diff --git a/Makefile b/Makefile
index c9f84f8251..90ec540931 100644
--- a/Makefile
+++ b/Makefile
@@ -108,7 +108,7 @@ ifeq ($(BR2_TARGET_ROOTFS_UBI),y)
 ifneq ($(filter $(BR2_OPENIPC_SOC_VENDOR),"rockchip" "sigmastar"),)
 	@$(call PREPARE_REPACK,,,rootfs.ubi,16384,nand)
 else
-	@$(call PREPARE_REPACK,uImage,4096,rootfs.ubi,16384,nand)
+	@$(call PREPARE_REPACK,uImage,4096,rootfs.ubi,16384,nand,rootfs.squashfs)
 endif
 endif
 ifeq ($(BR2_TARGET_ROOTFS_INITRAMFS),y)
@@ -149,7 +149,7 @@ endef
 define PREPARE_REPACK
 	$(if $(1),$(call CHECK_SIZE,$(1),$(2)))
 	$(if $(3),$(call CHECK_SIZE,$(3),$(4)))
-	$(call REPACK_FIRMWARE,$(1),$(3),$(5))
+	$(call REPACK_FIRMWARE,$(1),$(3),$(5),$(6))
 endef
 
 define CHECK_SIZE
@@ -164,11 +164,14 @@ define REPACK_FIRMWARE
 	cd $(TARGET)/images && if test -e rootfs.tar; then mv -f rootfs.tar rootfs.$(BR2_OPENIPC_SOC_MODEL).tar; fi
 	$(if $(1),cd $(TARGET)/images && if test -e $(1); then mv -f $(1) $(1).$(BR2_OPENIPC_SOC_MODEL); fi)
 	$(if $(2),cd $(TARGET)/images && if test -e $(2); then mv -f $(2) $(2).$(BR2_OPENIPC_SOC_MODEL); fi)
+	$(if $(4),cd $(TARGET)/images && if test ! -e $(4).$(BR2_OPENIPC_SOC_MODEL) && test -e $(4); then cp -f $(4) $(4).$(BR2_OPENIPC_SOC_MODEL); fi)
 	$(if $(1),cd $(TARGET)/images && md5sum $(1).$(BR2_OPENIPC_SOC_MODEL) > $(1).$(BR2_OPENIPC_SOC_MODEL).md5sum)
 	$(if $(2),cd $(TARGET)/images && md5sum $(2).$(BR2_OPENIPC_SOC_MODEL) > $(2).$(BR2_OPENIPC_SOC_MODEL).md5sum)
+	$(if $(4),cd $(TARGET)/images && md5sum $(4).$(BR2_OPENIPC_SOC_MODEL) > $(4).$(BR2_OPENIPC_SOC_MODEL).md5sum)
 	$(if $(1),$(eval KERNEL = $(1).$(BR2_OPENIPC_SOC_MODEL) $(1).$(BR2_OPENIPC_SOC_MODEL).md5sum),$(eval KERNEL =))
 	$(if $(2),$(eval ROOTFS = $(2).$(BR2_OPENIPC_SOC_MODEL) $(2).$(BR2_OPENIPC_SOC_MODEL).md5sum),$(eval ROOTFS =))
+	$(if $(4),$(eval EXTRA = $(4).$(BR2_OPENIPC_SOC_MODEL) $(4).$(BR2_OPENIPC_SOC_MODEL).md5sum),$(eval EXTRA =))
 	$(eval ARCHIVE = openipc.$(BR2_OPENIPC_SOC_MODEL)-$(3)-$(BR2_OPENIPC_VARIANT).tgz)
-	cd $(TARGET)/images && tar -czf $(ARCHIVE) $(KERNEL) $(ROOTFS)
+	cd $(TARGET)/images && tar -czf $(ARCHIVE) $(KERNEL) $(ROOTFS) $(EXTRA)
 	rm -f $(TARGET)/images/*.md5sum
 endef
diff --git a/br-ext-chip-hisilicon/configs/hi3516av100_ultimate_defconfig b/br-ext-chip-hisilicon/configs/hi3516av100_ultimate_defconfig
index 39fd6e3744..aa2da83209 100644
--- a/br-ext-chip-hisilicon/configs/hi3516av100_ultimate_defconfig
+++ b/br-ext-chip-hisilicon/configs/hi3516av100_ultimate_defconfig
@@ -25,6 +25,7 @@ BR2_LINUX_KERNEL_XZ=y
 
