFIG_ANDROID_LOG
+ 		va_start(ap, fmt);
+@@ -260,6 +270,9 @@ void _wpa_hexdump(int level, const char
+ {
+ 	size_t i;
+ 
++	if (wpa_hexdump_hook)
++		wpa_hexdump_hook(level, title, buf, len);
++
+ #ifdef CONFIG_DEBUG_LINUX_TRACING
+ 	if (wpa_debug_tracing_file != NULL) {
+ 		fprintf(wpa_debug_tracing_file,
+--- a/src/utils/wpa_debug.h
++++ b/src/utils/wpa_debug.h
+@@ -11,6 +11,10 @@
+ 
+ #include "wpabuf.h"
+ 
++extern void (*wpa_printf_hook)(int level, const char *fmt, va_list ap);
++extern void (*wpa_hexdump_hook)(int level, const char *title,
++				const void *buf, size_t len);
++extern void (*wpa_netlink_hook)(int tx, const void *data, size_t len);
+ extern int wpa_debug_level;
+ extern int wpa_debug_show_keys;
+ extern int wpa_debug_timestamp;
diff --git a/package/network/services/hostapd/src/src/ap/ucode.c b/package/network/services/hostapd/src/src/ap/ucode.c
index af97091be5..16d1b51536 100644
--- a/package/network/services/hostapd/src/src/ap/ucode.c
+++ b/package/network/services/hostapd/src/src/ap/ucode.c
@@ -711,6 +711,7 @@ int hostapd_ucode_init(struct hapd_interfaces *ifaces)
 		{ "freq_info", uc_wpa_freq_info },
 		{ "add_iface", uc_hostapd_add_iface },
 		{ "remove_iface", uc_hostapd_remove_iface },
+		{ "udebug_set", uc_wpa_udebug_set },
 	};
 	static const uc_function_list_t bss_fns[] = {
 		{ "ctrl", uc_hostapd_bss_ctrl },
diff --git a/package/network/services/hostapd/src/src/utils/ucode.c b/package/network/services/hostapd/src/src/utils/ucode.c
index 2beeb9a7ff..14fd6bc5ec 100644
--- a/package/network/services/hostapd/src/src/utils/ucode.c
+++ b/package/network/services/hostapd/src/src/utils/ucode.c
@@ -4,12 +4,20 @@
 #include "crypto/crypto.h"
 #include "crypto/sha1.h"
 #include "common/ieee802_11_common.h"
+#include <linux/netlink.h>
+#include <linux/genetlink.h>
+#include <linux/nl80211.h>
 #include <libubox/uloop.h>
 #include <ucode/compiler.h>
+#include <udebug.h>
 
 static uc_value_t *registry;
 static uc_vm_t vm;
 static struct uloop_timeout gc_timer;
+static struct udebug ud;
+static struct udebug_buf ud_log, ud_nl[3];
+
+#define UDEBUG_FLAG_RX_FRAME	(1ULL << 0)
 
 static void uc_gc_timer(struct uloop_timeout *timeout)
 {
@@ -251,6 +259,115 @@ int wpa_ucode_call_prepare(const char *fname)
 	return 0;
 }
 
+static void udebug_printf_hook(int level, const char *fmt, va_list ap)
+{
+	udebug_entry_init(&ud_log);
+	udebug_entry_vprintf(&ud_log, fmt, ap);
+	udebug_entry_add(&ud_log);
+}
+
+static void udebug_hexdump_hook(int level, const char *title,
+                const void *data, size_t len)
+{
+	char *buf;
+
+	udebug_entry_init(&ud_log);
+	udebug_entry_printf(&ud_log, "%s - hexdump:", title);
+	buf = udebug_entry_append(&ud_log, NULL, 3 * len);
+	for (size_t i = 0; i < len; i++)
+		buf += sprintf(buf, " %02x", *(uint8_t *)(data + i));
+	udebug_entry_add(&ud_log);
+}
+