 # Filesystem
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL)/package/busybox/busybox.config"
+BR2_PACKAGE_MTD=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPTABLES=y
@@ -42,7 +43,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_XZ=y
 BR2_TARGET_ROOTFS_UBI=y
 BR2_TARGET_ROOTFS_UBI_SUBSIZE=2048
 BR2_TARGET_ROOTFS_UBI_USE_CUSTOM_CONFIG=y
-BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize.cfg"
+BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize_hisilicon.cfg"
 BR2_TARGET_ROOTFS_UBIFS_LEBSIZE=0x1f000
 
 # OpenIPC
diff --git a/br-ext-chip-hisilicon/configs/hi3516av200_ultimate_defconfig b/br-ext-chip-hisilicon/configs/hi3516av200_ultimate_defconfig
index b8162ca099..f6518ae7ae 100644
--- a/br-ext-chip-hisilicon/configs/hi3516av200_ultimate_defconfig
+++ b/br-ext-chip-hisilicon/configs/hi3516av200_ultimate_defconfig
@@ -25,6 +25,7 @@ BR2_LINUX_KERNEL_XZ=y
 
 # Filesystem
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL)/package/busybox/busybox.config"
+BR2_PACKAGE_MTD=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPTABLES=y
@@ -42,7 +43,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_XZ=y
 BR2_TARGET_ROOTFS_UBI=y
 BR2_TARGET_ROOTFS_UBI_SUBSIZE=2048
 BR2_TARGET_ROOTFS_UBI_USE_CUSTOM_CONFIG=y
-BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize.cfg"
+BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize_hisilicon.cfg"
 BR2_TARGET_ROOTFS_UBIFS_LEBSIZE=0x1f000
 
 # OpenIPC
diff --git a/br-ext-chip-hisilicon/configs/hi3516cv300_ultimate_defconfig b/br-ext-chip-hisilicon/configs/hi3516cv300_ultimate_defconfig
index 8c95ba89f1..383378f265 100644
--- a/br-ext-chip-hisilicon/configs/hi3516cv300_ultimate_defconfig
+++ b/br-ext-chip-hisilicon/configs/hi3516cv300_ultimate_defconfig
@@ -22,6 +22,7 @@ BR2_LINUX_KERNEL_XZ=y
 
 # Filesystem
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL)/package/busybox/busybox.config"
+BR2_PACKAGE_MTD=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPTABLES=y
@@ -39,7 +40,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_XZ=y
 BR2_TARGET_ROOTFS_UBI=y
 BR2_TARGET_ROOTFS_UBI_SUBSIZE=2048
 BR2_TARGET_ROOTFS_UBI_USE_CUSTOM_CONFIG=y
-BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize.cfg"
+BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize_hisilicon.cfg"
 BR2_TARGET_ROOTFS_UBIFS_LEBSIZE=0x1f000
 
 # OpenIPC
diff --git a/br-ext-chip-hisilicon/configs/hi3516dv100_ultimate_defconfig b/br-ext-chip-hisilicon/configs/hi3516dv100_ultimate_defconfig
index a65acb46f0..cad628458d 100644
--- a/br-ext-chip-hisilicon/configs/hi3516dv100_ultimate_defconfig
+++ b/br-ext-chip-hisilicon/configs/hi3516dv100_ultimate_defconfig
@@ -25,6 +25,7 @@ BR2_LINUX_KERNEL_XZ=y
 
 # Filesystem
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL)/package/busybox/busybox.config"
+BR2_PACKAGE_MTD=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPTABLES=y
@@ -42,7 +43,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_XZ=y
 BR2_TARGET_ROOTFS_UBI=y
 BR2_TARGET_ROOTFS_UBI_SUBSIZE=2048
 BR2_TARGET_ROOTFS_UBI_USE_CUSTOM_CONFIG=y
-BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize.cfg"
+BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize_hisilicon.cfg"
 BR2_TARGET_ROOTFS_UBIFS_LEBSIZE=0x1f000
 