+static void udebug_netlink_hook(int tx, const void *data, size_t len)
+{
+	struct {
+		uint16_t pkttype;
+		uint16_t arphdr;
+		uint16_t _pad[5];
+		uint16_t proto;
+	} hdr = {
+		.pkttype = host_to_be16(tx ? 7 : 6),
+		.arphdr = host_to_be16(824),
+		.proto = host_to_be16(16),
+	};
+	const struct nlmsghdr *nlh = data;
+	const struct genlmsghdr *gnlh = data + NLMSG_HDRLEN;
+	struct udebug_buf *buf = &ud_nl[!!tx];
+
+	if (nlh->nlmsg_type == 0x10)
+		buf = &ud_nl[2];
+	else if (!tx && gnlh->cmd == NL80211_CMD_FRAME &&
+	         !(udebug_buf_flags(buf) & UDEBUG_FLAG_RX_FRAME))
+		return;
+
+	udebug_entry_init(buf);
+	udebug_entry_append(buf, &hdr, sizeof(hdr));
+	udebug_entry_append(buf, data, len);
+	udebug_entry_add(buf);
+}
+
+uc_value_t *uc_wpa_udebug_set(uc_vm_t *vm, size_t nargs)
+{
+	static const struct udebug_buf_meta meta_log = {
+		.name = "wpa_log",
+		.format = UDEBUG_FORMAT_STRING,
+	};
+	static const struct udebug_buf_meta meta_nl_ll = {
+		.name = "wpa_nl_ctrl",
+		.format = UDEBUG_FORMAT_PACKET,
+		.sub_format = UDEBUG_DLT_NETLINK,
+	};
+	static const struct udebug_buf_meta meta_nl_tx = {
+		.name = "wpa_nl_tx",
+		.format = UDEBUG_FORMAT_PACKET,
+		.sub_format = UDEBUG_DLT_NETLINK,
+	};
+	static const struct udebug_buf_flag rx_flags[] = {
+		{  "rx_frame", UDEBUG_FLAG_RX_FRAME },
+	};
+	static const struct udebug_buf_meta meta_nl_rx = {
+		.name = "wpa_nl_rx",
+		.format = UDEBUG_FORMAT_PACKET,
+		.sub_format = UDEBUG_DLT_NETLINK,
+		.flags = rx_flags,
+		.n_flags = ARRAY_SIZE(rx_flags),
+	};
+	bool val = ucv_is_truish(uc_fn_arg(0));
+	static bool enabled = false;
+
+	if (enabled == val)
+		return ucv_boolean_new(true);
+
+	enabled = val;
+	if (val) {
+		udebug_init(&ud);
+		udebug_auto_connect(&ud, NULL);
+		udebug_buf_init(&ud_log, 1024, 64 * 1024);
+		udebug_buf_add(&ud, &ud_log, &meta_log);
+		udebug_buf_init(&ud_nl[0], 1024, 256 * 1024);
+		udebug_buf_add(&ud, &ud_nl[0], &meta_nl_rx);
+		udebug_buf_init(&ud_nl[1], 1024, 64 * 1024);
+		udebug_buf_add(&ud, &ud_nl[1], &meta_nl_tx);
+		udebug_buf_init(&ud_nl[2], 256, 32 * 1024);
+		udebug_buf_add(&ud, &ud_nl[2], &meta_nl_ll);
+
+		wpa_printf_hook = udebug_printf_hook;
+		wpa_hexdump_hook = udebug_hexdump_hook;
+		wpa_netlink_hook = udebug_netlink_hook;
+	} else {
+		for (size_t i = 0; i < ARRAY_SIZE(ud_nl); i++)
+			udebug_buf_free(&ud_nl[i]);
+		udebug_buf_free(&ud_log);
+		udebug_free(&ud);
+		wpa_printf_hook = NULL;
+		wpa_hexdump_hook = NULL;
+		wpa_netlink_hook = NULL;
+	}
+
+	return ucv_boolean_new(true);
+}
+
 uc_value_t *wpa_ucode_global_init(const char *name, uc_resource_type_t *global_type)
 {
 	uc_value_t *global = uc_resource_new(global_type, NULL);
diff --git a/package/network/services/hostapd/src/src/utils/ucode.h b/package/network/services/hostapd/src/src/utils/ucode.h
index 2c1886976e..c083241e07 100644
--- a/package/network/services/hostapd/src/src/utils/ucode.h