 # OpenIPC
diff --git a/br-ext-chip-hisilicon/configs/hi3516ev200_ultimate_defconfig b/br-ext-chip-hisilicon/configs/hi3516ev200_ultimate_defconfig
index 44b831c73f..f4d342c1fc 100644
--- a/br-ext-chip-hisilicon/configs/hi3516ev200_ultimate_defconfig
+++ b/br-ext-chip-hisilicon/configs/hi3516ev200_ultimate_defconfig
@@ -25,6 +25,7 @@ BR2_LINUX_KERNEL_XZ=y
 
 # Filesystem
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL)/package/busybox/busybox.config"
+BR2_PACKAGE_MTD=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPTABLES=y
@@ -42,7 +43,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_XZ=y
 BR2_TARGET_ROOTFS_UBI=y
 BR2_TARGET_ROOTFS_UBI_SUBSIZE=2048
 BR2_TARGET_ROOTFS_UBI_USE_CUSTOM_CONFIG=y
-BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize.cfg"
+BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize_hisilicon.cfg"
 BR2_TARGET_ROOTFS_UBIFS_LEBSIZE=0x1f000
 
 # OpenIPC
diff --git a/br-ext-chip-hisilicon/configs/hi3516ev300_ultimate_defconfig b/br-ext-chip-hisilicon/configs/hi3516ev300_ultimate_defconfig
index efda07b598..9e51bbb760 100644
--- a/br-ext-chip-hisilicon/configs/hi3516ev300_ultimate_defconfig
+++ b/br-ext-chip-hisilicon/configs/hi3516ev300_ultimate_defconfig
@@ -26,6 +26,7 @@ BR2_LINUX_KERNEL_XZ=y
 # Filesystem
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL)/package/busybox/busybox.config"
 BR2_PACKAGE_EXFATPROGS=y
+BR2_PACKAGE_MTD=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPTABLES=y
@@ -43,7 +44,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_XZ=y
 BR2_TARGET_ROOTFS_UBI=y
 BR2_TARGET_ROOTFS_UBI_SUBSIZE=2048
 BR2_TARGET_ROOTFS_UBI_USE_CUSTOM_CONFIG=y
-BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize.cfg"
+BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize_hisilicon.cfg"
 BR2_TARGET_ROOTFS_UBIFS_LEBSIZE=0x1f000
 
 # OpenIPC
diff --git a/br-ext-chip-hisilicon/configs/hi3518ev200_ultimate_defconfig b/br-ext-chip-hisilicon/configs/hi3518ev200_ultimate_defconfig
index 8edb39287e..87b7b1136d 100644
--- a/br-ext-chip-hisilicon/configs/hi3518ev200_ultimate_defconfig
+++ b/br-ext-chip-hisilicon/configs/hi3518ev200_ultimate_defconfig
@@ -22,6 +22,7 @@ BR2_LINUX_KERNEL_XZ=y
 
 # Filesystem
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL)/package/busybox/busybox.config"
+BR2_PACKAGE_MTD=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPTABLES=y
@@ -39,7 +40,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_XZ=y
 BR2_TARGET_ROOTFS_UBI=y
 BR2_TARGET_ROOTFS_UBI_SUBSIZE=2048
 BR2_TARGET_ROOTFS_UBI_USE_CUSTOM_CONFIG=y
-BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize.cfg"
+BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize_hisilicon.cfg"
 BR2_TARGET_ROOTFS_UBIFS_LEBSIZE=0x1f000
 
 # OpenIPC
diff --git a/br-ext-chip-hisilicon/configs/hi3518ev300_ultimate_defconfig b/br-ext-chip-hisilicon/configs/hi3518ev300_ultimate_defconfig
index f22c73cdb8..f2b0783ae1 100644
--- a/br-ext-chip-hisilicon/configs/hi3518ev300_ultimate_defconfig
+++ b/br-ext-chip-hisilicon/configs/hi3518ev300_ultimate_defconfig
@@ -25,6 +25,7 @@ BR2_LINUX_KERNEL_XZ=y
 
 # Filesystem
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL)/package/busybox/busybox.config"
+BR2_PACKAGE_MTD=y
 BR2_PACKAGE_UBOOT_TOOLS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPTABLES=y
@@ -42,7 +43,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_XZ=y
 BR2_TARGET_ROOTFS_UBI=y
 BR2_TARGET_ROOTFS_UBI_SUBSIZE=2048
 BR2_TARGET_ROOTFS_UBI_USE_CUSTOM_CONFIG=y
-BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize.cfg"
+BR2_TARGET_ROOTFS_UBI_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL)/scripts/ubifs/ubinize_hisilicon.cfg"
 BR2_TARGET_ROOTFS_UBIFS_LEBSIZE=0x1f000
 
 # OpenIPC
diff --git a/general/overlay/init b/general/overlay/init
index c25f4075ec..53fcc0514d 100755
--- a/general/overlay/init
+++ b/general/overlay/init
@@ -11,7 +11,7 @@ mount -t proc proc /proc || exit 1
 grep -q overlay /proc/filesystems || exit 1
 
 if ! grep -q 'root=.*nfs\|mmcblk\|ram' /proc/cmdline; then
-	if grep -q ubifs /proc/cmdline; then
+	if grep -qE 'rootfstype=ubifs|ubi\.block=|ubi\.mtd=' /proc/cmdline; then
 		mount -t ubifs ubi0:rootfs_data /overlay
 	else
 		mtdblkdev=$(awk -F ':' '/rootfs_data/ {print $1}' /proc/mtd | sed 's/mtd/mtdblock/')
diff --git a/general/overlay/usr/sbin/sysupgrade b/general/overlay/usr/sbin/sysupgrade
index 1306662912..966cc59124 100755
--- a/general/overlay/usr/sbin/sysupgrade
+++ b/general/overlay/usr/sbin/sysupgrade
@@ -44,14 +44,27 @@ do_update_kernel() {
 		fi
 		compare_versions "$kernel_version" "$(get_kernel_version "$x")" && return 0
 	fi
-	set_progress flashcp -v "$x" "$kernel_device"
+	if [ "$flash_type" = "nand" ]; then
+		echo "Erasing kernel partition..."
+		flash_eraseall "$kernel_device"
+		echo "Writing kernel..."
+		nandwrite -p "$kernel_device" "$x"
+	else
+		set_progress flashcp -v "$x" "$kernel_device"
+	fi
 	echo_c 32 "Kernel updated to $(get_kernel_version "$kernel_device")"
 }
 
 do_update_rootfs() {
 	local x=$1
-	[ -z "$x" ] && x="/tmp/rootfs.squashfs.$soc"
 	echo_c 33 "\nRootFS"
+
+	if [ "$flash_type" = "nand" ]; then
+		do_update_rootfs_nand "$x"
+		return $?
+	fi
+
+	[ -z "$x" ] && x="/tmp/rootfs.squashfs.$soc"
 	echo "Update rootfs from $x"
 	[ ! -f "$x" ] && die "File $x not found"
 	local y=/tmp/rootfs
@@ -68,18 +81,178 @@ do_update_rootfs() {
 	echo_c 32 "RootFS updated to $rootfs_version"
 }
 