+++ b/package/network/services/hostapd/src/src/utils/ucode.h
@@ -21,6 +21,7 @@ int wpa_ucode_registry_add(uc_value_t *reg, uc_value_t *val);
 uc_value_t *wpa_ucode_registry_get(uc_value_t *reg, int idx);
 uc_value_t *wpa_ucode_registry_remove(uc_value_t *reg, int idx);
 
+uc_value_t *uc_wpa_udebug_set(uc_vm_t *vm, size_t nargs);
 uc_value_t *uc_wpa_printf(uc_vm_t *vm, size_t nargs);
 uc_value_t *uc_wpa_getpid(uc_vm_t *vm, size_t nargs);
 uc_value_t *uc_wpa_sha1(uc_vm_t *vm, size_t nargs);
diff --git a/package/network/services/hostapd/src/wpa_supplicant/ucode.c b/package/network/services/hostapd/src/wpa_supplicant/ucode.c
index 6cba73dcd5..397f85bde7 100644
--- a/package/network/services/hostapd/src/wpa_supplicant/ucode.c
+++ b/package/network/services/hostapd/src/wpa_supplicant/ucode.c
@@ -262,6 +262,7 @@ int wpas_ucode_init(struct wpa_global *gl)
 		{ "getpid", uc_wpa_getpid },
 		{ "add_iface", uc_wpas_add_iface },
 		{ "remove_iface", uc_wpas_remove_iface },
+		{ "udebug_set", uc_wpa_udebug_set },
 	};
 	static const uc_function_list_t iface_fns[] = {
 		{ "status", uc_wpas_iface_status },
diff --git a/package/system/ubus/Makefile b/package/system/ubus/Makefile
index 82c4dc601a..42737ff470 100644
--- a/package/system/ubus/Makefile
+++ b/package/system/ubus/Makefile
@@ -5,9 +5,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ubus.git
-PKG_SOURCE_DATE:=2023-06-05
-PKG_SOURCE_VERSION:=f787c97b34894a38b15599886cacbca01271684f
-PKG_MIRROR_HASH:=f4e898eb9207f069652f1767835f6aa9f015df2282d51e50ab57a0c3736f36e3
+PKG_SOURCE_DATE:=2023-11-14
+PKG_SOURCE_VERSION:=b3e8c4ef07ebb6f0f34a5c1f0dc1539068363619
+PKG_MIRROR_HASH:=bb7296b17d5a59b9080d4c9ae188dee49f49c0ce88a5cbe0317102123583d663
 PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
 CMAKE_INSTALL:=1
 
diff --git a/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network b/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network
index 5c176d4963..b9ac2bb1ae 100644
--- a/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network
+++ b/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network
@@ -12,7 +12,8 @@ mvebu_setup_interfaces()
 	local board="$1"
 
 	case "$board" in
-	ctera,c200-v2)
+	ctera,c200-v2|\
+	synology,ds213j)
 		ucidef_set_interface_lan "eth0" "dhcp"
 		;;
 	cznic,turris-omnia)
diff --git a/target/linux/mvebu/cortexa9/config-5.15 b/target/linux/mvebu/cortexa9/config-5.15
index e666dd486f..266596d638 100644
--- a/target/linux/mvebu/cortexa9/config-5.15
+++ b/target/linux/mvebu/cortexa9/config-5.15
@@ -1,4 +1,7 @@
 CONFIG_LED_TRIGGER_PHY=y
 CONFIG_MTD_SPLIT_SEIL_FW=y
+CONFIG_MTD_SPLIT_UIMAGE_FW=y
+CONFIG_MTD_VIRT_CONCAT=y
 CONFIG_PHY_MVEBU_A38X_COMPHY=y
+CONFIG_POWER_RESET_QNAP=y
 CONFIG_RTC_DRV_MV=y
diff --git a/target/linux/mvebu/cortexa9/config-6.1 b/target/linux/mvebu/cortexa9/config-6.1
index b2625c3b32..7f825a806b 100644