+compute_new_bootargs() {
+	# One-shot, idempotent migration from UBIFS-rootfs cmdline to squashfs-on-ubiblock cmdline.
+	# Returns the new bootargs string on stdout; empty if no change is needed.
+	# $1 = UBI MTD partition number (e.g., "3"); used to add ubi.mtd= if missing.
+	local current new ubi_mtd=$1
+	current=$(fw_printenv -n bootargs 2>/dev/null) || return 1
+	new=$(echo "$current" | sed -e 's|root=ubi0:rootfs|root=/dev/ubiblock0_0|' \
+				 -e 's|rootfstype=ubifs|rootfstype=squashfs|')
+	echo "$new" | grep -q 'ubi\.block=' || new="$new ubi.block=0,0"
+	# 2048 = NAND subpage size in bytes; matches BR2_TARGET_ROOTFS_UBI_SUBSIZE in HiSilicon NAND defconfigs.
+	echo "$new" | grep -q 'ubi\.mtd=' || new="$new ubi.mtd=${ubi_mtd},2048"
+	# Without init=/init the kernel runs /sbin/init directly and skips the overlayfs pivot,
+	# leaving / on the read-only squashfs.
+	echo "$new" | grep -q 'init=' || new="$new init=/init"
+	[ "$current" = "$new" ] && return 0
+	echo "$new"
+}
+
+do_update_rootfs_nand() {
+	local rootfs_ubi=/tmp/rootfs.ubi.$soc
+	local rootfs_squashfs=/tmp/rootfs.squashfs.$soc
+	local x=${1:-$rootfs_ubi}
+
+	# Determine UBI MTD partition number
+	local ubi_dev=$(get_device "ubi")
+	local ubi_mtd_num=$(echo "$ubi_dev" | grep -o '[0-9]*$')
+	[ -z "$ubi_dev" ] || [ -z "$ubi_mtd_num" ] && die "Cannot find UBI MTD partition!"
+	echo "UBI partition: $ubi_dev (mtd$ubi_mtd_num)"
+
+	# Pick the upgrade strategy:
+	#   updatevol — fastest, preserves rootfs_data by construction. Used when the
+	#               release tarball ships rootfs.squashfs AND the camera is already
+	#               on the SquashFS-on-UBI layout (rootfs_data volume present).
+	#   ubiformat — full UBI MTD rewrite. Required for first-hop migration from
+	#               legacy UBIFS-rootfs firmware to the new layout. Destructive
+	#               to rootfs_data.
+	#   legacy    — flash_eraseall+nandwrite. Only when running on pre-this-PR
+	#               firmware that does not ship mtd-utils. Destructive.
+	local mode
+	if [ -f "$rootfs_squashfs" ] && [ -e /dev/ubi0_1 ] && [ "1" != "$clear_overlay" ]; then
+		mode=updatevol
+		x="$rootfs_squashfs"
+	elif command -v ubiformat >/dev/null 2>&1; then
+		mode=ubiformat
+		[ ! -f "$x" ] && die "File $x not found"
+	else
+		mode=legacy
+		[ ! -f "$x" ] && die "File $x not found"
+		echo_c 31 "ubiformat not available on running firmware — falling back to legacy flash."
+		echo_c 31 "User data will be erased on this upgrade. Subsequent upgrades will preserve it."
+	fi
+	echo "Update rootfs (NAND, $mode) from $x"
+
+	local new_bootargs
+	new_bootargs=$(compute_new_bootargs "$ubi_mtd_num") || die "Cannot read U-Boot bootargs"
+
+	echo_c 33 "Preparing tmpfs root for NAND upgrade..."
+
+	local nr=/tmp/newroot
+	mkdir -p "$nr"
+	mount -t tmpfs tmpfs "$nr"
+	mkdir -p "$nr/bin" "$nr/lib" "$nr/dev" "$nr/proc" "$nr/tmp" "$nr/oldroot" "$nr/etc"
+
+	cp /bin/busybox "$nr/bin/busybox"
+	cp /lib/ld-musl-arm*.so.1 "$nr/lib/" 2>/dev/null
+	[ "$mode" = ubiformat ] && cp "$(command -v ubiformat)" "$nr/bin/ubiformat"
+	# fw_setenv (and its dereferenced fw_printenv binary) needed for post-flash bootargs migration
+	if [ -n "$new_bootargs" ]; then