--- a/target/linux/mvebu/cortexa9/config-6.1
+++ b/target/linux/mvebu/cortexa9/config-6.1
@@ -4,6 +4,9 @@ CONFIG_CURRENT_POINTER_IN_TPIDRURO=y
 CONFIG_IRQSTACKS=y
 CONFIG_LED_TRIGGER_PHY=y
 CONFIG_MTD_SPLIT_SEIL_FW=y
+CONFIG_MTD_SPLIT_UIMAGE_FW=y
+CONFIG_MTD_VIRT_CONCAT=y
 CONFIG_PHY_MVEBU_A38X_COMPHY=y
+CONFIG_POWER_RESET_QNAP=y
 CONFIG_RTC_DRV_MV=y
 CONFIG_THREAD_INFO_IN_TASK=y
diff --git a/target/linux/mvebu/image/cortexa9.mk b/target/linux/mvebu/image/cortexa9.mk
index 3bf8c55e19..a266897c1b 100644
--- a/target/linux/mvebu/image/cortexa9.mk
+++ b/target/linux/mvebu/image/cortexa9.mk
@@ -388,3 +388,22 @@ define Device/solidrun_clearfog-pro-a1
   SUPPORTED_DEVICES += armada-388-clearfog armada-388-clearfog-pro
 endef
 TARGET_DEVICES += solidrun_clearfog-pro-a1
+
+define Device/synology_ds213j
+  DEVICE_VENDOR := Synology
+  DEVICE_MODEL := DS213j
+  KERNEL_SIZE := 6912k
+  IMAGE_SIZE := 7168k
+  FILESYSTEMS := squashfs ubifs
+  KERNEL := kernel-bin | append-dtb | uImage none
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | uImage none
+  DEVICE_DTS := armada-370-synology-ds213j
+  IMAGES := sysupgrade.bin
+  IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
+                          check-size | append-metadata
+  DEVICE_PACKAGES := \
+    kmod-rtc-s35390a kmod-hwmon-gpiofan kmod-hwmon-drivetemp \
+    kmod-md-raid0 kmod-md-raid1 kmod-md-mod e2fsprogs mdadm \
+    -ppp -kmod-nft-offload -firewall4 -dnsmasq -odhcpd-ipv6only
+endef
+TARGET_DEVICES += synology_ds213j
diff --git a/target/linux/mvebu/patches-5.15/320-arm-dts-armada-370-synology-ds213j-mtd-parts.patch b/target/linux/mvebu/patches-5.15/320-arm-dts-armada-370-synology-ds213j-mtd-parts.patch
new file mode 100644
index 0000000000..280fc5957e
--- /dev/null
+++ b/target/linux/mvebu/patches-5.15/320-arm-dts-armada-370-synology-ds213j-mtd-parts.patch
@@ -0,0 +1,134 @@
+--- a/arch/arm/boot/dts/armada-370-synology-ds213j.dts
++++ b/arch/arm/boot/dts/armada-370-synology-ds213j.dts
+@@ -31,6 +31,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
++		append-rootblock = "nullparameter="; /* override the bootloader args */
+ 	};
+ 
+ 	memory@0 {
+@@ -94,6 +95,8 @@
+ 			       status = "okay";
+ 			       phy = <&phy1>;
+ 			       phy-mode = "sgmii";
++		               nvmem-cells = <&macaddr_vendor_0>;
++        		       nvmem-cell-names = "mac-address";
+ 			};
+ 
+ 			sata@a0000 {
+@@ -175,6 +178,24 @@
+ 			gpio = <&gpio1 30 GPIO_ACTIVE_HIGH>;
+ 		};
+ 	};
++
++	virtual_flash {
++		compatible = "mtd-concat";
++
++		devices = <&mtd_kernel &mtd_gap &mtd_gap2>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				compatible = "openwrt,uimage", "denx,uimage";
++				label = "firmware";
++				reg = <0x0 0x0>;
++			};
++		};
++	};
+ };
+ 
+ &mdio {
+@@ -265,48 +286,52 @@
+ 		reg = <0>; /* Chip select 0 */
+ 		spi-max-frequency = <20000000>;
+ 
+-		/*
+-		 * Warning!