+		fw_bin=$(readlink -f "$(command -v fw_setenv)")
+		[ -n "$fw_bin" ] && cp "$fw_bin" "$nr/bin/fw_setenv"
+		[ -f /etc/fw_env.config ] && cp /etc/fw_env.config "$nr/etc/fw_env.config"
+	fi
+	cp "$x" "$nr/tmp/rootfs.image"
+
+	mount --bind /dev "$nr/dev"
+	mount -t proc proc "$nr/proc"
+
+	cat > "$nr/tmp/flash.sh" << FLASHEOF
+#!/bin/busybox sh
+export PATH=/bin
+busybox --install -s /bin
+# Mirror progress to /dev/console so the UART log captures the post-pivot phase.
+exec > /dev/console 2>&1
+
+echo "Unmounting old root filesystems..."
+for d in overlay rom tmp run dev/shm dev/pts sys; do
+	umount -l /oldroot/\$d 2>/dev/null
+done
+umount -l /oldroot 2>/dev/null
+sleep 1
+
+echo "Detaching UBI from mtd${ubi_mtd_num}..."
+ubidetach -m ${ubi_mtd_num} 2>/dev/null
+sleep 1
+
+case "${mode}" in
+updatevol)
+	echo "Re-attaching UBI to update rootfs volume in place..."
+	ubiattach -m ${ubi_mtd_num} || { echo "ubiattach failed"; sleep 5; reboot -f; }
+	for i in 1 2 3 4 5 6 7 8 9 10; do
+		[ -e /dev/ubi0_0 ] && break
+		sleep 1
+	done
+	echo "ubiupdatevol /dev/ubi0_0 with rootfs.squashfs..."
+	ubiupdatevol /dev/ubi0_0 /tmp/rootfs.image \
+		|| { echo "ubiupdatevol failed"; sleep 5; reboot -f; }
+	echo "Rootfs volume updated; rootfs_data left intact."
+	ubidetach -m ${ubi_mtd_num} 2>/dev/null
+	;;
+ubiformat)
+	# flash_eraseall first so ubiformat does not skip blocks UBI previously marked bad,
+	# which would otherwise retain stale EC headers and image_seq → kernel attach panic.
+	echo "Erasing /dev/mtd${ubi_mtd_num}..."
+	flash_eraseall /dev/mtd${ubi_mtd_num}
+	echo "ubiformat /dev/mtd${ubi_mtd_num} with rootfs.ubi..."
+	ubiformat -y -f /tmp/rootfs.image /dev/mtd${ubi_mtd_num} \
+		|| { echo "ubiformat failed"; sleep 5; reboot -f; }
+	;;
+legacy)
+	echo "Erasing /dev/mtd${ubi_mtd_num}..."
+	flash_eraseall /dev/mtd${ubi_mtd_num}
+	echo "Writing rootfs.ubi to /dev/mtd${ubi_mtd_num}..."
+	nandwrite -p /dev/mtd${ubi_mtd_num} /tmp/rootfs.image
+	;;
+esac
+
+# Migrate U-Boot bootargs only after a successful flash, so a flash failure does not
+# leave the env pointing at a rootfs that does not exist.
+if [ -n "${new_bootargs}" ] && [ -x /bin/fw_setenv ]; then
+	echo "Updating U-Boot bootargs for SquashFS-on-UBI rootfs..."
+	fw_setenv bootargs "${new_bootargs}" || echo "Warning: fw_setenv failed; manual recovery may be needed."
+fi
+
+echo "NAND upgrade complete. Rebooting..."
+sync
+reboot -f
+FLASHEOF
+	chmod +x "$nr/tmp/flash.sh"
+
+	if [ "1" = "$skip_reboot" ]; then
+		echo_c 33 "Note: NAND rootfs update requires immediate reboot. -x flag ignored."
+	fi
+
+	echo_c 33 "Performing pivot_root to tmpfs and flashing NAND..."
+	cd "$nr"
+	pivot_root . oldroot
+	exec /bin/busybox sh /tmp/flash.sh
+}
+
 do_wipe_overlay() {
 	echo_c 33 "\nOverlayFS"
 	echo "Erase overlay partition"
-	[ "$flash_type" = "nand" ] || jffs2="-j"
-	set_progress flash_eraseall $jffs2 "$(get_device "rootfs_data")"
+	if [ "$flash_type" = "nand" ]; then
+		# Truncate the rootfs_data UBI volume without destroying rootfs
+		if [ -e /dev/ubi0_1 ]; then
+			ubiupdatevol /dev/ubi0_1 -t
+		else
+			flash_eraseall "$(get_device "rootfs_data")"
+		fi
+	else
+		set_progress flash_eraseall -j "$(get_device "rootfs_data")"
+	fi
 }
 