+-		 *
+-		 * Synology u-boot uses its compiled-in environment
+-		 * and it seems Synology did not care to change u-boot
+-		 * default configuration in order to allow saving a
+-		 * modified environment at a sensible location. So,
+-		 * if you do a 'saveenv' under u-boot, your modified
+-		 * environment will be saved at 1MB after the start
+-		 * of the flash, i.e. in the middle of the uImage.
+-		 * For that reason, it is strongly advised not to
+-		 * change the default environment, unless you know
+-		 * what you are doing.
+-		 */
+-		partition@0 { /* u-boot */
+-			label = "RedBoot";
+-			reg = <0x00000000 0x000c0000>; /* 768KB */
+-		};
++		partitions {
++			compatible = "fixed-partitions";
+ 
+-		partition@c0000 { /* uImage */
+-			label = "zImage";
+-			reg = <0x000c0000 0x002d0000>; /* 2880KB */
+-		};
++			partition@0 { /* u-boot */
++				label = "u-boot";
++				reg = <0x00000000 0x000c0000>; /* 768KB */
++				read-only;
++			};
+ 
+-		partition@390000 { /* uInitramfs */
+-			label = "rd.gz";
+-			reg = <0x00390000 0x00440000>; /* 4250KB */
+-		};
++			mtd_gap: partition@c0000 { /* gap */
++				label = "gap";
++				reg = <0x000c0000 0x00040000>; /* 256KB */
++			};
+ 
+-		partition@7d0000 { /* MAC address and serial number */
+-			label = "vendor";
+-			reg = <0x007d0000 0x00010000>; /* 64KB */
+-		};
++			partition@100000 { /* u-boot-env */
++				label = "u-boot-env";
++				reg = <0x00100000 0x00010000>; /* 64KB */
++			};
+ 
+-		partition@7e0000 {
+-			label = "RedBoot config";
+-			reg = <0x007e0000 0x00010000>; /* 64KB */
+-		};
++			mtd_kernel: partition@110000 {
++				label = "kernel";
++				reg = <0x00110000 0x006c0000>; /* 6912KB */
++			};
+ 
+-		partition@7f0000 {
+-			label = "FIS directory";
+-			reg = <0x007f0000 0x00010000>; /* 64KB */
++			partition@7d0000 { /* MAC address and serial number */
++				reg = <0x007d0000 0x00010000>; /* 64KB */
++				label = "vendor";
++				read-only;
++
++				compatible = "nvmem-cells";
++
++				nvmem-layout {
++					compatible = "fixed-layout";
++					#address-cells = <1>;
++					#size-cells = <1>;
++
++					macaddr_vendor_0: macaddr@0 {
++						reg = <0x0 0x6>;
++					};
++				};
++			};
++
++			mtd_gap2: partition@7e0000 {
++				label = "gap2";
++				reg = <0x007e0000 0x00020000>; /* 128KB */
++			};
+ 		};
+ 	};
+ };
diff --git a/target/linux/mvebu/patches-6.1/320-arm-dts-armada-370-synology-ds213j-mtd-parts.patch b/target/linux/mvebu/patches-6.1/320-arm-dts-armada-370-synology-ds213j-mtd-parts.patch
new file mode 100644
index 0000000000..280fc5957e
--- /dev/null
+++ b/target/linux/mvebu/patches-6.1/320-arm-dts-armada-370-synology-ds213j-mtd-parts.patch
@@ -0,0 +1,134 @@
+--- a/arch/arm/boot/dts/armada-370-synology-ds213j.dts
++++ b/arch/arm/boot/dts/armada-370-synology-ds213j.dts
+@@ -31,6 +31,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
++		append-rootblock = "nullparameter="; /* override the bootloader args */
+ 	};
+ 
+ 	memory@0 {
+@@ -94,6 +95,8 @@
+ 			       status = "okay";
+ 			       phy = <&phy1>;
+ 			       phy-mode = "sgmii";
++		               nvmem-cells = <&macaddr_vendor_0>;
++        		       nvmem-cell-names = "mac-address";
+ 			};
+ 
+ 			sata@a0000 {
+@@ -175,6 +178,24 @@
+ 			gpio = <&gpio1 30 GPIO_ACTIVE_HIGH>;
+ 		};
+ 	};
++
++	virtual_flash {
++		compatible = "mtd-concat";
++
++		devices = <&mtd_kernel &mtd_gap &mtd_gap2>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				compatible = "openwrt,uimage", "denx,uimage";
++				label = "firmware";
++				reg = <0x0 0x0>;
++			};
++		};
++	};
+ };
+ 
+ &mdio {
+@@ -265,48 +286,52 @@
+ 		reg = <0>; /* Chip select 0 */
+ 		spi-max-frequency = <20000000>;
+ 
+-		/*
+-		 * Warning!