 download_firmware() {
-	[ "$flash_type" = "nand" ] && echo_c 31 "\nNote: the updater uses the NOR package for updating NAND"
 	echo_c 33 "\nFirmware"
 	osr=$(get_system_build)
-	build="$soc-nor-$osr"
+	if [ "$flash_type" = "nand" ]; then
+		build="$soc-nand-$osr"
+	else
+		build="$soc-nor-$osr"
+	fi
 	if [ -n "$archive" ]; then
 		[ ! -f "$archive" ] && die "File $archive not found"
 		gzip -d "$archive" -c | tar xf - -C /tmp && echo_c 32 "Local archive unpacked" || die "Cannot extract $archive"
diff --git a/general/package/hisilicon-osdrv-hi3516ev200/files/script/set_allocator b/general/package/hisilicon-osdrv-hi3516ev200/files/script/set_allocator
index 618691ab5d..22993f9ef5 100755
--- a/general/package/hisilicon-osdrv-hi3516ev200/files/script/set_allocator
+++ b/general/package/hisilicon-osdrv-hi3516ev200/files/script/set_allocator
@@ -1,17 +1,11 @@
 #!/bin/sh
 
 
-get_env() {
-  bootargs=$(fw_printenv -n bootargs)
-  mem=$(echo ${bootargs} | awk -F '=' '$1=="mem"{print $2}' RS=' ')
-  console=$(echo ${bootargs} | awk -F '=' '$1=="console"{print $2}' RS=' ')
-  panic=$(echo ${bootargs} | awk -F '=' '$1=="panic"{print $2}' RS=' ')
-  rootfstype=$(echo ${bootargs} | awk -F '=' '$1=="rootfstype"{print $2}' RS=' ')
-  root=$(echo ${bootargs} | awk -F '=' '$1=="root"{print $2}' RS=' ')
-  init=$(echo ${bootargs} | awk -F '=' '$1=="init"{print $2}' RS=' ')
-  mtdparts=$(echo ${bootargs} | awk -F '=' '$1=="mtdparts"{print $2}' RS=' ')
-  osmem=$(fw_printenv -n osmem)
-  totalmem=$(fw_printenv -n totalmem)
+# Strip mem=, mmz_allocator=, mmz= from bootargs while preserving all other keys.
+# Also adjusts mem= to the requested value. Other keys (root=, rootfstype=, ubi.mtd=,
+# ubi.block=, mtdparts=, init=, console=, panic=, ...) round-trip unchanged.
+strip_managed() {
+  echo "$1" | tr ' ' '\n' | grep -vE '^(mem|mmz_allocator|mmz)=' | paste -sd ' '
 }
 
 calc_mmz() {
@@ -26,20 +20,22 @@ calc_mmz() {
 }
 
 
+bootargs=$(fw_printenv -n bootargs)
+osmem=$(fw_printenv -n osmem)
+totalmem=$(fw_printenv -n totalmem)
+preserved=$(strip_managed "$bootargs")
+
 if [[ "$1" == 'hisi' ]]; then
   echo "Allocator selected as hisi..."
-  get_env
   mem=${osmem:=32M}
-  newbootargs="mem=${mem} console=${console} panic=${panic} rootfstype=${rootfstype} root=${root} init=${init} mtdparts=${mtdparts} mmz_allocator=hisi"
+  newbootargs="mem=${mem} ${preserved} mmz_allocator=hisi"
   echo ${newbootargs}
   fw_setenv bootargs ${newbootargs}
-  #
 elif [[ "$1" == 'cma'  ]]; then
   echo "Allocator selected as cma..."
-  get_env
   calc_mmz
   mem=${totalmem:=64M}
-  newbootargs="mem=${mem} console=${console} panic=${panic} rootfstype=${rootfstype} root=${root} init=${init} mtdparts=${mtdparts} mmz_allocator=cma mmz=${mmz}"
+  newbootargs="mem=${mem} ${preserved} mmz_allocator=cma mmz=${mmz}"
   fw_setenv bootargs ${newbootargs}
   echo ${newbootargs}
 else
diff --git a/general/scripts/ubifs/ubinize_hisilicon.cfg b/general/scripts/ubifs/ubinize_hisilicon.cfg
new file mode 100644
index 0000000000..9d0dd5ac9b
--- /dev/null
+++ b/general/scripts/ubifs/ubinize_hisilicon.cfg
@@ -0,0 +1,17 @@
+[rootfs]
+mode=ubi
+vol_id=0
+vol_type=dynamic
+vol_name=rootfs
+vol_alignment=1
+vol_size=32MiB
+image=BINARIES_DIR/rootfs.squashfs
+
+[data]
+mode=ubi
+vol_id=1
+vol_type=dynamic
+vol_name=rootfs_data
+vol_alignment=1
+vol_size=2MiB
+vol_flags=autoresize