+-		 *
+-		 * Synology u-boot uses its compiled-in environment
+-		 * and it seems Synology did not care to change u-boot
+-		 * default configuration in order to allow saving a
+-		 * modified environment at a sensible location. So,
+-		 * if you do a 'saveenv' under u-boot, your modified
+-		 * environment will be saved at 1MB after the start
+-		 * of the flash, i.e. in the middle of the uImage.
+-		 * For that reason, it is strongly advised not to
+-		 * change the default environment, unless you know
+-		 * what you are doing.
+-		 */
+-		partition@0 { /* u-boot */
+-			label = "RedBoot";
+-			reg = <0x00000000 0x000c0000>; /* 768KB */
+-		};
++		partitions {
++			compatible = "fixed-partitions";
+ 
+-		partition@c0000 { /* uImage */
+-			label = "zImage";
+-			reg = <0x000c0000 0x002d0000>; /* 2880KB */
+-		};
++			partition@0 { /* u-boot */
++				label = "u-boot";
++				reg = <0x00000000 0x000c0000>; /* 768KB */
++				read-only;
++			};
+ 
+-		partition@390000 { /* uInitramfs */
+-			label = "rd.gz";
+-			reg = <0x00390000 0x00440000>; /* 4250KB */
+-		};
++			mtd_gap: partition@c0000 { /* gap */
++				label = "gap";
++				reg = <0x000c0000 0x00040000>; /* 256KB */
++			};
+ 
+-		partition@7d0000 { /* MAC address and serial number */
+-			label = "vendor";
+-			reg = <0x007d0000 0x00010000>; /* 64KB */
+-		};
++			partition@100000 { /* u-boot-env */
++				label = "u-boot-env";
++				reg = <0x00100000 0x00010000>; /* 64KB */
++			};
+ 
+-		partition@7e0000 {
+-			label = "RedBoot config";
+-			reg = <0x007e0000 0x00010000>; /* 64KB */
+-		};
++			mtd_kernel: partition@110000 {
++				label = "kernel";
++				reg = <0x00110000 0x006c0000>; /* 6912KB */
++			};
+ 
+-		partition@7f0000 {
+-			label = "FIS directory";
+-			reg = <0x007f0000 0x00010000>; /* 64KB */
++			partition@7d0000 { /* MAC address and serial number */
++				reg = <0x007d0000 0x00010000>; /* 64KB */
++				label = "vendor";
++				read-only;
++
++				compatible = "nvmem-cells";
++
++				nvmem-layout {
++					compatible = "fixed-layout";
++					#address-cells = <1>;
++					#size-cells = <1>;
++
++					macaddr_vendor_0: macaddr@0 {
++						reg = <0x0 0x6>;
++					};
++				};
++			};
++
++			mtd_gap2: partition@7e0000 {
++				label = "gap2";
++				reg = <0x007e0000 0x00020000>; /* 128KB */
++			};
+ 		};
+ 	};
+ };